At least 21 times in the past five years, U.S. airline pilots relying on the same navigational equipment used by Korean Air Lines Flight 007 have found themselves off course--in one case by 250 miles, according to reports they have filed with the National Aeronautics and Space Administration.
All of those planes were using an inertial navigation system (INS), the primary pathfinding gear on the KAL Boeing 747 that wandered 310 miles from its assigned track and carried 269 people into Soviet airspace, where a Soviet fighter shot it down.
The reports compiled by NASA and made available to The Washington Post include cases in which INS computers have malfunctioned, in which crew members have made mistakes in programming the computers, and in which pilots have failed to monitor the INS and the flight. Pilots and air traffic controllers reporting incidents and their own mistakes to NASA are guaranteed immunity and anonymity, but the information they provide is shared with the aviation community:
* One sweaty-palmed pilot said that his INS--which he had been warned before takeoff was behaving unreliably--had caused his plane to arrive three minutes early at a crowded junction in the airlanes approaching San Francisco. A time variation that large easily could cause a collision. "I had placed too much faith in an 'unreliable' INS and had not cross-checked enough" with other available navigational aids, the pilot said.
* Another pilot discovered a problem when an air traffic controller in Newfoundland radioed him that he was substantially off course over the North Atlantic. When he checked, he found that one of the required sets of geographic coordinates had not been entered into the computer because he had simply copied his airline's prepared flight plan instead of checking his navigational charts. He had urged the company "to advise flight planning" not to let it happen again, he said dryly.
* The pilot who found himself 250 miles north of course was flying between Japan and Oakland. The INS was supposed to be coupled to the automatic pilot so it could "fly" the plane in response to INS commands. Instead, a switch on the autopilot was set so that the plane would hold its last heading instead of changing course. A crew member finally caught the error by monitoring other equipment and noticing a deviation.
"It is not known how the autopilot . . . was switched to the wrong position," the pilot wrote. "Equipment malfunction or inadvertent crew action is suspected."
There are more than 1,000 scheduled airline flights a day in the United States alone, so 21 reported INS problems in five years is not a large percentage. But NASA has no way of knowing what percentage of such problems are reported, and the reports point up that no matter how reliable the equipment, it is not infallible--especially when people are cranked into the equation.
Automation on new-technology airplanes is creating some gnawing questions for safety experts: Should everything possible be computerized? What are the human consequences? The problems are particularly acute on long, overwater international flights that are far from civilian radar surveillance and where the airline crew members have to rely completely on their own skills, their ability to work together, and their equipment.
Speculation on what happened to Flight 007 has concentrated on the possibilities that either the INS malfunctioned or the KAL crew members made a mistake when they programmed the INS during a refueling stop in Anchorage on the Aug.30-Sept. 1 flight from New York to Seoul. Those are the only known possibilities barring the bizarre--a hijacker taking command of the plane or the South Korean government ordering an illogical intelligence mission.
Geography buffs have noted that the transposition of two digits in the latitude-longitude coordinates of one of the KAL flight's mandatory geographic check points would put the plane approximately where it was shot down--just west of Sakhalin Island. Those coordinates are keyboarded by hand into the INS computer, and are supposed to be checked by another crew member before takeoff.
"You'd be surprised how often you'll find you put in a 34 instead of a 43," Pan American World Airways pilot Thomas Foxworth said in an interview. Foxworth is the co-author of a novel, Passengers, which tells the tale of a computer run amok on a new-technology aircraft.
But the INS was one of at least three different methods the KAL crew members had available to check their position after the flight was under way. It would have taken a massive electrical failure to knock out everything, experts say, and it is known that the KAL crew members had their radio, because they told Japanese air traffic controllers of an altitude change they were making.
Foxworth said that, in his view, "One area that is woefully ignored and neglected in all of civil aviation is the psychological dynamics between the guys in that crew. The standard myth pilot, the one with straight teeth and a crooked smile, may be worst guy you could have up there. He does not take recommendations; he's going to do it his way."
It is just that problem that United Airlines was addressing when it started extensive human-relations training for its crew members about two years ago; other airlines have emulated that program.
The history of aviation is full of reasons for such concern. The world's worst airline disaster--the collision in March, 1977, of two 747s that killed 577 people on a fog-enshrouded runway at Los Rodeos Airport on Tenerife in the Canary Islands--happened when a KLM pilot started to take off without clearance from the tower.
"Wait a minute, we do not have a clearance," the KLM co-pilot said to the respected, senior captain. The co-pilot radioed the tower and received navigational directions, but no takeoff clearance. As he was reading those instructions back to the captain, the captain said, in Dutch, "We go, check thrust," and the huge jumbo roared down the runway into a taxiing Pan Am jet.
The Dec. 1, 1974, crash of Trans World Airlines Flight 514 into the Blue Ridge mountains west of Dulles International Airport involved a similar sequence. Because of vicious winds the flight had been diverted from Washington National Airport to Dulles, and the pilot and co-pilot were studying less than familiar charts as they descended.
The captain thought that an instruction from the Dulles air traffic controller meant the plane could drop to 1,800 feet. A lively discussion followed as the captain defended his decision.
"Well, but . . . ," the co-pilot tried.
The captain cut him off: "When he the controller clears you, expletive deleted that means you can go to your . . . initial approach altitude," a predetermined altitude for approaching a runway. That proved to be fatal for the 92 people on board, because the initial approach altitude coincided with the top of the mountain.
NASA was given the job of collecting and confirming anonymous aviation safety reports after the TWA Flight 514 crash, because investigators found that other airline captains had almost made the same navigational mistake coming into Dulles, but had discovered it in time to miss the mountain. They had declined to report the problem because of fear of disciplinary action from the Federal Aviation Administration.
In the old days, flight crews included a navigator sitting in a bubble on top of the airplane monitoring his compass and shooting the stars through a sextant. The navigator went out even on international flights with the advent of jet transports and their computers.
Further automation in the newest jetliners has eliminated the flight engineer and left only a pilot and a co-pilot. It is even technically possible today for an airplane to take off, cruise, respond to course changes and air traffic control directions and land safely without a pilot on board, although no airline would consider such a thing.
Earl L. Wiener and Renwick E. Curry, two experts who have studied the impact of automation for NASA, wrote in 1980 that "individuals involved with pilot training have noted perceptible skill losses in pilots who use automatic equipment extensively."
Wiener and Curry recommended guidelines for automated systems that included "extensive training for operators" not only "to insure proper operation and setup," but also to teach pilots how to monitor systems carefully and catch computer errors and malfunctions.
Three-man crews--a pilot, a co-pilot and a flight engineer--still are required on 747s and other transports used for transoceanic flights. One question is whether crew members have enough to do to remain alert on those long overwater flights.
Foxworth, who has twice in the past month flown the same route the KAL plane was supposed to take, was asked about this.
"It's easy" to become complacent, he said. "It's a human failing. The record is replete with numerous incidents of a guy just falling asleep. It doesn't happen often."
The KAL plane was equipped with the latest in pathfinding technology: three computer-driven inertial navigation systems manufactured by Litton Industries and installed only a year ago. An INS is nothing more than a sophisticated dead-reckoning system. It is told where the airplane is and where it is supposed to go. Seven times a second the INS computes direction, speed and the effect of the wind on the flight, then feeds corrections to the automatic pilot, which adjusts the throttles and directional controls.
Normally, one of the three INS systems is coupled to the pilot's autopilot and the second to the co-pilot's autopilot. The third INS monitors the flight. If there is a disagreement between the pilot's and the co-pilot's INS systems, it will show up on the control panel.
But a crew member must notice the discrepancy, then call upon the third INS to cast the tie-breaking vote.
But the INS depends totally upon people for its initial information: the geographic coordinates of where it is and the geographic coordinates of where it is supposed to go. Both KAL and Pan Am crew members have told reporters that it is their policy for one member to place all the coordinates of a flight in the computer and for a second crew member to check each one.
The INS system is self-contained. There are no outside references that continually feed the system as there are with some other aircraft navigation systems commonly used.
The crew can use radio beacons at the end of the Alaskan Aleutian chain and north of Hokkaido, the northernmost Japanese island, to verify INS accuracy at the beginning and end of the North Pacific route assigned to KAL Flight 007. But there is a gap of more than 1,000 miles in that route where no radio beacons can be received.
The KAL plane also was equipped with two weather radar units, each with a "mapping mode" to display land masses and oceans. Several pilots have said in interviews that the route Flight 007 was supposed to take is easy to follow on the radar, because there is almost always a land mass to avoid--first the Kamchatka Peninsula, then the Kuril Islands, then Hokkaido. By the time Hokkaido is reached, air traffic controllers are within range to monitor the flight on radar and complain if it strays from course.
Finally, it is the procedure on most airlines during the flight to plot the desired course on a map, then take current position readings from the INS (which can be queried at any time) and make certain that the reported position falls on the line of the desired course.
But the facts are that despite the triple redundancy of the INS, it can be misprogrammed and there are examples of it having failed. NASA's William Reynard, who runs the aviation safety report system, said, "Once you're away from standard navigation, you've got to believe."