Riven by Deceit: The crash of Partnair flight 394
Note: this accident was previously featured in episode 45 of the plane crash series on July 14th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 8th of September 1989, a Norwegian charter flight carrying employees of shipping company Wilhelmsen Lines abruptly plunged from the sky off the coast of Denmark, plummeting 22,000 feet in a matter of moments as the pilots engaged in a futile battle for control. All 55 people on board were killed as the plane broke up in flight, scattering wreckage over a wide area of shallow seabed. As Norwegian investigators launched an inquiry into what was at that time the worst air disaster in the history of both Norway and Denmark, focus centered on the aircraft itself: an aging, dilapidated 1953 Convair 580 with a convoluted modification record and a history of major mechanical problems. In the end, however, it would take several years for Norway’s Aircraft Accident Investigation Board to come to the astonishing conclusion that Partnair flight 394 was brought down not by a run-of-the-mill structural failure, but by a bizarre series of converging problems which caused the plane to literally vibrate itself apart in flight. And at the center of the story was a danger which, at least in commercial aviation, had until then been largely theoretical: counterfeit aircraft parts, which looked genuine at first glance, but couldn’t stand up to the conditions of normal operation. The implications of this finding would ultimately send authorities scrambling in the United States, as the Federal Aviation Administration launched a confrontation with a multi-billion-dollar shadow industry which continues to this day.
◊◊◊
Beneath the world of regular commercial airlines with household names lies a sometimes overlooked underworld of smaller, scrappier companies, often with older planes, tighter finances, and less rigid corporate cultures. Most of these are charter airlines, which carry large groups on short notice without regular schedules, a model which can sometimes make for fickle business. Partnair, the focus of this story, was perhaps a quintessential example. Founded in 1968 to carry skydivers in a single Cessna 182, by the 1980s the company had grown to the fifth largest airline in Norway by revenue, which sounds impressive only until one notes that the population of Norway in 1985 was a mere 4.2 million.
Partnair reached that point in large part through its 1984 purchase of rival airline NorFly Charter, which brought with it two 1950s-era Convair CV-580s. Originally produced as the CV-340/440 by US manufacturer Convair between 1947 and 1954, the planes had been converted to CV-580s when their radial piston engines were replaced with much more powerful aftermarket Allison 501-D turboprop engines. The Convairs had been abandoned by mainline carriers in the late 1950s, but they lived on among second and third tier charter airlines like NorFly and Partnair, which often modified them to carry more passengers and thus generate more revenue.
In 1986, Partnair sought to expand its Convair fleet to three aircraft, and it managed to find a CV-580 for sale in Canada. Owned by a company called Kelowna Flightcraft Limited, based in the town of Kelowna in interior British Columbia, the plane was being restored to airworthy condition for potential buyers, and Partnair jumped on the sale. By May 1986, the plane had been given the Norwegian registration LN-PAA and was on its way to join Partnair’s fleet.
LN-PAA had a long and at times sordid history. Delivered new to United Airlines in 1953, the plane carried paying passengers until 1959, at which point it was sold to General Motors for use as an executive aircraft. General Motors upgraded it to a turboprop CV-580 in 1960, and continued to use it for 11 years, before it was passed off to the Latin American airline Servicio Aéreo de Honduras S.A., known as SAHSA. This airline operated the plane until 1978, when it was involved in an accident caused by the collapse of the nose gear. The crash inflicted substantial damage, and the plane was sent to the US for repairs. Between 1978 and 1981, it passed through three small-time owners before eventually landing at Puerto Rico International Airlines, or Prinair, the ailing flag carrier of the US territory of Puerto Rico. In 1983 Prinair leased or sold it to another Puerto Rican airline, but at some point — the exact date has been lost to time — it ended up back at Prinair again, where it remained until it was grounded in September 1984. The plane sat derelict at the airport in Opa Locka, Florida for 11 months, until Kelowna Flightcraft, a major restorer of Convairs, purchased it in August 1985. Partnair acquired it the following year, becoming the plane’s 11th and ultimately final owner.
◊◊◊
In service with Partnair, LN-PAA did not demonstrate exceptional efficiency or reliability. The plane wasn’t a lemon, per se, unless you want to call every aging Convair a lemon, but it suffered its fair share of breakdowns. The mechanics who rode along on all Partnair’s flights had their work cut out for them, especially as the 1980s drew to a close and the airline’s financial situation worsened. Partnair was said to be pushing the planes to carry out as many flights as possible in order to stave off bankruptcy, and mechanical problems were increasingly being deferred due to a lack of maintenance downtime. On September 6th, 1989, for instance, the cabin crew had trouble closing the main entrance door and stairway; the pilots struggled to start the right engine; and the left AC (alternating current) electrical generator wasn’t hooking up to the left AC distribution system. This latter problem was the most serious, prompting a return to the airline’s base at Oslo Airport Fornebu for repairs. The generator had kicked offline during a positioning flight to Stavanger without passengers, and the next scheduled flight wasn’t until the following day, so mechanics took the time to replace the left AC generator, mounted in the left engine.
The plane subsequently flew to Stavanger, then to Aberdeen, Scotland; back to Stavanger; and finally back to Oslo on September 7th. During this time, the left AC generator fault was recorded again, despite the generator having been replaced. Mechanics again set about troubleshooting, but time soon ran out. The company had added a new last-minute flight to Trondheim on the morning of the 8th, and they weren’t willing to reschedule. Instead, the pilots proposed a temporary, ad-hoc solution: during the flight, they would power the left AC system using the Auxiliary Power Unit, or APU, instead.
An APU is a small turbine generator, usually mounted in the tail behind the passenger cabin, which provides electrical power to the aircraft while parked without the engines running. The APU can also be used to provide power in an emergency, such as a dual engine failure or generator malfunction. On the Convair 580, however, there was no procedure which called for the use of the APU in flight other than in an emergency, but the pilots seemed to have believed otherwise, probably due to imprecise wording in the Minimum Equipment List, or MEL, which lists the systems on the airplane that may be inoperative at dispatch. On this aircraft, the MEL entry for the electrical generators stated that “both” AC generators must be operative in order to depart — but the aircraft had three such generators, not two, so the word “both” was rather ambiguous.
As it turned out, LN-PAA was not originally manufactured with an APU. The plane initially had two AC generators, one powered by each engine, while the APU was installed as an aftermarket modification in 1963. It was later removed, before being put back in 1979, only to be removed again while the plane was mothballed at Opa Locka. Kelowna Flightcraft had subsequently tracked down the original APU and installed it yet again, but no one ever updated the MEL to reflect its presence. Therefore, when the MEL said that “both” generators must be operative, it meant all of the generators which were installed when it was written, which was two of them, and the use of the third generator, the APU, as an alternative power source in flight was not envisioned. The pilots may have believed that using the APU in flight was safe because it was prescribed by certain emergency procedures, but the validity of this assumption was, in hindsight, doubtful.
Nevertheless, the mechanics agreed to defer the generator repair, and the plane subsequently departed for Trondheim with the APU powering the left AC system. The APU ran for the first 17 minutes of the flight before apparently being turned off near the top of the climb, without having caused any adverse effects. The reason why it was turned off is not stated in official documents, but it could have been because the left AC generator started working again. It is also unknown whether the APU was used again on the flight back from Trondheim to Oslo later that morning.
In any case, LN-PAA’s next scheduled flight was to take place that afternoon, from Oslo to Hamburg, West Germany. The trip, designated flight 394, had been chartered by the Norwegian shipping company Wilhelmsen Lines in order to transport 50 of its employees to a naming ceremony for a new ship in the port of Hamburg, and the passenger list included both company executives and ordinary workers who had won an office lottery. The manifest also featured five crewmembers, including two flight attendants, a mechanic, and two pilots, Captain Knut Tveiten and First Officer Finn Petter Berg, both of whom were 59 years old with about 16,700 hours of flight time each, much of it in Sub-Saharan Africa. Their experience and stick-and-rudder flying skills certainly weren’t in question.
First Officer Berg was also Partnair’s Flight Operations Manager, a high-ranking managerial position, and he would certainly have been well aware of the company’s increasingly dire finances — an issue which came to a head just before flight 394 left to Hamburg. According to some sources, Partnair owed substantial amounts of money to the government in unpaid fees, including to state-owned carrier Scandinavian Airlines, which provided Partnair’s in-flight catering services. Hours earlier, Norway’s Civil Aviation Authority had allegedly ordered all Norwegian airports to bar Partnair planes from departing with any outstanding fees. Flight 394 was therefore slightly delayed, because the company had taken delivery of the catering for the passengers but had yet to pay the bill, and witnesses said they saw First Officer Berg leave the plane to cover the debt using cash.
With that obstacle out of the way, and all 55 passengers and crew back aboard, flight 394 taxied to the runway and took off at 15:59 local time. The APU generator was running as the plane climbed to its cruising altitude of 22,000 feet, which it reached at 16:23. Leaving Norwegian airspace, the crew contacted Copenhagen area control and advised of their position. The flight continued for some time, albeit not entirely uneventfully, as the passengers and crew were treated to a fairly close-up view of a Norwegian Air Force F-16 fighter jet which passed them in the opposite direction, 2,000 feet above and in the same airway. Still, there was no sign that anything was amiss, and the flight attendants set about serving the in-flight meal.
Five minutes later, however, the sense of normalcy began to break down. Increasingly heavy vibrations rocked the plane, and the pilots may have disconnected the autopilot. The flight’s heading and speed began to vary erratically. The pilots were losing control of the rudder, and with it, their ability to prevent the plane from veering off course to the right. The issues must not have been serious enough to prompt them to declare an emergency, but by the time they were, it was too late to do so. Just over 35 minutes into the flight, the plane suddenly veered hard to the left, swung back to the right for three seconds, and then rolled left so hard it flipped upside down in the blink of an eye. The effects in the cabin must have been catastrophic. Loose objects would have been flung in every direction: dishes, personal belongings, drinks carts, papers, magazines, trash. The maneuver was so dramatic and startling that First Officer Berg reflexively swallowed an entire toothpick.
As the plane turned over, pieces of the tail tore away, trailing behind like confetti; the rudder then separated entirely, crippling the aircraft beyond any hope of recovery. Plunging headlong toward the sea, the pilots may have pulled the APU emergency shutoff switch, but if the generator was the cause of their difficulties, it was much too late. Moments later, at an altitude most likely below 10,000 feet, the elevators failed under the extreme stress of the dive, causing a sudden pitch down which ripped the outermost seven meters off of both wings simultaneously. The cabin burst open, ejecting loose objects and debris out into the sky, and then what remained of the plane plummeted into the sea, impacting seconds later with a sound like thunder.
◊◊◊
In Copenhagen, air traffic controllers spotted flight 394’s sudden plunge on radar and attempted to contact the plane, but they never received a reply. The plane’s transponder return disappeared seconds later, still at a high altitude, but some kind of small object continued to appear, slowly drifting down from 22,000 feet, for nearly 40 more minutes. What it was, no one could say.
Rescuers soon launched toward the suspected crash site, located in the Skagerrak, the strait connecting the Baltic and North Seas, about 18 kilometers off the town of Hirtshals in northern Denmark. When they arrived, they found light debris and bodies floating on the surface, having clearly fallen from a great height. Although 31 victims were recovered, all were dead, with the violence of the crash having left no possibility of survival for any of the 55 passengers and crew. That made the accident the deadliest in the history of both Norway and Denmark, a tremendous shock to two small countries unused to mass peacetime tragedies. The crash of a Russian airliner in the Norwegian Arctic in 1996 later usurped one of those titles, but the disaster is still the deadliest to occur in Denmark as of this writing.
Although the crash occurred in Danish airspace, the plane came down just outside Danish territorial waters, meaning that responsibility for investigating the crash lay with Norway’s Aircraft Accident Investigation Board, or AAIB/N, representing the country of registration. They faced an enormous technical challenge: there were no survivors or eyewitness, and the plane was broken into many pieces, scattered over a wide area of muddy seabed under 40 to 90 meters of water. Special equipment was hired to recover the wreckage, piece by piece, so that the AAIB/N could put them back together again, in the process hopefully revealing the cause of Partnair flight 394’s abrupt mid-air breakup.
Initially, a few Norwegian papers openly speculated that the plane had been brought down by a bomb, a conclusion apparently drawn from the fact that, with elections looming, Norwegian Prime Minister Gro Brundtland had used that very plane to travel to a campaign stop just days before the crash. Naturally, investigators tested the wreckage for explosive residue, and lo and behold, they did find some — specifically, traces of the military explosive RDX. But the concentration was much too low to have come from a bomb or a missile, and in the lead investigator’s view, its presence was more likely indicative of contamination, either during recovery or while the wreckage was on the ocean floor. Furthermore, no missile or bomb fragments were found in the bodies, and in general, the wreckage showed no signs of having been exposed to an explosion or fire.
Investigators were also disappointed to discover that the plane’s cockpit voice recorder (CVR) had malfunctioned, causing the recording to stop when the pilots advanced the thrust levers to takeoff power on the runway. The CVR had been modified with a relay that was supposed to automatically transfer the power source from DC to AC when the engines reached takeoff power, but the relay was faulty and simply cut power to the device instead. This had not been detected during routine inspections because the issue only manifested when the plane was underway.
The flight data recorder (FDR), by contrast, would prove key to unraveling the mystery — not because of what it recorded, but how. The recorder was an antiquated model which etched five parameters, including airspeed, altitude, magnetic heading, and vertical acceleration, into a slowly rotating spool of metal foil using several diamond-tipped recording heads. The vertical acceleration parameter was faulty and recorded nothing, but interestingly enough, the altitude trace was sometimes recorded twice, with a second, parallel line appearing alongside the primary trace at periodic intervals (shown above). Since there is only one altitude recording head, this could only have happened if the arm holding the recording head was vibrating back and forth with an amplitude well outside the manufacturer’s specifications. Furthermore, on the accident flight, the double trace started earlier, and the two traces were farther apart, than on any previous flight, strongly suggesting that the double trace and the crash could have a common cause.
Investigators also noted that the problem had been around for some time: the foil recording spool had recorded flights dating back months, and the double trace was present throughout. It didn’t happen on every flight, but it did appear on the majority, up until July 1989, when it abruptly stopped.
This break in the pattern of double traces corresponded to a weeks-long maintenance overhaul session between July and August 1989, shortly before the crash. Partnair normally contracted out heavy maintenance on its Convair fleet to a Norwegian firm called the Fred Olsen Aircraft Company, but in the case of the scheduled overhaul on LN-PAA, Fred Olsen and co. lacked the capacity to perform the necessary work. The company therefore subcontracted the work one step further, to Kelowna Flightcraft Limited, the aircraft’s previous owner and a worldwide center of Convair expertise. The plane was then sent to Kelowna, British Columbia, where Kelowna Flightcraft mechanics and inspectors subjected it to a major structural inspection and repair program known as a D-check.
During the D-check, mechanics conducted both visual and ultrasound inspections of the bolts connecting the vertical stabilizer to the fuselage, and found one of the bolts to be damaged.
The Convair 580’s vertical stabilizer is structurally attached to the fuselage via only four attachment points — everything else is not load-bearing. Each of these attachment points consists of a dual-lug bracket on the stabilizer which fits over a corresponding single-lug bracket attached to the fuselage structure. Bolts were then screwed through the two brackets, holding them together. Each bolt in turn consisted of a pin, threaded on the outside, and a cone-shaped sleeve, threaded on the inside, which accommodated the pin. The sleeve would flex outward as the pin was screwed further in, expanding to fill the space inside the lugs and eliminate any “give” in the attachment.
In the case of LN-PAA, the mechanics found that the right rear pin and sleeve had worn down significantly, to the point that it was visibly in need of replacement, and indeed it was replaced.
Here investigators noted several issues with the way Kelowna Flightcraft accomplished the inspection and replacement. According to mechanics interviewed by the AAIB/N, they conducted the ultrasound inspection while the bolts were still attached to the plane — a violation of prescribed procedures, which called for the pins and sleeves to be removed first. This potentially could have masked damage to the bolts. Furthermore, the replacement of the right rear bolt was carried out without unloading the stabilizer, which would have made it difficult to line up the lugs and insert the new bolt, although the maintenance logs made no mention of this. But most critically of all was a simple matter of judgment: after all, the AAIB/N pointed out, if one of four identical components had worn out, then it would be reasonable to suspect that the others had worn out as well. And yet no one ever pulled out the other three bolts for a closer look.
After the D-check, a Norwegian inspector from Fred Olsen Aircraft Company looked over the paperwork, discovered that Kelowna Flightcraft had accomplished the ultrasound inspection incorrectly, and refused to sign off. However, the inspection of the bolts was not technically required until the plane had accumulated 40,000 flight hours, and it was currently at 36,800, so an agreement was reached to redo the inspection later. In the meantime, the aircraft was cleared to return to Norway so as not to interrupt Partnair’s schedule. Just days later, before the do-over inspection could be arranged, the airplane crashed.
◊◊◊
The FDR revealed that during the first 9 flights after the maintenance session, only a single altitude trace was recorded, indicating that the vibrations had stopped. But after that, they came back with a vengeance, now worse than before. That suggested that the cause of the vibrations was likely connected to the work done during the D-check in Kelowna.
Because one vertical stabilizer bolt was faulty, it was possible that the others were as well, and if this was the case, the loose bolts could potentially be the cause of the vibrations. The AAIB/N managed to locate the bolts among the wreckage and subjected them to detailed analysis, but such analysis turned out to be barely necessary: in fact, it was visually apparent that all three bolts, both the pins and the sleeves, were abnormally worn, with much deeper damage than would be expected at this point in their service lives. So much material had worn away that the bolts no longer fit snugly through the lugs, allowing the entire vertical stabilizer to move laterally by almost a millimeter.
This finding pointed investigators to aeroelastic flutter as a potential cause of the crash. Readers may recall my earlier article on the Lockheed Electra, which discussed the phenomenon extensively. In basic terms, aeroelastic flutter is a form of oscillation which can arise in a surface under the continuous, aperiodic application of energy. When continuous energy is applied to an object, whether it’s a wing, a tail, the ocean, or a piece of wood, it will tend to vibrate, or oscillate, at a particular natural frequency. Normally, these oscillations are “convergent,” meaning that as time passes after the initiating event, they tend to decrease in amplitude. This decrease in amplitude occurs because the energy being applied is insufficient to overcome the object’s inherent stiffness, which “damps” the oscillations. On the other hand, nothing built by humanity is infinitely stiff, which means that there is always a certain energy input level above which the oscillations will become divergent rather than convergent. That means that if the energy input is sufficient to overcome the inherent stiffness of the object, the amplitude of each oscillation will grow unchecked until the object eventually vibrates itself apart. This is the phenomenon known as aeroelastic flutter.
In my Lockheed Electra article, I explained that the infamous Tacoma Narrows bridge succumbed to aeroelastic flutter because the bridge deck was not stiff enough to damp the oscillations induced by the high winds on the day of its collapse. Similarly, above a certain speed, the energy from the airflow over an airplane’s hinged control surfaces, wings, or tail becomes sufficient to overcome these components’ inherent stiffness and excite oscillations of perpetually increasing amplitude. This is why airplanes have a maximum speed, and why they will eventually break apart in flight if they exceed that maximum speed, even under a continuous vertical loading of 1G.
In the case of the Lockheed Electra crashes, a loss of stiffness in the engine nacelles due to undetected damage reduced the amount of energy needed to cause divergent oscillations of the engine assembly, making aeroelastic flutter possible at normal cruising speeds. Therefore, AAIB/N investigators postulated that the loose bolts securing LN-PAA’s vertical stabilizer could have had a similar effect, allowing divergent oscillations of the stabilizer assembly during normal flight, eventually leading to loss of control, structural failure, or both. Furthermore, if the stabilizer had been vibrating back and forth because of the loose bolts, it would explain the double line recorded on the altitude parameter of the FDR, because the FDR was attached to the same interior bulkhead as the stabilizer’s two forward attachments. These vibrations must have been occurring at a similar frequency to the natural frequency of the FDR’s altitude recording arm, but not that of the other recording arms, explaining why only this trace produced the distinctive double line.
There was, however, one major question about this theory: if the stabilizer’s mounts were so degraded as to allow aeroelastic flutter at normal cruise speeds, why didn’t the accident happen earlier? After all, at no point before flight 394 had the plane ever suffered vibrations severe enough for flight crews to complain, as would surely be expected if the oscillations in the tail were close to becoming divergent. The simple fact was that even with the play present in the stabilizer bolts, the airstream over the tail at the Convair’s cruising speed of 200 knots did not contain sufficient energy to sustain divergent oscillations. If this was what happened, then there must have been some other source which provided the extra energy needed to tip the oscillations over the divergence threshold.
As it turned out, there was one such potential source: the Auxiliary Power Unit. The turbine inside the tail-mounted APU spins at 40,000 RPM and contains an incredible amount of kinetic energy in need only of a means of transference to the already vibrating vertical stabilizer. Normally this cannot occur because the APU is fixed stiffly in place by two mounts in the rear and a single mount in the front. But as investigators soon discovered, the front APU mount on LN-PAA was broken clean in two due to metal fatigue — the slow breakdown of the metal under repeated load cycles. Furthermore, damage to the two halves of the mount showed that they had come back into contact many times after separating, which proved that this mount broke before, not during, the crash.
Witnesses recalled that on the flight before the crash, the APU was used in the air to supply power to the left AC system due to the faulty generator on that side, and that this generator was not repaired before the accident flight. Additionally, melted fragments of cabin furnishings were found inside the APU turbine, indicating that it was still spinning when the plane broke apart. And on top of that, the APU fire extinguishing system was found empty of extinguishant, suggesting that one of the pilots may have pulled the APU emergency shutoff handle. These facts indicated that not only was the APU running at the time of the crash, but that the pilots might even have suspected it as the cause of their difficulties. (It should be noted that the finding of cabin fragments inside the APU was not mutually exclusive with the pilots having pulled the emergency shutoff handle, because the sequence of events unfolded very rapidly and the turbine would not necessarily have had sufficient time to spool down before the plane broke apart.)
If the APU was running during flight 394, and its forward mount was broken, the APU could have begun oscillating in place due to the flexibility of the remaining two mounts in the rear. This was the missing link: the means by which the energy from the APU was transferred to the vertical stabilizer. Something excited the oscillation of the APU — perhaps, the vibrations already present in the tail section due to the loose bolts got it going. If so, then the oscillation of the APU and the oscillation of the vertical stabilizer could have entered resonance, feeding and amplifying each other indefinitely. Between the APU turbine and the airflow over the stabilizer, sufficient energy was at last present for the oscillations in the stabilizer to become divergent, at which point the fate of flight 394 was sealed.
It is worth noting that although the APU was used during the flight to Trondheim earlier on the day of the accident, the aircraft did not crash at that time. The official report on the accident does not directly explain why a crash was avoided on this earlier flight, but the available information does allow for an educated guess. According to the FDR, on most flights the vibration in the vertical stabilizer didn’t normally start until the engines were throttled back from climb power to cruise power at the top of the ascent, due to variations in airflow associated with the propeller wash. This was also the point at which the APU was turned off during the flight to Trondheim, so there was probably no opportunity for the two vibrations to have entered resonance with each other. Only on flight 394, where the APU was left running well into the cruise phase, did this adverse linkage become possible.
Once the divergent oscillations began, the problems aboard flight 394 escalated very quickly. The first evidence of this was seen on the FDR at about 16:34, when the aircraft’s heading became unstable. This likely occurred because the rudder, which controls yaw, was attached to the vertical stabilizer, and was therefore swaying farther and farther to each side as the amplitude of the stabilizer’s oscillations increased. The pilots could not have failed to notice, and they probably identified difficulties controlling their airplane’s yaw and heading. Over the next minute, these problems steadily worsened, until the oscillations attained sufficient energy to force the rudder past its maximum travel range, at which point the plane began to veer sharply in one direction, then the other.
Normally, the rudder’s range is restricted by a system of counterweights, but their damping capacity was overcome by the increasingly violent oscillations. As the rudder moved beyond its maximum travel range, the counterweights began to impact the insides of the shroud doors, a pair of removable panels covering the gap between the vertical stabilizer structure and the rudder. Made from a light aluminum honeycomb, the shroud doors could not withstand these repeated impacts, and they consequently shattered. Investigators realized that it must have been pieces of these shroud doors which continued to show up on radar for 40 minutes after the crash, slowly drifting down from 22,000 feet.
Meanwhile, without the shroud doors, and with the stabilizer warping more and more with each oscillation, the rudder finally jammed beyond the maximum nose left position. This caused an extremely rapid left yaw transitioning to a left roll, which was captured on the flight data recorder and was evidenced by the First Officer’s extraordinary startle reflex. With the rudder hanging out in the open without the protection afforded by the shroud doors, the aerodynamic forces involved in the sudden roll probably ripped it right off the plane, at which point control was permanently lost. The pilots may have attempted to recover by shutting off the APU and pulling out of the dive, but the plane was uncontrollable, plunging downward and accelerating rapidly. Before long, the extreme forces of the dive ripped off the tail, wingtips, and parts of the cabin, sending the wreckage raining down into the sea from between 5,000 and 10,000 feet. Autopsy results would later show that Captain Knut Tveiten was still gripping the yoke in a desperate attempt to recover when the plane hit the water.
◊◊◊
Partnair flight 394’s dramatic and violent end was brought about by a sequence of events which may have been unique in the history of commercial aviation. But the AAIB/N also noted organizational failures which made that sequence of events possible, especially with regard to the modification status of the airplane and Partnair’s documentation thereof. The fact that the MEL predated the installation of an APU in the aircraft was one of many issues with this document that rendered several key segments inapplicable and encouraged pilots to come up with their own, ad-hoc solutions. Flight manuals and maintenance manuals suffered from the same problem, as they did not reflect the actual configuration of various aircraft systems. These discrepancies appeared to have come about due to the plane’s lengthy and complex ownership and modification history, which included large swaths of documentation that were missing or available only in Spanish (a language not widely spoken in Norway). They also reflected Partnair’s failure to apply any effort to keeping the documentation up-to-date, because a few minor discrepancies is one thing, but the MEL not even mentioning the fact that the plane has an APU could probably be considered negligence.
One month after the accident, Partnair went bankrupt, ceased all operations, and dispensed with its aircraft, and no Norwegian airline ever again operated Convair 580s. However, the owners of Partnair, brothers Rolf and Terje Thoresen, later created another company which bought some of Partnair’s few assets, which they operated under the name Air Stord for another ten years. As late as 15 years after the crash, they were still insisting that Partnair had not been at fault and that the plane broke apart due to a pressure wave from the passing F-16, briefly mentioned above. This theory was always quite doubtful — although a Swedish research firm (hired, of course, by the Thoresen brothers) concluded that the pressure wave could have caused the crash, Norwegian investigators calculated that the jet would have to have been “within a few meters” of flight 394 for its pressure wave to have had any effect whatsoever. Furthermore, the loss of control began a full five minutes after the fighter jet passed, so it was hard to see where the connection between the two events was supposed to be. A judge came to much the same conclusion in 2004, ruling that Partnair was at fault in the crash, not the Norwegian Air Force.
However, Kelowna Flightcraft also found itself under scrutiny, and it was here where events started to take a turn down a very large and very illegal rabbit hole. The AAIB/N found Kelowna Flightcraft’s overall operations to be satisfactory, and not only did the company continue operations, it’s actually still around today. As of this writing it was one of the last remaining operators of Convair CV-580s, which it has kept in service for nearly 70 years after the final airframe rolled off Convair’s production line. But it was impossible to overlook the fact that the company had used improper inspection procedures which failed to detect that all of the vertical stabilizer bolts were faulty, not just one; and that the APU’s front support was in poor condition as well.
In fact, investigators found, not only were these parts damaged or worn out, they had actually been faulty from the moment they were installed. The reason that the tail bolts wore out so much sooner than expected was that they had been improperly heat treated during manufacture and were only 55–60% as hard as called for in Convair’s specifications. If they had been up to spec, the tail would not have started vibrating, and the crash wouldn’t have happened — period.
The APU mount was an even worse case of sub-standard manufacture. The mount appeared to have been made out of a bolt crudely welded to a literal block of iron, almost medieval in its construction, as though someone had fabricated it in a matter of minutes out of scraps lying around the workshop. In contrast, even the stabilizer bolts were at least made out of the right materials!
The question naturally arose as to where these parts had come from, given that there are strict standards which aerospace grade parts must meet. The APU mount apparently came with the APU when Kelowna Flightcraft acquired it, and no one looked too closely when it was reinstalled, probably because the inspection documentation hadn’t been updated to mention the APU. As for who originally made the mount, no one could say.
The origin of the stabilizer bolts was equally murky. Kelowna Flightcraft had installed the bolts new in 1986 when it overhauled the plane for sale to Partnair, and three of these bolts were still in the plane when it crashed, the fourth having been replaced in July 1989, as mentioned earlier. But Kelowna Flightcraft told the AAIB/N that it didn’t implement an inventory tracking system until 1987, so the bolts could have come from any of their five major suppliers, and there was no way to know which. The company was certainly unaware that they were not aircraft-grade, and in fact there would have been no reasonable way to detect this until they wore down early in service.
The official Norwegian report on the accident didn’t dive much deeper into this topic, but the publication of their findings in the early 1990s did add fuel to growing alarm in the United States over what industry insiders increasingly believed was a massive problem with “unapproved” spare parts.
An approved part has a range of definitions, but in general it means either a specific part certified by the FAA as part of the plane’s original design and produced in accordance with the manufacturer’s specifications by a company carrying an FAA-issued Parts Manufacturing Approval certificate; or a standard part, such as a nut or common bolt, produced according to published industry specifications. By contrast, an unapproved part is anything that isn’t an approved part. It can be a non-standard part which was built by a company without a PMA; a part that has exceeded its legal life limit; a part that was stolen; a part that was damaged and repaired by unauthorized persons; a part whose approved status cannot be established; a part that was rejected from the manufacturer’s production line; or even a part that is outright counterfeit, made to look like an approved part but without adhering to the original specifications. Other types of unapproved parts also exist, but these are some of the main ones.
In the case of LN-PAA, the APU mount and the stabilizer bolts were all unapproved parts: the mount was probably manufactured using improper techniques by an individual not possessing approval to do so, while the stabilizer bolts may have been production line rejects or high-quality counterfeit. In any case, deception occurred somewhere along the way, because when Kelowna Flightcraft purchased them they were probably branded as legitimate.
So, one might ask, how did these parts get onto an aircraft? The answer was far from simple, but it was ultimately the result of a lack of clear legal guidelines for the spare parts industry. The problem was threefold: first, while one needed to hold a PMA to manufacture approved parts, one didn’t need any kind of approval to sell them; second, it was not and still is not illegal to possess, modify, or sell unapproved parts, so long as one does not attempt to pass them off as airworthy; and third — who was watching? Certainly the FAA is not checking every time a part is sold or installed on an airplane.
These problems helped give rise to a shadow industry known as “parts brokerage.” Because no approval was required to buy or sell aircraft parts, the barrier to entry into the business was non-existent. Former Department of Transportation Inspector General Mary Schiavo summed it up in an interview for Mayday in 2009: “If you had a telephone and a fax, you were a parts broker,” she said. “Overnight, you could be in the parts brokerage business.”
Furthermore, once in operation, parts brokers were not subject to FAA oversight and were in fact not mentioned in any FAA regulations. Unscrupulous individuals could therefore set up supply chains of unapproved parts, pass them off as real, and sell them to customers, and they were unlikely to be caught unless one of the customers reported them to the FAA. But the customers generally didn’t do this, because they feared that the FAA would come for them instead — so the industry just kept growing.
People on the ground in the aircraft maintenance industry were certainly aware of the problem. For instance, Robert Luedeman, author of a 1996 academic paper on unapproved parts, wrote that he had received several calls from parts brokers seeking to buy rejected or worn out parts from his engine repair shop. Many repair stations ignored these types of calls, but some did sell the parts, despite knowing where they would end up. Other parts brokers used even less scrupulous means: organized theft rings were sometimes assembled to steal parts directly off parked aircraft, while others looted the wreckage of crashed airplanes, and those with particular skill used a variety of crafty techniques to make fake parts from scratch. Specialized parts which had been overhauled to restore them to airworthy condition required a stricter paper trail, including a special yellow tag signed by an FAA inspector, but that too was no matter: fraudsters simply mass-produced fake FAA yellow tags, complete with the forged signatures of FAA inspectors.
The hotbed of this kind of activity was South Florida, and in particular along 36th street in Miami, which has long been home to shady, bottom-of-the-barrel aircraft support services with ties to Latin America and Africa. In 1996, for instance, parts stolen from the wreckage of American Airlines flight 965, which crashed in Colombia in December 1995, turned up in this shadowy spare parts marketplace, forcing American Airlines to publish a list of all the parts known to be missing from the crashed Boeing 757. In another case, a former drug trafficker from Colombia told South Florida detectives that she had switched to trafficking aircraft parts instead. After all, the money was almost as good — by some estimates, during the early 1990s, unapproved parts represented a $2 billion industry.
◊◊◊
Prior to the 1990s, the few purveyors of unapproved parts who ended up being caught almost invariably lost the game because they tried to provide those parts to the United States government under contract. Sale of unapproved parts was not in and of itself a crime, so these companies and individuals were usually charged with defrauding the United States or were sued in civil court for breach of contract. Of course, this meant that only those brokers mindless enough to try to hoodwink the US government faced consequences, while nobody did anything about the much larger number who were selling unapproved parts to commercial repair stations and airlines.
The problem was that these companies were highly incentivized to buy unapproved parts rather than approved ones, for the simple reason of cost. A lot of organizational overhead goes into proving that every part meets the manufacturer’s and the FAA’s specifications, and this cost is passed on to the consumer via prices which may be several times higher than similar parts produced without that overhead. Buying unapproved parts often comes with hidden costs down the road when those parts fail earlier than planned, but for cash-strapped companies focused on the short-term, these deals could seem too good to pass up. And even at major airlines, which can afford to take a longer-term view of the issue, unapproved parts still sometimes found their way into inventories farther up the supply chain where priorities were less clear-cut. The result was that unapproved parts were everywhere, and some people knew it — but others did not, or at least refused to acknowledge it.
Shortly after the Partnair crash, Mary Schiavo was appointed Inspector General of the Department of Transportation, the post responsible for enforcing transportation laws in the United States. Known inside the industry as “Scary Mary” due to her strong language, persistence, and willingness to hold a grudge, she was also an activist on the issue of unapproved parts, and came to power with a singular goal: to rip out the shadow industry by the roots. Anything which stood in her way was liable to suffer withering criticism, and before long she concluded that her biggest obstacle was in fact the FAA itself. When she raised the issue with them, she was met with shrugs of indifference: apparently, FAA officials didn’t think the problem was serious. Allegedly, several major airlines even asked for stricter regulations in 1990, only to be rebuffed. On the other hand, the Partnair crash showed that unapproved parts had caused at least one major commercial air disaster, and might in theory cause more in the future. Even so, the FAA initially was reluctant to place any significance on the Partnair crash because it didn’t happen in the United States, notwithstanding the fact that the unapproved parts which brought it down very likely came from US-based brokers.
Instead of waiting to convince the FAA, Schiavo started cracking down on purveyors of unapproved parts with the means available to her, charging over 100 individuals and companies with crimes including but not limited to wire fraud, conspiracy, trafficking in counterfeit goods, and endangering the safety of an aircraft. The majority of the defendants were convicted and most received jail time.
Now under pressure from Schiavo’s very public campaign, the FAA initiated an audit of its own supply of spares in an attempt to get a handle on the scale of the problem. Sure enough, there were unapproved parts: out of the types of parts surveyed, 39% contained at least some stock whose approved status could not be confirmed. Some of these parts were found on aircraft operated by the FAA, and low-level employees were even aware of the problem, but had been unable to raise the alarm because there was simply no mechanism by which to do so.
The FAA then turned to the commercial spare parts industry, where it surveyed a variety of repair stations and found that it could not verify the approved status of 43% of the parts it inspected. The vast majority of these came from the unregulated parts brokers, whose shipments the FAA found to contain 95% unapproved parts. Ultimately, no one was spared: there were unapproved parts on major airlines, on military planes, even in the supply chain for Air Force One. And to make matters worse, the process for approving parts in the first place barely even worked: according to Luedeman, “A sampling of parts approved by one FAA office showed that the PMA list was inaccurate in 50 of 66 cases,” meaning that the FAA didn’t really even know who was approved to manufacture spare parts and who wasn’t.
As these studies were taking place, the FAA finally began reforms designed to make it easier to detect unapproved parts and enforce the law against unscrupulous brokers. In the early 1990s, the agency established a task force to deal with the problem, which led to the creation of the Suspected Unapproved Parts program, designed to tackle the issue along three major axes. First, major campaigns were launched to educate mechanics and inspectors on techniques for detecting unapproved parts, including convincing counterfeits. Secondly, the FAA sought to increase the rate at which unapproved parts were reported, primarily by establishing a standardized Suspected Unapproved Parts form which could be filled out by anyone and submitted to the FAA, with a guaranteed response. And third, it became a specific criminal offense to knowingly install unapproved parts on an aircraft, which worked together with the standard form to encourage individuals and companies to notify the FAA instead of ignoring the problem. Because any part without a paper trail was considered an unapproved part, and airlines could no longer risk installing such parts for fear of criminal charges, it became much more difficult to traffic in unapproved parts due to the necessity to forge a substantial paper trail. Furthermore, any unapproved or fake parts with a paper trail could be traced back to the manufacturer if even one item was reported to the FAA, ensuring that shady parts brokerage became a substantially riskier business.
Unapproved parts haven’t entirely gone away — after all, with millions of parts on every aircraft, and tens of thousands of aircraft flying around the world, it’s almost impossible to ensure that every single spare part is properly approved. However, the scale of the infiltration has been dramatically reduced, thanks in no small part to the crash of Partnair flight 394, which helped convince the industry that the danger was real.
That being said, the probable continued existence of unapproved parts on the market should not really be cause for alarm to the flying public. While Mary Schiavo’s crusade against unapproved parts was ultimately welcome and necessary, the FAA officials who played down the danger were not necessarily wrong either — perhaps just out of touch. The fact is that Partnair flight 394 remains the only crash of a commercial airliner linked to unapproved parts, placing the issue rather far down the list of problems that cause the most crashes. An oft-repeated statement by Northwest Airlines’ former chief of quality assurance asserted that other crashes over the years may have been caused by unapproved parts, but this has been taken out of context; he never had access to insider information, and was merely speculating. As far as I can tell, there are very few if any modern crashes caused by mechanical failures of parts which were not recovered, and so it seems rather unlikely that unapproved parts could have been involved without being detected. In general, this is because unapproved parts cause annoying breakdowns and increase maintenance costs, but don’t directly cause crashes, simply because there are very few individual parts on an aircraft which could cause a crash if they fail. Redundancy in aircraft design largely shields us from the consequences, with the primary exception being very old aircraft like LN-PAA which predate many modern airworthiness requirements. Even then, it took multiple unapproved parts in multiple locations, plus inadequate inspections and poor documentation, to actually bring down the plane.
Nevertheless, had authorities not cracked down on the practice, it’s safe to say that over a long enough time frame, another flight would eventually have crashed due to unapproved parts. And when it comes to plane crashes, even one is too many, let alone two.
◊◊◊
Well over 30 years later, the crash of Partnair flight 394 remains one of the most unusual in the history of commercial aviation, having arisen from a combination of circumstances unlike almost any other, from the counterfeit bolts installed on the plane to the resonating vibrations which ripped it apart. So much was wrong with LN-PAA that its various faults started to interact in unpredictable ways, creating conditions which no one had foreseen, least of all the pilots, who probably went to their graves without any idea of what had befallen them. In this case, responsibility lay higher up the chain, with the airline that allowed use of the APU in flight, with the contractor that failed to detect the faulty bolts, with the brokers that sold those bolts to the contractor, and with the regulatory authorities that failed to crack down on the brokers. It took the horrific deaths of 55 people over the Skagerrak, plus a few committed individuals in places of power, to force these parties to clean up their acts — and all of us who fly are better off as a result.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
