Contractor provides long-term solution to solve problem of momentary hitch with ATMS on August 13
With regard to the momentary hitch experienced with the Air Traffic Management System (ATMS) on August 13, the contractor of the ATMS, Raytheon Company, submitted a report to the Civil Aviation Department (CAD) and provided a long-term solution – a software fix – to solve the problem. The CAD started the on-site testing of the software fix today (September 19) and expects to implement the software fix in the ATMS next month to prevent recurrence.
On August 13, the technical staff switched the ATMS from the Main System to the Fallback System in accordance with the established procedures as two Flight Data Processors (FDPs) of the Main System experienced a momentary hitch. The contractor stated in its report that an unexpected data corruption occurred when the system software was updating the flight route elements. In general, a flight route comprises an array of elements of a particular flight, such as standard instrument departure procedures, standard instrument arrival procedures, waypoints, airways and so on. Due to data corruption, an array of elements of a flight route unexpectedly contained an invalid value. As a result, the software could not continue its processing, which triggered for safety assurance the shutdown of the primary FDP of the Main System as per multi-layer redundancy in system design. It was then followed by an automatic switchover of operation to the secondary FDP, which subsequently shut down for the same reason as per system design (i.e. the detection of an invalid value in the flight route elements).
After the momentary hitch experienced by the ATMS on the day of the occurrence, the on-site technical staff immediately followed up and carried out investigations. Having co-ordinated with air traffic control (ATC) supervisors on-site, the technical staff switched from the Main System to the Fallback System, an independent but identical system with the same design, according to the established procedures. The processing and display of flight data then returned to normal. The occurrence lasted six minutes, during which time the Air Traffic Control Officers (ATCOs) were able to keep direct voice communication with the pilots and provide ATC services at all times. They were also able to simultaneously obtain all flight information that should be shown through the displays using Automatic Dependent Surveillance-Broadcast technology, including full information of the three flights for which only all three essential types of information, i.e. flight position, altitude information and secondary surveillance radar code, could be shown due to the momentary hitch experienced by the FDPs. All professional ATCOs receive rigorous training and have the skills and experience required to deal with unexpected circumstances in accordance with the established procedures, so as to continue to provide ATC services and safeguard aviation safety.
Upon the CAD's request, the contractor conducted an in-depth review on the programme algorithm and coding involving the flight route element comparison, and confirmed that the programme algorithm and coding were in order. Nevertheless, the contractor has provided the software fix to the CAD to prevent the operation of the FDPs from being affected by corrupted data in future.
In the current system design, when the ATMS first accepts the flight route elements, the system will verify the data to ensure the validity. For subsequent updates, the ATMS will check the relevant updates to ensure that only valid data will be accepted, followed by the execution of flight route element comparison. The software fix to be implemented will validate the flight route elements (including the updates) once again (i.e. one additional validation as compared to the past) prior to the execution of flight route element comparison. The following three new features will be introduced in the ATMS through this software fix:
(i) when a flight route contains an invalid value, the system will not proceed to the flight route element comparison for that flight;
(ii) the software will stop processing the flight route in question when it encounters the scenario mentioned in paragraph (i). It will then confine the flight route in question and will continue to process information of other flight routes to prevent the FDPs from shutting down and other flight data from being affected; and
(iii) At the same time, the software will display an alert message to ATCOs and the technical staff together with the relevant flight information for subsequent and separate handling of the flight route in question.
The on-site testing of the software fix is in progress. Upon completion of the test and relevant safety assessments by the CAD, the software fix is expected to be implemented in the ATMS in late October. For details of the contractor's report, please refer to Annex.
The CAD set up the ATMS Expert Panel shortly after the commissioning of the ATMS comprising local and overseas experts and academia in the fields of air traffic management, engineering and aviation safety management to offer independent advice to the CAD on the teething issues identified since the full commissioning of the ATMS. The Expert Panel published its final report (www.cad.gov.hk/english/reports.html) in November 2017 which stated that the performance of the ATMS had been exceeding the important safety criteria adopted by most European aviation authorities, i.e. the availability of surveillance information of 99.999 per cent for three essential types of information (i.e. flight position, altitude information and secondary surveillance radar code) since the system commissioning. Although two FDPs of the Main System experienced a momentary hitch on August 13, 2018, all three essential types of information were shown as per system design. The Expert Panel also stated in its report that as the ATMS was a large-scale, complex and comprehensive computer system, minor occurrences would occur intermittently for different reasons (including human factors) especially during the initial stage of its operations. The Expert Panel stressed the importance of a pragmatic approach on resilience and multi-layers of fallback in system design, well-trained professionals with standing procedures for contingency handling and an effective Safety Management System to anticipate and manage risks. The Expert Panel acknowledged in its report that the above mentioned arrangement were all in place in the CAD.
The CAD will continue to closely monitor the performance of the ATMS, and optimise the ATMS as well as overall ATC services in a sustained manner, and remain committed to ensuring that aviation safety is our top priority.