Superficial maintenance failed to fix flaw in attitude instrument
Inadequate airmanship combined with inadequate maintenance led to the fatal crash of a Korean Air Lines (KAL) freighter shortly after takeoff into the night sky at Stansted airport. This is the solemn conclusion of the UK’s Air Accidents Investigation Board (AAIB) in its final report of the fatal Dec. 22, 1999, crash. The AAIB report was posted on its website July 25.
The case prompted numerous changes at the airline and stands as an object lesson for operators in three key areas: basic flying skills in partial-panel situations, crew resource management, and maintenance trouble-shooting by unqualified technicians with insufficient oversight. In this last respect, the KAL case recalls the procedural and documentation deficiencies revealed recently by the U.S. National Transportation Safety Board (NTSB) in its investigation into the Jan. 8 crash of an Air Midwest twin turboprop (see ASW, May 26). Maintenance issues also will feature prominently in the NTSB’s final hearing, slated for Aug. 5, on the fatal Feb. 16, 2000, crash of an Emery Worldwide Airlines DC-8 freighter (see ASW, May 27, 2002).
The KAL, Air Midwest and Emery cases all involved loss of control shortly after takeoff. The Emery crew was helpless, since the elevator linkage was broken. The Air Midwest crew had only partial elevator movement and might have been able to bring the rising nose down by putting the airplane into a bank, but it is problematic whether the Air Midwest pilots could have brought their overloaded and tail-heavy airplane to a safe landing. The KAL case is different in one key respect: even though the maintenance action shortly before takeoff did not fix the root problem with the captain’s attitude director indicator (ADI), the crew could have surmounted the situation. In fact, it was the second fatal crash of a KAL cargo jet in an eight-month period. A KAL MD-11 freighter crashed April 15, 1999, in China. A two-year investigation by the Civil Aviation Administration of China (CAAC) determined that the co-pilot flying the airplane mistook a tower command to fly at 1,500 meters for 1,500 feet and put the aircraft into an unrecoverable dive. One industry observer believes that in the hands of “competent aircrew … both crashes were avoidable.” (See ASW, Jan. 10, 2000).
“The aircraft departed Stansted carrying the same fault with which it had arrived,” the AAIB con-cluded. In that phrase lies the tale of how one flight crew successfully coped with a faulty ADI and how another flight crew failed to do so. The maintenance in between these two flights failed to identify and fix the root cause.
Previous flight
The KAL B747-200F departed Seoul’s Kimpo Airport for a flight to Milan’s Malpensa Airport, with planned stopovers at Tashkent, Uzbekistan, and London’s Stansted Airport.
Climbing out after a daylight takeoff in clear weather from Tashkent, the captain’s ADI malfunctioned at a 10�-15� angle of bank in a right turn. As the angle of bank increased further, the displayed angle of bank remained “frozen” and the comparator alarm sounded – as it is designed to do when the two ADIs differ by 4� or more. The crew’s immediate actions were wholly appropriate to the situation. The captain, who was the pilot flying, compared his ADI display to the outside horizon and to the first officer’s ADI and to the standby ADI. His instrument disagreed with the other two and with the “picture” through the windscreen; the captain correctly concluded that his display was erroneous. The captain handed over control to the first officer.
A bit of explanation is in order. The captain’s ADI is connected to one of three inertial navigation units installed on the aircraft, in this case INU #1. The first officer’s ADI is connected to INU #2. Both pilots can select INU #3 as a backup source of attitude information.
The standby ADI is fully independent, with its own gyroscope and battery power.
By switching from NORM to ALT, the attitude data flowing to the captain’s ADI can be switched from INU #1 to INU #3. When this was done, the ADI displayed the correct roll information and the warnings disappeared.
When switched back to NORM, the comparator alerts resumed. The captain set his ADI to ALT and resumed his role as pilot flying for the remainder of the flight to Stansted.
Glossing over the glitch
After landing at 1505 hours (UTC), the captain turned the selector switch back to NORM. The faulty ADI was written up in the Technical Log by the flight engineer as “unreliable in roll.” From the fault reporting manual (FRM), the flight engineer told investigators that he entered the appropriate codes, 34 41 AD 01. The flight engineer also verbally passed details of the malfunction to the KAL ground engineer who met the aircraft at Stansted, to include explaining how the display normalized when ALT was selected. The codes entered in the log book referred to the captain’s ADI, and that it functioned correctly when switched to ALT.
Ground technicians could cross reference the codes entered in the log to the fault isolation manual (FIM). This manual translates the FRM codes into maintenance action.
Unfortunately, the technicians at Stansted did not have a copy of the FIM, according to the AAIB. If they had, they would have read that replacement of INU #1 was in order. A screwdriver never would have been applied to the ADI, as the fault lay in the INU. This particular INU, by the way, had been installed in the accident aircraft 18 days before the crash. It had been repaired after malfunctioning on another aircraft and was retrofitted to rectify an INU #1 problem on the accident airplane.
Two contract technicians (called Engineer ‘A’ and Engineer ‘B’ in the AAIB report) were on hand to help prepare the airplane and resolve any squawk items before its next flight. That flight was scheduled to depart for Milan at about 1800 hours. Engineers ‘A’ and ‘B’ were part of the contract maintenance support provided to KAL at Stansted by FLS Aerospace.
Engineer ‘A’ joined the KAL ground engineer in the cockpit and, under his observation, unscrewed the ADI from the instrument panel. A pin was found pushed back on the connector socket. At this point, since Engineer ‘A’ was not a qualified avionics technician, Engineer ‘B’ was called. On arrival in the cockpit, he pushed the pin into position with a satisfying “click.” The test button was pushed as the ADI was in both the NORM and ALT position, with satisfactory results.
The technicians thought they’d fixed the glitch. Not so. The pushed-in pin was a world class red herring. This particular pin was not related to the reported defect, and AAIB investigators suspect it was making contact anyway. More importantly, the ADI self-test only showed that the instrument itself was functioning. It did not test the integrity of the data coming from the three INUs.
How were three technicians seduced into believing they had fixed the problem, when the root cause in INU #1 still lurked? The KAL technician had about 14 hours of training in avionics (not much) and didn’t have the FIM available, with its clear instruction to look beyond the ADI to INU #1. The AAIB declared bluntly that the KAL engineer “had insufficient technical knowledge of the ADI/INU interface.”
“In the UK he would not have been permitted to embark on a self-devised process of troubleshooting,” the AAIB said.
Engineer ‘A’ was not an avionics technician and thought the KAL ground engineer had correctly diagnosed the problem. Although Engineer ‘B’ was a qualified avionics technician, he arrived late in the process and was responding to a colleague’s request to click the displaced socket pin into place. Engineer ‘B’ was helping to complete a process he had not started.
Critical fail points
There was no independent supervisory check of the work. Consider that the first of three critical fail points in the case.
INU #1 remained faulty. When the new aircrew for the flight to Milan boarded, the ADI was set to NORM, its input data coming from INU #1. The KAL ground engineer accompanied the crew on this flight.
Apparently, the pilots were not advised about the problem with the previous captain’s ADI on the flight from Tashkent or the actions taken to correct it.
Various delays, such as taking nearly an hour to contact air traffic control on the incorrect frequency had evidently frustrated the captain, who was the pilot flying. Of note, the 57-year old captain was considerably senior in time and experience to the 33-year old first officer.
Both the first officer and the 38-year old flight engineer may have been cowed by the captain’s ire. Based on the cockpit voice recorder (CVR), the captain twice admonished the first officer in a manner “construed by Korean listeners as derogatory,” according to the AAIB report. On one occasion, the captain snapped, “Make sure you understand what ground control is saying before you speak.” And, “Answer them! They’re asking how long the delay will be.”
The AAIB report painted a picture of the dark mood likely prevailing in the cockpit:
“The delay experienced by the crew … was greater than normal and would have resulted in an understandable degree of frustration in the commander.
“After personally handling the ATC communications a number of times prior to and during engine start (KAL standard procedure is for the first officer to handle ATC radio calls), he suddenly reprimanded the first officer for not responding to a radio call. On the taxi call, he faulted the first officer for not advising him to taxi to the centreline, then on receiving the line-up clearance told the first officer that a ‘Roger’ alone was sufficient. By making these comments, it is considered that the commander contributed to setting a tone which discouraged further input from the other crew members, especially the first officer.”
Shortly after lift-off at 1836 hours, the comparator warning sounded. The aircraft rolled wings level – the warning stopped. Moments later, as the captain put the aircraft into a left turn, the warning sounded again. In fact, the comparator sounded three warnings. The first officer said nothing and cancelled the comparator warning. Consider his non- action critical fail point #2. The more experienced flight engineer said, “Bank is not working,” suggesting his belief that the aircraft was not responding to the captain’s left roll input. Seconds later, the flight engineer called out, “Bank, bank,” suggesting that he recognized and was warning the captain of a bank angle greater than 30�. When the pilot applies roll into a turn and there is no banking response on the ADI, the tendency is to apply a greater roll input, experienced pilot sources say. A heavy aircraft can very quickly exceed the point at which a recovery would be possible at low altitude – in this case the KAL jet achieved a maximum height of about 2,600 feet.
According to the AAIB, the first officer’s ADI and the standby ADI were correctly displaying the aircraft’s dire attitude. With the first officer inexperienced, overloaded, overawed and distracted, the flight engineer being disregarded, the airplane’s fate rested entirely in the ability of one individual to get it all together. The captain flew his spurious ADI display all the way into the ground.
From a roll attitude of 78� the airplane could have been recovered, according to post-accident simulator runs. Climbing through clouds into the night sky, the AAIB surmised: “It is probable that this commander had not experienced an ADI failure, despite his long flying career. When the ADI did fail, he was apparently not able to recognize the problem, because his primary frame of reference had always been through his visual interpretation of the ADI attitude display.” This inability was critical fail point #3.
“There is no evidence of him invoking the ADI failure drill by consulting the first officer’s and standby attitude instruments to determine which of the two primary attitude instruments was correct,” the AAIB report observed. The AAIB suggested this failure was symptomatic of a larger problem: “It can be argued that at the time of the accident KAL crews, in general, were not adequately equipped to deal with this malfunction in a timely manner to avoid loss of control.”
The aircraft struck just 1.2 nautical miles (NM) from the airport in a huge fireball. Extrapolate the situation to Heathrow, substitute an aircraft with 350 passengers, and the total body count (in the air and on the ground) could have been 1,000 or more.
Action follows accident
In the time since the crash, KAL has undertaken numerous changes:
- Cockpit resource management (CRM) training has been strengthened. The AAIB urged that it be strengthened further to “ensure adaptation of imported material to accommodate the Korean culture.” The godlike authority invoked in the captain, a manifestation of traditional Korean structure, has sometimes been criticized as an impediment to good CRM.
- KAL is now keeping duplicate sets of technical logs on the ground. The log and whatever manuals and other relevant materials aboard the accident airplane were utterly consumed in the fiery crash.
- KAL has beefed up support staffing and/or arrangements at its overseas stations. To wit, the number of airports with full-time KAL engineers was increased from 31 to 43. The number of stations contracted for full technical handling was increased from 8 to 12.
- “Special instrument failure” training was instituted in 2000. Commencing in the first half of 2002, aircrews undergoing recurrent training began receiving an additional simulator session dealing with “automation degradation.” Specific training also was introduced on “unusual attitude recovery techniques” and the transfer of control when instrument failures occur.
Some related aspects of the case bear mention. One, the ongoing discussion in the pages of this publication concerning non-revenue check flights following maintenance of flight-critical systems (see ASW, July 14). Two, the concept of “twinning” the standby ADI right next to the primary ADI merits consideration. With the primary and standby ADI right in the center of the pilot’s field of view, their paired location can enable the immediate perception of disparities between the two, thereby providing more time to avert spatial disorientation and loss of control (see ASW, June 23).
Third, there is a belief in some quarters that outsourcing maintenance imports a diminution of quality. In this case, had KAL contracted with FLS Aerospace for full technical support (FTS) rather than technical assistance (TA), the initial fault isolation by specialists with more avionics knowledge and experience likely would have led to INU replacement.
The larger lesson is that redundancy is only as good as pilot training and the cockpit culture. With three ADIs to choose from, and the erroneous display dramatically different from the more alarming situation portrayed on the good displays, the captain of the accident airplane persisted at mortal peril to himself and his crew. The KAL case recalls the January 1978 crash of an Air India B747 when the captain, loathe to relinquish control, flew a failed ADI into the sea on departure.
The KAL crash at Stansted is further proof that one locked-up brain is not as good as three. Browbeating subordinates into silence or meekness is the human equivalent of flying with just one ADI – a denial of that great safety insurance policy known as redundancy. It applies to machines and to airmen.
(The full AAIB accident report may be viewed at http://www.dft.gov.uk/stellent/groups/dft_avsafety/documents/page/dft_avsafety_02 3258.hcsp )
Causal Factors
The top three factors of five factors in the crash were pilot-related
1 The pilots did not respond appropriately to the comparator warnings during the climb after takeoff from Stansted despite prompts from the flight engineer.
2 The commander, as the handling pilot, maintained a left roll input, rolling the aircraft to approximately 90� of left bank and there was no control input to correct the pitch attitude throughout the turn.
3 The first officer either did not monitor the aircraft attitude during the climbing turn or, having done so, did not alert the commander to the extreme unsafe attitude that developed.
4 The maintenance activity at Stansted was misdirected …. Consequently, the aircraft was presented for service with the same fault experienced on the previous sector, the No. 1 INU [inertial navigation unit] signal driving the captain’s ADI [attitude direction indicator] was erroneous.
5 The agreement for local engineering support … was unclear on the division of responsibility, resulting in erroneous defect identification, and mis-directed maintenance action. Source: AAIB
Not Just ‘Flap Operators’
Comments of Alex Paterson, former Ansett captain
“The whole point of having two pilots in airline transport aircraft is the recognition that even the best of human operators can fail at any time. It is for this reason that all properly run airlines employ competent pilots as their first officers (FOs), not only because they are the airline’s future captains, but equally important because they play a fundamental role in maintaining a safe airline operation through their monitoring role in the cockpit – despite some captains and airline management thinking FO means ‘flap operator.’
“With regard to the Stansted accident, an Ansett captain would almost certainly have elected to have the FO conduct takeoff given the suspect nature of his ADI. That said, assuming the captain elected to fly the aircraft, the Ansett FO would have been closely monitoring the aircraft and immediately called “Attitude” the moment the bank angle went out of wings level and no attempt was being made to level them. It should be noted the accident crew had not been told of the prior crew’s experiences, recovery actions or the ADI failure or repair.
“Assuming the captain had acknowledged the FO’s call, and the aircraft had not begun to roll back towards wings level, the FO would have vigorously repeated his call, “Attitude, get your wings level.” If the situation was not improving, he would then have quickly checked both his ADI and the captain’s with the standby ADI, and grabbed the control wheel and started to get the aircraft back to wings level if the captain failed to do so.
“The moment the comparator warning came on BOTH pilots would have glanced at the standby ADI and almost immediately BOTH would have determined that it was the captain’s ADI at fault.
“If the captain had not said, “My ADI is faulty, you fly the aircraft,” the Ansett FO would have said, “Your ADI appears faulty. Do you want me to fly the aircraft?” If the captain failed to correct the situation, the Ansett FO would have had no hesitation in taking over control of the aircraft, saying, “Your ADI is faulty, check the standby ADI, I’m taking over, I’ve got the aircraft,” or words to that effect. The point is, an Ansett FO assuming control of an aircraft in appropriate circumstances would not be abnormal. However, it is clear such action was inconceivable in that KAL cockpit.”
(ASW note: For one view of the situation at KAL in the year before the accident at Stansted, see http://www.vision.net.au/~apaterson/aviation/korean_audit.htm) >> Paterson, e-mail [email protected] <<