A Blunder Down Under
In a modern jetliner’s computer, the capability to move waypoints can lead to dangerous deviations from safe flight paths. Just such a subtle “pilot trap” occurred on a Virgin Australia B777 with 272 passengers aboard during an approach to land at Melbourne airport after a long 15-hour flight from Los Angeles.
The first officer, looking out of the cockpit, thought the airplane was too low and advised the captain, who was the pilot flying. The captain promptly agreed and leveled off the airplane at 500 feet. When the airplane intercepted the 3-degree glide slope — from below, we might add — the landing descent was continued. Passengers were none the wiser, but the August 15, 2013 incident triggered an Australian Transport Safety Bureau (ATSB) investigation. The ATSB issued its report July 15, 2015. What it reveals is that the airplane’s flight management system (FMS) is, despite its advanced state, capable of exceedingly dumb maneuvers if its programmed parameters are not double-checked six ways from Sunday by an alert and skeptical cockpit crew.
The ATSB concluded:
“This occurrence highlights the factors that can influence the accuracy of data entry in critical systems and any associated checks. In addition, it reinforces the importance of monitoring descent profiles, irrespective of any expectation that the descent is being appropriately managed by the auto-flight system, and taking appropriate action when a deviation from the desired profile is detected.” (Emphasis added)
Due to the flight’s wearying length, the two-person cockpit crew was augmented by two other relief pilots.
For the descent and landing at Melbourne, the captain decided he would be the handling pilot, with the first officer monitoring. The captain, with over 6,000 hours of experience in the B777, determined that the airplane’s automated systems would fly the descent to the runway 34 threshold (runway 34 being the longer of Melbourne’s two runways). He programmed various waypoints into his control display unit (CDU). The cockpit is equipped with two CDU’s, one for each pilot.
With these waypoints, the airplane’s computer (the flight management system, or FMS) will calculate commands for control of the flight path. The autopilot was set to fly the airplane right down to the runway threshold, and the captain would then take over for the last few moments of flight before touchdown.
The captain selected the runway waypoint — RW34 — from the data base. RW34 had an altitude setting of 380 feet.
So far, so good.
The captain then entered a runway extension of 2.8 NM to better align the airplane with the runway center line for landing. When he did so, the FMS created a waypoint reflecting this extension and labeled it RX34 (to distinguish it from RW34 at the threshold).
Instead of setting the RW34 waypoint for an altitude of 380 feet above sea level, the captain inadvertently programmed that altitude for RX34. As a result, the autopilot would fly a steeper approach to intercept RX34 at 380 feet, instead of RW34 at 380 feet.
The first officer noticed that the expected glide path angle for the final legs of the approach were not displayed. Not to worry, the captain advised; for a manually-constructed approach, the expected glide path was not displayed.
The first officer missed the wrong altitude entry for RX34.
When the first officer took a break, one of the relief pilots assumed his seat and double checked all the captain’s entries for the approach. He also missed the incorrect altitude for RX34.
Then, during the descent to land, the captain was so preoccupied with activities inside the cockpit he had to be advised by the first officer that they were mighty low and that the precision approach path indicator (PAPI) lights at the runway were showing red — indicating that the airplane was well below the safe 3-degree glide path (the lights would have shown white for a descent above the 3-degree slope desired).
A few salient points cry out for comment:
Captain: Entering runway extension of 2.8NM.
Captain: Waypoint RX34 created.
Captain: RX34 altitude set at 380 feet.
What the ATSB did not mention was obvious to this layman: ineffective cross-checking is rampant, and someday this will kill a planeload of people. Data entry should require simultaneous keystrokes by both pilots, with verbal announcement and confirmation, and the computer screens should highlight in glowing red any differences to the data just entered.
If all this data entry detracts from eyeballs looking outside of the cockpit, then all of the keystrokes should be completed before takeoff. If changes to the plans occur in flight, don’t dwell on revised data entry — just hand-fly the airplane. Data entry is not part of the definition of good airmanship, which is still regarded as the skill to competently fly the airplane to its landing destination without relying on still vulnerable cockpit computer systems.