Flight management systems (FMS) have evolved into sophisticated control and computation systems that accept multiple data and sensor inputs and provide outputs to various aircraft systems, pilots, controllers and maintainers. While many functions have been automated, an FMS still requires physical and visual interaction by the pilots, using interfaces such as the control display unit (CDU) keyboard, autopilot and flight-director system controls and cockpit displays. Data entry errors can lead to aircraft position or speed deviations and potentially accidents.
“An FMS is only as good as the human who interfaces with it,” advises Robert Baron, president of The Aviation Safety Group. “If pilots enter a wrong waypoint, without verification, the computer will do exactly what it is programmed to do. Often, the first time the pilots become aware of the error is when it is pointed out by air traffic control.”
In a December 2020 article published by Flight Safety Foundation, Baron described four FMS error types based on NASA Aviation Safety Reporting System or line operations safety audit (LOSA) observations: (1) Slip, when an action is performed incorrectly; (2) Lapse, an action that is not performed; (3) Intentional violation, an intentional action (or inaction) that results in noncompliance with known rules; and (4) Non-intentional violation, an unintentional action (or inaction) that results in noncompliance with known rules.
Automated systems must be monitored at all times, and FMS-related errors are typically influenced by environmental conditions such as stress, pressure, distractions and high workload, according to Barron. Flight crews receive specific training to deal with these influences, including crew resource management (CRM) and threat and error management (TEM) training. “Unfortunately, in many cases, pilots who successfully complete CRM/TEM training in the classroom or simulator fail to apply CRM/TEM principles in the practical world,” he says.
“When it comes to FMS error prevention, you already know what to do,” instructs Baron. “Practice good CRM/TEM and follow your SOPs (standard operating procedures). That way, when errors do occur (and they will), you will be better able to identify and trap the errors before they become consequential and lead to undesired aircraft states.”
IATA Error Prevention Strategies
A 2015 report by the International Air Transport Association (IATA), “FMS Data Entry Error Prevention Best Practices,” describes common types of data entry errors for all phases of flight, with best practices to prevent them. The report can be found at: https://www.iata.org/contentassets/b6eb2adc248c484192101edd1ed36015/fms-data-entry-error-prevention-ed-1-2015.pdf
The IATA document recommends several strategic steps for operators and pilots to prevent and manage FMS data entry errors, including:
Procedures: Standard operating procedures promulgated to pilots should reflect the procedures published by the aircraft or system manufacturer. If these are found to be impractical or ineffective, the operator should attempt to resolve the situation with the manufacturer and only as a last resort develop their own unique procedures.
Monitoring and cross-checking: Where internal FMS checks and safeguards are not available, pilots should recognize the need for accurate monitoring and cross-checking and the inherent human weaknesses in these functions. Training should help them build strategies to counter weaknesses, such as periodically swapping tasks between entering and cross-checking data, developing gross error checks, building a mental picture of the “normal” parameters for each phase of flight and recognizing the onset of symptoms of fatigue, stress and illness.
Time management: Pilot training and procedures must encourage pilots to plan ahead both strategically for the entire flight (or duty time) and tactically for the current and next phases of the flight. They must be alert to changes in the operational environment and be prepared to amend or even abandon their original plan if appropriate. Operators need to be aware of the potential threat of organizational time pressure, whether it is actual or perceived.
Workload management: Training and procedures should encourage and enable pilots to utilize periods of lower workload for routine tasks like reviewing the FMS, while confining activity to essential operational tasks during periods of higher workload. Workload management threats are distractions and interruptions, frequently from external sources such as the radio or cockpit visits. Strict adherence to sterile cockpit procedures during the critical phases of flight can reduce the risk of error.
Another significant workload management factor in FMS data entry errors is the allocation of FMS and autopilot/flight director system selections to each pilot. While parked at the gate, pilots can safely work together on the data entry and cross-checking processes, but once the aircraft is in motion it is essential that one pilot is always primarily engaged with managing the aircraft.
Gross error checks: It is possible to develop “rules of thumb” and gross error checks for many of the values that are input to and output by the FMS on a given aircraft type. Rigorous application of these checks offers an additional opportunity to identify errors which may have slipped through procedural defenses. Knowing roughly what to expect from a calculation before it is executed, or what performance parameters an aircraft is likely to exhibit, will help pilots to recognize potential data anomalies.
