Description

The Flight Management System (FMS) has evolved from a simple navigation management device into a fully integrated aircraft management system, receiving inputs from sensors in all flight critical systems and providing outputs that control virtually every aspect of the aircraft’s behavior. The FMS has delivered efficiencies in aircraft management that are far beyond the capabilities of the human pilots. However, some data required by the FMS must still rely upon the pilot to obtain and enter by its variety of interfaces. It is within these interactions that errors, some with catastrophic results, can occur.

The use of erroneous takeoff parameters (thrust and speeds), usually as a result of using incorrect values for takeoff weight in performance calculations, can result in early rotation with tail strike, loss of control when airborne, or overrun as a result of failure to get airborne.

Incorrect flight route inputs during the cruise phase can easily lead to airspace infringement, loss of separation or terrain proximity.

FMS input errors during the approach phase may result in unstabilised approach or a runway excursion.

Studies Identifying Common Causes

In 2007, following the investigation of two serious incidents involving tail strikes that had occurred at Paris, Charles de Gaulle Airport (LFPG), a study entitled "USE OF ERRONEOUS PARAMETERS AT TAKEOFF" was conducted by the Applied Anthropology Laboratory (LAA) at the request of Le Bureau d'Enquêtes et d'Analyses (BEA) and the French Civil Aviation Authority (DGAC).

Various investigation bodies, airlines and manufacturers were consulted in the course of the study because several other accidents, serious incidents and incidents of the same type have occurred around the world during recent years. These generally involved new-generation aircraft, being caused by significant errors in entering takeoff parameters that were not detected by crews. The errors occurred in various airlines and on various types of large aircraft manufactured by Airbus and Boeing. The most serious event occurred in 2004 and involved the destruction of a B747-200 Cargo on takeoff at Halifax and the death of all the crew members. Other incidents arising from errors of the same type, but of lesser magnitude, were reported more recently on latest-generation large and medium-sized aircraft such as Embraer 190.

The complete text of the study is accessible below (See: Further Reading).

A study named "FMS Data Entry Prevention" was carried out by IATA. A total of 309 air safety reports involving FMS data entry error were identified between 2007 and 2011. Analysis of the reports showed that errors related to navigational data, potential for a midair collision or Controlled Flight Into Terrain (CFIT) accident, accounted for 80% of the reports, while 20% were related to performance data and associated LOC-I or runway excursion accident.

The analysis also shows that Air Traffic Control (ATC) related threats, cited in 27% of the reports, were the top contributor to FMS entry errors. ATC clearance changes can require the flight crew to modify the programed vertical and horizontal trajectories in the FMS, potentially introducing errors, distractions and increased workload especially during critical phases of flight.

Other reported threats provided further evidence that flight crew distraction during FMS programing, frequently contribute to data entry errors. The reports also suggest that poor situational awareness and inadequate crew resource management led to flight path deviations following FMS data entry errors.

Organizational and human factors can also contribute to FMS entry errors. A common threat in commercial airline operations is time pressure, (whether it is actual or perceived), leading to stress, rushing, short cuts and errors. Human nature is such that an individual, when undertaking a repetitive task will try to introduce shortcuts. Changes in the organizational environment also have the potential to become threats. For instance, rapid airline expansion requiring the influx of many new personnel and thereby diluting the prevailing culture.

The IATA analysis included two case studies: A345, Melbourne Australia, 2009 and B752, vicinity Cali Colombia, 1995. The full text is accessible below (See: Further Reading)

Risks and Issues

In conclusion, the DGAC research identified the following problematic issues:

• The variety of events shows that the problem of determining and using takeoff parameters is independent of the operating airline, aircraft type, equipment and method used,
• Errors relating to takeoff data are frequent. They are generally detected by application of airline operating modes or by personal methods such as mental calculation,
• Studied cases reveal that failures correspond to the "calculation of takeoff parameters" and "input of speeds into the Flight Management System" functions, but do not correspond to errors in the "weight input into the FMS" function,
• In several cases, the Zero Fuel Weight (ZFW) was entered instead of the Takeoff Weight (TOW) into the performance calculator,
• Half of the crews who responded to the survey carried out in one of the participating airlines had experienced errors in parameters or configuration at takeoff, some of which involved the weight input into the FMS,
• Pilots' knowledge of the order of magnitude of these parameter values, determined by empirical methods, is the most frequently cited strategy used to avoid significant errors,
• Input of the weight used in parameter calculation, in whatever medium it may be (by ACARS, in a computer, manually), is one of the determining steps in the process of takeoff preparation. It is this, by affecting both the thrust and the speeds, that determines takeoff safety,
• The real-time availability of final weight information shortly before departure requires the crew to perform a large number of tasks, inputs and parameter displays under strong time pressure,
• Checks on the "takeoff parameter calculation" function can be shown to be ineffective because they consist of verifying the input of the value but not the accuracy of the value itself,
• In the same way, the check of data featuring on several media often proves to be ineffective. It is often limited to item by item comparisons. If the item is wrong, the check is correct but inadequate because it doesn't cover overall consistency. In particular, there is no comparison between values for takeoff weight given in the final loadsheet, on the takeoff paper or electronic "card" and in the FMS,
• The reference speed values suggested by some FMS can be easily changed. They do not enable routine detection of prior calculation errors,
• Studied FMS allow insertion of weight and speed values that are inconsistent or outside the operational limits of the aircraft concerned. Some accept an omission to enter speeds without the crew being alerted,
• The weight values manipulated by crews before the flight can appear, depending on the documents or software, under various names or acronyms and in different units and formats for the same data, which makes them too difficult to memorise,
• Time pressure and task interruptions are frequently cited in surveys as common factors contributing to errors. The observations showed that the crews' work load increases as the departure time approaches and that the normal operation actions of the captain were all the more disrupted,
• During the takeoff run, the possible decision to reject takeoff based on an erroneous V1 no longer guarantees safety margins,
• On cockpit display screens of the PFD-type (Primary Flight Display), the marker representing Rotation Speed (Vr) is not displayed at low speed. Further, it can be difficult to distinguish it from the marker representing V1, especially when the two values are similar.
• In several cases, crews perceived abnormal airplane behaviour during takeoff. Some took off “normally”, i.e. no abnormal behaviour counter strategy was applied. Others were able to adopt different strategies: stopping takeoff, increasing thrust, delayed rotation.

The IATA study analyses the impact of risk factors on the seven flight stages:

• Planning - errors in the data that pilots take onto the flight-deck with them, and ultimately enter into the FMS, can begin well before they board the aircraft.
  • Mass & Balance - if incorrect, these data will ultimately affect ZFW and ZFW centre of gravity entered in the FMS.
  • Flight Plan - may include erroneous information for take-off weight, fuel burn, route, winds and cost index.
  • Load and Trim Sheet - improper loading may introduce errors to data required for the FMS.
  • Navigation Database - there may be errors in the navigation database.
• Preflight - much of the critical data are calculated and most are entered into the FMS during this phase which is also one of the busiest, with conflicting demands on the pilots’ time.
  • FMS Limitations - some FMS do not incorporate internal automated cross-checks of data values.
  • Data Calculation - time pressure can cause calculation errors, omission of essential checks and the failure to identify erroneous data.
  • Data Transcription - time pressure can contribute to e.g. entering incorrect values or correct values in incorrect fields.
  • Cross-checking - checking of routinely accurate data can lead to omissions, oversights and complacency.
  • Time-pressure may lead to short cuts, omissions, errors and oversights in the calculation, entry and cross-checking of FMS data.
  • Distractions - a lot of people compete for the flight crew attention (e.g. cabin crew, ATC, ground staff, etc.).
• Start Up & Taxi - the pilots must develop and maintain situational awareness in order to avoid conflictions, collisions and incursions but at the same time changes in the weather or ATC instructions may require the recalculation and re-entry of FMS data.
  • Weather - significant changes may require the FMS data to be revised.
  • Runway - late changes to the runway in use may require the data to be amended.
  • Departure - a change of the ATC clearance may require additional FMS input.
  • Conflicting Demands - during the taxi phase, attention to the FMS may lead to e.g. errors in the taxi route and vice versa.
• Takeoff and Initial Climb - many of the most serious implications of data entry errors will become apparent during this phase.
  • Weight - if the actual take-off weight differs significantly from the one used for calculations, then much of the data will be incorrect (e.g. thrust setting, V-speeds, etc.).
  • Balance - incorrect data could result in an inappropriate horizontal stabiliser or trim setting, creating control problems at rotation.
  • Thrust - insufficient thrust will erode accelerate/stop distance margins and may lead to runway overrun.
  • Speeds - incorrect V-speeds may contribute to aircraft control difficulties, runway excursion, tailstrike or inappropriate stop/go decision making.
  • Configuration - wrong flap/slats selection may adversely affect aircraft performance during rotation, lift-off and initial climb.
  • Departure Route errors may cause loss of separation, airspace infringement or unsafe terrain proximity after take-off.
• Climb and Cruise - once airborne, navigational data in the FMS becomes as important as aircraft performance data and errors in FMS entries can be critical.
  • Route - errors can cause wrong predictions of flight time and fuel as well as e.g. airspace infringement.
  • Weight - incorrect values will affect FMS predictions and the calculation of maximum and optimum altitudes.
  • Environmental Data - inaccurate winds and temperatures leads to wrong predictions and calculations.
• Descent - the FMS fuel and time predictions become more critical to pilot decision making and any incorrect data may impact upon this process.
  • Top of Descent - wrong calculation couild lead to high RoD, time compression and unstable approach.
  • Landing Performance calculations based upon FMS predictions may be incorrect.
  • Fuel - incorrect FMS data may cause inaccurate fuel predictions and affect operational decisions related to holding or diversion.
  • Route - an incorrectly entered route for descent may take the aircraft into restricted airspace or close to terrain.
  • ATC - amended clearances require the pilots to divide their attention.
• Arrival, Approach and Landing - all of the considerations applicable to descent are even more relevant as available time, fuel and altitude diminish.
  • ATC - changes to the arrival, approach and runway in use could render the FMS data incorrect.
  • Weather - unexpected changes in surface conditions and runway state may differ from FMS data.
  • Approach & Landing Performance - incorrect speeds and flap settings can result in an unstabilized approach and/or runway excursion.

Mitigations and Risk Management

Procedures

The procedures used must be:

• Robust - achieving the desired outcome in all circumstances;
• Logical - process makes sense to the user in the context of the overall task;
• Modular - individual task processes can be completed separately from others to allow for unforeseen interruptions and distractions;
• Part of an universal culture of compliance.

Monitoring and cross-checking

Constant monitoring and repetitive cross-checking are vital to the identification and management of FMS data entry errors. Unfortunately humans are not especially good at either function, being prone to boredom, complacency, distraction and fatigue.

Where alternative technological solutions are not available it is essential that pilots recognize both the need for accurate monitoring and cross-checking and the inherent human weaknesses in these functions. Training must help them to build strategies to counter this threat, like periodically swapping tasks between entering and cross-checking data, developing gross error checks and rules of thumb, building a mental picture of the ‘normal’ parameters for each phase of flight and recognizing the onset of symptoms of fatigue, stress and illness.

Time management

Pilot training and procedures must encourage crews to plan ahead both strategically for the entire flight (or duty) and tactically for the current and next phases of the flight.

Decisions should not be rushed unduly, but pilots must also recognize when the time for discussion and consideration has passed and a decision has to be made. They must be prepared to differentiate when necessary between safety critical operational time pressure and commercial time pressure, and respond accordingly.

Operators need to be aware of the potential threat of organizational time pressure, whether it is actual or perceived.

Workload management

Cockpit workload rises and falls with and during phases of flight, and pilots’ training and procedures should encourage and enable them to utilize the periods of lower workload for routine tasks like reviewing the FMS, while confining activity to essential operational tasks during periods of higher workload.

Significant workload management threats are distractions and interruptions, frequently from external sources such as the radio or cockpit visits.

Whilst operational communications are unavoidable, strict adherence to sterile cockpit procedures during the critical phases of flight can reduce the threat and hence the risk of error. Collaborative training and procedures for pilots, cabin crew and ground staff can help to manage interruptions, especially common during the busy pre-flight phase.

Fatigue is a major threat to individual workload capacity and an effective fatigue risk management system (FRMS) can help manage and mitigate the impact of fatigue.

Another significant workload management factor in FMS data entry errors is the allocation of FMS and autopilot/flight director systems selections to each pilot. Whilst parked at the gate the pilots can safely work together on the data entry and cross-checking processes but once the aircraft is in motion it is essential that one pilot is always primarily engaged with managing the aircraft. At critical phases of flight or periods of high aircraft management workload it may not be appropriate for either pilot to be involved with FMS programing at all.

In the pre-flight phase it makes sense for the pilot nominated to ‘fly’ the aircraft (generally known as the pilot flying) to enter the majority of the data and especially the flight plan, while the other pilot (variously referred to as pilot monitoring, pilot not flying or non-handling pilot) performs the monitoring and crosschecking functions. However, at other times this may no longer be optimal in terms of error prevention and the allocation of tasks at these times must be clearly delineated in the procedures.

SOPs and pilot training must have clear direction as to which pilot is to make selections which will affect the aircraft trajectory at specified phases of flight. In manual flight the pilot flying should command all selections and the other pilot should perform them. In automatic flight it is more appropriate for the pilot flying to command selections at lower altitudes (generally below 10,000 feet) or at times of high workload but to make selections themselves in cruise and low workload periods.

In all cases the output of any selection must be confirmed by both pilots reading from the flight mode annunciations or the display screens as appropriate.

Gross error checks

The range of variables in some parameters affecting aircraft performance data can be so great that it would not be possible for pilots to know precisely what to expect in every circumstance.

However, it is possible to develop rules of thumb, and gross error checks for many of the values that are input to and output by the FMS on a given aircraft type. Rigorous application of these checks offers an additional opportunity to identify errors which may have slipped through the procedural defences.

Knowing roughly what to expect from a calculation before it is executed, or what performance parameters an aircraft is likely to exhibit will help pilots to recognize potential data anomalies.

Attitude

A professional will accept that in almost all situations the most assured route to the desired outcome is to follow the correct and entire procedure, without short cuts, omissions or ‘workarounds’ and professionalism is a reflection of this acceptance.

The control and management of FMS data entry errors requires the utmost professionalism from all those involved, adhering to procedures and being alert to threats. The culture within an organization must support and promote professionalism amongst all safety critical staff.

Mutual mistrust

Mutual mistrust is a condition in which individuals harbor a healthy degree of doubt with regard to the actions of their colleagues. A professionally questioning approach that does not automatically accept information, actions and decisions as correct can help to manage threats and to identify errors. The same would be true with regard to an individual’s own activities, never accepting that the right action has been taken without verifying the outcome and eliminating any doubt.

Pilots regularly demonstrate a degree of mutual mistrust when cross-checking each other’s actions in accordance with their SOPs.

Education and awareness

Error management strategies rely upon robust and comprehensive training to instill and encourage behaviors which are known to help avoid, identify and manage data entry errors. It is vital that the training accurately reflects the operational reality and helps pilots to understand the threats they face at work.

Training must focus on producing consistent and standardized pilot behaviors across the fleet.

Technology

There are some functions which machines perform better than humans, including monitoring and cross-checking. Aircraft systems, including the FMS, are being designed to incorporate internal safeguards and checks to ensure that potentially erroneous values are highlighted to the pilots immediately, requiring them to be checked before proceeding. The FMS should also be able to highlight to the pilots if its own navigation database is out of date rather than expecting them to check it before each flight. These eminently reliable technological solutions are probably the best final line of defence against hazardous FMS data entry errors.

Other possible technological enhancements include the use of a greater variety of colors and fonts on the CDU screens, and the use of QWERTY layout data entry keyboards.

Perhaps most effective of all in managing errors would be the reconfiguration of all of the controls and indications for the integrated FMS to ensure that the operating philosophies are consistent and intuitive, and the relevant displays are located adjacent to the controls. FMS navigation databases contain numerous duplicate names for navigation aids and for waypoints, which offer significant potential for error. Whilst the solution to this is not solely technological it would remove a potential error source from within the FMS itself.

Accidents & Incidents

Events in the SKYbrary database which include Pre Flight Data Input Error as a contributory factor:

Continuing the data entry theme, the following events in the SKYbrary database include Data use error as a contributory factor:

Further Reading

• DOC AA 556/2008, May 2008 - Use of Erroneous Parameters at Take-Off; DGAC France
• Calculating Errors, by Linda Werfelman, Aerosafetyworld, Sept. 2008
• Airbus FOBN: “Revisiting the stop or go decision”
• Airbus FOBN: “Understanding take off speeds”
• Performance Data Errors in Air Carrier Operations: Causes and Countermeaures, NASA, June 2012