FACTUAL INFORMATION
The Boeing 717-200 (717) was taxiing at Cairns Qld for a
scheduled service to Brisbane Qld. As part of the preparation for
the flight, the crew had entered flight plan details into the
aircraft's flight management system (FMS). While taxiing, due to
intermittent rain showers at Cairns, the 717 crew then programmed
the FMS with wet runway speed figures for takeoff.
The crew reported that late in the take-off roll the manually
entered wet speeds were lost from the airspeed tape on the primary
flight display and FMS-generated speeds were displayed. At rotation
'MAP FAIL'1 appeared on both
navigation displays. The aircraft was manually turned onto the
SWIFT SIX standard instrument departure2 (SID).
Figure 1: SWIFT SIX SID
After approximately 1 ½ minutes, just after the turn onto 030°,
the MAP displays returned to normal and flight plan integrity
appeared to have been maintained. Later, during the turn to SWIFT,
the 'MAP FAIL' indication returned. The crew reported that 'the FMS
had locked us out'. Eventually the crew were able to enter the
instrument landing system (ILS) frequency, but FMS operation did
not appear to be reliable. The aircraft was radar vectored for a
return to Cairns while maintaining visual meteorological conditions
(VMC). The crew conducted a visual approach to runway 15 and the
aircraft landed 32 minutes after takeoff.
1.1 Versatile integrated avionics (VIA)
units
The aircraft was equipped with two VIA units, VIA 1 and VIA 2.
The VIA units provide the following functions:
- Displays
- Flight Management System
- Autoflight / Autothrottle
- Communications Management
- Flight Warning / Aural Warning
- Central Maintenance
- Digital Flight Data Acquisition.
The latest FMS software, VIA-906 (Part number PS4081970-906),
was installed in both VIA units. The flight management computer
(FMC) is the VIA hardware that provides the FMS function.
One VIA unit is designated master and the other slave. The
selection of master and slave is determined by the selection of
autopilot. If the pilot in command's (PIC) autopilot is selected
then FMC 1 is considered the master and if the copilot's autopilot
is selected then FMC 2 is considered the master.
1.2 FMC latch
While a fault condition exists the FMC system will progress
through a series of resets: warm start, cold start, software reset
and latch (shutdown). The progression of resets is designed to
clear increasingly larger parts of the FMC eventually leaving a
crew with a usable FMC but no flight plan data. If the software
reset is unsuccessful then the FMC will latch. The FMC requires a
power cycle3 to restart after it has
latched.
1.3 VIA built-in test equipment (BITE) data
Each VIA unit stores BITE data in non-volatile memory4. Following the incident, VIA 2 was sent to
the manufacturer in the USA for download of the BITE data and bench
testing. BITE data from VIA 1 was downloaded by a manufacturer's
representative in Australia and forwarded to the manufacturer.
The non-volatile memory size in each VIA unit was fixed,
therefore, the oldest data was overwritten by the newest. During
the flight, the amount of BITE data generated exceeded the memory
size. As a result, BITE data from the event that initiated the FMS
problem was overwritten and lost.
The oldest BITE data that was recorded indicated that FMC 2 was
trying to sequence (activate) the '400 ft course to altitude' leg
associated with the SWIFT SIX SID.
The attempted sequencing was repeated which consumed FMC
processing cycles, consequently, other functions could not run.
Eventually, FMC 2 performed a software reset and cleared the flight
plan data, but was unable to recover and latched. Since FMC 2
progressed to a latched condition then either a piece of data that
was retained through each reset was invalid or FMC 1 passed back
invalid data as FMC 2 was resetting.
A similar progression of warm start, cold start and software
reset then occurred for FMC 1 but, in accordance with its design,
FMC 1 did not latch and was available for use but with the flight
plan information cleared.
After examination of the BITE data was completed, VIA 2 was
bench tested by the manufacturer and no fault was found.
1.4 Flight data recorder (FDR) information
Following the incident, flight data recorder information was
examined by the Australian Transport Safety Bureau (ATSB). The
earliest indication of a problem with the FMS was at 0914:10 EST
(3,610 ft) when the VIA 1 designation changed from slave to master.
With Autopilot 2 engaged, VIA 2 should have been designated master
and VIA 1 slave. The master/slave transitions recorded during the
flight were anomalous and would not have occurred during normal
operations. The master/slave transitions were also consistent with
the FMS performing a series of resets. The final master/slave
transition occurred at 0916:57 EST (at 9,120 ft) and FMC 2 is
considered to have latched at that time and been unavailable for
use during the remainder of the flight.
When returning for a landing at Cairns, the crew reported that
it had been difficult to select the instrument landing system (ILS)
frequency. At 0921:41 EST, while the aircraft was levelled at
FL150, the ILS Frequency 2 parameter began indicating that a valid
frequency had been selected. Later at 0925:36 EST, the ILS
Frequency 1 parameter began indicating that a valid frequency had
been selected.
FDR parameters showed that the aircraft was climbed to FL150 and
tracked to the east of the airport. During the return to Cairns a
descending orbit, below the controlled airspace steps, was
conducted to remain visual for a landing on runway 15.
Figure 2: Aircraft track plot
- MAP mode is the default display on
each pilot's navigation display (ND) and shows the waypoints
corresponding to the flight-planned route. If a flight management
computer (FMC) failure occurs then 'MAP FAIL' will be displayed on
the respective ND. - A Standard Instrument Departure
(SID) is a prescribed departure procedure that separates inbound
aircraft from outbound aircraft. The SID includes detailed
instructions about aircraft manoeuvring after takeoff. - A power cycle occurs when electrical
power is removed then re-applied. - Non-volatile memory retains data
when power is removed.
ANALYSIS
The FMS performance reported by the crew was consistent with FMC
2 performing a progressive series of resets before it latched. A
similar progression of resets then occurred for FMC 1 but, in
accordance with its design, it did not latch and was available for
use but with the flight plan information cleared. During the
resetting process, the FMS response would have been confusing to
the crew and consistent with the crew's observation of the 'FMS
locking us out'.
With FMC 2 latched, the MENU page would have been displayed on
the copilot's multi-function control and display unit (MCDU) but
with the FMC 2 prompt missing from the top left data field. The
standby navigation/radio (STANDBY NAV/RAD*) prompt would also have
been displayed on the MCDU and 'MAP FAIL' displayed on the
copilot's navigation display. Once the resetting was completed,
then an ILS frequency could be tuned using the STANDBY NAV/RAD page
on either the pilot in command's (PIC) or copilot's MCDU.
The PIC was the handling pilot during the flight. Normally the
PIC's MCDU will interact with FMC 1 and the copilot's MCDU will
interact with FMC 2. With FMC 2 latched, it was necessary for the
copilot to change his source select switch to 'FO ON 1' to access
FMC 1.
During the investigation the VIA manufacturer advised that no
other FMS problems of this nature had been reported.
FINDINGS
During the flight, the amount of generated VIA BITE data
exceeded the memory size. As a result, BITE data from the event
that initiated the FMS problem was overwritten and lost.
The available BITE data showed that FMC 2 was unable to sequence
the '400 ft course to altitude' leg associated with the SWIFT SIX
SID. Eventually, FMC 2 performed a software reset but was unable to
recover and latched.
A similar progression then occurred for FMC 1 but, in accordance
with its design, FMC 1 did not latch and was available for use but
with the flight plan information cleared.
SAFETY ACTION
As a result of this occurrence the operator has advised that a
Flight Operations Memo will be issued to all 717 pilots
highlighting this incident and detailing the FMS modes which remain
available during abnormal FMS operation.