Nine Minutes of Terror: The crash of Pakistan International Airlines flight 661
On the 7th of December 2016, A Pakistan International Airlines ATR-42 was en route to Islamabad when the left engine failed. But as the pilots began to work through the standard procedure, they realized that the problem was much worse than a regular engine failure — but why? As they struggled to understand what was happening, they lost all control of the plane. After performing a 360-degree barrel roll and losing thousands of feet of altitude, they managed to regain control and fly for a further seven desperate minutes — only to lose control a second time. The ATR-42 once again plummeted from the sky, and this time it plowed into a precipitous mountainside, triggering a massive explosion and instantly killing all 47 passengers and crew. The crash left Pakistan in shock — among the dead was pop singer-turned-preacher Junaid Jamshed, one of the country’s most popular musicians. With questions still lingering after botched investigations of earlier crashes, Pakistani authorities resolved to get to the truth this time, no matter the cost. After a grueling inquiry lasting nearly four years, an international team of experts uncovered the incredibly complex sequence of escalating mechanical failures that led to the crash, discovering engine behavior that not even the manufacturer could have imagined. Faced with a problem no one had ever encountered before, the pilots were overwhelmed — and unaware of the sole course of action which could have saved their plane.
As Pakistan’s flag carrier, Pakistan International Airlines is the country’s main domestic and international air carrier, with a long and storied history. The airline operates in a wide range of conditions, from the icy mountains of the north to the scorching deserts of the south, and has utilized a wide variety of aircraft over the years. It has not always done so safely — PIA, as the airline is known, has one of the worst safety records of any flag carrier in the 21st century, including two major disasters in the past five years alone. But while the investigation into the more recent accident is still underway as of this writing, the investigation into the earlier crash finally concluded in November 2020, revealing to the world a remarkable chain of events that unfolded on board PIA flight 661 on the 7th of December 2016.
The plane in question was an ATR-42, a midsized passenger turboprop produced by joint French-Italian manufacturer Avions de Transport Régional. This type of plane was ideal for getting into and out of small airports in Pakistan’s mountainous northern regions of Khyber Pakhtunkhwa and Gilgit-Baltistan, home to some of the world’s highest peaks. PIA flight 661 was one such flight, from the mountain town of Chitral to the capital, Islamabad. This flight was critical for residents of Chitral, which was otherwise accessible only by many hours of driving on grueling mountain roads. Flying flight 661 that day were three pilots: Captain Saleh Janjua, a veteran pilot with over 12,000 hours, and two much less experienced First Officers: Aly Akram, the accredited First Officer for the flight, and Ahmed Mansoor Janjua, a relatively new pilot who was flying under supervision in order to become familiar with the route. (Note: because the Captain and the trainee First Officer had the same last name, I will henceforth refer to Ahmed Janjua only as “the trainee FO.” All instances of the name “Janjua” will refer to the Captain.)
Just hours later, after flight 661 became a smoking crater on a mountainside, the chairman of PIA would tell the media, “this was a perfectly sound aircraft.” Unfortunately, he was wrong. There were in fact three pre-existing faults hidden inside the left engine — but to understand them, it helps to have an overview of how the Pratt & Whitney 127M turboprop engine works. Be warned: complex topics lie ahead.
1. The power turbine disk
A turboprop engine takes in air through an air intake, after which it is passed through a series of compressor fans. On the PW-127M, this compressed air is then blown into a power turbine, consisting of two turbine disks at the back of the engine. The compressed air spins the disks, which are attached via a turbine shaft to the propeller gearbox, thus spinning the propeller. As the propeller spins, the blades force air backwards over the wing, generating the thrust which propels the plane. In this case, the stage 1 turbine disk deserves special attention. After discovering that the blades of PW-127M turbine disks were not lasting as long as expected, Pratt & Whitney issued a service bulletin in 2015 recommending that operators replace the blades with a stronger version next time the engine was disassembled, if the blades had accumulated more than 10,000 hours of flight time. PIA made this cutoff point mandatory. On the 16th of November 2016, PIA mechanics removed the power turbine disks on this airplane for routine maintenance; at that time, the blades had logged 10,004 hours, meaning replacement was required. But for whatever reason, the mechanics didn’t replace the blades. Little did they know that a fatigue crack had been growing undetected inside one of the blades on the stage 1 power turbine disk, and within weeks it would reach its breaking point.
2. Propeller blade pitch
On almost all propeller-driven engines, blade pitch is everything. Blade pitch refers to the angle of the chord of the blade relative to the plane of rotation. At zero degrees, the blades are aligned edge-to-edge, with the flat sides facing into the oncoming airstream. At ninety degrees, the blades are parallel to each other with the edges facing into the airstream. During normal operation, the blade pitch is somewhere between these two values in order to optimally generate thrust. Where things get interesting is if the engine fails.
3. Blade pitch on a failed engine
The blades on most turboprop engines, including the P&W 127M, are held in a particular pitch using oil pressure alone. When not forced to maintain the selected position, aerodynamic effects will cause them to slowly rotate to zero degrees or even slightly below, a condition which is extremely hazardous to flight for several reasons. A propeller with the flat sides of the blades facing into the wind causes enormous drag, which makes the plane hard to control. Compounding this drag is the speed of the propeller. A failed propeller usually doesn’t stop turning, but instead starts windmilling in the oncoming airstream. The speed at which a propeller spins while windmilling is inversely proportional to the blade pitch — so as blade pitch decreases, rotations per minute (RPM) increase. When the propeller is spinning faster it causes more drag, adding to the difficulties already created by the low blade pitch. To prevent excessive drag on a failed engine, turboprop aircraft have the ability to “feather” the propeller even if the engine is shut off. “Feathering” in this case means increasing the blade pitch to 90 degrees and locking it there, where it causes the least drag.
4. The overspeed governor and the protection valve
Several redundant systems exist to ensure that blade pitch doesn’t reduce to dangerous levels. In normal operations, a system called Propeller Electronic Control (PEC) constantly modulates the oil pressure that holds the blades in the desired pitch. However, if there’s damage to the engine, the PEC may switch off, leaving only mechanical systems in place. Without the constant inputs of the PEC, the electro-hydraulic valve (the main oil pressure valve which controls blade pitch) will be overcome by aerodynamic forces and blade pitch will begin to decrease. Commensurate with this decrease, propeller RPM will begin to increase.
To prevent the propeller RPM from reaching dangerous levels, the engine is fitted with a small mechanical device called the overspeed governor. The overspeed governor includes a system to monitor propeller RPM, as well as an oil line, called the “overspeed line,” which contains a valve connecting it to the oil drain. This valve is closed by default, but if the overspeed governor detects a propeller RPM greater than 102.5% of the normal maximum, the valve (henceforth, the OSG valve) opens and some of the oil from the overspeed line is diverted to the drain, causing the pressure in the line to drop. The overspeed line is in turn connected to another device called the protection valve. The protection valve receives oil from both the overspeed line and the main oil supply and compares the pressure from the two sources. If the pressure from the two lines is the same, the protection valve does nothing; this is known as “unprotected mode.” However, if the pressure from the overspeed line begins to drop relative to the supply pressure, the protection valve will begin to open, and if the ratio drops below 50%, it will open all the way, into what’s known as “protected mode.” In protected mode, the open valve allows extra oil into the blade pitch command chamber, increasing the pressure and forcing the blade pitch to increase. In this way, the overspeed governor and the protection valve have a symbiotic relationship: as blade pitch decreases, RPM increases, the overspeed governor opens the OSG valve, pressure in the overspeed line drops, the protection valve opens, blade pitch increases, RPM decreases, the OSG valve closes, and the cycle reverses itself. Once this cycle has repeated enough times, the propeller RPM will stabilize at a value at or below the overspeed threshold of 102.5%.
5. Inside the overspeed governor
To understand what happened on flight 661, it’s necessary to understand how the overspeed governor actually measures propeller RPM. The system is entirely mechanical. Inside the governor, several weights, called flyweights, are attached to a shaft which rotates along with the propeller. Each of the two flyweights is on a hinge, such that as propeller RPM increases, centrifugal force will cause them to start “leaning backward,” away from the axis of rotation, like children hanging onto the edge of a merry-go-round. As the flyweights tilt, the “toes” of the flyweights move upward (see diagram), pressing against the bottom of a part called the plunger. The plunger is attached to a spring which constantly forces it downward against the toes of the flyweights. However, if the propeller spins faster than 102.5% of the normal maximum, the centrifugal force acting on the flyweights becomes sufficient to overcome the force of the spring, and the flyweight toes push the plunger upward. This opens the OSG valve, which sets the whole protection system in motion.
But on flight 661’s left engine — the same left engine with the faulty turbine blade — there was a problem with the overspeed governor. During unauthorized and undocumented maintenance at some point in the past, someone had disassembled the governor and reassembled it incorrectly. Normally, the plunger rotates along with the flyweights, because it’s connected to the flyweight carrier (see diagram below) by a pin. But someone had reassembled the governor with the plunger rotated out of its normal position, with the pin resting on top of the flyweights. This person then forced the governor back together, snapping the pin and severing the connection between the plunger and the rotating parts of the governor. In this condition, the overspeed governor could still function normally. But instead of rotating in tandem with the flyweights, the plunger now found itself pushed around in circles by the flyweights as they rotated. This put constant stress on the toes of the flyweights, which began to suffer from metal fatigue. By the time of flight 661, one of the flyweight toes had already broken off, leaving only the second one to protect against a propeller overspeed.
In this condition, flight 661 departed Chitral Airport on the 7th of December 2016 with 42 passengers and five crew on board, bound for Islamabad. No one realized that the faulty turbine blade had actually broken on the previous flight, and the engine’s remaining lifespan could be measured in minutes. At first the flight proceeded normally, but after reaching its cruising altitude of 13,500 feet, things began to go wrong. The missing turbine blade imbalanced the turbine disk, causing it to sway from side to side as it spun. This vibration was in turn transmitted to the turbine shaft. The turbine shaft spins inside two other concentric shafts connected to the low pressure and high pressure compressors, respectively. These shafts all rotate at different speeds and are separated by roller bearings. The shafts and the bearings are continuously immersed in oil to prevent metal on metal contact. But as the turbine shaft vibrated, it began to rub against one of the bearings, causing the metal to rapidly wear away and release flakes into the surrounding oil. These metal flakes were carried throughout the oil system, where they eventually made their way into the overspeed line, gumming up the OSG valve. This increased the force required to rotate the plunger connected to the valve (which, due to the broken pin, was being rotated by the flyweights themselves). As the flyweights attempted to push the plunger around and around through the sludge of metal particles, the extra resistance forced them slightly outward, causing the remaining flyweight toe to push the plunger upward. This partially opened the OSG valve, causing the protection valve to partially open as well, resulting in an increase in blade pitch. The increased blade pitch caused the propeller RPM to decrease from 82% (normal cruise speed) to 62%. Initially, nobody noticed.
In response to the decrease in propeller speed, the Propeller Electronic Control attempted to reduce blade pitch back to the selected value, but was unable to do so. As a result, a PEC fault was triggered, which appeared to the pilots on their engine monitoring screens along with a chime. For Captain Janjua and the trainee First Officer, who was sitting in the right-hand seat, this was the first indication of a problem. They pulled out the checklist for a PEC fault and began running through the steps. First they attempted to reset the PEC, but despite three attempts to do this, the fault always came back. In accordance with the checklist, they now switched the PEC off. To avoid overstressing the possibly damaged engine, the trainee FO reduced power to the left engine, and the plane’s airspeed slowly began to decrease from 186 knots to 146 knots.
Meanwhile inside the left engine, the extra stress being applied to the remaining flyweight toe, which was already fatigued, caused it to break as well. Now the head of the plunger was resting precariously atop the broken stumps of the flyweight toes, closing the OSG valve. With the PEC off and the OSG valve now closed, as expected, aerodynamic forces slowly began to push the blade pitch down toward zero degrees. As blade pitch decreased, propeller speed increased until it approached the overspeed threshold of 102.5%. The flyweights began to tilt backward again, and the stumps of the broken flyweight toes were just sufficient to lift up the plunger and open the OSG valve most of the way. The protection valve therefore also opened most of the way, allowing just enough extra oil into the command chamber to stop the blade pitch from decreasing further. The propeller RPM consequently stabilized at 102% for the next 15 seconds.
Noticing the change in the sound of the propeller and an abnormal increase in RPM, the Captain called an on-board engineer up to the cockpit to assess the situation, and the less experienced trainee FO turned over his seat to First Officer Akram. Moments later, there was a sudden noise, and the left engine’s torque output dropped to zero — the engine had failed. The pilots now moved to shut off fuel flow and feather the propeller. This was accomplished using the condition lever, a cockpit control which sets the state of the engine. They first moved the condition lever from normal to the “feather” position, sending a command to feather the propeller, and then further to “fuel shutoff,” shutting the engine down completely.
The feather command was sent to the feather solenoid, a switch which when activated opens a separate valve connecting the overspeed line to the drain. This had the same effect as opening the OSG valve: the pressure in the overspeed line dropped below 50% of the supply pressure, the protection valve moved to protected mode, and the blade pitch began to increase toward 90 degrees (“feathered”). And as long as the feather solenoid was active, the protection valve was supposed to stay open, and the propeller, feathered. Captain Janjua now accelerated the right engine to compensate, and their airspeed stabilized. So far, everything was proceeding according to plan.
However, this illusion of normalcy wouldn’t last long. Deep inside the engine, there existed a third latent problem: foreign contamination inside the pipe connecting the overspeed line to the drain via the feathering valve. This line normally doesn’t have oil in it at all, and the debris had presumably been there for years without causing any trouble. But when oil suddenly surged through the line, it picked up this debris, which then began to pile up at a bottleneck. The accumulation of debris partially blocked the flow of oil from the overspeed line into the drain, resulting in an increase in pressure inside the overspeed line. This caused the difference in pressure between the overspeed line and the supply line to move back above 50%, and the protection valve moved part way from protected mode back to unprotected mode — something which was not supposed to happen with the feather solenoid active.
Meanwhile in the overspeed governor, the decrease in propeller RPM that accompanied the initially successful feather command caused the flyweights to tilt fully back into their resting positions. In this position, the plunger (propelled by the spring) was able to force its way between the stumps of the broken flyweight toes instead of resting on top of them. Now there was no way for the flyweights to lift the plunger if the propeller speed increased again — the overspeed governor was totally out of service. And because the protection valve had moved out of protected mode, blade pitch was beginning to decrease again, and there was nothing to stop the propeller RPM from accelerating beyond the overspeed threshold.
During the 26 seconds after the protection valve returned to unprotected mode, the left propeller RPM slowly increased from 25% to 50%. Then suddenly, in just eight seconds, the RPM shot upward straight through the overspeed threshold to a value between 120% and 125%, way outside the normal operation envelope. Drag massively increased to several times what would normally be expected from a failed engine. The autopilot, which until this point had been compensating for the thrust/drag imbalance, disconnected. Captain Janjua found that he had to apply large rudder and aileron inputs to prevent the plane from pulling hard to the left. The huge amount of drag from the left engine also caused their airspeed to drop below 120 knots — barely half the normal cruise speed of 230 knots. As their speed dropped, the effectiveness of the flight controls decreased, and the plane began to slowly turn to the left, despite Captain Janjua’s best attempts to keep it straight.
Recognizing that the propeller had not feathered properly, the crew attempted to feather it again, but their efforts were in vain. Janjua began modulating thrust on the right engine in an attempt to offset fluctuations in drag on the left engine, but every time he reduced thrust, they lost airspeed and the problem got worse. In fact, in their current state, the drag was so heavy that it was impossible for the plane to maintain altitude indefinitely — the only way out of the situation was to increase airspeed by descending. But the pilots didn’t necessarily know this, and they were flying over a mountainous area with no obvious landing sites, so Captain Janjua was understandably reluctant to descend. He knew that unless he kept the plane as high as possible for as long as possible, they wouldn’t make it over the mountain range north of Islamabad.
While the pilots struggled to maintain control, an aerodynamic principle of the failed, unfeathered propeller was about to unleash chaos. A normally operating engine uses the turbine to drive the propeller; as the propeller blades cut through the air, they generate lift in a manner similar to a wing, propelling the plane forward. But a failed engine with a windmilling propeller does the reverse: instead of the blades producing lift by slicing the air, the air drives the propeller, which transmits back to the engine power equivalent to the thrust (lift) it would generate if the engine was driving it. Essentially, the propeller becomes the turbine and the turbine becomes the propeller. After the engine initially failed, the amount of power generated by the spinning propeller was sufficient to overcome the frictional forces inside the engine and spin the turbine. But as blade pitch decreases, a normally functioning propeller takes a smaller bite out of the air; similarly, in the reversed state of a propeller on a failed engine, lower blade pitch caused the air to take a smaller bite (figuratively speaking) out of the blade. While the propeller will continue to spin at high speed as blade pitch nears zero, keeping it spinning requires the amount of leverage (bite) from the airstream to be greater than the inherent friction of the rotating engine components. Therefore, as the blade pitch continued to fall toward zero over a period of several minutes, the speed of the propeller remained constant at 120%, but the force of the air on the blades progressively dropped — until suddenly, it wasn’t enough to overcome the friction and spin the turbine.
When the propeller’s power output reduced past this threshold, the friction practically stopped the propeller in its tracks; within a second or two, the RPM dropped from 120% to less than 25%. Because propeller speed and drag are proportional, this also caused a massive decrease in drag on the left side. With the sudden alleviation of this drag, Captain Janjua’s rudder and aileron inputs instantly became disproportionate in comparison to the pull to the left which he was trying to overcome. As a result, the plane entered a snap roll to the right — not because of a mechanical failure, but because of the captain’s own inputs, which he didn’t have a chance to remove. A large bank or yaw causes a commensurate decrease in lift, and at such a low speed, this decrease in lift immediately led to a stall. The right wing lost all lift, and the plane rolled inverted and began to fall from the sky. The upset caught the pilots completely by surprise, and they struggled to understand what was happening. The plane rolled a full 360 degrees to the right — a complete barrel roll — and kept right on going into another 90 degree right bank before Captain Janjua managed to level the wings and pull out of the dive. In just 24 seconds, they lost 5,100 feet of altitude, a terrifying plunge that sent pilots and passengers alike into a state of panic.
As Captain Janjua and First Officer Akram regained control of the plane, terror was evident in their rapid breathing and trembling voices. Indeed, they were now in a much more dire situation than before. During the dive, the left propeller blade pitch continued to decrease until it stabilized slightly below zero degrees, into what’s known as the reverse range, where it actively attempts to push back against the onrushing air. Such a pitch angle is only used when slowing the plane on the runway after landing; in flight, it not only caused drag, but actively worked as a brake. As a result, despite the fact that the propeller had almost entirely stopped spinning, the drag it produced was seven times the normal drag from a feathered propeller — even more than when it was spinning at 120% RPM. In such a state, the airplane proved extremely difficult to control. The only way to keep their speed high enough to maintain control was to enter a continuous descent of 800 to 1,000 feet per minute. At an altitude of 8,400 feet and dropping, they didn’t have much time to find a solution. The pilots knew they would need, at a bare minimum, 5,200 feet of altitude to clear the mountains near Islamabad, and in order to avoid dropping below that they would need to reduce their descent rate. Unfortunately, they didn’t know that this was impossible.
As the crippled plane dropped ever downward toward the mountains below, the pilots kept trying to pull up and slow their descent, but every time they did so they began to lose airspeed, and the plane would start to pull hard to the left. First Officer Akram declared an emergency and requested direct vectors to Islamabad, but they weren’t even able to maintain the correct heading. As the plane reached an altitude of 5,280 feet, Captain Janjua was forced to level the plane, knowing that if they dropped any lower they were certain to crash into the mountains. But as he held the plane at this altitude, their airspeed dropped dangerously; the stick shaker repeatedly activated, warning them that they were about to stall. The plane began to turn uncontrollably to the left, despite Janjua’s desperate attempts to turn back to the right. Mountains loomed ahead of them; the ground proximity warning system began to blare, “TERRAIN, TERRAIN, PULL UP!” The pilots fought with everything they had to stay in the air, but there was no escape. At a height of 850 feet above the ground, the left wing stalled, and the plane rolled 90 degrees to the left. The nose dropped and the plane dived toward the mountains below. There was no hope of recovery. Just a few seconds later, PIA flight 661 nosedived into a precipitous mountainside and exploded in flames, instantly killing all 47 people on board.
Residents of a nearby village saw the plane fly over and heard the crash, and the local mosques used their call-to-prayer loudspeakers to urge people to hurry to the crash site in search of survivors. Within minutes, dozens of people were on the scene, but it was soon clear that there was nobody to save. The airplane had been reduced to a smoldering pile of rubble, except for the tail section, which stood in stark white against the blackened chaparral.
As news of the crash hit the airwaves, it was soon discovered that one of the passengers was a household name in Pakistan: Junaid Jamshed, vocalist from the famous Pakistani pop band “Vital Signs.” In the 1980s and early 1990s he was responsible for some of the country’s most popular music, including “Dil Dil Pakistan,” which became an unofficial national anthem. By 2016 he had long since abandoned his music career, turning to Islam and becoming a televangelist. But despite the odd turn in his life, he was still revered for his music, and his sudden death in the crash shocked the country. Pakistan’s Civil Aviation Authority vowed to find the cause of the accident, and within hours, investigators from the Safety Investigation Board (SIB) arrived at the scene to begin the inquiry.
Up until that point, Pakistan had a rocky relationship with air crash investigations. The investigation into the high profile 2010 crash of Airblue flight 202 was widely criticized for failing to look deeply enough into the underlying issues which caused the accident. There was widespread concern that Pakistan’s Safety Investigation Board would make the same mistakes again. Fortunately, this time they wouldn’t have to solve it alone: experienced representatives from France (which built the plane), Canada (which built the engines), and the USA (which built the propellers) were all invited to participate, as the accident was already believed to have been caused by an engine failure.
An engine failure on a two-engine airplane is not supposed to be a very significant event; the ATR-42, like all multi-engine aircraft, is certified to be able to climb and maintain altitude on just one engine. ATR-42 pilots publicly speculated that the crew of flight 661 had made some kind of error in handling the engine failure which led to the crash. But as the international team looked deeper into the sequence of events, a very different story began to emerge.
An exhaustive investigation of the wreckage combined with extensive flight data analysis, computer simulations, and real world testing eventually revealed three latent faults in the left engine which led to the accident. There was the broken turbine disk blade, which should have been replaced by PIA mechanics in November, but was not; there was the broken overspeed governor pin, snapped off during an incorrect assembly attempt; and there was the unidentified contamination inside the propeller valve module. The first of these failures was caused by apparently systematic disregard for service bulletins at PIA maintenance facilities, which was not detected by the Civil Aviation Authority, whose specific purpose was to detect exactly this sort of noncompliance. The problem with the turbine disk blades on P&W 127M engines was already well known to the manufacturer and the airline, and the 10,000 hour limit existed for a reason. If the mechanics had simply followed their own rules, the crash wouldn’t have happened.
The origin of the other two failures was less clear. There were no service records which would indicate that the overspeed governor had ever been disassembled and put back together, but this had clearly occurred. The technique used to do so also made little sense, since it actually added time and difficulty to the procedure. That meant it was probably performed by someone who didn’t know what they were doing, rather than by someone trying to cut corners. The overspeed governor was considered by PIA to be a “repair abroad item” — a part that Pakistani maintenance facilities are not certified to repair, and which must be sent to another country if something goes wrong. It was possible that in an attempt to save time and/or money, a mechanic in Pakistan had attempted to repair the device without proper training, leading to the failure of the pin. As for the contamination in the valve, the investigators could only conclude that it had been introduced while the valve module was not attached to the engine, perhaps when something was spilled on it and not properly cleaned. When, where, why, and how this happened, and even what the debris was made of, could not be determined.
The combination of these three failures allowed the sequence of events to circumvent multiple redundant systems intended to prevent the propeller from reaching a dangerously low pitch in flight. In order, the failure sequence progressed as follows:
1. The broken overspeed governor pin causes the flyweights to push against the plunger head, leading to fatigue cracking of the flyweight toes.
2. The turbine disk blade fails, unbalancing the turbine shaft.
3. The vibration of the turbine shaft wears away a bearing, introducing metal particles into the oil.
4. This metal debris builds up against the overspeed governor valve, causing increased resistance which pushes the valve part way open. Propeller speed decreases.
5. The PEC attempts to increase propeller speed but it can’t, so it trips offline.
6. Without the PEC, aerodynamic forces cause the blade pitch to decrease and RPM to increase to the overspeed governor stop. The second flyweight toe breaks, but the broken toes continue to raise the plunger.
7. The pilots react to the unusual propeller speed by shutting off the engine and commanding the propeller to feather.
8. The propeller begins to feather. The reduced RPM resets the overspeed governor to its resting position, and the plunger pushes between the broken toes of the flyweights, rendering the governor inoperative.
9. Contamination in the overspeed line causes the protection valve to move back to unprotected mode. Blade pitch begins to decrease again.
10. Without the overspeed governor, there is nothing to stop the propeller RPM from increasing past its design limits to 120%. This causes massive drag which slows down the airplane.
11. Blade pitch gets so low that the airstream can’t push the propeller against the friction of the turbine inside the engine. The propeller RPM rapidly decreases.
12. The sudden decrease in drag causes the pilots to lose control of the plane.
13. Blade pitch settles slightly below zero, where it causes seven times the normal drag. Maintaining altitude is impossible.
This sequence of events had never been considered in any engineer’s wildest imagination. As a result, there were no procedures or training which the pilots could have drawn upon to tell them what to do. The flight crew operations manual devoted all of one line to the possibility of a failed engine not feathering, which it called a “scenario of hazardous consequence” without any further explanation. The actual failures faced by the crew went even further than that: not only did the propeller not feather, it actually overrode the overspeed protections and then went into reverse. The pilots evidently had no clue what was going on. In fact, ATR’s definition of an event “of hazardous consequence” specifies that a crew faced with such an event may struggle to adhere to optimal procedures and decision-making due to stress, surprise, and/or fear, and cannot be relied upon to successfully recover the aircraft.
The investigators did examine the behavior of the crew and found that they left much to be desired in terms of resource management, leadership, energy management, and adherence to standard procedures. But an analysis of their options rendered all of that rather moot. They found that it was only possible to reach Islamabad if the pilots kept the flaps retracted and maintained a speed of exactly 160 knots all the way to the airport for a flaps-zero landing, and even then, they would only barely have made it. Furthermore, this procedure was not published anywhere, and it would have to have been executed perfectly, so it was unrealistic to expect an air crew to have come up with it on the fly.
However, there were two airports closer than Islamabad that would have been easy to reach: a military air base in the town of Kamra Kalan, and a small field serving the Tarbela Dam, which was even closer. Unfortunately, because neither of these airports were used by commercial airplanes, the pilots didn’t know they existed. They thought the closest airport was Islamabad, and by the time they realized they couldn’t make it, it was too late to reach these other airports either. Therefore, even if the pilots had handled the situation perfectly, it was unlikely that they could have saved the airplane. The flight was all but doomed from the moment the engine failed.
In January 2019, after more than two years with no word on when the report was going to come out, Pakistan decided to reform its entire accident investigation apparatus. The Safety Investigation Board was replaced with the Aircraft Accident Investigation Board (AAIB), which would report directly to the Prime Minister instead of the Civil Aviation Authority. Considering the CAA’s history of mismanaging aviation safety in Pakistan, freeing the board from its influence was a wise move. So complex was the crash, however, that even with the reforms, the report was not released until November 2020, nearly four years after the crash.
During the course of the investigation, the AAIB issued several recommendations, including that PIA immediately comply with the Pratt & Whitney service bulletin and the 10,000-hour blade life limit; that the CAA overhaul its entire oversight apparatus; that PIA immediately inspect all its ATR-42 overspeed governors to ensure they were properly assembled; that PIA strictly adhere to manufacturer standards of cleanliness when working with engine parts; that PIA maintenance facilities improve problem areas identified during a CAA inspection after the crash; that Pakistani operators improve the effectiveness of their crew resource management programs, with an emphasis on managing the energy state of the aircraft; and that ATR offer training for pilots on situations with severe aerodynamic degradation like that on flight 661.
The crash of PIA flight 661 underscored the importance of proper maintenance in ensuring that redundant systems stay redundant. In the absence of PIA’s apparently gross maintenance errors, the probability of the propeller ending up in the position it did was supposed to be less than one in a billion. But because PIA was not taking good care of its planes, that safety margin was significantly eroded. In fact, at the time of the accident PIA had the highest rate of in-flight engine failures of any ATR operator in the world. This should have given the Civil Aviation Authority serious cause for concern, but it too failed to do its job and get to the root of the problem until after people had already died. And in the wake of the May 2020 crash of PIA flight 8303, it’s apparent that the airline still struggles to maintain an adequate level of safety. But there is one piece of good news: for what may be the first time in its history, Pakistan has conducted an air crash investigation properly. The inquiry covered every conceivable factor and dived deep into topics where few investigators had ventured before. No doubt the assistance from the US NTSB, the French BEA, and the Canadian TSB played a large role in that success. But it may be hoped that the experience gained during this investigation will help AAIB Pakistan uncover the full truth about every future accident — and in the process, turn the tide against Pakistan’s worrying aviation safety record.
_________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 170 similar articles.
You can also support me on Patreon.
