Last week, we looked at the sequence of events which led to Flash Airlines flight 604 crashing into the Red Sea a few minutes after take-off. This post assumes you’ve already read the previous post.

Once it became clear that the Boeing 737-300 had crashed, rescue teams were dispatched. They found the floating remains within minutes. The main wreckage was at the bottom of the sea, at a depth of over 1,000 metres (3,250 feet). It was immediately clear that there was no chance of survivors.

Flash Airlines flight 604 had been airborne for just 147 seconds.

A group in Yemen claimed that they had destroyed the aircraft as a protest against French law banning headscarves in schools. Their claim was easily dismissed by the tight debris field: the Boeing 737 had been intact when it impacted the water. If a bomb had caused the crash, the aircraft would have disintegrated in the air and the wreckage would have been much more spread out.

However, without the data from the flight, it was impossible to know what had happened. Searchers used submersible remotely operated vehicles to search for the Cockpit Voice Recorder and the Flight Data Recorder. The pingers, short-range emergency beacons that started broadcasting when the aircraft impacted the water, which reduced the search area down to ten metres. Both recorders were recovered by the 17th of January, about two weeks after the crash. The recovery operation shifted focus to a detailed mapping of the wreckage, which was too deep to be recovered.

The Flight Data Recorder records the movements of the pilot’s controls and the movement of the control surfaces along with the aircraft’s motion (pitch, roll attitude, heading angle). This information can be used to confirm whether the control surfaces were responding normally to the pilots’ input and and whether the aircraft itself was responding normally to changes in the control surfaces.

Simulations were run to show that the path of the aircraft was consistent with the recorded motion of the control surfaces, including the extreme bank towards the end of the flight. Similarly, the movements of the controls surfaces was consistent with the recorded motion of the control inputs. The control wheel data which was recorded was unreliable but nevertheless, there was no sign of a physical issue with the controls.

Further simulations were used to consider hypothetical faults which could result in a rolling movement, for example, flap or thrust asymmetry or the slats or spoilers deploying uncommanded. However, such faults would have changed the path of the aircraft as predicted by the recorded position of the ailerons.

The conclusion from the simulation: the aircraft was capable of doing what the crew and the aircraft systems commanded it to do. That didn’t explain what caused the extreme right overbank.

In a case like this, where it is not possible to determine exactly what happened, it is common to create and follow a scenario tree. The team identifies possible accident scenarios and determines whether there is sufficient evidence to support them. Thus, they can rule out the inapplicable scenarios and focus on the remaining possibilities and how those scenarios fit in with the evidence collected. The hope is that by reducing the number of scenarios and correlating them to the evidence, they can determine which scenario most likely explains the accident sequence events, even if a definite cause cannot be established.

Based on this logic, there were a few scenarios which could be dismissed. There was no evidence that the Boeing 737-300 had any faults. There was no reason to believe that any of the flight crew suffered illness or incapacitation. The FDR data could be considered definitive, as it matched the radar data.

However, other data points were more problematic. For example, it’s clear that there were issues with the autopilot. However, there was simply no way to determine if the autopilot had been manually disconnected or if it had happened automatically through a fault. Did the flight crew believe the autopilot was engaged when it was not? Certainly, the first officer seemed to be confused about this, as he had called out “autopilot in command,” followed by “No autopilot, commander.”

Another key question was why the aircraft had stopped the initial and expected left turn and started a turn to the right.

The aircraft initially rolled level on a heading of exactly 140°. It isn’t at all clear why the aircraft rolled back to wings level. The simulations had followed a list of faults and failures which might lead to this levelling out, including failure of the spoilers or leading edge slats and an external disturbance (weather). However, none of the simulations were consistent with the accident scenario. There was no recorded evidence of a thrust asymmetry, so the right roll wasn’t caused by the left engine generating more power than the right. Meteorological data supported the simulator result which allowed investigators to dismiss a weather-induced failure.

The investigation came up with four possibilities:

• pilot widening departure pattern (intentional control action)

• level wings prior to engaging autopilot (intentional control action)

• pilot loses awareness of heading or bank (unintentional action)

• Anomalies with the lateral control system (unintentional result)

There were a few reasons why it could have been an intentional control action.

The Chief Pilot reported that some crews choose to widen their departure pattern by squaring the turn at 90° to runway heading. The captain may have wanted to ensure that he didn’t violate the local VOR altitude crossing practice. However, the previous mirror-image departure, flown by the same crew and with the same Pilot Flying, didn’t widen the departure in this way. There is also no discussion on the CVR that he intended to do this. Similarly, it’s possible that the captain simply wanted the wings level before setting the autopilot. On the previous flight, the flight crew didn’t engage the autopilot until they were wings level, so this could have been a decision to level the wings and set the autopilot before continuing the turn.

Equally, it may have been an unintentional reaction by the captain. The roll out occurred just as the flight passed over the coastline, that is, right at the point when all outside visual references were lost. The pitch also changed slightly. This combination could easily confuse the captain’s vestibular system, leading him to misperceive the aircraft’s angle of bank.

Our ears have canals for each axis of motion. These canals are at right angles to each other to measure the primary axes of motion and they work in matched pairs, giving us inbuilt angular accelerometers. However, the system registers movement only after a specific threshold: in an aircraft and without visual cues, a turn under this threshold will feel like straight and level flight. If an aircraft turns below this level of acceleration, then the vestibular system simply doesn’t register the turn. This is why reference to the instruments is critical. As the aircraft rolled level just as the visual references were lost, this could be a sign that the captain responded based on false vestibuar cues without referencing the instruments.

And finally, the investigators considered that there might have been “temporary jams” in the lateral control system, which somehow affected the flight but could not be reproduced in the simulations.

The following exchange about the autopilot, which is very difficult to interpret, took place as the aircraft pitch increased and the heading decreased.

Captain: Autopilot.

Captain: Not yet.

First Officer Autopilot in command, sir.

The Boeing documented procedure is that the Pilot Flying, in this case the captain, should be the one to press the CMD button to engage the autopilot.

Possibly the captain was asking the first officer to engage the autopilot, rather than following procedure, and then changed his mind and said “Not yet.” However, if that’s what was meant by “Not yet”, the first officer disregarded it and the captain did not follow up.

Although, it seems from the exchange that the first officer pushed the button; however, it could also be that the captain pressed the button and nothing happened (“not yet”) and then pressed it again, at which point the first officer confirmed that this time it had engaged.

Or “Not yet” could have been about something else entirely and unrelated to the autopilot. We cannot know what the captain intended. However, combined with the change in pitch and heading, it appears to mark the beginning of a distraction event for the captain or the crew.

Directly after this conversation, the autopilot changed from HDG SEL (fly a specific heading) to CWS-R (Control Wheel Steering, following the flight director). Then the autopilot disengage warning was heard on the cockpit voice recorder.

As the manufacturer of the accident aircraft, Boeing determined that there were three reasons why the autopilot might have disengaged. The first was that there was a synchronisation issue; however if that were the case, the autopilot should have disconnected either almost immediately (0.182 seconds) or later (3.695 seconds) depending on the mismatch. The second possibility was that the engage hold interlocks were not satisfied. However, they must have been satisfied two seconds earlier, or else the autopilot would not have engaged, so for this to have been the cause, something unexpected must have happened to change the status within those two seconds. The third possibility was that the autopilot was manually disconnected.

Further analysis showed that there was a sound was consistent with a “double-click” typical of a manual disconnect. This was not enough to prove that it was an intentional action by the crew; the end result was that none of the three possibilities could be dismissed or proven. However, the investigators determined that the most likely reason for the autopilot to have disconnected was that one of the crew members disconnected it. Again, we cannot tell which pilot or why they might have done so.

However, a pattern was starting to emerge.

Evidence of distraction possibly becoming spatial disorientation is observed from the time of the start of right turn until the announcement of aircraft turning right, after which it is unclear whether the captain recovered or remained in the state of spatial disorientation. After the call of “No autopilot commander”, the crew behaviour appears normal.

The right roll continued into an overbank even as the captain said, in a confused voice, “Turning right. How turning right?” This could be that he didn’t understand how it was that the aircraft had started the right turn. However, considering that the first officer had to tell him twice that the aircraft was turning right, it strikes me as just as likely that he was asking how the aircraft could be turning right, when it was so obviously (to him) flying straight and level or even still in a left bank.

The turn deepened into a steep turn of over 30° bank.

Investigators also considered it possible that the autopilot was engaged but had suffered some unknown temporary fault, for example a temporary spoiler wing cable jam or a right side (first officer’s side) wheel jam. The report considered that these were all equal possibilities.

After the overbank to the right, a rapid left roll brought the wings level. This must have been the crew’s attempt to recover. It could have been manual input by the captain or by the first officer or by both of the two flight crew working together. The investigation stated that although all three scenarios were possible, they had concluded that recovery by the captain was the most likely. There is no explanation as to why they believed the captain was the one to pull the aircraft out of the dangerous right bank.

It didn’t really matter. The recovery attempt was too late to regain control before they impacted the sea.

Now, there are a few things that instinctively feel wrong in the final analysis. The scenario tree included aircraft failures that they had already proven as unlikely during the simulations. Multiple possibilities were all given equal weighting. And simple conclusions, such as that it was most likely the captain who pulled the aircraft out of the dangerous right bank, were left without any justification or explanation.

The investigation concluded with the following possible causes, all of which are technical issues which were unsupported by any of the flight data or simulation results:

• Trim/Feel Unit Fault (Aileron Trim Runaway)

• Temporarily, Spoiler wing cable jam (Spoiler offset of the neutral position)

• Temporarily, F/O wheel jam (spoilers offset of the neutral position)

• Autopilot Actuator Hardover Fault

Then, they list the possible contributing factors:

• A distraction developing to Spatial Disorientation (SD) until the time the F/O announced “A/C turning right” with acknowledgement of the captain.

• Technical Log copies were kept on board with no copy left at departure station.

• Operator write-up of defects was not accurately performed and resulting in unclear knowledge of actual technical status

• There are conflicting signals which make unclear whether the captain remained in SD or was the crew unable to perceive the cause that was creating an upset condition until the time when the F/O announced that there was no A/P in action

• After the time when the F/O announced “no A/P commander” the crew behaviour suggests the recovery attempt was consistent with expected crew reaction, evidences show that the corrective action was initiated in full, however the gravity of the upset condition with regards to attitude, altitude and speed made this attempt insufficient to achieve a successful recovery.

So, if the captain suffered from spatial disillusion, it was only a contributing factor, as relevant to the crash as the missing technical log and the last-minute recovery attempt, neither of which should be correctly termed a contributing factor.

The report ends on the following conclusion.

No conclusive evidence could be found from the findings gathered through this investigation to determine a probable cause. However, based on the work done, it wcould be concluded that any combination of these findings could have caused or contributed to the accident.

Although the crew at the last stage of this accident attempted to correctly recover, the gravity of the upset condition with regards to attitude, altitue and speed made this attempt insufficient to achieve a successful recovery.

Now there were two other agencies who were involved in the investigation, the American NTSB and the French BEA. Both of these agencies took issue with the final report released by the Egyptian Ministry of Civil Aviation.

The NTSB released a 40-page statement, making it clear that the decision trees were not a joint effort but had been done independently by the Egyptians.

Their argument focused on the unexpected changes in pitch and airspeed before the captain called for the autopilot.

The captain ultimately allowed the airspeed to decrease to 35 knots (65 km/h; 40 mph) below his commanded target airspeed of 220 knots (410 km/h; 250 mph) and the climb pitch to reach 22°, which is 10° more than the standard climb pitch of about 12°. During this time, the captain also allowed the aircraft to enter a gradually steepening right bank, which was inconsistent with the flight crew’s departure clearance to perform a climbing left turn. These pitch, airspeed and bank angle deviations indicated that the captain directed his attention away from monitoring the attitude indications during and after the autopilot disengagement process.

At night, distracted and confused by what the aircraft was doing, and with no visual references as they flew out to sea, the captain was in exactly the conditions in which spatial disorientation can take hold. Spatial disorientation leading to loss of control is relatively rare but often fatal specifically because it is so difficult to determine and and the same time, for the pilot, overwhelming.

The NTSB dismissed the idea that the aircraft suffered “temporary jams” which took place after the right turn but left no evidence on the FDR or in the wreckage. They rejected the conclusion that the various scenarios were all equally possible.

The Egyptian response can be summarised as that the mechanical faults were of course possible, else they would have been eliminated in the decision tree, which is a wonderfully circular argument.

The BEA also issued a statement highlighting errors and omissions. They argue that relevant details were brought to light during the investigation which were not included in the report. The report accepts four possible technical failures whereas the BEA states that the group worked showed that there were only two failures which could not be eliminated and, in both those cases, the crew would still have been able to control the aircraft’s track, thus they do not explain the excessive right bank. Another omission which the BEA highlighted was that CRM training was not mandatory in Egypt at the time of the crash and that the operator had not set up a CRM training programme.

It is necessary to examine why the crew, when confronted with an abnormal and unusual situation, did not seem to have either analyzed this situation or to have mobilized all its available resources to deal with it. The CVR readout shows an absence of appropriate dialogue aimed at identifying a possible problem or proposing a solution to it.

The operator, Flash Airlines, was equally unhappy. But they believed that there was an aircraft system fault that Boeing and Honeywell had failed to acknowledge.

Flash does not accept the existence of any spatial disorientation (“SD”) on the part of the flight crew, or that it is appropriate for the report to make any finding to that effect, in the absence of unequivocal and positive indicators of its presence. It follows from the analysis in 4-6 below that some other explanation must in any event be sought for the behaviour of the aircraft after the limited window referred to in those paragraphs and during the most critical phase of flight. That being the case, it is inappropriate and unnecessary to speculate as to the existence of SD during any earlier phase of the flight, unless there is clear evidence of its existence.

Spatial disorientation is, of course, particularly insidious because it is so difficult to determine. The captain’s experience is not relevant: flight hours do not protect against this type of illusion; training does. And as noted by the BEA, this same operator did not consider CRM training to be necessary at the time of the accident, in 2004.

Flash Airlines declared bankruptcy, which is said to have been a direct result of this crash. However, their safety record was already questionable. Two years earlier, Switzerland and Poland had banned the airline from flying in their airspace and Norwegian tour operators stopped contracting flight through the airline in response to safety concerns.

This investigation is considered to be controversial, as multiple aviation authorities were unable to agree as to the cause. However, two out of the three agencies involved in the investigation agree on a likely probable cause: the captain suffered from spatial disorientation and neither of the other pilots on board felt empowered to raise objections or take control.

The investigators had the chance to highlight the importance of cockpit resource management training and the risks of spatial disorientation. If they truly believed that an unknown mechanical failure had caused the crash, they could have demonstrated why flight data and simulator results could not be trusted. More importantly, they could have explored how the crew should have reacted to reduce the impact of these failures and why they didn’t. Instead, the Egyptian Ministry of Civil Aviation released a final report which attempted a compromise position which did little to further the cause of aviation safety and nothing to restore trust in Egyptian aviation.