The Lever of Death: The crash of Dan-Air flight 0034
On the 31st of July 1979, a chartered airliner carrying oil workers home from the Shetland Islands failed to become airborne on takeoff from Sumburgh Airport. The Hawker Siddeley HS 748 with 47 people aboard careened off the end of the runway and crashed into the freezing waters of the North Sea, which quickly began to fill the cabin. As the passengers struggled to escape, the plane started to sink nose first, slipping beneath the waves with passengers and crew alike still trapped inside. Thirty people managed to swim to shore or were picked up by rescuers, but 17 drowned both inside and outside the plane, unable to escape the rising water or negotiate the pounding surf.
Upon examining the possible scenarios, investigators came to a startling conclusion: the gust locks, meant to keep the elevators from moving while the plane is parked, were still engaged. With both pilots dead and no cockpit voice recorder to reveal what happened, they faced a difficult question: had the pilots neglected the checks that would have revealed the problem, or was there something seriously wrong with the design of the system? The answer came as a major surprise, revealing a tiny flaw with an obscure part and a dangerous mechanical phenomenon that came together to kill 17 people.
Among the many unusual services provided by eclectic British airline Dan-Air in the 1970s and 1980s were support flights for the North Sea oil extraction industry. While oil workers usually reach the offshore platforms by helicopter, the vast majority of them don’t live nearby, and so the oil companies arrange charter flights to take them from the oil hubs to their home cities at the end of each two-week shift. Dan-Air, which would do just about anything with an airliner if properly paid, was no stranger to these kinds of charter flights, which often involved flying into small airports on some of the United Kingdom’s tougher outlying islands.
The workhorse of the airline’s oilfield support operation was the Hawker Siddeley HS 748, a British-made twin turboprop that first entered service in 1960. Originally designed by Avro in the late 1950s before its acquisition by Hawker Siddeley, the HS 748 had room for around 45 passengers and was known for its high performance and ability to take off and land on very short runways, a feature that made it useful on flights to places like the Shetland Islands.
One such trip was Dan-Air flight 0034, a routine charter flight from Sumburgh Airport in the Shetland Islands to Aberdeen, Scotland, on the 31st of July 1979. The flight was one of a series contracted by Shell Oil; the plane and its crew had just flown a load of oil workers into Sumburgh that morning to start their shift, and they were now scheduled to pick up another 44 men who had just finished their shift and were ready to return home. The flight also featured three crewmembers: 37-year-old Captain Chris Watson, an unnamed 51-year-old first officer, and stewardess Elizabeth Cowe.
Prior to leaving the terminal at Sumburgh, the plane had been parked on the apron for seven hours. During this period, the pilots had engaged the plane’s gust locks according to standard procedure. The gust locks are a feature of smaller airplanes intended to prevent the control surfaces from flapping in the wind while the airplane is parked. While large planes have heavy control surfaces that are hard to move, small turboprops like the HS 748 have lighter controls that could be damaged in a stiff breeze if the wind is coming from anywhere other than straight forward.
The gust lock system on the HS 748 is entirely mechanical. When the pilots move the gust lock lever on the center console, a sequence of hinges, rods, and cams move all of the gust locks to the locked or unlocked positions. A mechanical interlock with the propeller and throttle controls prevents the pilot from moving the throttle levers to takeoff power if the gust lock lever is still in the “locked” position, ensuring that it’s not possible to take off with the locks still engaged.
Of particular importance in this case is the design of the gust lock lever itself. The lever moves back and forth in a channel with two wider spots, called detents, at each end, corresponding to the locked and unlocked positions. The metal plate into which the channel is carved is called the gate plate.
The lever has a strip running down the left side called the gate stop strip. This strip increases the width of the lever beyond the width of the channel, so that when it is sitting in one of the detents, it cannot travel toward the opposite position because it is too wide. In order to move the lever from one position to the other, the pilot must first pull the lever outward against the force of a spring, until the gate stop strip completely rises out of the detent. It is then possible to move the lever forward through the channel with the gate stop strip resting on top of the gate plate, until it reaches the next detent, at which point the channel again becomes wide enough to accommodate the gate stop strip and the spring pulls the lever fully back down. The fact that the pilot must pull the lever several centimeters outward in order to move it between the unlocked and locked detents ensures that it will be readily obvious if the lever has not been moved fully to either position.
Like many of the HS 748s in Dan-Air’s fleet, this particular plane had only recently returned to the United Kingdom. After manufacture in 1962, it was sold to Aerolíneas Argentinas, and then to Argentine oil company Yacimientos Petroliferos Fiscales, before being acquired by Dan-Air in 1977. At some point while the plane was in Argentina, someone modified the gust lock lever gate plate. In its original condition, the lever channel had been carved into a sheet of paxoline laminate that was overlaid on top of the underlying metal plate, but this tended to wear and was hard to maintain, so during the 1960s Hawker Siddeley asked operators to replace the laminate with a steel plate instead. A mechanic in Argentina had evidently attempted to do this, but the steel plate that they used was not exactly an example of fine workmanship. It was rather rough around the edges and was not quite the right size. A secondary strip of metal along the right side of the channel was also poorly riveted in place, and one of the rivets had come out, allowing the lever to rotate this strip out of the way as it moved through the channel. The gate stop strip on the lever itself was also not made to specifications, as it had apparently been ground down from a strip that was too thick, and now it was 0.4 millimeters too thin. At the same time the lever channel was 0.1 millimeter too wide. The cumulative result was that the difference between the width of the channel and the combined width of the lever and gate stop strip was only 0.28 millimeters, a little over a tenth of a millimeter less than the minimum specified in the manufacturer’s drawings.
With such low overlap between the gate stop strip and the gate plate, it became possible for the lever to force its way down into the channel anywhere along its length, and not just at the locked and unlocked detents. The ease of doing this had been further exacerbated due to wear on the bottom end of the gate stop strip, which made it tapered instead of square. This problem in turn caused a previously unimportant matter to become rather important indeed: the throttle interlock preventing takeoff with the gust locks on would actually disengage when the lever was about half way between the locked and unlocked positions. This had not previously been appreciated because it was not supposed to be possible to stow the lever anywhere other than the locked and unlocked detents, making it effectively a binary system with only two possible conditions. But the poorly manufactured and worn components had resulted in a range of possible positions, some of which were dangerous: if the lever was stowed in a false detent between 25% and 45% short of the actual unlocked detent, it would disengage the throttle interlock without quite moving the elevator locks to the fully unlocked configuration. The locks on the other flight controls would fully disengage in this zone, but the elevator locks had greater play in the system and required that the lever move more than 75% of the way toward the unlocked position before completely disengaging.
As the pilots of Dan-Air flight 0034 taxied toward the runway at Sumburgh Airport, one of them, most likely the first officer, attempted to remove the gust locks but accidentally allowed the lever to drop into a false detent within the “danger zone.” The lever became jammed in the channel, rendering it difficult to notice that it was not in the fully unlocked position. The throttle interlock, aileron locks, and rudder lock all disengaged, but the elevator locks were not quite all the way removed.
Before every takeoff the pilots must conduct a series of control checks to ensure that all the control surfaces are moving correctly. It was actually this check that served as the final link in the chain of events. With the lever in the false detent, the mechanical configuration of the elevator locking system was such that it was possible to move the elevators up and down, but the act of doing so would cause the gust locks to re-engage by themselves. So when the pilots conducted the control checks, it appeared that the elevators were moving freely, but as soon as they let go of the controls the gust locks slipped back into place, even though the gust lock lever was not in the locked position.
One final coincidence sealed the fate of Dan-Air flight 0034. The gust locks hold the elevators in the full nose down position as this is the optimal position to prevent wind damage. It also happens to be where the pilots will hold the elevators during the takeoff roll until they’re ready to lift off. As the plane accelerated down the runway, Captain Watson wouldn’t have noticed that the elevators were jammed fully nose down because he was holding them there using his control column anyway.
At a few seconds past 16:00, flight 0034 accelerated through V1, the highest speed at which it was possible to abort the takeoff without overrunning the runway. Although no one on board knew it yet, a crash was inevitable.
Seconds later, the plane reached VR, or rotation speed. The first officer presumably called out “rotate,” and Captain Watson pulled back on his control column to climb — but to his immense surprise, it wouldn’t budge an inch. What exactly he did in these critical seconds is unknown, but one might imagine that he tried as hard as he could to pull back, maybe asked his first officer to help him, perhaps tried to add elevator trim. None of it would’ve worked; the elevators were locked in the full nose down position and there was no way to get the plane off the ground. Five seconds after passing VR, Captain Watson concluded that they were not going to get airborne, so he cut engine power and slammed on the brakes, but it was already too late to prevent disaster.
Aborting a takeoff after V1 is something that goes against every pilot’s most basic instincts. 999 times out of a thousand it’s the wrong decision. Pilots understand intuitively that beyond this speed aborting will result in a crash, and unless it’s physically impossible to become airborne, taking off is always preferable. Situations that would call for aborting after V1 are extremely rare — but on that day at Sumburgh Airport, it happened.
There was never any hope that flight 0034 would be able to stop on the runway, even with full braking power. Still traveling at high speed, the HS 748 ran out of pavement and rumbled across the grass overrun area, slewing to the left as it did so. A massive impact rocked the cabin as the plane bounced off a 30-centimeter-high eroded step up to the airport perimeter road, causing the nose gear to collapse. The plane skidded across the road, cleared the breakwater, slammed into the surf 20 meters from shore, then plowed a further 30 meters out into the sea before coming to rest upright and mostly intact, except for the left wing, which had been torn off on impact.
Thanks to their seat belts, all 47 people on board survived the crash with minor injuries, but the toughest part still lay ahead. The HS 748 is not watertight, and damage to the fuselage made it even less so; by the time the plane came to a halt, water was already coming into the cabin. At first the evacuation proceeded in an orderly manner, as the passengers undid their seat belts and headed toward the exits under the calm direction of the stewardess. But as soon as the exit doors were opened, water began to flood into the cabin with tremendous speed. Most of the passengers weren’t wearing life jackets, because the seat pitch was so narrow that they couldn’t reach back around far enough to remove them from their pouches on the seat bottoms. Without any means of flotation, passengers forced their way out against the water rushing in through the exits, only to be promptly swept off the wings by the pounding surf. As those who had escaped struggled to swim to shore, the situation inside the cabin became increasingly desperate. Stewardess Elizabeth Cowe bravely shoved one passenger after another through the rear exit before the panicked crush of people forced her out the door and into the sea as well. Those who were still inside watched in horror and disbelief as the depth of the water inside the cabin increased from ankle height to neck height in just 30 seconds. With water accumulating in the front of the cabin, the plane started to pitch steeply downward, raising the tail high out of the water like the Titanic in her death throes. For those still on board, time was running out.
As soon as controllers saw the plane go into the water, they sent out a distress call to all emergency services in the area, and people quickly descended on the crash site to help the survivors. Two nearby helicopters arrived on the scene within two minutes, but they weren’t equipped for search and rescue, and all they could do was drop a pair of emergency dinghies into the water below. But the wind and waves blew the dinghies away from the survivors, and attempts to blow them back using the helicopters’ rotor wash were unsuccessful. To make matters worse, that same rotor wash made it much harder for many of the survivors to stay above the water and swim to shore.
Meanwhile, airport fire service personnel rushed to the scene in a Land Rover pulling a Zodiac rescue boat on a trailer. Attempts to launch the Zodiac directly off the end of the runway failed because the wind and waves were too strong, and its crew had to leave to find a sheltered launch point.
In the water, survivors fought in terrible conditions to reach the shore by themselves. The water was freezing cold and polluted with kerosene; passengers struggling against the cold shock and the heady fumes from the aviation fuel found themselves battered by powerful waves roaring in off the North Sea and crashing against the concrete breakwater. Some people made it, clambering out onto the runway, soaked and exhausted. Others slipped beneath the turbulent waters, never to rise again.
Soon, even more rescuers arrived, including a number of volunteers from a nearby construction site who tied ropes around their waists and swam out into the water to drag survivors to safety. A number of survivors who had managed to swim to shore did the same, re-entering the frigid waters to save their fellow passengers. A Coast Guard helicopter equipped for search and rescue soon arrived, along with a nearby fishing boat, and each pulled one survivor from the water. But after that, rescuers could only find bodies. The airport Zodiac, having finally launched from a sheltered cove 300 meters away, failed to find anyone who was still alive.
By the time authorities had counted up the survivors and the bodies, 17 people were dead, all of whom had drowned, while 30 survived. Although the stewardess lived, both pilots were not so lucky. The first officer was among seven people who died inside the sinking airplane, while witnesses said that Captain Chris Watson had made it out onto a wing before he disappeared into the water, one of 10 who drowned in the heaving surf after escaping the cabin. Certainly, were it not for 23-year-old Elizabeth Cowe’s remarkably calm efforts to maintain order during the evacuation, the death toll would have been higher. For her public service she was granted membership to the Most Excellent Order of the British Empire, and in the accident report investigators wrote, “The stewardess’s behavior in attempting to calm the passengers and subsequently to marshal a number of them out of the rear door was exemplary and almost certainly helped to reduce the number of casualties.”
Investigators with Britain’s Air Accidents Investigation Branch soon arrived on the scene to uncover the cause of the crash. Although both pilots were dead and the plane did not have a cockpit voice recorder, statements of witnesses made it clear that the plane never lifted off the ground, and that the pilots had attempted to abort the takeoff well beyond the highest speed at which it was possible to do so safely. Investigation of various possible mechanical causes ruled out everything except the elevator gust locks.
Upon recovering the cockpit almost completely intact from the sea floor, investigators messed about with the controls and found that it was possible to drop the gust lock lever into a false detent short of the fully unlocked position. Closer examination showed that this was because the gate plate and the gate stop strip had not been made to specifications, and the interference between them was 0.12 millimeters short of the minimum. Depending on where exactly the lever stopped, the throttle interlock could be removed while the elevator gust locks were still fully engaged. However, if this had occurred, it meant that the pilots didn’t do the mandatory control checks before takeoff — if they had, the locked condition of the elevators would have been easily discovered. That raised a key question that would define outcome of the inquiry: did the pilots conduct the control checks or not?
In the meantime, investigators found a number of previous cases of minor runway overrun accidents involving the HS 748 which occurred after the pilots were unable to lift the plane off the runway upon reaching VR. One of these occurred in Concordia, Argentina in 1967, when an HS 748 failed to become airborne and ran off into sand beyond the end of the runway. Although no damage occurred and no one was injured, Argentine authorities did conduct an investigation, which found that a badly worn “unlocked” detent in the gate plate made it possible to stow the gust lock lever before the elevator locks had fully disengaged. Investigators concluded that the crew must have missed the condition of the elevators because they didn’t conduct the control checks, although the pilots vehemently denied this accusation.
Another incident which occurred in India in 1975 also attracted investigators’ attention. The scenario was similar to that of the incident in Argentina. Indian investigators found that on some HS 748s, it was possible to leave the gust lock lever in an intermediate position that disengaged the throttle interlock but not the elevator gust locks. However, when the investigators alerted the manufacturer to their discovery, Hawker Siddeley denied that this was possible, and instead suggested that the pilots had attempted to take off with the elevator trim in the full nose down position.
The simplest explanation would have been that the crew didn’t do the control checks. But these were well-trained pilots with no history of such basic negligence, and besides, witness testimony backed them up: one surviving passenger said he saw the ailerons moving up and down before they began the takeoff roll, showing that the pilots almost certainly completed the checks. So if they did the control checks and didn’t encounter any problems, how did the gust locks become engaged?
Using a representative HS 748 with a gate plate modified to look like the one on the accident airplane, investigators ran a series of tests to see how the gust lock system responded to various intermediate lever positions. What they found was surprising: due to the geometry of the locking system, a mostly-disengaged elevator gust lock consistent with a gust lock lever in a false detent 30% short of the unlocked position would allow the elevators to move freely, but upon moving them to the full nose down position during the control check, the locks would sometimes, but not always, re-engage. The exact conditions under which they would re-engage were not repeatable and seemed to be essentially random. But despite being unable to figure out why the results were inconsistent, investigators were able to conclude that it was possible, although not guaranteed, that the elevator gust locks would re-engage during the control checks if the gust lock lever was in a false detent around 30% short of the unlocked position. The fact that the locks could almost totally disengage, only to become re-engaged during a control check, upended the assumption that the locks must have been fully engaged from the start.
This conclusion came as a surprise to all involved and cast serious doubt on the results of the investigations into the incidents in Argentina and India. The finding showed that the Argentine pilots could very well have been telling the truth when they insisted they did the control checks before they ran off the runway. Furthermore, it disproved Hawker Siddeley’s insistence to the Indian investigators that the plane could not have taken off with the gust lock lever in an intermediate position. Additional testing also showed that it was possible, using a reasonable amount of control column force, to take off with the elevator trim at full nose down — proving that this was not the cause of the Indian accident, nor could it have been the cause of the accident in the Shetland Islands. AAIB investigators expressed frustration that these incidents had not been more thoroughly investigated and their findings disseminated, as increased knowledge about the problems with the gust lock system could have prevented the tragedy at Sumburgh.
As for the origins of the shoddy repairs to the gate plate on the accident airplane, there was little to go on. The AAIB concluded that it probably didn’t happen at Dan-Air, given that the airline’s thorough maintenance records didn’t show any work having been done on the gate plate. Investigators only received incomplete records from the plane’s 15 years in Argentina, which also didn’t show any maintenance to the gate plate, but given the large gaps in the paperwork they concluded it probably happened there, not in the UK. The condition of the gate plate was not discovered because it is normally hidden beneath a rubber covering, and no inspection of this area was required during registration or routine maintenance.
The AAIB also examined the question of whether the pilots could have prevented the accident. Although it was unlikely that they would have discovered the problem prior to the failure to rotate after VR, calculations showed that if full braking had been initiated within 2.5 seconds of reaching this speed it would have been possible to stop before reaching the breakwater. However, tests showed that even pilots who were told there would be an unspecified emergency took three seconds on average to react. Investigators also consulted an aviation psychologist, who concluded that the five and a half seconds that passed between reaching VR and rejecting the takeoff were perfectly reasonable. This was not a lot of time to realize that there was a problem, conclude that additional back pressure on the control column would not solve it, and then make the hard decision to break one of the basic rules of flying by aborting after V1.
The flight data also showed that the pilots did not engage reverse thrust on the propellers for unknown reasons, which extended the plane’s run by about 40 meters. Although the plane still would have gone into the water had reverse thrust been used, it would have been closer to shore, and more passengers might have survived. Without a CVR there was no way to determine why the pilots didn’t use this available braking method, but it is possible that they simply overlooked it in the extremely high-stress environment of the rejected takeoff. The AAIB also noted that if the throttle levers were not quite pulled back all the way to the stop it would have been impossible to pull the handle to activate reverse thrust, a problem which can be solved by making sure the throttles are at the stop. However this kind of critical thinking might have been inhibited while hurtling toward an inevitable crash. Finally, the AAIB found that the first officer had unacceptable levels of certain prescription tranquilizers in his blood, rendering him legally unfit to fly, but given the mechanical nature of the problem and the fact that the captain was almost certainly at the controls at the time of the crash, this was probably irrelevant.
As a result of the findings, in August 1979 Hawker Siddeley issued a bulletin requiring all HS 748 operators to inspect the gust lock gate plates for damage, unapproved repairs, and deviations from the official specifications. However, the AAIB noted that many HS 748s flew for small airlines in rugged conditions in third world countries, where mechanics might have considerable difficulty making the extremely precise measurements necessary to comply with the service bulletin. They therefore recommended that the manufacturer redesign the gust lock system entirely to preclude any possibility of a recurrence.
Several changes were also made in the area of passenger survival. The AAIB asked that manufacturers reposition the life jackets to make them easier to reach in an emergency, and that airlines be required to provide safety cards for every passenger. (On the accident airplane there were no safety cards, only a poster depicting how to put on a life jacket mounted on the forward bulkhead, which was difficult to read from the back of the plane.) As a result of the accident and the recommendations, Dan-Air began providing every passenger with a safety card and installed cockpit voice recorders on all its HS 748s. The Civil Aviation Authority later required all similar airplanes to carry them. The British Helicopter Advisory Board disseminated rules for helicopters not equipped for search and rescue to follow when responding to an emergency. The AAIB also recommended that the CAA look into technologies that could stop planes from running off the runway into the sea, and while Sumburgh Airport still lacks such a system, the runway is much longer today than it was in 1979. The site of the crash, once 50 meters from shore, now lies under the threshold of runway 27.
Dan-Air flight 0034 remains noteworthy more than forty years later for featuring one of the most banal mechanical problems ever to cause a fatal crash. Because the channel for a cockpit lever was one tenth of a millimeter too wide, 17 people drowned in the frigid waters of the North Sea. The series of design flaws and unreliable systems that caused this tiny imperfection to escalate into a major disaster was rather typical of the notoriously fickle Hawker Siddeley HS 748, which was no stranger to bizarre mechanical problems. For example, in 1981 another Dan-Air HS 748 flying a night mail run lost control and crashed after a door fell off in flight and became wrapped around the horizontal stabilizer. All three crewmembers were killed. The cause of the crash was an extremely finicky door locking mechanism with a long list of flaws and an equally long history of coming open at inconvenient times. Much like the gust lock system, the door consisted of numerous interconnected parts that rarely seemed to move the same way twice. However, the worst of the flaws seem to have been fixed, and the dozen or so HS 748s still flying today, mostly in Canada, appear to be doing just fine.
The lesson of the crash is perhaps that every part even tangentially related to an airplane’s control systems must be treated carefully. The gate plate was such an obscure part that hardly anyone ever looked at it and only a few engineers at Hawker Siddeley knew the first thing about it. Certainly no one would have predicted that it could cause a fatal accident. And yet it did — a reminder that in aviation every component, no matter how small, must be handled with due respect.
________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 190 similar articles.
You can also support me on Patreon.
