The Reliability Trap: The crash of Emirates flight 521
On the 3rd of August 2016, an Emirates Boeing 777 landing in Dubai attempted a last second go-around after touching down too far along the runway. The pilots pulled up to climb and activated go-around mode, but the plane quickly lost speed and crashed back onto the runway. The fully loaded 777 slid across Dubai International Airport on its belly for almost a kilometer before it ground to a halt and burst into flames. Despite a chaotic evacuation that took much longer than it was supposed to, all 300 passengers and crew managed to escape with their lives. Tragically, the miracle of their survival was dampened just minutes later, when an explosion ripped through the plane, killing a firefighter.
So what caused the worst accident in Emirates’ 35-year history? In 2020, authorities in the United Arab Emirates released a report that outlined a complex sequence of events that led to the near disaster. There were miscommunications between the pilots and air traffic control; the weather was abnormal; the landing was unusually long. But at the center of the story was one of the most common dangers in aviation today: the overreliance of pilots on sophisticated automation that they don’t fully understand.
Emirates flight 521 was a regularly scheduled flight from Thiruvananthapuram, India, to Dubai in the United Arab Emirates. Thiruvananthapuram, located at the southern tip of India, is one of many cities in the region served by the UAE’s flag carrier Emirates, and flights from here to Dubai are usually filled with Indian workers and their families heading to the Gulf states for work. Flight 521 was certainly no exception. At Thiruvananthapuram’s Trivandrum International Airport, 282 passengers boarded the wide body Boeing 777, almost all of them Indian nationals. Joining them on the flight were two pilots and 16 flight attendants, adding up to exactly 300 people on board. The captain, who has not been named, hailed from the United Arab Emirates; the first officer, Jeremy Webb, was from Australia. Both were utterly average pilots — their records were largely indistinguishable from those of thousands of other pilots around the world. On an airline like Emirates, this should have been sufficient comfort; in fact, Emirates had not suffered a single aircraft loss or fatal accident since its founding in 1985, and it has consistently ranked in the top 10 safest airlines worldwide.
At 10:06 a.m. Indian time, Emirates flight 521 lifted off from Trivandrum International Airport and climbed out over the Arabian Sea, headed northwest toward the UAE. All was normal throughout the three and a half hour flight, until flight 521 began its approach into Dubai shortly before 12:30 p.m. local time. Weather at Dubai that day was rather unusual. A high pressure system had brought scorching temperatures as high as 49˚C (120˚F), while two low pressure systems off the coast drew a hot wind outward from the high pressure zone toward the sea. This wind collided head on with the normal sea breeze that moves inland from the Persian Gulf every morning, stalling its movement directly over Dubai International Airport. Flight 521’s assigned runway 12 Left had an approximately 13-knot tailwind; however, runway 30 Right, the same runway from the opposite direction, also had a tailwind of similar magnitude, a bizarre situation by all accounts. This caused wind shear — a sudden change in wind speed and/or direction — to develop in the middle of the runway. In the minutes before flight 521 lined up to land, two flights were forced to abort their landings after encountering wind shear; however, they didn’t tell the controller their reasons for doing so, and the controller didn’t ask. Nor was any information about these missed approaches conveyed to the pilots of Emirates flight 521, who were only expecting light to moderate wind shear based on the available weather reports.
Despite the tailwind, the pilots of flight 521 encountered no problems during final approach, and at 12:37, the plane arrived over the runway threshold at a normal speed and altitude. But from that moment, a rapid-fire sequence of events began to send the plane off course. The pilots raised the nose to “flare” the plane slightly too early, extending their glide. The extreme heat of the runway surface, which had risen to a blistering 68˚C (154˚F), caused thermals to rise upward off the ground, further reducing the plane’s descent rate. Finally, at an altitude of about 10 feet, the plane flew straight into the wind shear. The tailwind suddenly transitioned to a headwind, and within the space of a few seconds, the plane’s airspeed increased by 12 knots (22km/h). This in turn increased the lift generated by the wings, extending the glide even more. The plane barely descended at all, skimming along just a few feet above the runway as the captain struggled to get it to touch down. “Thermals!” he exclaimed, mistakenly attributing the plane’s increased performance to hot air rising off the runway. The first officer replied, “Check,” indicating that he agreed about the presence of thermals.
Moments later, a gust of wind blew the plane to the left, and the captain overcorrected to the right, causing the right main landing gear to momentarily touch the ground. By now, the captain feared that they would not be able to touch down within the prescribed touchdown zone, in which case Emirates procedures required him to perform a go-around and attempt the approach again. Just as both main landing gear bogies began to make contact with the runway, the captain called out, “Go around!” and immediately began the go-around sequence. At exactly the same moment, a computerized voice called out, “LONG LANDING,” warning that they had taken too long to touch down.
To make a go-around as simple as possible, the Boeing 777 (like all modern jets) has two “takeoff/go-around,” or TOGA, switches on the throttle levers that a pilot can press in order initiate a go-around. Pressing the TOGA switches will command the autothrottle to apply full power and will put the flight computer in go-around mode. However, the TOGA switches are inhibited on landing after touchdown, because if a pilot were to accidentally press it during rollout, it could cause the plane to run off the runway. The autothrottle system remains active, but if sensors detect that there is weight on the wheels, the TOGA switches simply won’t do anything.
To perform a go-around after touchdown, thrust must be increased manually. But when the captain of flight 521 pushed the TOGA switches, he was unaware that the plane had touched down and that the button was inhibited. As he pulled the nose up to climb, the autothrottle failed to increase engine power. Normally, the takeoff configuration alarm would warn the pilots that they were not properly configured for a go-around — but in this case, its trigger conditions were not met. The configuration warning relied on the advancement of the throttles to detect that a go-around was happening in the first place, so it was impossible for it to sound due to insufficient thrust.
As the captain pulled the nose up, the plane at first appeared to climb normally. The first officer called out “Positive climb,” and the captain retracted the landing gear. But neither pilot noticed that the flight computer hadn’t changed modes and that their speed was dropping rapidly.
Seeing that flight 521 appeared to be making a missed approach, the controller told them to climb out straight ahead to 4,000 feet, and the first officer acknowledged. But within seconds, the plane’s rate of ascent slowed and its speed dropped. Without sufficient thrust to sustain a climb, flight 521 reached an altitude of 85 feet, then began to fall back toward the runway. The ground proximity warning blared, “DON’T SINK!” The captain realized that they must have encountered wind shear and manually applied max power, in accordance with the wind shear escape maneuver, calling out “Wind shear, TOGA!” as he did so. Only now did he realize that the autothrottle hadn’t applied go-around power. Unfortunately, this realization came far too late.
Before its engines could finish spooling up, the Boeing 777 slammed back down onto the runway with its landing gear stowed. The hard impact sent unsecured objects flying in every direction as the 300 passengers and crew held on for dear life. The huge plane slid down the runway on its belly and engines for 800 meters, throwing up a trail of sparks; the right engine sheared off and became lodged in front of the wing as it plowed over the runway edge lights. Finally, the 777 spun around nearly 180 degrees and came to rest partially on a taxiway off the side of runway 12 Left, surrounded by a cloud of dust and smoke.
On board flight 521, no one had been seriously hurt during the crash, but getting 300 people off the plane alive would not be simple. Fires quickly erupted on both engines and in the right main landing gear bay, sending white smoke pouring into the center of the cabin almost immediately. Up front, the captain got on the radio and said, “Mayday, mayday, mayday, Emirates 521, evacuating!” The controller, who had witnessed the accident, sounded the crash alarm and alerted the airport’s fire station, which scrambled to respond.
Meanwhile, the pilots struggled to find their evacuation checklist amid the sea of random objects that had been strewn about the cockpit, requiring almost a full minute to locate it. But despite seeing fire and smoke outside the plane, the flight attendants didn’t initiate an evacuation on their own, causing jams in the aisles as passengers used the wait to try to retrieve their luggage from the overhead bins. When the order to evacuate finally came, flight attendants began to open the exit doors to deploy the slides. But now they faced a new problem: of the 777’s ten emergency exits, most immediately became unusable. The L1 slide was ripped out of its mountings by the wind and fell to the ground; wind blew the R1 slide sideways; the L2 and L4 slides blew upward against the fuselage; the L3 and R2 exits were blocked by smoke; and the R3 slide didn’t deploy at all. Somehow, the 16 flight attendants needed to get 282 passengers out through only three exits, all of them at the back, before fire consumed the plane.
The first fire trucks arrived at the scene around the time that the first people started to exit the plane, and they parked directly in front of the exit routes, creating a serious hazard for the fleeing passengers. The on-scene commander didn’t wear anything that would identify him as such, and he immediately started helping passengers off the plane without conveying a firefighting strategy to his subordinates. Each fire truck sprayed down whatever fire it could find without any coordination. As firefighters grappled with the visible flames around the engines, no one made any serious attempt to tackle the growing blaze in the landing gear bay, which was mostly hidden underneath the plane. Nor did anyone designate a safe area for the survivors to gather away from the aircraft.
Seeing that many of the escape slides were being blown about by the wind, firefighters rushed in to stabilize them, allowing some people to escape via the R1 slide, although it later deflated. The L5 slide then blew up against the fuselage as well, rendering all the exits on the left side useless. The R5 slide soon blew sideways too, but a firefighter managed to stabilize it and the evacuation resumed. A flight attendant also noticed that the smoke had cleared from around the R2 exit and that door was also made available for the evacuation. Inside the cabin, chaos reigned; panicking passengers pushed and shoved against each other, while many attempted to jump down the slides with bulky baggage in hand. There were also 67 young children on board, and it was difficult to keep track of all of them. One family lost sight of their 7-year-old daughter and attempted to push backward against the flow of people to find her, creating a massive obstruction. The flight attendants had to make the hard decision to order the family to evacuate without their daughter, assuring them that she would be found.
After some seven minutes, far longer than the evacuation was supposed to have taken, the last passenger finally jumped down the slide and off the plane. All the rear flight attendants followed down the R5 slide some 25 seconds later, but the lead flight attendant and the pilots remained on board, searching for the 7-year-old girl who had been separated from her family. They donned protective breathing equipment and tried to re-enter the smoke-filled cabin but were quickly beaten back by the intense heat. Unknown to them, the little girl had escaped via a different exit and had been reunited with her parents on the runway.
Seconds later, the uncontrolled fire in the landing gear bay spread into the center fuel tank, causing a massive, earth-shaking explosion. A huge ball of fire ripped through the cabin, and a 15-meter long section of the right wing’s upper skin was launched high into the air. Wreathed in flames, the enormous sheet of metal tumbled back down out of the sky as firefighters and passengers alike ran for their lives. Not everyone made it: as it came down, the wing section struck a firefighter, killing him instantly.
The lead flight attendant and pilots were still on board at the time of the explosion and were thrown to the ground by the force of the blast. Peeling themselves off the floor, they abandoned any hope of searching the cabin for stragglers and jumped down from the L1 exit door, using the detached slide to break their fall. Like a true commander, the captain was the last person to leave the plane.
As the survivors gathered in a hangar near the runway, the crew conducted a head count and were amazed to discover that every one of the 300 people on board had escaped the burning plane. Four flight attendants were seriously injured and 21 passengers suffered more minor injuries, but most people were completely unscathed. Unfortunately, the fire crews were not so lucky. In addition to the firefighter who died in the explosion, eight other first responders were seriously injured, including five who were hospitalized due to heat stress caused by the extreme temperatures on the runway.
The crash landing in Dubai immediately captured the attention of aviation safety experts and investigators around the world. This was the first fatal crash and first aircraft loss in Emirates’ history, and if such an accident could happen to Emirates, it could happen to anyone. Within hours, the UAE’s General Civil Aviation Authority (GCAA) launched an investigation into the crash with help from Boeing and the US National Transportation Safety Board.
Interviews with the crew and an analysis of flight data revealed the basic sequence of events that led to the crash. As flight 521 came in to land, a combination of an early flare, thermals rising from the runway, and a tailwind-to-headwind wind shear prevented the crew from landing inside the prescribed touchdown zone, forcing a go-around. But when the captain pressed the TOGA switches, they were inhibited because the wheels were touching the ground. Subsequently, nobody noticed that thrust was not increasing until it was too late. How could such a thing happen? As the GCAA would soon discover, there were many external factors that came together to make this sequence of events possible.
The first element was the weather. If the pilots had been aware that the wind shear was the cause of their inability to touch down, they probably would have used the wind shear escape maneuver instead of the regular go-around procedure. Unlike a regular go-around, a wind shear escape maneuver requires the pilots to apply maximum thrust manually instead of using the TOGA switches; had they done this, the crash would not have occurred. But although the 777 is equipped with an advanced wind shear detection system, it didn’t sound an alarm at any point during the approach or landing. One reason for this was that the wind shear detection system was designed to warn of transitions from a headwind to a tailwind, which causes a decrease in aircraft performance, rather than a tailwind-to-headwind transition, which increases performance and is therefore less dangerous. The capability to detect this type of wind shear was an optional extra that had not been installed. However, the system relies on moisture in the air to detect wind speed and direction, and at the time of the crash the air was too dry for it to have been effective anyway. Nor did the controller inform flight 521 of the two other flights that went around due to wind shear in the minutes before landing, leaving the pilots with no specific knowledge of the wind shear’s nature, intensity, or location.
The second link in the chain was the inhibition of the TOGA switches while the plane was on the ground. The reason for this inhibition was logically sound, but investigators learned that the pilots had little knowledge of this feature and its consequences. The flight operations manual, which all pilots are required to read, did mention that the TOGA switches were inhibited once the landing gear touched the runway. However, no information about this was included in the Boeing 777 training program devised by Boeing and the FAA. Neither pilot had ever performed a go-around after touchdown with the autothrottle active, neither in training nor in the course of normal operations. And the manual stated that go-arounds after touchdown should be made using the normal go-around procedure, without noting that thrust would have to be added manually. Furthermore, pilots were taught to always use the autothrottle if it was available, including during normal go arounds. Training emphasized that manual intervention was required for thrust changes when the autothrottle is not active, but made no mention of any situations where manual intervention might be needed when the autothrottle is active. All of these factors primed the pilots to expect that as long as the autothrottle was working, it would always respond when they pressed the TOGA switches. And even if they did remember that obscure line in the manual, the pilots were not even aware that the aircraft had touched down. Despite clues such as a change in ambient noise, these signs escaped their notice during the critical seconds between the moment of touchdown and the captain’s call for a go-around.
The third link in the chain was the pilots’ failure to notice that engine thrust had not increased. According to standard operating procedures, it was the job of the pilot monitoring — in this case, the first officer — to observe that thrust is increasing during a go-around. But a study of 777 go-arounds during training showed that many pilots don’t perform this step, instead skipping straight from retracting the flaps to raising the landing gear. The step was subconsciously viewed as unnecessary because the autothrottle was so reliable — no one had ever pressed the TOGA button without getting a response, so why take the time to check? The first officer was also not required to call out the status of the engines during the go-around, so the captain — who was busy flying the plane — would not necessarily know whether this check had been performed. Because he was unaware that his first officer had neglected to confirm that thrust was increasing, the captain had no obvious reason to suspect that it wasn’t, especially once the first officer called out “positive climb.” Only when the lack of thrust began to affect the aircraft’s performance did either pilot realize there was a problem, by which time it was already too late to avert impact with the runway. The latest possible point at which the crash could have been avoided was around the time the captain retracted the landing gear, four seconds after beginning the go-around and seven seconds before he actually applied full power.
Investigators also had much to say about the events that occurred after the crash. The firefighting response was a disaster of its own — one that led directly to the accident’s sole fatality. In 2015, a training exercise at Dubai International Airport assessed how the airport firefighters responded to a simulated runway overrun involving an Airbus A380. The exercise revealed numerous problems. There was no effective on-scene chain of command, the fire commander did not put together a coherent firefighting strategy, insufficient attention was paid to moving passengers to a safe location, and no attempt was made to separate injured and uninjured passengers. After the simulation, airport authorities made several recommendations to try to improve firefighter training. But after the Emirates flight 521 crash, it was clear that nothing had fundamentally changed. All the same failures reappeared, and it was the lack of a firefighting strategy that allowed the landing gear fire to spread to the fuel tanks. Furthermore, no one undertook a dynamic risk analysis; had the commander done so, he might have realized that the fuel tanks could explode and could have moved firefighters and passengers away from the danger zone. Instead, firefighters were working right next to the wing when it blew up, resulting in the fatality. Passengers had also not been effectively cleared from the area, putting them in danger as well.
In contrast, investigators praised the flight attendants for handling a very chaotic situation with exceptional grace and professionalism. Faced with 282 panicked passengers, including numerous children and people with luggage; only three usable emergency exits; and smoke inside the cabin, they managed to coordinate effectively and got everyone off the plane before the explosion. The lead flight attendant and the pilots even risked their own lives to ensure that everyone had escaped. However, investigators did note that the inflatable escape slides didn’t live up to their design specifications, which required them to be usable up to wind speeds much higher than those on the day of the accident. Under slightly different circumstances, the failure of the slides to stand up to the wind could have caused people to be trapped on board a burning plane, with potentially fatal consequences.
Once all the facts had been ascertained, investigators were struck by the similarity between Emirates flight 521 and an earlier accident also involving a Boeing 777 — the 2013 crash of Asiana Airlines flight 214 in San Francisco, in which the plane struck a seawall on landing and broke apart, killing 3 passengers and injuring hundreds more. In that accident, the plane came in too low on landing, prompting the captain to attempt a go-around. However, he didn’t advance the throttles to max power, assuming that the autothrottle would automatically increase thrust. He was unaware that his actions earlier in the approach had caused the autothrottle to enter a mode in which it did not have the capability to do this. As a result, the plane was unable to climb out in time, and it struck the seawall at the runway threshold. In both cases, the pilots assumed that the autothrottle would increase thrust during a go-around, but were unaware that they had run up against an edge case where it would not.
The common denominator between the two crashes was an overreliance on automation. As automated systems become more and more reliable, it becomes increasingly easy for pilots to take this reliability for granted. Monitoring automation is a very dull task, especially when that automation almost never fails, so pilots sometimes won’t do it. Some pilots might be able to get through a whole career without this mindset ever coming back to bite them, but in the Asiana and Emirates crashes, it proved to be catastrophic. This problem could be solved if the pilots had a complete understanding of the possible edge cases, exceptions, and failure modes that affect the automation. But a modern airliner has so many complex automated systems that expecting a pilot to fully understand all of them is unreasonable. This paradox makes the problem of overreliance on automation extremely difficult to solve. All too often, potentially important exceptions in the autothrottle or autopilot logic are only taught to pilots after they result in an accident or serious incident. The only real way to overcome the problem is to instill every pilot with an innate awareness of the energy state of his or her aircraft, something that is much easier said than done. How does one even measure whether a pilot has this ability? The aviation industry is still grappling with these questions.
As a result of the findings of the investigation, the GCAA issued several safety alerts relating to weather reporting and firefighting operations at UAE airports. Emirates also took numerous unilateral actions, including training pilots on go-arounds after touchdown with the TOGA switches inhibited; encouraging the use of tactile feedback to monitor movement of the thrust levers; training pilots to recognize tailwind-to-headwind wind shear; introducing new methods to track whether pilots are monitoring instruments during training; and training flight attendants on scenarios in which the escape slides are affected by wind, among many other changes. Dubai International Airport also overhauled its training of firefighters.
In its final report, released in February 2020, the GCAA issued no less than 40 additional recommendations intended to prevent a similar accident from ever happening again. Many of these reinforced the actions already taken by Emirates, with the additional suggestion that they display the evacuation checklist on a secure surface somewhere in the cockpit so it’s easy to find after a crash. Other recommendations were addressed to the airport, including that controllers be trained to always pass on reports from flights that performed go-arounds when wind shear is present; and that the airport implement new training techniques to help airport firefighters develop a containment strategy, identify hot spots, and manage passenger evacuations. The GCAA also issued recommendations intended to make the Boeing 777 a safer aircraft, including that the configuration alarm go off when the throttles are not advanced during a go-around; that the manual provide more prominent and consistent information about the inhibition of the TOGA switches; that 777 pilots be required to verbally verify that thrust is increasing during a go-around; that the FAA consider enhancing the capabilities of the 777’s wind shear detection system; and that Boeing consider changing procedures so that pilots increase thrust manually during all normal go-arounds, regardless of whether the plane has touched down or not.
In the end, it’s hard to blame any individual or organization for the crash of Emirates flight 521. The accident occurred as a result of a set of faulty assumptions that were not unique to this particular flight crew, and in fact their level of professionalism was high throughout the flight. The root causes of overreliance on automation are complex, and criticizing the pilots or the airline will not solve the problem.
However, there is one underrecognized hero of the story: the Boeing 777 itself. Despite being slammed against the runway and sliding on its belly for almost a kilometer, the plane stayed in one piece, didn’t immediately explode, and protected all of its occupants from serious injury. Other crash landings involving the 777, including Asiana Airlines flight 214 and British Airways flight 38, resulted in similar outcomes. It was thanks in large part to the sturdiness of the airframe and the calm assertiveness of the flight attendants that every one of the 300 passengers and crew was able to walk off that plane and go home to their family in a taxi instead of a body bag.
___________________________________________________________
Join the discussion of this article on Reddit!
And don’t forget to visit r/admiralcloudberg to read over 130 similar articles.
