Incident: Pilots' Errors and Lack of Software Update Lead to UPS Crash

Published Date: 2014-09-09

Postmortem Analysis
Timeline 1. The software failure incident happened in August 2013.
System 1. Ground proximity warning system software on the UPS cargo plane [29728]
Responsible Organization 1. The pilots were primarily responsible for causing the software failure incident due to a series of errors they made, including failing to correctly program the aircraft computer, monitor the plane's altitude, communicate important information, and abort the landing when necessary [29728].
Impacted Organization 1. Pilots of the UPS cargo plane [29728] 2. UPS as a company [29728]
Software Causes 1. UPS did not update software on a ground proximity warning system, which could have given the crew an earlier indication they were too close to the ground [29728].
Non-software Causes 1. The captain failed to correctly program an aircraft computer and monitor the plane's altitude. 2. The first officer failed to communicate altitudes to the pilot as the plane approached the airport. 3. The co-pilot confessed to being fatigued and failed to use off-duty time to get appropriate rest. 4. UPS did not update software on a ground proximity warning system, which could have given the crew an earlier indication they were too close to the ground. 5. UPS did not provide all available weather information to the pilots, leading to misjudgment of cloud ceiling height. 6. The captain did not have a stabilized approach in the final minutes before the crash [29728].
Impacts 1. The software failure incident, specifically the failure to update software on a ground proximity warning system by UPS, could have potentially given the crew an earlier indication they were too close to the ground, which might have prevented the deadly crash of the UPS cargo plane in Alabama [29728]. 2. The failure to update software on the plane's ground proximity warning system was highlighted as a missed opportunity that could have possibly prevented the accident, as mentioned by NTSB member Robert Sumwalt [29728].
Preventions 1. Updating the software on the ground proximity warning system could have given the crew an earlier indication they were too close to the ground, potentially preventing the crash [29728]. 2. Providing all available weather information to the pilots could have helped them make more informed decisions during the approach, potentially preventing the incident [29728].
Fixes 1. Updating the software on the ground proximity warning system could have given the crew an earlier indication they were too close to the ground, potentially preventing the crash [29728]. 2. Providing all available weather information to the pilots could have helped them make better decisions during the approach, potentially preventing the incident [29728].
References 1. National Transportation Safety Board (NTSB) [Article 29728] 2. UPS official (Capt. Houston Mills) [Article 29728]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown The articles do not mention any specific software failure incident happening again at the same organization (UPS) or at multiple organizations. Therefore, the information related to the software failure incident happening again at one organization or multiple organizations is unknown.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the UPS cargo plane crash incident. The National Transportation Safety Board (NTSB) pointed out that UPS did not update the software on a ground proximity warning system, which could have provided the crew with an earlier indication that they were too close to the ground. NTSB member Robert Sumwalt criticized UPS for failing to take actions that could have prevented the crash, specifically mentioning the lack of software updates on the plane's warning system [29728]. (b) The software failure incident related to the operation phase is highlighted by the fact that UPS did not provide all available weather information to the pilots. This lack of information led to the pilots expecting to see the airport after descending below clouds at 1,000 feet, but they didn't clear the clouds until 350 feet. Additionally, the NTSB mentioned that the captain did not have a stabilized approach in the final minutes, indicating issues with the operation of the aircraft [29728].
Boundary (Internal/External) within_system (a) within_system: The software failure incident related to the UPS cargo plane crash in Alabama was primarily within the system. The failure was attributed to the pilots' errors, such as the captain failing to correctly program the aircraft computer, failing to monitor the plane's altitude, and not relaying important information to the co-pilot [29728]. Additionally, the global delivery company, UPS, was criticized for not updating the software on a ground proximity warning system, which could have provided the crew with an earlier indication that they were too close to the ground [29728]. (b) outside_system: There is no specific mention in the articles of the software failure incident being caused by contributing factors originating from outside the system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The NTSB mentioned that UPS did not update software on a ground proximity warning system, which could have given the crew an earlier indication they were too close to the ground. This failure to update the software was a contributing factor that was not directly related to human actions [29728]. (b) The software failure incident occurring due to human actions: - The NTSB cited a litany of errors made by the pilots, including the captain failing to correctly program an aircraft computer, failing to monitor the plane's altitude, and not relaying important information to the co-pilot. These human errors directly contributed to the crash of the UPS cargo plane [29728].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The NTSB mentioned that UPS did not update software on a ground proximity warning system, which could have given the crew an earlier indication they were too close to the ground. This failure to update the software on the system was a hardware-related contributing factor to the incident [29728]. (b) The software failure incident occurring due to software: - The NTSB did not directly attribute the software as a contributing factor in the incident. However, there was a mention of the need for UPS to update software on a ground proximity warning system, indicating a potential software-related issue that could have played a role in the crash [29728].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in the UPS cargo plane crash in Alabama in 2013 was non-malicious. The incident was primarily attributed to errors made by the pilots, including the captain failing to correctly program the aircraft computer, failing to monitor the plane's altitude, and not relaying important information to the co-pilot. Additionally, UPS was criticized for not updating the software on a ground proximity warning system, which could have provided the crew with an earlier indication that they were too close to the ground [29728]. (b) The incident was not attributed to malicious intent but rather to a series of errors and failures in both human actions and software updates that could have potentially prevented the crash.
Intent (Poor/Accidental Decisions) unknown The articles do not provide information about a software failure incident related to either poor_decisions or accidental_decisions.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence: - The NTSB pointed out that UPS did not update software on a ground proximity warning system, which could have provided the crew with an earlier indication they were too close to the ground. This lack of software update was highlighted as a factor that could have prevented the crash [29728]. - NTSB member Robert Sumwalt criticized UPS for not taking actions that could have prevented the crash, mentioning that if UPS officials had an iPhone, they would keep their software up to date, yet they failed to update software on the plane carrying two of its employees [29728]. (b) The software failure incident related to accidental factors: - There is no direct mention in the articles of the software failure incident being caused by accidental factors.
Duration unknown The articles do not mention any software failure incident related to either a permanent or temporary duration. Therefore, the information about the duration of the software failure incident is unknown.
Behaviour crash, omission, other (a) crash: The software failure incident in this case resulted in a crash, as the UPS cargo plane crashed near the Birmingham runway due to a series of errors made by the pilots and the failure of the ground proximity warning system software to provide an early indication of being too close to the ground [29728]. (b) omission: The software failure incident also involved omission, as the UPS cargo company did not update the software on the ground proximity warning system, which could have potentially prevented the crash by providing the crew with an earlier indication of being too close to the ground [29728]. (c) timing: There is no specific mention of a timing-related failure in the software incident described in the articles. (d) value: The software failure incident did not involve a value-related failure where the system performed its intended functions incorrectly. (e) byzantine: The software failure incident did not exhibit a byzantine behavior with inconsistent responses and interactions. (f) other: The other behavior observed in this software failure incident is the failure of the software to provide all available weather information to the pilots, which could have impacted their decision-making during the approach to the airport [29728].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence death, harm (a) death: The consequence of the software failure incident was the death of both pilots in the UPS cargo plane crash in Alabama on August 13, 2013. The Airbus A300-600 crashed a short distance from the Birmingham runway, resulting in the tragic loss of lives [Article 29728].
Domain transportation (a) The failed system was related to the transportation industry, specifically the aviation sector. The incident involved a UPS cargo plane crash in Alabama, where the pilots made critical errors leading to the accident [Article 29728]. UPS, the global delivery company involved in the crash, was criticized for not updating software on a ground proximity warning system, which could have potentially prevented the crash by providing the crew with an earlier indication that they were too close to the ground [Article 29728]. (h) Additionally, the incident highlighted issues within the aviation industry regarding different FAA standards for commercial and cargo aircraft. The FAA had exempted cargo pilots from certain rest hour requirements, which was a point of concern raised by cargo pilots who believed that rest rules should be uniform across all types of aircraft [Article 29728]. (m) The incident also brought attention to the issue of pilot fatigue within the transportation industry. The Independent Pilots Association conducted a survey where 91% of respondents disagreed with the notion that the UPS culture encourages pilots to call in fatigued when they are tired, indicating a concern about fatigue management practices within the industry [Article 29728].

Sources

Back to List