Incident: Incorrect Temperature Input Leads to Near Catastrophic Plane Takeoff.

Published Date: 2018-11-21

Postmortem Analysis
Timeline 1. The software failure incident happened in July 2017 [Article 77582]. 2. The incident occurred on July 21, 2017, at Belfast International Airport [Article 77582].
System 1. Flight Management Computer system on the Boeing 737 [Article 77609, Article 77582] 2. Software upgrade for Boeing 737s that crosschecks information typed into the flight management system with its own temperature sensors [Article 77609]
Responsible Organization 1. The cabin crew member who entered the wrong temperature into the Flight Management Computer [Article 77582]. 2. The crew on the Sunwing holiday flight from Belfast to Corfu who failed to input the correct temperature, possibly due to jetlag [Article 77609].
Impacted Organization 1. Passengers on the Boeing 737 flight [77609, 77582] 2. Belfast International Airport staff and operations [77609, 77582] 3. Sunwing Airlines [77609, 77582] 4. Air Accidents Investigation Branch (AAIB) [77609, 77582] 5. Transportation Safety Board in Canada [77582]
Software Causes 1. The software cause of the failure incident was the incorrect input of the outside temperature into the Flight Management Computer, leading to the autopilot calculating the takeoff speed based on a temperature of -52C instead of 16C, resulting in the plane struggling to take off and flying low for two and a half miles [77609, 77582]. 2. The software malfunction also included the lack of an alarm system to alert staff of the mistake during takeoff, which could have prevented the incident from occurring [77582]. 3. Additionally, the aircraft's computer lacked the capability to alert the crew to the incorrect outside temperature input, highlighting a software deficiency that has since been addressed in new software versions [77582].
Non-software Causes 1. Jetlag affecting one of the pilots [77609] 2. Mistake by cabin crew in entering the outside temperature [77582] 3. Lack of alert system to notify staff of the mistake during take-off [77582] 4. Failure of the crew to recognize the issue until reaching the end of the runway [77582]
Impacts 1. The software failure incident led to the Boeing 737 struggling to take off and flying low for two and a half miles after pilots entered the wrong temperature into the onboard computer, which could have had "catastrophic" consequences [77609, 77582]. 2. The incident resulted in the plane lifting off at the extreme end of the runway, striking a 36cm-high light on the ground almost 30 meters after takeoff [77609, 77582]. 3. Due to the software failure, the plane climbed to just 800ft, far below the usual steep climb on takeoff, risking further collision if there were obstacles in the flight path [77609, 77582]. 4. The crew did not report the incident themselves, and the aircraft operator, tour operator, or aircraft commander failed to inform the Air Accidents Investigation Branch (AAIB) about the incident, despite having a legal duty to do so [77582]. 5. The incident highlighted the lack of capability in the aircraft's computer to alert the crew to incorrect outside temperature inputs, leading to a situation where abnormality detection was unlikely due to normal limitations in human performance [77582].
Preventions 1. Implementing a software upgrade on all Boeing 737s to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors could have prevented the incident [77609]. 2. Introducing safety systems to warn pilots of unusually low acceleration before take-off and low altitude afterwards could have helped prevent the software failure incident [77609]. 3. Enhancing the aircraft's computer capabilities to alert the crew to incorrect outside temperature inputs could have potentially prevented the incident [77582].
Fixes 1. Implement a software upgrade for all Boeing 737s to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors [77609, 77582]. 2. Introduce safety systems to warn pilots of unusually low acceleration before take-off and low altitude afterwards [77609]. 3. Enhance the aircraft's computer capability to alert the crew to incorrect outside temperature inputs [77582].
References 1. Air Accidents Investigation Branch (AAIB) [Article 77609, Article 77582] 2. Transportation Safety Board in Canada [Article 77582]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization a) The software failure incident related to the Boeing 737 struggling to take off due to the wrong temperature input by the pilots happened again within the same organization. The incident occurred on a Sunwing holiday flight from Belfast to Corfu on 21 July last year [77609]. The Air Accidents Investigation Branch recommended that all Boeing 737s have a software upgrade to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors, which had been available but not installed on the Sunwing flight. b) The software failure incident related to the wrong temperature input causing a plane to struggle during takeoff has not been explicitly mentioned to have happened at other organizations or with their products and services in the provided articles.
Phase (Design/Operation) design (a) The software failure incident in the articles can be attributed to the design phase. The incident occurred because the pilots typed the wrong temperature into the onboard computer, leading to the autopilot calculating the takeoff speed based on the incorrect temperature input [77609, 77582]. This design flaw in the system development process contributed to the plane struggling to take off and flying low for two and a half miles after departure, potentially leading to catastrophic consequences. Additionally, the Air Accidents Investigation Branch recommended a software upgrade to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors, highlighting a design-related solution to prevent such incidents in the future [77609]. (b) The software failure incident does not seem to be directly related to the operation phase or misuse of the system. The focus of the incident was on the incorrect temperature input during the design phase, which led to the plane's struggle during takeoff. There was no indication in the articles that the failure was caused by the operation or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) The software failure incident in the articles is primarily within_system. The incident occurred because the pilots typed the wrong temperature into the onboard computer, causing the autopilot to calculate the takeoff speed based on the incorrect temperature input [77609, 77582]. This internal error within the system led to the plane struggling to take off and flying low for a significant distance after departure. Additionally, the software upgrade recommended by the Air Accidents Investigation Branch was aimed at ensuring the plane crosschecks the information typed into the flight management system with its own temperature sensors, indicating an internal system improvement to prevent such incidents in the future [77609]. (b) The software failure incident also had elements of outside_system factors. The crew members' mistake of entering the wrong temperature was attributed to potential jetlag affecting one of the pilots, which is an external factor influencing the crew's performance [77609]. Furthermore, the investigation found that the crew did not recognize the issue until they reached the end of the runway, indicating a lack of alerting mechanisms or external checks to catch such errors during the pre-flight phase [77582].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurred due to non-human actions, specifically a mistake in entering the outside temperature into the Flight Management Computer. This error led to the autopilot calculating the takeoff speed based on the wrong temperature, resulting in the plane struggling to take off and flying low for a significant distance [77609, 77582]. (b) The incident also involved human actions as the crew members were responsible for entering the incorrect temperature into the system. Investigators found that one of the pilots may have been suffering from jetlag, which could have contributed to the error. Additionally, the crew did not report the incident themselves, and the aircraft operator, tour operator, or aircraft commander failed to inform the Air Accidents Investigation Branch about the incident, despite having a legal duty to do so [77609, 77582].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The incident involved a Boeing 737 struggling to take off due to pilots typing the wrong temperature into the onboard computer, which led to the plane lifting off at the extreme end of the runway and striking a light on the ground [77609]. - The crew did not recognize the issue until they reached the end of the runway, indicating a lack of alert or warning systems during takeoff [77582]. (b) The software failure incident occurring due to software: - The error on the Flight Management Computer, where a crew member entered the wrong outside temperature, resulted in the assumed temperature thrust only delivering 60% of the required thrust for takeoff [77582]. - The Air Accidents Investigation Branch recommended a software upgrade for all Boeing 737s to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors [77609].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in the articles was non-malicious. The incident occurred due to human error when one of the pilots entered the wrong temperature into the onboard computer, causing the autopilot to calculate the takeoff speed based on the incorrect temperature [-77609, -77582]. Additionally, the crew did not report the incident themselves, and there was no indication of any malicious intent behind the error.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor_decisions: - The incident occurred when the crew members entered the wrong temperature into the Flight Management Computer, leading to the autopilot calculating the takeoff speed based on the incorrect temperature [77609, 77582]. - Investigators found that one of the pilots may have been suffering from jetlag, which could have contributed to the error in inputting the temperature [77609]. - The crew did not report the incident themselves, indicating a lack of proactive action to address the mistake [77609]. - The Air Accidents Investigation Branch recommended a software upgrade to ensure the plane crosschecks the information typed into the flight management system with its own temperature sensors, indicating a need for better decision-making processes regarding software updates [77609]. (b) The intent of the software failure incident related to accidental_decisions: - The error in inputting the temperature into the Flight Management Computer was described as a mistake made by the crew members [77582]. - The crew did not recognize the issue with the temperature input until they reached the end of the runway, suggesting an unintended decision that led to the software failure [77582]. - The investigation found that the crew were unlikely to detect any abnormality due to normal limitations in human performance, indicating that the mistake was not intentional but rather a result of human error [77582].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the articles can be attributed to development incompetence. The incident occurred because the pilots of the Boeing 737 entered the wrong temperature into the onboard computer, leading to the autopilot calculating the takeoff speed based on the incorrect temperature of -52C instead of the actual temperature of 16C [77609, 77582]. This mistake was a result of human error or lack of professional competence in entering the correct data into the system, which ultimately led to the plane struggling to take off and almost causing a catastrophic incident. (b) Additionally, the incident can also be categorized as accidental, as the error in entering the wrong temperature was not intentional but rather a mistake made by the crew members. The crew member accidentally entered -52C instead of the correct temperature of 16C into the Flight Management Computer, which resulted in the plane not achieving the required thrust for takeoff [77582]. This accidental error almost led to a catastrophic incident during the flight from Belfast to Corfu.
Duration temporary The software failure incident described in the articles can be categorized as a temporary failure. The incident occurred due to a mistake made by the cabin crew when entering the outside temperature into the Flight Management Computer, resulting in the system calculating the takeoff speed based on the incorrect temperature of -52C instead of the actual temperature of 16C [77609, 77582]. This temporary failure led to the plane not achieving the required thrust for takeoff, which could have had catastrophic consequences. Additionally, the investigation found that the crew did not recognize the issue until they reached the end of the runway, indicating a temporary nature of the failure [77582].
Behaviour crash, omission, timing, value, other (a) crash: The incident involving the Boeing 737 at Belfast International Airport can be categorized as a crash type of software failure. The pilots entered the wrong temperature into the onboard computer, causing the autopilot to calculate the takeoff speed based on the incorrect temperature. This led to the plane struggling to take off, almost reaching the end of the runway, and flying low for two and a half miles before climbing to a safe altitude [77609, 77582]. (b) omission: The software failure incident also involved an omission type of failure. The crew member mistakenly entered the outside temperature as -52C instead of the actual temperature of 16C into the Flight Management Computer. This error resulted in the assumed temperature thrust delivering only 60% of the required thrust for takeoff, leading to the plane not achieving its top speed and hitting a light at the end of the runway [77582]. (c) timing: The timing of the software failure incident can be considered a factor in this case. The crew did not recognize the issue with the incorrect temperature input until they reached the end of the runway, indicating a delay in detecting the error. Additionally, the malfunction that should have alerted staff to the mistake did not occur during takeoff, further highlighting a timing-related failure aspect [77582]. (d) value: The software failure incident also involved a value type of failure. The incorrect temperature input led to the system performing its intended functions incorrectly, resulting in the plane not receiving the necessary thrust for takeoff, which could have had catastrophic consequences [77609, 77582]. (e) byzantine: There is no indication in the articles that the software failure incident exhibited a byzantine type of behavior, which involves inconsistent responses and interactions. (f) other: The software failure incident also involved a human factor, as one of the pilots may have been suffering from jetlag, which could have contributed to the error in entering the temperature. This human error aspect adds another dimension to the behavior of the software failure incident [77609].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence theoretical_consequence (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The consequence of the software failure incident: - The incident involving the Boeing 737 at Belfast International Airport had the potential for catastrophic consequences, including the risk of death if an engine failure had occurred during takeoff [77609, 77582]. - Fortunately, in this case, there were no injuries or damage to the aircraft, and the flight continued to its destination without further incident due to the lack of obstacles in the flight path [77582]. - The incident did not result in any real observed consequences such as death or physical harm, but the potential for such consequences was discussed [77609, 77582].
Domain transportation The software failure incident reported in the articles is related to the transportation industry. The incident involved a Boeing 737 aircraft carrying passengers from Belfast to Corfu, where the pilots entered the wrong temperature into the onboard computer, leading to a miscalculation of takeoff speed and subsequent issues during the flight [Article 77609, Article 77582]. The failure of the Flight Management Computer to cross-check the information typed by the pilots with its own temperature sensors contributed to the incident [Article 77609]. Additionally, the lack of an alarm system to alert staff of the mistake during takeoff further emphasizes the transportation industry aspect of this software failure incident [Article 77582].

Sources

Back to List