Aircraft Accidents and Memories

Fifty years ago, Apollo 11 took off for its historical moment: the first two men to walk on the Moon. I say two because it was not a one-man gig. Anyone cognizant in the Summer of ’69 has fond memories of Neil Armstrong stepping off the ladder and onto the parched white surface of our favorite satellite. His first words were emblazoned on our American hearts for decades as we cheered, “U-S-A! U-S-A!”, while giving raspberries to Russia.

It is hard to forget important events, those that stand out as milestones, both tragic, like nine-eleven, and wonderful, like the 1976 Bicentennial. Unfortunately, we forget the tragic lessons too early; sometimes we choose to, and others are lost to a preoccupation with other matters. The less spectacular the tragic event, the sooner we push it to the back of our minds. In aviation, if the fatality rate, for instance, is low, we, in the aviation industry, tend to forget.

Incidentally, does anyone remember Atlas flight 3591? One hundred and forty-seven days ago? Outside Baytown, Texas? The Miami-to-Houston flight, a Boeing 767-375BCF, suddenly plunged into the swampy waters of Trinity Bay with little indication of an emergency.

The National Transportation Safety Board (NTSB) launched immediately. According to the NTSB website, they were at the accident scene within hours with the usual cadre of NTSB engineers; they found the flight data recorder and cockpit voice recorder and after several days of recovery returned to NTSB Headquarters. On March 5, 2019, the NTSB website posted a report titled, ‘NTSB Laboratory Completes Initial Review of Cockpit Voice Recorder, Recovers Flight Data Recorder’. The report just stated that the recorders’ data were being reviewed.

But then something happened: Ethiopian Airlines flight 302. The B737-MAX crashed shortly after takeoff on March 10, 2019, a mere fifteen days after Atlas 3591. One hundred and fifty-seven people lost their lives on Ethiopian Airlines 302, but it was worse because another B737-MAX crashed over four months earlier. On October 29, 2018, Lion Air flight 610 crashed with a loss of life at one hundred and eighty-nine. In four months, the B737-MAX was involved in two similar accidents costing three hundred and forty-six lives. The B737-MAX was grounded; intense scrutiny of the aircraft had begun.

As it should have. It was one thing to crash under different circumstances, but the two MAX accident causes were too close for coincidence. And yet, the NTSB was not the lead investigatory group on either accident. They did assist, but the lead roles belonged to the National Transportation Safety Council (Lion Air) and the Ethiopian Civil Aviation Authority (Ethiopian Airlines).

What, then, was on the NTSB’s plate? The NTSB’s Director for the Office of Aviation Safety, in a speech at the 2018 Embraer Safety Stand Down in Wichita, Kansas, said of the Title 14 Code of Federal Regulations (CFR) Part 121 operators that accidents among these air carriers, “is a very short conversation. It’s the sound of crickets … they’re just not happening anymore in the U.S.” Unbelievable! That ‘inspired’ comment was good to know because then that meant that the NTSB was not too busy to update the industry about the Part 121 operations flight Atlas 3591, seeing as, you know, Part 121 accidents, “they’re just not happening anymore in the U.S.”.

Where were the updates? Consider American 587, the A300-600 that crashed November 12, 2001. Long after terrorism was ruled out, the NTSB provided seven updates in the first five months after the accident. Atlas 3591 has had only one update in the five months since February 23, 2019. On March 12, 2019, the NTSB posted to its website for Atlas 3591, accident number DCA19MA086, the only accident update, concluding with the final sentence, “Additional Information will be released as warranted.” That additional information has not been updated for one hundred and thirty days.

Why, then, has Atlas 3591 practically disappeared off of the NTSB’s update pages? What were the differences in the four flights just discussed? American 587 resulted in 265 deaths; Ethiopian Airlines 302 had 157 deaths; Lion Air 610 resulted in 189 killed. Atlas 3591 had three pilot fatalities. There is no suggestion that accident priority is focused on fatality counts, although when I worked as an NTSB investigator, I investigated at least two Title 14 CFR Part 121 accidents that received … less than adequate NTSB Office of Aviation Safety attention: Colgan 9446 and Emery 17, two and three pilot deaths, respectively. It would be unethical to pick which accidents are to receive full NTSB investigation resources by the fatality count, especially when accident investigation generally has nothing to do with the lives lost; it is about why the plane crashed.

To be candid, it is obvious 99% of the time, why accident victims perish, e.g. blunt force trauma, asphyxiation, post-crash fire. These injuries are consequences of the accident; in most cases, they are not the cause of the accident. A lot of accident related information can be gathered from the victims, e.g. damage to the face and hands, smoke in the lungs or symptoms of an explosive decompression; again, these injuries are the results of the accident, they are not the cause. All victims’ families want to know why their family member died just as much as how they died. In my monthly series Lessons Unlearned, I do not mention victim counts. As an NTSB accident investigator, it did not matter how many people were killed in the accident I investigated, whether it was the three pilots in Emery 17 or all 265 in the plane and on the ground with American 587. Emotions were distractions; sorrow was a luxury I could not afford if I wanted to be partial, effective and analytical. My job was to find the accident’s root cause … period. That happens to be the NTSB’s job as well. Or does the NTSB settle on probable cause?

Why would Atlas 3591 be important? Because it is not about the fatality numbers; it is about the chances, as in: What are the chances another B767 has a similar problem? Shouldn’t the question be: What are the chances another CARGO B767 has a similar problem? No, it should not. Cargo aircraft only differ from passenger aircraft because of the upper deck; one has seats and the other has cargo restraining devices. Some differences may be a little deeper, but not too deep. The truth is that what caused Atlas 3591 to fall out of the sky could very well cause a passenger version to fall out of the sky, as well. Which means finding Atlas 3591’s root cause could save hundreds of lives.

One might argue that the cargo aircraft could have been out of balance due to freight misloading. Not likely from what the industry knows of Atlas 3591 so far. If the aircraft was nose heavy, the pilots would have noticed long before arriving at Houston and would have benefited from the spent fuel. Tail heavy? True, burning off the fuel would have moved the center of gravity aft; with flaps extended and airspeed reduced, this would have presented a recipe for trouble. However, the NTSB did not report that the plane suffered an aerodynamic stall, but that it fell nose first. The March 12th update stated, “FDR data indicated that the airplane gradually pitched up to about 20 degrees nose down during the descent.” If the NTSB has contradicting information, then it is important they provide it.

The point of this speculation is to drive home the point that, aside from any phantom cargo issues, the events that caused Atlas Air 3591’s B767 to crash might very easily happen to a passenger B767. There are, at last count, over eleven hundred B767s manufactured, most of them in passenger service. Some versions of the B767 can carry 375 people; that’s almost as many fatalities as Ethiopian Airlines 302 and Lion Air 610, combined.

Many B767s are ETOPS qualified, meaning Extended over Water Twin Engine Operations. An ETOPS airplane is qualified to fly on one of the two engines, while cutting across the ocean. The ETOPS aircraft does not operate on only one engine; in an emergency, however, where the second engine fails, an ETOPS aircraft can operate on the remaining engine to the nearest airport that may be hours away.

Determining the root cause(s) of Atlas 3591 cannot be ignored or delayed; they must be discovered. The memories of the accident are short lived; people forget just what they should not, that this is in the best interests of the flying public; a tragedy waiting to happen … again. The NTSB needs to stop worrying about the B737-MAX; it is grounded and not flying anytime soon. Get back to Atlas 3591 because it is … that … important!

Aircraft Accidents and Lessons Unlearned XXVII: United 811

On February 24, 1989, while climbing out of Honolulu, Hawaii, passing 22,000 for 23,000 feet of altitude at 300 knots of indicated airspeed, United flight 811, a Boeing B747-122, tail number N4713U, suffered an explosive decompression. The forward cargo door separated from the lower fuselage. At its departure, the door damaged the right wing, numbers three and four engines; the right wing’s leading-edge devices, the fuselage, the right horizontal stabilizer and the vertical stabilizer as it fell away. Due to the violent nature of the door’s separation, a fuselage section above the cargo door, measuring thirteen feet lengthwise and fifteen feet vertically – to the first-class passenger windows’ level – tore free and away from the aircraft. The captain executed an emergency descent with a left turn to return to Honolulu where the plane landed safely, per Accident report AAR-92/02; accident number DCA89MA027.

Navy radar in the vicinity of Honolulu tracked the debris as it fell into the Pacific Ocean. The forward cargo door had been split in two pieces; the two sections were recovered from the ocean floor nineteen months later, on October 1, 1990. Within a year and a half, the National Transportation Safety Board (NTSB) had the necessary pieces to connect the dots, figure out how the door failed. More importantly, they could learn, Why.

Cargo doors are intricate devices, whether they are hydraulically operated main cargo doors, manually operated narrow body belly doors or electrically operated wide body belly doors; precise mechanical motions are synchronized to take place at specific times. However, the fundamental workings of a cargo door are simple: sequential order. The first sequence is the door open/close actuator which raises and lowers the door. As the closing door reaches the doorframe, the door actuator cuts out; a second sequence occurs where the door is pulled in tight against the frame. This signals the third sequence: the locking device; the door is captured and secured in place.

Three forces would have worked on Flight 811’s forward cargo door, causing the catastrophic results. The first is the internal pressure of the aircraft acting to open the door; over one hundred pounds per square inch were pressing against the 99” by 110” door’s inside surface. Simultaneously Bernoulli’s principle explains the second force acting on the door’s exterior, like lift on a wing: “An increase in the velocity of a stream of fluid [air] resulted in a decrease in pressure;” the decrease in pressure on the outside pulled the door away from the fuselage. Once the door was ‘pushed’ open, the third force, the airstream around the plane, tore the door away at 300 knots.

Much of AAR-92/02 report’s damage descriptions were confusing; the pictures used were poor quality and suggested that the NTSB investigators should have employed more technical drawings that would have translated better. Unfortunately, the NTSB failed to use maintenance experienced investigators to explore the maintenance issues.

The report’s maintenance records were documented between December 5, 1988 and December 30, 1987. Eleven times between these dates, the forward cargo door was written up as non-functioning electrically, resulting in the alternate method being employed: manually closing the door, a proven safe practice. However, United ignored the repetitious nature of these write-ups and failed to fix the problem, instead they postponed the fix indefinitely. The NTSB investigators did not pick up on this history finding, then failed to show any forward cargo door maintenance history from December 30, 1988 to the accident.

Instead, the NTSB maintenance investigator focused on a trivial matter as stated in Finding 16, “The smooth wear patterns on the latch pins of the forward cargo door installed on N4713U were signs that the door was not properly aligned (out of rig) for an extended period of time, causing significant interference during the normal open/close cycle.” As stated above, the door was under several forces during each flight. The cargo door’s latches were going to make ‘smooth wear patterns’ as the door leans into the latches. The latches also contacted the pins as the latches moved around them. This was normal.

AAR-92/02 related to a similar incident involving Pan Am flight 125, a B747-122, where, during flight, the cargo door was open one and a half inches along the bottom edge with the latch cams unlatched. Pan Am 125 returned to its origin due to a problem with pressurization. The NTSB used this incident as a ‘told-you-so’ moment to both Boeing and the Federal Aviation Administration (FAA), to say that the NTSB’s warning was unheeded, that the same thing happened with United 811.

However, Pan Am 125 and United 811 were fundamentally different. Was the event of Pan Am 125 dangerous? Yes. But to compare the two flights was a distraction; it focused away from United 811’s unique issues, that would have pointed to United 811’s root cause. On Pan Am 125, the door was never completely closed, pressurized air bled out of the gap, decreasing the pressure that would have pushed the door open. The pressurization forces were entirely different because the opening never allowed the forces to build up on the door. The NTSB’s attempt to draw comparisons did nothing to increase safety or knowledge of the root cause; instead it wasted time.

Throughout the report, the NTSB investigators stumbled through the various conclusions, some findings having had nothing to do with the accident, e.g. Fire and Rescue truck paint schemes. With the cargo door’s recovery, the root cause should have been definitive. Instead the NTSB resorted to a guessing game, probable causes were made in error that focused on one or two inconclusive reasons for the explosive decompression but, in the end, AAR-92/02 established nothing.

What, then, caused the forward cargo door to depart United 811? Without the evidence available at the time to study, all one can do is speculate and speculation is useless. It was clear that the use of megaphones (Finding 24) or the Fire and Rescue trucks’ camouflage paint job (Finding 23) never contributed to the accident. However, as a former aircraft mechanic, one who had worked many cargo doors, there were several issues I expected the NTSB should have focused their attention on.

The last maintenance performed on the cargo door was the replacement of a mid-span latch pin due to gouging. Wearing was a common consequence of normal cargo door use but gouging meant the door may have had a single latch out of rig, perhaps more than one. Gouging could have also signaled a timing problem, that the latch was out of sync with the other latches. Did the NTSB ask to see the replaced pin, if that was possible? What about the new pin; was it showing early signs of gouging. According to the maintenance records, since 1984, “… a full cargo door rigging check had not been accomplished.” If an NTSB investigator experienced in maintenance were available, he would have found the gouges to be an item of interest, certainly of a more focused examination.

The most unusual item in the maintenance history, however, was the adjustment of the S-8 switch on December 14, 1988; the NTSB investigator did not give this a second look; the S-8 switch and the gouged pin never made it into the Findings. The S-8 switch was the Hook Close Switch; this switch sequenced the two ‘Pull in’ hooks to rotate over the doorframe pin, which pulled the cargo door flush with the fuselage. If they resembled the B727 main cargo door’s ‘Pull in’ hooks they had duck bill shaped grooves that captured the pin and, as they rotated, pulled the door tight against the doorframe. The locking cams then easily rotated to the closed position, which secured the cargo door in place.

What if the S-8 switch was adjusted incorrectly on December 14th? What if the ‘Pull in’ hooks rotated early or late; would it have captured the pin or, instead, would the hooks have slid behind the pin? Why did the NTSB not assure the S-8 switch had been inspected by a quality control inspector? If it was not, was that a policy violation; a preventable cause? We will never know.

AAR-92/02 was typical of many accident reports reviewed on this site: heavy on the blame but light on the root cause. Later accidents continued to display signs of previous accidents, not because FAA inspectors did not do their jobs, or the industry did not do what’s right but because time and energies were misdirected; opportunities were wasted on inexperienced guess work. Aviation will not become safer when the resources to make it safer are ignored or ill-used.