The Cargo Door Was Left Open. Then the Airspeed Disappeared.
The most dangerous failures in complex engineering systems do not always begin where the final problem appears. In the Boeing 747-400 SF incident involving G-ONEE, the event began on the ground with an open cargo door during rainfall. Water entered the aircraft, reached electrical equipment beneath the cargo deck, and caused two AC electrical buses to be isolated. That electrical failure removed heating from all four pitot-static probes. The critical flight-control consequence appeared later, when the aircraft descended into icing conditions. The pitot probes froze, all three airspeed indications became erroneously low, and the autopilot responded to the false data by commanding a nose-down pitch. The investigation illustrates how a seemingly ordinary ground-handling condition can propagate through several layers of an aircraft's architecture before becoming a flight-control problem.
1. The Problem Started Before Takeoff
The Boeing 747-400 freighter was scheduled to operate from London Heathrow to Hong Kong with no cargo onboard. During overnight maintenance, the left forward L1 door remained open while work was being carried out. During the final two hours before maintenance ended, moderate rainfall occurred. The investigation found that the L1 door mat and surrounding cargo-deck area had become wet. There were no significant pools of standing water, but the cargo deck had been exposed to rainfall. The aircraft subsequently departed and the first electrical problems appeared during the takeoff roll.
2. Water Reached Equipment That Was Not Supposed to Get Wet
The Main Equipment Centre (MEC) is located below the main cargo deck. The E1 and E2 avionics racks contain the Generator Control Units and other electrical and electronic equipment. The investigation found evidence of water ingress into GCU 1 and GCU 4. When GCU 4 was removed, water was found coming from the unit and moisture was also present around its installation area. Examination of the units identified corrosion, moisture residue and evidence consistent with water intrusion. The exact route taken by the water from the cargo deck to the GCUs could not be established.
3. The Electrical Protection System Reacted to the Water
GCU 4 developed faults associated with its internal electrical protection functions. Recorded data showed that AC Bus 4 was isolated after the GCU detected a Sync Bus Protection fault followed by a Shorted Rotating Diode fault. The investigation considered water ingress a possible cause of these faults. Shortly afterwards AC Bus 1 was also lost. The GCUs responded by opening their associated contactors and isolating the buses. When GCU 4 was replaced, the recorded faults disappeared and both AC buses could be powered normally. GCU 1 was also replaced.
4. Losing Two AC Buses Also Meant Losing Pitot Heating
The Boeing 747-400 is equipped with four combined pitot-static probes. The captain and first officer airspeed and altitude information is derived from these probes, while the integrated standby flight display uses the left auxiliary pitot-static probe. The pitot-static heating system was supplied through AC Buses 1 and 4. When both buses were lost, heating was lost to all four pitot-static probes and both Total Air Temperature probes. The flight crew were aware of this consequence and the QRH specifically warned them to avoid icing conditions because the captain's, first officer's and standby airspeed indications could become unreliable.
5. The Crew Tried to Stay Out of Icing
The crew declared PAN and began diverting toward Amsterdam Schiphol. They recognised that the planned descent could take the aircraft through icing conditions and prepared for the possibility of unreliable airspeed. At the same time, the cabin altitude began increasing and exceeded 8,600 ft. To avoid the additional complexity associated with oxygen masks if cabin altitude reached 10,000 ft, the commander initiated the descent using FLCH while continuing the diversion. The crew had already discussed the possibility of unreliable airspeed and used the QRH to prepare an appropriate descent target. Nevertheless, the situation required them to descend even though icing was expected.
6. Then the Airspeed Became False
At approximately 12,000 ft the aircraft entered icing conditions. The speeds shown on all three airspeed indicators began to decrease and the aircraft began to pitch down. The handling pilot increased thrust slightly, but the indicated speed continued to decay. Recorded data showed that the autopilot remained engaged while pitot, TAT and related heat faults were active. IAS and groundspeed diverged significantly, consistent with pitot probe icing. The investigation concluded that all three pitot tubes had frozen during the descent. In a descent, ice blocking a pitot tube traps pressure and causes the airspeed indication to under-read.
7. The Autopilot Did Exactly What the Data Told It to Do
The aircraft was flying in FLCH mode, in which the autopilot controls pitch to achieve the selected airspeed or Mach number. As the indicated airspeed fell because of the iced pitot probes, the autopilot responded by increasing nose-down pitch in an attempt to regain the selected speed. The aircraft reached 7.6° nose-down and approximately 6,240 ft/min rate of descent. The crew received an IAS disagree indication and recalled that they were about to intervene. Before they did so, the aircraft descended through approximately 10,000 ft and exited the icing conditions. The pitot probes became free of ice, the indicated airspeed increased rapidly, and the autopilot responded by pitching the aircraft back up.
8. When the Pitot Probes Cleared, the Danger Changed Again
As the aircraft left the icing conditions, the captain's indicated airspeed suddenly increased from approximately 260 kt to 345 kt in four seconds. This was consistent with the blocked pitot probe becoming unblocked and restoring a more accurate pressure measurement. The autopilot reacted to the rapid increase in indicated airspeed by increasing pitch. The aircraft nevertheless experienced an overspeed, reaching a recorded peak of 383 KIAS. The crew subsequently declared MAYDAY and continued managing the remaining system failures and landing configuration issues before landing safely at Amsterdam Schiphol.
9. The Hidden Failure Was in the Water Protection
The investigation did not identify a single confirmed water path from the L1 door to the GCUs. Instead, it identified several weaknesses in the protection intended to keep water away from flight-critical electrical equipment. Areas of degraded or missing moisture barrier and polyurethane tape were found on the main deck above the E1 and E2 racks. The drip shield above the racks had compromised sealant at both ends, including above the locations of GCU 1 and GCU 4. The investigation also identified missing sealant at the L1 door mat and other conditions that could allow water to migrate below the cargo-deck floor.
10. A Complex Failure Without a Single Checklist
The crew were faced with multiple simultaneous failures that extended beyond the scope of a single normal checklist. There was no defined QRH procedure specifically covering the cumulative loss of AC Bus 1 and AC Bus 4. The crew therefore had to manage several concurrent procedures while also dealing with the developing pressurisation problem and the possibility of unreliable airspeed. The AAIB noted that such rare combinations of failures cannot necessarily be covered by a definitive checklist and that flight crew may have to use judgment and experience when several procedures interact. The crew used structured decision-making and had support from a third crew member.
11. The Chain of Failure Was Longer Than the Final Problem
The incident is a useful example of how a flight-critical event can develop through several apparently unrelated engineering layers. The sequence was not simply a pitot failure. It was an environmental exposure followed by water ingress, electrical protection action, loss of two AC buses, loss of pitot heating, icing, erroneous airspeed, and finally an automated flight-control response to incorrect data. Each individual step had a different engineering function. The hazard emerged from the interaction between them.