I wrote a complete explanation for Mashable–just click here for the full article.
I wrote a complete explanation for Mashable–just click here for the full article.
All the Wrong Answers to the GermanWings 9525 Crash Questions
As is always the case after an airline disaster, the media and shortly thereafter, regulators rush to propose a quick but ill-advised “fix.”
In this case, the proposed quick fix falls into one of two useless but unavoidable categories: technology and regulation.
In the first case, technology, the spectrum of bad ideas runs from remote control to cockpit access override. That reminds me of earlier, fun days flying a supersonic jet that began to accumulate pilot fatalities in low speed, low altitude ejections. The engineering fix was to install a drogue chute that deployed upon ejection to hasten the main parachute deployment. That worked fine until the first high speed, high altitude ejection when the drogue chute deployed at Mach 1 and the G forces cut the pilot in half.
Back to today, talk in this airline tragedy is of an even more bizarre solution: remote control “intervention:” taking over the aircraft flight controls from the ground. Beyond the fact that I as a thirty year airline pilot will not set foot in a cockpit that can be commandeered by remote control, consider the added layer of vulnerability: beyond two pilots who “could go rogue,” you’ve now introduced an entire spectrum of people, entities and hackers capable of taking over the jet. Better? Really?
Yes, some type of cockpit access intervention “might” have worked to restore this one pilot to his rightful place, while opening every cockpit henceforth to an outside “intervener” which defeats the necessary cockpit exclusion no one disputes is necessary: if one can, eventually all can. Better?
Then there’s the regulatory crowd, for whom the semi-annual FAA pilot physical, recurring spot checks, blood and urine alcohol and drug testing is not sufficient to validate a pilot’s fitness to fly. What’s next, a psych exam before brake release? A background check beyond the extensive background checks we all have already? A credit report before each instrument report?
Here’s the real problem: there are no quick solutions. Yet that’s what the public “demands”–for now, but only for now. The fact is, in Texas alone there have been 257 traffic deaths so far this year, yet no one’s calling for a twenty mile an hour speed limit or any other radical but certain solution. Yet the “1 in 11,000,000 chance” (Harvard 2006) of dying in a plane crash brings a public outcry for an immediate technological or regulatory intervention.
I watched Air Force One arrive once, the president bounding down the stairs and greeting the crowd as law enforcement snipers on rooftops looked on. No “remote control triggers,” no on-scene sharpshooter credit checks. Rather, the thinnest final line ever drawn: trust.
In the end, that’s what it comes down to anyway: trust in your flight crew. There’s no simple solution to the rare and tragic occurrence that just transpired over the French Alps. But there is real danger in half-baked solutions that just add more layers of vulnerability to what is already 11 million to 1 odds in an airline passenger’s favor.
Despite the media frenzy driving an out of scale public reaction, no “solution” is better than a hasty, ill-conceived technological or regulatory bandaid that increases the very danger that started the panic in the first place.
If you don’t trust me in the cockpit, fine: trust yourself on the road. Your odds there are astronomically worse, if that matters to you, but at least the flying public will remain safe.
Network news media love a screaming headline, even if they have to fudge the facts to suit the rhetoric. But here is the reality behind the wailing and gnashing of teeth regarding recent ice-related delays at major airports: the airlines did a damn good job given the challenges heaped on them in this storm.
As a captain, I flew a 737 trip in the middle of the week in the slush and snow out of DFW. Here is your chance to bypass the media frenzy (NBC News carefully crafted “9 hour delay for passengers”–quietly admitting later that it wasn’t on-board) and watch the flight evolve despite the weather interference.
At 06:10, a phone call from crew schedule woke me up. I had volunteered to fly a trip that day and they offered one, a turn to John Wayne Orange County (SNA) scheduled to depart at 10:10. I agreed to fly the trip.
Normally, it takes me 35 minutes to drive to DFW. I left my house at 6:45 to allow extra time for the slush and snow snarling the highways.
I arrived at DFW an hour later, an hour and twenty minutes early. The jet was parked at the gate, had been all night in the freezing precip, so I went aboard and started powering up systems. A quick check of the wings and fuselage confirmed what I assumed driving in: we’ll need a good de-icing on the wings, control surfaces and fuselage.
Let’s get more specific about aircraft icing. First, we need to remove the accumulated ice. Second, we need to prevent more ice from re-forming on aircraft surfaces. De-icing can be accomplished by a number of different fluids under pressure. “Anti-icing” is provided by a different, specifically designed fluid that chemically inhibits the adherence of ice on aircraft surfaces.
In our case, the ceiling was low and visibility limited by ice fog, confirming the critical temperature-dew point spread that leads to condensation which of course would freeze on any cold surface. That means both de-ice and anti-ice will be required.
Anti-ice fluid effectiveness varies with temperature, and rate and type of precipitation. The duration of anti-ice protection declines as various forms of moisture increase. So, gauging the time–called “holdover time”–is a call that must be made by the flight crew based on observation of conditions actually occurring.
You can tell when anti-ice fluid has been applied to a jet because it will be colored either brick red-ish or lime green. The intensity of the color cues the cockpit crew as to the fluids declining effectiveness–it fades as the fluid loses the ability to inhibit icing. We actually check visually that from inside the aircraft prior to takeoff.
A side note about the fluid color. Most airlines now use the green fluid because the red was difficult to distinguish from hydraulic fluid as it dripped from crevices and bays on the aircraft, sometimes several flights downline from the original de-icing treatment. I learned long ago how to differentiate the two: propylene glycol, the main ingredient in anti-icing fluid, smells and tastes sweet. Skydrol hydraulic fluid is bitter. Yes, I’ve tasted both in the thirty years (and counting) I’ve been flying jets and laugh if you want, but it saves all aboard a needless and probably lengthy maintenance delay.
Another unseen complication that adds to the icing mix is jet fuel. The worst case is with fuel remaining in wing tanks after a flight at high altitude. The fuel in the tanks become super cold due to the temperature at altitude (often -50C or less) and as a result, the wing surfaces both upper and lower are super-chilled, causing any moisture in the air to freeze on contact. Explain that to the guy sitting next to you griping as we de-ice on a sunny, clear day: humidity plus ice-cold metal surfaces can add up to wing icing that must be removed: we can tolerate no more than 1/8″ of mere frost on the underside of the wing only. Any other airfoil contamination must be removed before flight.
Clear ice on wings is not easy to see from the cabin, particularly the area near the wing root, which is critical on aircraft with tail mounted engines like the MD-80 and -717, because upon wing flex as rotation and liftoff occur, any wing root ice that breaks loose into the slipstream could easily fly back along the fuselage to be ingested by either or both engines, with potentially disastrous results.
So why don’t aircraft have heated wing surfaces? Actually, most MD-80 upper wing surfaces do have an electrically heated thermal blanket on top of the inboard-most portion of the wing surface. But, not the curved wing root joint which is not visible from the cabin. So, you’ll notice a lot of MD-80 aircraft having to de-ice in even the slightest icing conditions.
In our case, I knew the fuel pumped aboard for our flight would have the opposite effect. At DFW, the fuel is stored underground and pumped aboard from a hydrant, not a truck. The effect would be to warm, not freeze the wing surfaces. That would help with de-icing, but we’d still require a thorough dose of Type-2 de-icing fluid to clean ice off the jet.
By 9:10, the official crew check-in time, there was no sign of a first officer. I started the process of printing a flight release and agreeing on a fuel burn, as well as the complex process of determining takeoff speeds, made more complicated due to the presence of slush and snow on the runway. Any type of contamination, from pooled water to slush to ice can impede both acceleration and deceleration. Both maximums (takeoff and stopping) must be accurately calculated and while there is a published “runway condition,” the actual calculations are very much a realtime, eyeballs-verified assessment: I’ve broken through an undercast during an ice storm as we approached DFW only to find that just the first two-thirds of the runway had been cleared–a fact not noted on the official field report. That lopped off about four thousand feet of useable braking surface.
At 9:30, forty minutes prior to pushback, still no sign of a first officer. The roads are awful, as is the traffic, so I’m not surprised and I’m glad I left home as early as I did. I called Crew Tracking, catching them by surprise as well: in this winter storm, there were plenty of stuck, stranded or missing crewmembers. They hadn’t noticed.
I resigned myself to going out into the sleet to do the exterior inspection myself, planning to have all preflight duties complete in case the first officer should show up at the last minute. Here’s an up close look at the leading edge icing:
and the ice on the wing trailing edge:
Engine covers were installed, a very smart preventative measure to prevent icing, but which would require maintenance removal and documentation. I radioed maintenance to get in the cue for this required maintenance and fortunately, American Airlines had well-staffed maintenance for this shift. But again, they too had technicians who, like my F/O, were stuck in the ice storm snarled traffic, slowing things down.
With the exterior preflight complete, I requested the upload of navigation and performance data as well as our clearances. And I took a minute to call the Crew Scheduling Manager on Duty to suggest that they grab the deadheading 737 first officer sitting in row 20 and reassign him to fly the trip. He said if the duty legality limits worked, that’s what he’d do.
By 10:00, the conscripted first officer was in the right seat, having agreed to the reassignment: he’d fly the leg to the west coast, his home base, and rather than going home, he’d also fly the leg back to DFW and only then deadhead home, if possible. Just one more crewmember going the extra mile to make the flight operation work.
We pushed back nearly on time (10:21 vs. 10:10) , but the ramp was congested with ice and slush, slowing everyone down even further. The precip had stopped, the ceiling had lifted to a thousand feet and the temperature-dew point spread had widened, all of which meant less chance of ice formation. Our holdover time would expand, allowing us to de-ice on the ramp rather than at the end of the runway. Essentially, that made for a shorter wait for all aircraft: if there is freezing precip, or any precip in freezing temps, all de-icing would have to be done at the end of the runway, meaning long takeoff delays.
Taxiing a seventy-five ton tricycle on ice and slush is tricky, requiring slower speeds and a critical energy management: too slow and you’ll have to add excessive power to restart movement, slinging ice and slush at other aircraft. But you also need almost zero forward inertia to maintain nose gear traction in any turn, aided by asymmetric braking on the main gear into the turn. It’s a dicey operation that takes extra time.
We kept the flaps retracted on taxi-out so as to not accumulate any slush or freezing water on the underside of the flaps, a potential problem during flap retraction. Our miles-long taxi from the east side terminal to the west side runway gave us plenty of time to assess the surface conditions and fine-tune our power and speed plans.
We finally lifted off nearly fifty minutes after taxi-out. Through route shortcuts and favorable winds, we made up some of the lost time, arriving twenty-eight minutes behind schedule.
I believe my flight was more typical of all flights during an unrelenting ice storm, but mine isn’t the one craftily worded into a horror story by the media. Regardless, the fact is that icing makes flight operations complex, difficult and challenging. Yet more flight operated in the same way mine did–slow, careful, successful–than the media version of a few unfortunate cases. I take it as a compliment that the reality of these winter flights was a success story leaving the media very few flights to turn into their typically overblown horror stories.
By the time I got home nearly fourteen hours after voluntarily accepting the challenging flight assignment, the network news was already sensationalizing the “impossible” travel situation created by SnoMIGOD 2015 which dumped an unprecedented amount of snow and ice on DFW and Dallas Love Field. At least I knew the facts were not as they’d have us believe–and now you do too.
Travel smarter, with this insider air travel field manual and survival guide. Check it out on Amazon.com, or just click this link to order from Amazon.
The search continues for the Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR) from the lost Air Asia flight 8501 and as that process drags on, speculation about the cause of the crash abounds.
Multiple news media sources advance abstract theories based more on the wide-open field of “what could happen” rather than what’s likely, serving only to blur the line between fact and fiction.
I won’t speculate on what happened to QZ 8501 because until the DFDR and CVR are recovered, transcribed and the recovered data analyzed, any theory advanced is just more noise in the media clamor aimed mostly at ratings rather than facts.
But, I can speak to what concerns me as the pilot of a modern, 160 seat airliner flying often in the same circumstances encountered by the lost flight. My goal in learning what the flight’s recorders report is simple: I want to know how to avoid a similar outcome.
With that in mind, here are my concerns. First, the slim margin between high speed and low speed limits at high altitude and the liabilities of each. Second, the problems presented by convective activity in crowded airspace. Finally, recovery from any inflight upset at altitude that may be encountered as a result of any or all of the above factors.
Early in any flight, the aircraft’s weight is the highest, limiting the ability of the aircraft to climb into the thinner air at higher altitude. As the flight progresses and fuel is consumed, the aircraft grows lighter and climb capability increases. Generally speaking, later in flight there are more habitable altitudes available due to weight constraints easing.
But don’t think that climbing is the only option for weather avoidance. Often enough, a descent is needed to avoid the top part of a storm, the anvil-shaped blow-off containing ice, high winds and turbulence. Equally as often, lower altitudes may turn out to have a smoother ride.
The other major climb restriction along frequently used jet routes is converging traffic. Aircraft flying opposing directions must be separated by a thousand feet vertically, so if I want to climb to avoid weather, I have to nonetheless stay clear of oncoming traffic. The New York Post reported the incorrect statement that the air traffic controllers handling the Air Asia flight “made the fatal mistake” of denying the Air Asia’s pilot request for a higher altitude. The first job of air traffic control is to separate traffic, particularly converging nose to nose. Climbing through conflicted airspace–or granting clearance to do so–would more likely be a fatal mistake.
But there’s even more to the story: air traffic controllers respond to such requests in a more fluid fashion than the static “no” being implied by many media reports. In actual practice, for a climb or descent request, the denial would be more typically, “Unable climb, you have traffic on your nose,” or, “It’ll be 5 to 7 minutes before we can clear you higher,” or, “We can vector you off course so you can clear the airway and traffic and then climb,” or, “Unable in this sector, check with the next controller.” Regardless, there are other options to avoid weather.
If changing altitude is not an immediate option, lateral deviation is the next choice. But the same obstacles–weather and traffic–may limit that option as well.
So now, if vertical and lateral deviation isn’t immediately available, you must do your best to pick your way through the weather with radar, if possible, until one of those options comes available (again, at ATC denial isn’t final or permanent) or you’re clear of the weather.
Which brings us back to the margin between high and low speed limit. This is even more critical in convective weather, because turbulence can instantaneously bump your airspeed past either limit if there’s not enough leeway to either side of your cruise Mach.
The picture below shows a normal airspeed spread in cruise. Notice the speed tape on the left with the red and white stripe above and the yellow line below the airspeed number box. The hash marks represent 10 knots of airspeed. The red and black marker above the speed readout is called the chain, and it depicts the maximum speed limit for weight and altitude. The yellow line below the numbers is called the hook, and it marks the minimum speed required to keep flying.
Turbulence, or more accurately, high altitude windshear, can bump you past either limit, or both, if there’s less than say, ten knots of slack, because moderate turbulence can cause swings closer to twenty knots; severe turbulence even more. Essentially, turbulence can instantly bump an aircraft out of its flight envelope.
In that case, the aircraft can depart controlled flight in a couple of different ways. The one that concerns me most is on the high end: if turbulence or any other factor pitched the nose down and the airspeed then climbed above the chain, the worst case is a phenomenon rarely discussed outside of the jet pilot community called “Mach tuck” that affects swept wing aircraft. Essentially, if you don’t immediately apply the proper corrective input, in a matter of seconds, recovery is beyond all means from the cockpit.
On the low speed side, if the wing stalls due to an airspeed below the hook, recovery is possible once the airspeed is regained. That takes altitude to regain, but normally can be done if a stall occurs at cruise altitude. But even that requires recognition and then the proper corrective control inputs, and Air France Flight 477 with three pilots in the cockpit entered a stall at cruise altitude but never identified the problem or applied the proper recovery inputs, resulting in a crash into the Atlantic that killed all aboard.
Bottom line: you need a wider spread between high and low speed limits in case of turbulence. If you can’t avoid turbulence and need to change altitude, you must assure a wide airspeed margin between limits to avoid being pushed by turbulence beyond either speed constraint. Here’s what the airspeed range looks like at high altitude:
There’s very little tolerance for turbulence and any associated airspeed fluctuation.
In the worst case scenario, if the aircraft is pushed beyond its flight envelope to the extent that controlled flight is departed, a pilot must quickly and accurately recognize which situation is at hand, high or low speed buffet, then immediately apply the correct control input.
Problem is, they may initially look the same, and the correct remedy for one applied to the other severely worsens the situation. Specifically, if the aircraft begins a descent at a speed beyond the chain, the corrective action would be to deploy speed brakes, pull throttles to idle, apply back pressure to raise the nose, and I’d be ready to even lower the gear to add drag, even knowing that would likely result in gear doors being ripped off the aircraft.
If this recovery is not done early in the pitchdown, the result will be a dive with no chance of recovery.
If a low speed stall is encountered, the proper corrective action would be to add power and lower the nose until flying speed was recovered. But, if the high speed departure–also a pitch down and descent–was mistakenly interpreted to be a slow speed stall, applying the slow speed recovery to a high speed departure would be fatal.
The other way? If you mistakenly added drag and pulled back power in a slow speed stall? That would prolong the stall, but if the correct control input was eventually applied, the aircraft could recover, altitude permitting.
Adding the factors that make this vital task of discrimination difficult would be any associated systems failure and the physical effects of turbulence that can make instruments nearly impossible to read.
In any pitch down, if rapid and deep enough, can cause electrical failure due to generators failing at negative G-loads associated with the pitch down. Yes, back up controls and instruments exist, but recognizing the situation, taking corrective action and reading backup instruments also takes time and attention.
Pitot-static failure, one of the contributing causes in the Air France slow speed stall, can also be difficult to recognize in turbulence or in an electrical failure.
Regardless, the high speed situation must be correctly identified and recovery initiated in a matter of seconds. Both situations would be difficult to diagnose and both recoveries would be very challenging to perform in turbulence and with any other systems failure or complication. Both recoveries are time-sensitive and if not managed correctly, one recovery could induce the other stall. That is, too much drag and power reduction carried beyond the return from the high speed exceedence can induce a low speed stall, and too much nose down pitch and excess power from a slow speed recovery could push you through the high speed limit.
So here are my questions, which are those that will be asked by The QZ8501 accident investigation board. First what did the aircraft weigh and what was the speed margin at their cruise altitude and at the altitude they had requested? What type turbulence did they encounter and what speed and altitude excursions, if any, resulted? What collateral malfunctions, if any did they encounter? And finally, what departure from controlled flight, if any, occurred, and what remedial action, if any, was attempted?
These questions can only be answered by the DFDR and CVR and my interest–and that of every airline pilot–is mostly this: I want to know what exactly happened so as to be prepared in case I encounter the situation myself, and I want to know what they did in order to know what exactly I should or shouldn’t do.
Like pilots at all major US airlines, I get annual simulator training in exactly these scenarios, hands-on practice recovering from stalls and uncontrolled flight. Is that enough? Can we do that better?
Once the facts contained in the flight’s recorder are extracted and analyzed, we’ll have the answers to all of these questions, which will help us prevent a repeat of this disaster. Beyond that, speculation is just a sad, pointless part of unfortunate ratings-hungry media circus.
“That’s some catch, that Catch-22.” –Captain Yossarian, Catch-22
Here’s the deal, captain: you’re flying a 65 ton jet into Orange County airport, the famously short 5,700 foot runway. The stopping distance required there is increased drastically if that runway is wet–and yesterday, “wet” was an understatement: Los Angeles was drenched in a ten-year storm dumping inches of rain in a matter of hours.
And here’s the catch: you want to have the least amount of fuel–which is weight–on board for landing to permit stopping on the short, rain-slicked runway, but at the same time, as much as possible for a divert if necessary to Los Angeles International Airport or to Ontario Airport, both of which have long runways.
But it gets worse. The best bet for a diversion is Ontario, because the inbound air traffic is light compared to always busy LAX. But you’ve been watching on radar two thunderstorms sitting exactly on the top of Ontario, hardly moving. LAX is reporting heavy rain which means inbound delays and you know from experience that the inbound LAX air traffic flow includes many long-haul flights from Asia, Europe and points beyond. You don’t want to elbow into their already depleted fuel reserves.
Here’s your set of decisions: who will fly the approach at SNA? It must be done perfectly, given the conditions, which are reported as 1 1/2 mile visibility in fog and heavy rain, with 200 foot ceiling. The touchdown must be exactly on the right spot–neither too early nor too late–and exactly on speed, if we’re to stop on the remaining runway.
What is your plan: SNA, and then what? No holding fuel–on a missed approach, you can either try again, or divert to Ontario (thunderstorm overhead) or LAX.
You already know landing in a thunderstorm at Ontario is a poor choice. And you know, realistically, you don’t have the fuel to handle the air miles entry into the LAX landing sequence will require. A second try? Not even.
Here’s what I chose on each question. First, I had the F/O fly the approach. Why, when it had to be done exactly perfectly under bad conditions? The answer is, because he damn well knows how to fly an ILS, in any circumstances. If he flies the approach, fully investing in the stick-and-rudder attention demands which are large, I can focus on the big picture: what’s the Ontario storm doing? Watching LAX too on radar. Updating SNA winds, our fuel, our position.
Above ten thousand feet, we talk. I tell him what I’m thinking, then ask: what am I missing? Tell me your ideas? And as importantly, are you okay flying the approach? Because a bad night of sleep, a sore shoulder, anything–if you’re not up to this, I’ll do it.
And we have one shot, I tell him, then I’m putting clearance on request (actually did that as soon as we were switched to tower frequency) to Ontario. If the storm looks impassable on radar, option 3 is declare an emergency for fuel and barge into the LAX landing sequence. Don’t like that idea, but if we’re down to option 3, there is no other choice.
I also plot the magic number for SNA winds: 110 degrees and 290 degrees. For the precision landing runway, any wind beyond those two cardinal points strays into the verboten tailwind area. Asked about landing the other direction and the answer was: long delay. Not possible, for us.
Already requested and had the data linked chart for our landing weight sent up to the aircraft: we require 5,671 feet on a wet runway, good braking, zero tailwind. Each knot of tailwind adds 150 to the distance required, so even one knot of tailwind exceeds the runway length.
I switch my nav display from a compass arc to a rose: the full 360 display. I’m getting wind checks all the way down final and watching my cardinal points, alert for an excedence.
There’s a wind display on my HUD, too, but I realize that’s a calculation that is at least 15 seconds old. Eyeballs and experience tell the tale: he’s glued mostly to his instruments to fly a flawless ILS, but I’m mostly eyeballs-outside, monitoring speed, azimuth and glide path through the HUD, but paying attention to the realtime wind cues. He knows if I don’t like what I see, I’ll say, “Go-around” and we will be on to option 2 immediately. I know that if he doesn’t like the way the approach is going, he’ll announce and fly the go-around without any questions from me.
I tell him that if everything is stable on approach, let’s make a final wind analysis at 200 feet. If we’re both satisfied, silence means we’re both committed to landing.
I review in my head the rejected landing procedure. That is, if we touch down but I judge we can’t stop, throttle max, speed brakes stowed, flaps fifteen, forward trim, back into the air.
Clear your mind, focus on the plan: hate math, but I can sure see the compass depiction that means a verboten tailwind. Poor viz in heavy rain, but once I spot the VASIs, I can tell what the wind is doing to us. He’s flying a hell of a good approach. One final wind check at 200 feet. “That’s within limits,” I say, just to let him know that component is fine. He’s flying–if it doesn’t feel right, I want him to feel free to go-around immediately.
I don’t want to see high or low on either glide path or speed. No worries–he’s nailed it, both are stable.
A firm touchdown, then my feelers are up for hydroplaning: none. Speedbrakes deploy, but we’re not committed until reverse thrust. The MAX brakes grab hold, good traction; we’re fine, reverse thrust, I take over at 100 knots.
Silence in the cockpit. “Excellent job,” I say as we clear the runway, glad we didn’t have to execute either backup plan. Relief, Boeing has built us a damn fine, stable jet for this weather, this day, this runway.
Now, put that all behind–we still have to fly out of here in less than an hour. And do it all again tomorrow.