FMS Data Input Errors
FMS Data Input Errors
Description
The Flight Management System (FMS) has evolved from a simple navigation management device into a fully integrated aircraft management system, receiving inputs from sensors in all flight critical systems and providing outputs that control virtually every aspect of the aircraft’s behavior. The FMS has delivered efficiencies in aircraft management that are far beyond the capabilities of the human pilots. However, some data required by the FMS must still rely upon the human to obtain and enter by its variety of interfaces. It is within these interactions that errors, some with catastrophic results, can occur.
The use of erroneous take-off parameters (thrust and speeds), usually as a result of using incorrect values for take off weight in performance calculations, can result in early rotation with tail strike, loss of control when airborne, or overrun as a result of failure to get airborne.
Incorrect flight route inputs during the cruise phase can easily lead to airspace infringement, loss of separation or terrain proximity.
FMS input errors during the approach phase may result in unstabilised approach or a runway excursion.
Studies Identifying Common Causes
In 2007, following the investigation of two serious incidents involving tail strikes that had occurred at Paris, Charles de Gaull Airport (LFPG), a study entitled "USE OF ERRONEOUS PARAMETERS AT TAKEOFF" was conducted by the Applied Anthropology Laboratory (LAA) at the request of Le Bureau d'Enquêtes et d'Analyses (BEA) and the French Civil Aviation Authority (DGAC).
Various investigation bodies, airlines and manufacturers were consulted in the course of the study because several other accidents, serious incidents and incidents of the same type have occurred around the world during recent years. These generally involved new generation aircraft, being caused by more or less significant errors in entering takeoff parameters that were not detected by crews. The errors occurred in various airlines and on various types of large aircraft manufactured by Airbus and Boeing. The most serious event occurred in 2004 and involved the destruction of a B747-200 Cargo on takeoff at Halifax and the death of all the crew members. Other incidents arising from errors of the same type, but of lesser magnitude, were reported more recently on latest-generation large and medium-sized aircraft such as Embraer 190.
The complete text of the study is accessible below (See: Further Reading).
A study named "FMS Data Entry Prevention" was carried out by IATA. A total of 309 air safety reports involving FMS data entry error were identified between 2007 and 2011. Analysis of the reports showed that errors related to navigational data, potential for a Mid Air collision or Controlled Flight Into Terrain (CFIT) accident, accounted for 80% of the reports, while 20% were related to performance data and associated LOC-I or runway excursion accident.
The analysis also shows that Air Traffic Control (ATC) related threats, cited in 27% of the reports, were the top contributor to FMS entry errors. ATC clearance changes require the flight crew to modify the programed vertical and horizontal trajectories in the FMS, potentially introducing errors, distractions and increased workload especially during critical phases of flight.
Other reported threats provided further evidence that flight crew distraction during FMS programing, frequently contribute to data entry errors. The reports also suggest that poor situational awareness and inadequate crew resource management led to flight path deviations following FMS data entry errors.
Organizational and human factors can also contribute to FMS entry errors. A common threat in commercial airline operations is time pressure, (whether it is actual or perceived), leading to stress, rushing, short cuts and errors. Human nature is such that an individual, when undertaking a repetitive task will try to introduce shortcuts. Changes in the organizational environment also have the potential to become threats. For instance, rapid airline expansion requiring the influx of many new personnel and thereby diluting the prevailing culture.
The IATA analysis included two case studies: A345, Melbourne Australia, 2009 and B752, vicinity Cali Colombia, 1995. The full text is accessible below (See: Further Reading)
Risks and Issues
In conclusion, the DGAC research identified the following problematic issues:
- The variety of events shows that the problem of determining and using takeoff parameters is independent of the operating airline, aircraft type, equipment and method used,
- Errors relating to takeoff data are frequent. They are generally detected by application of airline operating modes or by personal methods such as mental calculation,
- Studied cases reveal that failures correspond to the "calculation of takeoff parameters" and "input of speeds into the Flight Management System" functions, but do not correspond to errors in the "weight input into the FMS" function,
- In several cases, the Zero Fuel Weight (ZFW) was entered instead of the Take-off Weight (TOW) into the performance calculator,
- Half of the crews who responded to the survey carried out in one of the participating airlines had experienced errors in parameters or configuration at takeoff, some of which involved the weight input into the FMS,
- Pilots' knowledge of the order of magnitude of these parameter values, determined by empirical methods, is the most frequently cited strategy used to avoid significant errors,
- Input of the weight used in parameter calculation, in whatever medium it may be (by ACARS, in a computer, manually), is one of the determining steps in the process of takeoff preparation. It is this, by affecting both the thrust and the speeds, that determines takeoff safety,
- The real-time availability of final weight information shortly before departure requires the crew to perform a large number of tasks, inputs and parameter displays under strong time pressure,
- Checks on the "takeoff parameter calculation" function can be shown to be ineffective because they consist of verifying the input of the value but not the accuracy of the value itself,
- In the same way, the check of data featuring on several media often proves to be ineffective. It is often limited to item by item comparisons. If the item is wrong, the check is correct but inadequate because it doesn't cover overall consistency. In particular, there is no comparison between values for takeoff weight given in the final loadsheet, on the takeoff paper or electronic "card" and in the FMS,
- The reference speed values suggested by some FMS can be easily changed. They do not enable routine detection of prior calculation errors,
- Studied FMS allow insertion of weight and speed values that are inconsistent or outside the operational limits of the aircraft concerned. Some accept an omission to enter speeds without the crew being alerted,
- The weight values manipulated by crews before the flight can appear, depending on the documents or software, under various names or acronyms and in different units and formats for the same data, which makes them too difficult to memorise,
- Time pressure and task interruptions are frequently cited in surveys as common factors contributing to errors. The observations showed that the crews' work load increases as the departure time approaches and that the normal operation actions of the captain were all the more disrupted,
- During the takeoff run, the possible decision to reject takeoff based on an erroneous V1 no longer guarantees safety margins,
- On cockpit display screens of the PFD-type (Primary Flight Display), the marker representing Rotation Speed (Vr) is not displayed at low speed. Further, it can be difficult to distinguish it from the marker representing V1, especially when the two values are similar.
- In several cases, crews perceived abnormal airplane behaviour during takeoff. Some took off “normally”, i.e. no abnormal behaviour counter strategy was applied. Others were able to adopt different strategies: stopping takeoff, increasing thrust, delayed rotation.
The IATA study analyses the impact of risk factors on the seven flight stages:
- Planning - errors in the data that pilots take onto the flight-deck with them, and ultimately enter into the FMS, can begin well before they board the aircraft.
- Mass & Balance - if incorrect, these data will ultimately affect ZFW and ZFW centre of gravity entered in the FMS.
- Flight Plan - may include erroneous information for take-off weight, fuel burn, route, winds and cost index.
- Load and Trim Sheet - improper loading may introduce errors to data required for the FMS.
- Navigation Database - there may be errors in the navigation database.
- Pre-flight - much of the critical data are calculated and most are entered into the FMS during this phase which is also one of the busiest, with conflicting demands on the pilots’ time.
- FMS Limitations - some FMS do not incorporate internal automated cross-checks of data values.
- Data Calculation - time pressure can cause calculation errors, omission of essential checks and the failure to identify erroneous data.
- Data Transcription - time pressure can contribute to e.g. entering incorrect values or correct values in incorrect fields.
- Cross-checking - checking of routinely accurate data can lead to omissions, oversights and complacency.
- Time-pressure may lead to short cuts, omissions, errors and oversights in the calculation, entry and cross-checking of FMS data.
- Distractions - a lot of people compete for the flight crew attention (e.g. cabin crew, ATC, ground staff, etc.).
- Start Up & Taxi - the pilots must develop and maintain situational awareness in order to avoid conflictions, collisions and incursions but at the same time changes in the weather or ATC instructions may require the recalculation and re-entry of FMS data.
- Weather - significant changes may require the FMS data to be revised.
- Runway - late changes to the runway in use may require the data to be amended.
- Departure - a change of the ATC clearance may require additional FMS input.
- Conflicting Demands - during the taxi phase, attention to the FMS may lead to e.g. errors in the taxi route and vice versa.
- Take-off and Initial Climb - many of the most serious implications of data entry errors will become apparent during this phase.
- Weight - if the actual take-off weight differs significantly from the one used for calculations, then much of the data will be incorrect (e.g. thrust setting, V-speeds, etc.).
- Balance - incorrect data could result in an inappropriate horizontal stabiliser or trim setting, creating control problems at rotation.
- Thrust - insufficient thrust will erode accelerate/stop distance margins and may lead to runway overrun.
- Speeds - incorrect V-speeds may contribute to aircraft control difficulties, runway excursion, tailstrike or inappropriate stop/go decision making.
- Configuration - wrong flap/slats selection may adversely affect aircraft performance during rotation, lift-off and initial climb.
- Departure Route errors may cause loss of separation, airspace infringement or unsafe terrain proximity after take-off.
- Climb and Cruise - once airborne navigational data in the FMS becomes as important as aircraft performance data and errors in FMS entries can be critical.
- Route - errors can cause wrong predictions of flight time and fuel as well as e.g. airspace infringement.
- Weight - incorrect values will affect FMS predictions and the calculation of maximum and optimum altitudes.
- Environmental Data - inaccurate winds and temperatures leads to wrong predictions and calculations.
- Descent - the FMS fuel and time predictions become more critical to pilot decision making and any incorrect data may impact upon this process.
- Top of Descent - wrong calculation couild lead to high RoD, time compression and unstable approach.
- Landing Performance calculations based upon FMS predictions may be incorrect.
- Fuel - incorrect FMS data may cause inaccurate fuel predictions and affect operational decisions related to holding or diversion.
- Route - an incorrectly entered route for descent may take the aircraft into restricted airspace or close to terrain.
- ATC - amended clearances require the pilots to divide their attention.
- Arrival, Approach and Landing - all of the considerations applicable to descent are even more relevant as available time, fuel and altitude diminish.
- ATC - changes to the arrival, approach and runway in use could render the FMS data incorrect.
- Weather - unexpected changes in surface conditions and runway state may differ from FMS data.
- Approach & Landing Performance - incorrect speeds and flap settings can result in an unstabilized approach and/or runway excursion.
Mitigations and Risk Management
Procedures
The procedures used must be:
- Robust - achieving the desired outcome in all circumstances;
- Logical - process makes sense to the user in the context of the overall task;
- Modular - individual task processes can be completed separately from others to allow for unforeseen interruptions and distractions;
- Part of an universal culture of compliance.
Monitoring and cross-checking
Constant monitoring and repetitive cross-checking are vital to the identification and management of FMS data entry errors. Unfortunately humans are not especially good at either function, being prone to boredom, complacency, distraction and fatigue.
Where alternative technological solutions are not available it is essential that pilots recognize both the need for accurate monitoring and cross-checking and the inherent human weaknesses in these functions. Training must help them to build strategies to counter this threat, like periodically swapping tasks between entering and cross-checking data, developing gross error checks and rules of thumb, building a mental picture of the ‘normal’ parameters for each phase of flight and recognizing the onset of symptoms of fatigue, stress and illness.
Time management
Pilot training and procedures must encourage them to plan ahead both strategically for the entire flight (or duty) and tactically for the current and next phases of the flight.
Decisions should not be rushed unduly but pilots must also recognize when the time for discussion and consideration has passed and a decision has to be made. They must be prepared to differentiate when necessary between safety critical operational time pressure and commercial time pressure, and respond accordingly.
Operators need to be aware of the potential threat of organizational time pressure, whether it is actual or perceived.
Workload management
Cockpit workload rises and falls with and during phases of flight, and pilots’ training and procedures should encourage and enable them to utilize the periods of lower workload for routine tasks like reviewing the FMS, while confining activity to essential operational tasks during periods of higher workload.
Significant workload management threats are distractions and interruptions, frequently from external sources such as the radio or cockpit visits.
Whilst operational communications are unavoidable, strict adherence to sterile cockpit procedures during the critical phases of flight can reduce the threat and hence the risk of error. Collaborative training and procedures for pilots, cabin crew and ground staff can help to manage interruptions, especially common during the busy pre-flight phase.
Fatigue is a major threat to individual workload capacity and an effective fatigue risk management system (FRMS) can help manage and mitigate the impact of fatigue.
Another significant workload management factor in FMS data entry errors is the allocation of FMS and autopilot/flight director systems selections to each pilot. Whilst parked at the gate the pilots can safely work together on the data entry and cross-checking processes but once the aircraft is in motion it is essential that one pilot is always primarily engaged with managing the aircraft. At critical phases of flight or periods of high aircraft management workload it may not be appropriate for either pilot to be involved with FMS programing at all.
In the pre-flight phase it makes sense for the pilot nominated to ‘fly’ the aircraft (generally known as the pilot flying) to enter the majority of the data and especially the flight plan, while the other pilot (variously referred to as pilot monitoring, pilot not flying or non-handling pilot) performs the monitoring and crosschecking functions. However, at other times this may no longer be optimal in terms of error prevention and the allocation of tasks at these times must be clearly delineated in the procedures.
SOPs and pilot training must have clear direction as to which pilot is to make selections which will affect the aircraft trajectory at specified phases of flight. In manual flight the pilot flying should command all selections and the other pilot should perform them. In automatic flight it is more appropriate for the pilot flying to command selections at lower altitudes (generally below 10,000 feet) or at times of high workload but to make selections themselves in cruise and low workload periods.
In all cases the output of any selection must be confirmed by both pilots reading from the flight mode annunciations or the display screens as appropriate.
Gross error checks
The range of variables in some parameters affecting aircraft performance data can be so great that it would not be possible for pilots to know precisely what to expect in every circumstance.
However, it is possible to develop ‘rules of thumb’ and gross error checks for many of the values that are input to and output by the FMS on a given aircraft type. Rigorous application of these checks offers an additional opportunity to identify errors which may have slipped through the procedural defences.
Knowing roughly what to expect from a calculation before it is executed, or what performance parameters an aircraft is likely to exhibit will help pilots to recognize potential data anomalies.
Attitude
A professional will accept that in almost all situations the most assured route to the desired outcome is to follow the correct and entire procedure, without short cuts, omissions or ‘workarounds’ and professionalism is a reflection of this acceptance.
The control and management of FMS data entry errors requires the utmost professionalism from all those involved, adhering to procedures and being alert to threats. The culture within an organization must support and promote professionalism amongst all safety critical staff.
Mutual mistrust
Mutual mistrust is a condition in which individuals harbor a healthy degree of doubt with regard to the actions of their colleagues. A professionally questioning approach that does not automatically accept information, actions and decisions as correct can help to manage threats and to identify errors. The same would be true with regard to an individual’s own activities, never accepting that the right action has been taken without verifying the outcome and eliminating any doubt.
Pilots regularly demonstrate a degree of mutual mistrust when cross-checking each other’s actions in accordance with their SOPs.
Education and awareness
Error management strategies rely upon robust and comprehensive training to instill and encourage behaviors which are known to help avoid, identify and manage data entry errors. It is vital that the training accurately reflects the operational reality and helps pilots to understand the threats they face at work.
Training must focus on producing consistent and standardized pilot behaviors across the fleet.
Technology
There are some functions which machines perform rather better than humans, including monitoring and cross-checking. Aircraft systems, including the FMS, are being designed to incorporate internal safeguards and checks to ensure that potentially erroneous values are highlighted to the pilots immediately, requiring them to be checked before proceeding. The FMS should also be able to highlight to the pilots if its own navigation database is out of date rather than expecting them to check it before each flight. These eminently reliable technological solutions are probably the best final line of defence against hazardous FMS data entry errors.
Other possible technological enhancements include the use of a greater variety of colors and fonts on the CDU screens, and the use of QWERTY layout data entry keyboards.
Perhaps most effective of all in managing errors would be the reconfiguration of all of the controls and indications for the integrated FMS to ensure that the operating philosophies are consistent and intuitive, and the relevant displays are located adjacent to the controls. FMS navigation databases contain numerous duplicate names for navigation aids and for waypoints, which offer significant potential for error. Whilst the solution to this is not solely technological it would remove a potential error source from within the FMS itself.
Accidents & Incidents
Events in the SKYbrary database which include Pre Flight Data Input Error as a contributory factor:
On 21 April 2017, a Boeing 777-300 which had just departed Amsterdam was advised by ATC of a suspected tail strike and by cabin crew of a scraping noise during takeoff. Fuel dumping was followed by a return to land and evidence of a minor tail strike was identified. The Investigation found that the tail strike had resulted from a gross error in data input to the takeoff performance calculation which resulted in inadequate thrust, slow acceleration and rotation at a speed so low that had an engine malfunction occurred, safe continuation or rejection of takeoff would have been problematic.
On 26 February 2020, an Airbus A330-300 tailstrike occurred during rotation for takeoff from Zurich and was not detected by the crew who completed the planned 7½ hour flight to Nairobi before learning that the aircraft was not airworthy as a result. The Investigation concluded that the tailstrike had been the direct result of the crew’s use of inappropriate inputs to their takeoff performance calculation on the variable headwind encountered during the takeoff and noted a very similar event had previously occurred to the same aircraft type operated by an airline within the same overall ownership.
On 24 September 2017, a Boeing 747-8UF, which had just made an easterly takeoff from Hong Kong on a moonless night but in good visibility, deviated from its correctly acknowledged SID clearance towards steep terrain and a resultant EGPWS PULL UP Warning was immediately actioned resulting in a terrain clearance of approximately 670 feet. The Investigation found that the SID track deviation was caused by the inadvertently incorrect input of a SID clearance which was supposed to be issued only to locally-based operators whereas the flight concerned was being operated by a foreign operator on behalf of a locally-based one.
On 2 September 2019, a Boeing 777-300 failed to continue climbing following a night takeoff from Shanghai when the autopilot was quickly engaged. When it began to descend, inaction after several EGPWS DON’T SINK Alerts was followed by an EGPWS ‘PULL UP’ Warning. Recovery then followed but only after autopilot re-engagement led to another descent did the crew recognise that a single character FMS data input error was the cause. The Investigation was concerned that both pilots simultaneously lost situational awareness of the low aircraft altitude during the event and noted both procedural non-compliance and sub-optimal crew interaction.
On 29 August 2019, an Airbus A319 crew used more runway than expected during a reduced thrust takeoff from Nice, although not enough to justify increasing thrust. It was subsequently found that an identical error made by both pilots when independently calculating takeoff performance data for the most limiting runway intersection had resulted in use of data for a less limiting intersection than the one eventually used. The Investigation concluded that the only guaranteed way to avoid such an error would be an automatic cross check, a system upgrade which was not possible on the particular aircraft involved.
On 24 November 2019, as an Airbus A321 taking off from the 2665 metre-long runway 05 at Glasgow approached the calculated V1 with the flex thrust they had set, the aircraft was not accelerating as expected and they applied TOGA thrust. This resulted in the aircraft becoming airborne with less than 400 metres of runway remaining. The Investigation confirmed what the crew had subsequently discovered for themselves - that they had both made an identical error in their independent EFB performance calculations which the subsequent standard procedures and checks had not detected. The operator is reviewing its related checking procedures.
On 24 April 2019, the engine of a Beech B200 en-route from Winnipeg to Churchill at FL 250 failed due to fuel exhaustion and the crew realised that they had forgotten to refuel before departure. An emergency was declared and a diversion to the nearest available airport was commenced but the right engine later failed for the same reason leaving them with no option but to land on a frozen lake surface. The Investigation concluded that confusion as to relative responsibility between the trainee Captain and the supervising pilot-in-command were central to the failure to refuel prior to departure as intended.
On 28 February 2020, a Boeing 737-800 taking off from the full length of the London Gatwick main runway, which is in excess of 3000 metres long, was observed to get airborne only 120 metres before the end of the paved surface. The Investigation found that the crew response when the automatic V1 and VR calls did not occur was unduly delayed with rotation only occurring at a much higher than normal speed. No system fault was subsequently found and it was concluded that the crew had most likely omitted to input these speeds to the FMC after calculation.
On 16 September 2019, an Airbus A320 departing Lisbon only became airborne 110 metres before the end of runway 21 and had a high speed rejected takeoff been required, it was likely to have overrun the runway. The Investigation found that both pilots had inadvertently calculated reduced thrust takeoff performance using the full 3705 metre runway length and then failed to identify their error before FMS entry. They also did not increase the thrust to TOGA on realising that the runway end was fast approaching. This was the operator’s third almost identical event at Lisbon in less than five months.
On 16 August 2008, an AMC Airlines Boeing 737-800 inadvertently began a night take off from an intersection on runway 27L at Paris CDG which left insufficient take off distance available before the end of the temporarily restricted runway length. It collided with and damaged obstructions related to construction works in progress on the closed section of the runway but sustained only minor damage and completed the intended flight to Luxor. The context for the flight crew error was identified as inadequate support from the Operator and inadequate airport risk assessment for operations with a reduced runway length.
On 15 July 2018, an Airbus 220-300 crew were slow to recognise that the maximum de-rate thrust required for their takeoff from Porto had not been reached but after increasing it were able to get safely airborne prior to the end of the runway. The Investigation found that applicable SOPs had not been followed and that the function of both the spoiler and autothrottle systems was inadequately documented and understood and in the case of the former an arguably flawed design had been certified. Five similar events had been recorded by the aircraft operator involved in less than six months.
On 15 July 2017, a Boeing 747-8F close to its maximum takeoff weight only became airborne just before the end of the 2,500 metre-long north runway at Narita after the reduced thrust applicable to the much longer south runway was used for the takeoff and the aircraft cleared the upwind runway threshold by only 16 feet. The Investigation found that the very experienced Captain and the very inexperienced First Officer had both failed to follow elements of the applicable takeoff performance change procedures after the departure runway anticipated during pre-start flight preparations prior to ATC clearance delivery had changed.
On 16 November 2017, a Boeing 737-700 departing Singapore Seletar was observed by ATC to only become airborne very near the end of the runway and to then climb only very slowly. Ten approach lights were subsequently found to have been impact-damaged by contact with the aircraft. The Investigation found that after the crew had failed to follow procedures requiring them to validate the FMC recalculation of modified takeoff performance data against independent calculations made on their EFBs, takeoff was made with reduced thrust instead of the full thrust required. The modification made was also found not to have been required.
On 29 March 2018, an augmented Boeing 787-9 crew completed an uneventful takeoff from Tel Aviv on a type conversion line check flight for one of the First Officers in the crew. After getting airborne, the crew found that all performance calculations including that for takeoff had been made on the basis of a Zero Fuel Weight which was 40 tonnes below the actual figure of 169 tonnes. The Investigation found that it was highly probable that automatic reduction in commanded pitch-up when rotation was attempted at too low a speed had prevented an accident during or soon after liftoff.
On 22 May 2015, a Boeing 777F augmented crew attempted a reduced thrust daylight takeoff from Paris CDG using a thrust setting based on a weight 100 tonnes below the actual weight after an undetected crew error. The tailstrike protection system prevented fuselage runway contact after rotation attempts but only after a call from an augmenting crew member was full thrust set with the aircraft becoming airborne near the runway end. The Investigation noted poor crew performance but concluded that operator management of the risk involved and the corresponding regulatory oversight had been inadequate in a number of ways.
Continuing the data entry theme, the following events in the SKYbrary database include Data use error as a contributory factor:
On 10 June 2018, a Boeing 737-800 departing Amsterdam with line training in progress and a safety pilot assisting only became airborne just before the runway end. The Investigation found that the wrong reduced thrust takeoff performance data had been used without any of the pilots noticing and without full thrust being selected as the end of the runway approached. The operator was found to have had several similar events, not all of which had been reported. The implied absence at the operator of a meaningful safety culture and its ineffective flight operations safety oversight process were also noted.
On 3 March 2021, a Boeing 737-800 departing Lisbon only just became airborne before the end of runway 21 and was likely to have overrun the runway in the event of a high speed rejected takeoff. After a significant reporting delay, the Investigation established that both pilots had calculated takeoff performance using the full runway length and then performed takeoff from an intersection after failing to identify their error before FMS entry or increase thrust to TOGA as the runway end was evidently about to be reached.
On 10 July 2019 an Airbus A380 in the cruise at night at FL 400 encountered unexpectedly severe turbulence approximately 13 hours into the 17 hour flight and 27 occupants were injured as a result, one seriously. The detailed Investigation concluded that the turbulence had occurred in clear air in the vicinity of a significant area of convective turbulence and a jet stream. A series of findings were related to both better detection of turbulence risks and ways to minimise injuries if unexpectedly encountered with particular reference to the aircraft type and operator but with wider relevance.
On 29 November 2018, a Let 410 landed on a temporarily closed section of the runway at Dubrovnik after a visual approach in benign weather conditions. The Investigation found that the flight crew had not carried out a sufficient pre-flight review of current and available information about a major multi-phase runway reconstruction there which they were familiar with. The opportunity for better advance and real time communication with aircraft operators and their flight crew and the benefit of the recommended ‘X’ marking at the beginning of any temporarily closed part of a runway, omitted in this case, was noted.
On 20 December 2009 a Blue Line McDonnell Douglas MD-83 almost stalled at high altitude after the crew attempted to continue climbing beyond the maximum available altitude at the prevailing aircraft weight. The Investigation found that failure to cross check data input to the Performance Management System prior to take off had allowed a gross data entry error made prior to departure - use of the Zero Fuel Weight in place of Gross Weight - to go undetected.
On 16 August 2008, an AMC Airlines Boeing 737-800 inadvertently began a night take off from an intersection on runway 27L at Paris CDG which left insufficient take off distance available before the end of the temporarily restricted runway length. It collided with and damaged obstructions related to construction works in progress on the closed section of the runway but sustained only minor damage and completed the intended flight to Luxor. The context for the flight crew error was identified as inadequate support from the Operator and inadequate airport risk assessment for operations with a reduced runway length.
On 14 April 2012, a Titan Airways Boeing 737-300 attempted to take off from Chambery with incorrect reference speeds taken from the EFB used for performance calculations. As a consequence, the pressure hull was damaged by a tail strike during take off, although not sufficiently to affect cabin pressure during the subsequent flight. The Investigation concluded that the accident raised regulatory issues in respect of the general design and use of EFB computers to calculate performance data.
On 22 October 2009, a BN2 Islander suspected to have been overloaded experienced an engine failure shortly after departure from Curaçao. Rather than return, the Pilot chose to continue the flight to the intended destination but had to carry out a ditching when it proved impossible to maintain height. All passengers survived but the Pilot died. The cause of the engine failure could not be established but the Investigation found a context for the accident which had constituted systemic failure by the Operator to deliver operational safety which had been ignored by an inadequate regulatory oversight regime.
On 10 June 2011 an ATC error put a German Wings A319 and a Hahn Air Raytheon 390 on conflicting tracks over Switzerland and a co-ordinated TCAS RA followed. The aircraft subsequently passed in very close proximity without either sighting the other after the Hahn Air crew, contrary to Company procedures, followed an ATC descent clearance issued during their TCAS ‘Climb’ RA rather than continuing to fly the RA. The Investigation could find no explanation for this action by the experienced crew - both Hahn Air management pilots. The recorded CPA was 0.6 nm horizontally at 50 feet vertically.
On 16 December 2011, a Saab 2000 in the hold and an opposite direction Cessna VLJ joining it lost procedural separation in IMC near Lugano due to conflicting ATC clearances issued by the same controller who had used the wrong Transition Level. Any risk of collision was removed by a TCAS RA activated on the Saab 2000 but the Investigation found that the DFTI radar display available to the controller to help resolve unexpected emergency situations was configured to systematically convert SSR standard pressure altitudes to QNH for altitude display using a distant and inappropriate value of QNH.
On 6 August 2011 an Easyjet Airbus A319 on which First Officer Line Training was in progress exceeded its cleared level during the climb after a different level to that correctly read back was set on the FMS. As a result, it came into conflict with an Alitalia A321 and this was resolved by responses to coordinated TCAS RAs. STCA alerts did not enable ATC resolution of the conflict and it was concluded that a lack of ATC capability to receive Mode S EHS DAPs - since rectified - was a contributory factor to the outcome.
On 13 March 2011, a Turkish Airlines Boeing 737-800 stopped climb shortly after take off after misreading the SID chart. After levelling at 450 feet agl, it continued following the lateral part of the SID only until ATC re-iterated the requirement to climb after resolving a temporary loss of contact due to an un-instructed premature frequency change. It was found that the crew had received but apparently not responded to an EGPWS PULL UP Warning. It was concluded that there was an opportunity to improve the clarity of UK SID charts to aid pilots with limited English language skills.
On 31 December 2011 a USAF C12 Beech King Air descended 700 feet below the cleared outbound altitude on a procedural non precision approach to Stornoway in uncontrolled airspace in IMC and also failed to fly the procedure correctly. As a result it came into conflict with a Saab 340 inbound on the same procedure. The Investigation found that the C12 crew had interpreted the QNH given by ATC as 990 hPa as 29.90 inches, the subscale setting units used in the USA. The Saab 340 pilot saw the opposite direction traffic on TCAS and descended early to increase separation.
On 20 November 2011, a problem in reading the altitude labels on the ATC radar control display led to a Finnair Boeing 757 being cleared to make a descent which brought it into proximity with a Thomas Cook Boeing 757 in day VMC. Co-ordinated TCAS RAs were generated onboard both aircraft but when the Finnair aircraft failed to respond to its Climb RA and continued descent, the other aircraft, which had responded correctly to its initial RA, received a further RA to reverse their descent to a climb. The Finnair aircraft reported retaining visual contact with the other aircraft throughout.
On 5 February 2012, an Airbus A340-300 started its takeoff from an intermediate point on the runway for which no regulated takeoff weight information was available and had only become airborne very close to the end of the runway and then climbed only very slowly. The Investigation found that as the full length of the planned departure runway was not temporarily unavailable, ATC had offered either the intersection subsequently used or the full length of the available parallel runway and that despite the absence of valid performance data for the intersection, the intersection had been used.
Related Articles
- Runway Excursion
- Rejected Take Off
- Runway Excursions Research - ATSB
- ATSB Safety Study: Take-off performance parameter errors: A global perspective
- Takeoff Weight Entry Error and Fatigue (OGHFA SE)
- European Action Plan for the Prevention of Runway Excursions (EAPPRE) Edition 1.0, January 2013.
Further Reading
- DOC AA 556/2008, May 2008 - Use of Erroneous Parameters at Take-Off; DGAC France
- Calculating Errors, by Linda Werfelman, Aerosafetyworld, Sept. 2008
- Airbus FOBN: “Revisiting the stop or go decision”
- Airbus FOBN: “Understanding take off speeds”
- Performance Data Errors in Air Carrier Operations: Causes and Countermeaures, NASA, June 2012
Categories
