Iridium Ban by Oceanic ATC

The Iridium satellite communications network provides global coverage, including over the polar regions. Through inter-satellite cross links, which allow voice calls to be relayed from one satellite to the next until ground-based Gateway is reached, Iridium Satellite network enables data connectivity, allowing for CPDLC communication in remote coverage areas.

Recent equipment issues with Iridium Satellite service for ATC comms (CPDLC) have prompted a ban by a number of Oceanic ATC agencies. The FAA Central Reporting Agency (CRA) investigator provided the following explanation, "If Iridium receives an ACARS uplink but is unable to deliver it to the Iridium SATCOM avionics, then Iridium queues the uplink indefinitely (until the avionics register on the Iridium network), which risks delivery of an old uplink and is inconsistent with the ACARS protocols by which the DSP indicates to the uplink originator that delivery of the uplink failed."

Currently, Auckland (NZZO), Anchorage (PAZA), Oakland (KZAK) Oceanic, and New York (KZNY and KZWY) have informed operators not to use Iridium for CPDLC. At the present time, Iridium has advised they do not have a way to repair this issue and they will make changes in late 2018 and early 2019 to delete the old messages.

On Sep 12th, an Alaskan Airlines flight had a failure of their CMU (Comms Management Unit) that caused the Iridium connection to stop working. An ATC message was sent to the aircraft but not delivered. On the next flight, the CMU power was reset and corrected the issue, and the pending message was delivered. The CMU did not recognize the message as being old, and so it was presented to the Flight Crew as a control instruction. FSB understands that this aircraft took the climb instruction and executed the level change, climbing 1000 feet.

Another flight, operated by Hawaiian out of Oakland, had a similar problem. This aircraft had both Iridium and Inmarsat onboard and, during the flight, switched over to Inmarsat as the provider. An ATC message was routed via Iridium, but didn’t reach the aircraft before the switch. Some 23 hours later, on the next flight, Iridium was activated again and again the ATC message presented as a "live" instruction. On this occasion, the crew queried the instruction and did not climb.

The safety hazard: if ATC sends a CPDLC message such as "Climb FL390", which is valid for the present time, but another crew gets the message hours later, there’s a very high risk of the next crew accepting the clearance and climbing.