The Crash Detectives

by Christine Negroni

  When the Elba accident investigation was concluded, it was joined like a Siamese twin to the tragedy that followed four months later near Stromboli. The report lays out the whole sad story, justifying to the end the decisions by British aviation officials to keep the Comet in the air. Many, including me, would wonder about that. But when I ask those who have studied the history of the Comet, I find few skeptics.

  Of the final decision to let the plane fly after the still-unsolved Elba accident, Graham Simons, aviation historian and author of Comet! The World’s First Jetliner, writes, “It was all that could be done, for no one had any idea what had gone wrong” with the airplane. Hold on to that thought, because Simons has summarized not just the decision to let the Comet fly again, but the kind of risk-benefit analyses airplane manufacturers have been making ever since.

  Deflection

  The single aisle Boeing 737, introduced in 1968, is Boeing’s best-selling airliner and has flown in nine different versions. On March 3, 1991, a United Airlines 737 crashed preparing to land in Colorado Springs, killing all twenty-five people aboard. It had been an uneventful flight until just after 9:43 a.m. Flight 585 was on approach, and First Officer Patricia Eidson was concerned about the turbulence experienced by the plane that had landed ahead of them.

  “I’ll watch that airspeed gauge like it’s my mom’s last minute,” Eidson said to Capt. Hal Green. Indeed, the descent was dodgy, with the plane accelerating and Green complaining how hard it was to hold his airspeed.

  “Wow,” Eidson said, followed twenty seconds later by “We’re at a thousand feet.” The plane rolled to the right, and the pilots tried to regain control. The cockpit voice recorder suggests the captain was adjusting settings for a go-around, abandoning the present landing to go around and try again. The only communication between the pilots makes it clear they realized the plane was going to crash. “Oh God,” the first officer says repeatedly. “Oh no,” Green says the second before impact.

  Investigators thought early on that the rudder, the hinged vertical panel on the tail that swings from side to side to control the plane’s left and right motion, played a role. The week before the accident, two crews who flew the plane reported problems related to the operation of the rudder, including uncommanded movement. In July 1992, as the investigation was under way, a United maintenance worker reported finding an anomaly during a ground check of another 737 in the fleet. “The rudder had the potential to operate in a direction opposite to that commanded by the flight crew,” the airline reported. The main rudder control valve was changed by Parker Hannifin, the company that designed it.6

  Still, after nearly two years studying the evidence, Tom Haueter, the NTSB investigator in charge, could not say conclusively if or how the rudder factored in. The probable cause of the accident was left as one of two likely events: some mechanical problem with lateral control of the aircraft, or an atmospheric disturbance that caused the airplane to enter an uncontrollable roll. From that point on, though, Haueter took notice of any difficulties reported with the 737’s rudder.

  Among the family of Boeing airplanes, the 737’s rudder design was unique in a number of ways. First, since it was smaller than the 727 and the 747, there was not enough room for two entirely separate and redundant power control units. That unit, known by the abbreviation PCU, takes the input of the pilot’s foot on the rudder pedal and converts it through hydraulic action into movement of the swinging panel on the tail.

  Boeing got the plane certified with a novel design that put both control of the rudder and a backup in the same unit. In what was to be a belt-and-suspenders plan, Boeing told the FAA that in the unlikely case of a loss of both primary and secondary rudder control, pilots could still control the movement of the plane with the use of panels on the wings called ailerons.

  But two aspects of the device in operation went unappreciated when the FAA certified the plane in 1967. First, the two cylinders in the PCU were “hand-fitted and mated for life,” according to Haueter. Because the space between the two cylinders was hair-thin, just enough to allow one valve to move within the other, particles trapped between the cylinders could cause a jam that could then make the rudder go in a reverse direction, as when a steering wheel is turned to the right and the car goes left. It wasn’t often, and it wouldn’t happen in all the units. “Some would never reverse,” Haueter said when we talked about the case years later. “Some were extraordinarily sensitive to reversal because of the way they were made.”

  When the rare event did occur, the second unforeseen problem could reveal itself. At slower speeds the ailerons would not have sufficient power to offset the force of the rudder. This was discovered only in 1994, when another Boeing 737 crashed, also under puzzling circumstances.

  On September 8, 1994, USAir7 Flight 427 plummeted from six thousand feet during what was up until that point a normal flight from Chicago to Pittsburgh. The plane was crossing the wake turbulence of a Delta Boeing 727. Suddenly it rolled to the left, surprising both pilots. Then the nose of the plane went down. In his book, The Mystery of Flight 427: Inside a Crash Investigation, author Bill Adair gives a horrifying description of the sensation experienced by the 132 people on board. “It would have felt as if they had reached the top of a roller coaster and were starting the first, huge drop.”

  The pilots pulled back on the yoke, but the left wing remained pointed down, and the plane began spiraling to the left, picking up speed as it fell. From the initial upset to the plane’s crash into the woods just outside Pittsburgh, the event took twenty-eight seconds.

  It was a difficult investigation. Flight data recorders at the time contained just a few details, but no data about the position of the rudder or ailerons. Tests of the components that control the plane’s lateral movement did not reveal any problem that could have caused the plane to act as it did.

  Throughout the investigation, however, Boeing insisted there was nothing wrong with the plane or the rudder. “The rudder was doing what it was asked to be doing,” chief 737 engineer Jean McGrew told investigators in January 1995. McGrew was saying the pilots had mishandled the controls, exacerbating the problem by slamming on the rudder pedal and pulling back on the yoke, effectively stalling the plane.

  Boeing clung to that position for two years. Then, in October 1996, Ed Kikta, a young Boeing engineer, was reexamining data from an earlier test and discovered that a fail-safe mechanism in the rudder control unit did not work as it should. Kikta was simulating a jam when hydraulic fluid began flowing in the wrong direction, which would then cause the rudder to swing in a direction opposite to what the pilot expected.

  After a few hastily arranged follow-up tests, Boeing notified the FAA, agreeing to redesign faulty parts and supply them to 737 operators. Boeing started a campaign to help pilots understand how to react to in-flight upsets. John Cox, a 737 captain for USAir and a member of the accident investigation team, was enthusiastic about the pilot training. But he disagreed with the notion that Boeing would not abandon: the pilots’ actions caused the accident.

  Cox listened to the cockpit voice recorder repeatedly. He told me each time he heard it it was clear the pilots “had no idea what was going on. They never understood what the aircraft was doing or why it was rolling uncontrollably, and they could not stop it.”

  During an interview at the time with John Purvis, who was a Boeing air safety investigator, he took a similar tack, spinning the rudder fix not as a remedy to a problem with the plane but as an additional precaution. He told me, “We’re making a safe plane safer.” I was to hear the same thing two more times over the next fifteen years as Boeing recognized, both times under duress, that its designs could sometimes harbor hazards.

  “Go to the engineering folks. They’ll say, ‘It couldn’t happen, it’s perfect. I understand that,” Haueter told me. It’s like what happens when the police show up and say your straight-A student robbed a convenience store. You’re not going to believe it. Engineers are so embedded into the sy
stem, they know the design so well, they can’t see its flaws.”

  I was working as a correspondent for CNN in 1996 when I got a call in the middle of the night telling me about the crash of TWA Flight 800. It was a Boeing 747 with two hundred thirty people on board that exploded thirteen minutes after taking off from New York on its way to Paris. There had been no distress call, just normal cockpit conversation—and then, wham, the plane broke into three large sections, leaving a long trail of debris in the Atlantic Ocean. Where each of these sections landed would help investigators determine the timeline of events, but not what triggered the blast.

  Federal law enforcement agents were concerned about an act of terrorism, but the tin kickers with the safety board concluded the blast had been triggered by a flaw in the design.

  The 747 jumbo jet and many other models produced by Boeing feature a large fuel tank in the space between the wings—the structural center of the plane. This tank was designed to double as a heat sink for the air-handling equipment located below. But it worked that way only when there was fuel in the tank to absorb the heat. When the tank was empty, there was nothing but fumes, which would heat up as if the tank were a giant saucepan sitting on top of the stove. It could get hot enough to ignite.

  In my book Deadly Departure, I write that the stunning news to emerge from the four-year probe into the disaster was that this flammability problem was well known. Engineers at Boeing, some of the airline’s customers, and federal air safety regulators had been discussing it for thirty-five years, because of a number of similar events beginning in 1963. In those cases, Boeing concentrated on locating the specific ignition source rather than the greater hazard of operating with a fuel tank in an explosive state.

  Studies carried out as part of the Flight 800 accident probe showed that fuel tanks with heat-generating devices below them can be like ticking time bombs as much as one-third of the plane’s operating time.

  In the 1960s and ’70s, safety officials asked for devices to be installed in fuel tanks to preclude the possibility of explosion by eliminating the oxygen, a necessary component of fire. During the development of the 747, Boeing even tested some systems specifically designed to do this. The manufacturer ultimately dismissed the idea, however, citing concerns about the additional weight.

  The recommendations for protecting the fuel tanks emerged repeatedly over the decades, but the FAA accepted Boeing’s position that if the triggers for the explosion could be identified and fixed, the design would be safe enough. What the TWA 800 disaster showed was that there would always be unknown triggers. We would have to call them the “known unknowns.”

  In 2006 the U.S. Department of Transportation issued a new rule: all new airplane designs had to include a system to protect the tank from explosion. Boeing’s newest airplane, the 787 Dreamliner, incorporates a fuel tank explosion-prevention system that is a direct result of the TWA crash investigation.

  So it is ironic that after just fourteen months in service, the 787, which had already secured its place in the pantheon of revolutionary aircraft, was gracelessly sidelined for four months in 2013 because of a risk of fire and explosion from the plane’s lithium-ion batteries.

  The designers of the Dreamliner and the Comet shared an overconfidence in their creations. “The Comet embraced new technologies before they were fully understood,” Graham Simons, the author of Comet, told me. “With the Dreamliner, Boeing pushed the same limits. They seem to have forgotten when you push the envelope, you open a greater area of risk.”

  Fever Dream

  Among Boeing’s worldwide customer base, there are few as loyal as Japanese carriers Japan Airlines and All Nippon Airways. ANA effectively launched the 787 Dreamliner by placing the very first order for fifty of them in 2004. Ten years later it remained the largest 787 operator.

  There was much national pride in the 787 because of the number of Japanese companies making parts for it. Fuji Heavy Industries, Mitsubishi Heavy Industries, and Kawasaki Heavy Industries all turned out pieces that were shipped to Boeing’s American assembly plants.

  While these giants of Japanese industry made the big parts, in Japan’s historic former capital of Kyoto, battery manufacturer GS Yuasa was churning out a much smaller and more obscure component that was on the cutting edge of transportation power systems. Lithium-ion batteries the size of a bread box and the weight of a dorm refrigerator were to ignite the biggest issue in aircraft design since the Comet.

  The first time I saw a Dreamliner outside the factory, it was on its six-month world tour. The aircraft arrived at Bole International Airport in Addis Ababa in December 2011. Ethiopian Airlines captain Desta Zeru, dapper in a forest green uniform, was at the controls for the first flight of the new airliner into the African continent. Ethiopian was a launch customer, with ten 787s on order. Ethiopian was also a new member of the Star Alliance, the world’s largest network of airlines, so the airline hosted a three-day extravaganza to celebrate. Boeing created a large meeting space on board the airplane and invited reporters in for a press conference and look-see.

  Of course, everybody was delighted to have the plane on display. Three years late to customers, the plane was sometimes called the seven-late-seven, and Boeing had had it up to here with criticism of its inability to set a delivery date and stick to it.

  In late October 2011, however, when the first Dreamliner began revenue flights for All Nippon Airways, the game-changing airplane was changing headlines, too. “The engines purred rather than roared.” Travelers were “agog.” The engines “sipped fuel,” and the passenger cabin “glowed,” and that’s just one review8 from among thousands written in a similar vein once the plane actually started flying. President Barack Obama called the Dreamliner “the perfect example of American ingenuity.”

  The Japanese are enthusiastic air travelers, and they embraced the Boeing 787, too. Kenichi Kawamura is a policy adviser to his father, a Japanese political official in Tokyo. His job required him to commute by air each week between his home in Yamaguchi and his father’s office. A self-described aviation enthusiast, Kawamura knew he was traveling on a special airliner on January 16, 2013.

  Eighteen minutes into the ninety-minute flight on ANA’s Flight 692 to Haneda Airport, the Boeing 787 Dreamliner nosed down precipitously. Kawamura grabbed his drink moments before it would have tipped off his tray table. He had never experienced such a rapid shift. “It was a sudden fall and very steep,” he told me. Looking at the flight profile, an experienced airline pilot described it as being like riding in the backseat of a car racing down a highway and then suddenly having the driver hit the brakes.

  “Then there was a smell like plastic burning,” Kawamura said. The flight attendants were walking up and down the aisle purposefully, collecting the cups and bowls in which they’d recently served miso soup. As an attendant approached his row, Kawamura started to ask what was going on, but then stopped as a voice came on the PA. “This is the captain,” Kawamura remembers hearing. In fact, it was the forty-six-year-old first officer, one of the airline’s very first pilots to be certified to fly the Dreamliner.

  “We have smoke, we smell smoke,” Kawamura remembers being told. “We must make an emergency landing.” That much was already clear. Kawamura was heartened to hear the pilot say that instruments in the cockpit indicated that there was no problem.

  In truth, the pilots were worried that the flight instruments were giving bad information. As soon as the first officer was finished with the announcement, he told air traffic control that there was “thin smoke, possibly by an electric fire.” The main battery had failed. The pilots wanted to land as “soon as practicable,” he said.

  The drama for the flight crew began sixteen minutes into the flight, as they were taking the plane through thirty-two thousand feet on the way to leveling off at forty-one thousand feet. Voltage dropped in the main battery used to provide emergency power in case of the loss of other systems. It was not a subtle decline, either, falling from thirty-o
ne volts to eleven volts in ten seconds. The pilots were unaware of this, though. Their first alert was an advisory that emergency floor and exit lights had come on in the cabin.

  The first officer had only moments to wonder what might have triggered the lights, because everything seemed to be working fine. Then he smelled something burning.

  Pilots adopt an air of bravado about their work. But if there is a kryptonite for aviators, it is fire. That’s a “no-shit problem,” Capt. James Blaszczak, the retired Dreamliner captain, told me in reference to how the ANA crew would have reacted.

  Nine days earlier, a Japan Airlines Boeing 787 (JA 829J) with just 169 flight hours and 22 landings was parked on the ramp at Boston’s Logan International Airport when a maintenance worker called the airline’s station manager, Ayumu Skip Miyoshi, reporting “smoke inside the cabin.”

  At first Miyoshi was confused. “So you mean one of the passengers smoked in the lavatory?” he asked. “Smoke inside the aircraft cabin” was the reply. Miyoshi hurried out to the tarmac, and as he approached, another maintenance worker was running toward the plane with a fire extinguisher in his hand. Smoke was billowing out of the electronics bay. When firefighters arrived, they said the battery was hissing, sputtering, and popping as flames leapt from the connectors on the blue battery case. It took an hour and forty minutes to get the smoke under control. The contents of the battery box continued to burn until all the fuel feeding the fire was exhausted.

  Every operator of the Dreamliner heard about the Boston event within minutes. I was interviewing former American Airlines chief Robert Crandall at his Florida home when his wife interrupted us with the news. CNN was carrying the story live. Forty-seven airlines around the world had already ordered the airplane. If Crandall’s reaction was typical of other aviation executives, they were all glued to their TV sets.