An investigation of a serious incident concluded with the release, this week, of the final report, which contains the information gathered and evaluated and the safety recommendations issued.
First of all, the Dutch Safety Board, responsible for the investigation, emphasizes that when accidents or disasters occur, it investigates how it was possible for them to occur, with the aim of learning lessons for the future and, ultimately, , improve security.
The Security Council is independent and free to decide which incidents to investigate. In particular, it focuses on situations where people’s personal safety depends on third parties, such as the government or corporations. In certain cases, the Board has an obligation to conduct an investigation, but its investigations do not address questions of guilt or liability.
Takeoff with incorrect data, Boeing 737-800
On June 10, 2018, a Boeing 737-800 from the Dutch airline KLM was scheduled for a passenger flight from Amsterdam Airport Schiphol, Netherlands, to Munich Airport, Germany. On board the aircraft were three flight crew members, four cabin crew members and 182 passengers.
According to Air Traffic Control (ATC) clearance, the aircraft was scheduled to take off from Runway 09. When the aircraft arrived close to Runway 09, ATC asked if it was possible to take off from the N4 intersection; the crew responded in the negative.
Due to wind conditions and the takeoff weight being close to the maximum takeoff weight, the aircraft would have to depart from the beginning of the runway, using the N5 intersection. The takeoff data corresponding to this takeoff characteristic was entered into the Flight Management Computer (FMC).
During the continuation of the taxi to the runway, it was found that the wind conditions had changed sufficiently and that a take-off from the N4 intersection was possible. Using the N4 intersection allowed the crew to reduce the delay as the aircraft was already delayed in its departure.
After ATC instructed the aircraft to taxi to intersection N4, new takeoff data had to be calculated with the new wind conditions for this intersection. This was done by a crew member just before the plane lined up on the runway.
The investigation revealed that only the new wind data was entered into the FMC, while the intersection remained N5, rather than being updated to N4. The newly entered takeoff data was not verified by the other crew members.
As the new calculated and entered data were not verified, the calculation of the take-off parameters by the FMC was based on an available runway length, which was 3,494 meters from the N5 instead of the actual 2,460 meters from the N4. After the takeoff run, the aircraft left the ground just 176 meters before the end of the runway and crossed the opposite threshold at a height of 28 feet (8.5 meters).
Although the crew noted that the takeoff run did not develop as expected, the full power option was not selected at any time.
The available runway length was 1,034 meters shorter than the runway length considered by the automatic power system to calculate the required configuration. As a result, the applied power was insufficient to take off safely.
Discoveries and evaluations
Upon investigation, it was discovered that operational pressure caused the crew to opt for an unplanned last-minute change at the runway intersection. As other cases of this operator and multiple occurrences in the sector show, it was not an isolated event, nor a new phenomenon.
One of the findings of a 2017 security audit was that the “airline operational pressure threat prevalence” was identified as the second key element of the operator’s threat profile.
The serious incident was not reported by the crew to the operator, nor were the flight recorders protected to prevent data loss after landing (the system keeps recording new data on top of the old ones if it is not stopped). Although the lack of notification was mentioned in the operator’s internal report, it was not labeled as a safety risk. The internal report did not mention that the flight recorders were not secured.
The Dutch Safety Board investigation focused on the use of erroneous takeoff data and factors that played a role in this. Other issues such as safety culture, crew resource management and air traffic control were not investigated in depth.
Takeoff accidents and serious incidents as a result of using erroneous takeoff data occur with some regularity. Last minute changes, time pressure, haste and lack of cross-checking are the factors that most often contribute to takeoff performance incidents.
Despite continuous developments, there are currently no technical solutions that completely prevent erroneous takeoffs. Therefore, prevention must currently be sought in operational solutions.
To allow the crew more time to independently verify and enter data in the event of a last-minute change, it is advisable to stop the aircraft to perform these actions.
This stationary moment should be considered as one of the main practices against the prevention of erroneous data entry.
Furthermore, it has been found that the flight crew often maintains a reduced power takeoff and does not select full power when there is a suspicion that the takeoff run does not develop as expected.
Aircraft taking off with erroneous takeoff data cause dangerous situations that can lead to loss of aircraft or loss of life. Several safety investigation reports, including those published by the Dutch Safety Board, have been written about this long-standing and complex issue.
These reports led to recommendations to regulatory authorities, standards bodies, the aviation industry and airline operators to develop procedural, technical and operational safety improvements.
These developments are ongoing and some of these improvements show the potential to properly detect takeoff data entry errors or insufficient takeoff performance; however, a comprehensive solution to this complex problem has not yet been developed and operationalized across the world’s air transport fleet.
Takeoff with erroneous takeoff data is often a result of operational pressure when last minute changes occur during taxiing. To allow the crew more time to independently verify and enter the changed data, it is advisable to stop the aircraft to perform these actions. This stationary moment should be considered as one of the main practices against the prevention of erroneous entry of takeoff data.
As this investigation has shown, this is already included in the procedures of many airlines. It has also been found that the flight crew often maintains a reduced takeoff and does not select full power if there is a suspicion that the takeoff run does not develop as expected.
In addition to the previous recommendations, the Dutch Safety Board therefore makes the following recommendations:
– To the European Union Aviation Safety Agency (EASA):
Recommend operators and their flight crews to allow a stationary moment when calculating, verifying and entering takeoff performance data in case of last minute changes and implement this advice as a best practice in guidance material, Safety Information Bulletin 2016- 02R1 and other material security promotions.
– For KLM Royal Dutch Airlines:
Implement the following measures to prevent crews from taking off with incorrect take-off data:
• Calculate, verify and enter altered takeoff performance data only when the aircraft is stationary;
• Develop a procedure for flight crews to prepare an alternate plan in advance and encourage the use of full thrust when last minute changes occur; and
• Train flight crews to take action if they suspect that the takeoff run is not going as expected; make this training an element of the recurring training program.
The report can be accessed in full, with the entire technical assessment (in English or Dutch), directly on the Dutch Safety Board page via this link .