The finger of fate

One mistyped digit almost led to what could have been the worst crash in the history of Australian aviation. Adrian Park analyses an incident that exposes some uncomfortable truths about automation, redundancy and the role of human pilots.

It was a busy Friday night at Tullamarine Airport as the crew of Emirates Flight EK407 prepped the aircraft for the 14-hour flight to Dubai. Cockpit activity was high as the crew ran checklists, confirmed clearances and computed performance calculations. With the help of an onboard laptop, known as an electronic flight bag (EFB), the first officer calculated the required take-off speed for the aircraft’s weight of 362.9 tonnes and made a dangerous mistake: instead of entering the intended 362.9 tonnes the first officer inadvertently made a typo and entered 262.9 tonnes. The design of a keyboard with the ‘2’ and the ‘3’ adjacent to each other, the preoccupation with a departure clearance, cockpit busyness and a slightly misaligned keystroke produced a lift-off speed 100 tonnes out. An unchecked case of ‘garbage-in, garbage-out’ came into play and, as pushback commenced, hidden amongst the many other inputted figures of flap configuration, altimeter setting, anti-ice selection, centre of gravity, wind speed, wind direction, outside air temperature, runway surface condition and air conditioning status, a single out-of-place digit endangered hundreds of lives.

In all likelihood by the end of today, if you haven’t done so already, you will make some sort of data entry error. It could be as you attempt to long in…er log in to your computer and inadvertently hit an adjacent key. It could be as you type vital text or numbers an (sic) auto-correct misses the fact you meant to type ‘and’. It could be when you are relating your too mistakes er… two mistakes for the day via a text message. It doesn’t matter whether you’ve been typing for decades; it is inevitable, sooner or later and probably sooner, an adjacent key will be tapped, a letter left out or numbers entered back to front.

Thankfully, the consequences to these kinds of mistakes are generally innocuous. All is well after a second read or a ‘please retype your password’ message gets our attention. All is well in cases like this because something looks unreasonable and we fix it. We look at the figures, we check them against some norm or standard and we note the deviation with a view to correcting it. This is what’s often called a ‘reasonableness’ test. For typos, no harm no foul, retype with the correct words or numbers and move on. But what happens when there’s an undetected, uncorrected typo in the take-off calculations for a passenger airline carrying hundreds of passengers weighing in at several hundred tonnes?

This was the case in the darkness of evening on 20 March 2009 for Emirates Flight EK407, an Airbus A340-541, on take-off from Melbourne. As EK407 received its clearances, lined up and accelerated down runway 16, the crew of four experienced pilots—two operating pilots and two ‘augmenting’ pilots—had missed three key opportunities to detect and correct the 100-tonne typo. The first opportunity was before pushback when the first officer handed the laptop to the captain to check the take-off performance parameters. At this point, the captain was supposed to verbally check the calculated weight from the aircraft’s flight management and guidance system with the inputted weight on the EFB laptop. Perhaps, due to the general busyness in the cockpit or perhaps due to the preoccupation with the details of a departure clearance, that verbal check was never made.

The second opportunity to detect the error was during the load sheet confirmation procedure when the first officer read aloud the take-off weight first from the flight management and guidance system, and then from the EFB laptop calculations written on the flight plan. With a slip of the tongue he incorrectly read out a figure of 326.9 tonnes from the flight plan before correcting to 362.9 tonnes. He corrected the relatively innocuous slip of the tongue, but still didn’t notice the EFB laptop calculations were out by 100 tonnes.

The third opportunity also came and went without correction to the maverick digit. In this case, the reasonableness test involved cross-checking a characteristic airspeed of the aircraft known as the ‘green dot’ speed. The check compared the EFB laptop-calculated green dot speed with the green dot speed from the flight management and guidance system. The first officer called out the green dot speed of 265 knots—some 40 knots different to the EFB laptop figure of 225 knots—and the captain confirmed the figure without question. Investigators would later surmise this was because the last digit of each respective speed ended with a five and the normal check required the two green dot speeds to be within two knots of each other—the captain had apparently mentally cued from the last digits of each number only. In any case EK407 was now rolling down runway 16 accelerating towards a dangerously low lift-off speed.

Partly because of the darkness of the evening and partly because of the lack of a clear cockpit warning for a low acceleration rate, none of the four pilots noted the aircraft’s acceleration was dangerously sluggish and that the 3.5 kilometres of runway was being consumed. At a much later point along the runway than normal, and at the spuriously calculated lift-off speed, the captain called ‘Rotate’. The first officer duly complied initiating a nose-up command to the sidestick by applying back pressure. Nothing happened. With the aircraft 100 tonnes heavier than calculated there simply wasn’t enough lift. A struggle began between aerodynamics and gravity.

The captain repeated his call: ‘Rotate!’ The first officer again, more urgently this time, applied back-stick. The nose lifted but gravity continued to prevail against aerodynamics and the aircraft remained firmly stuck to the ground—now with only 300 metres of runway remaining. The captain, recognising the danger, quickly selected ‘take-off/go-around’ on the thrust levers, but it was a further three seconds before the aircraft could generate take-off lift. In the meantime, the A340 was out of runway.

In earlier generations, pilots would sometimes be heard talking colloquially about ‘unsprightly’ take-offs as ‘dragging one’s sorry backside into the air’. That was exactly what the Airbus A340 was doing. At 265 metres from the end of the runway, with a high nose attitude and marginal aerodynamic lift, the rear end of the aircraft struck the bitumen of the runway. The ground contact, which continued along the remaining length of the runway, gouged the aluminium skin down to the supporting ribs as well as dislodging a large service panel. Still there was not enough lift to overcome gravity’s persistent pull. The A340 overran the end of the runway into the grass and dirt, its tail carving a near continuous rut before slowly inching its way into the air—so slowly in fact that it struck a ground-based strobe light (about 30 cm high), the localiser near-field monitor antenna (about 60 cm high) and finally the main localiser array (about 3 m high).

By now, the maximum thrust setting the captain had selected was finally doing its job and the aircraft was able to climb away despite the damage to the tail. About five minutes after having been alerted to the tail strike by an automated message, the first officer pulled out the EFB laptop to calculate the landing performance parameters for an emergency landing. It was then he noticed the EFB laptop had a weight figure one hundred tonnes out. There was little time for self-reproach: the first officer had also noticed the cabin was not pressurising and that the cabin crew were reporting smoke in the rear cabin. The captain consulted with the augmenting crew and decided to dump fuel over Port Philip Bay and return for a landing as soon as possible, which they were able to do without further incident. The ‘smoke’ was later determined to be ingested dust from the tail strike that had deformed a pressurisation seal.

In some ways you’d be forgiven for thinking, at least in the grand scheme of things, simple typos wouldn’t occur on the flight deck of EK407. The aircraft was staffed not just by two pilots, but four experienced and relatively well-rested pilots. The flight was not experiencing delays and there were no other known external factors affecting the crew. The ‘reasonableness’ levels in the reasonable tests on the flight deck of EK407 should have been high and the opportunity for error low. The fact that it did occur without the usual suspects of fatigue, external pressures and inexperience prompted the ATSB to conduct further research. The goal was to identify why skilled and highly trained crews were unable to detect fundamentally wrong calculations. The results, derived from a French research report as well as its own research, were sobering. In a 20-year period, 31 other significant incidents similar to EK407 were identified, and, in a survey carried out with a major airline, 50 per cent of respondents stated they’d experienced take-off performance errors.

The ATSB noted: ‘(Such errors) have multiple origins and involved a range of devices and systems. For example, crew actions could result in the wrong figure being used in a system, in data being entered incorrectly, data not being updated and data being excluded in a range of systems including performance documentation, laptop computers, FMS and aircraft communications addressing and reporting systems’.

Furthermore: ‘The occurrences reviewed indicated the systemic nature of the problem, and the fact that it manifests irrespective of location, aircraft type, operator and flight crew.’

Perhaps an ideal solution to the aviation typo would be an artificial intelligence check, but such designs are still in the future. In the meantime, the following is worth remembering: firstly, unreasonable data may sneak past because of the lack of an ‘order of magnitude’ paradigm. This is where there is no consistent average figure to which the brain can become accustomed. For example, if I write that I weigh 1000 kg we know almost immediately a mistake has been made because our brains are conditioned to the ‘normal’ weight of a person being far less than 1000 kg. The same normative mental cueing would apply to an aircraft weight if the take-off weight was relatively static, but unfortunately, as was the case for EK407, take-off weights vary widely depending on fuel and passenger loads. This means that for any wide-ranging, performance-critical figures we need to have sound cross-checks and to be especially aware of data entry mistakes—especially if such figures are obscured by the data denseness of other parameters.

Secondly, though surprisingly they did not play a major role for EK407, the ATSB’s research showed the usual suspects remain the major players for most other data issues—fatigue, stress, inexperience, distraction and miscommunication. These not only produce errors, they also undermine reasonableness checks. Who amongst us hasn’t looked at figures at 3 am or during high stress (for whatever reason) and had trouble making them compute? Knowing this means we should avoid these states wherever possible, or at least during these undesirable states, double check and even triple check flight-critical data.

What would have happened if EK407 had crashed off the end of Tullamarine at take-off speed? There had been one other A340 runway overrun—Air France flight 358 at Toronto in 2005. Everyone survived, but it was travelling about 70 knots when it overran a wet runway, nearly 100 knots slower than flight 407 at the end of its runway.

The loss of 275 lives on flight EK407 would have made it the first large-scale aviation disaster in Australia. And it all would have been because of uncorrected ‘finger trouble’. EK407 ought to make us reconsider the reasonableness of our own reasonable checks—particularly when we are fatigued, inexperienced, stressed or distracted. Given the appalling consequences of an aviation typo, it’s the only reasonable thing to do.