16 Human Factors Incident Reporting

Aeronautical Information Circulars

Introduction

From time to time the Civil Aviation Authority issues Aeronautical Information Circulars (AlCs). If the CAA should change the requirements then an amendment will be issued during your course.

It is the responsibility of the individual pilot to check with current national AlCs on a regular basis.

Staines Trident Accident 1972

A Case Study

This tragic accident incorporates a number of human factor aspects. Among these are personal relationships, personal conflict, health, stress, ergonomics, design, crew cooperation, non standard procedures and cockpit warnings. Perhaps the reader is able to identify others.

Background - the Organizational Environment in BEA at theTime of the Accident

At the time of the accident there were several disputes ongoing involving the pilots in BEA (British European Airways). Firstly, the Training First Officers were ‘working to rule’ in demand for better pay and conditions in line with their extra training responsibilities. These Senior First Officers were responsible for training new recruits in the Flight Engineer’s (P3) position. As they were working to rule they were refusing to undertake these duties, so many of the new pilots recruited by BEA were not checked out in this position and as a result they could not actually act as a crew member on a revenue-earning flight in the P3 position.

Reporting Incident Factors Human 16

Schematic of the Trident Flight Deck

Jeremy Keighley was one of these pilots. He had less than 250 hours on type and was only qualified in the P2 position (the Training Captains were not working to rule). Simon Ticehurst was also a relatively inexperienced pilot but he had about 1500 hours and was qualified to fly in both the P2 and the P3 position. As a result, Ticehurst, although the most experienced of the copilots, was flying in the Flight Engineer’s position. This was quite normal at this time.

In an attempt to circumvent the problems of the industrial dispute involving the training of First Officers, BEA were rostering crews in such a way as to avoid giving in to their demands. It also needs to be noted that at the time of the accident there was a huge increase in the demand for

316

Human Factors Incident Reporting 16

air travel. As a result, airlines could not actually train new pilots quickly enough, hence many aircraft were being crewed by relatively inexperienced pilots in the P2 and P3 position.

To add to BEA’s misery, on the following day (a Monday) there was scheduled a worldwide strike of all pilots affiliated to the Association of Airline Pilots (the British Association of Airline Pilots is the UK body). This caused a massive increase in the number of people flying on that Sunday in an attempt to avoid the effects of the dispute. In the UK all BALPA pilots would be on strike. However, many pilots in the UK belong to GAPAN (the Guild of Air Pilots and Air Navigators). GAPAN was opposed to taking industrial action, and the relationships between BALPA and GAPAN members in BEA at the time were distinctly ‘cool’.

The People

Captain Stanley Key was in charge of the flight. He was a staunch GAPAN member and was totally opposed to the decision to strike on the following day. He was extremely experienced, both as a pilot on the Trident and as a Training Captain. Key could best be described as an ‘old fashioned’ pilot. Ex-RAF, he was equipped with the ‘right stuff’. He flew that aircraft ‘by the book’ and was extremely intolerant of anyone who didn’t get everything absolutely correct. He also had a temper. His explosions were famous throughout BEA (which involved violent verbal outbursts, massive increases in blood pressure and a marked change in facial colour). His outbursts when supervising trainee pilots were well known throughout the company. Unbeknownst to anyone at the time of the accident, Key was also suffering from arteriosclerosis. Many of the arteries in his heart had actually narrowed to around 50% of their normal width. This had not shown up on his annual ECG as these were conducted at rest. Stress ECGs which would have shown up such a defect were not being used by the regulatory authority as trial had shown that they produced too many false positive results. At the time of the accident, Captain Key’s life expectancy was already quite short (being measured in months rather than years).

Jeremy Keighley was a Junior Second Officer in BEA and was very inexperienced, both as a pilot as a whole and on the Trident aircraft. He was one of the pilots who was a victim of the industrial dispute and was only qualified to fly in the P2 position. He had still to complete his training as a Flight Engineer. He was shy and retiring and was not prone to coming forward with his opinions. During his training he had been criticised as being slow to react and lacking initiative. His reports suggested that he would need careful, patient coaching to get the best out of him and should not be pressured during his training. Keighley also shared a house with another Junior Second Officer who had recently flown with Key and had been subject to one of his outbursts when he made a mistake on the flight deck during the flight.

Simon Ticehurst was occupying the Flight Engineer’s (P3) position for the flight. He had 1000 flying hours to his name, 750 of which were on Tridents. He was described as a very capable and thoroughly reliable young pilot.

TheTrident Aircraft

The Trident had several ‘interesting’ design characteristics that were probably implicated in the sequence of events leading to the accident. Perhaps the most critical of these was a tendency to ‘deep stall’.

It was a three-engine aircraft, with all the engines mounted in a group around the tail. While this had aerodynamic advantages (it allowed for a very ‘clean’, aerodynamically-efficient wing and it also reduced the tendency of the aircraft to ‘swing’ during take-off should it lose an engine) this configuration also allowed the possibility of a deep stall. As the aircraft approaches the stall it flies with an increasingly nose-up attitude. Deep stalls occur when the turbulent air from the

Human Factors Incident Reporting 16

317

16 Human Factors Incident Reporting

Reporting Incident Factors Human 16

wings enters the engine air intakes causing the engines to flame out. Most aircraft also drop nose first after the stall, allowing them to gain flying speed and ‘fly out’ of the problem. Not so the Trident. The Trident dropped tail down. These characteristics made recovery absolutely impossible as all the aerodynamic control surfaces were ineffective due to the lack of airspeed. With turbulent air in the engine air intakes it was also impossible to restart the engines. The prototype Trident had been lost in just these circumstances, killing all of the flight test crew on board.

STALL

Engine intakes within turbulent flow - engines flame out

DEEP STALL

Engine intakes and stabilizer within turbulent flow - engines flame out and aircraft is uncontrollable and irrecoverable.

In an attempt to avoid the aircraft entering a deep stall, the Trident was equipped with a stick pusher system which activated when the aircraft approached the aerodynamic stall. The stick push system was a pneumatic system that operated on the pilots’ control columns pushing the nose of the aircraft down if the crew failed to respond to the stall warnings. Pressure in the stick push system could be ‘dumped’ by pulling a lever on the Captain’s side of the central pedestal. A small amber light illuminated in the case of a lack of pressure in the stick-push system. This was located on the pedestal near the levers controlling the flaps and droops.

The Trident also had a very efficient wing optimized for high speed flight. Unfortunately, it was not so efficient at low speeds, so for take-off and landing it was equipped with flaps (on the trailing edge) and droops (on the leading edge). Flaps were normally retracted at about 185 kt but the droops (also known as ‘slats’) could not be retracted below about 225 kt. Below 225 kt the Trident’s ‘clean’ wing could not produce enough lift to keep the aircraft in the air (i.e. it would enter a stall). Both the flaps and droops produced a great deal of low speed lift but they also produced a lot of drag.

The flaps and droops were controlled by two (almost identical) levers located on the co-pilot’s side of the pedestal. If the flaps and droops were deployed as a safety measure, the droops could not be retracted unless the flaps had first been fully retracted. Unfortunately, as flaps were normally retracted at about 185 kt, the droop lever was effectively unguarded between

318

Human Factors Incident Reporting 16

this speed and droop retraction speed (at 225 kt). Above 250 kt the droops could not be extended as the air pressure would be so great as to rip them from the wing. In an attempt to guard against retracting the droops below 225 kt or leaving them extended about 250 kt, there was an amber ‘droops out of position’ warning light in the cockpit. Unfortunately it did not actually tell you if the droops were retracted when they should be extended or vice versa. It just told you that they were not in the correct position for the indicated airspeed. This amber light was located next to the warning light advising the crew of a lack of pneumatic pressure in the stick push system.

The Run-up to the Flight

During the months before the flight there had been various flight safety bulletins promulgated throughout BEA advising pilots that it was totally unacceptable to perform flapless take-offs in the Trident (using only the droops). Several pilots were known to do this, as although it increased rotation speed at take-off, a far better climb performance could be attained. Unfortunately, as a result of the design of the Trident’s cockpit and ingrained habits, on several occasions after performing a flapless take-off, as normal flap retraction speed was approached, the Captain still called for flaps, at which point the First Officer immediately retracted the droops! On all occasions the Flight Engineer had noticed and reversed the droop travel before the aircraft fell out of the sky.

Furthermore, several days before the fateful flight the aircraft they were using underwent routine maintenance. During this maintenance visit the stick pusher system was overhauled. Unfortunately on reassembly the mechanic left out a small lock washer. This has the effect of very occasionally letting the pneumatic pressure in the system drop for a fraction of a second before recovering its normal pressure.

The Day of the Flight

Sunday 18 June 1972 was a typical British summer flying day; wet and windy with poor(ish) visibility. In the hours before the flight there was a great deal of pressure on the check-in staff, baggage handlers and everyone at Heathrow due to the number of passengers flying that day in an attempt to avoid the consequences of the strike on the following day. In the hour or so before the flight Captain Key was speaking at a pilots’ meeting in an attempt to persuade his colleagues not to strike on the following day. He failed. Unfortunately, another pilot made some sort of comment to him just after the meeting about his lack of success, at which point Key had one of his famous explosions, turning all the colours of the rainbow and entering into a full and frank (if one sided) discussion of the situation with this other pilot. Keighly and Ticehurst were close by and witnessed the tirade.

Immediately after this outburst Key seemed to be in some discomfort. The problem seemed to be centred around his chest. It now seems likely that at this point he had a minor heart attack.

The Flight

While loading the aircraft there were a few problems. At the last moment space had to be found for a crew of a Vanguard freighter so that it could be brought back from Brussels before the strike. This put a little extra pressure on the crew at the last moment as they had to redo the passenger manifest and all the weight and balance calculations. However, the Trident pushed back from the gate approximately on time and began the taxi out.

From this point onwards a great deal of what happened is supposition. The aircraft was only equipped with a rudimentary Flight Data Recorder. There was no Cockpit Voice Recorder so many of the actions and thoughts of the crew are unknown.

Human Factors Incident Reporting 16

319

16 Human Factors Incident Reporting

Reporting Incident Factors Human 16

During the taxi out there seemed to be a problem. It is likely that the warning light on the stick pusher system kept illuminating as the aircraft bounced over the ridges in the taxiway. As a result the line-up of the aircraft on the runway was delayed. However, eventually the decision was made to line up and take off.

The take-off run was normal, with rotation at 139 kt and unstick at 145 kt. The gear was almost immediately retracted and the V2 (single engined) safety speed was passed at 152 kt. At 170 kt the autopilot was engaged. Unfortunately, slightly the wrong speed was set in the autopilot box. It should actually have been 177 kt, but even at this reduced climb speed there was still a safety margin (although somewhat reduced.) Captain Key was a stickler for procedures. However, it was noted that the autopilot was engaged very early and Key’s radio transmissions were terse and non-standard. Ninety seconds after commencing the take-off run was ‘noise abatement’ time, which required the pilots to throttle back the engines so as not to disturb the residents local to Heathrow. At this point the engines were throttled back as required. The flaps were also retracted, as was normal. By now, because of the reduced thrust from the engines, a turbulent day and an incorrect target speed being set in the autopilot, the aircraft was having difficulty maintaining its speed in the climb.

At times the climb speed dropped to about 157 kt, 20 kt below target. No one seemed to notice. It was suggested that as a result of the combination of Key’s general attitude and his specific demeanour as a result of this outburst and Keighly’s quiet, retiring nature and his general lack of confidence, the latter was disinclined to mention this. Key also may have been distracted by his chest pains. However, the climb continued.

For some reason that will never be established, around this time the droop lever was operated, retracting them. It was likely that Keighley did this as it was on his side of the cockpit. One theory is that the stick push warning light illuminated and that this was mistaken for the ‘droop out of position’ light. Another theory was that Key was so distracted by his chest pains that he associated the low airspeed with flap drag and either retracted what he thought was the flaps himself or asked Keighley to do it. Nevertheless, the droops were retracted while the aircraft was only flying at about 162 kt. The Trident entered the stall regime.

Shortly after the droops retracted, the stall warning went off and the stick push system operated, pushing the aircraft’s nose down to regain flying speed. This would have automatically disconnected the autopilot and triggered a whole series of warnings in the cockpit (stall warning; autopilot disconnect; master warning; and the stick push operating). Sometime around this point Key had another, larger, heart attack where his heart muscle actually separated due to the blood pressure in a ruptured arteriole. He may not have been incapacitated but he would certainly have been in great pain. As the nose dropped, one of the pilots pulled back on the column in an attempt to hold the aircraft level. It stabilized at around 177 kt in a slight descent. No attempt was made to redeploy either the flaps or the droops. The climb was then reinitiated by pulling back on the column. The stall warning and stick push operated for a second time. Again the crew attempted to hold the aircraft level instead of diving the aircraft, applying power and deploying the high lift devices. The third time the stick push system operated it was overridden by dumping the pressure in the system (remember that the crew may have thought that it was faulty as a result of the previous warnings). It is likely that Key did this as the override was on his side of the centre pedestal. By now airspeed had increased to around 193 kt as a result of being in a shallow dive but for some reason the aircraft was reestablished back into the climb once again. Airspeed decayed to about 175 kt and it entered the stall, followed shortly after by adopting a 60° nose-up attitude (as the Trident was prone to do in these circumstances). This led to the aircraft entering a deep stall from which there was no recovery. The aircraft’s altitude at this point was 1275 feet (AGL) and it was travelling at no more than 54

320

Human Factors Incident Reporting 16

kt. The Trident fell out of the sky in a flat spin, crashing next to the A30 near Staines Reservoir. All 118 passengers and crew on board were killed in the impact.

SomeThoughts

Was the system designed for minimum risk? It can be argued that the Trident was a fundamentally unsafe design as it had an inbuilt capacity to lapse naturally into a dangerous, irrecoverable situation (the deep stall).

Were appropriate automatic safety features installed in the aircraft and implemented in the correct manner? For example the stick push? It can be argued that the lack of a speed lock on the droops was an automatic safety device that should have been present. There is nothing worse than an unreliable safety device that gives out false warnings. This leads operators to mistrust these systems and potentially be inclined to ignore or override them.

Were the warning systems implemented in an appropriate way? Consideration of the position of warning lights on the stick push system and the ‘droops out of position’ warning etc. What about the cacophony of warnings and alerts when the aircraft began to stall? Should these have been better prioritized?

Were there appropriate procedures in place? The lowest level of system fix to be employed only when all the above cannot be used. Were there appropriate procedures for the selection and training of aircrew? Was the procedure to circumvent the industrial dispute one which promoted safety? Was it appropriate to use an inexperienced P2 and P3 on a flight? Should Keighley have been ‘selected out’ in the training process? Should Key have been selected as a Training Captain? What about the inspection procedures in the maintenance hangar?

If possible, each factor in the accident should be assessed as being either causative or contributory. A causative factor is an item in the accident chain, which if it were removed would have stopped the accident from happening. A contributory factor is one which, from knowledge of the human operator, ‘would not have helped’. This is not an easy thing to do but can be informative if you need to prioritize actions.

With thanks to Dr Don Harris, Human Factors Group, College of Aeronautics, Cranfield University

Human Factors Incident Reporting 16

321

16 Human Factors Incident Reporting

Reporting Incident Factors Human 16

322