On 1 November 2010, an Airbus A330-302, registered VH-EBF (EBF), departed Phuket, Thailand on a scheduled passenger flight to Sydney, New South Wales.
When the aircraft was approaching overhead Kuala Lumpur International Airport, Malaysia, in icing conditions, the aircraft systems indicated a loss of total air temperature (TAT) data. This resulted in the loss of autopilot and autothrottle capabilities. The crew attempted to resolve the fault but were unable to restore the auto-flight capabilities.
The crew conferred with company operational and maintenance personnel and elected to divert to Singapore. The aircraft landed in Singapore without further incident.
Analysis of the data from the flight data recorder indicated that both TAT probes failed during the incident flight, triggering the loss of autoflight capabilities. The manufacturer suspected that the TAT probes failed due to icing.
A new TAT probe was certified for the A330 aircraft and issued through an optional Service Bulletin in 2008. As of November 2010, there had been no reported events of multiple failures involving the new TAT probes. At the time of the incident, EBF was not fitted with one of the new TAT probes.
Occurrence summary
Investigation number
AO-2010-086
Occurrence date
01/11/2010
Location
overhead Kuala Lumpur International Airport Malaysia
On 20 March 2010, an Airbus A320-232 aircraft, registered VH-JQX, was conducting a scheduled passenger flight from Brisbane to Mackay, Queensland. On decent into Mackay, the crew received multiple Electronic Centralized Aircraft Monitoring (ECAM)[1] messages.
At the same time, the autopilot and engine autothrust disengaged and the primary flight displays (PFD) lost airspeed, altitude and descent data. After about two minutes, all data returned to the primary flight displays. Engine autothrust and the autopilot were re-engaged and the aircraft continued without further incident to land at Mackay.
Recorded data from the event enabled a number of precautionary actions to be completed by the operator with no faults found.
On 5 August 2009, during on a scheduled flight from Melbourne, Victoria (Vic) to Mackay, Queensland (Qld), the flight crew of an Airbus A320-232 aircraft, registered VH-VND, were advised of an electrical burning smell in the mid cabin area. Within 5 minutes of that advice, multiple left and right engine warnings were observed on the electronic centralised aircraft monitoring (ECAM) display. The flight was diverted to Canberra, Australian Capital Territory (ACT) where an uneventful landing was conducted.
Subsequent examination found the electrical burning smell had originated from a fluorescent light ballast resistor in the cabin. The ECAM warnings were attributed to an internal fault in the number 2 display management computer (DMC).
Following similar incidents, the DMC manufacturer introduced a cyclic software check of parameters used in the receiving function, with an auto reset of the DMC if corrupted parameters were identified.
The aircraft manufacturer reviewed its operational procedures and provided operators with additional procedures for flight crew to transfer from a faulty DMC to an alternate DMC during flight or reset a faulty DMC on the ground.
On 31 May 2007, the pilot of a Beech Aircraft Corp. Super King Air, registered VH-XCB, was conducting an Area Navigation (RNAV) Global Navigation Satellite System (GNSS) non-precision approach (NPA) to runway 36 at Ballarat, Vic. in instrument meteorological conditions (IMC) as part of a check flight for renewal of a command instrument rating. While conducting the approach, the check pilot on board visually determined that the aircraft was displaced outside the permitted lateral tolerances of the published final approach track. The pilot's primary flight display showed that the aircraft was within permitted tolerances and there were no associated messages or alerts.
An examination of the aircraft's navigation equipment by an avionics technician found that the installation was not approved for the procedure and a technical problem prevented the equipment from meeting approval standards.
The operator of the aircraft annotated the aircraft's maintenance release to reflect that the Global Positioning System (GPS) was not approved for use in the conduct of RNAV (GNSS) NPAs.
On 7 April 2009, at about 1210 Eastern Standard Time, the flight crew of a Boeing 737-800 aircraft, registered VH-VYL, received an enhanced ground proximity warning system alert during an approach to land at Sydney Airport, NSW. At the same time, the autopilot disconnected, and the engine thrust levers moved towards idle. The handling pilot corrected the engine thrust levers immediately and conducted an uneventful landing.
The investigation determined that spurious data from the left radio altimeter (RA) provided an indicated altitude of minus 7 ft, resulting in the autopilot disconnecting and the thrust lever movement.
An examination found that the left RA receive antenna displayed rubbing wear adjacent to the attachment screw inserts. A bonding check of the antenna indicated that the antenna's resistance was outside the aircraft manufacturer's limits. The antenna was replaced, and the aircraft was returned to service.
Three months after the occurrence, a further RA warning flag event was experienced by another crew in this aircraft. As a result of that event, the left and right RA transceivers were removed and tested with internal faults found on the left unit.
At 0938 Central Standard Time on 2 August 2006, a Boeing Company 717-200 aircraft, registered VH-NXE, took off from Alice Springs Airport, NT, on a scheduled flight to Perth, WA.
The applicable aircraft take-off settings and techniques were applied by the flight crew for the takeoff. The recorded data showed that, 4 seconds after lift off, when about 31 ft above the runway, the aircraft's stall warning system activated for 4 seconds, and that the aircraft did not approach an aerodynamic stall condition at any time during the stick shaker activation. In response to the activation of the stick shaker, the flight crew increased engine thrust and reduced the aircraft's pitch attitude.
It is almost certain that an incorrect left wing slat sensor signal was received by the proximity sensing electronics unit (PSEU) from one of the two left wing slats proximity sensors. Consequently, the different slat position signals from the two sensors in the left wing resulted in the PSEU defaulting to the slats not-extended indication for the left wing. As a result of the different slat position signals sent by the proximity sensing electronics unit for the left wing (slats not-extended) and right wing (slats extended), the aircraft's flight control computers used the flaps-extended/slats-retracted stick shaker angle of attack schedule, leading to stick shaker activation and other stall indications.
Although no explanation could be found for the incorrect signal received by the PSEU from one of the two left wing slats proximity sensors, the aircraft manufacturer concluded that there did not appear to be a systemic problem in the worldwide 717 fleet.
The ATSB has completed its technical analysis report of the flight recorder data from the Boeing Co. 737-329, registration PK-KKE on behalf of the Indonesian National Transportation Safety Committee. The aircraft was operating a flight from Jakarta to Makassar, Indonesia when it was involved in a serious (navigation related) incident while enroute. The crew landed safely at Tambolaka in Sumba.
The National Transportation Safety Committee (NTSC) of Indonesia is responsible for investigating this occurrence. The NTSC requested assistance from the Australian Transport Safety Bureau (ATSB) in the recovery and analysis of information from the flight data recorder and cockpit voice recorder. In accordance with clause 5.23 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an Accredited Representative to assist the NTSC and initiated an investigation under the Transport Safety Investigation Act 2003.
The ATSB's Technical Analysis Report has been sent to the NTSC to assist its ongoing investigation. The NTSC is responsible for releasing a final investigation report regarding this occurrence.
National Transportation Safety Committee Ministry Of Transportation Republic Of Indonesia Transportation Building 3rd Floor Jalan Medan Merdeka Timur No. 5 Jakarta Pusat 10110 Indonesia
As a result of this occurrence the operator has advised that a Flight Operations Memo will be issued to all 717 pilots highlighting this incident and detailing the FMS modes which remain available during abnormal FMS operation.
Findings
FINDINGS
During the flight, the amount of generated VIA BITE data exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.
The available BITE data showed that FMC 2 was unable to sequence the ‘400 ft course to altitude’ leg associated with the SWIFT SIX SID. Eventually, FMC 2 performed a software reset but was unable to recover and latched.
A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.
Analysis
ANALYSIS
The FMS performance reported by the crew was consistent with FMC 2 performing a progressive series of resets before it latched. A similar progression of resets then occurred for FMC 1 but, in accordance with its design, it did not latch and was available for use but with the flight plan information cleared. During the resetting process, the FMS response would have been confusing to the crew and consistent with the crew’s observation of the ‘FMS locking us out’.
With FMC 2 latched, the MENU page would have been displayed on the copilot’s multi-function control and display unit (MCDU) but with the FMC 2 prompt missing from the top left data field. The standby navigation/radio (STANDBY NAV/RAD*) prompt would also have been displayed on the MCDU and ‘MAP FAIL’ displayed on the copilot’s navigation display. Once the resetting was completed, then an ILS frequency could be tuned using the STANDBY NAV/RAD page on either the pilot in command’s (PIC) or copilot’s MCDU.
The PIC was the handling pilot during the flight. Normally the PIC’s MCDU will interact with FMC 1 and the copilot’s MCDU will interact with FMC 2. With FMC 2 latched, it was necessary for the copilot to change his source select switch to ‘FO ON 1’ to access FMC 1.
During the investigation the VIA manufacturer advised that no other FMS problems of this nature had been reported.
Factual Information
FACTUAL INFORMATION
The Boeing 717-200 (717) was taxiing at Cairns Qld for a scheduled service to Brisbane Qld. As part of the preparation for the flight, the crew had entered flight plan details into the aircraft's flight management system (FMS). While taxiing, due to intermittent rain showers at Cairns, the 717 crew then programmed the FMS with wet runway speed figures for takeoff.
The crew reported that late in the take-off roll the manually entered wet speeds were lost from the airspeed tape on the primary flight display and FMS-generated speeds were displayed. At rotation 'MAP FAIL'1 appeared on both navigation displays. The aircraft was manually turned onto the SWIFT SIX standard instrument departure2 (SID).
Figure 1: SWIFT SIX SID
After approximately 1 ½ minutes, just after the turn onto 030°, the MAP displays returned to normal and flight plan integrity appeared to have been maintained. Later, during the turn to SWIFT, the 'MAP FAIL' indication returned. The crew reported that 'the FMS had locked us out'. Eventually the crew were able to enter the instrument landing system (ILS) frequency, but FMS operation did not appear to be reliable. The aircraft was radar vectored for a return to Cairns while maintaining visual meteorological conditions (VMC). The crew conducted a visual approach to runway 15 and the aircraft landed 32 minutes after take-off.
1.1 Versatile integrated avionics (VIA) units
The aircraft was equipped with two VIA units, VIA 1 and VIA 2. The VIA units provide the following functions:
Displays
Flight Management System
Autoflight / Autothrottle
Communications Management
Flight Warning / Aural Warning
Central Maintenance
Digital Flight Data Acquisition.
The latest FMS software, VIA-906 (Part number PS4081970-906), was installed in both VIA units. The flight management computer (FMC) is the VIA hardware that provides the FMS function.
One VIA unit is designated master and the other slave. The selection of master and slave is determined by the selection of autopilot. If the pilot in command's (PIC) autopilot is selected, then FMC 1 is considered the master and if the copilot's autopilot is selected then FMC 2 is considered the master.
1.2 FMC latch
While a fault condition exists the FMC system will progress through a series of resets: warm start, cold start, software reset and latch (shutdown). The progression of resets is designed to clear increasingly larger parts of the FMC eventually leaving a crew with a usable FMC but no flight plan data. If the software reset is unsuccessful then the FMC will latch. The FMC requires a power cycle3 to restart after it has latched.
1.3 VIA built-in test equipment (BITE) data
Each VIA unit stores BITE data in non-volatile memory4. Following the incident, VIA 2 was sent to the manufacturer in the USA for download of the BITE data and bench testing. BITE data from VIA 1 was downloaded by a manufacturer's representative in Australia and forwarded to the manufacturer.
The non-volatile memory size in each VIA unit was fixed, therefore, the oldest data was overwritten by the newest. During the flight, the amount of BITE data generated exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.
The oldest BITE data that was recorded indicated that FMC 2 was trying to sequence (activate) the '400 ft course to altitude' leg associated with the SWIFT SIX SID.
The attempted sequencing was repeated which consumed FMC processing cycles, consequently, other functions could not run. Eventually, FMC 2 performed a software reset and cleared the flight plan data but was unable to recover and latched. Since FMC 2 progressed to a latched condition then either a piece of data that was retained through each reset was invalid or FMC 1 passed back invalid data as FMC 2 was resetting.
A similar progression of warm start, cold start and software reset then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.
After examination of the BITE data was completed, VIA 2 was bench tested by the manufacturer and no fault was found.
1.4 Flight data recorder (FDR) information
Following the incident, flight data recorder information was examined by the Australian Transport Safety Bureau (ATSB). The earliest indication of a problem with the FMS was at 0914:10 EST (3,610 ft) when the VIA 1 designation changed from slave to master. With Autopilot 2 engaged, VIA 2 should have been designated master and VIA 1 slave. The master/slave transitions recorded during the flight were anomalous and would not have occurred during normal operations. The master/slave transitions were also consistent with the FMS performing a series of resets. The final master/slave transition occurred at 0916:57 EST (at 9,120 ft) and FMC 2 is considered to have latched at that time and been unavailable for use during the remainder of the flight.
When returning for a landing at Cairns, the crew reported that it had been difficult to select the instrument landing system (ILS) frequency. At 0921:41 EST, while the aircraft was levelled at FL150, the ILS Frequency 2 parameter began indicating that a valid frequency had been selected. Later at 0925:36 EST, the ILS Frequency 1 parameter began indicating that a valid frequency had been selected.
FDR parameters showed that the aircraft was climbed to FL150 and tracked to the east of the airport. During the return to Cairns a descending orbit, below the controlled airspace steps, was conducted to remain visual for a landing on runway 15.
Figure 2: Aircraft track plot
MAP mode is the default display on each pilot's navigation display (ND) and shows the waypoints corresponding to the flight-planned route. If a flight management computer (FMC) failure occurs then 'MAP FAIL' will be displayed on the respective ND.
A Standard Instrument Departure (SID) is a prescribed departure procedure that separates inbound aircraft from outbound aircraft. The SID includes detailed instructions about aircraft manoeuvring after takeoff.
A power cycle occurs when electrical power is removed then re-applied.
Non-volatile memory retains data when power is removed.
ANALYSIS
The FMS performance reported by the crew was consistent with FMC 2 performing a progressive series of resets before it latched. A similar progression of resets then occurred for FMC 1 but, in accordance with its design, it did not latch and was available for use but with the flight plan information cleared. During the resetting process, the FMS response would have been confusing to the crew and consistent with the crew's observation of the 'FMS locking us out'.
With FMC 2 latched, the MENU page would have been displayed on the copilot's multi-function control and display unit (MCDU) but with the FMC 2 prompt missing from the top left data field. The standby navigation/radio (STANDBY NAV/RAD*) prompt would also have been displayed on the MCDU and 'MAP FAIL' displayed on the copilot's navigation display. Once the resetting was completed, then an ILS frequency could be tuned using the STANDBY NAV/RAD page on either the pilot in command's (PIC) or copilot's MCDU.
The PIC was the handling pilot during the flight. Normally the PIC's MCDU will interact with FMC 1 and the copilot's MCDU will interact with FMC 2. With FMC 2 latched, it was necessary for the copilot to change his source select switch to 'FO ON 1' to access FMC 1.
During the investigation the VIA manufacturer advised that no other FMS problems of this nature had been reported.
FINDINGS
During the flight, the amount of generated VIA BITE data exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.
The available BITE data showed that FMC 2 was unable to sequence the '400 ft course to altitude' leg associated with the SWIFT SIX SID. Eventually, FMC 2 performed a software reset but was unable to recover and latched.
A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.
SAFETY ACTION
As a result of this occurrence the operator has advised that a Flight Operations Memo will be issued to all 717 pilots highlighting this incident and detailing the FMS modes which remain available during abnormal FMS operation.
Summary
The Boeing 717-200 was taxiing at Cairns Qld for a scheduled service to Brisbane Qld. As part of the preparation for the flight, the crew had entered flight plan details into the aircraft's flight management system (FMS). While taxiing, due to intermittent rain showers at Cairns, the 717 crew then programmed the FMS with wet runway speed figures for take-off.
The crew reported that late in the take-off roll the manually entered wet speeds were lost from the airspeed tape on the primary flight display and FMS-generated speeds were displayed. At rotation 'MAP FAIL' appeared on both navigation displays.
The investigation found that flight management computer (FMC) 2 was unable to sequence the '400 ft course to altitude' leg associated with the SWIFT SIX standard instrument departure. Eventually, FMC 2 performed a software reset but was unable to recover and became unavailable for use by the crew. A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 remained available for use but with the flight plan information cleared.
Eventually the crew were able to enter the instrument landing system frequency, but FMS operation did not appear to be reliable. The aircraft was radar vectored for a return to Cairns while maintaining visual meteorological conditions. The crew conducted a visual approach to runway 15 and the aircraft landed 32 minutes after take-off.
The Australian Transport Safety Bureau did not conduct an on-scene investigation of this occurrence. The report presented below was prepared essentially from information supplied to the Bureau.
REPORTED INFORMATION
At 0745 eastern summer time, on 12 January 2005, the pilot of Aero Commander Division 500-B, (Aero Commander) registered VH-YJO, was climbing to an assigned altitude of 5,000 ft enroute from Essendon to Wangaratta Victoria. An Airbus A320, registered ZK-OJG, was inbound to Melbourne on a crossing track at 6,000 ft. The vertical separation standard required between the two aircraft was 1,000 ft. The Aero Commander was observed on radar by air traffic control (ATC) to climb to about 5,300 ft. ATC requested that the pilot clarify the aircrafts altitude and the aircraft was observed to descend back towards the assigned altitude. The pilot reported that, at the time ATC queried his altitude, the aircraft altimeter read 5,100 ft. That was within the normal flight tolerance of plus or minus 100 ft for IFR flight specified in Civil Aviation Order 40.2.1.
Prior to the flight, the pilot conducted an accuracy check of the aircrafts altimeters as part of normal pre-flight checks. Those checks indicated that both aircraft altimeters were within IFR altimeter tolerances. On the return flight to Essendon later that day, the pilot carried out a check of the aircraft transponder with Melbourne Centre. That check indicated an aircraft altimeter reading of 6,060 ft, and a corresponding radar-derived altitude of 6,200 ft.
After the aircraft landed at Essendon, the operator conducted a maintenance check of the transponder encoder. That check determined that the encoder was over-reading by 140 ft. The operator took maintenance action to correct the anomaly.
While the aircraft altimeter confirmed the pilot was within normal IFR flight tolerance, the encoder anomaly contributed to the radar-derived apparent error in the pilots cruising level. Had the anomaly in the encoder not been present, this incident would not have occurred.
The investigation of this occurrence(200404436) has been discontinued. The circumstances of this occurrence are being considered as part of investigation 200403238.
Occurrence summary
Investigation number
200404436
Occurrence date
09/11/2004
Location
222 km S Brisbane, Aero.
Report release date
19/11/2004
Report status
Discontinued
Investigation type
Occurrence Investigation
Investigation status
Discontinued
Mode of transport
Aviation
Aviation occurrence category
Avionics/flight instruments
Occurrence class
Incident
Highest injury level
None
Aircraft details
Manufacturer
De Havilland Canada/De Havilland Aircraft of Canada
