On 18 January 1969, United Airlines Flight 266, a Boeing Model 727-22C series airplane, N7434U (airframe serial no. 19891), bound for Milwaukee, WI crashed into Santa Monica Bay after departure from the Los Angeles International Airport (LAX), at night and in light rain and fog. Shortly after take off, the flight crew reported a fire warning in the No. 1 engine and proceeded to shut that engine down. An air turn-back to LAX was requested. This was the last voice contact with air traffic control (ATC). Approximately five seconds after this communication, radar returns from the airplane transponder were lost. ATC radar indicated that the airplane entered a left turn and disappeared from the radarscope within two sweeps. All 38 passengers and crewmembers were lost. (Map of flight path)

The flight had been dispatched with generator No. 3 inoperative, in accordance with the minimum equipment list (MEL), and had been operated in this configuration since January 15, 1969 (approximately 42 flight-hours). United Airlines' procedures for this condition required that galley power and one air conditioning pack fan be OFF for takeoff, and could be turned on in flight following flap retraction.

The exact cause of the loss of all electrical power could not be determined from available evidence. However, the loss of the No. 2 generator is associated with the sudden placement of all three generator bus loads on that generator after the shutdown of the No. 1 engine. When the No. 1 engine was shut down, electrical power from its generator was lost, leaving the No. 2 generator as the sole source of main alternating current power. Loss of the No. 2 generator would have resulted in the loss of normal direct current as well as main AC electrical power on the airplane. Under such conditions, the standby electrical power system, powered by the airplane battery, would provide the electrical power needed to operate and illuminate basic flight instruments. For reasons that could not be determined, the standby electrical power system either failed or was not activated.

There was very little evidence related to the failure of the No. 2 generator, however, several scenarios were considered. One scenario involved, contrary to United Airlines' procedures, the failure to turn off galley power and/or one air conditioning pack fan prior to takeoff. Following the loss of the No. 1 generator, all electrical loads would have transferred to the No. 2 generator. If the additional loads of the galley and/or air conditioning packs were present, the generator could have been overloaded and tripped offline.

Alternately, the severity of the overload may have been the cause of the generator failure. Ground and flight tests subsequent to the accident indicated that, under extreme overload conditions, induced electrical interference may inhibit proper operation of a time delay circuit in the generator control panel. The expected function of the control panel during normal operation would be to trip the bus tie breaker, isolating the generator and its load from the rest of the system. If this time delay circuitry fails to operate properly, or is disabled by induced interference, the overload will trip the generator control relay, removing the generator from the system. It is possible that the sudden shock load was sufficient to trigger this sequence of events.

Finally, the NTSB could not rule out the possibility that an apparently uncorrected problem in the No. 3 generator system may have been a factor in the loss of the No. 2 generator. The No. 3 system was relatively free of problems until the installation of a new No. 3 generator control panel five days prior to the accident. The installed control panel had an extensive history of malfunctions for a variety of reasons. Following this change, the No. 3 generator was changed because the field relay would not stay closed. Less than four flight hours later, the No. 3 generator was rendered inoperative. The occurrence of two separate problems within such a short time after installation, and subsequent tests showing the removed generator functioned properly, indicated to the NTSB that the problem was not corrected and was probably associated with the control panel.

Several scenarios leading to the failure of the standby electrical system were also considered, although no evidence was discovered to substantiate any of the possibilities. The first scenario involved the inadvertent shutdown of the battery bus by the flight engineer. The galley power switch and battery switch were located in close proximity to one another, and both are non-locking, ON-OFF toggle switches. It was considered possible, in attempting to verify that galley power was off, that the flight engineer either moved the wrong switch or inadvertently brushed the battery switch and turned it off, rendering the battery unavailable following the loss of all generators. A second scenario involved the failure of the battery or battery charger. If the battery had failed, or was not properly charged, it would be unavailable for use following the loss of all other power sources. Following the accident, the flight engineer’s panel was redesigned to place a guard over the battery switch. (Engineer’s panel on accident airplane) (Engineer’s panel after AD)

The probable cause of the accident was flight crew disorientation due to loss of attitude indication resulting from the total loss of electrical power. One scenario that is not contradicted by available evidence was the inadvertent placement of the battery switch to the "OFF" position by the flight engineer during attempts to remove galley loads from the generator buses. The galley switches were similar in shape and size and were located on the flight engineer's upper panel in close proximity to the battery switch.

Back to top

The NTSB concluded that the probable cause of the accident was loss of attitude orientation during a night, instrument departure in which the attitude instruments were disabled by loss of electrical power (see Captain's Panel and First Officer's Panel to the right). The NTSB was unable to determine (a) why all generator power was lost and (b) why the standby electrical power system either was not activated or failed to function. (NTSB Findings) The complete accident report, as issued by the NTSB, is available at the following link (accident report)

Back to top

Accident Board Recommendations

The NTSB submitted the following safety recommendations to the FAA:

1) For all turbine-powered airplanes, mandatory incorporation of automatic switching of essential systems to standby power in the event of loss of all generators. As an interim action until automatic switching features were installed, emergency checklists pertaining to "Loss of all Generators" to be adopted by all airlines, providing procedures for the flight engineer or captain, as appropriate, to perform a check to ensure that the battery switch is in the "ON" position. (see Flight Engineer's Panel to the right)                                                                                                  

2) Provide the flight engineer with positive indication on his panel whenever the standby electrical power system is being powered by the battery. (see Schematic diagram of Flight Engineer's Panel)

3) Remove the "STANDBY" position from the multi-position, rotary essential power source selector switch and assign to a separate ON-OFF toggle switch. (see Rotary Switch)

The complete text of the recommendations, excerpted from the NTSB report, are available at this link: (NTSB Recommendations)

Back to top

Section 4b.606, "Equipment, systems, and installations," of the Civil Air Regulations (CARs) (CAR 4b.606) - Requires that systems, equipment, and installations reliably perform their intended functions, that they should be designed to safeguard against hazards to the airplane in the event of their failure or malfunction, and provides requirements relative to essential electrical loads for both normal and failure conditions.

Section 4b.612, "Flight and navigational instruments," of the CARs (14 CAR 4b.612) - Outlines the requirements for flight instrument systems and their calibrations and tolerances.

Section 4b.622, "Generating system," of the CARs (14 CAR 4b.622) - Outlines the requirements for electrical power generating systems.

Section 4b.623, "Distribution system," of the CARs (14 CAR 4b.623) - Outlines the requirements for electrical power distribution systems.

Section 4b.627, "Electrical system tests and analyses," of the CARs (14 CAR 4b.627) - Requires demonstrations by analysis or test that the electrical system functions properly and without electrical or thermal distress.

Back to top 

At the time of this accident, the reliability of engine fire warning systems on turbine powered aircraft was relatively poor, and false fire warnings were relatively common. Reliable dual-loop fire warning systems were not available, and as a result, single faults would result in unnecessary engine shutdowns. This was true on the Pratt & Whitney JT8D engine powering the 727, as well as other installations at the time. While false engine fire warnings and accompanying shutdowns, in and of themselves, may not pose an immediate threat to safety, the frequency of occurrence of these false warnings can increase the risk that an individual airplane can eventually experiencing an additional unrelated failure or malfunction which, when combined with the false warning, can be catastrophic under certain conditions (i.e., a fire warning combined with inappropriate electrical power reconfigurations.) This underscores the importance of minimizing false warnings of all kinds.

Back to top 

Loss of attitude information needed for safe flight and landing of the airplane.

Unguarded battery switch located adjacent to identical type switch for galley power.

Lack of independence of critical flight instrument display from the electrical power generation system.

Back to top 

1) The standby electrical system will be effectively activated, either automatically or by the flight crew, in the event of loss of all generated electrical power. 

2) The flight crew will continue to have primary flight displays (airspeed, altitude, and attitude) following the disruption of electrical power, and those displays will be adequately lit, allowing viewing in a dark flight deck.

3) When operating per the MEL, the flight crew will properly configure the airplane in accordance with the MEL instructions.

Back to top

Five days prior to the accident, the No. 3 generator control panel was removed and replaced. On the same day, a flight crew flying this airplane reported problems with the No. 3 generator. The generator was replaced. The generating system was functionally tested and passed all tests, however, three and a half flight hours later, the flight crew flying at the time disconnected the newly installed generator because the field relay would not stay closed. The No. 3 generator was then rendered inoperative and carried as a deferred maintenance item per the MEL. The generator continued to be carried as a deferred item for three days and operated through 28 stations, 23 of which possessed maintenance facilities at which the generator could have been replaced. Flight scheduling prevented its repair at any of these facilities.

The NTSB stated that dispatch of the airplane with the No. 3 generator inoperative was not a casual factor in the accident. However, the NTSB also stated that timely repair of inoperative components, beyond the requirements of the MEL, would significantly enhance safety.

Back to top

At the time of the Model 727 certification, part 4b, "Airplane Airworthiness; Transport Categories," of the CARs (CAR part 4b) was the effective regulation and was established as the certification basis. In 1965, CAR part 4b was replaced by part 25, "Airworthiness Standards: Transport Category Airplanes," Title 14 of the Code of Federal Regulations (14 CFR part 25) as the certification standard for transport airplanes. As a result, in 1969, when this accident occurred, CAR part 4b was no longer in effect, and was not subject to amendment.

It was determined, however, that a regulatory amendment should be processed to improve safety standards relative to factors in this accident. Accordingly, since 14 CFR part 25 was the effective regulatory standard, specific changes were made to 14 CFR part 25 as follows: 

Amendment 25-23, May 8, 1970 (35 FR 5665, April 8, 1970), to section 25.1333, "Instrument systems," of the regulations (14 CFR 25.1333). Amendment 25-23 was adopted and required that flight instruments needed for safe flight and landing of the airplane be available to the flight crew after any failure or combination of failures not shown to be extremely improbable, without the need for crewmember action.

The same evolution existed relative to the operating rules which became part 121. "Operating Requirements: Domestic, Flag, and Supplemental Operations," (14 CFR part 121), which was amended as follows:

Amendment 121-60, to section 121.305, "Flight and navigational equipment," (14 CFR 121.305), requires a third attitude indicator whose operation is independent of the electrical generating system. (Note: the indicated link is to the current version of 14 CFR 121.305. The version as amended by amendment 121-60 is no longer available)

Back to top

Emergency AD 69-04-01, amendment 39-723, mandated replacement of the battery switch with a detent lock type or install a guard over this switch (see illustration to right).

AD 69-16-01, amendment 39-838, revised the emergency procedures section of the Boeing 727 airplane fight manual (AFM) to provide flight crews with enhanced procedures for dealing with loss of all generators.

AD 69-25-01, amendment 39-882, required modification of the generator control panel for the purpose of filtering out electrical interference that could, under overload conditions, disable the generator before opening the bus tie breaker. 

Back to top

Airplane Life Cycle:

• Operational
• Design / Manufacturing

Accident Threat Categories:

• Flight Deck Layout / Avionics Confusion
• Lack of System Isolation / Segregation

Groupings:

• Automation

Accident Common Themes:

• Human Error
• Flawed Assumptions
• Unintended Effects

Back to top

Human Error

One of the possibilities cited by the NTSB for non-activation of the standby electrical system was the inadvertent deactivation of the system by the flight engineer. Though the NTSB was unable to conclusively establish that this was, in fact, the case, if it had occurred, it would explain the lack of standby electrical power, and the ensuing loss of attitude, airspeed, and the loss of standby instrument lighting, leading to the loss of control of the airplane. In the stress of the situation, the similar design, and close proximity of the standby power and galley power switches, the NTSB viewed it as a possibility that the flight engineer moved the wrong switch.

Flawed Assumptions

Though it was never established by the NTSB why the standby electrical system failed to activate after the loss of all other airplane electrical power, a basic airplane design assumption was that that standby electrical system would always operate. Its failure left the flight crew with no attitude or airspeed references, and no instrument lighting, making any functioning instruments unreadable.  Combined with the dark night and inclement weather, loss of control was the inevitable outcome. Had this basic assumption been correct, airplane control could have been maintained.

Unintended Effects

Many of the switches and controls for basic airplane systems were of similar design, and located near each other. The switches for the standby electrical system, and galley power were identical in form and method of activation, and on the accident airplane, were located in close proximity to one another. Though it was never conclusively established by the NTSB, the non-activation of the standby electrical system could have been the result of the flight engineer inadvertently disabling the standby electrical system when attempting to deactivate galley power. If the switches had been of dissimilar design, and/or not been collocated, this error could not have been made.

Back to top

None.

Back to top

Technical Related Lessons:

Flight deck layout should be such that inadvertent or incorrect actions are prevented by positive design details. (guarded switches, non-proximity of commonly used switches, etc.) (Threat Category: Flight Deck Layout/Avionics Confusion)

• In the case of the original 727 Flight Engineer's panel, the unguarded toggle switches for galley power and the battery were identical, and adjacent to each other. The arrangement made them vulnerable to incorrect actuation, which at the time of this emergency was believed to have contributed to the catastrophic loss of all electrical power following automatic shedding of the last AC generator.

Reversion to backup/standby systems should be timely, and automatic. (Threat Category: Lack of System Isolation/Segregation)

• In this accident, the standby electrical system either failed, or was never activated, resulting in a dark flight deck, and loss of some instruments. The accident report cites multiple possibilities for its failure. Any standby or emergency system that is expected to operate in critical situations should provide seamless, disruption free transition to the backup mode(s). 

Complete loss of all normal electrical power can occur, for a number of different reasons, including human error. Emergency electrical power for flight instrumentation and associated lighting needs to be provided for a sufficient period to allow continued safe flight and landing. (Threat Category: Lack of System Isolation/Segregation)

• Following the loss of all engine-generated electrical power, Flight 266 primary flight attitude displays were inoperative without standby battery power. The failure or inactivation of this standby electrical system means that the airplane attitude instruments and lighting for these instruments remained unavailable. With no attitude/altitude/airspeed references, crew disorientation lead to a loss of control, and the crash. 

In evaluating power loss scenarios, it is important to consider the effects of power losses on a single electrical bus, and the capabilities of the remaining buses to carry the electrical loads. (Threat Category: Lack of System Isolation/Segregation)

• One of the scenarios that may have led to this accident was the sudden loss of the number 1 electrical generator when its engine was shut down, and the transfer of electrical load to the number 2 generator, which would have become overloaded, and dropped offline (cascading failure). An automatic transfer to standby power did not occur, leaving the airplane with no electrical power from any source.

Common Theme Related Lessons:

Warning, or crew alerting system integrity needs to be sufficiently reliable so that false indications are very rare events. The high rate of false warnings, and the high rate of unnecessary actions which result, adds additional risks to safety of operation. (Common Theme: Unintended effects)

• During the time of this accident, false engine fire warnings were very common occurrences on many engine installations. The evidence in this accident suggested that the engine fire warning was false. Although the warning itself may not have posed a particular hazard to safety of flight, the high rate of occurrence carries with it additional risks which result from the repeated exposure to the resulting actions of the warnings. Some of these additional risks include:
  • Flight crews failing to take appropriate actions because they expect the warning to be false, since that has always been their experience.
  • Actions as a result of the warning, such as shutting the engine down, and executing an in-flight diversion to an alternate airport, possibly in bad weather and in unfamiliar conditions.
  • Reactions to the warning, combined with other failures or conditions (such as dispatching in an MEL configuration, as was the case in this accident), can combine to form a hazardous situation.
  • Compounded risks by including human error, as in the case of the crew failing to complete the MEL actions prior to the false warning, or by improper reaction to the warning itself (e.g. shutting the wrong engine down, etc.).

Controls or switches that must be employed during accomplishment of emergency procedures, where the opportunity for human error is increased, must be arranged and configured to reduce the risk of crew error in their selection. (Common Theme: Human Error)

• On this airplane, the battery and galley power switches were located next to each other and were of a similar design. Further, the design was such that the switches were not positively locked in position and could be moved inadvertently. It was deemed possible that the flight engineer could have inadvertently deactivated battery power rather than actually deactivating galley power in preparation for takeoff. Dependence on manual switching of standby information and electrical power source may not be adequate on large transport category airplanes.
• Procedures for accommodating a generator failure required certain manual operations to attain a proper electrical configuration and load. Further, requiring the manual shutdown of certain electrical loads prior to takeoff (in particular, galley power, which was located next to the battery switch and was of a similar switch type) could have resulted in galley power inadvertently having been left on and/or battery power inadvertently having been shut off.

Failure to adhere to MEL procedures substantially increases the risk to safe operation when exposed to a subsequent failure or condition. (Common Theme: Human Error)

• The MEL dispatch configuration had certain associated requirements related to takeoff electrical loads (dispatch with galley power off). Inadvertent activation of loads that were required to be off could have caused a generator overload and failure of all electrical power.

Back to top