This was a significant event. The AAIB took the unusual step of releasing a Special Bulletin before completion of their final report so that people could act on what they have learnt so far.
Essentially, the crew entered the cruise OAT of - 52°C into the (airport) OAT field (which should have been +16°C) on the N1 LIMIT page. This reduced the take-off N1 to 81.5% from the required 93.3%. The aircraft struck a supplementary runway approach light, which was 36 cm tall and 29 m beyond the end of the takeoff runway.
Since the incident aircraft was only using FMC U10.8A it did not crosscheck between the OAT entered by the crew and that sensed by the external temperature probe. FMC U12.0 with CDS BP15 onwards performs this check. The report recommends that the FAA mandates that all applicable 737s are updated to this standard.
*** Updated 20 Nov 2018 ***
21 Jul 2017 - 737-800, C-FWGH (37752/3835), FF Oct 2011, operated by Sunwing Airlines departed from Belfast runway 07 with a thrust setting which was significantly below that required for the conditions of the day. After the aircraft lifted off from the runway, one of the aircraft tyres struck a runway approach light, which was 35cm high and 29m beyond the end of the runway.
The AAIB issued Special Bulletin S2/2017 which contains preliminary information on this serious incident, clarification about the reporting of accidents and serious incidents and two Safety Recommendations relating to Flight Management Computer (FMC) software updates.
The final report was issued in November 2018. Excerpts are reproduced here:
At 1539 hrs on 21 July 2017, a Boeing 737-800 took off from Belfast International Airport (BFS) with insufficient power to meet regulated performance requirements. The aircraft struck a supplementary runway approach light, which was 36 cm tall and 29 m beyond the end of the takeoff runway.
An outside air temperature (OAT) of -52°C had been entered into the Flight Management Computer (FMC) instead of the actual OAT of 16°C. This, together with the correctly calculated assumed temperature thrust reduction of 48°C, meant the aircraft engines were delivering only 60% of their maximum rated thrust. The low acceleration of the aircraft was not recognised by the crew until the aircraft was rapidly approaching the end of the runway. The aircraft rotated at the extreme end of the runway and climbed away at a very low rate. The crew did not apply full thrust until the aircraft was approximately 4 km from the end of the runway, at around 800 ft aal.
There was no damage to the aircraft, which continued its flight to Corfu, Greece without further incident. However, it was only the benign nature of the runway clearway and terrain elevation beyond, and the lack of obstacles in the climb-out path which allowed the aircraft to climb away without further collision after it struck the runway light. Had an engine failed at a critical moment during the takeoff, the consequences could have been catastrophic.
The investigation found the following causal factors for this serious incident:
The investigation found the following contributory factors for this serious incident:
1. The aircraft’s FMC did not have the capability to alert the flight crew to the fact that they had entered the incorrect OAT into the FMC, although this capability existed in a later FMC software standard available at the time.
2. The Electronic Flight Bags (EFB) did not display N1 on their performance application (some applications do), which meant that the crew could not verify the FMC-calculated N1 against an independently-calculated value.
3. The crew were unlikely to detect the abnormally low acceleration because of normal limitations in human performance.
The investigation identified other examples of accidents or serious incidents where there was a gross failure of an aircraft to achieve its expected takeoff performance, and found that technical solutions to address this serious safety issue are now feasible.
AAIB Special Bulletin S2/2017, published on 20 September 2017, provided initial information on the circumstances of this serious incident, clarification about the reporting of accidents and serious incidents, and made two safety recommendations related to FMC software updates. In this report, the AAIB makes four safety recommendations: one supersedes a recommendation made in Special Bulletin S2/2017; one concerns procedures to verify engine takeoff power settings; and two concern the development of Takeoff Acceleration Monitoring Systems.
Safety Recommendations and Actions
Two Safety Recommendations were made in Special Bulletin S2/2017, published in September 2017, which are reproduced below along with the response from the addressee:
Safety Recommendation 2017-016
The FAA, in its initial response to this recommendation, stated that there might be hardware and fleet compatibility issues and cost implications for some operators which it would need to understand before responding substantively. It undertook to provide an updated response by December 2018.
The AAIB classified this response as: Superceded.
Safety Recommendation 2017-017
It is recommended that The Boeing Company promulgates to all 737 operators the information contained within this Special Bulletin and reminds them of previous similar occurrences reported in the Boeing 737 Flight Crew Operations Manual Bulletin dated December 2014.
On 13 July 2018, Boeing issued a Multi Operator Message which described the potential for FMC OAT entry errors referring to this, and other serious incidents. The message also reminded operators of the associated service bulletins recommending the installation of revision U12.0 of the FMS OPS software and BP15 update of the CDS1. The message reminded operators that the final compliance date for the recommended action was 10 January 2019.
The AAIB classified this response as: Adequate – Closed.
The following Safety Recommendation is made in this report, which supersedes Safety Recommendation 2017-016:
Safety Recommendation 2018-012
It is recommended that the Federal Aviation Administration mandate the use of Flight Management Computer OPS software revision U12.0, or later, and the Common Display System Block Point 15 update where this is required, to enable the outside air temperature crosscheck on all applicable Boeing 737 aircraft.
The following additional Safety Recommendations are made in this report:
Safety Recommendation 2018-013
It is recommended that Boeing Commercial Airplanes give guidance to operators of Boeing 737 aircraft on how they might verify the FMC-calculated value of N1 against an independently‑calculated value.
Safety Recommendation 2018-014
It is recommended that the European Aviation Safety Agency, in conjunction with the Federal Aviation Administration, sponsor the development of technical specifications and, subsequently, develop certification standards for a Takeoff Acceleration Monitoring System which will alert the crew of an aircraft to abnormally low acceleration during takeoff.
Safety Recommendation 2018-015
It is recommended that the International Civil Aviation Organization note the conclusions of this report and introduce provisions addressing Takeoff Acceleration Monitoring Systems.
This report presents the following safety action:
Safety Action by the aircraft operator
As a result of the initial findings of this investigation into this serious incident the aircraft operator began a programme of upgrading their fleet of B737s to FMC Update 13 and CDU BP15 in order that the OAT alerting function would be available. They also updated their EFB software to display N1 and included a crosscheck of this figure in their SOPs.
Safety Action by the UK CAA
After this serious incident, the CAA amended MATS Part 1 such that the senior controllers at ATSUs providing air traffic services at an aerodrome are required to notify the AAIB by telephone as part of their initial reporting actions following an aircraft accident or serious incident. The CAA also amended CAP 797, Flight Information Service Officer Manual, to require air traffic services personnel to notify the AAIB by telephone as part of their initial reporting actions following an aircraft accident or serious incident. In addition to the action above, a link to Regulation (EU) 996/2010 was put into MATS Part 1 and CAP 797 pointing to typical examples of what are likely to be classified as serious incidents.
Special Bulletin S2/2017
On 21 July 2017 at 1539 hrs, C-FWGH took off from Belfast International Airport with a thrust setting which was significantly below that required for the conditions of the day. Preliminary evidence indicated that, after the aircraft lifted off from the runway, one of the aircraft tyres struck a runway approach light, which was 35 cm high and 29 m beyond the end of the runway.
The event was not reported to the AAIB by the aircraft commander, aircraft operator or the tour operator on behalf of which the flight was being undertaken, although it was reported to the Transportation Safety Board in Canada by the aircraft operator. At 2053 hrs on 21 July 2017, ATC personnel at the airport filed a Mandatory Occurrence Report (MOR) and sent a signal using NATS’s Aeronautical Fixed Telecommunications Network (AFTN), and the AAIB was one of the addressees on the signal. This system is only monitored by the AAIB during office hours and the message was not read until 0713 hrs on 24 July 2017 at which time an investigation was begun. The delay introduced by these circumstances meant that Flight Data Recorder (FDR), Cockpit Voice Recorder (CVR) and other recorded data sources were unavailable to the investigation.
This Special Bulletin contains preliminary information on this serious incident, clarification about the reporting of accidents and serious incidents and two Safety Recommendations relating to Flight Management Computer (FMC) software updates.
History of the flight:
The aircraft was registered in Canada but was operating on behalf of a UK tour operator. The Canadian operator supplied the aircraft and flight crew to support the tour operator for the summer season. The aircraft was departing for a flight from Belfast International Airport to Corfu, Greece. The crew boarded the aircraft and completed their pre-flight preparations before pushing back, intending to depart from Runway 07. After pushing back, the ground crew noticed that one of the tyres on the nose landing gear was worn and the aircraft returned to the stand. After both nose landing gear tyres had been changed, the aircraft once again pushed back and taxied out for departure. The crew were cleared for takeoff on Runway 07 from Taxiway D (Figure 1), which gave a Takeoff Run Available (TORA) of 2,654 m. During the takeoff, at around 120 to 130 kt, the crew realised that the aircraft was not accelerating normally. They estimated, during post-flight interviews, that they reached V1 with around 900 m of the runway remaining and rotated shortly afterwards. The aircraft was seen, by multiple witnesses, during rotation and took a significant time to lift off before climbing at a very shallow angle. After the takeoff, airport operations staff conducted a runway inspection and a runway approach light for Runway 25 was found to be broken. Preliminary evidence indicated that the aircraft struck the light, which was 35 cm high, 29 m beyond the end of the runway in the stopway. After takeoff, the crew checked the aircraft’s FMC which showed that an N1 of 81.5% had been used for the takeoff. This figure was significantly below the required N1 setting of 93.3% calculated by the operator and shown on the pre-flight paperwork.
The aircraft had flown for 16 sectors before the AAIB became aware of the event and, when the FDR was downloaded, it was found that the data from the incident flight had been overwritten by subsequent flights. The aircraft was also fitted with a Quick Access Recorder, but the operator was troubleshooting this installation and the memory cards contained no data. The CVR installed on the aircraft had a 30 minute recording capability and would have been overwritten due to the elapsed time since the event so was not removed from the aircraft. The radar installation at Belfast International Airport tracked the aircraft along Runway 07 and during initial climb-out, when altitude data also became available from the aircraft’s transponder. The radar returns allowed groundspeed for the aircraft to be calculated which was supplemented by both groundspeed and altitude data transmitted from the aircraft over its ADS-B data link. This data is shown in Figure 1 for the ground roll, where the text in yellow represents calculated groundspeed data from the radar track and, in green, the received ADS-B groundspeeds. Orange lines show the approximate position where the aircraft achieved airspeeds equivalent to V1 and VR, taking into account a 7 kt headwind component.
Figure 2 (below) shows spot heights above the elevation of Belfast International Airport (268 ft amsl) for the aircraft’s initial climb, derived from the aircraft’s ADS-B reports (these heights are annotated ‘above airfield level’ (aal)). At no time during the climb-out was the aircraft’s Enhanced Ground Proximity Warning System Mode 3 aural alert (“don’t sink”) triggered.
Passing the upwind end of the runway the aircraft’s ACARS sent a takeoff report, which confirmed that the engines were at an N1 of approximately 81.5%. Other ACARS messages confirmed that the correct weights for the aircraft had been entered into the FMC. The aircraft’s auto-throttle BITE history showed two messages generated during the climbout. Both messages were consistent with the crew having manually advanced each throttle to a power setting above an N1 of 81.5% when the aircraft was approximately 800 ft aal. The Electronic Flight Bags (EFB) used by the crew to calculate the performance figures for entry into the FMC were provided to the AAIB. Initial examination of these devices indicated that the correct figures were calculated by the EFB performance software prior to the aircraft’s departure.
The AAIB and operator carried out independent assessments of how the incorrect thrust setting might have been programmed into the FMC. Both assessments concluded that the only credible way to achieve a grossly low N1 setting was to enter an extremely low value into the outside air temperature (OAT) field on the n1 limit page. It was found that the takeoff N1 setting used on the flight (81.5%) would be calculated by the FMC if:
No other combination of data entries was found which would achieve the same result.
During the simulation carried out by the AAIB, the aircraft’s performance was assessed following an engine failure immediately prior to V1, with the pilot making a decision by V1 to either abandon or continue the takeoff. In the simulator, the aircraft was able to stop in the runway remaining following a decision to abandon the takeoff, but was unable to climb away safely following a decision to continue the takeoff.
An example FMC N1 LIMIT page from the report (not showing the data used in this incident)
Erroneous FMC entries of OAT
As a result of previous events involving erroneous OAT entries during FMC programming, Boeing published a Flight Crew Operations Manual Bulletin in December 2014. This document discussed three events where incorrect values for OAT had been entered into, and accepted by, the FMC. In two of these cases, the incorrect OAT had been sent to the FMC via datalink, but in the third case the crew made a manual entry error. The bulletin stated:
The bulletin also states that:
It then described how this check was to be carried out.
In addition, from revision U12.0 of the FMC software, a crosscheck was added that compares the OAT entered by the crew against either that fed to the Electronic Engine Controls or, on older Boeing 737s, sensed by the aspirated Total Air Temperature probe (if fitted).
The crosscheck runs once, approximately one minute after engine start, and establishes whether a difference of more than 6ºC exists between the value entered into the FMC and that sensed by the external temperature sensor. If the difference is more than 6ºC it rejects the OAT entry, deletes the takeoff reference speeds and indicates on the FMC displays that the reference speeds have been deleted. C-FWGH, and the simulator used for the AAIB trial, had an earlier revision of FMC software installed, U10.8A, which did not include this crosscheck. Revision U12.0 of the FMC software became available in February 2016, but the crosscheck functionality also required Next Generation Boeing 737 (B737NG) aircraft to have the Block Point 15 (BP15) standard of the Common Display System (CDS) installed, which became available in January 2017.
The aircraft took off from Runway 07 with a thrust setting significantly below that required to achieve the correct takeoff performance, and struck a Runway 25 approach light shortly after lifting off.
The N1 required to achieve the required takeoff performance was 93.3% but 81.5% was used instead. Independent assessments by the AAIB and operator showed that the only credible way for this to have happened was for an error to have been made whilst entering the OAT into the FMC. If the top-of-climb OAT was mistakenly inserted into the OAT field on the n1 limit page (a figure of -52°C as opposed to +16°C), and the correct assumed temperature of 48°C was entered, the FMC would have calculated a target takeoff N1 of 81.5%. The investigation will consider how such a data entry error could have been made, and whether actual aircraft performance matched that which would be expected given the N1 power setting used.
The simulator trial examined aircraft performance following an engine failure immediately prior to V1 with the pilot making a decision to either abandon or continue the takeoff. Although the simulator results cannot be considered definitive, and aircraft performance will be investigated further with the manufacturer, they suggest that, in similar circumstances on the incident flight:
The FMC software fitted to C-FWGH, U10.8A, predated revision U12.0, which features the crosscheck between the OAT entered by the crew and that sensed by the external temperature sensor. In this event, had C-FWGH been updated with U12.0 and CDS BP15, the entry of a top-of-climb OAT instead of the ambient OAT at ground level would have been prevented, the crew would have received feedback on their erroneous entry, and the serious incident would have been prevented. The updates to the CDS and FMC software are offered by Boeing as upgrade service bulletins at nominal cost. Fleet embodiment of software revision U12.0 (or later revision incorporating the outside air temperature crosscheck) would reduce the likelihood that this type of data entry error was repeated. Therefore:
Safety Recommendation 2017-016 It is recommended that the Federal Aviation Administration, mandate the use of Flight Management Computer software revision U12.0, or later revision incorporating the outside air temperature crosscheck, for operators of Boeing 737 Next Generation aircraft.
Flight Crew Operations Manual Bulletins are inserted by aircraft operators into the Flight Crew Operations Manual (FCOM) upon receipt, but are temporary in nature and removed when the FCOM is next updated as part of the regular FCOM revision cycle. In this particular case, the operator’s FCOM had been revised and incorporated the text showing how the flight crew should verify the OAT entry. However, the removal of the whole Bulletin meant that the background material about the reasons for the existence of this check was no longer present. Given the serious potential consequences of this type of data entry error, it was considered important to inform Boeing 737 operators of this event (including operators of aircraft which are not ‘Next Generation’). Therefore:
Safety Recommendation 2017-017 It is recommended that The Boeing Company promulgates to all 737 operators the information contained within this Special Bulletin and reminds them of previous similar occurrences reported in the Boeing 737 Flight Crew Operations Manual Bulletin dated December 2014.
The rest of the special bulletin goes on to address the non-reporting of the incident to the AAIB and the subsequent loss of Flight Data Recorder (FDR), Cockpit Voice Recorder (CVR) and other recorded data sources to the investigation.