Navigation system failure, Cairns, Queensland, VH-VQI, Boeing 717-200

The Boeing 717-200 was taxiing at Cairns Qld for a scheduled service to Brisbane Qld. As part of the preparation for the flight, the crew had entered flight plan details into the aircraft's flight management system (FMS). While taxiing, due to intermittent rain showers at Cairns, the 717 crew then programmed the FMS with wet runway speed figures for take-off.

The crew reported that late in the take-off roll the manually entered wet speeds were lost from the airspeed tape on the primary flight display and FMS-generated speeds were displayed. At rotation 'MAP FAIL' appeared on both navigation displays.

The investigation found that flight management computer (FMC) 2 was unable to sequence the '400 ft course to altitude' leg associated with the SWIFT SIX standard instrument departure. Eventually, FMC 2 performed a software reset but was unable to recover and became unavailable for use by the crew. A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 remained available for use but with the flight plan information cleared.

Eventually the crew were able to enter the instrument landing system frequency, but FMS operation did not appear to be reliable. The aircraft was radar vectored for a return to Cairns while maintaining visual meteorological conditions. The crew conducted a visual approach to runway 15 and the aircraft landed 32 minutes after take-off.

FACTUAL INFORMATION

The Boeing 717-200 (717) was taxiing at Cairns Qld for a scheduled service to Brisbane Qld. As part of the preparation for the flight, the crew had entered flight plan details into the aircraft's flight management system (FMS). While taxiing, due to intermittent rain showers at Cairns, the 717 crew then programmed the FMS with wet runway speed figures for takeoff.

The crew reported that late in the take-off roll the manually entered wet speeds were lost from the airspeed tape on the primary flight display and FMS-generated speeds were displayed. At rotation 'MAP FAIL'¹ appeared on both navigation displays. The aircraft was manually turned onto the SWIFT SIX standard instrument departure² (SID).

Figure 1: SWIFT SIX SID

After approximately 1 ½ minutes, just after the turn onto 030°, the MAP displays returned to normal and flight plan integrity appeared to have been maintained. Later, during the turn to SWIFT, the 'MAP FAIL' indication returned. The crew reported that 'the FMS had locked us out'. Eventually the crew were able to enter the instrument landing system (ILS) frequency, but FMS operation did not appear to be reliable. The aircraft was radar vectored for a return to Cairns while maintaining visual meteorological conditions (VMC). The crew conducted a visual approach to runway 15 and the aircraft landed 32 minutes after take-off.

1.1 Versatile integrated avionics (VIA) units

The aircraft was equipped with two VIA units, VIA 1 and VIA 2. The VIA units provide the following functions:

Displays
Flight Management System
Autoflight / Autothrottle
Communications Management
Flight Warning / Aural Warning
Central Maintenance
Digital Flight Data Acquisition.

The latest FMS software, VIA-906 (Part number PS4081970-906), was installed in both VIA units. The flight management computer (FMC) is the VIA hardware that provides the FMS function.

One VIA unit is designated master and the other slave. The selection of master and slave is determined by the selection of autopilot. If the pilot in command's (PIC) autopilot is selected, then FMC 1 is considered the master and if the copilot's autopilot is selected then FMC 2 is considered the master.

1.2 FMC latch

While a fault condition exists the FMC system will progress through a series of resets: warm start, cold start, software reset and latch (shutdown). The progression of resets is designed to clear increasingly larger parts of the FMC eventually leaving a crew with a usable FMC but no flight plan data. If the software reset is unsuccessful then the FMC will latch. The FMC requires a power cycle³ to restart after it has latched.

1.3 VIA built-in test equipment (BITE) data

Each VIA unit stores BITE data in non-volatile memory⁴. Following the incident, VIA 2 was sent to the manufacturer in the USA for download of the BITE data and bench testing. BITE data from VIA 1 was downloaded by a manufacturer's representative in Australia and forwarded to the manufacturer.

The non-volatile memory size in each VIA unit was fixed, therefore, the oldest data was overwritten by the newest. During the flight, the amount of BITE data generated exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.

The oldest BITE data that was recorded indicated that FMC 2 was trying to sequence (activate) the '400 ft course to altitude' leg associated with the SWIFT SIX SID.

The attempted sequencing was repeated which consumed FMC processing cycles, consequently, other functions could not run. Eventually, FMC 2 performed a software reset and cleared the flight plan data but was unable to recover and latched. Since FMC 2 progressed to a latched condition then either a piece of data that was retained through each reset was invalid or FMC 1 passed back invalid data as FMC 2 was resetting.

A similar progression of warm start, cold start and software reset then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.

After examination of the BITE data was completed, VIA 2 was bench tested by the manufacturer and no fault was found.

1.4 Flight data recorder (FDR) information

Following the incident, flight data recorder information was examined by the Australian Transport Safety Bureau (ATSB). The earliest indication of a problem with the FMS was at 0914:10 EST (3,610 ft) when the VIA 1 designation changed from slave to master. With Autopilot 2 engaged, VIA 2 should have been designated master and VIA 1 slave. The master/slave transitions recorded during the flight were anomalous and would not have occurred during normal operations. The master/slave transitions were also consistent with the FMS performing a series of resets. The final master/slave transition occurred at 0916:57 EST (at 9,120 ft) and FMC 2 is considered to have latched at that time and been unavailable for use during the remainder of the flight.

When returning for a landing at Cairns, the crew reported that it had been difficult to select the instrument landing system (ILS) frequency. At 0921:41 EST, while the aircraft was levelled at FL150, the ILS Frequency 2 parameter began indicating that a valid frequency had been selected. Later at 0925:36 EST, the ILS Frequency 1 parameter began indicating that a valid frequency had been selected.

FDR parameters showed that the aircraft was climbed to FL150 and tracked to the east of the airport. During the return to Cairns a descending orbit, below the controlled airspace steps, was conducted to remain visual for a landing on runway 15.

Figure 2: Aircraft track plot

MAP mode is the default display on each pilot's navigation display (ND) and shows the waypoints corresponding to the flight-planned route. If a flight management computer (FMC) failure occurs then 'MAP FAIL' will be displayed on the respective ND.
A Standard Instrument Departure (SID) is a prescribed departure procedure that separates inbound aircraft from outbound aircraft. The SID includes detailed instructions about aircraft manoeuvring after takeoff.
A power cycle occurs when electrical power is removed then re-applied.
Non-volatile memory retains data when power is removed.

ANALYSIS

The FMS performance reported by the crew was consistent with FMC 2 performing a progressive series of resets before it latched. A similar progression of resets then occurred for FMC 1 but, in accordance with its design, it did not latch and was available for use but with the flight plan information cleared. During the resetting process, the FMS response would have been confusing to the crew and consistent with the crew's observation of the 'FMS locking us out'.

With FMC 2 latched, the MENU page would have been displayed on the copilot's multi-function control and display unit (MCDU) but with the FMC 2 prompt missing from the top left data field. The standby navigation/radio (STANDBY NAV/RAD*) prompt would also have been displayed on the MCDU and 'MAP FAIL' displayed on the copilot's navigation display. Once the resetting was completed, then an ILS frequency could be tuned using the STANDBY NAV/RAD page on either the pilot in command's (PIC) or copilot's MCDU.

The PIC was the handling pilot during the flight. Normally the PIC's MCDU will interact with FMC 1 and the copilot's MCDU will interact with FMC 2. With FMC 2 latched, it was necessary for the copilot to change his source select switch to 'FO ON 1' to access FMC 1.

During the investigation the VIA manufacturer advised that no other FMS problems of this nature had been reported.

FINDINGS

During the flight, the amount of generated VIA BITE data exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.

The available BITE data showed that FMC 2 was unable to sequence the '400 ft course to altitude' leg associated with the SWIFT SIX SID. Eventually, FMC 2 performed a software reset but was unable to recover and latched.

A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.

SAFETY ACTION

As a result of this occurrence the operator has advised that a Flight Operations Memo will be issued to all 717 pilots highlighting this incident and detailing the FMS modes which remain available during abnormal FMS operation.

ANALYSIS

The FMS performance reported by the crew was consistent with FMC 2 performing a progressive series of resets before it latched. A similar progression of resets then occurred for FMC 1 but, in accordance with its design, it did not latch and was available for use but with the flight plan information cleared. During the resetting process, the FMS response would have been confusing to the crew and consistent with the crew’s observation of the ‘FMS locking us out’.

With FMC 2 latched, the MENU page would have been displayed on the copilot’s multi-function control and display unit (MCDU) but with the FMC 2 prompt missing from the top left data field. The standby navigation/radio (STANDBY NAV/RAD*) prompt would also have been displayed on the MCDU and ‘MAP FAIL’ displayed on the copilot’s navigation display. Once the resetting was completed, then an ILS frequency could be tuned using the STANDBY NAV/RAD page on either the pilot in command’s (PIC) or copilot’s MCDU.

The PIC was the handling pilot during the flight. Normally the PIC’s MCDU will interact with FMC 1 and the copilot’s MCDU will interact with FMC 2. With FMC 2 latched, it was necessary for the copilot to change his source select switch to ‘FO ON 1’ to access FMC 1.

During the investigation the VIA manufacturer advised that no other FMS problems of this nature had been reported.

FINDINGS

During the flight, the amount of generated VIA BITE data exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.

The available BITE data showed that FMC 2 was unable to sequence the ‘400 ft course to altitude’ leg associated with the SWIFT SIX SID. Eventually, FMC 2 performed a software reset but was unable to recover and latched.

A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.

SAFETY ACTION

As a result of this occurrence the operator has advised that a Flight Operations Memo will be issued to all 717 pilots highlighting this incident and detailing the FMS modes which remain available during abnormal FMS operation.