Paradox of the Improbable: The crash of West Air Sweden flight 294
On the 8th of January 2016, a Swedish cargo plane suddenly plummeted 30,000 feet in less than two minutes before slamming nose-first into the ground at more than 700 kilometers per hour. At the remote crash site in the Swedish Arctic, nothing remained but a snowbound crater, leaving little recognizable as having been part of an airplane. With both crewmembers dead, the black boxes would have to tell the tale of what happened to West Air Sweden flight 294 — only when investigators deciphered the flight data recorder, they realized the data didn’t make any sense. As it turned out, the false data and the fate of the plane were intimately connected. The failure of a critical gyro caused the captain’s instruments to go haywire, convincing him that a sudden upset had occurred. It was his reaction to this emergency — exacerbated by a poorly designed interface, and by the pilots’ failure to communicate with each other — which doomed the two men and their cargo.
West Air Sweden is a subsidiary of West Atlantic Group, a company which owns two dedicated cargo airlines, West Air Sweden and West Atlantic UK. West Air Sweden is one of the largest air cargo carriers in Sweden, with a fleet of nearly 40 aircraft, including four wide body Boeing 767s, as well as 33 British Aerospace ATP twin turboprops (amounting to more than half of all examples of that type in existence). The final portion of the fleet was made up of a handful of Bombardier CRJ200 regional jets. In a passenger configuration, the CRJ200 could carry about 50 passengers, but those owned by West Air Sweden had all been converted to the “Package Freighter” configuration, which included the removal of all windows and cabin amenities.
It was one of these CRJ200s that on the night of the 7th of January 2016 was scheduled to operate West Air Sweden flight 294, a regular mail flight from Oslo, Norway, to the town of Tromsø in the Norwegian Arctic. In command of the flight were a Spanish captain and his French first officer, neither of whom has been named; they had a fairly average combined experience of about 6,600 flight hours and no significant training deficiencies. Amid cold weather and clear skies, flight 294 departed from Oslo on time at 11:11 p.m. and headed northeast toward Tromsø. The pilots settled into the routine of cruise flight, chatting idly about personal topics as the 7th of January ticked over into the 8th. At around 12:17 a.m., as flight 294 cruised at 33,000 feet over Swedish airspace near the Norwegian border, the crew decided to perform the approach briefing, going over all the steps that would be needed to land at Tromsø. As they proceeded with this routine task, they had no way of knowing that something was about to go catastrophically wrong.
At 12:19 and 20 seconds, the pitch gyro of the number one inertial reference unit unexpectedly failed. An inertial reference unit, or IRU, is a device which measures the angular motion of the aircraft using a gyroscope and an accelerometer. The gyroscope determines the pitch, bank, and yaw of the aircraft, while the accelerometer measures acceleration; the IRU then processes this information and sends it out to various systems, including the pilots’ primary flight displays (PFDs), the autopilot, and the flight data recorder. The CRJ-200 has two IRUs, designated IRU-1 and IRU-2, which feed the captain’s and first officer’s instruments, respectively. On board West Air Sweden flight 294, an unknown failure — perhaps a data processing error — caused the pitch data produced by IRU-1 to become corrupted. This false pitch data was passed on to all the aforementioned systems, including the captain’s PFD. The PFD contains most of the instrumentation needed for a pilot to fly the airplane, including the attitude indicator — which displays pitch and bank — along with airspeed, altitude, and other critical information. When corrupted pitch data from IRU-1 reached the captain’s PFD, it caused his attitude indicator to display a pitch up motion which was not actually occurring.
At first, the apparent pitch up was small, but over a period of a couple of seconds it rapidly increased in magnitude. Simultaneously, the autopilot disconnected as it received conflicting pitch commands from the two IRUs, triggering a loud, continuous alarm. A comparator measuring the difference between the indications of the two PFDs also detected a mismatch, and a flashing yellow “pitch miscompare” warning appeared on both pilots’ attitude indicators, along with an automated message on the computer screen and a chime issued through cockpit speakers. All of this took place in less than three seconds, catching both pilots completely by surprise. Observing a terrifying pitch up that appeared to present a grave danger to the safety of the flight, the captain exclaimed, “What the fuck!” and began to push the nose down. Meanwhile, the first officer, whose PFD indicated that they were still in level flight, struggled to figure out what was going on.
As the angle of the indicated pitch up exceeded 30 degrees, the captain’s PFD entered what is known as “declutter” mode. When the pitch of the airplane is greater than 30 degrees or less than -20 degrees, or the bank angle is greater than 65 degrees, all unnecessary information disappears from the PFD, leaving only the raw attitude indication, and a set of red arrows telling the pilot how to fly out of the unusual attitude. This “decluttering” of the PFD is intended to help the pilot focus on visualizing the attitude of the airplane so that he or she can more easily recover control. But one of the items removed in declutter mode is the miscompare warning. When the indicated pitch on the captain’s PFD exceeded 30 degrees, it entered declutter mode and the miscompare warning disappeared, removing any indication that the PFD might be malfunctioning. Only four seconds had passed since the failure began, and already the warning was gone and the captain was beginning to push the nose down to recover from an upset that wasn’t really happening.
As the captain pushed the plane into a dive, the first officer, overwhelmed by confusion, could only exclaim, “What the fuck?” The negative G-forces caused by the sudden maneuver sent unsecured items crashing into the ceiling and caused severe disorientation. The unusual forces also disrupted the functioning of the engines, causing an automated voice to call out, “ENGINE OIL.”
After a few seconds it became clear to the first officer that they were entering a dive and needed to pull out. “Come up!” he exclaimed. By now his PFD had registered a nose down attitude greater than -20 degrees and also entered declutter mode. It still would have been simple for either pilot to look at the other’s PFD and realize there was a mismatch, but tunnel vision had taken over, causing both to focus narrowly on the extreme indications demanding their attention.
“Come on, help me, help me!” the captain shouted. He thought they were in a nose high position, in certain danger of stalling, but his inputs were doing nothing to correct the problem. Likewise, the first officer knew they were in a dive, but thought the captain was fighting to pull up without success.
The plane now entered an increasing roll to the left due to a random input made during first officer’s earlier attempts to grab the control column while in negative G. “Turn right!” he said, but he didn’t realize that the captain’s PFD displayed a turn in the opposite direction. The IRU requires correct pitch information in order to calculate bank angle, and when the pitch data is false, the bank angle indication also becomes corrupted.
“Help me, help me!” the captain exclaimed again. As the plane accelerated downward, it exceeded its maximum operating speed, triggering an overspeed warning that filled the cockpit with a continuous rapid-fire clacking sound.
“Yes, I’m trying!” said the first officer. “Turn left, turn left!” With the plane pointed straight at the ground, rolling past 90 degrees to the left, he had succumbed completely to disorientation. A warning began to blare, “BANK ANGLE, BANK ANGLE.”
The first officer keyed his mic and broadcast a panicked distress call to air traffic control. “Mayday, mayday, mayday, Air Sweden 294! Mayday, mayday, mayday!”
“294?” asked the controller, startled by the sudden, frantic exclamations.
“Mayday, mayday, mayday, Air Sweden 294!” the first officer repeated. “We are turning back! Mayday, mayday!”
“294, mayday, 294,” the controller acknowledged. But he could see that the plane wasn’t turning back; instead, it was losing altitude rapidly, plummeting downward and veering off course to the east at close to the speed of sound.
“We need to climb, we need to climb!” the captain said, for the first time acknowledging that they were losing altitude. But his PFD still displayed a nose high position, and he kept pushing the nose down to try to level the plane.
“Yeah, we need to climb!” replied the first officer. But he still seemed to be focused on their extreme bank angle. “Turn left, turn left!” he repeated.
“No, continue right, continue right!” said the captain.
“Okay, shit!”
“No, help me, help me please!”
“I don’t know, I don’t see anything!” the first officer pleaded. “I think you are the — right to correct!”
“Okay, okay, yeah!”
“What the fuck!”
By now the plane was completely upside down, falling along a terrifying course toward the ground, far beyond any hope of recovery. The captain spewed expletives into the cacophony of warnings before the cockpit voice recording came to an abrupt end.
Just 80 seconds after the beginning of the upset, the inverted CRJ 200 slammed nose first into a snow-covered valley in a remote, uninhabited area of the Swedish Arctic. The high speed impact blasted a crater through several meters of snow and into the gravel beneath, compacting the plane like an accordion into the hole before spewing the mangled debris back out again, leaving a black splatter across the snow as the only sign of its passing.
As soon as the plane disappeared from radar, a search and rescue operation was launched to locate the aircraft. Swedish and Norwegian aircraft scoured the snowbound mountains of far northwestern Sweden under the polar night, hoping against hope that the crew would be found alive. At 3:07 a.m., two Norwegian F-16s stumbled across the crash site near Lake Akkajaure near the border with Norway. They reported what everyone already suspected: the plane had impacted the ground at high speed and it was obvious that neither pilot could have survived.
The job of finding the cause of the crash fell to the Swedish Accident Investigation Authority, or SHK. Investigators knew that the location of the crash would present a major challenge. There were no roads near the crash site, deep snow covered the area, and temperatures ranged from -25 to -40˚C. Furthermore, at such a northerly latitude in January, they could expect only 2 hours and 15 minutes of daylight out of every 24 hours. They would have only a brief window in which to collect evidence, after which the bulk of the analysis would have to be done in Stockholm.
After a truncated trip to the crash site, investigators brought back several key items, including the plane’s two black boxes. These could be the key that would unlock the story of West Air Sweden flight 294. But when investigators downloaded the data from the flight data recorder, something didn’t add up. The black box had recorded a sudden pitch up in cruise flight which continued for some time, momentarily reversed to a large pitch down, then returned to a large pitch up shortly before impact. But the other parameters, such as speed and angle of attack, didn’t correspond with this reading. If the plane had pitched up, its speed should have decreased and its altitude should have increased; instead, the opposite happened — the plane accelerated and began to lose altitude. At this point investigators realized that the pitch data had to be wrong.
The flight data recorder (or FDR) acquires its pitch data from the number one inertial reference unit. The fact that it recorded false pitch data meant that the pitch channel of IRU-1 must have failed. Such a failure would also affect the captain’s primary flight display, but not the first officer’s, or the standby indicator on the center console. The control inputs recorded on the FDR were consistent with a reaction to the false pitch data fed to both the FDR and the captain’s PFD. It was therefore established that the captain must have pitched down to correct what he thought was a dangerous nose-high attitude — and in the process, he flew his plane straight into the ground.
This left two key questions: why did the IRU fail, and why didn’t the pilots realize that the indications were false? Neither would be easy to answer.
To try to understand the IRU failure, the SHK examined the full operational history of that type of unit, but found no similar incidents across millions of hours in service. More than 9,000 of these exact units were in use on a wide range of Airbus, Bombardier, and SAAB aircraft, and yet no serious malfunctions had ever occurred. The unit’s rate of failure — any type of failure — was 5.7 per million flight hours across the entire fleet. Whatever happened to the IRU on West Air Sweden flight 294 must have been unimaginably rare. The SHK teamed up with the IRU’s manufacturer to run a wide variety of tests on a representative unit, but they were unable to reproduce a failure which even remotely resembled the one that precipitated the accident. The failed IRU from flight 294 was so thoroughly destroyed in the crash that no useful information could be gleaned from it. In the end, the SHK was unable to determine what caused the IRU to fail, except that it must have involved the pitch gyro, and it must not have exceeded the limitations which would cause the unit to mark the data as invalid. Beyond that, there was little they could say.
But at the end of the day, the failure of IRU-1 was not a dire emergency. It only affected the indication presented to one of the two pilots, and it had no effect on the controllability of the airplane, save for the disconnection of the autopilot, which should not cause any real difficulty for the crew. The key to the sequence of events lay with how this failure was presented to the pilots, how it affected their states of mind, and how they were trained to handle it.
It didn’t take long for investigators to discover that the design of the pilots’ PFDs probably played a role. When the comparator detects a mismatch between the two sets of attitude data, it displays a miscompare warning (in this case, “PIT”) on both pilots’ PFDs, which flashes repeatedly for several seconds to gain their attention before stabilizing. But the fact that the miscompare warning would disappear if the PFD went into declutter mode represented a significant design flaw. The danger of this feature was obvious, because the miscompare warning would still disappear even if the “unusual attitude” that triggered declutter mode was caused by an instrument failure. In the event, this made it harder for the captain to realize that his PFD was malfunctioning, because the miscompare warning only appeared for four seconds — not enough time for him to process what it meant.
Despite the absence of the miscompare warning, the captain could have looked at his copilot’s PFD or at the standby attitude indicator in order to realize that they showed something different. But while these indicators were easily within his field of view, noticing them would have been harder than it might seem. When the captain suddenly saw his attitude indicator showing a pitch up in cruise flight, he was caught by what is known as the surprise effect. The sudden appearance of danger essentially put his brain into fight-or-flight mode. His vision narrowed in on what he needed to do in order to survive — which was, it seemed, to pitch the nose down. With this tunnel vision causing him to focus so intently on eliminating the perceived danger, his brain was less likely to pick up cues in his peripheral vision, such as the first officer’s PFD. In the dark of night with no visible horizon, there were no other significant cues which would have told him that his attitude indication was wrong.
Recovery from the situation therefore relied on the first officer clearly communicating with the captain about what was happening. Within moments of the IRU failure and the captain’s subsequent control inputs, the two pilots had developed conflicting mental models of the situation. The captain saw a high pitch with red arrows urging him to push down, while the first officer saw a low pitch with red arrows urging him to pull up. In order to recover control, they needed to reconcile these mental models. But before they could do that, they needed to realize that their mental models were different. Each man assumed that the other had the same mental model. When the captain called out, “Help me, help me,” he probably wanted his copilot to help him push the nose down, but the first officer certainly could not have come to such a conclusion, and to him it would have seemed more likely that the captain wanted him to help pull the nose up. Had the captain at any point mentioned how he wanted the first officer to help him, the first step — recognizing that their mental models were different — might have taken place, and from there, it would have been possible to detect the attitude mismatch and maybe recover control. Unfortunately, as the surprised and panicked pilots tunneled into their own PFDs, this crucial realization never occurred.
In a situation like this, training plays a critical role. Much of the training which pilots receive regarding flight without a visible horizon centers on trusting the instruments, and for good reason. Many planes have crashed because pilots relied on unreliable physical sensations even though their instruments were telling them a different story. In the case of West Air Sweden flight 294, this training worked too well: the captain trusted his instruments to the exclusion of other clues which indicated that the plane was still in level flight and not pitching up.
But there is a type of training which can help in such a situation. Called Upset Recovery, this training teaches pilots how to stay calm and communicate when the plane is in an unusual attitude. During upset recovery training, pilots are taught to suppress their instinctive reactions and instead call out the nature of the upset using standard phraseology, such as “nose high” or “nose low.” The other crewmember then confirms or denies the observation. At the time of the accident, upset recovery training was not required in Europe, but West Air Sweden had begun to provide it to some of its pilots anyway. Unfortunately, the pilots involved in the accident were not among them. Had the captain received this training, he might have first called out “Nose high” before pitching down, and the pilots would have quickly realized that there was an instrument mismatch. The crash, in all likelihood, would not have occurred.
In May 2016, five months after the crash, the European Aviation Safety Agency (EASA) mandated that all airlines in Europe provide upset recovery training for pilots, and West Air Sweden introduced training that would help pilots detect and respond to instrument failures. On top of these measures, the SHK recommended that the International Civil Aviation Organization promote upset recovery training worldwide, and that manufacturers ensure miscompare warnings are still present on the PFD even in declutter mode. The software logic of the CRJ 200 primary flight displays was reworked as a result of this recommendation to make sure miscompare warnings are never removed from the PFDs as long as a mismatch exists.
The crash of West Air Sweden flight 294 illustrated one of the main dilemmas of pilot training; namely, that the malfunction which precipitated the accident was so rare that it would be pointless to train pilots to react to that specific problem. But modern training increasingly aims to help pilots deal with the unexpected by providing standard callouts and procedures that can be applied to a wide range of emergencies. In addition to upset recovery training, other new strategies are also being developed. For example, in the event of an unexpected disconnection of the autopilot, the pilot flying, upon noticing the disconnection, should silence the warning and then announce “Autopilot off, I have control.” The cause of the autopilot disconnection doesn’t matter; this procedure can be applied universally. In this way, training regimes are increasingly working around the reality that the number of possible emergencies is too large for a pilot to learn about all of them. The crash of West Air Sweden flight 294 can and should serve as a teachable moment as the airline industry continues to adopt this approach to safety.
__________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 150 similar articles.
You can also support me on Patreon.
