El Al B789 at Tel Aviv on Mar 29th 2018, departure using wrong takeoff performance data

Last Update: December 1, 2018 / 19:47:50 GMT/Zulu time

Bookmark this article

Photo of El Al 4X-EDB, Boeing 787-9 Dreamliner — El Al 4X-EDB, Boeing 787-9 Dreamliner (Photo credit: Thomas Naas Photography / Flickr / License: CC by-nd)

Incident Facts

Date of incident
Mar 29, 2018

Classification
Report

Airline
El Al

Flight number
LY-27

Departure
Tel Aviv, Israel

Destination
Newark, United States

Aircraft Registration
4X-EDB

Aircraft Type
Boeing 787-9 Dreamliner

ICAO Type Designator
B789

An El Al Boeing 787-9, registration 4X-EDB performing flight LY-27 from Tel Aviv (Israel) to Newark,NJ (USA) with 282 passengers and 18 crew, was climbing out of Tel Aviv when the captain noticed that the FMS indicated a substantially higher optimal flight level than anticipated and planned. The captain examined the reasons for this and discovered that a zero fuel weight of 40 tons lower than the actual zero fuel weight had been entered into the FMS. The captain immediately understood that the takeoff performance computation had also been wrong, concluded to the severity of the occurrence, notified the airline's operations center and the fleet manager, who in turn involved Israel's accident investigation unit. The aircraft continued to Newark for a safe landing without further incident.

On Nov 26th 2018 Israel's AIAI released their final report in Hebrew only (readers later pointed us to the English version, see below).

Editorial note: to serve the purpose of global prevention of the repeat of causes leading to an occurrence an additional timely release of all occurrence reports in the only world spanning aviation language English would be necessary, a Hebrew only release does not achieve this purpose as set by ICAO annex 13 and just forces many aviators to waste much more time and effort each in trying to understand the circumstances leading to the occurrence, in particular as no reasonable translation software is available and the use of native Hebrew translators is almost needed to make sense of the report. Aviators operating internationally are required to read/speak English besides their local language, investigators need to be able to read/write/speak English to communicate with their counterparts all around the globe.

The report does not contain a formal conclusion as to the causes but lists 33 findings - which are way too long to translate. The Aviation Herald refuses to provide such lenghty translations which substantially increase the probability of serious translation errors. The Aviation Herald transmitted requests for English reports to the AIAI repeatedly in the past without ever receiving a reply. We invite the AIAI this way to e-mail us an English copy of the final report and release all investigation reports in English and Hebrew in the future.

In summary (not in translation) the findings state:

"The AIAI rated the occurrence a serious incident, that began with poor preparation of the flight management system with the captain entering a zero fuel weight signficantly lower, by 40 tons, than the actual one with the cross check failing to detect the error. As result the takeoff performance (takeoff power, takeoff speeds) were calculated erroneously resulting in increased danger of a tail strike on departure or loss of control after lift off. The protection system preventing the pitch to increase above limits to prevent a tail strike operated as expected and most likely prevented an accident, however caused the aircraft to add additional speed first before becoming airborne. The departure preparations were rushed due to late arrival of the incoming aircraft. As result the crew was handed a preliminary load sheet right after arriving at the aircraft, the crew entered those data into the FMS but skipped the testing due to the preliminary nature of the data. After receiving the final loadsheet the captain entered the data again, the first officer cross checked the data but did not recognize the error. The captain however spotted the error and again entered the data, but made the same error again, the first officer remained unaware of the correction attempt. The secondary captain of the augmenting crew did notice the primary captain did enter some correction, however, was in the cabin at the time and didn't see what was done. While the gross weight was over 220 tons, it was still 40 tons below the actual weight resulting in speeds being 15 knots lower than the actual ones. While the aircraft would have been able to stop on the runway before V1, in case of an engine failure above V1 the aircraft would not have been able to become airborne before the end of the runway. Rotation for takeoff was initiated at (computed) V1, the protection activated preventing the pitch to increase above limit and thus maintaining a minimum clearance between tail and runway surface. The aircraft accelerated in that attitude for some time until the aircraft became airborne. The initial climb to 1500 feet, still with reduced takeoff thrust, occurred at a lower climb rate than required. The flaps were retracted based on the erroneous schedule. The climb above 1500 feet was continued with climb thrust and went normal. While climbing through FL200, upon checking the cruise performance data, the crew discovered the error, when the FMS recommended FL380 which seemed implausible to the crew. The departure occurred in night hours when due to the biological clock the cognitive and physical capacity of humans are reduced. The flight crew, including the captain, had done a flight the previous day, had consumed their legal minimum rest time, however, fatigue can not be ruled out. The aircraft and all its system were operating normally. The airline did not conduct risk assessment when introduced the 787 fleet that was efficient enough to update all flight crew converting from the 777 to the 787 properly. A lot of distractions occurred during departure preparations, the time of which was reduced, with the handling of how data are being forwarded to the crew, 3 of the 4 flight crew members arriving later than the captain within the conditions of a busy holiday flight critical for family members. In the standard operating procedures of El Al there is no effective cross check of the takeoff offset, there is also no instruction to check and verify the computed takeoff thrust setting before commencing takeoff. The procedures by El Al as well as flight regulations do not take into account the mental fitness of flight crew after experiencing a critical safety issue."

Editorial note: the editor remains unsure whether all the technical terms in Hebrew were correctly understood, in particular the various numbers thrown around for (gross) takeoff weight of 220 tons and 197.7 tons etc. raise substantial doubt that the understanding of the narrative is entirely correct. We deliberately do not touch the (gross) takeoff weight as result due to lack of correct understanding.

The flight crew consisted of 4 pilots:

The primary captain (52, ATPL, 24,800 hours total, 186 hours on type), an augmenting secondary captain (58, ATPL, 9,970 hours total, 80 hours on type), a primary first officer (33, ATPL, 4,176 hours total, 40 hours on type) and an augmenting secondary first officer (47, ATPL, 10,112 hours total, 80 hours on type).

The departure of the flight was set for 01:00L, the airline had classed the flight as "holiday flight". Several family members of the flight crew were on board of the aircraft (wives, sons, daughters).

The aircraft was arriving from Hong Kong and was delayed. Operations thus decided to postpone the departure by 15 minutes, however, a night curfew was to prevent departure after 01:40L. The crew determined their ZFW would be 168.6 tons.

The crew began their departure briefing prior to the arrival of the inbound aircraft in the pilot lounge. After arrival the crew transferred to the aircraft arriving at 00:50L, about 25 minutes prior to (postponed) planned departure. The primary captain and first officer took their seats and began to program the FMS, the captain however entered 128.6 tons as ZFW into the FMS. The flight crew recognized the mistake and the captain attempted to correct the mistake, however, the wrong data remained in the field, the first officer remained unaware that the correction had not taken on. The augmenting crew observed that the captain was attempting to correct, however, did not follow the correction.

Following preparations the aircraft doors closed at 01:34L, the engines were started and the aircraft taxied to runway 26 receiving takeoff clearance at 01:49L. The crew commenced takeoff, upon calling V1 the captain noticed the controls were "sluggish" and he needed more force to unstick the aircraft. It took an unusually long time until the aircraft establised in a positive climb. The augmenting crew left the cockpit while climbing through FL100 to take their rest.

Climbing through FL200 the flight crew performed their cruise test and to their surprise found FL380 recommended as optimum flight level in the FMS. This was considered unreasonable, such long haul flights would usually cruise at FL340 initially. The crew had also briefed for this initial FL340. While investigating the reason the flight crew discovered the ZFW was 40 tons low and corrected the mistake. The captain asked cabin crew to call the augmenting crew to the cockpit, however, they were already asleep and were left sleeping. The captain thus called operations center and asked to inform the fleet chief as well as the accident investigation board. The flight crew assessed their own condition and decided they were fit to continue the flight. The augmenting crew returned to the cockpit about 4 hours later releasing the occurrence crew to their rest. The occurrence crew conducted clarification whether they were qualified to perform the landing into Newark, which was affirmed, the occurrence crew flew the landing into Newark. After engine shut down the flight data were collected and the occurrence crew filed an occurrence report.

Editorial note: we also skip the analysis as we can not be sure our understanding would be halfway correct. This underlines the difficulty of not releasing such reports in English, even though investigators are all capable of talking, writing and reading English, and makes clear how hopeless it it for aviators all around the globe to take aboard the lessons, that could be learned by this occurrence, and avoid a repeat, unless those aviators are native Hebrew speakers.

After we released the coverage above reader "Innocent Abroad" told us the link to the English version of this report (which can not be found via the home page of the AIAI). The English version lists the 33 findings:

- The event is classified as a “serious incident”, with direct responsibility of the active flight crew and contribution of organizational and management factors.

- The incident began with inadequate preparation of the flight management computer, by the captain entering a ZFW value, which was substantially lower from the correct weight to the FMC, and continued with ineffective crosschecking, which did not detect the error. Takeoff performance calculation according to the wrong weight has resulted in a takeoff conducted with erroneous thrust and speed parameters, which created a real risk of tail strike or loss of control after liftoff, during initial climb and during flaps retraction.

- The flight control system’s feature, of reducing elevator authority to prevent tail strike, worked and it is highly probable that it prevented an accident. Elevator deflection angles reduced immediately upon raising the nose and the liftoff, despite the continued and even increased pulling aft of the control column. Consequently, the actual tail clearance did not exceed the minimum theoretical value. The delayed raising of the nose has contributed to aircraft gaining speed prior to climbing and thus prevented a stall or loss of control.

- The late arrival of the aircraft from its previous flight resulted in the crew’s arriving very late relative to the usual reporting time, while the aircraft was still being cleaned, prepared, refueled and stuffed. A narrow period prior to the airport closure for takeoffs has introduced a pressure factor to the crew’s functioning. A final load sheet was provided to the crew for review immediately upon their arrival to the airplane. At the first stage of cockpit preparation, the crew has entered final weights to the flight management computer, and not initial planning parameters as is usually done. Consequently the crew skipped the stage of checking and updating the previously entered parameter versus a final value, a stage done by every crew on every flight and is listed in the FCOM.

- While reviewing the final load sheet, together with the first officer, the captain, acting as the PM entered a ZFW figure, which was 40 tons lower than the correct weight. The FO did not monitor the captain’s action and did not detect the captain’s error when it occurred.

- The captain promptly noted his mistake and mentioned it, but it is highly probable that while trying to correct it he actually entered the same wrong figure. The first officer did not hear it and was not aware of the correction attempt. The other captain, who at that time was in the cockpit, heard the captain mentioning his error, saw him make a correction but in reality did not see that the wrong figure was again entered.

- The first officer, acting as PF, did not perform effective cross checking of the data entered by the captain while checking all entered parameters, in accordance with operating procedures, in particular the captain’s error.

- The two active crewmembers were in a singular mental fixation during the calculation of takeoff data. Although in the power selection line on the OPT they entered the correct power corresponding to a takeoff weight higher than 220 tons, they did not notice that the gross weight copied from the flight management computer, a weight which they entered in an adjacent line on the OPT, was substantially lower. The two crewmembers did not notice until the climb phase the fact that the gross weight was substantially lower than both the planned weight and the typical takeoff weight for a long-range flight.

- The captain also copied the wrong ZFW from the FMC onto the OPT. The first officer, who earlier entered the planned ZFW into the OPT, noticed that there is a small and illogical margin between the ZFW he entered initially and the gross weight value which he first copied off the FMC and then corrected according to the captain’s figures. The first officer stated in the cockpit that something seemed “strange” to him, did not elaborate and modified the ZFW value to the wrong value, which he saw on the captain’s OPT. The captain heard the first officer saying that something seems strange but did not clarify the issue with him. Communication between the crewmembers during the performance computation was inadequate. Open communication and raising doubts could at high probability, have led to detecting the error and correcting it in advance.

- Conducting the performance calculations, for a weight, 40 tons lower than the true weight, resulted in takeoff speeds and engines thrust setting substantially lower than required for the true takeoff weight and lower than typical values for a full airplane on a long-range flight. It is probable that inexperience on this aircraft type, of both the active crew and the augmenting crew who were at the cockpit during takeoff, has contributed to the fact that no one has noticed that the data are substantially out of the reasonable probability criterion.

- Takeoff roll acceleration was significantly lower than usual. The aircraft reached V1 speed, which was 15 knots lower than the speed appropriate to the weight, at a point only about 100 feet from the correctly calculated point, due to the fact the slow acceleration was offset by the low V1. None of the crewmembers noticed the slow acceleration. There is a difficulty in perceiving acceleration variations in darkness.

- Under an aborted takeoff at V1 scenario, the incident aircraft would have succeeded in stopping on the runway, because the decision point was approximately the same, though with a substantially lower decision speed. Under a scenario of engine failure at V1 and continued takeoff, it is highly probable that it would have not safely lifted off the runway, and if a lift off was accomplished the climb performance would have been insufficient to safely complete the takeoff, unless the crew would have increased the operating engine thrust to full.

- The rotation speed computed by the crew was lower than Vmu and was approximately equal to the aircraft stall speed. Therefore, the aircraft only lifted off after gaining additional speed. Upon reaching the wrong rotation speed, the FO began pulling the column aft and the elevators responded accordingly. Aircraft response was sluggish, the nose raised only after reaching sufficient speed and became airborne at a pitch attitude significantly higher than usual and climbed at slow rate. Upon lift off, the elevators angle reduced for about 4 seconds, because of the flight the flight controls tail strike protection feature activation. This was sufficient to bring the smallest tail clearance to 29.3”, not exceeding the minimum defined in the aircraft manual.

- Continued climb to an altitude of 1500 feet AGL was conducted at the reduced takeoff thrust, at lower than usual rate of climb and at an airspeed slightly lower than required for the actual weight, but not to an extent, which significantly affected the maneuver margin.

- Flaps retraction procedure was executed based on slower flaps maneuver speeds than required for the actual weight. Although the maneuver margin was affected, in particular during retraction from flaps 1 to UP, no hazardous increase in angle of attack was observed and the process was completed safely.

- While climbing through about 20,000 feet the crew checked the cruise parameters and detected the error – the recommended FMC altitude was about 38,000 feet, which seemed too high and improbable to them for an initial cruise altitude on a long-range flight. The maximum altitude at which the aircraft could be operated under the prevailing atmospheric conditions and the actual weight was lower than the recommended cruise altitude, which could not be climbed to. The error was corrected promptly in the FMC.

- The first officer under check felt confident about his success and the checker inspired a comfortable atmosphere, but it can be reasonably assumed that being a check ride did contribute to increasing the mental workload on the first officer on one hand and on the captain on the other hand, especially considering the latter’s low experience in the B787 fleet.

- The crew inadequate teamwork has manifested itself in lack of coordination, lack of cross checking and flawed internal communication. Although the crewmembers felt good about it, it turned out that actually their perception of their cooperation was incorrect.

- Night departures, during hours in which the physical and cognitive performance are impaired, have a potential for human error caused by the biological clock effects. Any crewmember embarking on a night flight is subject to such effects, but not necessarily aware of them. All crewmembers including the captain, who has operated a flight the previous night, have had sufficient rest time beyond the minimum required by the Air Regulations, yet the impact of regular or accumulated fatigue cannot be ruled out.

- The discussion conducted by the active crew during the cruise, regarding their qualification to continue the flight was appropriate and the decision to continue was reasonable. The additional discussion regarding their ability to conduct the approach was also appropriate. Their decision to continue was reasonable, although it is possible that transferring command, cancellation of the check ride and transferring the approach to the augmenting crew could have been a safer alternative.

- El Al’s operating procedures, B787 fleet included, have no definition for cross checking of weight data and performance calculations versus objective data from external sources. Performance computation on two iPad devices does not consist effective cross checking, because both crewmembers might be using identical parameters, yielding identical yet potentially incorrect results.

- El Al’s communication infrastructure between aircraft systems and the ground systems does not support transmittal of weight and performance data to the aircraft via a data link. Had such network been in use and the company’s operating procedures would mandate receiving weight and performance data by datalink, it is highly probable that the error would have been prevented.

- The flight crew was properly qualified and held the licenses and ratings required by the Israeli Air Regulations for conducting the flight. However, all crewmembers assigned to this flight had less than one and a half month experience on the B787. All crewmembers were formally defined as “inexperienced”, except for the captain who was not defined as such because he has converted from the B777 fleet. Crewmembers’ inexperience with the aircraft they are operating might lead to increased workload, to additional mental pressure and reduced capability to detect unreasonable flight parameters, in particular when they are subjected to time constraints as was the case with this flight.

- The aircraft was serviceable and all its relevant systems functioned properly.

- El Al’s risk mitigation process conducted when the B787 fleet was established has not been sufficiently effective to specify means for reducing risks in flights manned by crew combinations having little experience in the type. The implemented risk mitigation processes were, initially based on all crewmembers being converted from the B777 fleet, i.e. a similar aircraft with the same type ratings. These processes were not properly revised when there were changes in the B787 fleet and in its crewmembers’ conversions.

- One of the risk mitigation measures defined upon the establishing of the fleet was pilots’ performance tracking by the FOQA system. Such tracking is not sufficiently effective, because it is focusing on a narrow aspect of the flight, the aircraft operation at takeoff and landing. It does not cover the other regimes of operation. No tracking parameters or irregular frequencies were defined. Eventually the tracking was not effective because the data from this system, since the fleet creation and until the incident date, have lacked essential details, due to incompatibility between the aircraft parameters and the ground analysis systems.

- Another risk mitigation step defined for the fleet was a discussion between the fleet manager (Or chief pilot) with a checker prior to conducting a check ride or an initial operating experience flight. According to the fleet’s chief pilot, such a conversation with the captain did take place few days before the incident flight. The conversation touched training flights and checks in general, but did not relate to this particular check ride. The captain was not aware of this being a check ride prior to starting the preflight briefing.

- According to the chief pilot, the crew assignment was “in focus” by the fleet management because of the accumulated little experience in type, of all crewmembers, but it was decided to refrain from changing the assignment because both captains were experienced and in the past both of them had senior positions in the flight operations division. This decision was proven wrong. The fact that this was a holiday flight may have also been a reason for refraining from changing crew assignments.

- Various distractions are typical to El Al operations and probably to other airlines as well. They include dealing with final fuel quantity during cockpit preparation, signing the fueling form, checking and signing the load sheet, etc. Dealing with “service passengers” is a distraction on every such flight, especially when there is shortage of available seats. It gets worse on holiday flights, which are critical for the family members. This was a busy holiday flight and 3 of the 4 flight crewmembers were accompanied by family members, a fact which may have caused a distraction to some and in particular to the captain who has the overall responsibility for operating the flight. When all of the above distractions occur within a tight time constraint, their effect is more pronounced.

- El Al’s B787 fleet operating procedures have no reliable crosschecking of the trim for takeoff parameter. Mismatching trim values detected during a crosscheck will necessitate an explanation and thus support detection of errors. On this flight, the trim value from the FMC happened to be similar to the value on the load sheet.

- The "Before Start" checklist has no item directing checking and calling out of the calculated engines thrust. Checking of this parameter meets the first criterion for inclusion of an item in the normal checklist, since it is a parameter critical to flight safety and there is no system monitoring it and cautioning if it happens to be incorrect.

- The decision of the director of flight operations in 2012 to introduce takeoff data cards was not implemented. Had it been implemented, the subject incident may have been prevented.

- Neither El Al’s procedures nor the Air Regulations have any reference to the mental fitness of crewmembers to continue active flying after experiencing a serious safety event.

In the English version the AIAI analyses takeoff performance:

Conclusions from the chart and table:

- The aircraft reached the runway point of erroneous V1 at a distance of 7,100 feet, instead of 7,000 feet if the takeoff would have been made at correct thrust and speeds. For a scenario of aborted takeoff at V1 (Accelerate-Stop), the point of initating pilot actions would be 100 feet further down the runway, but the speed upon brakes application would be substantially slower. Thereofre the aircraft would have been able to stop on the runway, either with two engines operating or single engine.

- For a scenario of continued takeoff from V1 (Accelerate-Go), the aircraft would have reached the Vr point at about the same distance, because it only had to accelerate by 2 more knots (152-154 knots). Note: The chart presents a two engines scenarion, does not account for single engine.

- From the point of perceiving distances along the runway, the crew was unable to detect the error.

- Acceleration was substantially slower than normal – 41 seconds from 30 knots to 154 knots, compared to 43 knots from 30 to 180 knots, measured on a flight under similar conditions. None of the crewmembers noticed the slow acceleration.

Rotation process

- Take off data from the EAFR, in seconds since brake release:
- 41 Sec. – Reaching Vr, 154 knots.
- 42 Sec. – Beginning of pulling the column.
- 44 Sec. – Column reaches max aft travel. Elevators average angle 10.3 Deg., speed 163 knots, nose starts coming up.
- 45 Sec. – Aircraft is airborne, sped 166 knots. Elevators average angle 9.7 Deg.
- 46 Sec. – Speed 167 knots. Pitch attitude increasing. Aircraft is not climbing.
- 47 Sec. – Speed 168 knots. Pitch attitude increasing. Aircraft is not climbing.
- 48 Sec. – Speed 170 knots. Aircraft starts climbing. Pitch attitude 9.0 Deg., elevators average angle 9.1 Deg. Minimum measured tail clearance 29.3”.
- 49 Sec. – Speed 171 knots. Tail clearance increasing to 30”, pitch attitude 9.2 Deg., aircraft climbing.
- 50 Sec. – Climb speed 172 knots. Tail clearance continues to increase, pitch attitude 10.4 Deg., elevators average angle 12.4 Deg.
- 53 Sec. – Airspeed 175 knots. Altitude 35 feet above the runway.

The AIAI further analysed:

Active failure – Main contributing factor to the incident – Ineffective crosschecking by the PF over the entering of data by the PM
FO1 did not follow the process of entering the weight data into the FMC by CAP1 and was not aware of the error and of the attempt to correct it.
It was the FO1’a duty as the PF to crosscheck all values entered by CAP1 into the FMC. It is highly probable that FO1 did not check the PERF INIT page and did not detect the error entered to the ZFW line and the wrong gross weight. It is highly probable that neither crewmember has reviewed the VNAV CRZ page. Reviewing this page would have most probably exposed the error while still on the ground, as has eventually happened during climb.

Note: Reviewing the cruise page is not required in the departure process but many crewmembers are regularly reviewing it.