Canada E190 and Canada B773 at Toronto on Mar 7th 2020, both aircraft accelerated on same runway at same time, both aircraft rejected takeoff

Last Update: June 16, 2022 / 22:22:04 GMT/Zulu time

Bookmark this article

Photo of Air Canada C-FMZW, Embraer ERJ-190 — Air Canada C-FMZW, Embraer ERJ-190 (Photo credit: Lord of the Wings© / Flickr / License: CC by-sa)

Incident Facts

Date of incident
Mar 7, 2020

Classification
Incident

Airline
Air Canada

Flight number
AC-1037

Departure
Toronto, Canada

Destination
Denver, United States

Aircraft Registration
C-FMZW

Aircraft Type
Embraer ERJ-190

ICAO Type Designator
E190

An Air Canada Embraer ERJ-190, registration C-FMZW performing flight AC-1037 from Toronto,ON (Canada) to Denver,CO (USA) with 87 people on board, was cleared for takeoff from Toronto's runway 06L under visual departure procedures.

Immediately when the E190 began their takeoff roll, Tower cleared the Air Canada Boeing 777-300, registration C-FJZS performing flight AC-606 from Toronto,ON to Halifax,NS (Canada) with 359 people on board, to taxi into position and hold on runway 06L.

While the E190 was still in their takeoff roll, tower cleared the Boeing 777-300 for takeoff.

Shortly afterwards the E190 received a bird strike, the crew decided to reject takeoff at 135 KIAS. The crew radioed tower that they were rejecting takeoff exactly at the same time when the B773 acknowledged their takeoff clearance and commenced takeoff.

When the B773 accelerated through 110 KIAS they noticed the E190 was still on the runway and rejected takeoff and managed to stop clear of the E190.

Both aircraft were able to vacate the runway, the E190 returned to the apron. The Boeing 777-300 waited on a taxiway for 45 minutes to cool their brakes, then returned to the apron.

The Canadian TSB reported there were no injuries and no damage to either aircraft. There was a risk of collision, the TSB opened a Class 3 investigation into the occurrence.

In June 2022 the TSB released their final report concluding the probable causes of the occurrence were:

Findings as to causes and contributing factors

- In order to achieve an expeditious flow of traffic, the controller was using pilot-applied visual departure separation procedures per NAV CANADA’s Manual of Air Traffic Services. In this occurrence, the operations conducted under the pilot-applied visual departure separation procedure were optimized to a point where separation was not assured.

- Given the Embraer 190’s speed and position on the runway, the controller was not expecting a high-speed rejected takeoff. He assessed that the aircraft was becoming airborne and no longer required his attention and monitoring. As a result, he issued the take-off clearance to the Boeing 777 even though the Embraer 190 was still on the runway.

- The Embraer 190 struck a bird and conducted a rejected takeoff at a critical point during its take-off roll, just before the Boeing 777 received its take-off clearance and started its own take-off roll.

- The first officer of the Embraer 190 made a radio call reporting the rejected takeoff, but this call went undetected by the controller or the Boeing 777 flight crew as it was overlapped by the radio call from the first officer of the Boeing 777 reading back the take-off clearance. As a result, neither the controller nor the Boeing 777 flight crew were aware that the Embraer 190 was rejecting the takeoff.

- Because the controller was expecting the Embraer 190 to take off without interruption, he shifted his attention and priority to other aircraft movements. Focus on these tasks, combined with operating from the north tower position, reduced the controller's opportunity to detect the Embraer 190’s rejected takeoff and delayed the response to the conflict.

- The Boeing 777 flight crew visually sighted the Embraer 190, believed it would soon be airborne, and saw no apparent risk of collision; however, they were unaware that it was conducting a rejected takeoff and decelerating. Proceeding as authorized, the Boeing 777 flight crew commenced their take-off roll while the Embraer 190 was still on the runway, which resulted in a runway incursion and risk of collision.

- The Embraer 190’s transponder transmitted that the aircraft was in air after the aircraft accelerated past 50 knots. As a result, although compliant with current standards, an inaccurate in-air status was transmitted for approximately 52 seconds while the aircraft remained on the ground during its take-off roll and rejected takeoff.

- The runway incursion monitoring and conflict alert sub-system (RIMCAS) relies on data from aircraft systems designed to provide aircraft flight status data for use by airborne surveillance systems. The use of this data by RIMCAS led to the inaccurate identification of the Embraer 190 and the Boeing 777 as in air while these 2 aircraft were still on the ground. This resulted in late and inaccurate RIMCAS alerts and delayed the response to the risk of collision.

- A risk of collision occurred when the accelerating Boeing 777 was travelling at 133 knots indicated airspeed and was approximately 5000 feet from the decelerating Embraer 190. The risk was mitigated once the Boeing 777 flight crew rejected their takeoff after recognizing that the Embraer 190 was still on the runway ahead of them.

Findings as to risk

- If the logic which determines flight status within the runway incursion monitoring and conflict alert sub-system (RIMCAS) has a latency of several seconds, the resulting delays in conflict detection increase the risk that the RIMCAS alerts will be ineffective.

The TSB analysed:

At the time of the occurrence, the controller planned to coordinate the Boeing 777’s departure using pilot-applied visual departure separation behind the Embraer 190. He was using a rapid flow, or cadence, to be as expeditious as possible, in accordance with NAV CANADA’s MATS. He was highly experienced, was comfortable with the traffic level, and was managing the workload efficiently. The controller assessed this situation very quickly (in the span of only a few seconds), which was a normal practice. The controller made assessments based on his past experience, knowledge, and perceptions of the performance capabilities of both the Embraer 190 and the Boeing 777, including:

- perceiving the Embraer 190 at a speed at or near its rotation speed;
- perceiving the Embraer 190 in a position at or beyond a typical rotation point;
- timing the Boeing 777’s take-off clearance; and
- anticipating that the Embraer 190 would be airborne by the time the Boeing 777 flight crew read back their take-off clearance and started the take-off roll.

The controller’s expectation was very high that the Embraer 190 would depart at the controller’s assessed position and time. This expectation was reinforced by his knowledge that:

- high-speed rejected takeoffs are rare;
- aircraft do not conduct rejected takeoffs after rotation; and
- he had never in his career seen a rejected takeoff at such a high speed or from that point on the runway.

With this understanding, the monitoring stage and confirmation of action of the Embraer 190’s departure was effectively complete. Therefore, the controller transitioned to other duties, even though he did not actually see the Embraer 190 rotate. He concluded that the Embraer 190 was “rotating” based on all of the cues indicating that his assessment was correct.

The point at which the controller decided to issue the take-off clearance to the Boeing 777 was several seconds before the Embraer 190 was anticipated to be airborne. The controller’s situation assessment matched his mental model up to the point of the bird strike and the USiT. This decision was also influenced by guidance and procedures in the MATS, as well as the controller’s extensive experience.

In this case, the controller needed external cues to tell him that things were not as he had assessed. He did not hear any radio calls from the Embraer 190 and did not receive any RIMCAS alerts; therefore, the controller did not receive any contradictory cues (aural or visual) to challenge his mental model or his expectations, or alter his assessment or actions. These 2 defences failed.

As a result, the controller’s mental model and expectation were that the aircraft was rotating, which meant that it was essentially considered departed and no longer required his attention and monitoring. The controller assessed the situation as typical and familiar and identified a course of action likely to succeed, which allowed him to rapidly move on to other pressing tasks and decisions. This decision is consistent with naturalistic decision making and with the way experts make rapid and timely decisions in a dynamic environment and under time pressure. The controller timed the delivery and expected readback of the Boeing 777’s take-off clearance so that the aircraft would start its take-off roll immediately after the Embraer 190 became airborne, satisfying procedural requirements of the MATS.

Finding as to causes and contributing factors

Given the Embraer 190’s speed and position on the runway, the controller was not expecting a high-speed rejected takeoff. He assessed that the aircraft was becoming airborne and no longer required his attention and monitoring. As a result, he issued the take-off clearance to the Boeing 777 even though the Embraer 190 was still on the runway.

Bird strike and Embraer 190’s rejected takeoff

When the Embraer 190 struck a bird on its take-off roll, the controller was issuing a take-off clearance to the Boeing 777. The Embraer 190 was travelling at 139 knots indicated airspeed (KIAS)—just below the calculated V1 speed of 146 KIAS—at the time. The captain of the Embraer 190 initiated a rejected takeoff and the first officer transmitted a radio call, per company procedures. This whole sequence of events took 5 seconds.

Finding as to causes and contributing factors

The Embraer 190 struck a bird and conducted a rejected takeoff at a critical point during its take-off roll, just before the Boeing 777 received its take-off clearance and started its own take-off roll.

Undetected simultaneous transmissions

Simultaneous transmissions are a common hazard in aviation. They pose a threat and the risk of important communications going unheard increases when these transmission signals go undetected.

The radio transmissions from the Embraer 190 and the Boeing 777 were initiated within 0.1 seconds of each other and 0.6 and 0.7 seconds, respectively, after the controller had ended his radio transmission for the Boeing 777’s take-off clearance:

- At 0948:53.4, the first officer of the Embraer 190 initiated the radio call for the rejected takeoff. This transmission lasted 3.13 seconds.

- At 0948:53.5, the first officer of the Boeing 777 initiated the readback of the take-off clearance. This transmission lasted 3.225 seconds.

The timing of these radio calls indicates a full overlap of radio signals. As a result of this USiT, neither the controller nor the flight crew of the Boeing 777 were aware of the conflict because they did not know that the Embraer 190 was conducting a rejected takeoff.

Finding as to causes and contributing factors

The first officer of the Embraer 190 made a radio call reporting the rejected takeoff, but this call went undetected by the controller or the Boeing 777 flight crew as it was overlapped by the radio call from the first officer of the Boeing 777 reading back the take-off clearance. As a result, neither the controller nor the Boeing 777 flight crew were aware that the Embraer 190 was rejecting the takeoff.

Detecting the Embraer 190’s rejected takeoff

In this occurrence, the USiT meant that no aural cue was available to alert the controller or the Boeing 777 flight crew to the rejected takeoff. Unaware of the Embraer 190's radio call to reject the takeoff, the controller carried on with his duties.

Once the Embraer 190 flight crew initiated the rejected takeoff, some visual cues were available to the controller:

- the Embraer 190 could be seen decelerating on the runway; and
- the speed values on the track label for the Embraer 190 on the controller working position (CWP) could be seen decreasing.

Because the controller was working from the north tower control position, he had to perform visual scans to monitor the thresholds of Runway 05 and Runway 06L, the departure end of Runway 06L, and the monitors at his CWP. To face either Runway 05 and the CWP or Runway 06L, he needed to turn 180°, and did so several times. This made it more difficult to visually monitor aircraft departing from Runway 06L because of the visual obstructions present when he was looking across the tower cab and out the window at Runway 06L.

Furthermore, when the controller perceived that the Embraer 190 was about to become airborne, and with no expectation that it would perform a rejected take-off at that point, he concluded that it no longer required his attention and monitoring. He then shifted his body and visual scan, and started focusing on listening to the Boeing 777’s clearance readback, monitoring an aircraft landing on Runway 05, instructing an aircraft to line up on Runway 06L, and then looking down at his CWP. Because the controller had already shifted his focus to aircraft arriving on Runway 05, his back was likely turned away and he was no longer looking at the departure end of Runway 06L and, therefore, the Embraer 190 was no longer in his field of view.

As for the monitors at this CWP, the track labels are small and it is possible that changes to an aircraft’s speed, altitude, or flight status on the track label would go unnoticed by a controller who is standing and concentrating on looking outside to control aircraft movements. In this case, the controller did not notice any changes to the speed of the Embraer 190 once it had rejected the takeoff.

Lastly, the RIMCAS was not configured to help the controller detect the conflict that occurred following the rejected takeoff and did not generate alerts (visual or aural) in time.

Finding as to causes and contributing factors

Because the controller was expecting the Embraer 190 to take off without interruption, he shifted his attention and priority to other aircraft movements. Focus on these tasks, combined with operating from the north tower position, reduced the controller's opportunity to detect the Embraer 190’s rejected takeoff and delayed the response to the conflict.

After the Boeing 777 flight crew had read back their take-off clearance, they began the takeoff roll. At that moment, they were unaware of the bird strike or the Embraer 190’s rejected take-off and saw no apparent risk of collision. They could see the Embraer 190 on the runway, but had no reason to expect that it would not be airborne given that they had received their take-off clearance. In addition, because they did not hear the radio call made by the first officer of the Embraer 190, no aural cues were available to alert the Boeing 777 flight crew of the Embraer 190’s rejected takeoff.

Finding as to causes and contributing factors

The Boeing 777 flight crew visually sighted the Embraer 190, believed it would soon be airborne, and saw no apparent risk of collision; however, they were unaware that it was conducting a rejected takeoff and decelerating. Proceeding as authorized, the Boeing 777 flight crew commenced their take-off roll while the Embraer 190 was still on the runway, which resulted in a runway incursion and risk of collision.

In-air/on-ground flight status

In this occurrence, 3 aircraft were on the runway at the same time: the Embraer 190, the Boeing 777, and a de Havilland DHC-8 that was moving into position and waiting to take off.

Advanced surface movement guidance and control system (A-SMGCS) alerts were generated only after both the Embraer 190 and the Boeing 777 had initiated their respective rejected takeoff procedures. The investigation examined why neither a stage 1 alert – departure nor a stage 2 alert – departure was generated earlier in the occurrence sequence of events. The following sections will discuss the system logic that contributed to the in-air/on-ground flight statuses observed in this occurrence.

Honeywell Primus Epic monitor warning function

The investigation determined that the Honeywell XS-857A Mode S transponder’s system logic complies with the Minimum Operational Performance Standards for Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment (DO-181 MOPS) guidance and, as designed, uses the in-air/on-ground status that it receives from the Honeywell Primus Epic’s MWF. Although the MWF system used input from the weight-on-wheels sensors, an examination of where the data came from found that the origin of the inair/on-ground status was the logic in the MWF because the validation check used a speed of 50 knots.

The system logic in the Honeywell Primus Epic avionic suite causes the XS-857A Mode S transponder to transmit an in-air status when the indicated airspeed is greater than 50 knots, even if the aircraft is still on the ground. Although the investigation was unable to determine why the MWF was set to 50 knots, the threshold of 50 knots complies with the applicable standard and technical standard orders, was set in accordance with design requirements, and presented no issues for the operation at the time of design and certification processes in the early 2000s. The DO-181 MOPS cites 100 knots as a validation check for overriding a faulty on-ground status and accepts any value below 100 knots (including 50 knots) as valid.

Discussions with Honeywell and Embraer revealed that the 50-knot value was selected during the design and certification processes for the Embraer 190. It was most likely selected as a conservative speed value to ensure the timely interoperability of the transponder with airborne surveillance systems (such as an airborne collision avoidance system [ACAS]) before flight while the aircraft accelerates on its take-off roll. At that time (early 2000s), the DO-181 MOPS predated systems such as A-SMGCS and RIMCAS. The use of the transponder’s in-air status function for use by ground surveillance systems was not considered by the DO-181 MOPS, applicable technical standard orders, aircraft and transponder manufacturers, or other stakeholders. While this speed value complies with the applicable standard and technical standard orders and is an effective means of ensuring the timely interoperability of the transponder with airborne surveillance systems before flight, it provides inaccurate information for ground surveillance systems that need to accurately determine an aircraft’s on-ground status.

The transponders on board the Embraer 190 and the Boeing 777 functioned as designed and switched to an in-air status after the aircraft had accelerated past a speed threshold during takeoff while still on the ground, making the aircraft visible to ACAS. This is consistent with the original intent of the system.

Transport Canada has confirmed that selections of this threshold value vary and are generally selected by the aircraft manufacturer. The selection of a 50-knot override threshold found within the Embraer 190’s transponder system logic may be unusually low for large transport-category aircraft, but other aircraft may have different override threshold values below 100 knots as well.

Finding as to causes and contributing factors

The Embraer 190’s transponder transmitted that the aircraft was in air after the aircraft accelerated past 50 knots. As a result, although compliant with current standards, an inaccurate in-air status was transmitted for approximately 52 seconds while the aircraft remained on the ground during its take-off roll and rejected takeoff.

Runway incursion monitoring and conflict alert sub-system alert logic

The RIMCAS is designed to monitor aircraft and vehicles and to identify and alert air traffic controllers to possible conflict situations. In this occurrence it functioned as designed; however, because the transponder transmitted an inaccurate status, the RIMCAS did not immediately detect the departure conflict and, as a result, the controller did not receive an alert until after both aircraft had conducted their rejected takeoffs.

To provide timely and accurate alerts, the RIMCAS must correctly identify a target’s status. If a target is identified as in air, it will be omitted from the targets used to detect a departure conflict. Therefore, if the RIMCAS receives or uses an inaccurate in-air/on-ground status, it might not identify vehicles or aircraft that are on the ground at critical times.

In this occurrence, at 0948:30, 3 seconds after the Embraer 190 accelerated through a ground speed of 50 knots, the A-SMGCS multi-sensor tracker (MST) accepted the aircraft’s status based on its ground bit set (GBS) value and inaccurately identified the Embraer 190 as being in air. As a result, the RIMCAS logic omitted the radar target from the departure conflict detection logic. Forty-two seconds later, when the Boeing 777 was accelerating down the runway, the criteria for a stage 2 alert – departure should have been met; however, because the Embraer 190 was still identified as being in air, the RIMCAS did not detect a departure conflict. The Boeing 777 initiated its rejected takeoff 12.5 seconds later.

The RIMCAS generated an alert regarding these 2 aircraft at 0949:43, when both the Embraer 190 and the Boeing 777 met the criteria to be identified as on ground.

The investigation determined that the RIMCAS relied on the GBS value for automated conflict detection and alerting, despite the limitations with respect to the accuracy of the data. However, the investigation was unable to determine the rationale behind the RIMCAS default values and what the full extent of the repercussions would be if the parameters were modified and the setting of the in-air status at takeoff were delayed.

The RIMCAS can be configured to overcome these limitations, but doing so may cause false alarms, which might reduce the controllers’ confidence in the sub-system.

The DO-181 MOPS recommended speed of 100 knots for the transition point from on ground to in air is beneficial to ensure the timely interoperability of an aircraft’s transponder with airborne surveillance systems before it becomes airborne. However, data inputs (such as Mode S reply messages, MWF values, or GBS values) that use a speed value may provide inaccurate data for ground surveillance systems or automated runway incursion monitoring systems, such as RIMCAS.

This investigation focused heavily on the inaccuracies found in the in-air status of the Embraer 190 and the RIMCAS. The Embraer 190 was identified as in air for approximately 52 seconds even though it remained on the ground. Simulations and an examination of flight data show that the Embraer 190 would have been identified as in air for approximately 19 seconds even if the DO-181 MOPS recommended airspeed of 100 knots had been applied.

Equally important, however, is the fact that the Boeing 777’s in-air/on-ground status was also inaccurate. The status of the Boeing 777 switched to in air at 0949:20 once it accelerated past 100 knots during its take-off roll, and remained that way for approximately 23 seconds even though the aircraft was still on the ground. Although the investigation did not examine the Boeing 777’s avionics systems or its transponder, it did determine that these systems will inaccurately identify an aircraft as in air if 100 knots is used as the standard recommended speed (in compliance with the DO-181 MOPS) and the aircraft is accelerating past that speed but is still on the ground.

In this occurrence, ground surveillance systems and automated runway incursion monitoring systems, such as RIMCAS, relied on the accuracy of the GBS value received from aircraft transponders. However, RIMCAS may make use of other available data to determine whether an aircraft is on ground or in air. As this occurrence demonstrated, the aircraft’s or transponder’s on-ground status function data were inaccurate—indicating in air when the aircraft was on ground. Using this inaccurate information, the RIMCAS made a determination that the Embraer 190 had become in air for a period of time while it was still on the runway. This same RIMCAS behaviour resulted in the controller’s display indicating the Boeing 777 was in air for 23 seconds even though it also remained on the runway during the entire occurrence. If more accurate aircraft status data are available, these systems will be better able to determine an aircraft’s on-ground status and provide accurate and timely alerts.

Finding as to causes and contributing factors

The RIMCAS relies on data from aircraft systems designed to provide aircraft flight status data for use by airborne surveillance systems. The use of this data by RIMCAS led to the inaccurate identification of the Embraer 190 and the Boeing 777 as in air while these 2 aircraft were still on the ground. This resulted in late and inaccurate RIMCAS alerts and delayed the response to the risk of collision.

In addition to the inaccuracies identified above, the RIMCAS was also subject to internal latencies. As the Embraer 190’s airspeed was decelerating through 50 knots, its GBS from the multilateration system changed from in air to on ground. However, the MST delayed changing the target’s flight status for a further 6 seconds. This delay was also observed during the Boeing 777’s deceleration as the MST also delayed changing the Boeing 777’s flight status to on ground for 11 seconds. The cause of these delays in the changes to the aircraft flight status back to on ground was due to the setting of the “Ground speed” parameter within the RIMCAS, which was set 10 knots lower than the take-off speed, or the “Minimum speed for takeoff when GBS is OK,” of 50 knots. These values are set as recommended by Indra Navia AS after a local tuning and optimization process is completed with the client.

Finding as to risk

If the logic which determines flight status within the RIMCAS has a latency of several seconds, the resulting delays in conflict detection increase the risk that the RIMCAS alerts will be ineffective.

Boeing 777’s rejected takeoff

When the Boeing 777 flight crew detected that the Embraer 190 had rejected its takeoff and was decelerating on the active runway, they rejected their takeoff and significantly reduced the severity of this runway incursion. The Boeing 777 reached 133 KIAS before decelerating. At that point, the Boeing 777 and the Embraer 190 were separated by 5000 feet and that distance was decreasing.

The defences that were present included technical safety barriers (such as the use of radios and the interoperability between transponders and RIMCAS) and procedural safety barriers (such as aerodrome operating procedures, air traffic control procedures, and airline or pilot operating procedures).

A number of these defences broke down after the bird strike, the Embraer 190’s rejected takeoff, and the USiT, but 1 line of defence remained in place: the visual separation maintained by the Boeing 777 flight crew. The risk of collision was mitigated when the Boeing 777 flight crew conducted its own rejected takeoff.

Finding as to causes and contributing factors

A risk of collision occurred when the accelerating Boeing 777 was travelling at 133 KIAS and was approximately 5000 feet from the decelerating Embraer 190. The risk was mitigated once the Boeing 777 flight crew rejected their takeoff after recognizing that the Embraer 190 was still on the runway ahead of them.