An observation and question on Kegworth

Date:         02 Dec 96 01:44:33 
From:         "Peter B. Ladkin" <ladkin@rvs.uni-bielefeld.de>
Followups:    1
Next article
View raw article
  or MIME structure

Bill Chivers, a professional pilot in the UK, asked me if I had some
information on the Kegworth accident that he was seeking. Bill
pointed out a feature of the Kegworth accident that I do not know
of a parallel to, namely that the crew misidentified a problem, but
obtained a *false positive* confirmation of their diagnosis. Bill
suggests that obtaining positive confirmation of their diagnosis
in a high-workload situation could easily  have accounted for the
crew's lack of attention to the engine vibration indicators (which the
report criticised as lacking the conspicuity of the electromechanical
originals), whose readings would have alerted the crew that there
was something amiss with the No 1 engine. He also notes that the
autothrottle disengagement caused this false positive confirmation.

Thus the autothrottle design/action caused a false positive confirmation
of a misdiagnosis, which led 15 minutes later to the commander
increasing thrust on No 1, which then failed catastrophically after
nearly 5 minutes of increased-power operation, just before landing
and (in the report's view) too late to spool up No 2. I agree with
him that this is a partial causal chain. [There are of course other
causal factors: the misidentification, the crew failing to cross-check
their diagnosis, partly because of high workload, the high workload
itself partly caused by traffic on the frequency, the crew's need to
coordinate the emergency with company at East Midlands (!!), ATC
routing and instructions. And the relative lack of conspicuity of the
vibration indicators, which told the true story. Not to speak of
the original cause - blade failure - and the possible causes of
that. Or the infernal bad luck to have their mistake brought home to
them just a few seconds before landing, and too late to spool up
No 2. And this is only a partial list.]

I agree with Bill that this false positive confirmation is likely to
have had cognitive consequences for the pilots, which kinds of
consequences we don't yet know much about in aviation psychology.
My question is: is there another example of a computer-related
accident in which a false positive confirmation of a misdiagnosis
figured as a causal factor?

As a definition of `causal factor', I use the counterfactual
conditional: C is a causal factor if, all other things being as
equal as possible, the accident would not have happened had:
	* (if C is an event) C not occurred; or
	* (if C is a state)  C not persisted

I don't read sci.aeronautics.airliners (mea culpa), so please
reply directly to me. I give a brief synopsis of Kegworth below for
those unfamiliar.

Bill's request prompted me to expand the Kegworth section in my
Compendium. The synopsis and Sections 3 (Conclusions) and 4
(Safety Recommendations) are reproduced in their entirety, and
the excerpts from Sections 1 (Factual Information) and 2 (Analysis)
have been corrected and expanded somewhat. I still have in mind to
digitise and format the entire report for the WWW, but as it's
152pp long + Appendices and figures, it's likely to be on my
list of New Year's Resolutions rather than Old Year's Accomplishments.

To summarise what happened: The accident airplane, G-OBME, was
a Boeing 737-400 with CFM56-3C engines. The No 1 engine suffered
fatigue on a fan blade, which caused detachment of the blade outer
panel. There followed a series of compressor stalls for 22 seconds
until the autothrottle was disengaged by the crew, whereupon it
stabilised at a slightly lower running speed, until it suffered an
abrupt loss of thrust some nearly 19 minutes later, 53 seconds
before ground impact, on final approach into East Midlands airport,
due to extensive secondary damage.

The combination of symptoms (shuddering, accompanied by smoke
and/or smell of fire in the cockpit) was outside the crew's
training or experience. They misidentified the problem as occurring with
the No 2 engine, they disengaged the autothrottle and throttled back No
2 to flight idle. The shuddering felt on the flight deck diminished,
because the No 1 engine ceased surging, and this `confirmed' their
mistaken diagnosis of a problem with the No 2 engine. However, the No 1
engine vibration indicator remained on `maximum' for some minutes
afterwards. The report criticised the LED display, which mimics a
`dial' display of the older variety. The crew overlooked the
vibration indication on No 1, attempted a review of their decision
at one point but were interrupted by ATC, and lost thrust on it just
under a minute before impact, and too late to spool up the No 2.

The primary address of `Computer-Related Incidents with Commercial
Aircraft', where the extra Kegworth info has just appeared, is now one
click away from
		http://www.rvs.uni-bielefeld.de
although it will be asynchronously mirrored at the previous address
		http://www.techfak.uni-bielefeld.de/~ladkin/
for a while, and eventually be replaced by a link to the new site.

Peter Ladkin

--
Peter Ladkin, Professor fuer Rechnernetze und Verteilte Systeme
ladkin@rvs.uni-bielefeld.de 	http://www.rvs.uni-bielefeld.de
Snailmail: Universitaet Bielefeld, Technische Fakultaet,
		Postfach 10 01 31, D-33501 Bielefeld, Germany
Tel: +49 (0)521 106-5326/5325/2952, Fax: +49 (0)521 106-2962