This was the crash of British Midlands flight BD92, also called the Kegworth acciden. The BBC documentary about Kegworth, Fatal Error, provides the name given to this plot. A mechanical failure creates a difficult, but survivable situation. Humans misunderstand what is going on, and make a few basic errors, that make things much worse.
The story starts with a fan blade in the left side engine of a Boeing 737. Remember, that this is a two-engine plain, and it is the left side engine with the fan blade failure. The fan blade ripped through the engine, and caused a series of compressor stalls.
The whole plane then started shuddering, and smoke and fumes started to come into the flight deck. Based on his knowledge of the air conditioning design on the 737, the pilot suspected that the right-hand engine was on fire. This was confirmed by the first officer, who when asked for his diagnosis said, quote, “It’s the LE … It’s the RIGHT one”.
The pilots throttled back the right hand engine. This caused the vibrations to slow down and stop, confirming their impression that the right hand engine was the one that had suffered a failure. The smell of smoke also appeared to be clearing.
There then followed a confused minute whilst the pilots were communicating with air traffic control to report the emergency and arrange an emergency landing. They were also monitoring the situation with the engine trying to decide whether to shut it down completely or keep it running under reduced power. During this time the First Officer announced that he was going to start the engine failure and shutdown checklist. This checklist was paused multiple times as the pilots communicated with air traffic control at two airports and their own airline operations staff, and planned for an emergency landing. Eventually they completely shut down the right-side engine, without going through the checklist.
By this stage the passengers were becoming rather agitated by the smoke and vibrations. The pilots announced to the passengers that they had shut down the failed right-side engine, and were diverting for a landing. This announcement was somewhat surprising to those passengers who had seen the flames coming from the left-hand engine, but no one said anything to the pilots.
As the plane came in to land at East Midlands airport, additional demand was placed on the remaining engine. This demand caused further failure of the already damaged engine, including a fire and loss of power. The crew desperately tried to restart the working right-hand engine, but were unsuccessful. The plane crashed into a field at a little over one hundred knots, and then hit the side of the M1 motorway, suffering a lot of damage from the physical impacts.
At this point, for the first time that night, things started to go right for those passengers who survived the initial impact. 737s are designed not to crash, but they are also designed to be safe if they do crash. One of the important features is that the engines and landing gear break away in a fashion that doesn’t rupture the wing fuel tanks, and this worked more-or-less as it should. Even though all but 14 of the passengers and crew were trapped in the wreckage, the only fire was the already burning left-side engine, which was put out when emergency services arrived promptly on the scene.
These are the factors that led to the pilots to shut down the wrong engine.
1: The speed with which they made the decision. Pilot training for the 737 and the airlines stressed taking time to properly evaluate a situation before taking precipitate action. This was true not only for the generic training, but also for the engine failure procedures. Making a decision quickly meant that they didn’t have time to consider or interpret all of the information available to them. Having made a decision, it was cognitively difficult to unmake that decision.
2: The symptoms got better in response to their actions. Confirmation bias led them to interpret this as evidence that their decision was the correct one. In fact, probably simply disconnecting the autothrottle halted the series of stalls, which was what the pilots could feel. The vibration was still there, but evident only on the sensors, not as a physical sensation.
3: The design of the electronic instrument display. The main concern was that the electronic indicators were good for showing current values, but made it harder to spot changes in values. The display had been certified based on its reliability, without detailed assessment of whether pilots performed better or worse when using the display. Certainly a warning light that drew attention when an engine was showing maximum vibration would have been very useful in this case.
4 : The engine vibration monitors themselves. These instruments indicated that it was the left-hand engine that was vibrating. Historically, engine vibration sensors had been highly unreliable. To quote the FAA – vibration detectors are not as reliable as the engines they monitor. A good vibration sensor needs to take into account normal vibration and movement, and exaggerate abnormal movement. This is a difficult engineering problem, but it had been fixed by the time of the 737-400. An experienced pilot, however, such as the Captain of BD 92, would have learnt to fly in aircraft where the vibration sensors were unreliable. He was accustomed to not scanning or taking into account those particular instruments.
5: Failure to follow the checklist. As it happens, reducing the throttle on the wrong engine would not have caused the accident. The accident was made likely by the second decision, the one to fully shut-down the engine. To understand the role of the checklist here, imagine the situation for the pilots. The plane is shaking, and there is a smell of burning. This created stress, and people under stress search for certainty. There was a lot of radio chatter, and planning tasks associated with landing at an airfield not originally intended as a possible diversion. This created workload and interruptions, making methodical reflection and checking information difficult. Most simulated emergencies involve an engine shutdown, so there was a certain amount of following practiced patterns of behaviour. In these circumstances, the checklist is a safety line. It provides a way to systematically focus on the important information, the important decisions, and the important steps that must be carried out.
6: Not understanding the aircraft systems. The checklist was necessary, but by itself it may not have been enough. Pilots need to be able to understand the situation well enough to choose the right procedure, and to know when the procedure doesn’t apply. In this particular case for example, there was a vibration procedure, and an engine on fire procedure, but no procedure that explicitly mentioned what to say if you have both at once.
A better technical understanding of the plane could have lead the pilots to recognise that disconnecting the autothrottle was what had reduced the feeling of vibration. A better technical understanding could have lead them to trust the vibration sensors as a source of information. A better technical understanding would have let them know that smoke in the air conditioning could happen from either engine.
As a final note, the accident report doesn’t blame the passengers or cabin crew for not telling the pilots which engine was on fire. Generally speaking, it is better to trust that the pilots know what they are doing rather than interrupt them in the middle of an emergency landing just to check.
