Descent below segment minimum safe altitude involving Fokker 100, VH-FGB, near Adelaide Airport, South Australia, on 30 August 2023

The occurrence

On 30 August 2023, an Alliance Airlines Fokker 100 aircraft, registered VH-FGB, was operating scheduled passenger flight VA1388 from Brisbane, Queensland to Adelaide, South Australia. The first officer was the pilot flying and the captain was the pilot monitoring.[1] 

Prior to departure from Brisbane, the flight crew entered the planned route, arrival, and approach procedures into the flight management computer. The flight crew selected the vertical navigation profile (PROF) mode, which was then armed to automatically capture the altitude at which the climb thrust was reduced (see the section titled Automated flight). The PROF mode is a flight management system (FMS) managed mode, in which the FMS controls the aircraft’s vertical path. However, an altitude selected by the flight crew at the flight mode panel (FMP) (Figure 1) takes precedence over PROF commands. The flight crew also selected and armed the FMS-managed lateral navigation (NAV) mode.

Figure 1: Flight mode panel 

Source: Fokker, annotated by the ATSB

The aircraft took off at about 0900 Brisbane local time. Recorded flight data showed that passing about 90 ft above mean sea level (AMSL) on climb, the lateral NAV mode activated. A review of flight data identified that, at that time, both the vertical and lateral modes were FMS‑managed, and the armed vertical mode was altitude hold (ALT HOLD). The No. 2 (right) autopilot was engaged passing 574 ft on climb, consistent with the first officer as pilot flying.

When the aircraft reached the cruising altitude of flight level (FL) 320,[2] the active vertical mode changed to FMS-managed altitude hold (ALT HOLD). Apart from during a 30-second period in which the aircraft commenced a climb to a new cruising altitude of FL 340, the selected modes remained unchanged for the cruise phase of the flight. 

The flight crew had entered the expected Adelaide BLACK 3A standard instrument arrival (STAR) and instrument landing system (ILS) – Z for runway 23 into the FMS. For that STAR, there were FMS-coded altitude restrictions at waypoints PLEZN (at or below 9,000 ft) and KERRS (at or above 5,000 ft) (Figure 2). The aircraft was required to remain at or above the segment minimum safe altitude of 3,800 ft until reaching GULLY. There was no altitude restriction and therefore no FMS-coded altitude for waypoint GULLY on the STAR (Figure 2). However, the ILS had the FMS‑coded altitude constraint at GULLY as depicted on the ILS chart (Figure 3).

Figure 2: Extract of BLACK 3A standard instrument arrival chart

Source: Airservices Australia, annotated by the ATSB

Figure 3: Extract of ILS-Z Runway 23 Adelaide chart

Source: Airservices Australia, annotated by the ATSB

At about 1036 Adelaide local time, the aircraft commenced descent from FL 340. The selected altitude was set to 9,000 ft, consistent with the air traffic control clearance, the lateral mode remained FMS-managed NAV and the vertical mode became FMS-managed DESCENT.  

At 1048:03, the aircraft passed waypoint BLACK at the commencement of the STAR, descending through 13,600 ft. The altitude was then selected to 5,000 ft. About 1 minute later, APP mode was selected on the right electronic flight information system panel in preparation for the ILS. 

At 1051:17, the aircraft passed the next waypoint on the STAR (PLEZN), descending through 8,090 ft barometric altitude,[3] thereby meeting the altitude requirement to be at or below 9,000 ft. About 1 minute later, the selected altitude was set to 3,800 ft. The flight crew reported that, in accordance with standard procedure, when they received air traffic control clearance to descend to 3,800 ft, the first officer set that altitude at the FMP and checked that it annunciated on the primary flight display. The first officer reported that they read aloud ‘3,800’ and the captain crosschecked that was the altitude set at the FMP and on the primary flight display. Shortly afterwards, the selected airspeed was reduced from 250 kt to 193 kt.

At 1053:19, descending through 5,377 ft, the recorded flight data showed the FMS-managed vertical mode changed from DESCENT to ALT HOLD, consistent with the auto-flight system reducing the descent rate to meet the altitude constraint at KERRS. The aircraft then passed waypoint KERRS at about the required 5,000 ft altitude, still descending. Shortly afterwards, the vertical mode reverted to FMS-managed DESCENT. About 10 seconds later, the APP mode was selected on the left electronic flight information system panel in preparation for the ILS.

Recorded flight data showed that an altitude alert activated as the aircraft descended through 4,562 ft, consistent with the aircraft being about 750 ft above the selected altitude (of 3,800 ft). The alert ceased as the aircraft passed 4,062 ft, still descending. 

At 1054:43, the aircraft was 1.7 NM prior to waypoint GULLY and descending at about 1,100 ft per minute, when it descended below the selected altitude of 3,800 ft, which was the segment minimum safe altitude. The flight crew were monitoring the altitude and noticed that the FMS did not capture the selected altitude. In response, the captain pressed the altitude control knob to command the aircraft to hold the current altitude[4] and the FMS-managed mode was disconnected. The flight crew reported that the aircraft was in and out of cloud at that time, but they had sufficient visibility with the ground and terrain to assess that adequate separation existed. As the aircraft continued to descend through 3,631 ft, the selected airspeed was increased from 193 kt to 206 kt and the selected altitude was then increased to 4,700 ft by the first officer in an attempt to make the auto-flight system commence a climb.

Assessing that the aircraft was continuing to descend, 8 seconds later the first officer disconnected the autopilot, and initiated a climb. The aircraft was then at 3,487 ft. About 15 seconds later, the aircraft passed GULLY at 3,321 ft, descending at 704 ft per minute. The aircraft then entered a gradual climb, but as the aircraft had passed GULLY, the minimum safe altitude was 3,200 ft and no further climb was necessary. The flight crew reported selecting the approach mode (LAND on the FMP), and the aircraft captured the lateral track of the localiser. The autopilot was reinstated 40 seconds later, at which time the aircraft intercepted the ILS glideslope. The aircraft continued the ILS approach and landed at about 1100. 

Context

Automated flight

The aircraft was fitted with an automatic flight control and augmentation system (AFCAS), consisting of the automatic flight control, autothrottle and flight augmentation systems. The automatic flight control system (AFCS) provided flight director guidance, autopilot control and altitude alerting. Two flight control computers provided the calculations for the AFCS. AFCS outputs were connected to the electronic flight instrument system (EFIS), autopilot servos for the ailerons, rudder and elevator, and to the flight management system (FMS) and flight warning computer. AFCS modes, speed, altitude, heading and bank limit could be selected at the flight mode panel (FMP), which also had autopilot engage (and an alternate autopilot disconnect).

The AFCAS could be operated in 2 basic states – programmed by the FMS with lateral and vertical navigation modes (NAV/PROF mode), or through flight crew manipulation of the FMP, referred to as AFCAS mode. The flight crew had received training in operating PROF and AFCAS states. The captain reported a preference for AFCAS mode, which required more manual inputs. The first officer, as pilot flying, elected to operate the flight in PROF mode. The flight crew also reported being aware that very rarely, the aircraft did not behave as expected when in PROF mode. As such, the training included monitoring and the importance of reverting to the manual mode if the auto-flight system was not behaving as expected. 

The Alliance Airlines Operations Policy and Procedures Manual, section Flight Techniques stated:

The use of PROF mode in certain approach conditions creates extra workload. 

Disconnect the PROF mode in cases where: 

• Radar headings and/or speed restrictions are given. 
• The NAV mode is not used for other reasons.
• Late clearances are given.
• Operationally not acceptable speed targets are issued by FMS.
• PROF should not be used when NAV is not engaged. 

None of these listed conditions existed on the incident arrival/approach.   

Recorded data

Recorded flight data from the incident flight is depicted in Figure 4. ATSB analysis of the recorded data was unable to determine the reason for the descent below the selected altitude. The ATSB therefore requested assistance from Fokker and Honeywell, as the manufacturer of the flight management computer. 

Fokker advised that the flight data recorder only showed No. 1 (left side) parameters. As the first officer was the pilot flying, the aircraft was flying on autopilot No. 2. Therefore, it was possible that the systems were in independent operation and that there was a difference between the 2 systems. However, Alliance Airlines advised that the flight management systems were operating in cross-talk configuration, so both side parameters should have been evident in the recorded data. 

Fokker also observed that when the flight crew changed the selected altitude to 3,800 ft, they initially wound the dial down to 3,500 ft before selecting 3,800 ft. Fokker advised that had the system been in altitude hold mode at the time, it would have captured 3,500 ft. However, it was in descent mode at that time and the recorded selected altitude was 3,800 ft. Fokker advised that the alert would activate about 750 ft above the selected altitude and the alert commenced as the aircraft descended through 4,562 ft, supporting that 3,800 ft was selected. 

Honeywell was also unable to provide any reason for the occurrence and advised that they reviewed their problem reports and did not identify any similar occurrences. 

Alliance Airlines analysed flights that tracked to Adelaide via GULLY from August 2023, and found that the incident flight was the only Alliance Airlines flight below the segment minimum safe altitude at GULLY. Alliance Airlines also provided additional flight data from VH-FGB, which included 4 flights from Brisbane to Adelaide in October 2023. In 2 of those, the arrival and approach were not conducted in FMS-managed mode and in another flight, the FMS‑managed mode was disconnected at about KERRS (the 5,000 ft altitude constrained waypoint).

In data from a flight on 15 October 2023, the auto-flight system entered altitude hold mode and levelled the aircraft at about 4,500 ft halfway between KERRS and GULLY, with the selected altitude of 3,800 ft. No difference was identified in the data to explain why that flight met the minimum safe altitude requirement, and the incident flight did not. 

Figure 4: Recorded flight data for the incident flight showing selected parameters

Safety analysis

During the standard instrument arrival to Adelaide Airport, the aircraft was operating in an automated flight mode, in which the flight management system controlled the flight path. Approaching waypoint KERRS, although the automatic flight system entered altitude hold mode, the aircraft continued to descend, but met the 5,000 ft minimum altitude restriction at KERRS. The automatic flight system then returned to the descent mode and did not capture the selected 3,800 ft altitude, which was the segment minimum safe altitude between KERRS and waypoint GULLY. 

Despite the ATSB consulting with the aircraft manufacturer, Fokker, and the flight management computer manufacturer, Honeywell, the reason the aircraft did not level at the selected altitude could not be determined. 

Fortunately, in this incident the flight crew were monitoring the instruments and disconnected the automatic flight system when they detected the descent below the selected altitude and initiated a climb. By the time the flight crew had completed resolution actions and reinstated the automatic flight system, the aircraft had passed GULLY and intercepted the lateral localiser track. During that period, the aircraft was in and out of cloud and the flight crew were able to visually assess terrain clearance. When the flight crew reconnected the autopilot, the aircraft intercepted the glideslope and completed the instrument landing system approach.

Findings

From the evidence available, the following findings are made with respect to the descent below the segment minimum safe altitude involving Fokker 100, VH-FGB, near Adelaide Airport, South Australia on 30 August 2023. 

Contributing factors

• For reasons that could not be determined, the flight management system did not capture the selected altitude. This resulted in the aircraft descending about 480 ft below the segment minimum safe altitude.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew 
• the aircraft operator and manufacturer
• the flight computer software manufacturer
• Airservices Australia
• recorded flight data from the aircraft. 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• flight crew
• Alliance Airlines
• Fokker
• Honeywell
• United States National Transportation Safety Board
• Civil Aviation Safety Authority.

Submissions were received from:

• Honeywell
• Fokker
• Alliance Airlines.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.