Serious incident to the Boeing 737- 800 registered CN-ROJ operated by Royal Air Maroc on 30/12/2016 at Lyon-Saint Exupéry (Rhône)

Cat. 1 investigation report: ICAO-format report, published after a major or complex investigation.

On 30 December 2016, the Boeing 737- 800 was being vectored to the ILS of runway 06 at Paris-Orly (Val-de-Marne). The meteorological conditions required a category 3 instrument approach (CAT III ILS).
After receiving the approach clearance, the crew twice tried to engage the second autopilot (A/P B). The non-reception of radio-altimeter (RA) 2 data by the flight control computer (FCC B) prevented the engagement of A/P B and caused the disengagement of A/P A.
The crew re-engaged A/P A, informed the controller that they could not perform a CAT III ILS approach, and requested to fly a missed approach and divert to Lyon-Saint Exupéry airport. Conditions at Lyon permitted a CAT I ILS approach, which could be carried out with only one A/P functioning.
On intercepting ILS 35R at Lyon-Saint Exupéry, with the A/P in intercept mode and the Localizer radio signal captured (green VOR/ LOC mode), the aeroplane suddenly veered to the right with a bank angle of 30°, crossed the Localizer path and then departed from it on a clearly divergent heading (heading 70°) without any onboard warning being activated. This untimely right turn was commanded by the A/P due to the erroneous data from the IRS module of the left Air Data Inertial Reference Unit (ADIRU).
The invalidity of the data supplied by the left ADIRU then led to the disengagement of A/P A. The captain then flew manually with the Flight Directors (F/D) displayed on the Primary Flight Display (PFD).
The crew first tried to return to the path. As the deviation from the path compromised continuing the approach, they flew a missed approach and then engaged A/P B.
The aeroplane had just been transferred to the Approach again when the L IRS FAULT warning was activated causing the disengagement of A/P B, and the disappearance of the pitch, roll and heading data along with the F/D bars from the left PFD. The captain again flew manually while carrying out from memory, one of the actions of the IRS FAULT check-list, namely, IRS Transfer Switch - BOTH ON R. The two FCC thus used the data supplied by the right ADIRU. The pitch, roll and heading were displayed again on the left PFD and the F/D bars reappeared.
During the second approach and the interception with the localizer, and after re-engaging A/P B and transferring the controls to the co-pilot, the captain informed the controller that he had positioning problems. The controller continued the radar vectoring.
On capturing the Glide, A/P B automatically disengaged due to FCC B not receiving data from RA 2. The F/D disappeared from both sides. The co-pilot then transferred the controls to the captain. The latter informed the Approach controller that he was continuing in manual flight. The flight was transferred to the Tower controller.
The approach, in manual and without F/D, was not stabilized with respect to the approach path or the aeroplane’s speed and configuration. Several EGPWS “SINK RATE”, “GLIDE SLOPE” and “TOO LOW TERRAIN” warnings were activated on final. The aeroplane came out of cloud cover between runways 35L and 35R, made a side-step and landed on runway 35R.

The following factors contributed to this serious incident:

The concomitance of two independent failures within two separate systems where the cause of the failures, the absence of any link and the consequences were difficult for the crew to determine, without appropriate information in the operational documentation or sufficiently salient warnings emitted by the aircraft systems.
The crew’s progressive loss of confidence in the plane’s systems as the flight continued, causing substantial stress and the crew to focus their attention on the level of remaining fuel.
The deterioration in CRM by the crew when the workload became very high due, in particular, to having to manage the IRS FAULT during the missed approach phase.
The operating logic of the FCC which does not monitor the inertial data provided by the ADIRU, except for approaches with the two A/P engaged. The FCC was not designed to, nor was it required for certification, to monitor the AIDRU inputs.
The ADIRU internal monitoring logic with respect to the validity of the inertial data transmitted to other systems. The activation criteria of the “Drift Angle” fault, which in turn activates the IRS FAULT warning, can cause the latter to appear at a late stage with respect to the start of the ADIRU IR module malfunction.
The crews’ non-systematic reporting of technical malfunctions in the Technical Log Book (TLB) such as the disappearance of the F/D, the ADIRU malfunctions and the A/P automatically disconnecting.
The persistence of intermittent faults.

The BEA has issued five safety recommendations concerning:

A re-assessment of the safety study relating to the consequences of the FCC using undetected erroneous data from the ADIRU.
The ADIRU’s built-in monitoring system and the activation of the IRS FAULT warning.
The flight crew fault reporting procedures.
The processing of intermittent faults within Royal Air Maroc.
The company’s practices when intercepting the ILS.

Four safety lessons have also been drawn from this incident. These lessons concern:

The crew’s compliance with the fault isolation procedures.
Pilot training in manual piloting without F/D on an ILS approach with the sudden disconnection of the A/P.
The importance of line maintenance.
The update of operational documentation.