Tailstrikes Prompt Recommendations To Modify Flight Management Software

Flight management systems (FMS) need a software patch to alert aircrews when a takeoff reference speed or a landing weight is incorrect, according to a National Transportation Safety Board (NTSB) recommendation issued March 8.

The recommendation was prompted by incidents in March 12, 2003 (takeoff), and Nov. 11, 1998 (landing), in which the flight crew entered weights that were substantially less than those actually flown. The takeoff case involves a Singapore Airlines B747, Flight SQ286, which took off from Auckland, New Zealand. The incident was investigated by the Transport Accent Investigation Commission (TAIC) of New Zealand (see ASW, Jan. 26, 2004). The NTSB is relaying the TAIC's findings to the Federal Aviation Administration (FAA). The landing case involves a Delta Air Lines [DAL] MD-11, Flight 51, landing at Portland, Ore.

Both cases involve a Honeywell FMS. A company official said, "Our flight management systems have been proven to be very safe when operated in accordance with the flight manual."

"However," he added, "we will work with aircraft manufacturers and government regulators to look into ways of reducing the problem of human error, and we have the technical capacity to meet the safety goals proposed by the NTSB."

One recourse, it seems to us, is to have gross error-detection software built into the FMS. This software could cause the apparently odd output to blink repetitively, causing the crew to look twice before blundering. After all, the critical trick is to ensure that every mistake is spotted before reaching a commit-point on the flight deck. In effect, the computer could just flash for a confirming second ENTER action.

The safety board clearly disagrees with Boeing's response to the TAIC, to the effect that further study of the problem is necessary.

"The safety board does not believe that further study is necessary to incorporate changes to the FMS that would prevent changing a takeoff reference speed to a value that would impede the airplane's ability to safely take off," the board said. "If such FMS logic were installed on Flight SQ286, the FMS would have prevented the flight crew from altering the rotation speed to a value 33 knots below the correct value."

And in the case of Delta Flight 51, the FMS incorrectly indicated a landing weight that was less than both the airplane's zero fuel weight and its operating empty weight, which the system and the crew failed to catch. The system should highlight such entries to the crew, the NTSB said. And not just in the case of Honeywell systems, the safety board said. Rather, the FAA should review other manufacturers' systems, too, to make sure that they have adequate protections against incorrect weights.

Finessing the FMS

The tail of Singapore Airlines Flight SQ286, a Boeing 747-412, struck the runway and incurred substantial damage during takeoff rotation at Auckland Airport in New Zealand. The airplane was fully loaded with fuel, 369 passengers, 17 cabin crewmembers and three flight crewmembers (a captain and two first officers) for an approximately nine-hour flight from Auckland to Singapore.

The flight crew declared an emergency during the airplane's initial climb and returned to Auckland where an overweight landing was completed. No injuries to the passengers or crew were reported. The TAIC concluded in its final report that the accident was caused by erroneously low takeoff reference speeds being entered into the FMS based on a takeoff weight transcription error committed by the flight crew. Before the flight, the captain reviewed the flight dispatch paperwork, which included the airplane's zero fuel weight and takeoff gross weight. As the captain read the airplane information from the dispatch paperwork, the first officer, who was responsible for cross-checking the flight dispatch calculations, transcribed the information onto a reference card used by the airline for pertinent takeoff information for the flight. The captain read a takeoff gross weight of 347.4 tons from the flight dispatch paperwork. However, the first officer incorrectly wrote 247.4 tons, thus introducing an error of 100 tons.

The first officer then used an airport analysis chart to independently determine a takeoff rotation speed, or Vr, of 130 knots, based on the incorrect takeoff gross weight. At the airplane's actual takeoff gross weight of 347.4 tons, the takeoff rotation speed, as determined by the FMS, was 163 knots. The first officer then wrote the takeoff speeds on the reference card and handed the card to the captain. The captain checked the fuel weight on the reference card against the fuel weight determined by the airplane's onboard fuel quantity system. The captain also confirmed the takeoff gross weight from the dispatch paperwork against the FMS-calculated takeoff gross weight, but he did not check the takeoff gross weight on the reference card against the takeoff gross weight from either the FMS or flight dispatch paperwork. The captain then entered the erroneous takeoff speeds from the reference card into the airplane's FMS computer, which did not challenge the validity of the new speeds. During the takeoff roll, the flight crew rotated the airplane at 130 knots, which was 33 knots less than the correct airplane rotation speed. The first officer's transcription error went undetected.

Incidents Are Similar in Nature

A similar FMS-related accident occurred on Nov. 11, 1998, involving DAL Flight 51, an MD-11, which experienced a tailstrike while landing at Portland International Airport, Ore. No injuries to the 11 crew members or 113 passengers were reported, but the aircraft sustained substantial damage. The Safety Board determined that the probable cause of this accident was "[t]he flight crew's entry of an incorrect weight figure in the [Honeywell] flight management system (FMS) computer, resulting in the approach being flown at an improper (low) Vref speed and an excessively nose-high attitude through the landing flare." Delta's flight dispatch paperwork listed the airplane's zero fuel weight as 359,659 pounds, a takeoff fuel weight of 103,000 pounds, a calculated fuel burn of 68,700 pounds, and a gross weight at landing of about 394,000 pounds; however, the airplane's flight data recorder (FDR) data showed that the FMS erroneously determined the gross weight at landing to be 295,000 pounds. The board's investigation determined that this discrepancy likely occurred as a result of the flight crew either:

1) Entering the zero fuel weight in the FMS computer's gross weight field, or

2) Entering a zero fuel weight that was 100,000 pounds less than the airplane's actual weight.

Despite the erroneous weight value entered into the FMS, the flight crew accomplished the takeoff using reference speeds related to the airplane's actual weight. This rotation airspeed correlated to the speed shown on the flight dispatch paperwork. The investigation determined that the flight crew most likely modified the FMS-derived reference speeds for takeoff. Based on the incorrect landing weight, the FMS calculated an approach speed of 132 knots. The flight crew flew the approach at an airspeed of 136 knots, which was 15 knots lower than the approach speed needed for the actual gross weight on landing of 394,000 pounds. To maintain the reduced airspeed, the flight crew flew the approach at an 8� aircraft-nose-up pitch attitude instead of a typical 3� to 4� pitch attitude. During the airplane's flare for landing, the FDR recorded a maximum pitch attitude of 10.9�. According to the operator, "tail clearance tolerances are minimal" while landing at this speed and attitude.

FMS Software Revisions Proposed

The National Transportation Safety Board recommends that the Federal Aviation Administration:

• Require Honeywell to modify its flight management system (FMS) software to annunciate warnings to the flight crew when a takeoff reference speed is changed by a value that would impede the airplane's ability to safely take off, and require all operators of airplanes with Honeywell FMS computers to incorporate this software modification.
• Require Honeywell to modify its FMS software to prevent entry of airplane weights that would result in landing weights below zero fuel weight or operating empty weight, and require all operators of airplanes with Honeywell FMS computers to incorporate this software modification.
• Require Honeywell to modify its FMS software either to inhibit manual entries in the gross weight field or to allow the takeoff gross weight to be uplinked directly into the FMS, and require operators of airplanes with Honeywell FMSs to incorporate this software modification.
• Require Honeywell to conduct a study of its FMS computers to identify any additional improvements that may be necessary for error checking and confirming that the entered takeoff and landing performance information is correct and reasonable.
• Require companies other than Honeywell that manufacture FMS that are installed on 14 Code of Federal Regulations Part 25 airplanes to study their FMS computers to identify any improvements that may be necessary for error checking and confirming that the entered takeoff and landing performance information is correct and reasonable.

The NTSB safety recommendation is available at http://www.ntsb.gov/Recs/letters/2005/A05_03_07.pdf.