On the morning of Jan. 26, as two Alaska Airlines flights from Seattle to Hawaii lifted off six minutes apart, the pilots each felt a slight bump and the flight attendants at the back of the cabin heard a scraping noise.
As the noses of both Boeing 737s lifted skyward on takeoff, their tails had scraped the runway.
Both planes circled back immediately and landed again at Seattle-Tacoma International Airport. Tail strikes happen occasionally in aviation, but two in quick succession was not normal.
Bret Peyton, Alaska's on-duty director of operations, immediately ordered no more planes were to take off across the airline's network. All Alaska flights not already airborne were stopped nationwide.
"At that point, two in a row like that, that's when I said, 'No, we're done,'" said Peyton. "That's when I stopped things."
For Peyton, who was an Air Force lieutenant colonel, that decisive call was a heart-racing moment. But few travelers, apart from the passengers aboard the two Hawaii flights who had to wait several hours to continue their journey, would have noticed anything amiss.
The stoppage lasted just 22 minutes.
Alaska's flight operations staff quickly realized that a software bug was sending bad takeoff weight data to its crews. They immediately figured out a workaround and normal flying resumed.
Last Tuesday, following a series of recent safety incidents and dangerous close calls around the U.S. aviation system, acting Federal Aviation Administration Administrator Billy Nolen wrote a "call to action" letter warning that the U.S. system's stellar safety record mustn't be taken for granted.
The Jan. 26 tail strikes at Sea-Tac were not close calls; the passengers on those Hawaii flights were never in danger. Still, the mishaps point to the need for more vigilance by pilots in checking automated data.
"We rely on that data to safely operate the plane," said an Alaska Airlines captain who has flown 737s to Hawaii and asked for anonymity because he spoke without company permission.
Yet the incidents also offer some reassurance, in the way Alaska promptly shut down service until it understood the cause and fixed it.
"Alaska dealt with it very quickly and appropriately," the captain said.
20,000-pound error
The first incident occurred when Alaska flight 801, a Boeing Max 9 headed to Hawaii's Big Island, lifted off at 8:48 a.m.
At 8:54 a.m., Alaska flight 887 followed, this time a Boeing 737-900ER headed to Honolulu.
To determine the thrust and speed settings for takeoff, Alaska's pilots and others use a performance calculation tool supplied by a Swedish company called DynamicSource.
It delivers a message to the cockpit with crucial weight and balance data, including how many people are on board, the jet's empty and gross weight and the position of its center of gravity.
In a cockpit check before takeoff, this data is entered into the flight computer to determine how much thrust the engines will provide and at what speed the jet will be ready to lift off.
A pilot at American Airlines, which uses the same DynamicSource performance data tool, and who also spoke anonymously because he didn't have authorization, explained that the computer then calculates just the right amount of engine thrust so the pilots don't use more than necessary.
"The goal is to lower the power used on takeoff," he said. "That reduces engine wear and saves money" on fuel and maintenance.
Flights to Hawaii are typically full, with lots of baggage and a full load of fuel for the trip across the ocean. The planes are heavy.
That morning, a software bug in an update to the DynamicSource tool caused it to provide seriously undervalued weights for the airplanes.
The Alaska 737 captain said the data was on the order of 20,000 to 30,000 pounds light. With the total weight of those jets at 150,000 to 170,000 pounds, the error was enough to skew the engine thrust and speed settings.
Both planes headed down the runway with less power and at lower speed than they should have. And with the jets judged lighter than they actually were, the pilots rotated too early.
Both the Max 9 and 737-900ER have long passenger cabins, which makes them more vulnerable to a tail strike when the nose comes up too soon.
Alaska says it operated 727 flights that day, of which just 30 took off with incorrect takeoff data. Only those two Hawaii-bound aircraft had tail strikes.
Subsequently, Alaska flight operations staff and safety experts with the pilots union, the Air Line Pilots Association, independently analyzed the data from the two flights to evaluate the safety risk. Each determined that both aircraft got airborne well within safety limits despite the lower thrust.
The data "confirms that the airplane was safely airborne with runway remaining and at an altitude by the end of the runway that was well within regulatory safety margins," said the union's Alaska unit chair, Will McQuillen, in a statement.
The fuselage under the tail of a jet has a bump on it called a "tail skid" that is designed to crumple and absorb impact. Still, maintenance technicians are required to inspect the damage, which is why the two planes immediately returned to the airport.
Both airplanes were cleared to fly again later that day. Indeed, the Max 9 was cleared in time to take off at 12:30 p.m. to fly the passengers who had deboarded that morning to Kailua-Kona.
"That looks about right"
The bug was identified quickly in part because some flight crews noticed the weights didn't seem right and asked for manual validation of the figures.
During preflight check, when the DynamicSource message comes in, the first officer reads each data point aloud and the captain verbally verifies each one.
Soon after the tail strikes that day, Alaska issued a "safety flash" message to all its pilots that noted that when entering the DynamicSource information, they should "take a second and conduct a sanity check of the data."
In other words, they should pause if the weights seem off.
The Alaska captain said that, as for many things in aviation, pilots routinely use an acronym when they do the pre-takeoff "sanity check": TLAR, which means "That Looks About Right."
If the automatically loaded data strikes either pilot as not right, they can make a manual request for takeoff data from the airline operations center. "But 99.8% of the time, the data is accurate," he said.
Alaska's Peyton said "several crews noticed the error and notified dispatch."
The pilot at American Airlines said "requesting manual data is not standard" and that if there's a glitch, naturally some pilot somewhere is going to miss it.
"Not everyone gets eight hours sleep the night before. Someone is going through a divorce. Someone is not so sharp that morning," he said. "The sanity check isn't perfect every day of the week."
Pulling the plug
After Peyton called the stoppage that morning, the discrepancy in the DynamicSource weight data became clear.
"This discovery was happening in a very small time period right around that 8:45 time frame," he said. "It all happened very, very rapidly, as did the shutting down of the airline."
A quick interim fix proved easy: When operations staff turned off the automatic uplink of the data to the aircraft and switched to manual requests "we didn't have the bug anymore."
Peyton said his team also checked the integrity of the calculation itself before lifting the stoppage. All that was accomplished in 20 minutes.
The software code was permanently repaired about five hours later.
Peyton added that even though the update to the DynamicSource software had been tested over an extended period, the bug was missed because it only presented when many aircraft at the same time were using the system.
Subsequently, a test of the software under high demand was developed.
Peyton said his first call that day was to the airline's chief dispatcher to halt operations. His second was to the FAA to let the agency know what was happening.
Acting FAA Administrator Nolen's Tuesday warning letter was spurred by a raft of recent airline incidents that barely escaped becoming fatal accidents.
In addition to several runway incursions, the sharp dive toward the ocean of a 777 flying out of Hawaii in December and the close call this month between a FedEx 767 coming in to land and a Southwest Airlines 737 taking off from the same runway in Austin, Texas, raised particular alarm.
It has been 14 years since the last fatal U.S. airliner crash. There is concern that less-experienced pilots and air traffic controllers hired during the post-pandemic labor shortage could diminish safety margins.
Nolen said he's ordered a safety review "to examine the U.S. aerospace system's structure, culture, processes, systems and integration of safety efforts."
And he's called a summit in March to determine "what additional actions the aviation community needs to take to maintain our safety record."
FAA spokesman Ian Gregor said Thursday the agency is looking into the Alaska incidents. He confirmed the airline's account that the planes took off well within safety parameters.
Peyton said the airline's leadership has been very supportive of his decision to pull the plug that January morning.
"We needed to stop the operation. It was very clear to me within a very short period of time, and I'm glad we did," he said.
"I didn't walk into work that morning, thinking I would stop a major airline," Peyton added. "What it says to me is that I'm empowered to do so and so is every employee here. It's part of our safety culture."
