FMS Data Entry Error Prevention

Best Practices

1st Edition
 NOTICE
DISCLAIMER. The information contained in this
publication is subject to constant review in the
light of changing government requirements and
regulations. No subscriber or other reader should
act on the basis of any such information without
referring to applicable laws and regulations and/
or without taking appropriate professional advice.
Although every effort has been made to ensure
accuracy, the International Air Transport Association
shall not be held responsible for any loss or
damage caused by errors, omissions, misprints
or misinterpretation of the contents hereof.
Furthermore, the International Air Transport
Association expressly disclaims any and all
liability to any person or entity, whether a
purchaser of this publication or not, in respect of
anything done or omitted, and the consequences
of anything done or omitted, by any such person or
entity in reliance on the contents of this publication.

© International Air Transport Association. All

Rights Reserved. No part of this publication
may be reproduced, recast, reformatted or
transmitted in any form by any means, electronic
or mechanical, including photocopying, recording
or any information storage and retrieval system,
without the prior written permission from:

Senior Vice President

Safefy & Flight Operations
International Air Transport Association
800 Place Victoria
P.O. Box 113
Montreal, Quebec
CANADA H4Z 1M1

FMS Data Entry Error Prevention Best Practices

ISBN 978-92-9252-778-5
© 2015 International Air Transport Association. All rights reserved.
Montreal—Geneva
 Table of Contents
Introduction ...................................................................................................................................................... 1

Case Studies .................................................................................................................................................... 2

Tailstrike and runway excursion, Airbus A340-541 at Melbourne, Australia, 20 March 2009: ......................2
Controlled flight into terrain – Boeing 757-223 near to Cali, Colombia, 20 December 1995: ........................3

FMS Technology .............................................................................................................................................. 3

Human Performance........................................................................................................................................ 4

Human/Machine Interface ............................................................................................................................... 4

Organizational Factors .................................................................................................................................... 6

Common Error Types and Best Practice Mitigations by Phase of Flight .................................................. 7

Strategic Error Prevention and Management ............................................................................................. 17

Conclusion ..................................................................................................................................................... 20

i 1st Edition 2015

 FMS Data Entry Error Prevention

List of Figures
Figure 1: A340 Tailstrike Damage.................................................................................................................. 2
Figure 2: Typical FMS Control & Display Units (CDU) ................................................................................ 5
Figure 3: Typical Glareshield Autopilot/Flight Director Interfaces ............................................................ 5

ii 1st Edition 2015

Introduction
In the space of 40 years the flight management system (FMS) has evolved from a simple navigation
management device into a fully integrated aircraft management system, receiving inputs from sensors in all
flight critical systems and providing outputs that control virtually every aspect of the aircraft’s behavior. The
FMS has delivered efficiencies in aircraft management that are far beyond the capabilities of the human
pilots however some data required by the FMS must still rely upon the human, either pilots or other external
parties, to obtain and enter by its variety of interfaces. It is within these interactions that errors, some with
catastrophic results (see Case Studies below), can occur.

A total of 309 air safety reports (ASRs) involving FMS data entry error were identified in the IATA Global
Aviation Data Management (GADM) / Safety Trend Evaluation, Analysis & Data Exchange System
(STEADES) program between 2007 and 2011. Based on total flights operated by GADM-STEADES
members during this period, these 309 reports extrapolate into approximately 2,377 global industry events
over five years or one (1) event per day.

Analysis of the reports showed that errors related to navigational data, potential for a Mid Air collision
or Controlled Flight Into Terrain (CFIT) accident, accounted for 80% of the reports, while 20% were related
to performance data and associated LOC-I or runway excursion accident. The analysis also shows that
Air Traffic Control (ATC) related threats, cited in 27% of the reports, were the top contributor to FMS entry
errors. Route modifications instructed by ATC; runway, departure and arrival changes; and revised altitude
and speed instructions were commonly reported factors. These changes require the flight crew to modify the
programed vertical and horizontal trajectories in the FMS, potentially introducing errors, distractions and
increased workload especially during critical phases of flight.

Other reported threats such as aircraft malfunction, cabin events, ground events and dispatch/paperwork
provided further evidence that flight crew distraction during FMS programing, and in particular during the
busy pre-flight phase, frequently contribute to data entry errors. In addition to inadequate management of
these external threats, a significant source of reported FMS entry errors was flight crew interaction with the
FMS Control & Display Unit (CDU). Errors made when using FMS key pad/CDU during programing were the
main reported data entry errors. Significantly, in 44% of the reports these errors went unnoticed by the pilots
due to failures in monitoring and cross-checking. The reports also suggest that poor situational awareness
and inadequate crew resource management led to flight path deviations following FMS data entry errors.
In 35% of all reports, flight path deviations were first recognized by ATC rather than by the pilots, indicating
inadequate error recognition and management.

This guide aims to analyse the threats which are known to promote and propagate these errors, to explore
the common error types that have been identified in previous incidents and propose some strategic and
tactical measures to help pilots and operators to prevent, identify and manage FMS data entry errors. The
guidance is not intended to replace or contradict International Civil Aviation Organization (ICAO) Standards
& Recommended Practices, State regulations, IATA International Operational Safety Audit (IOSA)
Standards or manufacturers’ procedures and guidance. Air carriers should always comply with the
regulations and requirements of the relevant Competent Authority.

1 1st Edition 2015

 FMS Data Entry Error Prevention

Case Studies
Tailstrike and runway excursion, Airbus A340-541 at Melbourne,
Australia, 20 March 2009:

The flight was to operate from Melbourne, Australia to Dubai, United Arab Emirates with a ‘heavy’ crew of
four (4) pilots, 14 cabin crew and 257 passengers. In accordance with company procedures the operating
first officer entered the required data into the laptop take-off performance application and recorded the
output values. The captain reviewed the data and entered the V speeds, the flap setting and the flex thrust
temperature into the FMS. The aircraft was taxied to runway 16 for take-off, with the first officer as pilot
flying. At VR the captain called ‘rotate’ but seeing that the rotation did not commence, he called ‘rotate’
again. The aircraft pitched up but did not lift off and the rear fuselage contacted the runway surface. As the
end of the runway was reached the captain selected TOGA (take-off/go-around or maximum) thrust but the
aircraft main wheels and rear fuselage remained in contact with the ground in the overrun area for some
distance before becoming airborne. After lift-off one of the main wheels impacted upon the ILS localiser
antenna. The aircraft returned to Melbourne and landed safely.

Figure 1: A340 Tailstrike Damage

2 1st Edition 2015

 FMS Data Entry Error Prevention

Controlled Flight Into Terrain – Boeing 757-223 near to Cali, Colombia,

20 December 1995:

The flight was a scheduled passenger service from Miami, USA to Cali, Colombia with two (2) pilots, six (6)
cabin crew and 155 passengers on board. On arrival from the North the controller offered the ‘straight in’
VOR/DME approach to runway 19, which the crew accepted. The clearance was for the ROZO 1 arrival for
the VOR/DME 19, with no additional altitude constraints beyond those published on the chart. The captain
subsequently requested direct to the ROZO NDB (identifier ‘R’), on the approach to runway 19 and he
misunderstood this to have been approved. The controller actually reiterated the clearance for the ROZO 1
arrival, with an instruction to report 21 miles on the DME and 5,000 feet (Cali airfield elevation is 3,162 feet).
Shortly thereafter the aircraft turned approximately 90 degrees left of the cleared route and flew east for
one (1) minute before turning back to the right, in a continuous descent. Passing approximately 9,000 feet in
instrument meteorological conditions (IMC) the aircraft’s ground proximity warning system (GPWS) ‘terrain’
warning activated and in spite of efforts by the pilots to respond to the warning, the aircraft crashed into a
mountainside. The investigation determined that the pilots had erroneously entered an incorrect navigation
aid identifier into the FMS.

FMS Technology
As long range commercial aviation began to grow in the 1950s and ‘60s the demand for more versatile and
accurate navigation systems grew with it. Flights over remote areas were able to supplement celestial
navigation with inertial navigation systems (INS) and by the ‘70s aircraft were being equipped with
navigation and performance computers. In the early ‘80s the first integrated flight management systems
appeared, combining navigation and performance functions in a single system and ultimately contributing to
the demise of the flight engineer role.

Modern FMS vary from simple navigation/performance computers to sophisticated control and computation
systems, drawing data from multiple sources and providing numerous outputs to the aircraft systems, to the
pilots and even to ATC, maintenance providers and airline dispatchers, remotely to the aircraft. The
accuracy of the present generation of FMS allows for the reliable prediction and guidance of vertical and
horizontal aircraft trajectories along with precise thrust management to optimize fuel efficiency and
aircraft utilization.

However, there has long been a concern as to what effect these systems have on the role of the pilots and
in particular the implications for cockpit workload. While the FMS undoubtedly absorbed many of the
functions previously performed by humans, one early study published by NASA (‘Human Factors of
Advanced Technology Transport Aircraft’, Earl Wiener, 1989) even concluded that while the FMS may
decrease cognitive workload for the pilots when workload is low they potentially increase it when workload is
already high. In its current form the FMS continues to require significant interaction from the pilots, entering
data, making selections and crucially monitoring and cross-checking the system outputs. With the exception
of the very latest aircraft types, the design of the FMS CDU, through which much of the interaction occurs,
has changed little since the earliest incarnations. However, increasingly FMS software programs are
including internal gross error checking functions to highlight potentially erroneous inputs.

3 1st Edition 2015

 FMS Data Entry Error Prevention

Human Performance
Bearing in mind that the human brain has changed very little in hundreds, if not thousands of years it has
assimilated remarkably well into the complex world of aviation, adapting to an unfamiliar environment and
accumulating the countless necessary new skills. In simple terms the brain puts these skills into practice by
using two separate ‘channels’ to direct the movements and actions of the body: a cognitive channel
involving conscious thought in the brain’s simple but fast ‘processor’, things like problem solving and
decision making, and; a sub-conscious channel using complex movement sequences learned through
repetition, like a golf swing or manually flying an aeroplane.

The trouble is that each of these channels is vulnerable. Human cognitive capability is finite and prone to
overload in times of stress, it can be misled by confusing or contradictory inputs and it is very poor at
recognizing its own errors. Learned skills on the other hand can be eroded by lack of practice, confounded
by unfamiliar circumstances or initiated at an inappropriate time.

The increasing sophistication of aircraft computers in their ability to make calculations and to control the
aircraft systems has had a fundamental effect on the role of the pilot, changing it from primarily controlling
to mostly monitoring and observing. Unfortunately like all humans, pilots are prone to fatigue, distraction,
boredom, complacency, illness and stress and each of these can impact significantly upon the prolonged
concentration required to be an effective monitor – machines tend to be much more reliable and accurate.

Human/Machine Interface
The effective operation of aircraft and their systems requires there to be a point or points at which humans
can interface with them, receiving the information generated, making decisions and responding with
appropriate inputs and selections. Pilots work with the FMS through several physical and optical interfaces
(even a few aural ones) including the flight controls, the cockpit displays, the CDU keyboard and the
autopilot and flight director system controls, each of which is conceptually very different.

4 1st Edition 2015

 FMS Data Entry Error Prevention

Figure 2: Typical FMS Control & Display Units (CDU)

To an experienced pilot the flight control interface is probably entirely intuitive but the same cannot
necessarily be said for the others. With the exception of the very latest generation of aircraft, CDU
keyboards have stuck with the original square alphabetical layout rather than the QWERTY layout most
people will use elsewhere in their lives. The CDU display is simplistic, often using only one or two font
colours and sizes on a series of discrete pages that pilots must select in turn. The autopilot and flight
director system controls, located mostly but not exclusively on the cockpit glareshield, use unique
combinations of rotating, pulling, pushing and switching to convey critical commands to the system, but the
effect of each selection is generally displayed elsewhere on another instrument panel. The main cockpit
displays use a variety of colours, fonts and symbols to combine a vast amount of data and information into
a few small screens, requiring careful monitoring, scanning and interpretation by the pilots.

Figure 3: Typical Glareshield Autopilot/Flight Director Interfaces

5 1st Edition 2015

 FMS Data Entry Error Prevention

Organizational Factors
Operators publish policies and develop procedures in order to shape the behavior of individuals within the
organization but unless those individuals subscribe to the same beliefs as the policy-makers they are
unlikely to conform entirely, especially when out of sight. This points to a definition of organizational culture
as ‘the common behaviors and beliefs which define a group of individuals’ and it is vital to get it right to
ensure that people do the right thing even when no-one else is looking. There will always be outlying
individuals who do not fit in but if the majority accept and support the culture it can thrive and grow.
Fairness, openness and consistency from management (sometimes referred to as a ‘just’ culture) will foster
trust, compliance and professionalism within the team, essential to identifying threats, minimising errors and
enhancing error management.

Organizations can introduce threats to the system, which make FMS data entry errors more likely, and they
can provide tools which reduce the likelihood of errors or make it easier to detect and manage them once
made. A common threat in commercial airline operations is time pressure, (whether it is actual or perceived),
leading to stress, rushing, short cuts and errors. Human nature is such that an individual, when undertaking
a repetitive task will try to introduce shortcuts. Understanding the purpose, the need for a process to
address the risks will help to minimise the human desire to introduce ‘shortcuts’. Airline managers must
carefully balance the commercial imperatives of on-time performance and cost control with an
understanding of the consequent effects on human behavior. Fuel saving initiatives like taxiing on one
engine can increase workload during a critical phase of operation and make errors more likely. Airlines may
establish centralized functions like load control and take-off performance calculation, apparently reducing
cockpit workload and distraction but at the same time increasing the amount of cross-checking required.
Laptops and electronic flight bags may assist with complex data functions but introduce further opportunities
for data entry, calculation and transcription errors.

Changes in the organizational environment also have the potential to become threats – rapid airline
expansion requiring the influx of many new personnel and thereby diluting the prevailing culture; early
promotions and direct entry commanders bringing relative unknowns to the cockpit; airline mergers and
takeovers with conflicting cultures and procedures; restructuring and redundancies creating uncertainty and
resentment. All of these threats need to be analysed, understood and managed to ensure that they don’t
contribute unduly to errors in the cockpit.

Finally, operators have a responsibility to ensure that the service provider for their FMS databases can
provide adequate assurance of the integrity and accuracy of the data, which must be accepted at face value
by the pilots at the point of use.

6 1st Edition 2015

 FMS Data Entry Error Prevention

Common Error Types and Best Practice Mitigations

by Phase of Flight
Planning – errors in the data that pilots take onto the flight-deck with them, and ultimately enter into the
FMS, can begin well before they board the aircraft:

TRAPS MITIGATIONS
Mass & Balance – aircraft mass and balance data The operator’s quality management system must
like aircraft basic weight and centre of gravity, include regular audits of the process by which these
whether it is stored on a database or recorded on data are derived and the accuracy of the values
paper, may be incorrect and will ultimately affect the themselves.
zero fuel weight (ZFW) and ZFW centre of gravity All discrepancies should be reported via the safety
(ZFWCG) entered in the FMS. management system (SMS) reporting program and
addressed appropriately.
Flight Plan – the operational flight plan, which may Standard Operating Procedures (SOPs) must
be calculated manually by the pilots or more usually include appropriate cross-checks for all manually
nowadays generated by flight planning software, calculated flight planning data.
may be incorrect and include erroneous information SOPs must include appropriate gross error checks
for take-off weight, fuel burn, route, winds and for all computer generated flight planning data.
cost index. Pilots should check that the operational flight plan
matches the ATC filed plan.
Load and Trim Sheet – aircraft loading that is SOPs for load control must include appropriate
contrary to the loading instruction or mistakes in gross error checks and cross-checks for
calculations made by the load controller may loading data.
introduce errors to data required for the FMS. The SMS reporting program must be non-punitive
and encourage loading staff to report errors and
discrepancies in loading.
Education and training for loading staff will help
spread an understanding of the importance of
loading accuracy.
Navigation Database – latent errors may exist in The contracted navigation database provider must
the navigation database. be able to demonstrate the assurance processes it
uses to ensure accuracy, and undertake to adhere
to them.
The operator’s quality management program must
include regular audits of database accuracy.
SOPs must include a check of the navigation
database currency before flight.
All discrepancies should be reported via the SMS
reporting program and addressed appropriately.

7 1st Edition 2015

 FMS Data Entry Error Prevention

Pre-flight – the period between boarding the aircraft and engine start is when much of the critical data are
calculated and most are entered into the FMS but it is also one of the busiest periods of the flight with
conflicting demands on the pilots’ time.

TRAPS MITIGATIONS
FMS Limitations – FMS computer processing Never make simultaneous entries on both
power is limited and can be overwhelmed. Earlier multifunctional control display units (MCDUs) and
FMS do not incorporate internal automated ensure only one key is pressed at a time.
cross-checks of data values. Never make data entries when the FMS is
processing a calculation.
FMS entries should be slow and deliberate to ensure
that they reflect the pilot’s intention.
Check that the scratchpad is blank/clear before
commencing programing or preparing an entry.
Check the aircraft position for initialisation against
the prescribed data (aerodrome chart, airport sign
or company data as appropriate).
Scratchpad messages should be reviewed by both
pilots to confirm the implications before being deleted.
Pilots must have a good understanding of the FMS
data entry and display conventions like: data pairs
separated by a /; entry of positive and negative
values; user defined waypoints.
Data Calculation – take-off performance and the SOPs for the calculation of take-off data must take
associated thrust, speed and configuration data, is account of the time available and the possibility that
dependent on a significant number of variable a subsequent calculation may be required.
inputs, the values of which are frequently not defined Pilots must adhere rigorously to the calculation and
until close to departure, thereby compressing the cross-checking procedure and not be tempted to
time available for calculations. Typically the make short cuts.
loadsheet with vital mass and balance data is not Perform the take-off data calculation and cross-
completed until 15 minutes before push-back and check according to the SOP, ensuring that the latest
whilst the pilots may have made preliminary runway environmental data are used and that the
calculations based on estimated values these may loadsheet values are correctly transcribed – the
change significantly requiring complete recalculation. most robust safeguard against output error is for
It is also important that the environmental conditions each pilot to make entirely separate calculations and
used in the calculations are as close as possible to then to compare results.
those prevailing at the time of take-off and especially
If operating with an augmented or ‘heavy’ crew,
in rapidly changing conditions pilots must use the
consider using them to provide a further calculation
very latest reports. Whether the calculations are
and/or cross-check of the data but do not devolve
made manually or by reference to a software
the responsibility to them alone.
application on a laptop or electronic flight bag (EFB)
the pressure of time can lead to errors of calculation,
omission of essential checks and the failure to
identify erroneous data.

8 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Where available use gross error checks from other
systems to verify the accuracy of the take-off data
(V2 or minimum clean speed for example, which may
be calculated separately by the FMS using the
aircraft gross weight).
SOPs must include defined limits for acceptable
changes to data inputs (weight, fuel, index, wind etc)
before a recalculation is required.
Gross error checks should be developed for all
critical data calculations.
Adhere to the SOPs for task allocation of data
entry and cross-checking, and whether to have
one pilot read out the data while the other confirms
from the source or for them to perform individual
cross-checks.
Data Transcription – whether calculated manually Pilots must be made aware of the potential
or by software at some point the calculated values for these transcription errors and be trained
must be transcribed into the FMS and there is to rigorously adhere to SOPs for transcription
significant potential for errors in this mental and and cross-checking.
physical interface such as misreading the data, If inserting a route manually beware of duplicate
misunderstanding the data, inadvertently waypoint/navaid identifiers and airways with more
transposing values, entering incorrect values (see than one common intersection.
the Case Study above), entering data in the wrong If necessary to insert user defined waypoints
field or omitting values entirely. Once again this is (lat/long, place/bearing/distance, waypoint +/-,
usually completed in the final few minutes bearing/bearing etc) take care to verify that they are
before departure. on the required route.
Cross-check the route against the operational flight
plan (and hence ATC plan), checking tracks and
distances and using the horizontal display to
highlight anomalies.
Check the FMS departure and transition against the
charts to confirm the route and any altitude or speed
constraints – if available use the horizontal display to
show the constraints.
Always refer to the 3-letter identifiers for navigation
aids rather than the geographical name of the aid to
prevent confusion.
When available check the loadsheet basic data for
accuracy (registration, date, basic weight and index)
and review the output values of mass and balance
against those expected – investigate any
significant differences.

9 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Beware of common errors such as reversing or
transposing digits or inserting values into the
incorrect field.
Cross-check the take-off data using displays such as
the airspeed indicator for V speeds and N1/Engine
Pressure Ration (EPR) gauges for take-off thrust.
Cross-checking – however the data come to be in Pilots must be made aware and regularly reminded
the FMS, by manual entry, direct from the FMS of the risks of complacency when cross-checking
database or by uplink they must be cross-checked FMS data.
for accuracy and reasonableness. Pilots’ procedures Pilot proficiency assessments should include
will direct them to cross-check most of the input and diligence in cross-checking data.
output data of the FMS during the pre-flight phase Conduct individual cross-checks silently to avoid
and almost every time they do it, the data will be inadvertently passing on errors.
accurate and correct. This laborious checking of
The SMS reporting program must be non-punitive
routinely accurate data can lead to omissions,
and encourage reporting of errors in cross-checking
oversights and complacency. If an error is identified
data in order to enhance awareness of the risk.
during pre-flight it will probably be necessary to
Use the departure briefing to highlight critical items
recalculate the value or values in whatever
of FMS data as a further check and cross refer to
time remains.
other displays to confirm values where possible.
Once the ATC clearance is received (radio or
Pre-departure Clearance [PDC]) check that the FMS
route conforms – amend and re-check if necessary.
Time-pressure – a great deal must be achieved in Pilot training should include strategies for time
the pre-flight phase which is typically under one hour management and for coping with time pressure.
and sometimes much less than that, especially Operators must make it clear that adherence to SOP
during a turnaround. The pilots must complete the takes precedence over departure time.
external inspection, liaise with ground and cabin Collaborative training for pilots, cabin crew and
staff, review the aircraft maintenance status, make ground staff should emphasise the risks of
a number of data calculations, program and cross- time pressure.
check the FMS, prepare and conduct briefings and
Any significant late changes to environmental
address the passengers. Time-pressure may lead
conditions or to the aircraft loading (values as
to short cuts, omissions, errors and oversights in the
defined by SOPs) require that the take-off data be
calculation, entry and cross-checking of FMS data.
recalculated and re-checked in accordance with the
full procedure.
Where available use a second FMS route to insert
the most likely option if the flight planned route
cannot be followed – alternative take-off runway,
engine out departure, immediate return to departure
airfield, diversion – in order to minimise programing
time in the event of a change.

10 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Distractions – there are multiple and often Collaborative training for pilots, cabin crew and
conflicting demands upon the pilots during the ground staff should emphasise the risks of
pre-flight phase and it is easy for them to be distraction.
distracted from or during vital data related tasks. It is SOPs should be written to allow for ‘modular’
impractical to entirely cocoon the pilots because progress through pre-flight preparation.
communication is vital but cockpit visits by cabin If distracted from a procedure or process, return to
crew, load controllers, ramp agents and engineers, the start and begin again.
and radio and interphone communications with
Pilots should communicate to cabin crew and ground
dispatch, ATC and ground staff all compete for the
staff when they require to be left alone.
pilots’ attention.

Start Up & Taxi – immediately prior to and during the taxi phase the pilots must develop and maintain
a robust situational awareness of the ground environment in order to avoid conflictions, collisions and
incursions but at the same time changes in the weather or ATC instructions may require the recalculation
and re-entry of FMS data.

TRAPS MITIGATIONS
Weather – significant changes in the prevailing Any significant changes to environmental conditions
weather, including wind strength and direction, require the take-off data to be recalculated and
precipitation and temperature may require the FMS cross-checked according to the SOP – it may well be
data to be revised. necessary to stop the aircraft in order to achieve this
safely and accurately.
Runway – late changes to the runway in use, the Any significant runway changes require the take-off
runway condition or departure intersection may data to be recalculated and cross-checked according
likewise require the data to be amended. to the SOP – it may well be necessary to stop the
aircraft in order to achieve this safely and accurately.
Departure – ATC may advise changes to the A change to the ATC clearance may require the
departure to be flown after take-off and this too will route to be amended and cross-checked according
require the pilots to update the FMS data. to the SOP – it may be necessary to stop
the aircraft.
Conflicting Demands – during taxi the pilots SOPs must define a point prior to engine start,
communicate with ATC, cabin crew and possibly typically closure of the last external door, from which
dispatch, they navigate and guide the aircraft along the sterile cockpit procedure prevails and this should
the cleared taxi route, select and cross-check continue until at least 10,000 feet in the climb –
flap/slat configurations, review the FMS and other during this time there should be no visits to the
displayed data, conduct any final take-off briefings cockpit, minimal communications from the cabin
and complete one or more checklists. Any crew and no non-operational conversation by
requirement to recalculate and re-enter FMS data the pilots.
will likely conflict with these tasks creating the From shortly prior to brake release until the aircraft is
potential for errors, omissions and oversights in the parked at destination one pilot must be primarily
data. The additional attention required to ensure engaged with managing the aircraft at all times –
FMS data accuracy may conversely lead to errors in SOPs must be clear on the allocation of this role.

11 1st Edition 2015

 FMS Data Entry Error Prevention

the taxi route, possibly contributing to a mismatch Flap/slat selection is often made after engine start
between the calculated data and the actual aircraft and must be checked against the calculated take-off
take-off position (erroneous departure from the data inserted into the FMS.
wrong intersection). The take-off briefing or review should be used as
another opportunity to confirm and check critical
FMS data and cross-check with other displays such
as stabiliser/trim setting, thrust setting, flap/slat
configuration and V speeds.
Approaching the runway verify that the intersection
to be used for take-off corresponds to that used for
the take-off data calculation and to the FMS.

Take-off and Initial Climb – very few FMS data entries or cross-checks are made during these phases but
it is during take-off that many of the most serious implications of data entry errors will become apparent.

TRAPS MITIGATIONS
Weight – if the actual take-off weight differs Pilots must be alert to aircraft performance
significantly from the weight used to calculate the anomalies related to potential FMS data entry errors
take-off data entered in the FMS, then much of that and be prepared to react promptly – early in the
data will be incorrect, including the thrust setting, take-off roll the safest option is to stop.
V-speeds and possibly flap/slat configuration. Performance deficiencies detected later in the take-
off are more difficult to manage and pilots will need
to use their judgement – if the decision is to ‘go’ then
full power must be applied immediately to expedite
the take-off.
Balance – incorrect aircraft balance data will have Pilots must be prepared to quickly and positively
generated an inappropriate horizontal stabiliser or correct their control inputs to manage any control
trim setting for take-off, potentially creating aircraft difficulties during rotation and initial climb.
control problems at rotation. Simulator training should if possible include take-off
trim anomalies.
Thrust – excess thrust is unlikely to have any Pilots must be alert to aircraft performance
adverse impact on take-off but insufficient thrust will anomalies related to potential FMS data entry errors
erode accelerate/stop distance margins and may and be prepared to react promptly – early in the
ultimately lead to runway overrun (see Case Study take-off roll the safest option is to stop.
above). Performance deficiencies detected later in the take-
off are more difficult to manage and pilots will need
to use their judgement – if the decision is to ‘go’ then
full power must be applied immediately to expedite
the take-off.

12 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Speeds – incorrect V-speeds may contribute to Performance deficiencies detected later in the take-
aircraft control difficulties, runway excursion, off are more difficult to manage and pilots will need
tailstrike or inappropriate stop/go decision making in to use their judgement – if the decision is to ‘go’ then
an emergency. full power must be applied immediately to expedite
the take-off.
Configuration – selecting the wrong flap/slat Any activation of a configuration warning at thrust
configuration for take-off may adversely affect setting must result in the take-off being abandoned
aircraft performance during rotation, lift-off and initial and the cause investigated.
climb.
Departure Route – errors in the departure route Aircraft trajectory once airborne must be monitored
entered in the FMS may contribute to loss of carefully to ensure that the lateral and vertical
separation from other traffic, airspace incursion or clearances are adhered to – any deviation must be
unsafe terrain proximity after take-off. corrected immediately using inputs to the
autopilot/flight director system if required to avoid
risk of loss of separation or terrain proximity.
Whilst airborne pilots must adhere to the SOP task
allocation for autopilot/flight director system
selections.

Climb and Cruise – once airborne navigational data in the FMS becomes as important as aircraft
performance data and errors in FMS entries can be critical.

TRAPS MITIGATIONS
Route – the route entered by manual entry, via Changes to the ATC clearance should be confirmed
uplink or from the database drives the predictions of by both pilots before being inserted into the active
flight time and fuel generated by the FMS and if FMS route.
incorrect these may inappropriately affect Amendments to the FMS, whether by manual entry,
operational decisions made by the pilots. If the FMS database selection or uplink must always be verified
route does not correspond to the filed flight plan by both pilots in accordance with SOP before they
there may be airspace incursions, terrain proximity are inserted or executed – this includes a check of
and traffic conflictions and the same may be true in the other displays as appropriate (horizontal display
the case of erroneous FMS route amendments of proposed new route for example).
made during flight (see Case Study above). Use FMS predictions of time and fuel at destination
to identify gross errors especially after route
amendments – any significant change in these
values must be investigated.
Pilots must fully understand route modification
strategies such as ‘direct to’, intercepting radials and
airways, user defined waypoints and ‘offsets’ and be
alert to route discontinuities after route amendments.

13 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Long ‘direct to’ legs may remove waypoints from the
route that would have been used for fuel progress
checks – select or insert ‘on track’ or ‘abeam’
waypoints if available to replace them.
Prior to each waypoint check track and distance to
the next waypoint against the operational flight plan
– if the route has been amended calculate
approximate values to perform the check.
Use abeam points, second FMS routes and
appropriate screen displays to mark suitable en
route diversions.
FMS route data accuracy is especially important
when flying over remote and oceanic regions,
where there are no other navigational aids for
cross-reference.
Even in cruise there should be no occasions when
both pilots are engaged ‘head down’ with the FMS at
the same time – one should make the selections and
the other cross-check prior to insertion.
Weight – an incorrect aircraft weight value will also Throughout the flight regular checks of the FMS
affect FMS predictions and the calculation of predicted time and fuel at destination should be
maximum and optimum altitudes, although some made – they should remain consistent unless there
aircraft can correct this once airborne. has been a significant change in the FMS, the cruise
level, the wind or crucially the fuel state.
Environmental Data – as with the aircraft weight, if Throughout the flight regular checks of the FMS
the winds and temperatures entered or uplinked are predicted time and fuel at destination should be
not accurate many of the predictions and made – they should remain consistent unless there
calculations will be incorrect. has been a significant change in the FMS, the cruise
level, the wind or crucially the fuel state.
Update winds and temperatures manually or by
uplink as necessary.

14 1st Edition 2015

 FMS Data Entry Error Prevention

Descent – towards the end of the flight and in particular during descent the FMS fuel and time predictions
become more critical to pilot decision making and any incorrect data may impact upon this process.

TRAPS MITIGATIONS
Top of Descent – if the weight, route or other data Pilot flying should hand over control to the other pilot
entered in the FMS are incorrect then calculation of in order to program the FMS and take back control
the descent path and consequently top of descent for the other pilot to cross-check the FMS.
point will be affected. This may lead to high rates of Beware of duplicate names of navigation aids and
descent, time compression and possible terrain cross-check before selecting.
proximity and may contribute to a subsequent Enter and/or cross-check the descent winds in
unstable approach. the FMS.
Check FMS top-of-descent point and
altitude/distance relationship for descent in the
forecast wind conditions.
If available program the second FMS route for the
next most likely approach/runway to reduce potential
re-programing in descent.
Conduct the arrival briefing well before top-of-
descent (10 minutes at least) and use the briefing as
an opportunity to highlight and cross-check critical
FMS data using all appropriate displays.
Landing Performance – landing performance Obtain destination and alternate weather, and
calculations based upon FMS predictions may be runway in use (ATIS) whilst in cruise.
incorrect. Use the FMS prediction for fuel at destination plus
zero fuel weight to calculate landing weight and
determine landing distance required in the
forecast/reported conditions.
Fuel – incorrect FMS data may cause inaccurate Monitor arrival fuel prediction throughout descent.
fuel predictions and affect operational decisions Program the route to the selected alternate,
related to holding or diversion. including most likely arrival, approach and runway
for the most accurate fuel prediction.
Route – as well as affecting FMS predictions, an Check the navigation accuracy status.
incorrectly entered route for descent may take the Enter the expected arrival (including holding),
aircraft into restricted airspace or close to terrain. approach and runway in the FMS.
Check the chart for altitude/speed constraints and
confirm in the FMS using displays as appropriate.
In descent monitor vertical deviation from the FMS
calculated path together with altitude against
distance to touchdown, in relation to altitude/speed
constraints and aircraft energy management.

15 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
ATC – it is not unusual for ATC to amend route and Be prepared for ATC clearance changes – cross-
altitude instructions during the descent and check before inserting and consider/brief the
accommodating these changes in the FMS requires implications.
the pilots to divide their attention between operating Avoid lengthy or complex FMS programing below
and monitoring the aircraft, and FMS data 10,000 feet where possible.
entry/cross-checking.

Arrival, Approach and Landing – these are very busy phases of the flight and all of the considerations
applicable to descent are even more relevant as available time, fuel and altitude diminish.

TRAPS MITIGATIONS
ATC – ATC may well instruct changes to the arrival, If holding is required confirm the orientation and
approach and runway in use, which could render the direction of the holding pattern in the FMS with the
FMS data incorrect. chart or with ATC before entry.
Reduce to the correct holding airspeed prior to
entering the hold and monitor the FMS hold entry for
accuracy – if necessary intervene with autopilot/flight
director system selections.
Monitor fuel in the hold and calculate latest exit
time/fuel in relation to any estimated approach
time (EAT).
When cleared for the approach, ensure correct
waypoint sequencing to maintain accurate
predictions and FMS flight phase.
Do not engage in major FMS re-programing – if
necessary use autopilot/flight director system
selections instead but be aware that FMS
predictions may no longer be accurate.
Weather – unexpected changes in surface Monitor Automatic Terminal Information Service
conditions and runway state may also be at odds (ATIS), ATC and pilot reports for significant changes
with the respective data in the FMS. to environmental conditions – it may be necessary to
request additional track miles to make changes to
the FMS.
Approach & Landing Performance – the speeds Be alert to unusual aircraft performance, steep or
for approach and landing and the selected flap fast approach and correct as appropriate – if
setting may be incorrectly entered in the FMS necessary go-around.
leading to inappropriate approach and landing Observe the stabilized approach criteria.
performance and potentially an unstabilized In the event of a go-around ensure the correct
approach and/or runway excursion. waypoint sequencing for the missed approach path,
second approach or route to the alternate.

16 1st Edition 2015

 FMS Data Entry Error Prevention

TRAPS MITIGATIONS
Conflicting Demands – as the workload increases SOPs must define a point, typically 20,000 feet or
towards landing and the time to make FMS changes top-of-descent, from which the sterile cockpit
diminishes the pilots must decide which FMS data procedure applies (see Pre-Flight above) and
amendments are critical to the flight and which may continues to apply until the aircraft is parked – during
be safely disregarded in favor of flying the aircraft. this time there should be no visits to the cockpit,
minimal communications from the cabin crew and no
non-operational conversation by the pilots.

Strategic Error Prevention and Management

Procedures – in general the standard operating procedures promulgated to pilots should reflect the
procedures published by the aircraft or system manufacturer. If these are found to be impractical or
ineffective then the operator should first attempt to resolve the situation in partnership with the manufacturer
and only as a last resort develop their own unique procedures. The adoption of common procedures
throughout the global user-group offers the best opportunity to identify and rectify shortcomings to achieve
the best possible operating procedures. In all cases the procedures must be: robust, in that that they
achieve the desired outcome in all circumstances; logical, in that the process makes sense to the user in the
context of the overall task, and; modular, in that individual task processes can be completed separately from
others to allow for unforeseen interruptions and distractions. However, none of this can be effective without
a universal culture of procedural compliance within the pilot group, supported and fostered by training and
airline management.

Monitoring and cross-checking – constant monitoring and repetitive cross-checking are vital to the
identification and management of all errors, including those of FMS data entry. Unfortunately humans are
not especially good at either function, being prone to boredom, complacency, distraction and fatigue. Where
alternative technological solutions (see below) are not available it is essential that pilots recognize both the
need for accurate monitoring and cross-checking and the inherent human weaknesses in these functions.
Training must help them to build strategies to counter this threat, like periodically swapping tasks between
entering and cross-checking data, developing gross error checks and rules of thumb (see below), building a
mental picture of the ‘normal’ parameters for each phase of flight and recognizing the onset of symptoms of
fatigue, stress and illness.

Time management – key to countering the threat of time pressure is effective time management. Pilot
training and procedures must encourage them to plan ahead both strategically for the entire flight (or duty)
and tactically for the current and next phases of the flight. At the same time they must be alert to changes
in the operational environment and be prepared to amend or even abandon their original plan if appropriate.
Decisions should not be rushed unduly but pilots must also recognize when the time for discussion and
consideration has passed and a decision has to be made. They must be prepared to differentiate when
necessary between safety critical operational time pressure and commercial time pressure, and respond
accordingly. Operators need to be aware of the potential threat of organizational time pressure, whether
it is actual or perceived.

17 1st Edition 2015

 FMS Data Entry Error Prevention

Workload management – workload is a critical factor in threat and error management. Cockpit workload
rises and falls with and during phases of flight, and pilots’ training and procedures should encourage and
enable them to utilize the periods of lower workload for routine tasks like reviewing the FMS, while confining
activity to essential operational tasks during periods of higher workload. Significant workload management
threats are distractions and interruptions, frequently from external sources such as the radio or cockpit visits.
Whilst operational communications are unavoidable, strict adherence to sterile cockpit procedures during
the critical phases of flight can reduce the threat and hence the risk of error. Collaborative training and
procedures for pilots, cabin crew and ground staff can help to manage interruptions, especially common
during the busy pre-flight phase. Fatigue is a major threat to individual workload capacity and an effective
fatigue risk management system (FRMS) can help manage and mitigate the impact of fatigue.

Another significant workload management factor in FMS data entry errors is the allocation of FMS and
autopilot/flight director systems selections to each pilot. Whilst parked at the gate the pilots can safely work
together on the data entry and cross-checking processes but once the aircraft is in motion it is essential that
one pilot is always primarily engaged with managing the aircraft. At critical phases of flight or periods of high
aircraft management workload it may not be appropriate for either pilot to be involved with FMS programing
at all. In the pre-flight phase it makes sense for the pilot nominated to ‘fly’ the aircraft (generally known as
the pilot flying) to enter the majority of the data and especially the flight plan, while the other pilot (variously
referred to as pilot monitoring, pilot not flying or non-handling pilot) performs the monitoring and cross-
checking functions. However, at other times this may no longer be optimal in terms of error prevention and
the allocation of tasks at these times must be clearly delineated in the procedures. SOPs and pilot training
must have clear direction as to which pilot is to make selections which will affect the aircraft trajectory at
specified phases of flight. In manual flight the pilot flying should command all selections and the other pilot
should perform them. In automatic flight it is more appropriate for the pilot flying to command selections at
lower altitudes (generally below 10,000 feet) or at times of high workload but to make selections themselves
in cruise and low workload periods. In all cases the output of any selection must be confirmed by both pilots
reading from the flight mode annunciations or the display screens as appropriate. In general, the FMS CDU
should be regarded as the pilot interface for long term strategic interventions and the autopilot/flight director
system controls on the glare shield (mode control panel or flight control unit) as the interface for short term
tactical interventions, keeping the pilot’s attention more ‘head up’.

18 1st Edition 2015

 FMS Data Entry Error Prevention

Gross error checks – the range of variables in some parameters affecting aircraft performance data can be
so great that it would not be possible for pilots to know precisely what to expect in every circumstance.
However, it is possible to develop ‘rules of thumb’ and gross error checks for many of the values that are
input to and output by the FMS on a given aircraft type. Rigorous application of these checks offers an
additional opportunity to identify errors which may have slipped through the procedural defences. Knowing
roughly what to expect from a calculation before it is executed, or what performance parameters an aircraft
is likely to exhibit will help pilots to recognize potential data anomalies. Operators should discuss potential
gross error checks with manufacturers and fellow operators so that the global fleet can benefit from
identified best practices.

Professionalism – a professional will accept that in almost all situations the most assured route to the
desired outcome is to follow the correct and entire procedure, without short cuts, omissions or ‘work
arounds’ and professionalism is a reflection of this acceptance. The control and management of FMS data
entry errors requires the utmost professionalism from all those involved, adhering to procedures and being
alert to threats. The culture within an organization must support and promote professionalism amongst all
safety critical staff.

Mutual mistrust – mutual mistrust is a condition in which individuals harbor a healthy degree of doubt with
regard to the actions of their colleagues. Clearly, a pervasive air of genuine mistrust would not be conducive
to good crew resource management but a professionally questioning approach that does not automatically
accept information, actions and decisions as correct can help to manage threats and to identify errors. The
same would be true with regard to an individual’s own activities, never accepting that the right action has
been taken without verifying the outcome and eliminating any doubt. Without perhaps being aware of this
specific term, pilots regularly demonstrate a degree of mutual mistrust when cross-checking each other’s
actions in accordance with their SOPs.

Education and awareness – all of the foregoing strategies rely upon robust and comprehensive training to
instill and encourage behaviors which are known to help avoid, identify and manage data entry errors. It is
vital that the training accurately reflects the operational reality and helps pilots to understand the threats they
face at work. Training must focus on producing consistent and standardized pilot behaviors across the fleet.
Due to time constraints and syllabus requirements simulator training can induce undesirable behaviors like
the rapid cancelling of multiple FMS scratchpad messages during repositioning and it is vital that this is
minimized in session plans. Familiarity with FMS operating principles and conventions comes with use and
regular access to dedicated FMS trainers offers a cost-effective avenue to increasing pilots’ knowledge,
skills and awareness and to identifying common errors.

Technology – as mentioned above there are some functions which machines perform rather better than
humans, including monitoring and cross-checking. Increasingly aircraft systems, including the FMS, are
being designed to incorporate internal safeguards and checks to ensure that potentially erroneous values
are highlighted to the pilots immediately, requiring them to be checked before proceeding. The FMS should
also be able to highlight to the pilots if its own navigation database is out of date rather than expecting them
to check it before each flight. These eminently reliable technological solutions are probably the best final line
of defence against hazardous FMS data entry errors. Other possible technological enhancements include
the use of a greater variety of colors and fonts on the CDU screens, and the use of QWERTY layout data
entry keyboards. Perhaps most effective of all in managing errors would be the reconfiguration of all of the

19 1st Edition 2015

 FMS Data Entry Error Prevention

controls and indications for the integrated FMS to ensure that the operating philosophies are consistent and
intuitive, and the relevant displays are located adjacent to the controls. FMS navigation databases contain
numerous duplicate names for navigation aids and for waypoints, which offer significant potential for error
(see Case Study above). Whilst the solution to this is not solely technological it would remove a potential
error source from within the FMS itself.

Conclusion
In its latest incarnations the FMS is a sophisticated system integrated into virtually every function of the
aircraft, providing the pilots with their primary aircraft control interface for the majority of each flight. It has
taken on so much workload that only the two pilots remain as essential crew in the cockpit. There is no
doubt that the FMS has revolutionized the task of operating an aircraft, offering efficiencies and accuracies
that were never before available. However, the FMS has also introduced threats and the potential for errors,
which can have catastrophic implications for the safety of flight. It has also fundamentally changed the tasks
of the pilots to an extent which may even be counter-productive.

For the foreseeable future all commercial air transport aircraft will be delivered with an FMS installed and so
operators and pilots must ensure that they are adequately prepared for the threats and fully aware of the
potential for errors associated with managing the aircraft through the FMS. Until the FMS is able to identify
erroneous input and output data in all cases, it will fall to the pilots to perform this vital function and the old
saying of ‘rubbish in, rubbish out’ will remain true. There are many things that pilots, operators and
manufacturers can do to reduce the threats and manage the errors associated with operating the FMS,
some simple and some more complex, but the foregoing should provide guidance for maintaining or
improving standards of safety across the industry.

20 1st Edition 2015