This was a significant event. The AAIB have taken the unusual step of releasing a Special Bulletin before completion of their final report so that people can act on what they have learnt so far.
Essentially, it appears that the crew may have entered the cruise OAT of - 52°C into the (airport) OAT field (which should have been +16°C) on the N1 LIMIT page. This reduced the take-off N1 to 81.5% from the required 93.3%.
Since the incident aircraft was only using FMC U10.8A it did not crosscheck between the OAT entered by the crew and that sensed by the external temperature probe. FMC U12.0 onwards performs this check. Hence the following safety recommendation:
Safety Recommendation 2017-016
Also, since this was not the first such event they issued the following:
Safety Recommendation 2017-017
*** Updated 08 Jun 2017 ***
21 Jul 2017 - 737-800, C-FWGH (37752/3835), FF Oct 2011, operated by Sunwing Airlines departed from Belfast runway 07 with a thrust setting which was significantly below that required for the conditions of the day. Preliminary evidence indicated that, after the aircraft lifted off from the runway, one of the aircraft tyres struck a runway approach light, which was 35cm high and 29m beyond the end of the runway.
The AAIB issued Special Bulletin S2/2017 which contains preliminary information on this serious incident, clarification about the reporting of accidents and serious incidents and two Safety Recommendations relating to Flight Management Computer (FMC) software updates.
On 21 July 2017 at 1539 hrs, C-FWGH took off from Belfast International Airport with a thrust setting which was significantly below that required for the conditions of the day. Preliminary evidence indicated that, after the aircraft lifted off from the runway, one of the aircraft tyres struck a runway approach light, which was 35 cm high and 29 m beyond the end of the runway.
The event was not reported to the AAIB by the aircraft commander, aircraft operator or the tour operator on behalf of which the flight was being undertaken, although it was reported to the Transportation Safety Board in Canada by the aircraft operator. At 2053 hrs on 21 July 2017, ATC personnel at the airport filed a Mandatory Occurrence Report (MOR) and sent a signal using NATS’s Aeronautical Fixed Telecommunications Network (AFTN), and the AAIB was one of the addressees on the signal. This system is only monitored by the AAIB during office hours and the message was not read until 0713 hrs on 24 July 2017 at which time an investigation was begun. The delay introduced by these circumstances meant that Flight Data Recorder (FDR), Cockpit Voice Recorder (CVR) and other recorded data sources were unavailable to the investigation.
This Special Bulletin contains preliminary information on this serious incident, clarification about the reporting of accidents and serious incidents and two Safety Recommendations relating to Flight Management Computer (FMC) software updates.
History of the flight:
The aircraft was registered in Canada but was operating on behalf of a UK tour operator. The Canadian operator supplied the aircraft and flight crew to support the tour operator for the summer season. The aircraft was departing for a flight from Belfast International Airport to Corfu, Greece. The crew boarded the aircraft and completed their pre-flight preparations before pushing back, intending to depart from Runway 07. After pushing back, the ground crew noticed that one of the tyres on the nose landing gear was worn and the aircraft returned to the stand. After both nose landing gear tyres had been changed, the aircraft once again pushed back and taxied out for departure. The crew were cleared for takeoff on Runway 07 from Taxiway D (Figure 1), which gave a Takeoff Run Available (TORA) of 2,654 m. During the takeoff, at around 120 to 130 kt, the crew realised that the aircraft was not accelerating normally. They estimated, during post-flight interviews, that they reached V1 with around 900 m of the runway remaining and rotated shortly afterwards. The aircraft was seen, by multiple witnesses, during rotation and took a significant time to lift off before climbing at a very shallow angle. After the takeoff, airport operations staff conducted a runway inspection and a runway approach light for Runway 25 was found to be broken. Preliminary evidence indicated that the aircraft struck the light, which was 35 cm high, 29 m beyond the end of the runway in the stopway. After takeoff, the crew checked the aircraft’s FMC which showed that an N1 of 81.5% had been used for the takeoff. This figure was significantly below the required N1 setting of 93.3% calculated by the operator and shown on the pre-flight paperwork.
The aircraft had flown for 16 sectors before the AAIB became aware of the event and, when the FDR was downloaded, it was found that the data from the incident flight had been overwritten by subsequent flights. The aircraft was also fitted with a Quick Access Recorder, but the operator was troubleshooting this installation and the memory cards contained no data. The CVR installed on the aircraft had a 30 minute recording capability and would have been overwritten due to the elapsed time since the event so was not removed from the aircraft. The radar installation at Belfast International Airport tracked the aircraft along Runway 07 and during initial climb-out, when altitude data also became available from the aircraft’s transponder. The radar returns allowed groundspeed for the aircraft to be calculated which was supplemented by both groundspeed and altitude data transmitted from the aircraft over its ADS-B data link. This data is shown in Figure 1 for the ground roll, where the text in yellow represents calculated groundspeed data from the radar track and, in green, the received ADS-B groundspeeds. Orange lines show the approximate position where the aircraft achieved airspeeds equivalent to V1 and VR, taking into account a 7 kt headwind component.
Figure 2 (below) shows spot heights above the elevation of Belfast International Airport (268 ft amsl) for the aircraft’s initial climb, derived from the aircraft’s ADS-B reports (these heights are annotated ‘above airfield level’ (aal)). At no time during the climb-out was the aircraft’s Enhanced Ground Proximity Warning System Mode 3 aural alert (“don’t sink”) triggered.
Passing the upwind end of the runway the aircraft’s ACARS sent a takeoff report, which confirmed that the engines were at an N1 of approximately 81.5%. Other ACARS messages confirmed that the correct weights for the aircraft had been entered into the FMC. The aircraft’s auto-throttle BITE history showed two messages generated during the climbout. Both messages were consistent with the crew having manually advanced each throttle to a power setting above an N1 of 81.5% when the aircraft was approximately 800 ft aal. The Electronic Flight Bags (EFB) used by the crew to calculate the performance figures for entry into the FMC were provided to the AAIB. Initial examination of these devices indicated that the correct figures were calculated by the EFB performance software prior to the aircraft’s departure.
The AAIB and operator carried out independent assessments of how the incorrect thrust setting might have been programmed into the FMC. Both assessments concluded that the only credible way to achieve a grossly low N1 setting was to enter an extremely low value into the outside air temperature (OAT) field on the n1 limit page. It was found that the takeoff N1 setting used on the flight (81.5%) would be calculated by the FMC if:
No other combination of data entries was found which would achieve the same result.
During the simulation carried out by the AAIB, the aircraft’s performance was assessed following an engine failure immediately prior to V1, with the pilot making a decision by V1 to either abandon or continue the takeoff. In the simulator, the aircraft was able to stop in the runway remaining following a decision to abandon the takeoff, but was unable to climb away safely following a decision to continue the takeoff.
An example FMC N1 LIMIT page not showing the data used in this incident
Erroneous FMC entries of OAT
As a result of previous events involving erroneous OAT entries during FMC programming, Boeing published a Flight Crew Operations Manual Bulletin in December 2014. This document discussed three events where incorrect values for OAT had been entered into, and accepted by, the FMC. In two of these cases, the incorrect OAT had been sent to the FMC via datalink, but in the third case the crew made a manual entry error. The bulletin stated:
The bulletin also states that:
It then described how this check was to be carried out.
In addition, from revision U12.0 of the FMC software, a crosscheck was added that compares the OAT entered by the crew against either that fed to the Electronic Engine Controls or, on older Boeing 737s, sensed by the aspirated Total Air Temperature probe (if fitted).
The crosscheck runs once, approximately one minute after engine start, and establishes whether a difference of more than 6ºC exists between the value entered into the FMC and that sensed by the external temperature sensor. If the difference is more than 6ºC it rejects the OAT entry, deletes the takeoff reference speeds and indicates on the FMC displays that the reference speeds have been deleted. C-FWGH, and the simulator used for the AAIB trial, had an earlier revision of FMC software installed, U10.8A, which did not include this crosscheck. Revision U12.0 of the FMC software became available in February 2016, but the crosscheck functionality also required Next Generation Boeing 737 (B737NG) aircraft to have the Block Point 15 (BP15) standard of the Common Display System (CDS) installed, which became available in January 2017.
The aircraft took off from Runway 07 with a thrust setting significantly below that required to achieve the correct takeoff performance, and struck a Runway 25 approach light shortly after lifting off.
The N1 required to achieve the required takeoff performance was 93.3% but 81.5% was used instead. Independent assessments by the AAIB and operator showed that the only credible way for this to have happened was for an error to have been made whilst entering the OAT into the FMC. If the top-of-climb OAT was mistakenly inserted into the OAT field on the n1 limit page (a figure of -52°C as opposed to +16°C), and the correct assumed temperature of 48°C was entered, the FMC would have calculated a target takeoff N1 of 81.5%. The investigation will consider how such a data entry error could have been made, and whether actual aircraft performance matched that which would be expected given the N1 power setting used.
The simulator trial examined aircraft performance following an engine failure immediately prior to V1 with the pilot making a decision to either abandon or continue the takeoff. Although the simulator results cannot be considered definitive, and aircraft performance will be investigated further with the manufacturer, they suggest that, in similar circumstances on the incident flight:
The FMC software fitted to C-FWGH, U10.8A, predated revision U12.0, which features the crosscheck between the OAT entered by the crew and that sensed by the external temperature sensor. In this event, had C-FWGH been updated with U12.0 and CDS BP15, the entry of a top-of-climb OAT instead of the ambient OAT at ground level would have been prevented, the crew would have received feedback on their erroneous entry, and the serious incident would have been prevented. The updates to the CDS and FMC software are offered by Boeing as upgrade service bulletins at nominal cost. Fleet embodiment of software revision U12.0 (or later revision incorporating the outside air temperature crosscheck) would reduce the likelihood that this type of data entry error was repeated. Therefore:
Safety Recommendation 2017-016 It is recommended that the Federal Aviation Administration, mandate the use of Flight Management Computer software revision U12.0, or later revision incorporating the outside air temperature crosscheck, for operators of Boeing 737 Next Generation aircraft.
Flight Crew Operations Manual Bulletins are inserted by aircraft operators into the Flight Crew Operations Manual (FCOM) upon receipt, but are temporary in nature and removed when the FCOM is next updated as part of the regular FCOM revision cycle. In this particular case, the operator’s FCOM had been revised and incorporated the text showing how the flight crew should verify the OAT entry. However, the removal of the whole Bulletin meant that the background material about the reasons for the existence of this check was no longer present. Given the serious potential consequences of this type of data entry error, it was considered important to inform Boeing 737 operators of this event (including operators of aircraft which are not ‘Next Generation’). Therefore:
Safety Recommendation 2017-017 It is recommended that The Boeing Company promulgates to all 737 operators the information contained within this Special Bulletin and reminds them of previous similar occurrences reported in the Boeing 737 Flight Crew Operations Manual Bulletin dated December 2014.
The rest of the special bulletin goes on to address the non-reporting of the incident to the AAIB and the subsequent loss of Flight Data Recorder (FDR), Cockpit Voice Recorder (CVR) and other recorded data sources to the investigation.