When the airliner pulled up to the gate, the first indication that something was amiss came from a shock felt by the crew that ran through the plane at the same instant that a sign on the terminal wall illuminated the message “STOP.” As soon as the engines shut down, the cabin services manager rushed to the cockpit and announced that the airplane had collided with the air bridge and that there was a gaping hole in the wing.
The jagged hole was the end product of multiple breaches to system safety (see Figure A). The safety defenses were breached through a combination of complacency and ignorance that led to the final and humiliating gash in the wing. Without a doubt, human error was involved, but the computerized coding for the flight was a contributing factor. The incident shows how an arcane code can contribute to a snowballing of errors. While the cumulative errors involved a ground-based system, one wonders about similar potentials in modern avionics.
| Figure A |
| The aircraft being repaired after being ferried to Syria. Note the technician’s head in the damaged area, indicating that a substantial portion of the lower wing surface was damaged. Photo: SHK |
Details are contained in the just-released Swedish Accident Investigation Board (Statens haverikommission, SHK) report of the pre-dawn 11 September 2006 incident at Stockholm’s Arlanda Airport involving a Syrian Arab Airlines B747SP arriving from Damascus with 116 passengers and crew.
The cockpit voice recorder (CVR) was blank (erased perhaps, not stated in the investigation report) and the Syrians did not release the flight data recorder (FDR) information to the Swedish investigators. One can only imagine the Arabic oaths on the CVR as the wing crunched into the jet bridge jutting out from the terminal building. As the SHK report said delicately, “Since the aircraft CVR did not hold any usable data, the actions and observations of the pilots while taxiing in could not be reconstructed with certainty.”
No one was injured, save for some embarrassed crew egos, no doubt, and the passengers debarked through the jet bridge
This sort of collision was supposed to have been prevented by the docking guidance system, called “Safedock,” that was installed at Arlanda’s terminals. This system uses a high intensity LED (light emitting diodes) display, in conjunction with a laser scanner, to detect the precise location of the aircraft as it approaches the jet bridge. The LED display is large enough to help guide the pilot as he taxis in to the jet bridge, especially during periods of low visibility, as was the case here (see Figure B).
| Figure B |
| The docking procedure, shown here for a B757. A laser scanner is used to warn the gate operator and the pilot if a fault occurs. However, gate 18 at Arlanda was not equipped with the upgraded laser scanners and thus could not detect the difference between a B747 and a B747SP. The distance between the aircraft nose and the front of the wing on the B747SP is about 18 feet less than for a B747. The high intensity LED messages are displayed on the terminal wall, depicted here as DGS, for Docking Guidance System. Illustration: SHK |
The air bridge is managed by an operator, who programs “Safedock” with the aircraft type and other relevant parameters via a control panel on the air bridge. Once programmed, the LED signage functions automatically and the airplane should stop at just the right position for the air bridge to be mated with the aircraft doorway.
Let us now go through the various ways the total system failed. Recall the construct for safety systems first articulated by the UK researcher James Reason. He used slices of Swiss cheese to describe how safety defenses can be breached, and if the holes in the cheese line up, the result can be an incident or accident. Plug one or more holes and an untoward event will be forestalled.
The flight originally was to have been made by an A320, but because of the number of passenger bookings, a B747SP was substituted. The “SP” stands for “Special Purpose” and is a shortened version of the venerable B747. The airplane is a real rarity nowadays, with SPs few and far between. Whereas the B747 has two doors forward of the wing, and normally uses Door 2 to board passengers, the SP has only Door 1 and, coincidentally, must be parked further away from the terminal to avoid having the wing collide with the jet bridge.
The International Air Transport Association (IATA) establishes codes for all aircraft types. In the case of the B747SP, the code is “74L.” This special code, instead of B747SP, clearly injects a potential uncertainty. Self-evident is always better, as far as coding conventions go.
In fact, four different codes were in use that morning at Arlanda for this aircraft: B747SP, B74S, 74L, and B74SH. Things can potentially get real confusing real fast.
As it turned out, the “Safedock” operator was not familiar with the code 74L she received for the flight from the airport’s internal data system. Worse, there was no decoding table available to translate the IATA codes into the names that were used in the docking system. She wasn’t familiar with the code “B74SH” either.
She consulted colleagues, who were equally mystified. She looked out the gate, saw the aircraft approaching, and thought it was a B747. Looking at the taxiing airplane, the SHK report determined, “Was in this case worthless, since in the dark and viewed directly from the front, it is virtually impossible to distinguish a B747 from a B747SP.”
Let’s chalk the IATA code up as breach 1 in the safety system.
She was employed by LVF Handling, which provided personnel for the docking systems at the airport. LVF training was rudimentary. As the SHK report noted:
“The theoretical internal training of operators carried out within the handling company has been brief and relatively limited … No training was provided in respect of decoding or identifying the various names of aircraft types.”
The SHK report said bluntly, “The risks associated with incorrect operation [of “Safeguard”] are not being taken seriously.”
Chalk up the training deficiency as breach 2 in the safety system.
Because of at least two earlier incidents of B747SP collisions with jet bridges at the airport, two things had happened. One, the “Safedock” system had been upgraded to include laser scanners to calculate the taxiing aircraft’s length, by measuring the distance between the aircraft’s nose and the nearest of its engines. This distance, from the nose to the leading edge of the wing, is about 18 feet less on the B747SP than on the regular B747. However, this upgraded system, installed at certain gates at Arlanda, was not installed at gate 18, where the Syrian B747SP was to park. About eight years had passed since the SHK had first recommended universal installation of the upgrade, based on its investigation of the previous B747SP collisions with the jet bridges.
So the tardy upgrade can be cited as breach 3 in the safety system.
Two, the operator’s panel functions had been altered following the earlier incidents. The operator’s panel program was modified so that B747SP was the version of the aircraft type that would be displayed first when the ramp agent selected B747. This change was made to have a more safe outer parking position so as to prevent a repetition of the previous incidents. However, believing the aircraft was a B747, and because the computer would not accept “Door 2,” as there is no such door on the B747SP, she overrode the B747SP and entered B747. The SHK said:
“This ‘barrier’ was however revealed as being completely worthless when the operator, as in this case, was totally convinced that she should enter B747 and had not been trained or informed about the B747SP type version.”
Thus, the operator overrode a hedge built into the safety system – breach 4.
What about the captain? The LED sign displayed B747 for gate 18, not B747SP. The gate agent was interviewed following the event and said she saw the alternating information, “B747/2 DOOR” flashing on the LED display while the aircraft was taxiing in. The captain said he saw only “B747,” and even though he was commanding a B747SP, he said he had seen the docking system at other airports display B747 although the system was set for the B747SP. The SHK opined:
“SHK considers it probable that the commander did see the full text, ‘B747/2 DOOR’ on the display [and] assumed that it was an unusual but normal local code for the B747SP. The fact that the commander completed the taxiing maneuver, however, leads SHK to point out that the company’s training and operating procedures could probably be improved in this area.”
The SHK issued four recommendations:
1. Improve training so that gate operators know the different types and models of aircraft they are dealing with.
2. Ensure that a safety and quality control system for air bridge operators and guidance systems for docking aircraft is in place.
3. Ensure that all gates at Arlanda are equipped with the upgraded scanners to distinguish differing aircraft lengths of the same model.
4. Ensure that all docking terminals are designed so that aircraft types cannot be misinterpreted.
Not a word about the four abbreviations used by various agencies to refer to the B747SP, and the obvious need to clean up this Augean stable of potential confusion. In an ideal world, one would like to see a recommendation for each of the safety breaches noted above; however, the SHK report was not organized along the lines of these holes in the Swiss cheese layers of the safety system.
What the SHK did indicate is a desire to receive, by 20 June 2008, a report of how the recommendations are being followed up.
One thing is evident: minimum training to ground staff was the proximate cause of this event. Had she known the meaning of “74L” and its significance, the torn wing might have been prevented. Then again, the captain presumed that the wrong message on the display board, “B747/2 DOOR,” was the right one for a B747SP. There is no evidence from the SHK report that he inquired about the curious disconnect as he taxied in. It was just before dawn; one wonders if, in this period of circadian rhythm low, he was too tired to ask for an explanation.
(For the full SHK report, see www.havkom.se/virtupload/news/rl2007_23e.pdf; for more on B747SPs, see www.tinyurl.com/ysxw9b)