On Course for Disaster: The crash of Alitalia flight 404
On the 14th of November 1990, an Italian passenger jet on approach to Zürich, Switzerland suddenly slammed into a mountain short of the airport, tearing a swath of destruction through the forest and killing all 46 passengers and crew. The crash seemed to be a classic case of controlled flight into terrain, a type of accident virtually always caused by pilot error — and indeed, it appeared at first as though the pilots had mistakenly begun their descent too early. But in trying to explain why they did this, investigators discovered that while human error did play a key role, the proximate cause was a mechanical failure deep within the plane’s navigation system. A short circuit had misled the crew into flying their plane straight into the ground, and disabled the warnings that would have alerted them to the danger — a failure so insidious that investigators had to scramble to correct the problem before it could kill again.
Alitalia flight 404 was a regularly scheduled international flight from Milan, Italy to Zürich, Switzerland. In 1990, Alitalia, Italy’s state-run flag carrier, operated the brief flight using the McDonnell Douglas DC-9, of which it owned several aging examples originally built in the 1970s. These older generation DC-9s contained some equipment that might have been better off in a museum, but so far this hadn’t caused any problems.
On the morning of the 14th of November 1990, the pilots of one of these DC-9s reported a problem with the plane’s navigation equipment while on approach to Düsseldorf, Germany. Specifically, the problem arose with one of the aircraft’s two NAV receivers, the pair of computers that detect the signals from an airport’s instrument landing system (ILS) and then transmit that data to the cockpit instruments so that the pilots can find the runway in low visibility conditions. Several hours later, another crew flew a round trip from Milan to Frankfurt and observed similar problems on the second NAV receiver as well. After the plane returned to Milan’s Linate Airport, Alitalia mechanics replaced both of the NAV receivers, correcting the problem.
After installing the new NAV receivers, the mechanics tested them to ensure that they functioned properly. The NAV receiver detects three main types of signals: navigational waypoints called VOR beacons; localizer beacons, which broadcast a narrow beam on the extended centerline of the runway to help planes align with it; and glide slopes, which produce a directed signal that can be followed in order to maintain the correct descent angle on approach to the runway. While the DC-9 was parked on the ground in Linate, the mechanics were able to tune in to nearby VOR beacons and a localizer, confirming that the NAV receivers tracked them correctly. But the plane was parked in a position where it could not pick up the signal from Linate’s glide slope, so they couldn’t check this last component. The mechanics released the aircraft for flight without conducting this check, but left a note in the technical log stating that an approach using the ILS should be conducted in clear conditions to confirm that the NAV receivers were correctly picking up glide slope signals. Only after completing this check could they be used to conduct a real ILS approach under conditions where the pilots would rely on their instruments to navigate.
As it turned out, there was a problem with the ability of the №1 (captain’s side) NAV receiver to track a glide slope. It is thought that a soldering defect in the electronic component that transmits already-processed glide slope data to the cockpit instruments created a short circuit that prevented the information from ever leaving the NAV receiver. A modern NAV receiver could detect this sort of failure and display a “glide slope fault” warning flag on the affected instruments, but this was not a modern receiver. The №1 NAV receiver on this plane was a King KNR-6030, an older model that could only display a fault flag if a failure occurred during processing of the data. If the data was processed correctly but then failed to reach the cockpit instruments, no fault flag would be produced.
This DC-9 used analog glide slope instruments where a needle would physically deflect based on the plane’s distance above or below the glide slope. Therefore, in the absence of any deflection, the needle necessarily had to rest in the “on course” position. So when the №1 NAV receiver short circuited, preventing the glide slope signal from reaching the instruments, the glide slope indication on the captain’s instruments would default back to “on course,” and no warning flag would be produced.
The DC-9’s next scheduled trip was flight 404 to Zürich. In command of this flight were Captain Raffaele Liberti, an experienced pilot with over 10,000 flying hours; and First Officer Massimo De Fraia, a young, new hire with much less time on the DC-9. Joining them on the flight were four flight attendants and 40 passengers, mostly Swiss businessmen returning home to Zürich.
Flight 404 took off at 6:36 p.m. and climbed to its cruising altitude of 20,000 feet, passing quickly over the dark void of the Alps. The cruise phase was extremely short, and by 6:52, they had already begun the descent into Zürich’s Kloten Airport. The plan was to loop around the airport and approach runway 14 from the northwest using the instrument landing system. Although the weather was overcast, the clouds bottomed out at about 4,000 feet, well above any terrain; therefore they were allowed to use the as-yet untested NAV receivers, since they should have been able to visually determine whether they were in line with the runway or not. But there was initially some disagreement over what runway to use, given the wind; three different runways were suggested before the crew settled on 14, the one offered to them by controllers. When Captain Liberti began briefing the approach, First Officer De Fraia had a chart for a different runway in front of him, and more confusion ensued until Liberti told him to put it away.
Although the approach briefing was incomplete, all was normal as flight 404 began a series of descending turns before lining up with the runway. At 7:02, Captain Liberti observed that they were going too fast, so he told First Officer De Fraia (who was the pilot flying), “I would decelerate even more, because after passing abeam [the threshold] it is useless to rush; the more you rush the more you get away, you understand?” He felt that when they had flown past the runway and were preparing to turn around, it would not be economical to fly fast, since this would cause them to overshoot even more. Moments later, the Zürich controller contacted the flight and asked it to decelerate to 210 knots, because it was getting too close to the plane ahead of it in the traffic pattern. “You see?” Liberti said to De Fraia. The first officer rolled the throttles back to idle, decreasing their speed and increasing their rate of descent.
At 7:06, the controller instructed flight 404 to descend to 4,000 feet and cleared them for an ILS approach to runway 14. One minute later, flight 404 arrived at the top of the approach at an altitude of 4,000 feet. The expectation was that they would remain at that altitude until they intercepted the glide slope from below, which would occur 15 kilometers from the runway. But at that moment, Captain Liberti’s instruments showed that they had already lined up with the glide slope, because of the short circuit in the №1 NAV receiver, which caused his instruments to default to the “on course” indication. He therefore believed that since they were already on the glide path, they could begin descending immediately. However, First Officer De Fraia’s instruments correctly showed them well below the glide slope, causing a mismatch.
“Do you have the glide here?” Liberti asked.
“On one I don’t have it,” De Fraia replied.
“Alright, then let’s do it on the other one,” said Liberti. Here he made a critical error: because he had not caught on to the fact that they were below the glide slope, he assumed that De Fraia’s instruments were wrong and his were correct, even though the opposite was true.
In response to Liberti’s determination, De Fraia flipped the Radio Selector switch to the “radio 1” position, causing both sets of instruments to source their data from the №1 NAV receiver. De Fraia’s glide slope indicator then moved to show them on course, like Liberti’s, and both pilots believed the problem had been solved. De Fraia then began the descent from 4,000 feet, believing they were on the correct glide slope. In reality, they had begun the descent at a distance of 21 kilometers from the runway instead of 15, putting them about 1,200 feet below the real glide slope.
As flight 404 descended, the pilots made visual contact with the runway. But a hidden danger lurked between them and the airport: the 2,110-foot Stadlerberg, a small mountain located about 11 kilometers from the threshold of runway 14. That night, the Stadlerberg was shrouded in a cloud cap and hidden against a dark background, rendering it utterly invisible — like flying into a black hole. To make matters worse, Kloten Airport lacked a Precision Approach Path Indicator, or PAPI, a set of lights next to the runway that change color if an approaching aircraft is too high or too low. Therefore, no visual indication that they were too low would exist until the black mass of the Stadlerberg rose up in front of them.
At a distance of 7 kilometers from the airport lay a navigational beacon called the outer marker, which the pilots knew they were supposed to pass at a height of 1,250 feet above the ground. But at 7:10, having already descended to an altitude of 1,100 feet above the ground, Captain Liberti reported that they were about 7 kilometers away from the outer marker. Suddenly, First Officer De Fraia realized that something must be wrong — how could they be at 1,100 feet above ground level and on the glide slope if they were still well short of the outer marker?
“Haven’t we passed it?” he asked. “Haven’t we passed the outer marker?”
“No, no, it hasn’t changed yet…” said Liberti. “Oh, here it’s giving me — ”
His thought was interrupted by a transmission from air traffic control, as the approach controller gave them the frequency to contact the tower for landing clearance. After acknowledging the transmission, Liberti said, “That doesn’t make sense to me.” He too had caught on to the problem that was giving his first officer pause.
“Nor to me,” said De Fraia. The aircraft was still headed straight for the summit of the Stadlerberg, but it seemed as though the crew was beginning to catch on to the problem.
At this point, Captain Liberti made another critical error. He glanced at his altimeter to try to judge their height, but misread it. The altimeters installed on the plane were an antiquated type called a “drum pointer,” on which the aircraft’s altitude in thousands of feet is displayed on a rotating drum, and increments in hundreds were displayed using a needle on a gauge. The problem with drum pointer altimeters was that it took two steps to read them; and the drum was small and difficult to see, especially when it had rotated half way from one number to the next, or when the needle on the gauge moved in front of it. As a result, pilots frequently misread this type of altimeter, deriving an altitude 1,000 feet higher or lower than their actual altitude. It is thought that as he scrambled to figure out what was going on, Captain Liberti misread their altitude by 1,000 feet. At that time, flight 404 was about 1,250 feet below the glide slope, but because he misread the altimeter, when Liberti cross checked his observation with the height they were supposed to be at, he came to believe that they were only 250 feet below the glide slope, and that it was this relatively small discrepancy that had disturbed the first officer.
“Pull, pull, pull, pull,” Liberti said to De Fraia, intending to have the first officer stop descending and level the plane until they intercepted the glide slope again.
First Officer De Fraia had a much more dire picture of the situation. “Go around,” he said, reaching for the throttles and pulling back on his control column to climb.
But Captain Liberti believed that the approach could still be salvaged. “No no no no, catch the glide!” he said, and De Fraia aborted his nascent attempt at a go-around.
“Can you hold it?” Liberti asked. Ahead of them, the lights of the runway began to disappear behind the mist-shrouded Stadlerberg.
“Yes,” said De Fraia, timidly.
“Wait, let’s try to…”
Before Liberti could finish his sentence, the mountain rose into their path without warning. There was no time to react; a split second later, the DC-9’s forward fuselage and right wing struck trees, tearing off chunks of the right outboard flaps, slats, and wingtip. The right wing lost lift and the plane rolled hard to the right as it plunged into the forest. Flight 404 rolled inverted and crashed to earth upside down, triggering a huge explosion that sent burning debris tumbling on through the trees for several hundred meters. Although the impact was not necessarily fatal for all the passengers, the explosion and fire consumed the wreckage in mere seconds, quickly killing anyone who remained. By the time anyone even realized the plane was missing, all 46 passengers and crew were dead.
At Kloten Airport, the controllers soon noticed that Alitalia flight 404 had disappeared from radar. After receiving no response from the plane, the approach controller asked another nearby flight, “Do you have an aircraft in sight about two miles ahead of you?”
“Standby,” said the flight. After a few moments, they replied, “There is a fire on the ground, but we have no traffic in sight.”
Controllers immediately sounded the crash alarm, then cancelled the approach clearances of all inbound aircraft and shut down the airport while emergency services raced to the scene. It was not long before firefighters located the crash site on the side of the Stadlerberg, where they set about bringing the fire under control before it could spread through the nearby forest. As the flames subsided, rescue crews moved in to look for victims, but it was soon clear that no one had survived. A first aid tent, set up to care for the wounded, stood forlorn amid the falling rain.
Swiss, Italian, and American investigators soon converged on the scene to determine the cause. By virtue of the fact that the crash site was in line with the runway and the plane appeared to have impacted the first trees in a nearly level attitude, it was apparent that flight 404 had flown into the mountain in a controlled manner while properly aligned with the runway. The problem was that it was 1,250 feet too low. But why?
In nearly all crashes categorized as “controlled flight into terrain,” there is nothing wrong with the plane prior to impact, and the entire sequence of events is rooted in human factors. Therefore, when the investigators examined the black box data, they initially expected to find evidence of some major instigating error. Instead, they found that the pilots’ instruments had indicated that they were on course throughout the descent, despite the fact that they were well below the glide slope the entire time. Something had misled them, but what? The recent maintenance history involving the NAV receivers provided a tantalizing clue, but a teardown of the devices was inconclusive, because they were badly damaged in the crash and could not be properly tested.
Then, in June 1991, another Alitalia plane fitted with the same type of NAV receiver was performing an ILS approach when the crew observed that their instruments showed them aligned with the localizer when this was manifestly untrue. An examination of the NAV receivers showed that one of them had a badly soldered joint that caused a short circuit which cut off the cockpit instruments from the source data. Just like on flight 404, no fault flag appeared because the outdated NAV receiver was not capable of detecting a failure that occurred after the data processing phase. Investigators determined that a similar bad soldering job in the glide slope unit would explain everything that went wrong on board Alitalia flight 404. In the absence of a signal from the №1 NAV receiver, any instruments that relied on it would default to the “on glide slope” position, and no fault flag would appear because the data was being processed correctly. Critically, investigators discovered that this failure would also affect the plane’s ground proximity warning system (GPWS). Although flight 404’s closure rate with the ground was not fast enough for this early model GPWS to have produced a terrain alarm, it was also capable of producing a “BELOW GLIDE” warning, which should have sounded in the last minutes of the doomed flight. But the short circuit in the №1 NAV receiver also prevented glide slope information from reaching the GPWS, rendering it unable to determine the plane’s relationship to the glide slope. The result was chilling: the very same failure that tricked the pilots into flying too low also disabled the one alarm that could have saved them!
However, the investigation did identify two critical moments at which the actions of the pilots contributed to the crash. First, when Liberti and De Fraia initially realized that their glide slope indications didn’t match, they had an opportunity to discover the problem and switch to the NAV receiver that was working properly. Instead, Captain Liberti immediately switched all the instruments over to the NAV receiver that produced the reading most closely resembling his preconception of the situation. When the glide slope and localizer indications moved to “on course” right as they reached 4,000 feet, Liberti believed this meant that the controller had deliberately vectored them directly to the beginning of the approach, when in reality they needed to remain level for another 9 kilometers before descending. When First Officer De Fraia’s instruments showed them below the glide slope, Liberti assumed that this was the faulty reading, and he switched over to the other receiver without a second thought. Had he cross-checked their altitude with their distance from the airport, he would have realized that De Fraia’s glide slope indication was the correct one, but he never did this.
Another opportunity to prevent the accident came when First Officer De Fraia called for a go-around shortly before impact. Investigators determined that had they not aborted this go-around, the plane would probably have missed the mountain. Unfortunately, Captain Liberti intervened to stop the go-around, most likely because he had misread the altimeter and believed they were only 250 feet below the glide slope — a potentially salvageable deviation that he didn’t think warranted a go-around. But the fact that one pilot would overrule another pilot’s attempt to perform a go-around was concerning in and of itself. De Fraia, as the pilot flying, was the one who was supposed to make the call. The fact that Liberti tried to stop him revealed that he did not trust the inexperienced first officer’s ability to make critical decisions — a theory that was supported by the interactions between them throughout the flight. Liberti spoke to De Fraia as though he was his instructor rather than his coworker, giving the first officer numerous heavy-handed pieces of advice that often came off as patronizing. When the controller echoed his advice about reducing their speed, he made sure to rub it in, and he frequently took note of De Fraia’s minor mistakes, like when he grabbed the wrong approach chart. This attitude ultimately came back to bite him: when De Fraia tried to point out a clear and present danger, Liberti didn’t believe him.
The sequence of events that led to the crash was thus established. But investigators were left astonished that a NAV receiver with such a dangerous failure mode could have been installed on a passenger plane without anyone apparently being aware of it. However, they eventually found that various parties had known of the problem for at least 15 years. In 1975, the manufacturer of one of the two types of NAV receivers used on Alitalia’s DC-9 fleet had asked operators to upgrade the older models to a newer version that was capable of detecting a failure at any point in the data generation and transmission process. Although this was not the type of NAV receiver that failed on flight 404, the problem with both receivers was exactly the same. Then in 1984, aircraft manufacturer McDonnell Douglas issued a bulletin warning operators, including Alitalia, of this same potential malfunction. And in 1985 McDonnell Douglas convened a seminar in which pilots from various airlines were briefed on the malfunction and were given strategies to recognize it. At least two Alitalia pilots were known to have attended the seminar. But despite all these attempts to make the problem known, no effective method existed to disseminate the information to the individuals at Alitalia who needed to know it, and the airline did not replace the affected NAV receivers or train pilots to recognize the malfunction.
The King KNR-6030 NAV receiver was not the only piece of outdated equipment on the DC-9. Investigators were also shocked by the fact that a passenger jet in 1990 could be equipped with a drum pointer altimeter. The risk of misreading this type of altimeter had been known for decades, and all the way back in 1959 a US Air Force report concluded that it was “not an acceptable instrument.” A subsequent study revealed that 81% of Boeing 727 pilots had at some point misread a drum pointer altimeter, and of those, 85% said they had done so more than once. In most of the world, drum pointer altimeters had been phased out by the end of the 1970s, but this Alitalia DC-9 still had one in 1990!
A lack of appropriate equipment at Zürich airport also contributed to the crash. By 1990, the United States had installed Minimum Safe Altitude Warning (MSAW) systems at all major airports, but Switzerland had not. An MSAW system detects when an inbound plane descends too far below the glide slope and provides both visual and aural alerts in the control tower, allowing controllers to intervene if a flight is on a collision course with terrain. Had an MSAW system been available at Kloten Airport, the accident might not have happened. The same would have been true of a Precision Approach Path Indicator (PAPI) system, which could have informed the pilots that they were too low during the period when the runway was in sight. Again, such systems were common in the United States, but not in Switzerland. Thirdly, no light had been installed on top of the Stadlerberg to help make it visible to pilots, because such lights were not required on obstructions located more than 5.5 kilometers from the airport. And finally, the approach chart provided to the pilots didn’t show any topographic relief.
Part way through their investigation, the Swiss Federal Accidents Inquiry Board released an interim report containing several urgent recommendations. As a result of these preliminary findings, Alitalia began training its pilots to always cross-check their distance and altitude before switching to a single NAV receiver, and instructed pilots that if either crewmember calls for a go-around, that decision must be respected with no exceptions. Concurrently, Swiss authorities began working to install a light atop the Stadlerberg.
In its final report, the Board went much further, recommending that unmonitored NAV receivers and drum pointer altimeters be removed from service immediately; that ground proximity warning systems should be redesigned so as not to rely on the correct functioning of the NAV receivers; that all airlines institute a policy requiring the completion of a go-around once one is started; that approach charts show a profile of the terrain beneath the glide path; that airports without MSAW consider installing it; and that runways fitted with instrument landing systems should also have PAPI lights.
The overarching theme behind the crash of Alitalia flight 404 was a failure by numerous parties to utilize the latest innovations in flight safety. The technology that could have prevented the accident already existed — NAV receivers with output monitoring, standard-display altimeters, PAPI lights, and MSAW systems could have been installed but were not. This crash showed that being slow to upgrade was not merely risky, but dangerous. Experts had known of the dangers of unmonitored NAV receivers and drum pointer altimeters for years, but still Alitalia — whether through internal dysfunction, lack of funds, ignorance, or some combination of all three — never heeded those warnings. Flight 404 was Alitalia’s last fatal accident, and today, the antiquated systems that led to the crash are long gone. But it should not have taken the deaths of 46 people to get rid of them — that it did is testament to the fact that all too often, the inertia of industry can only be overcome by disaster.
_______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 140 similar articles.
You can also support me on Patreon.
