On the 29th of November 2013, Mozambique Airline flight 470 was flown directly into the ground by a pilot, believed to be the Captain, who was alone in the cockpit.

As the fatal accident took place in the Republic of Namibia, their Directorate of Aircraft Accident Investigation (DAAI) were in charge of the investigation. They invited the following countries to take part.

Mozambique: state of registry and operator

Brazil: state of manufacturer and design

Botswana: state controlling the accident aircraft

Angola: state of final destination

USA: manufacturer of the power plant

All five countries sent accredited representatives and advisors to support the investigation. The final report was released last week.

The aircraft was an Embraer ERJ 190-100 IGW aircraft, a narrow-body medium-range twin-engine jet, registration C9-EMC.

It departed Maputo International Airport in Mozambique at 09:26 UTC carrying six crew members (two pilots, one engineer and three cabin crew) and 27 passengers.

The weather was fine, the aircraft was in good shape, in fact it had just undergone an inspection. The Mozambique flight crew discussed politics and social activities for the first hour and fifty minutes of the flight. The Captain held an Airline Transport Pilot Licence with no restriction. The first officer held a Commercial Pilot Licence. The conversation was cordial and there was no sign of any deviance from standard procedures during the initial flight.

The flight proceeded normally, cruising at Flight Level 380 (38,000 feet) through the Gaborone flight information region (FIR).

Gaborone is the capital and largest city of Botswana. The flight was in contact with Gaborone Area Control Centre and cleared to maintain Flight Level 380 with a request to report at waypoint AGRAM. Waypoint AGRAM marks the boundary between Gaborone flight information region and Luanda flight information region. Upon reaching this waypoint, the flight crew would be expected to report and then would be advised to change frequencies to speak to Luanda Area Control Centre. The flight crew acknowledged the request.

At 10:19 ATC requested the estimated time to waypoint AGRAM and the aircraft registration. Mozambique 470 responded with the estimation and registration.

The Gaborone flight information region has a mandatory reporting point at waypoint EXEDU. The EXEDU waypoint is 72 nautical miles south of waypoint AGRAM.

At 11:09, the aircraft reached waypoint EXEDU and suddenly began a steep descent.

The flight crew never spoke on the radio and there were no distress calls, nor was the transponder set to flag an emergency.

The controller was dealing with conflicting traffic on radar and did not notice that Mozambique 470 had begun an unexpected rapid descent. Botswana Radar did not have any visual or aural alerts to signal that the aircraft had deviated from its planned route.

As a result, it was almost ten minutes (11:17) before Gaborone ATC next contacted the aircraft, saying “Mozambique 470, you can continue with Luanda 8888, 5565. Good day.” There was no reply. He called the aircraft again but received no response.

The controller phoned Luanda Air Traffic Control. “Luanda, Gabs. Just advise if you are in contact with Mozambique 470. He’s not talking to me, are you in contact there?” Luanda’s response was inaudible. The Gaborone controller believed that Luanda would be in touch once they heard from Mozambique 470.

The next communication was almost two hours later, at 13:05, when Luanda Area Control Centre contacted Gaborone to say that they still had no contact with the aircraft.

Later, the radar returns showed that the aircraft disappeared from radar at 11:14, with the last radar return showing it at 6,600 feet above mean sea level.

A minute later, the aircraft crashed into the ground and the flight data recorder stopped. The Emergency Locator Transmitter never sounded as its antenna cable was severed in the crash. No one knew where the aircraft was or what had happened.

Villages in Botswana near the border reported that they had heard explosions and observed smoke coming from Namibian territory. Namibia Air Traffic services initiated a search and rescue operation but in the dark, with the weather bad, they were unable to find any sign of the wreckage.

The next day the wreckage was discovered in Bwabwata National Park in Namibia, a remote savanna.

The site was far from any settlement and only accessible with all-terrain vehicles. The bodies of the crash victims were “fragmented,” showing the force of the impact. The wreckage was destroyed by a post-impact fire which was out by the time the site was reached.

Once the remains of the pilots were identified, they were tested for drugs, alcohol and toxins. Nothing was found.

The Namibian investigators recovered the flight data recorder and the cockpit voice recorder. What they discovered was disturbing.

The flight data recorder showed that the Embraer ERJ was flying normally and there was no sign of any flight / mechanical issues.

The first officer said that he had to go to the toilet and asked the captain if he had the controls. “No problem,” was the captain’s response. Then there are the sounds of a door opening and closing. Then there’s the sound of it locking.

Mozambique Airlines Manual of Flight Operation is quite clear on the procedure for Absence from the Flight Deck:

A pilot can only leave the Flight Deck when the aircraft is above 10 000 feet, for physiological reason or when carrying out his operational task. He or she shall, for that matter, first call a cabin attendant who will remain in the Flight Deck until his return. At the moment of the pilot’s exit, the other (pilot) shall lock the door, to only re-open it for the return of the absent pilot.

The aircraft was cruising at 38,000 feet so the first criterion was met but there was no mention of bringing cabin crew into the cockpit during the first officer’s absence.

After the first officer left the cockpit, the aircraft flight altitude was changed from FL380 (38,000 feet) to 4,288 feet. The click sounds picked up by the Cockpit Voice Recorder were determined to be the sound of the altitude preselect rotary knob: that is, the change in selected flight altitude was done manually and with intent.

Then the flight altitude selection was manually adjusted again, this time down to 1,888 feet. In the background there were sounds of someone trying to open the door. The third adjustment took the required flight altitude down to 592 feet.

The local elevation of the area that the aircraft was overflying was 3,600 feet above mean sea level.

The CVR recorded the sound of knocking on the door which slowly became louder and more stringent. An automated voice repeating HIGH SPEED, HIGH SPEED, HIGH SPEED sounded but not a human word was spoken.

The speed was set to 309 knots (572 km/hour, 355 miles per hour). The aircraft actually travelled much faster because of the high rate of descent. A normal descent is around 2,000-2,500 feet per minute. At it’s peak speed, the aircraft was descending at 10,158 feet per minute.

The speed brakes were deployed, which may have been done to achieve the highest possible rate of descent, perhaps to counter the speed protection. The autopilot was engaged throughout and it would attempt to level the aircraft once the aircraft reached Vmo (overspeed). The angle of attack was normal and the throttles were set to flight idle.

All of this means that the person in the cockpit had clear knowledge of the aircraft and its systems. As the various warnings sounded, the aircraft’s descent could have been successfully arrested and recovered. There was nothing that showed of any attempt to recover; the actions in the cockpit appeared to be focused on increasing the descent of the aircraft as much as possible.

The Enhanced Ground Proximity Warning System (EGWPS) sounded with an aural warning: SINK RATE, SINK RATE, SINK RATE. PULL UP! PULL UP! PULL UP! PULL UP!

And then the Embraer 190 crashed into the ground, killing every one on board in the impact.

There was no fault which could have caused the crash and the actions in the cockpit show that someone flew the aircraft deliberately into the ground. It is impossible to know for sure who was in the cockpit but there was never the sound of a struggle or of an additional person. All the passengers were correctly checked in and scanned: there’s no sign of an unexpected person on board. We know the flight crew were in the cockpit together and then one said he needed the toilet. The sounds are that of someone leaving cockpit and having the door locked behind him. It seems pretty clear but I think it is worth considering that we don’t actually know who was in the cockpit, we can only extrapolate it.

Of course, the investigators looked into the details of the flight crew. They confirmed that both were well-rested and well within their duty times. They also discovered that the captain’s son had been killed in a car accident on the 21st of November 2012, one year and a week before the crash. The car accident was a suspected suicide. The captain had not attended his son’s funeral. In addition, they found that he was struggling with the process of divorcing his wife, which had still not been finalised after ten years separation, and that his youngest daughter had gone through heart surgery in South Africa recently. These are all stressful events; however they don’t appear to have investigated further as to whether the pilot was seeking medical attention or other healthcare.

From the official report:

Probable Cause

The inputs to the auto flight systems by the person believed to be the Captain, who remained alone on the flight deck when the person believed to be the co-pilot requested to go to the lavatory, caused the aircraft to depart from cruise flight to a sustained controlled descent and subsequent collision with the terrain. Contributing factor

The non-compliance to company procedures that resulted in a sole crew member occupying the flight compartment.

It’s impossible not to compare this to Germanwings 9525, in which a steady descent and a selected altitude below ground level was set up by a member of the flight crew. The main reason for the similarities, I believe, is that in both instances the pilots knew they had plenty of time to accomplish their plan, as a result of the locked cockpit door. The Directorate of Aircraft Accident recommends that the ICAO should set up a working group to look at operation and threat management emanating from both sides of the cockpit door, with a view to establish safety recommendations to prevent authorised crew members from being locked out of the cockpit. This strikes me as the most important recommendation of the set.

In addition, they recommend that the ICAO should review the installation of visual recordings inside and outside the cockpit as well as to expedite the implementation of global tracking of airline flights. There’s nothing wrong with either of these recommendations but neither of which would have had any effect on this accident.

Finally, they recommend that the Mozambique CAA should find a way to ensure that there are two people on the flight deck at any time, which seems insanely optimistic at best.

Unfortunately, the accident report leaves it at that. Unlike the Germanwings investigation, there did not seem to be any effort put into how we could better support pilots, especially when it comes to mental health issues which put the aircraft crew and passengers at risk. One unverified source claims that the pilot had asked to be relieved of flying duties that day and was denied. An attempt to discover whether he had made this request and whether he was in a position to disclose mental health concerns without fear of losing his job would have been the very least that I would expect from a two-year investigation and report.

A commercial pilot putting his passengers at risk is of course not a common occurrence. Flight crew should not be treated as a threat to commercial flight and I think it is important that the aviation industry avoids responses that involve protecting the cockpit from its pilots. However, it is disappointing that the report did not even attempt to analyse the issue or explore what might have been done to mitigate the risk.