Programmed to Death: Software & The Erebus Disaster
In November 1979, one of the world’s most advanced aircraft flew itself to Antarctica and into the side of the active volcano Mount Erebus, entirely under computer control. All 257 people aboard perished. How did an airline with a flawless safety record come to erroneously rely on technology with such catastrophic results? Today, I’ll look at the Erebus Disaster from a software standpoint and see what lessons it might hold.
The Temptation of Erebus
Antarctica is a cold and dangerous place. The endless icy vistas, devoid of land, remind us how small and fragile we are — and how much we depend on the familiarity of our environment in order to survive. The Erebus tragedy begins with a fatal attraction — man’s desire to discover and perhaps even tame the Antarctic, making it habitable and approachable if only for a moment.
This desire, coursing through the veins of millions of people, would come to play a fatal role in what happened to Air New Zealand Flight 901 that day. It would lead to complicity and acceptance of many situations which were, from the start, untenable.
Mount Erebus is the second highest volcano in Antarctica and one of three on Ross Island. The island was named for Sir James Ross who discovered it during his expedition of 1840. Ross himself named the volcano after one of his expedition ships, the HMS Erebus — a fact which might be of no interest whatsoever except that the ship’s name (bestowed by the British Navy) alludes to Erebus, the personification of darkness and a place of darkness in Greek mythology. In a stark and solemn contrast to the mountain’s brilliant white ice, the long, dark, grease-like stain of Flight 901’s wreckage now appears every year on the side of Mount Erebus during the snow melt.
Air Innovations of the 1970's
The 70’s were an exciting time for aviation, representing the birth of the Jet Age and the attraction of affordable, international travel. The DC-10 from McDonnell Douglas (now part of Boeing) was an early example of computerization in the cockpit. The plane was not as elegant nor as well put together as its competitor in the three-engine jet market, the L-1011, and quickly earned a frightening reputation for incidents and accidents.
Five years earlier, a Turkish Airlines DC-10 had killed all 346 people aboard in what was at the time the deadliest accident in aviation history. The plane had been shown to have a fatal mechanical flaw in the design of its cargo doors, as well as other problems. Air New Zealand and McDonnell Douglas feared, naturally, that if they or their aircraft could be in any way blamed for what happened on Mount Erebus, it would spell the end of the DC-10 program.
McMurdo Sound
Air New Zealand felt the call of Erebus more than a decade before the ill-fated flight. In 1969, Captain Peter Grundy, the airline’s Flight Operations Manager, made a trip to Scott Base in Antarctica to study the feasibility of operating a sightseeing flight from New Zealand down to McMurdo Sound. The sound is the world’s southernmost harbor which can be approached by boats, often with icebreaker hulls. It serves as an important access point for Antarctic expeditions as well as for the US’s McMurdo Station, which operates an ice airfield and air traffic control for military planes in the area.
He determined that the DC-8 aircraft then in use by the airline lacked the long range and fuel capacity required for the 12-hour round trip. There was no option to stop and refuel at McMurdo. Commercial jets were not permitted to make the dangerous ice landing and take-off.
Taking Delivery
Air New Zealand took its first delivery of a DC-10 in January, 1973. At the time of the crash, they were a small airline focused mostly on domestic flights. The company only had 35 aircraft in its entire fleet and only 10 flying internationally. Seven of those were DC-10s.
The airline began scenic flights to Antarctica in February, 1977 but there were very few of them. In the two years leading up to the crash, Air New Zealand had only flown the Antarctic route 13 times.
Navigation from the Ground
In addition to its long range and fuel capacity, the DC-10 afforded Air New Zealand another technological innovation that proved irresistible: computer navigation by an inertial guidance system. This precursor to GPS technology relied on two critical parts: a programmed flight path that would be set from the ground using longitude and latitude measurements, and a gyroscope-based measurement system that allowed the plane to know how far it had moved from its takeoff point and in which direction.
When combined, this information gave the DC-10 a new and impressive autopilot feature. Now, the plane could auto-navigate. Left in its NAVIGATION mode, the aircraft would set its own headings and fly from point-to-point, as specified by its ground programming — without pilot intervention.
Because the system was new and not certified to land itself, Air New Zealand’s pilots had made a practice of disengaging the NAVIGATION mode near the final waypoint and flying the aircraft on traditional instruments through the landing pattern.
On the ground, the Navigation Department would program a final waypoint which was often near a beacon or other fixed-position device. Upon the last leg of the flight, pilots fly over that beacon then disengage and land at the correct airport. This combination of navigating from the ground while controlling the plane from the air proved to be the ultimate cause of the Erebus Disaster.
An Excess of Faith
Prior to the availability of onboard computer navigation, Air New Zealand, like all airlines, plotted its routes with paper and maps provided by the company’s Navigation Department. All pilots attended a flight-specific briefing before flying a new route. These were essentially condensed training sessions held with a pilot who had flown the route before.
Pilots were shown slides and given simulator practice in identifying critical route features, such as landmarks to sight, obstacles to avoid, and altitude rules to be respected. In this era, pilots often took their own paper copies of maps and waypoint lists for later study and use in the cockpit.
Great care was taken to correlate the paper maps, slides, and simulator presentations to ensure that every pilot had a good understanding of the route before risking his own life and that of his passengers. Perhaps this is why the airline hadn’t been responsible for a single fatality from its founding day in 1936 up until the Erebus crash. What had changed in the company’s process to allow Erebus to happen?
Risky Business
For some reason lost to history, the Flight Operations department’s original plans for the Antarctic sightseeing trip involved directly overflying the top of Mount Erebus, a volcano whose rim is filled with a lava lake that emits poisonous gas and steam and has been doing so for about 1.3 million years.
The insanity of overflying a volcano in a passenger craft cannot be overstated, yet here again the lure of Erebus overruled rational thinking. In testimony he gave later in a Royal Inquiry on the incident, the Flight Operations Director said that, if the volcano were to become dangerous (as in, spewing vast amounts of lava), he felt the airline would be given sufficient warning.
It never occurred to anyone that allowing smoke and gas to enter the cabin could be damaging to the aircraft mechanically and to its inhabitants. Certainly no objections were raised about these risks when Air New Zealand applied for and received permission from Civil Aviation to overfly Erebus directly as part of its DC-10 tourist operations.
First Flight
The first two tourist flights operated by Air New Zealand to Antarctica did, in fact, fly right over the volcano — at 16,000 feet or 3 miles above sea level and a little less than a mile above the peak. Unfortunately, there’s not much to see out an airplane window from that far away. Tourists commemorating their historic visits complained that they could not see or photograph anything resembling an Antarctic journey. There were no huts or huskies visible, no research domes or antennae in the white wasteland.
By the time the company had invited the president of McDonnell Douglas on board for a sightseeing flight in his company’s DC-10, the airline was already taking a different — and much lower — route. To get the huge planes down to 2,000 feet with good visibility for the passengers, the pilots disengaged the programmed navigation and flew down McMurdo Sound, alongside the volcano rather than over it. This allowed passengers to see and photograph the looming mountain as well as the Scott and McMurdo bases on the ice surface below.
The Douglas executive was so impressed with his trip that he wrote the airline CEO, Morrie Davis, in effusive praise of the “majestic view of Mount Erebus alongside at 2,000 feet.” Much to its later embarrassment, Air New Zealand would pay to reprint a copy of this letter and mail it as an advertising piece to every household in the country, nearly a million homes.
Garbage In, Garbage Out
Air New Zealand was so taken with the idea of computer navigation that it replaced its entire paper-based process with on-the-ground navigation computers — just 14 months before the crash. The time savings afforded by programming on tape and uploading to the aircraft would also be rewarded with increased safety, so it was felt. After all, if the pilot wasn’t in charge of navigation, there couldn’t be any pilot navigation errors. Every route would be duplicated digitally and fed directly to the planes for perfect accuracy.
Whether or not an “error” was made in setting up the computerized route for Flight 901 is an area of great dispute. What is certain is that, when the ground computers were first programmed 14 months earlier, the final waypoint on the Antarctic trip was a beacon in McMurdo Sound. This reflected the actual practice of flying down the sound, rather than over the mountain. It was also reflected in the identical briefings given to every pilot who had flown the route since. They were all shown a route down McMurdo Sound, not over Mount Erebus.
Since the McMurdo Sound route reflected the reality of flying as well as the pilots’ training, it’s hard to believe it was accidental. The airline had no reason to dangerously overfly the volcano, especially since the required altitude made for terrible views.
Despite the fact that pilots would disengage and look manually for ideal sightseeing spots, the last waypoint still indicated an area the plane would pass over. The stored waypoint was only entered once, when the maps were migrated from the older paper system. That final point was located in McMurdo Sound. Later, by way of explanation, Air New Zealand would offer that the waypoint had been entered “in error.”
The actual route approved by Civil Aviation had been the one they first proposed and flew in the initial two tourist flights. The final waypoint in that scenario was just behind Mount Erebus. No permission had been sought or given for any other route, despite flying it. The airline would maintain through the crash investigation that this was and had always been the correct route and that the initial computer entry was erroneous.
A Special Dispensation
The dangerous and unique terrain of Antarctica imposed another safety rule for the airline’s sightseeing flights. Civil Aviation requirements dictated that no pilot would be allowed to captain a flight to Antarctica without first co-piloting with another captain who had previously flown the route.
Everyone seems to have been aware of the uniqueness of the terrain and the risks of overflying frozen volcanoes in whiteout conditions — everyone that is except Air New Zealand. Even the military, which operated more flights in the area than anyone, held to the same rule of “no first-timers captaining in Antarctica.”
It’s particularly disturbing, then, to learn that the company requested and received a special exemption from the Civil Aviation Board for the requirement that first time Antarctic pilots be accompanied by an experienced captain. The reason given was that the improved training process afford by their new computer automation and guided navigation was sufficient to replace the expertise of a trained captain on board.
The Civil Aviation Board never requested any explanation from Air New Zealand as to how or why this could be just as safe as going with an experienced pilot, especially to a destination so far away and with such few options for recovery in case of a problem. During the Royal Inquiry, the Board would testify that they had complete trust in Air New Zealand due to their stellar safety record and had no reason to question the request for an exemption. When staff at McMurdo Station learned that neither of the pilots involved in the crash had been down McMurdo Sound before, they were speechless.
Is the lure of Erebus present here, too, along with the lure of technology? As the country’s largest business, one that was state-owned and had direct financial ties to ministers of Parliament and other prominent people (ties which would only be disclosed in the accident’s fallout), was there a sense of hubris that prevented Air New Zealand (or anyone in New Zealand) from realizing the very human limitations of their new technology?
Going sightseeing for a day in Antarctica was sexy and appealing. It was global and high tech and helped put tiny New Zealand on the map. It was a showcase for just how big the little island airline could be — a matter of national pride. Nothing could go wrong, and nothing could have gone wrong at Air New Zealand in the minds of anyone involved.
Changing the Coordinates
The most direct cause of the accident was leaked to the press by whistleblower pilots within the airline. Several of them had stated, off-the-record, that the airline made a change to the stored ground computer coordinates for the final McMurdo waypoint. Instead of pointing to a beacon in McMurdo Sound, the changed coordinates pointed directly at Mount Erebus. Without exaggeration, the plane had been programmed to fly into the mountain.
When confronted with this information by journalists, the airline employee who made the change told his superiors that he thought it to be “insignificant.” He had only noticed a small numeric difference in one coordinate — a tiny fraction of a decimal — and meant to correct what he thought was a mistake in the original entry — a typo made while transcribing the approved, paper flight plan.
He did not think it worthwhile to inform the crew of Flight 901 of this change. Just hours later, they would enter the airplane fully believing it was programmed with the McMurdo Sound coordinates as they had been shown in their briefings. By failing to plot the new course on a paper map, the navigator-as-computer-operator hadn’t realized that the new “correct” coordinates were 27 miles to the east and on a direct collision course with Mount Erebus.
The airline had only sought and received authorization for this “correct” route (at 16,000 feet above sea level or more than 4,000 feet over the mountain) and they were not willing to admit they had been repeatedly flying at 2,000 feet over the ocean instead. The company’s CEO defended the coordinate change only by saying that the intended route had always been the correct route and the ground computer was programmed correctly on the night before the flight.
Can’t Get There from Here
When pressed at the Royal Inquiry as to whether or not Air New Zealand had flown (and, indeed, promoted) unapproved and potentially dangerous low-altitude flights over McMurdo Sound, the company sang as one chorus. Not a single executive could recall ever hearing about low sightseeing flights in Antarctica. Even when shown their own company’s advertisements and internal documents, they maintained the position that any such low flying was always prohibited and that Flight 901 was “in the wrong location” and “flying far too low.”
It has always been the default position of airlines and aircraft manufacturers to hold that “the pilot was at fault.” Of course, there is some truth to the maxim that he or she alone must ultimately be responsible for everyone on board. Urged on by their insurers, Air New Zealand pursued this explanation. If it could be found that the pilots were at fault, the airline’s payouts to the victims’ families would be limited by the Warsaw Convention to $44,000 per death — as opposed to the unlimited liability if the airline were found negligent or in gross misconduct in their operations.
In lock-step fashion, each testimony from the company’s executives and pilots presented the same arguments: The plane was flying too low and the pilot was unaware of his location and didn’t spot the mountain, thus circling into it.
Whiteout, and Not from Snow
During the Royal Commission of Inquiry, both the public and Air New Zealand’s executives would come to learn the meaning of a term unfamiliar to them — sector whiteout. While everyone who skis or drives in Florida hurricanes knows about whiteout, in Antarctica it refers to something different. Specifically, sector whiteout is a visual phenomenon which makes the sky in front of the plane look like white ice below it in the distance. Under these conditions, Mount Erebus rising in front of you would look like an ice-covered sea far ahead. Military pilots in the Antarctic were well aware of this phenomenon around McMurdo Sound. It was one of the reasons for their requirement that only pilots with specific experience in that area be allowed to fly.
During the inquiry, it was learned that Air New Zealand had leaned heavily on their training exemption to get around this requirement. In fact, not a single pilot on any of Air New Zealand’s commercial flights had ever been there before — including both the pilots of Flight 901. Perhaps even more remarkable, the airline had been found conducting pilot briefings led by pilots who had not, themselves, been to Antarctica. With the reality of sector whiteout and the natural similarities of all the frozen rocks and glaciers, this was truly a case of the blind leading the blind.
While it is certainly true that the pilots did not know where their airplane was (since its route had been changed), it is also true that they failed to see the mountain rising up in front of them. Remarkable photos found in cameras at the wreckage site showed tourist shots taken out the window just seconds before the crash. During the flight, the cockpit door was often open and passengers were allowed to look through the front windows. No one onboard was the least bit aware that the plane was heading for the side of a volcano. And thanks to Antarctic whiteout, there was no visual evidence to tell them otherwise.
Radar Can’t Save You, Either
When the impossibility of judging a rising white mountain in Antarctic whiteout was raised, the company claimed that the 12,000 ft. peak should have been visible on the aircraft’s forward-facing radar. Surely a giant mountain of rock and ice would show up if you were about to hit it. But the intact flight recorders and cockpit voice recorder revealed that the pilots received no warning other than a “pull up, pull up” voice warning from the ground proximity sensor in the last few seconds — far too late to do anything about it.
Judge Peter Mahon, in charge of the Commission, decided to investigate many aspects of the case for himself, including the radar. He visited the Bendix company’s factory in Florida, makers of the device. They informed him that DC-10s were equipped with weather radar, designed only to reflect moisture. Since arctic ice is notably dry (famously drier than the Sahara), little moisture on the mountain would mean little or no radar reflection, and thus no indication of the danger that lay ahead.
Conclusions & Conspirators
The Commission decided that the immediate cause of the accident was the change in coordinates in the ground computer, made the night before without alerting the pilots. While making no official statement on the airline’s poor training or over-reliance on technology, Mahon did make a scathing comment on their disingenuous efforts to avoid responsibility for the crash, calling what he had witnessed, “an orchestrated litany of lies.” This phrase would go on to enter the New Zealand vernacular. It also raised so much ire with the political establishment that an appeal was brought and won in court in which Mahon’s “brilliant” conclusions were both validated and, at the same time, completely dismissed.
The state-owned airline would see the matter end without criminal prosecution for any executive or employee. In fact, most of the people involved in creating and covering up the disaster were able to keep their jobs, including CEO Morrie Davis. When it was later found that the appeals court had been loaded with shills who were connected financially to Air New Zealand, he resigned — claiming he wanted to help the company “move on.” Today, you’ll find his name nearly scrubbed from the internet, which makes researching the intrigue of Flight 901 all the more difficult.
How Software Came to Kill
As with other famous cases where computers kill people with intent and purpose (as opposed to error or failure), our over-reliance on tech comes down to a misplaced sense of trust in something we don’t understand. Arthur C. Clarke said that any sufficiently advanced technology is indistinguishable from magic. Air New Zealand certainly believed so. The novelty of computers at the time and the pride the company felt at conquering Antarctica left them on a kind of drug-induced high with a commensurate and devastating crash at the end.
The company would never again offer Antarctic sightseeing flights. Nor would it comment on the culture that led to cover-ups and bad decision making — like the decision to fly over an active volcano in the first place, or to do so with untrained pilots. There would be no explanation of how the company had come to trust its brand new computers so thoroughly that they abandoned human oversight — with tragic results.
The software disasters of the past are not, unfortunately, the last of their kind. Even today, Tesla software kills people due to bad decision making on the part of its designers and marketers, including the questionable intent to even achieve self-driving (or Antarctic overflights) in the first place.
Icarus, another Greek myth that fits this story, was given a magical gift — the gift of wings. Air New Zealand had magical technology in their DC-10s with ground-based computer navigation. Today, we have modern electric cars that drive — and crash — themselves. Not long ago, we saw how Theranos took down many smart people by convincing them of technological powers that did not exist inside a black box that no one bothered to understand.
Whatever our technological flights of fancy, we should be careful not to fly too close to the sun, lest we risk disasters on the same scale as our ambitions.
— — — — — -
As always, thank you for reading.
— D
Sources (Both excellent and recommended!)
Verdict on Erebus, by Peter Mahon, Commissioner of the Royal Inquiry.
Erebus: The Aftermath. New Zealand TV Documentary.
