Lessons Learned

Technical Related Lessons:

Flight deck layout should be such that inadvertent or incorrect actions are prevented by positive design details. (guarded switches, non-proximity of commonly used switches, etc.) (Threat Category: Flight Deck Layout/Avionics Confusion)

  • In the case of the original 727 Flight Engineer's panel, the unguarded toggle switches for galley power and the battery were identical, and adjacent to each other. The arrangement made them vulnerable to incorrect actuation, which at the time of this emergency was believed to have contributed to the catastrophic loss of all electrical power following automatic shedding of the last AC generator.

Reversion to backup/standby systems should be timely, and automatic. (Threat Category: Lack of System Isolation/Segregation)

  • In this accident, the standby electrical system either failed, or was never activated, resulting in a dark flight deck, and loss of some instruments. The accident report cites multiple possibilities for its failure. Any standby or emergency system that is expected to operate in critical situations should provide seamless, disruption free transition to the backup mode(s). 

Complete loss of all normal electrical power can occur, for a number of different reasons, including human error. Emergency electrical power for flight instrumentation and associated lighting needs to be provided for a sufficient period to allow continued safe flight and landing. (Threat Category: Lack of System Isolation/Segregation)

  • Following the loss of all engine-generated electrical power, Flight 266 primary flight attitude displays were inoperative without standby battery power. The failure or inactivation of this standby electrical system means that the airplane attitude instruments and lighting for these instruments remained unavailable. With no attitude/altitude/airspeed references, crew disorientation lead to a loss of control, and the crash. 

In evaluating power loss scenarios, it is important to consider the effects of power losses on a single electrical bus, and the capabilities of the remaining buses to carry the electrical loads. (Threat Category: Lack of System Isolation/Segregation)

  • One of the scenarios that may have led to this accident was the sudden loss of the number 1 electrical generator when its engine was shut down, and the transfer of electrical load to the number 2 generator, which would have become overloaded, and dropped offline (cascading failure). An automatic transfer to standby power did not occur, leaving the airplane with no electrical power from any source.

Common Theme Related Lessons:

Warning, or crew alerting system integrity needs to be sufficiently reliable so that false indications are very rare events. The high rate of false warnings, and the high rate of unnecessary actions which result, adds additional risks to safety of operation. (Common Theme: Unintended effects)

  • During the time of this accident, false engine fire warnings were very common occurrences on many engine installations. The evidence in this accident suggested that the engine fire warning was false. Although the warning itself may not have posed a particular hazard to safety of flight, the high rate of occurrence carries with it additional risks which result from the repeated exposure to the resulting actions of the warnings. Some of these additional risks include:
  • Flight crews failing to take appropriate actions because they expect the warning to be false, since that has always been their experience.

  • Actions as a result of the warning, such as shutting the engine down, and executing an in-flight diversion to an alternate airport, possibly in bad weather and in unfamiliar conditions.

  • Reactions to the warning, combined with other failures or conditions (such as dispatching in an MEL configuration, as was the case in this accident), can combine to form a hazardous situation.

  • Compounded risks by including human error, as in the case of the crew failing to complete the MEL actions prior to the false warning, or by improper reaction to the warning itself (e.g. shutting the wrong engine down, etc.).

Controls or switches that must be employed during accomplishment of emergency procedures, where the opportunity for human error is increased, must be arranged and configured to reduce the risk of crew error in their selection. (Common Theme: Human Error)

  • On this airplane, the battery and galley power switches were located next to each other and were of a similar design. Further, the design was such that the switches were not positively locked in position and could be moved inadvertently. It was deemed possible that the flight engineer could have inadvertently deactivated battery power rather than actually deactivating galley power in preparation for takeoff. Dependence on manual switching of standby information and electrical power source may not be adequate on large transport category airplanes.

  • Procedures for accommodating a generator failure required certain manual operations to attain a proper electrical configuration and load. Further, requiring the manual shutdown of certain electrical loads prior to takeoff (in particular, galley power, which was located next to the battery switch and was of a similar switch type) could have resulted in galley power inadvertently having been left on and/or battery power inadvertently having been shut off.

Failure to adhere to MEL procedures substantially increases the risk to safe operation when exposed to a subsequent failure or condition. (Common Theme: Human Error)

  • The MEL dispatch configuration had certain associated requirements related to takeoff electrical loads (dispatch with galley power off). Inadvertent activation of loads that were required to be off could have caused a generator overload and failure of all electrical power.

Back to top