Forces of Nature: The crash of Garuda Indonesia flight 421
On the 16th of January 2002, a Garuda Indonesia Boeing 737 flew into a severe thunderstorm over the island of Java. As the pilots battled howling wind, driving rain, and pounding hail, both engines rolled back simultaneously. When the crew attempted to restart them, the plane lost all electrical power. With almost no instruments, no radios, no lights, and barely any flight controls, the plane emerged from the clouds just a few thousand feet above the ground — and the airport was nowhere to be seen. With just seconds to decide where to land, the captain managed to bring the plane down on a narrow stretch of the Bengawan Solo River, threading the needle between two bridges that stood just 1,500 meters apart. The tail struck the rocky river bottom and was ripped away, killing a flight attendant, but the rest of the plane ground to a halt intact against the bank, saving the lives of the other 59 passengers and crew. Against the odds, the pilots had saved the day — but by rights they shouldn’t have needed to. The plane’s engines were rated to withstand almost any conceivable storm, and even if they shut down, the pilots should have been able to restart them later. It would be up to investigators to piece together what went wrong.
Garuda Indonesia flight 421 was a regularly scheduled domestic flight from the city of Mataram on the island of Lombok to the major Javan city of Yogyakarta (pronounced Jog-yakarta). Like many other flights with Indonesia’s flag carrier, the airplane of choice for this route was the Boeing 737, the most popular passenger jet in the skies.
Indonesia relies heavily on air travel to connect its hundreds of scattered islands, but the tropical archipelago can present all kinds of dangers for airplanes, particularly severe weather. January falls during Indonesia’s rainy season, which has been known to produce some of the most intense thunderstorms in the world. Navigating around these storms was a daily chore for the pilots who were scheduled to carry out flight 421 on the 16th of January 2002. If there was anyone who could be trusted to do it, it might have been Captain Abdul Rozaq. He worked his way up from selling fruits on the streets of Jakarta to flying for Indonesia’s national airline by proving himself through hard work: of thousands of applicants, only a handful received prestigious scholarships to go to Garuda’s flight school, and he was among them. Now, decades later, he had accumulated 14,000 flight hours and was one of the most senior pilots at the company. His first officer, Harry Gunawan, had a very respectable 7,000 hours of his own.
Flight 421 was lightly loaded that day, with 54 passengers and six crew filling the 737 to a little under half capacity. At 8:20 a.m. UTC (4:20 p.m. local time), the flight departed Lombok International Airport in the Mataram suburb of Ampenan, headed west to Adisucipto International Airport in Yogyakarta. Flight 421 proceeded normally until around 9:10 UTC, shortly after leaving its cruising altitude of 28,000 feet. It was at this point that the pilots observed a line of powerful thunderstorms between their position and the airport. These huge cumulonimbus clouds stretched up to 62,000 feet, high into the stratosphere, and the only way to avoid them was to try to find a weak spot to go between the cells. Having already entered the cloud cover, they would need to rely on their on-board weather radar to determine the path of least resistance.
The radar showed several areas of intense precipitation indicated in red, with three gaps displayed in green: one to their right, one to their left, and another even farther to the left. Captain Rozaq was familiar with the area and believed that the first gap to the left would be the most convenient. The gap farther to the left went through restricted military airspace and he would need special permission from air traffic control to enter it. The gap to the right was less direct, but it also had a much more material problem: a 9,500-foot volcano called Mount Merapi, which would lie close to their approach path if they tried to go that way — a major liability considering that they were already cleared to descend to 9,000 feet. The best choice was therefore to head for the middle gap. After informing the controller that they were detouring to avoid weather, the pilots estimated that they would arrive over a waypoint called PURWO at 9:22. Little did they know that this would be their last communication with ATC.
Captain Rozaq and First Officer Gunawan thought they were flying into a gap between the thunderstorm cells, but they had actually fallen victim to a trick as old as radar itself. The 737’s radar system detects the intensity of precipitation by sending out an electromagnetic pulse and measuring how much energy bounces back. A more intense return signal means more intense precipitation is deflecting the radio waves. But if the precipitation within a storm is sufficiently heavy, the radio waves can be completely deflected without fully penetrating the storm. This leaves a radar shadow: a zone behind the point of deflection which is displayed as clear, because there is no signal returning from that area. Unlike an actual clear area, where the signal fails to return because there is nothing to bounce off of, this area appears clear because no signal can enter it in the first place. The “gap” that Captain Rozaq had selected was actually a radar shadow, an area where the precipitation was so intense that his radar couldn’t penetrate it.
As soon as flight 421 entered this phantom gap, the gap disappeared and was replaced by a sea of red on the weather radar. Seemingly out of nowhere, powerful turbulence rocked the plane, and torrential rain slammed against the windscreen. Small hailstones pounded the fuselage by the thousands every second. The pilots struggled to maintain control of the plane as violent winds threw it up and down and side to side, and they could barely hear each other over the unholy din of the hail. This was by far the most intense storm that they or their passengers had ever seen. So dense was the concentration of hail that it set off the ground proximity warning system, which began to blare, “TERRAIN! TERRAIN!” as the plane descended through 18,000 feet.
Barely a minute after entering the storm, the engines were already straining to stay lit amid the violent atmospheric onslaught. When an engine ingests water and ice along with air, the effective density of the air increases, and the engine has to work harder to produce the same amount of thrust. As more and more rain and hail poured into the engines of flight 421, the volume of water inside the engines became so great that they were unable to sustain combustion. The engines began to lose power, and within 90 seconds of entering the storm, they both flamed out simultaneously.
The loss of engine power also caused a loss of electrical power as the generators in the engines stopped running. The lights flickered and went out, while essential systems like Captain Rozaq’s instruments were rerouted via the emergency bus to the airplane’s battery. Everything that couldn’t be powered by the battery stopped working, including the hydraulic pumps that move the flight controls. All the controls went into manual reversion, connecting the control surfaces directly to the yoke with no hydraulic assistance. With the cockpit bathed in the dim glow of the instrument panel, Rozaq called for the engine relight procedure, an item which both pilots had memorized in training. First Officer Gunawan set up the engine and flipped the ignition switch, but nothing happened. There was still too much water inside the engines to initiate combustion, and although neither pilot knew it, restarting the engines would be impossible as long as they remained in the heart of the storm.
After the first attempt, Rozaq called for the relight sequence again. But after a minute passed and the engine didn’t light, it seemed to him that the process wasn’t working. (Although he should have waited three minutes per the manual, this would have made no difference in the actual outcome.) Furthermore, if they kept trying unsuccessfully to relight the engines off of battery power, they would drain the battery, and then they would be in real trouble. Rozaq therefore instructed Gunawan to start the Auxiliary Power Unit, or APU, a generator which would provide electrical power to all aircraft systems and enable more restart attempts.
Rozaq and Gunawan were unaware that they were already in real trouble. The battery on this 737 had been degrading for some time. Long before flight 421, corrosion caused the battery’s temperature sensor to separate from the battery. Without a temperature sensor, the battery’s protections against overheating couldn’t function, and in the months or years that followed, the battery repeatedly overheated due to overcharging. The battery is made up of more than a dozen individual cells that together can produce an electrical potential of 24 volts, but due to the repeated overheating, cell #12 — located in the hottest part of the battery — split open shortly before flight 421, causing its supply of electrolyte to escape. This dropped the overall potential of the battery from 24 volts to 22 volts. The pilots had noticed that the battery was showing a lower voltage than normal before the flight, but 22 volts was not quite low enough for the battery to be considered faulty, so they thought nothing of it. What they didn’t know was that at 22 volts, the battery would not be able to supply sufficient power for two engine relight attempts and still start the APU. When the battery’s charge decreases due to current draw, the voltage that it can provide also decreases. The two back-to-back engine restart attempts dropped the voltage below 18 volts, but APU ignition required more current than 18 volts could deliver.
When First Officer Gunawan flipped the switch to start the APU, the voltage dropped to 12 volts, too low to power the emergency bus; as a result, the plane’s entire electrical system failed. Captain Rozaq’s entire instrument panel went dark, leaving him with three analog standby instruments just above the center console: a tiny attitude indicator, an airspeed indicator, and a magnetic compass. Both radios failed along with the plane’s transponder. At the air traffic control center in Yogyakarta, flight 421 dropped off the secondary radar displays; the controller began calling the flight to ask for its position, but there was no reply. On board the plane, passengers could hear First Officer Gunawan shouting “Mayday, mayday!” over the radio, but he might as well have been screaming directly into the howling void.
With no battery power, there was no way to start the engines or the APU — they would be forced to make a dead stick landing somewhere in central Java. But with no radios and no navigation equipment beyond a simple compass, the pilots had no way of determining their position while unable to see the ground. Rozaq and Gunawan found themselves helpless, able to do little more than hold the plane level as it dropped through the storm at a rate of 4,000 feet per minute. In the absence of any further measures that would help their situation, they prayed to god for salvation.
After what seemed like an eternity, the plane suddenly emerged from the storm at an altitude of 8,000 feet, and the rain and hail disappeared as quickly as they had come. From this height, the pilots would have less than two minutes to pick a landing spot and line up for an approach. Based on visible landmarks, they determined that they were somewhere to the south of Surakarta city, but Surakarta’s airport was behind them and out of range. Ahead of them lay a sprawling plain covered with thousands of rice paddies, which could not possibly provide a safe landing surface. But bisecting the plain was the narrow Bengawan Solo River, which in this area was only just beginning its journey to the sea. The water was a couple meters deep at most, and only about twice as wide as the 737’s wingspan with overhanging trees, but the pilots saw no better option. Wrestling with the heavy and sluggish manual controls, Captain Rozaq fought his way through a nearly 360-degree turn to line up with the only straight stretch of river he could find.
His target was a section of river near the village of Bulakan, about 1,500 meters of tree-lined water sandwiched between two bridges and a stretch of rocky rapids. Coming in low over the first bridge, Captain Rozaq pulled back and slowed, and the plane slammed into the water with a heavy thud. Traveling at 300 kilometers per hour, the 737 bounced off the rocky river bottom, ripping out the floor in the tail section. In a flash, the rear galley, one of the toilets, the APU, the flight recorders, and the flight attendants’ seats flipped underneath the tail and disintegrated, instantly killing one of the flight attendants and seriously injuring her seat mate as they were crushed against the river bed. The plane continued on without them, shuddering and shaking as it went, ripping seats out of the floor and showering luggage out of shattered overhead bins. Then, after just a few harrowing seconds, the plane ground to a halt against the right bank of the river, with a few holes in the floor and a detached engine, but otherwise intact. Although there were several serious injuries and a flight attendant was dead, Captain Abdul Rozaq and First Officer Harry Gunawan had brought their crippled plane down in one piece, saving the lives of 59 out of 60 passengers and crew.
The rescue of the passengers proved to be a delicate affair. Although most of the passengers managed to exit the plane through the right side and wade to shore, a number of people had suffered serious injuries that prevented them from escaping, and some method needed to be found to extract them from the plane. Under the direction of Captain Rozaq, a fisherman managed to carry out one injured passenger using the overwing exit door as a makeshift stretcher. Local residents drove injured passengers and flight attendants to hospitals in Surakarta using their personal vehicles. After making sure everyone had been evacuated, Captain Rozaq called the Garuda operations center on his mobile phone to let them know what had happened — at that point, all they knew was that the plane had dropped off radar and reportedly landed on a river somewhere in Central Java. Only now, two hours after the crash, did emergency services finally arrive at the scene.
Investigators from Indonesia’s National Transportation Safety Committee (KNKT) were keen to understand why a 737 had lost both engines in flight — and so was the American NTSB. The first question was why the engines flamed out at all.
It was already known that severe precipitation could cause an engine to flame out, because it had happened before. Three such incidents occurred on the 737 in the late 1980s, including the infamous 1988 emergency aboard TACA flight 110. In that case, a 737 with 45 passengers and crew aboard was inbound to New Orleans on a flight from Belize when it flew through a severe thunderstorm over the Gulf of Mexico. Both engines ingested hail and flamed out; the hailstones damaged the engines beyond hope of restarting, and the pilots ended up making a spectacular dead stick landing on a levee in the Mississippi delta. A similar dual engine failure occurred on an Air Europe flight in 1987, and a Continental flight in 1989 also lost one engine under similar circumstances. After these incidents, CFM International redesigned several aspects of the CFM-56 engine to make it less susceptible to heavy precipitation, including changing the shapes of the spinner and fan disk to make them deflect hail away from the core. The Federal Aviation Administration also required jet engines to continue to operate under an atmospheric precipitation-to-air ratio of 10 grams per cubic meter, a volume which could safely be considered torrential. So why didn’t these modifications prevent the crash of Garuda Indonesia flight 421?
Investigators used several pieces of data to try to estimate the volume of precipitation encountered by flight 421 at the moment the engines failed. By correlating the rate of excess fuel flow to the engines with fluctuations in the sound of the hail on the cockpit voice recorder, in combination with the fact that the density of the hail set off the ground proximity warning system, they were able to derive a figure of approximately 18 grams of precipitation per cubic meter of air (most of which was hail) — nearly twice what the engines were certified to withstand. In fact, the British Air Accidents Investigation Branch, which analyzed the CVR, said that the precipitation on flight 421 was the most intense ever recorded from on board an airplane as far as they were aware. Finally, tests conducted by engine manufacturer CFM International showed that in practice, a CFM-56 engine will flame out at a precipitation volume of 17.8 grams per cubic meter — exactly where the engines gave up the ghost on flight 421. There was nothing wrong with the engines or the method by which they were certified: instead, the ill-fated flight had flown into a downright biblical hailstorm which overwhelmed all the protective systems.
A teardown of the engines revealed that no damage occurred prior to impact, and that both engines could theoretically have been restarted. Only after examining the aircraft’s battery did investigators understand why the pilots were unable to do so. The damage to the #12 cell caused the battery’s voltage to drop to near the bottom of the acceptable range, where it was unable to provide enough power to conduct two engine restart attempts and still start the APU. The pilots couldn’t have predicted that their actions would drain the battery because they didn’t know both of their relight attempts would fail, nor did they know exactly how many volts each attempt would require. When First Officer Gunawan flipped the switch to start the APU, he certainly wouldn’t have looked at the battery voltage before doing so — nor would it have mattered, because by that point the battery no longer had enough power to do anything useful anyway. After the battery failed, the plane became a very expensive lump of metal with good aerodynamics but not much else going for it. Only due to Captain Rozaq’s quick thinking was a catastrophic crash into a rice field or a village prevented. However, it also had to be noted that proper procedures advised the crew not to hesitate before starting the APU during a dual engine failure scenario. Had they started the APU first, further restart attempts would not have been conducted off the battery, and they probably could have relighted the engines and landed safely after exiting the storm.
The last remaining area of inquiry was the pilots’ decision to fly into the storm in the first place. The gap that they thought they saw turned out to be a radar shadow, and the two real gaps on either side of it contained various obstacles that made them seem less appealing. But radar shadowing was a well-known phenomenon, and the pilots actually might have been able to detect it if they had received better training on how to use their radar system. The system had a function which allowed the pilot to tilt it up and down, scanning the clouds at different elevations to get a better sense of the location of the heaviest precipitation. Scanning the cloud through the radar’s full range of emission angles could have shown that the gap was likely an illusion by revealing slightly lighter (but still very heavy) precipitation either above or below it. However, if the pilots don’t understand the radar system, or they underestimate the threat of radar shadowing, this extra functionality can prove useless — which is what happened on flight 421. For all their years of experience, Rozaq and Gunawan could only work with what they had been given by Indonesia’s rather lackluster pilot training system, and even an incredibly skilled pilot like Rozaq can’t be expected to have acted upon information that he didn’t know existed. Furthermore, similar thunderstorms are extremely common throughout the rainy season, and no SIGMETs advising of severe weather had been issued, so he had no reason to expect anything out of the ordinary, much less the most intense precipitation ever known to have been encountered by a passenger airliner.
In its final report, the KNKT recommended that CFM International create a special procedure for relighting the engines while in heavy precipitation to prevent repeated attempts under conditions where the engine cannot be relighted, and that CFM provide guidance to help pilots optimize an engine’s water/hail ingestion capability, should another crew find themselves in a similar situation. The NTSB has noted that all known incidents of engine flame out due to precipitation occurred while descending through a storm with a high forward airspeed and a low throttle setting; in fact, the low power setting allows more hail into the engine because the fan disk is not spinning as fast and hail can more easily sneak through the gaps. Accelerating the engines before entering an area of precipitation can prevent flame out even in very intense hail. Investigators also recommended that Indonesia’s meteorological service issue SIGMET warnings whenever severe weather is detected, and that Indonesian airlines provide more comprehensive training to pilots on the capabilities of their weather radar. Separately, the NTSB urged the FAA to publish clear guidance for pilots on the consequences of performing the engine relight tasks — especially starting the APU — out of order.
The crash of Garuda Indonesia flight 421 is a stark reminder that it is possible for an airplane to encounter weather conditions that exceed those that it was certified to survive. The best way to prevent such an occurrence is to avoid flying into severe storms in the first place. Taking a chance on a gap without properly evaluating it is a recipe for disaster. For the remainder of his career, Captain Rozaq doubtlessly was more careful about navigating in stormy weather — and one might hope that the same can be said of thousands of other pilots across Indonesia. FAA publications urge pilots to keep a minimum distance of 20 nautical miles from any severe thunderstorm, a rule of thumb which the pilots of flight 421 did not follow. The gap that Rozaq chose to fly through, even if it had really existed, was simply too narrow to safely keep the plane clear of the severe weather. His excellent flying under pressure saved 59 lives — but going forward, the best solution is not to rely on every pilot’s ability to successfully ditch an airliner, but to avoid having to ditch airliners at all.
______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 170 similar articles.
You can also support me on Patreon.
