You are browsing category: Accidents and Incidents
10 April 2015

Glider breaks up, pilot lands on hospital

I’m feeling that I’d like a happy ending and this accident certainly fits the bill. It’s an amazing incident which ended well for everyone …well, except for the glider.

It happened last Sunday in Reno. Not everything that happens in Reno stays in Reno, apparently.

At around 07:30 local time that morning, a pilot departed Minden-Tahoe airport in a Schleicher ASW-27 glider. The ASW is a 15-metre-class German-built sailplane; the W means that it was developed by the designer Gerhard Waibel. It has a maximum speed of 285 km/h (178mph).

That day the weather was reportedly somewhat variable but a number of gliders departed from Minden that day and had uneventful flights.

I don’t know a lot about gliding but Japlopnik reports that the Reno area is “a kind of Mecca for glider pilots”.

Its unique location nestled at the foothills of the Sierra Nevada mountains creates the ideal location for flying a mountain wave. This oscillating wind creates a massive updraft on the lee side of the ridge, allowing powerless aircraft and their crew the opportunity to fly to extreme altitudes and record breaking distances.

While this mountain wave weather phenomenon requires stable air by definition, there are several hazards associated while flying in the wave. That’s the reason pilots always wear a parachute in the event that the aircraft breaks apart.

The pilot had had a full morning’s gliding and was returning to Minden when he encountered severe winds.

He was at around 14,000 feet and experiencing turbulence while the weather was closing in. He attempted to fly between two large clouds. The gap filled in quickly and he found himself in instrument meteorological conditions: in cloud with no visual reference.

The turbulence was severe. He said that he felt the glider stall and then it began to descend rapidly. The airspeed increased very quickly. Then he remembers hearing two loud pops.

At about 9,000 feet, the glider came out of the clouds and the pilot saw that he was in a spin. He attempted to recover. Then he realised that his left wing was missing. Out of options, he disconnected from the glider with his parachute.

Both of the wings had sheared off in the severe wind and turbulence. It is not clear if the glider exceeded its maximum turbulence penetration or if the wings were maybe fatigued leading to structural damage.

The pilot came down near Circus Circus just before 14:30 local time. It was a hard landing but he couldn’t be more perfectly placed. He landed on the five-story parking structure of St. Mary’s Hospital and was treated on the scene.

The fuselage landed in a nearby alley and caused some damage to parked cars. The left wing was found in Dick Taylor Park, about 2½ kilometres (1½ miles) from the hospital. The right wing has not yet been located.

The initial reports stated that the glider “experienced a malfunction over Reno”, which is an interesting way to describe breaking up in mid-flight.

Reno Police Department reported that the pilot suffered only minor injuries from the hard landing.

The pilot spoke to Reno local news channel 2:

I was going around the clouds and the clouds closed in on me and when you are in a cloud, you can’t tell if you are rightside up or upside down and I ended up upside down and I got going so fast, the wings came off.

It broke both wings off and I had to get rid of the canopy and bail out.

Reno Flying Service President John Burruel spoke to local news channel 4:

Sometimes there is something wrong that you don’t know about with the airplane, some fatigue or stress, metal fatigue is a common thing that you hear about and if you don’t know about that, and you’re staying perfectly within the limits of the airplane, you could still have instances like yesterday.

Because you’re not inspecting as frequently as a commercial airplane is being inspected, it’s possible you don’t know about that fatigue.

So here’s the story: the pilot survived entering cloud and going into a spin leading to the glider breaking up with only minor injuries which were treated at the hospital he near as damnit landed on.

Hard to get better than that.

03 April 2015

Questions and Answers on the Tragedy of Germanwings 9252

So I went out of town last week without saying anything, which is why you had sudden silence from me as the scale of this tragedy unfolded. I spoke to a few journalists but was not in a position to write an article for you until today. That means I get the benefit of over a week of investigation news and it’s also already clear what aspects of this, after the initial how could he? are causing the most confusion. So to make up for my absence, I’ve put together a set of questions and answers that I hope might be helpful in deciphering the reporting from the mainstream press.

What if the First Officer took ill? Why is everyone saying he did this deliberately? They can’t possibly know that!

Yes, actually, we do have enough evidence that criminal proceedings against him are in progress.

I can tell you one hundred percent: a pilot slumped over in the cockpit could not put the aircraft into a descent. The Airbus has a joystick at the side, not a control column in front.

The aircraft was configured by a human directly after the Captain left the cockpit. The First Officer chose to start a descent in what could only have been a deliberate action.

The Captain should have been able to access the cockpit using the keypad, as below, but he was locked out.

Finally, the Flight Data Recorder shows that the First Officer repeatedly accelerated the plane’s descent. He did not make a mistake: he was flying the aircraft into the mountains.

This was not the responses of a panicked man but quite clearly a decision taken to crash the aircraft.

How do investigators know that the First Officer locked the Captain out?

Normally, if one pilot leaves the cockpit, the other pilot simply lets him in upon his return. In the Airbus 320, there is a keypad by the door to allow access to crew as the door automatically locks.

The Chief Executive of Lufthansa stated that the Captain had the code to the keypad and that he would not have forgotten it. Even if he had, the other crew members also knew the code and could have let the Captain in.

However, to ensure security and that the key code can’t be forced off a crew member by a terrorist, there is a “lock” switch in the cockpit. The Lufthansa executive confirmed that, as set up for their aircraft, this would disable the keypad for five minutes. If the First Officer used this “lock” to ensure the Captain couldn’t get in, he probably overrode the keypad repeatedly, as the descent lasted for eight minutes, enough time for the Captain to get in again.

Why does the Captain not simply carry a key? How can it be possible to lock the Captain out?

The security in place is strictly to protect the cockpit from hijack. The Captain could be attacked in the cabin and the key taken off him, or he could be forced to relinquish the code. The locked door is a response to a threat from the passengers, not a threat from the flight crew. Thus, it makes sense that the control is inside the cockpit, to stop a forced entry.

The entire concept of protecting an aircraft from the flight crew is pretty crazy and not something that should ever be needed. Realistically, if pilots decide to crash the plane and kill everyone on board, it really isn’t that easy to stop them.

Regardless, surely we have to stop this ever happening again?

I’d like to refer you to an old post of mine: Fear of Landing – JetBlue Captain Break Down

Three years ago, the captain of a JetBlue flight began to act very oddly, rambling to his first officer about evaluations, religion and stated that they were not going to Vegas. The first officer became concerned when his captain said that “things just don’t matter”. The captain told the air traffic controllers to be quiet and turned off all the radios.

The First Officer invited another, off-duty pilot to join them and when the captain left the cockpit to use the toilet, the first officer locked him out and changed the security code. Passengers were able to subdue the screaming captain and restrain him until the aircraft landed safely.

So there’s the core of the problem: we can’t have a system in place that protects the cockpit from hijackers, saves the passengers from their captain on JetBlue flight 191 and also would have saved the passengers from the first officer on Germanwings flight 9525. There’s no way to protect against every possible scenario.

We just can’t make it one hundred percent risk free, however much we’d like to save every soul.

Why didn’t they already have a rule that you need two in the cockpit?

Some airlines already had this rule and last week, many or even most airlines decided to implement this as standard.

Personally, I’m not impressed with all these airlines jumping on the bandwagon to change these rules. I think all we’ve done is add a new point of vulnerability. Flight attendants do not receive the same amount of mental health checks as pilots and with this rule, we are increasing access to the cockpit rather than reducing it.

Previously, if you decided that you wanted to take control of the aircraft and crash it, you would first have to become a pilot and get a job as the flight crew. Now, all you have to do is get a job as a flight attendant.

In addition, the moment of transition, when one person is trying to get out while the other person is trying to get in, is a vulnerable time in the Boeing 737 and other smaller aircraft. The door must be held open for one person to exit so that the other can enter. From a hijack point of view, it opens a window of opportunity on every flight.

There are also regional flights with three-man crews: two pilots and a single flight attendant to cover the cabin. Is the cabin to be abandoned in order for the flight attendant to stand uncomfortably in the cockpit?

It is possible that the First Officer would never attempted this awful plan if someone had stayed with him. It’s possible that the cabin crew member would have fought the First Officer for control when he disabled the keypad to deny the captain entrance. But I remain unconvinced by the wisdom of this attempt to reduce the likelihood of what is an incredibly rare event.

Why have they spent so much time and money on the recovery of the Flight Data Recorder after the Cockpit Voice Recorder made it clear that the crash was intentional?

Because it would clearly either corroborate the existing evidence that the First Officer deliberately flew the aircraft into the ground or give us new data to explain what happened.

As it happens, the data shows that the first officer repeatedly increased the rate of descent, confirming that this was a deliberate action.

Shouldn’t we have video in the cockpit too?

Straight up: in my opinion, the main reason to add a video feed would be to sate morbid curiosity. Right now, we have the cockpit voice recorder and the flight data recorder which store information about the flight and attempts to ensure that we have enough data to recreate an accident and understand why it went wrong. It may not be possible for you and me to recreate the actions in the cockpit based on soft sounds, but that’s exactly what the analysis of the CVR is. These on-board recorders are put through surviveability testing including:

  • Crash Impact Test — 3400gs for 6.5 ms would be required to meet most accident scenarios. This test is actually performed with a cannon. A Fairchild CVR has survived a crash that was estimated to be more than 6000 gs.
  • Static Crush — In this test, 5,000-pound pressure is applied against all six axis points.
  • Pierce Test — A pierce test employs a 500-lb. weight dropped from 10 feet. It has been modified to be performed with a hardened steel pin.
  • Fire Test — The devices are subjected to 1100 degrees Centigrade for 60 minutes, then undergo 10 hours at 260 degrees Centigrade.

Any further recording devices would have to go through the same testing and be placed securely so as to have a useful view of the cockpit and yet not be dislodged by turbulence or really anything other than a full impact. And then, we have very little new information that couldn’t be recovered / recreated from the existing recorders.

Having a video of this would be a journalist’s dream but it is unlikely that investigators would receive enough new data to make it worth it.

How did a deranged pilot get control of a commercial airplane? How could the Airline not have known?

It’s not all that easy to determine if a person is going to go off the rails. If we banned everyone with any mental issue from flying, then it would be close to impossible to source enough pilots to cover current flights, let alone industry growth. In addition, although reporting is encouraged, it can be very frightening for a pilot to admit to issues like depression or alcoholism which could mean losing her job or her licence.

The New Yorker puts this into perspective with lots of good references.

Andreas Lubitz, Psychiatry, and the Germanwings Disaster – The New Yorker

But as any mental-health professional will tell you (and as many did in the wake of the crash), nearly one in three Americans meets the criteria for a mental-disorder diagnosis in any year, and more than half of us will qualify at some point in our lives. Once diagnosed, people with mental illnesses, even severe psychotic disorders like schizophrenia, do not commit violent crimes at higher rates than the rest of the population. And most people who have had suicidal thoughts do not go on to kill themselves, let alone a planeload of strangers. More intense psychological scrutiny coupled with the possibility of getting fired, as the head of an organization of German flight attendants warned, could easily backfire. “I would warn against making the crew into completely transparent people,” he said. “That would just mean that someone would not go to a doctor.”

But then how do we protect against pilots with mental disorders?

One thing that would undoubtably help is a long-term disability program. A user on the Professional Pilots Rumour Network posts about how this worked at American West.

Airbus A320 crashed in Southern France – Page 143 – PPRuNe Forums

We had pilots with a wide variety of issues from substance abuse to heart conditions able to go out on medical leave at 60% of their income. Long term disability kicked in 3 months after the initial short term period. There was no sick leave used in the process, if you had a condition that kept you out longer than 3 months you were placed in the program. Some guys never did get their medical back, they were able to stay on disability until social security retirement age. It was an industry leading benefit, one we fought hard to retain. I know for a fact that guys that may have hid an issue were proactive in getting help becaiuse of this program. I worked on the Aeromedical committee for ALPA when we had that union on the property.

Unfortunately we have lost that benefit in the merger with American. I personally think that this is short sighted on the part of the present union, APA, and the company. Guys that don’t have sick bank, which is about 40 percent of the combined pilot group, will not have the money coming in if they have a significant issue. That is disincentive to getting help. We should encourage proactive health fitness, not hinder it.

We self certify our fitness to fly every leg, it’s an ACARS entry we make before each flight. The burden is on the pilot to be honest and truthful. The system cannot operate any other way, it is too burdensome to check every pilot every leg. And it would be stupid to do so. This is not a common problem. 99.9 % of us just do our jobs safely and quietly every day. We have a bigger threat from weather and fatigue than we do from mental instability.

Will this accident bankrupt Lufthansa?

Airlines have insurance specifically to protect them in the case of liability for accidents. In this case, there are over 30 insurers led by Allianz.

Allianz pencils in $300 mln cost for Germanwings crash – sources | Reuters

The initial estimate represents about 20 percent of the $1.5 billion in premiums in the global market for airline insurance. The estimate includes the loss of the aircraft, which is seen at about $6.5 million, the recovery efforts, legal fees and indemnification of the passengers’ families.

Why are there so many plane crashes suddenly?

There aren’t. Honestly, there really aren’t more crashes happening now and air travel isn’t suddenly unsafe. Ever since Malaysia Airlines flight 370 disappeared, we’ve had incredible news coverage of crashes that wouldn’t have had much more than a mention in newspapers in previous years. It’s a hot subject, it gets viewers, and it fills news hours. People are incredibly interested — certainly I have become much more popular at parties in the past year!

One of the whole points of doing the Why Planes Crash series was that I wanted to offer a wide spread of accidents around the world, which I knew most people would never have heard of. The fact is, I may well decide to stop the series at 2014 as public knowledge about air accidents massively increased.

It’s hard to believe watching the news, but air travel became safer in 2014. Despite what the opinion columns would have you believe, Asian airline carriers improved their safety record in 2014, which is largely invisible because Asian accidents are being covered which never were before.

How can you say that flying is safe after all this?

Public transportation is generally safe. However, the public (by which I mean all of us) is extremely interested in crashes and pretty much disinterested in flights where nothing happens.

The International Air Transport Association released their IATA – 2014 Safety Performance report for commercial aviation last month.

2014 had the lowest accident rate in history, the equivalent of one accident for every 4.4 million flights. There were 12 fatal accidents with 641 fatalities out of a total of 38 million flights.

The fatalities in 2014 is high, to be sure but 537 of those were from the two Boeing 777 accidents suffered by Malaysia Airlines, which really swings the stats.

IATA says that more than 3.3 billion people flew safely on 38 million flights (30.6 million by jet, 7.4 million by turboprop). So out of 3.3 billion journeys, 641 were fatal. That doesn’t make the loss of those lives any less tragic but it really does put into perspective.

The average per year over the five year period of 2009-2013 was 19 fatal accidents and 517 fatalities…but we’ve never seen anything like the current news coverage before, which makes it feel like aircraft are dropping out of the sky.

Aviation safety performance improved in 2014 in every region in the world (compared to the respective five-year rate 2009-2013). So flying today is safer than it ever was. Only the media coverage has changed.

So what should we do?

Right now, the focus has to be on this particular accident and how it happened. We should not, however, rush to make half-cocked changes based on partial information and we must avoid opening air travel up to new risks in a rush to protect from this specific situation.

Investigators will look for systemic weaknesses which could have led to this and consider what could be done to minimise the risk of similar situations. The French investigative body (BEA) has already said that, “the Safety Investigation will be oriented towards the cockpit door locking system logic and cockpit access and exit procedures, as well as the criteria and procedures applied to detect specific psychological profiles.”

Armed with this information, we can look at getting real results in an industry that is already one of the safest.

20 March 2015

Lightning Strike and Loss of Control: AAIB special report

With the loss of AirAsia flight QZ8501, a lot of attention has been focused on thunderstorms and their effects. I was quoted on the BBC talking about storms shortly after the accident.

BBC News – AirAsia QZ8501: Does bad weather cause plane crashes?

But it’s very rare for the weather alone to cause airliners to crash, experts say. Instead, how pilots and crew operate the plane mostly determines whether an incident will end up being a fatal accident, says Sylvia Wrigley, a light aircraft pilot and author of Why Planes Crash.
“I can’t think of an accident where weather was the sole cause of the problem,” she says. “But there can be a situation where the weather puts the aircraft at a higher risk of going wrong.”

The AAIB have just released a special bulletin that shows just badly things can go wrong without the storm being the real danger.

The incident took place in a Saab 200, a twin-engined turboprop with fly-by-wire elevator and rudder control system. The operator was Loganair, a Scottish regional airline which operates scheduled services under a Flybe franchise.

This video shows the aircraft arriving at Glasgow a year ago:

The flight consisted of three crew and thirty passengers. The captain had logged 5,800 flight hours but only 143 hours on type.

On the 15th of December in 2014, the Saab 2000 was flying from Aberdeen to Sumburgh.

Sumburgh Airport serves as the main airport of the Shetlands, situated on Mainland, which rather confusingly is the main island of Shetland. Flybe run scheduled services to Sumburgh Airport from Aberdeen, Edinburgh, Glasgow, Inverness, and Kirkwall (Orkney).

The weather forecasts were bad, predicting thunderstorms with rain, snow, hail and winds gusting up to 60 knots.

As they approached Sumburgh, the first officer checked the Automatic Terminal Information Service (ATIS) and confirmed that Runway 27 was in use, the wind was from 290° at 34 kt, gusting to 47 kt. Visibility was 4,700 metres (three miles) in heavy rain and snow. They accepted vectors for an ILS approach on runway 27.

On the base leg, shortly before final, the air traffic approach controller told them that the visibility had dropped to 3,300 metres (two miles) in moderate rain and snow and that the runway was wet.

The flight crew descended to 2,000 feet nine miles east of the airport. The weather radar on the aircraft showed a “convective cloud cell” as a red patch immediately west of the airport: a thunderstorm.

The captain immediately decided to abort. At that point, the autopilot was engaged with heading select and altitude tracking modes selected. This means that the flight crew can control the aircraft’s direction with the heading while the autopilot maintains the altitude selected.

The captain told the controller that they were discontinuing the approach and turned the aircraft onto a southerly heading.

A luminous sphere of “ball lightning” appeared briefly in the forward cabin. Then, just as the aircraft rolled out on the new southerly heading, lightning struck. The lightning entered the airframe at the radome (a weatherproof blister or enclosure that protects the radar antenna) and exited at the auxiliary power unit exhaust in the tail.

The captain called out that he had control. He pitched the nose up but the aircraft didn’t seem to respond. He pitched up harder and also used the elevator trim to pitch the nose up. The first officer made a MAYDAY call to air traffic control.

The aircraft finally began to climb in response to the captain’s increasingly aggressive inputs on the control column. The first officer also pulled back on the controls and applied pitch trim inputs. The pilots believed they may have lost control of the aircraft. The primary flight displays showed pitch and roll mis-trim indications.

The both thought that the lightning strike might have broken the fly-by-wire elevator controls.

The captain asked the first officer to use the elevator emergency trim switch on the flight deck panel. It had no effect. Their slow climb continued.

Then, as the aircraft reached 4,000 feet, the aircraft pitched nose-down by 19°.

The aircraft began descending at a rate of up to 9,500 feet per minute. The speed increased and soon they were going 80 knots indicated airspeed faster than the maximum operating speed.

Both pilots continued to try to bring the nose up. The Ground Proximity Warning System sounded with SINK RATE, PULL UP warnings. The captain applied full power and pulled back.

At just 1,100 feet above sea level, the aircraft finally began to climb.

The elevator control response still did not feel right to the captain and he asked the first officer to select the pitch control disconnect. This disconnects the two elevator control systems from each other, so that each pilot’s control column remains connected to the elevator on his side.

The first officer queried this request, because he said, the pitch control didn’t appear to be jammed. The captain disconnected the pitch control himself.

The climb continued. The flight crew tested pitch inputs on both control columns which worked perfectly. After those frightening few minutes, they were now clearly in control of the aircraft. They diverted to Aberdeen and landed safely.

So what happened? The flight data recorder showed that the autopilot was engaged throughout the failed climb and the descent.

The pilots were pulling back on the yoke and through sheer force, they managed to pitch the nose up. The autopilot was set to track the altitude and when the control inputs no longer allowed it to maintain the altitude, the autopilot used the pitch trim function to correct their unexpected climb. Thus, the pilots pulling back on the controls was countered by the autopilot making a prolonged nose-down pitch trim input.

The aircraft is fitted with a Rockwell Collins FCC-4003 autopilot system. This system controls the aircraft in pitch by mechanically moving the control column via an electric servo, and by sending pitch trim signals to the digital control system to move the elevator to offload the servo and allow the column to centralise in trimmed flight. When the autopilot is engaged the letters AP are displayed on the primary flight displays and the autopilot engage lever is in the engaged position.

The autopilot can be disengaged in the following ways:

  • pressing the disengage button on either control yoke
  • moving the autopilot lever on the centre pedestal to disengaged
  • moving the standby trim switches on the centre pedestal
  • pushing the power lever go-around palm switches

The point the report is making here is that the Saab 2000′s autopilot doesn’t disconnect when control column inputs are made, unlike many other aircraft. Neither does it disengage if the electric trim is adjusted manually, which seems a bit odd.

The captain and the first officer were attempting to fly the aircraft manually but because they never disengaged the autopilot, it continued to try to keep the aircraft at the selected altitude.

When the captain pulled the control column back, he felt a higher resistance than he expected. He was able to force the control column back but the autopilot retaliated by using the trim to pitch the aircraft nose-down and regain the selected altitude. The harder the pilot tried to climb, the greater the autopilot trim inputs were made to counteract him. The captain must have been disoriented because it would seem instinctive to hit the disconnect button for the autopilot when not receiving the expected response. However, he was clearly completely convinced that the autopilot was disengaged: of all the configuration changes he made, pressing the disengage button on his control column was not one of them.

The autopilot finally disengaged as the result of invalid system data during the frightening dive, with the pitch trim set to almost fully nose-down.

The lightning strike had done minor damage to the radome and the Auxiliary Power Unit exhaust. But the elevator control system and the autopilot were not affected and had no faults. The aircraft is now back in service and has not shown any flight control or autopilot problems.

As a response, Saab 2002 published an operator’s newsletter which highlighted the incident and clarified the operation of the autopilot.

Manual control inputs will not cause the autopilot to disengage and the main trim switches are disabled when the autopilot is engaged. Consequently, operation of the main pitch trim switches will not have any effect on aircraft trim nor cause the autopilot to disengage.

In addition, Loganair released a Notice to Aircrew advising them to ensure that the autopilot is disconnected if the flight crew experience control abnormalities. Their type rating training now includes a simulation of the situation.

The special bulletin is online here: AAIB Special Bulletin on Saab 2000, G-LGNO – News stories – GOV.UK. The final report is obviously still in progress although the AAIB have made it clear where their focus will be.

Further investigation
The AAIB investigation has not identified any technical malfunction which might account for the incident. The investigation continues; exploring crew training, autopilot design requirements, the human-machine interface, including the autopilot system and other human factors of relevance to the incident.

It’s easy to say that the pilots should have known better but the AAIB excels at investigating how to stop such errors being made. The additional training to expose pilots to the symptoms is already a step in the right direction. I wouldn’t be surprised if one recommendation in the report will be to have automatic systems work more predictably across a wide range of aircraft. Even if the control inputs didn’t disconnect the autopilot, it sure seems like manual interactions with the trim should have.

13 March 2015

The Mystery of Pan Am flight 7

Pan Am trip number 7 was an around-the-world flight which disappeared at sea, never to be recovered or understood.

The aircraft was Pan Am ship #944 (registration N90944), a Boeing 377 Stratocruiser Romance of the Skies. The Stratocruiser was “the ocean liner of the air” with Pullman-style sleeping berths, reclining seats with 60 inches of legroom and a large cocktail lounge. Champagne and caviar were served to start off the meals served on china plates. There were 36 passengers and eight crew.

The round-the-world trips started and ended in San Francisco. Pan Am trip 7 was on its first leg of the flight. On the 8th of November, the Romance of the Skies departed San Francisco normally at 11:51 PST (local time for San Francisco) for its ten-hour flight to Honolulu.

At 16:04, the Captain made a routine position report to the US Coast Guard cutter Pontchartrain, which was located at the halfway point between the mainland and Oahu. The Romance of the Skies was on course and on schedule. This was about the time that the passengers would have sat down for their seven-course gourmet dinner. That radio call was the last contact with the aircraft.

The last position report received was at 01:04. There was no distress call or any indication of trouble, but the aircraft never arrived at Honolulu.

The New York Times, 9 November 1957:

The Coast Guard sent out a search plane to look for the airliner, which carried 36 passengers and a crew of eight. The Coast Guard also alerted crews of two cutters to be ready to take part in the search. United Press International (UPI) reported that submarines USS Cusk and USS Carbonero were the closest vessels to the point where the plane was last reported and were diverted to the search. The last radio report from the plane came when Capt. G. H. Brown made a routine check.

The search and rescue mission grew rapidly until it was reported to be the largest peace time response since Amelia Earhart went missing. Six days later, the US Navy carrier Philippine Sea discovered debris off course: 940 miles east of Honolulu and 90 miles north of the aircraft’s intended track.

A flotilla of small boats delivered the bodies and debris to the US Navy carrier. They found a 33-square-mile area of debris. In that area, there were fifteen bodies floating in the water with no shoes on. Most of them wearing life jackets from the aircraft. Three of the bodies were found with wristwatches stopped at 16:26, giving investigators the exact time when the Romance of the Skies impacted the water.

The bulk of the aircraft and remaining passengers and crew had sunk to the bottom of the Pacific and has still not been salvaged.

The state of the passengers meant that they had time to prepare for the aircraft to ditch. In addition, some of them were found to have higher than normal levels of carbon monoxide. However, the wreckage that was recovered had burn marks only above the water line, which means that although there was a fire, it was post crash. There was no evidence of an in-flight fire. The passengers did not die from carbon monoxide poisoning and only a few showed impact trauma; most died from drowning.

This means that the aircraft did not crash into the water at high speed.

This is bourne out that the wreckage was found 90 miles north of track, which implies that the aircraft continued to fly after something went wrong. Investigators believed that the aircraft impacted the water with the nose down and the right wing lowered.

No probable cause was ever discovered and to this day that tragedy that befell Pan Am ship #944 on flight 7 to Honolulu is a mystery. Theories include on-board bombs and faulty propellers. Many believed that the crash was a suicide: an unstable crew member who had been diagnosed with a fatal illness taking the plane out with him. “He was too chicken to go alone,” his step-daughter told journalists.

There’s also a suspicious passenger: a middle-aged man who took out three life insurance policies, two of them purchased just three days before the flight. The man was an innkeeper but he was discovered to have been a demolitions expert in the Navy. He had previously burned a heavily insured lodge to the ground and collected the payout.

A year before, the sister ship of the Romance of the Skies, Pan Am ship #943, ditched on the last leg of its around-the-world-tour, flying from Honolulu to San Francisco. The 943 had an overspeeding propeller and an engine failure. The aircraft managed to circle until daybreak and then ditched in the same area, next to Pontchartrain. The aircraft and the rescue were filmed. Everyone on board was saved.

Pontchartrain was the same clipper who received the final radio call from the Romance of the Skies. It’s possible that the aircraft suffered the same fault: An Airworthiness Directive was issued as it was one of many cases of loss of propeller control but there are some that believe that the directive was never carried out and that a similar overspeed event afflicted the Romance of the Skies. However, it remains odd that there was no mayday call or any sign of distress. In addition, the aircraft continued to fly away from Pontchartrain, making a rescue unlikely even if they were able to successfully ditch.

Between 1962 and 2006, the NTSB have logged 363 instances of vanished aircraft, most of which disappeared over the water.

It’s frustrating not to know and tempting to fill in the blanks. But sadly, we will probably never know what happened that day.

27 February 2015

Pretty Crazy Actually: Debunking the Latest MH370 Solution

So all week, people have been forwarding me Jeff Wise’s piece from New York Magazine in which he comes up with a “new” theory that explains everything about why we can’t find Malaysia Airlines flight 370.

How Crazy Am I to Think I Know Where MH370 Is? — NYMag

Obviously, I immediately read it with interest. Even excitement. As soon as I got to his theory, my mood changed to dismay.

The first section is about his own experience, so I’m happy to accept all that as truthful and based on his perception. I particularly liked the reference to Believers: people who had already chosen a single theory as true and wanted to convince the world. I had the same experience after I published The Mystery of Malaysia Airlines flight 370, where readers would mail me (or review me) complaining that the book was a waste of time because it didn’t deal properly with the only explanation that made sense. I didn’t mind if that was a theory I hadn’t covered, that’s fair enough. But in most cases, I had discussed the theory: the reader was just upset that I hadn’t proved it as true.

This is also an interesting section of Wise’s article because in it, he effectively establishes his credentials as understanding the various theories and ability to recognise a crackpot. This sets up legitimacy for the second half. He certainly had my sympathy by this time. It helped that I’d read his blog before and found him interesting and knowledgeable.

But once he started putting forward the pieces of his theory, it fell apart.

For a long time, I resisted even considering the possibility that someone might have tampered with the data. That would require an almost inconceivably sophisticated hijack operation, one so complicated and technically demanding that it would almost certainly need state-level backing. This was true conspiracy-theory material.

For the record, I agree with this. That’s not to say it is impossible, but there are easier ways to achieve the same results. Generally, the path of least resistance is the way to go. That doesn’t mean it didn’t happen and Wise says he found evidence, so lets run with it.

I realized that I already had a clue that hijackers had been in the E/E bay. Remember the satcom system disconnected and then rebooted three minutes after the plane left military radar behind.

Woah, no, wait! I don’t remember that at all. This refers to an earlier description in the text:

For about an hour after that, the plane was tracked on radar following a zigzag course and traveling fast. Then it disappeared from military radar. Three minutes later, the communications system logged back onto the satellite. This was a major revelation. It hadn’t stayed connected, as we’d always assumed. This event corresponded with the first satellite ping.

The first satellite ping is the only data we had once it disappeared from military radar. The communications system wasn’t logged onto the satellite before this and it didn’t log onto the satellite at that point. The system pinged the satellite and was refused [see comment below for more on this] because Malaysia airlines had not purchased the satellite service.

So Wise describes a three minute period between disappearing from military radar and the first ping to the satellite and suddenly this is rephrased as Remember the satcom system disconnected and then rebooted.

To be honest, it’s the phrasing that made me read more suspiciously. However it was just a sentence later when the whole theory derailed for me.

I spent a great deal of time trying to figure out how a person could physically turn the satcom off and on. The only way, apart from turning off half the entire electrical system, would be to go into the E/E bay and pull three particular circuit breakers. It is a maneuver that only a sophisticated operator would know how to execute, and the only reason I could think for wanting to do this was so that Inmarsat would find the records and misinterpret them. They turned on the satcom in order to provide a false trail of bread crumbs leading away from the plane’s true route.

Inmarsat had never released records like this before. No aircraft had ever been tracked like this before. The idea that it was even possible was a major revelation, even to Inmarsat. The data was never intended for tracking purposes.

MH370: Inmarsat details proposal for free flight-tracking – 5/12/2014 – Flight Global

“Now that we know we have these ‘pings’, why not make use of them?” says Inmarsat senior vice-president for external affairs Chris McLaughlin.

Wise seems to have forgotten this in his excitement. His inconceivably sophisticated hijack operation now is based on seeding false data in the form of pings on a satellite service that had not been paid for. What a crazy amount of effort this is on a hope and a prayer that someone would spot it, realise it was useful data and use it to lead the world in the wrong direction.

Once I threw out the troublesome BFO data, all the inexplicable coincidences and mismatched data went away. The answer became wonderfully simple. The plane must have gone north.

So if he throws away the data that no one expected us to have and accepts that the hijackers spoofed everything, then whatever theory he likes can be fit into the minimal information that remains. This is a mark of a Believer, without a doubt.

Using the BTO data set alone, I was able to chart the plane’s speed and general path, which happened to fall along national borders. Flying along borders, a military navigator told me, is a good way to avoid being spotted on radar.

Oh yes, definitely, borders are not at all important politically and most nations pay no attention to them whatsoever. Definitely not covered by military radar…no wait.

What military navigator would say such a thing? I mean, seriously, is this someone who disliked Wise? Of course borders are covered by radar; strategically this is a critical requirement of radar.

There aren’t a lot of places to land a plane as big as the 777, but, as luck would have it, I found one: a place just past the last handshake ring called Baikonur Cosmodrome.

If MH370 did land at Yubileyniy, it had 90 minutes to either hide or refuel and takeoff again before the sun rose. Hiding would be hard. This part of Kazakhstan is flat and treeless, and there are no large buildings nearby. The complex has been slowly crumbling for decades, with satellite images taken years apart showing little change, until, in October, 2013, a disused six-story building began to be dismantled. Next to it appeared a rectangle of bulldozed dirt with a trench at one end.

This implies it is some sort of abandoned airfield in the middle of nowhere. He then goes on to show satellite images that show a building being dismantled in October 2013 and a rectangle of bulldozed dirt. He drew in the silhouette of a 777 to show that it is the perfect size.

Perfect size if you don’t mind the wings touching the walls, I guess?

By March 2014, he says, the building was gone.

Construction experts told me these images most likely show site remediation: taking apart a building and burying the debris. Yet why, after decades, did the Russians suddenly need to clear this one lonely spot, in the heart of a frigid winter, finishing just before MH370 disappeared?

Let’s get this absolutely clear: Baikonur Cosmodrome is not abandoned. It is the largest operational space launch facility in the world. There are commercial, military and scientific missions launched from the site. It is the sole launch site for International Space Station missions. Inmarsat launched a spacecraft there just a few weeks ago.

Not a lonely spot. Full of scientists and foreigners and even Inmarsat employees. Are they all in on this?

To the best of my knowledge, this airstrip is the only one in the world built specifically for self-landing airplanes. The 777, which was developed in the ’90s, has the ability to autoland.

He’s talking about CATIII. This is a category of ILS equipment which allows for auto landing.

I’m not sure what he means by the only airstrip in the world built specifically for self-landing aircraft nor why that would make a difference. Either the airstrip supports CATIII or it doesn’t.

Most modern city airports support CATIII and thus allow for self-landing aircraft. Most modern aircraft have the ability to autoland. Baikonur is not special in this respect and the use of “only one in the world” is misleading.

The point of CATIII is to make it possible to land in visibility too poor for a visual landing. Normally, your commercial pilot, flying in bad weather, has to have the runway in sight at a predefined height or else he has to break off the approach. This is known as the decision height.

To autoland, the aircraft knows precisely the aircraft’s height above the ground and initiates the landing flare at the correct height for the model, usually about 15 metres (50 feet) above the ground. This means there is no decision height: the runway never has to be in sight.

From a hijacking perspective, this feature allows people who don’t have commercial-piloting experience to abscond with an airplane and get it safely on the ground, so long as they know what autopilot settings to input.

Well, yes, with a bit of luck and perfect conditions, this might work. The absconder would still need to reduce the speed as the flaps are are selected and manually activate reverse thrust, at least, but it would be easier to teach a person to autoland than to fly the Boeing 777.

I know I sound a bit grudging there. Quite honestly, by this point, it feels weird when Wise says something logical and factually correct.

Whether the plane went to Baikonur or elsewhere in Kazakhstan, my suspicion fell on Russia.

Again, the phrasing here is a logical fallacy: he’s put forward a failed case for Baikonar and then dismisses objections with the assumption that it has gone to Kazakhstan, which he has never shown based on the data he has chosen to accept as correct.

He defends his suspicion of the Russians with a headline that the Russians were responsible for the deteriorating situation in Ukraine. Then Wise points out that there were three suspects on board who match his profile: one Russian and two Ukrainians. He suspects all three of being special forces or covert operatives.

All were in their mid-40s, old enough to be experienced, young enough for vigorous action —about the same age as the military-intelligence officer who was running the show in eastern Ukraine.

Convinced yet? Me neither.

He hired Russian speakers to make phone calls to Odessa and Irkutsk to find out more about the men. Not surprisingly, their families weren’t interested in discussing his theory. Nevertheless, he says that the more he discovered, the more coherent the story seemed, as if the existence of 40-something “ethnically Russian” men somehow proved his point. His confidence is meant to lead the reader into nodding along knowingly even though he’s never actually justified his logic.

As if that all weren’t bad enough, he ends on a completely false note.

Last month, the Malaysian government declared that the aircraft is considered to have crashed and all those aboard are presumed dead. Malaysia’s transport minister told a local television station that a key factor in the decision was the fact that the search mission for the aircraft failed to achieve its objective.

Simply not true. The transport minister said no such thing and the declaration specifically says the opposite:

Read Full Statement in English

The underwater search is still ongoing at this time and the exercise is currently being performed by 4 vessels, namely the Go Phoenix, Fugro Discovery, Fugro Equator and Fugro Supporter. To date, the search has covered over 18,600 square kilometres (as of 28 Jan15).

The declaration defined the incident as an accident, which includes aircraft that have gone missing.

I’ll tell you a secret: I know what he misread. The declaration talks about the search and rescue mission in the past tense. That’s because there’s no one left to rescue. There are two points of detail to defend that the search and rescue is completed even though the search is still continuing, but I guess Wise never read that far.

He is clearly convinced that the search is over.

The search failed to deliver the airplane, but it has accomplished some other things: It occupied several thousand hours of worldwide airtime; it filled my wallet and then drained it; it torpedoed the idea that the application of rationality to plane disasters would inevitably yield ever-safer air travel. And it left behind a faint, lingering itch in the back of my mind, which I believe will quite likely never go away.

It’s a quick visit to the Australian Transport Safety Bureau to get the latest Operational Update. The search has not (yet) failed and, just last month, Search chief Martin Dolan spoke confidently about finding the wreckage.

I think Dolan be horrified to hear that his accomplishment was to have filled and drained Wise’s wallet. And honestly, the application of rationality has absolutely yielded ever-safer air travel. The effects to Wise’s mind I leave as an exercise for the reader.

I sure do understand his desire to sell his book. I want to sell mine, too. I have spent the last year discussing Malaysia Airlines flight 370 and wondering what happened to it, just like him. But coming up with hare-brained schemes and using persuasion tactics instead of facts, well, Wise is better than this.

If you are interested in thought experiments about what happened to Malaysia Airlines flight 370, then please consider my book, which takes the leading theories and considers their plausibility. I don’t have any simple answers but, quite frankly, neither does Wise, whatever he might claim.

[Edit: added reference to Bill's comment below to the main text]

20 February 2015

NTSB Open Docket of Bagram Cargo Crash Documents

The chilling video of a Boeing 747 crashing on take-off from Bagram Afghanistan meant that this tragic accident from April 2013 made headline news.

This is the dashcam video of the aircraft’s take off. Please note that it shows the actual impact and may be disturbing.

The Ministry of Transportation and Commercial Aviation in Afghanistan was joined by the American NTSB for the investigation.

The NTSB has now opened a docket on the crash, releasing factual information which forms the basis of the investigation. There is no analysis nor conclusion at this time; the final report has not yet been released. But the documents and photographs are enough to give us a heart-breaking picture of what happened that day.

The full set of files is available here: http://dms.ntsb.gov/pubdms/search/projList.cfm?ntsbnum=DCA13MA081

It’s hard not to draw conclusions from the information released so far. I’ve collected the key facts where they seem to help shed light on the cause.

The Boeing 747-400 registration N949CA was a converted cargo plane operated by National Airlines.

On the 29th of April in 2013, the cargo plane crashed shortly after take-off from Bagram Airfield in Afghanistan. All seven crew members onboard were killed and the aircraft was destroyed.

Bagram Airfield is the largest US Military base in Afghanistan. It is run by US Armed Forces but also occupied by the International Security Assistance Force (ISAF) and the Afghan Armed Forces.

The airfield was built in the 1950s and played a key role for the US during the Cold War and then in the Soviet war in Afghanistan. In 2007, Bagram Airfield was described as the size of a small town having over 40,000 inhabitants, with traffic jams, commercial shops and dual runway operations.

The original flight schedule was for the Boeing 747 to fly from Chateauroux, France to Camp Bastion, Afghanistan and then continue to the Dubai World Center at Al Aktoum, UAE airport. However, National Airlines couldn’t obtain clearance to overfly Pakistan for the flight departing Camp Bastion to Dubai. The dispatcher instead planned for the flight to fly to Bagram, refuel, and continue from there to Dubai.

The aircraft was held up en route to Camp Bastion as a result of indirect fire at the airport from the Taliban. The load manifest shows that the plane was loaded by National Air Cargo. National Airlines transported the cargo but National Air Cargo was responsible for the load planning, cargo/pallet build up and aircraft loading. The Boeing 747 was loaded with 94,119 kgs of cargo, including 5 Mine Resistant Ambush Protected (MRAP) armoured military vehicles on the main deck. National Air Cargo ground crew told the NTSB investigators that the Dubai offices conducted classes on how to palletize a Stryker, a military vehicle which weighed about 12-13 tons.

Of the five mine resistant armoured vehicles loaded onto the Boeing 747, two were MRAP all-terrain vehicles weighing about 12 tons each. The other three were MRAP Cougars weighing about 18 tons each.

It was the first time that National Airlines had transported the 18-ton military vehicles.

More importantly, it was the first time that National Air Cargo had ever attempted to load an 18-ton Cougar on a National Airlines B747-400.

The National Air Cargo Operations Specialist who was in charge of the pallet build-up for the accident flight load told NTSB Staff he did not have an SOP (standard operating procedure) for any particular load, there was no specific manual that they followed when building the pallets, and he did not know the load capacity of a pallet.

He further said that the only manual he had for reference in Camp Bastion was a dangerous goods manual. National Air Cargo staff did not have a copy of the National Airlines Cargo Operations Manual in Camp Bastion, and did not have a computer to view any manuals online.

There were seven crew. Two captains and two first officers, along with two mechanics and one loadmaster. The aircraft had a rest facility on board, allowing the 747 to be flown with a double crew. The accident Captain was highly experienced and described as “excellent” in his training transcripts and “having great CRM” by crew who had flown with him. The accident First Officer was new to the aircraft but was considered to have strong skills, both monitoring and flying, and was described as very well prepared for the change to the B747-400.

The loadmaster had worked for National Airlines for two and a half years and had been a ground handling supervisor/trainer before that.

Neither the accident Captain nor his First Officer had prior experience carrying mine resistant armoured vehicles. Neither did the loadmaster: he had never worked a National Airlines flight with an MRAP as part of the cargo load before, not even the 12 ton version. No special guidance, strapping diagrams or photos were provided to him.

The Chief Loadmaster was asked if there was a conscious decision by National Airlines to approve the loading of the 18-ton Cougars. He told the NTSB that it was up to National Air Cargo (the company who took the order) and that as the operator the flight, they stuck to “you call, we haul”.

The five heavy military vehicles were loaded onto the Boeing 747 and the flight crew continued on their journey to Bagram Airfield.

It’s early on in the Operation Chairman’s Factual Report that the focus turns to the broken strap that the flight crew found in the cargo bay after they landed at Bagram Airfield.

According to recorded data, at about 0957 while the airplane was still on the ramp in Bagram, the captain was made aware of a broken strap found by one of the other crewmembers, and the cockpit crew had a discussion about a possible shift of the cargo load during landing in Bagram. There was additional discussion on re-securing the load prior to departure.

Here’s the transcript of that conversation.

09:57:33 First Officer There’s your trouble Brad.
09:57:35 Captain What is it? What the [expletive] was that from?
09:57:39 First Officer One of those [expletive] straps is busted
09:57:42 Second Captain [unintelligible] tire
09:57:44 Captain No no, I know that… [unintelligible] No I know, but…
09:57:45 First Officer Give you one guess what was right there.
09:57:49 Captain What was right where?
09:57:49 First Officer Right here.
09:57:50 Captain A knot?
09:57:51 First Officer Uh huh.
09:57:52 Captain That was the one right at the door?
09:57:54 First Officer No… This was at… [unintelligible]
09:57:56 Captain So you (go on/goin) puttin more straps (on [expletive])?
09:57:59 First Officer (well) it just shifted (apparently/barely)
09:58:01 Second Captain There was a bunch of them first… That first (truck).
09:58:02 Captain Did it move? … [expletive] moved?
09:58:04 First Officer Yes. Just tightened up on the straps. The truck?
09:58:06 Second Captain [unintelligible] like… Tightened those straps up uh, quite a bit, on the first one
09:58:13 First Officer You know how that… Well you go look at the… Went and looked at them now… all the ones [unintelligble] they had a bunch like this, to keep them from moving backwards… a bunch like this [unintelligble][unintelligble]movin forward? All the one that were keepin em from movin backwards were all [expletive] loose.
09:58:28 Second Captain What the [expletive] do you think’s gonna happen when you [expletive] slam it on the runway and slam on the [expletive] brakes and don’t use reverse… [said in a joking manner]
09:58:35 Captain [sound of laughter]
09:58:36 First Officer There ain’t nothing you coulda done about that.
09:58:37 Second Captain [unintelligible]I’m putting it on the [expletive][expletive] board. I’m gettin off this plane, I’m scared. [said in a joking manner]
09:58:46 Captain Throw that out man, that’s evidence. [unintelligible] [The Loadmaster] don’t want that hangin around either.
09:58:50 Unknown No.
09:58:53 Captain I hope instead of [unintelligible] rather than just replacing that (strap) I hope he’s beefing the straps up more
09:58:59 Unknown Just on that one spot.
09:59:00 First Officer Yeah.
09:59:02 Unknown All the rest of them are fine.
09:59:06 First Officer He’s cinching them all down.
10:14:49 Notice [break in transcript]
10:14:57 Captain What’s up dude?
10:15:01 First Officer Did you throw that other strap away?
10:15:04 Captain What did you – Did you put a couple more on? How far did it move… a couple of inches?
10:15:13 Loadmaster Yeah they just moved a couple inches… cause you know, it’s nylon ya know, so.
10:15:20 First Officer (you throw some) numbers (in here)?
10:15:21 Captain That’s scare-… that’s [expletive] scary- without a lock (for those big heavy things/[unintelligible] anything). Man I don’t like that. I saw that, I was like [expletive], I never heard of such a thing.
10:15:30 Unknown [unintelligible] I’d be kinda interested ta… wish I could put a camera down there and watch it…
10:15:36 First Officer (You’d probably)[expletive] yourself.
10:15:37 Captain Right.
10:15:37 Unknown See what they do
10:15:39 Captain Those things are so [expletive] heavy you’d think though that they probably wouldn’t hardly move no matter what

Clearly, the Captain is not happy with the situation. Ultimately, it’s the Captain’s decision whether it is safe to fly or not, not the loadmaster’s. However, in order to declare cargo as unsafely loaded, the Captain has to have the training to make a qualified opinion.

A National Airlines B747-400 Check Airman stated that “the loadmasters have their job–there is very little interaction between pilots and loadmasters.” A B747-400 FO stated that pilots at National Airlines “relied on the loadmasters 100% to make sure the load was done and secured properly.”

A National Airlines B747-400 Check Airman told the NTSB that there were guidelines on how to strap down cargo in a document referred to as the “loading manual” but pilots were neither trained nor evaluated on that information.

There was nothing included in the National Airlines Flight Operations Training Manual that covered the review of a cargo load by the pilots.

In this company culture, the Captain could not feel supported in going against the loadmaster, even if he accepted that the final decision to fly or not fly rested with him. The Captain quite simply did not have the knowledge or expertise at his disposal to make that kind of decision.

The Captain was, as the National Airlines First Officer said to the NTSB, completely reliant on the loadmaster.

He decided to continue. In fact, it never seemed to have occurred to him that he could do anything else.

Here’s what the Captain would have said was a really [expletive] scary thing: loadmasters aren’t certified. There’s no agreed training, there are no currency checks, there’s nothing official.

There was no specific training for the Chief Loadmaster position.

The documents include an interview with Charles Dsouza, Base Support at Camp Bastion and one of the staff who helped with the palletizing and loading.

In the accident flight, he was pushing loads into the airplane. The load had 5 MRAPs, 3 Cougars and 2 smaller MRAPs. The Cougars were 18 tons, and this was the first time they had ever loaded something that large. They used PGF pallets, two together with a sheet of plywood between them. They tied the pallets together with straps, 3 long and wide ways. They were the same straps used on the tie down to the airplane.

He said the pallet could handle the weight of an 18 ton Cougar. He said there’s no written guidance on how to build a pallet. They just did it, not by manual, but by working as a team.

He never received training to build and load pallets. No one complained about his load. The load master checks his work, and Ralph was his supervisor who also checked his work. He said if there were any problems with the straps and chains, the load master would correct them, or Ralph would correct him.

The Chief Loadmaster told the NTSB that they’d never needed to replace any straps and there was no training to tell when a strap was no longer safe.

Although the FAA has no regulatory oversight over loadmasters, cargo loading on aircraft is within their jurisdiction. Cargo loading equipment and continuous analysis surveillance are considered “high criticality items” which means that these operations must be surveyed by the FAA every six months.

The Principal Maintenance Inspector from the FAA told investigators that he’d attempted to observe the loading process for National Airlines; however he’d only seen National Airline’s B747-400 loaded once, in 2012 when he went to Dubai for five days and they did a ramp inspection.

In Dubai for the one time he observed National Airlines, they loaded only general items and military items. He could not remember if the load was going into Afghanistan, and told NTSB Staff he was not allowed to go to Afghanistan because the State Department would not issue them visas to travel to Afghanistan, and they could only observe the aircraft in Dubai.

One FAA cabin safety inspector out of Minnesota was able to do an enroute cabin inspection, and he said he heard that “there was some fallout from it.”

When asked how he would survey an operation overseas like the National Airlines B747-400, he said that “you would just go to DXB [Dubai, UAE] and see what you see,” and the one time he went to Dubai, he observed the 757 when it arrived and left.

The Principal Maintenance Inspector said that he didn’t observe any of the pallet build ups since that was the Principal Operations Inspector’s responsibility. He said that he never had an opportunity to observe the straps.

The Principal Operations Inspector told the NTSB that he didn’t know that National Airlines was strapping the heavy vehicles to the seat tracks until after the accident, when he saw photographs of the strapping.

The FAA was not aware of any risk analysis done by National Airlines for the carriage of 18 ton military vehicles, and the FAA was not notified by National Airlines that they were carrying multiple MRAPs prior to the accident.

The FAA did not conduct a risk analysis when it was discovered that National Airlines was hauling heavy military vehicles like MRAPs because, according to the [Principal Operations Inspector], “the manual seemed sufficient,” and “if they were following their manual there should not be an issue.”

The FAA conducted a review of National Airlines manuals after the accident, specifically because it was unclear whether loadmasters were referring to Boeing or Telair when they discussed the guidance in the Cargo Operations manual. Turned out that National Airlines had combined the Boeing and Telair guidance into the manual to allow for “one stop shopping rather than having to reference separate manuals.”

A National Aviation Safety Inspection Program had just run an assessment of National Airlines at the time of the accident. The primary problem identified was that National Airlines were having problems training and hiring loadmasters.

The Director of Safety at National Airlines stated that no risk analysis was conducted for the carriage of heavy, centre-loaded floating palletised loads like the MRAPs. He said he wasn’t involved in the decision to begin carrying large, heavy military vehicles and the Safety Department was not asked to prove input.

In other words, no one actually took responsibility for making sure that the cargo transports were safe and the staff had no experience and little or no guidance.

“You call, we haul.”

The crew did not take on any additional cargo in Bagram, and only took on fuel for the flight to Dubai. The airplane refueled to 48,000 kilograms of fuel. A National Air Cargo ground crew met the airplane during refueling, and only spoke with the loadmaster at the entrance of the main deck door. The flight release for the Bagram to Dubai leg had been emailed to the captain while the airplane was in Camp Bastion, so there was no paperwork exchanged, and the ground crew did not enter the airplane or cockpit and only spoke with the loadmaster.

The aircraft taxied out normally for departure on runway 03 at Bagram. The take-off roll appeared normal and the aircraft rotated around the Charlie intersection of the runway.

Nine seconds later, the cockpit voice recorder stopped recording. Three seconds after that, the Flight Data Recorder stopped recording. The airborne aircraft pitched up until it appeared to stall, at which point it turned to the right and crashed into the ground just beyond the departure end of runway 03.

Twelve items were recovered from the runway following the accident in the vicinity of Taxiway C which was near the point of takeoff rotation. Eleven were identified as airplane structure and one was identified as being part of an MRAP.

The data and the physical evidence suggest that at least one 12-ton MRAP vehicle broke loose of its restraints and damaged the FDR and the CVR before breaking through the aft pressure bulkhead. That damaged hydraulic systems #1 and #2. The stabilizer jackscrew assembly was displaced and had scuff marks of paint on it, which possibly occurred on impact. However, if the paint was from the MRAP sliding into it and the stabilizer jackscrew was displaced during take-off, safe flight and landing were not longer possible.

That is just key information that I picked up out of the documents; there’s a lot more information in the docket. It seems to me that the investigators aren’t very far from a conclusion and it’s already pretty clear what some of the recommendations will be.

For me, the hardest part of this to read was the CVR transcript. The sound of the crew laughing and joking around is heartbreaking, knowing in an hour they would find themselves in an aircraft that could not be controlled. No report in the world can make that better.

06 February 2015

TransAsia Flight 235 Inexplicably with No Engines

TransAsia Airways Flight 235 was a scheduled Taiwanese domestic flight from Taipei Songhan Airport to the Kinmen Islands.

The aircraft, registration B-228516, was a twin-engine turboprop made for regional airliners, the ATR 72. It can seat up to 74 passengers and is operated by a two-pilot crew. B-22816 had two Pratt & Whitney Canada PW127M engines and was less than a year old. There were five crew and 53 passengers on board. The flight crew consisted of three extremely experienced pilots. The Captain (Pilot Flying) had 4,914 flight hours and the First Officer had 6,922 flight hours. A flight instructor who was in the jumpseat had over 16,000 flight hours.

The aircraft took off from Taipei and climbed through 1,000 feet. Two minutes after take-off, the flight crew declared an emergency.

Control Tower [inaudible] … wind 100 degrees, 9.9 knots. Clear to take off.
TransAsia GE235 Clear to take off, runway 10, TransAsia 235
TransAsia GE235 Mayday! Mayday! Engine flameout
Control tower TransAsia 235, please try again. Contact Taipei Approach on 119.7
Control tower TransAsia 235. Control tower. … TransAsia 235, Control tower.

Contact was lost at 10:53 GMT, just two minutes after departure.

Flight 235 passed over the Huangong Viaduct, where multiple cars with dashcams inadvertently recorded the disaster.

TransAsia Airways Flight 235 – Wikipedia

The aircraft, flying level, first cleared an apartment building. Then it rolled sharply, at nearly a 90-degree bank angle, left wing down. As the aircraft flew low over the elevated viaduct, its left wingtip struck the front of a taxi travelling west on the viaduct, and the outboard section of the wing was torn off when it struck the concrete guardrail at the edge of the viaduct. Two people in the taxi were injured.

The following shows the aircraft in its last moments before it crashed into the Keelung River and the wreckage after (caution, may be disturbing).

As of today (6 Feb 2015), 15 people have been rescued. 35 occupants of the aircraft were killed in the crash and eight are missing. Two were injured on the ground when the aircraft hit a taxi on the road but suffered only minor injuries.

The Taiwanese Aviation Council has released some preliminary data from their investigation, specifically the engine plots from the flight-data recorder. All times are given in GMT.

The blue dotted line is the right-hand engine, engine #2, which is the one that had the original fault. The green line is the left-hand engine, engine #1.

10:51:XX TransAsia Flight 235 received take-off clearance
10:52:33 TransAsia Flight 235 handed off to departure
10:52:38 The aircraft had been airborne for 37 seconds and was at 1,200 feet above mean sea level when a master warning showed that the right-hand engine (engine #2) had failed.
10:52:43 The left-hand engine (engine #1) was throttled back
10:53:06 The right-hand engine (engine #2) auto-feathered.

The director of the Aviation Safety Council said in a press event that there was no flame-out. The right-hand engine shifted into idle mode but the oil pressure never changed. It’s unclear what triggered this.

10:53:12 Stall warning activated
10:53:18 Stall warning ceased

According to the Aviation Herald, at 10:53:19 the crew discussed that engine #1 had already feathered, the fuel supply had already been cut to the engine and they decided to attempt a restart of engine #1. However, I’ve not seen a copy of the cockpit voice recorder data or a news report that it is released, so I’m not sure where this information has come from.

However, there’s no doubt that at this point, the left-hand engine, that is the working engine, was shut down manually. Now the aircraft has no power.

10:53:21 Stall warning activated
10:53:34 Mayday call while multiple attempts were made to restart the engine
10:54:34 A second master warning activated

Half a second later, all devices on the aircraft stopped recording.

The actions of the pilots don’t make sense. They clearly believed that an engine had flamed out but even taking this into account, there’s no reason to shut down the other one. The ATR 72 can fly on just one engine so losing the right-hand engine would not have necessarily been an issue.

Right now, it looks suspiciously like this tragedy could have been averted if the pilots had done nothing at all. But this is surprising considering how experienced all of the pilots were and I’m still hoping there will be some other explanation.

The Taiwanese Aviation Safety Council is leading the investigation, with the French BEA representing the country of manufacture and the Transportation Safety Board of Canada representing the country of engine manufacture. They expect to release a preliminary report in 30 days.

30 January 2015

Cirrus SR22 ditching into Pacific captured on video

The U.S. Coast Guard has released video footage of a Cirrus SR22 ditching into the Pacific on the 25th of Jan.

The SR22 was being flown by a commercial pilot on a repositioning flight from Tracy, California to Maui. It’s a long flight and well out of range for a normal Cirrus SR22.

The aircraft was fitted with ferry tanks – extra fuel tanks meant for large water crossings. The flight was uneventful for the first 14 hours or so… until the aircraft was about 900 miles from Hawaii, when pilot realised he was unable to transfer fuel from his aft auxiliary fuel tank. The fuel transfer system had malfunctioned: although the aircraft had plenty of fuel for the remainder of the flight, the pilot was unable to get it to the engine.

The pilot contacted the Hawaiian National Coast Guard and told them that he had only three hours of fuel remaining, not enough to make it to land.

He said he would ditch the aircraft around 320 miles north east of Maui by deploying the Cirrus Airframe Parachute System (CAPS).

The Coast Guard informed him of the cruise ship Veendam which was within his range and asked him to divert towards it. A Coast Guard HC-130 Hercules was deployed from Coast Guard Air Station Barbers Point on Oahu to assist and maintain communications. It must have been from there that the video footage was shot.

Once the pilot was near the cruise ship, around 250 miles northeast of Maui, he activated the CAPS and the parachute deployed.

The aircraft seemed to be almost floating as it descended until the impact with the water. If you watch the rocking of the aircraft as the pilot climbs out, you can see just how turbulent the sea was. At the time of the rescue, weather conditions were seas of nine to twelve feet and winds of 21-24 knots (40-45 kilometres or 25-28 miles per hour).

The aircraft sank very quickly after the pilot came free, possibly dragged under by the parachute.

The pilot inflated an emergency life raft and was rescued (“extracted”) about 30 minutes later by the crew of the cruise ship Veendam. He was unharmed.

There’s also a video taken within the cockpit at the same time. See the comments below for the link to the pilot’s video of the event taken on his mobile phone.

The NTSB reports that the investigation is in progress and the final report will be published on the NTSB website: WPR15LA089.

There is no intention to attempt to recover the aircraft. Poor plane…

16 January 2015

50/50 Blame for Pilot and Skydiver in Mid-Air Collision

The final report ERA14LA146 was released last month for the incredible collision between an aircraft and a parachutist with only minor injuries (and a totalled Cessna) as a result.

The accident happened at South Lakeland Airport in Florida on the 8th of March 2014. It was a clear day, blue skies and a light 3-5 knot wind. South Lakeland Airport is an uncontrolled grass strip at the edge of Lakeland’s Class D airspace.

The pilot was an 87-year-old WWII veteran who has been flying all his life. He was flying in the circuit and had done three touch-and-go landings on runway 32: touching down on the runway to immediately take off and go again. He was aware that skydiving operations were in progress.

While he was flying, another aircraft with a group of parachutists had departed South Lakeland Airport and climbed to jump altitude. The skydiver in question was the 4th skydiver to jump. He deployed his parachute and manoeuvred to be parallel to the runway. He was watching another skydiver at about the same altitude and then initiated a left-turn so that he would land into the wind. His approach path crossed the approach end of runway 32.

Meanwhile, the pilot called out that his next approach would be for a full-stop landing; he was finished practising for the day.

Robert Goyer of FLYING knows the airfield and wrote about it a few days after the accident.

Insight: Parachute-Cessna 170 Midair Collision | Flying Magazine

The airport is pretty small, and there’s a two-lane highway immediately to the east lined by power lines, which you can see in the photographs. There are tall trees at the departure end of the runway, but with more than 3,000 feet of available runway, the power lines are the greater hazard until after you’ve climbed out initially. On approach to Runway 32, there are high tension lines. It feels as though you’re descending into a funnel with only one place to go. On approach to Runway 32, where the Cessna was doing touch and goes, you can go missed in a emergency by executing a right turn over the airport grounds. Otherwise, once you’re as low as the Cessna was and already rotating for a touch and go, the options are even more limited.

What’s clear is that neither of them had seen the other and both were on their final approaches without any awareness of a conflict.

The Cessna 170 was on short final coming in to land as the skydiver glided across the runway. They were 75 feet above the ground when the pilot saw the skydiver.

“A parachutist dropped down in front of me and was going to land in the center of the approach end of the runway.”

Tim Telford was taking photographs of the skydiver as he was about to touch down and he couldn’t believe what he saw.

The pilot immediately climbed in a desperate attempt to avoid the man who had effectively dropped into his view. However, he wasn’t able to climb over the parachute and his right wing caught the parachute’s suspension lines.

The Cessna pitched up and then down. The skydiver was pulled up into the air like a marionette and then dropped to the ground as the nose of the plane sliced through the strings of his parachute. The aircraft crashed nose-first into the runway.

Unbelievably, both the pilot and the skydiver suffered only minor injuries. They were taken to hospital immediately but suffered only bruises, no broken bones.

The Cessna 170, on the other hand, was a write-off.

The NTSB report categorised the accident as a “collision with terrain/object (non-CFIT)” and “Uncontrolled descent” which I suppose is the closest they have for a mid-air collision of man and plane.

The National Transportation Safety Board determines the probable cause(s) of this accident as follows:
The failure of the pilot and the parachutist to see and avoid each other, which resulted in the airplane’s wing colliding with the parachute’s suspension lines.

The point is that both the pilot and the skydiver were responsibile to “see and avoid” the other traffic in the circuit. The fact that neither of them had a clue that the other one was there means that they were both at fault for the resulting collision.

I’m lucky enough to have never flown into an airfield at the same time as parachutists were dropping. I’ve been a passenger, though, and it’s a case of constant looking out and making sure that you know where the jumpers are and that there’s no chance of getting close to them.

Insight: Parachute-Cessna 170 Midair Collision | Flying Magazine

Even if the high wing of the 170 hadn’t blocked the vision of the pilot — and who looks for parachute traffic on rotation? — there was probably not enough time to get stopped without there being a collision. The pilot, likewise, was surely busy on the arrival over trees and power lines before setting up for the touch and go.

The parachutist likely had few options as well. New chutes are fairly maneuverable compared to old fashioned models, but there’s only so much a chutist could do under the circumstances, especially since he’d just cleared power lines behind him.

It does seem a bit unfair to the pilot, as the skydiver was out of his drop zone and should not have been landing on the active runway. I just think that on short final, you can’t really expect to see someone coming dropping down onto you from above. Your attention is ahead of you, gauging the touchdown point and ensuring that the runway is free of obstructions; I don’t think it would occur to me to be looking up!

The good news is that both pilot and skydiver were fine and said they planned to continue their hobbies despite the scare.

And Tim Telford got the photographs of his life!

02 January 2015

Five Aircraft That Did Not Crash In Thunderstorms

OK, that title is a bit misleading because there are thousands and thousands of aircraft that haven’t crashed in thunderstorms. Even counting only commercial airliners then, according to How many planes and passenger are there in the world? (Livecounter), there are 19,025 of them around the world right now. All of these have not crashed flying through a thunderstorm.

However, there’s a number of aircraft which have flown through thunderstorms and ended up in trouble. Some of them did crash. Others got away with a hard landing. What they have in common is that it wasn’t just the weather. The thunderstorm alone didn’t result in an immediate crash scenario.

Thunderstorms aren’t safe. Aircraft will make great detours in order to avoid flying through one. But in a commercial jet, flying through a thunderstorm doesn’t mean certain death or that the aircraft is going to fall to pieces. A pilot avoids flying through a thunderstorm for three reasons: it’s uncomfortable, it’s unpredictable and it’s a hostile environment for aviation. Aircraft in a thunderstorm are subjected to updrafts, downdrafts, icing, heavy precipitation and lightning, all of which have a level of risk associated with them.

The truth is, flying through a thunderstorm makes the aircraft a hell of a lot more vulnerable. When combined with general risks, such as aircraft structural integrity and human factors, the likelihood of an incident is increased.

Thunderstorm and icing shouldn’t have caused this aircraft to crash

We have to start with the obvious example: Air France flight 447. This has come up a lot when discussing AirAsia flight QZ8501 because there are some core similarities. Both aircraft were flying in thunderstorm conditions. Neither aircraft made a mayday call and in both instances the aircraft simply disappeared from radar. In the case of Air France flight 447, it took a week to find the initial wreckage in the South Atlantic ocean, quite a bit longer than the three days of searching for QZ8501. Finding the black box itself took almost two years but in the shallow waters of the Java Sea, it should be possible to locate the AirAsia black box very quickly: weeks, not years.

Air France flight 447 flew directly through a large system of thunderstorms and the pitot tubes became obstructed by ice crystals. The pitot tubes work as speed sensors and, without this data, the autopilot could not keep control of the aircraft. The aircraft was straight and level: if the flight crew had done nothing at all, the issue would have almost certainly resolved itself in a few minutes. But instead the Pilot Flying pulled the stick back, causing the aircraft to go into a climb and lose speed. The flight crew did not follow the correct procedure for loss of displayed airspeed information and appeared to be very confused by the situation. The confusion in the cockpit lasted until the aircraft crashed. In the most alarming human factors crash of the decade, the Pilot Flying effectively flew the Airbus A330 into the ocean.

Flying too high

Pulkovo Aviation Enterprise Flight 612 was a Tulopev 154 passenger airline which crashed north of Dontesk in 2006. The area was beset by heavy thunderstorms. The flight crew made a mayday call to report that they were experiencing severe turbulence as they approached the storm area. Two minutes later, the aircraft disappeared from radar. However, it was not the turbulence that brought the aircraft down. The flight crew initially tried to outclimb the thunderstorm, hoping to fly over the top, which may have been the same plan as the AirAsia flight had.

That day, it was an impossible task. The thunderstorm front was extremely high, with the clouds peaking out between 40,000 and 50,000 feet. Nevertheless, the flight crew climbed from their cruising altitude of 35,000 feet to their maximum altitude of 39,500 feet. Untrained in flying at high altitudes, they did not appear to have any idea of the risk

The maximum altitude of an aircraft is the highest altitude at which the aircraft can sustain level flight. As they flew through the thunderstorm, they were subjected to a severe updraft which lifted the aircraft to 42,000 feet in a matter of seconds. The angle of attacked increased and the airspeed dropped to zero. The air density was so low that the aircraft was no longer capable of flight. It fell into an unrecoverable spin. This flat spin is where a plane spins on its belly and gains no airspeed. Witnesses on the ground watched the aircraft spin into the ground at low speed but there was not a thing that the pilots could do.

In-flight break up near a storm

There was one incident in Florida where the wings broke off of a single engine aircraft flying in thunderstorm weather in Florida. The Pilatus PC-12 was flying at 26,000 feet when ATC cleared him to deviate right to avoid adverse weather ahead. As the pilot was turning to the right into cloud, the autopilot disengaged.

However, instead of taking control, the pilot ran through a test of the autopilot to see if it was working normally. Meanwhile, the aircraft continued in an uncontrolled turn. While he was testing, the aircraft dropped into a spin.

At 15,000 feet and travelling at about 338 knots, 175 knots above the maximum operating speed of the aircraft, the pilot appears to have finally realised that the aircraft, and not the autopilot, needed his full attention. He pulled back hard on the yoke, trying to yank the aircraft back up to straight and level. He effectively tore his wings off.

Struck by Lightning

In 2003 in Norway, a turboprop was struck by lightning. Generally speaking, lightning has no effect on modern aircraft, however in some instances the aircraft can lose functionality. In this instance, the flight crew were flying to Bodø in a Dornier 228 when they were confronted with a “wall of clouds”. The storm cells were reported as containing heavy precipitation and intense lightning activity.

Another aircraft reported a lightning strike as it was approaching Bodø airport. The Dornier 228 elected to approach from the opposite direction and communicated with Air Traffic Control about the weather and how to avoid the worst of the storms. The aircraft was at 6,000 feet when it entered heavy turbulence and the flight crew commented that the weather radar didn’t seem to be giving correct information. Thirty seconds later, a bolt of lightning hit the baggage door on the nose.

The crew were blinded for about half a minute. When they recovered, they discovered that their elevator, which controls pitch, wasn’t working correctly. By the time that the Captain took control, the aircraft speed had decayed to a stall. The aircraft stopped climbing at 7,800 feet. The flight crew used engine power to increase the airspeed and the aircraft continued its climb to 9,000 feet. The flight crew regained some control of the pitch using the elevator trim and were able to fly the aircraft to Bodø Airport, where they were given clearance to do whatever was needed to get the aircraft onto the ground. On the second attempt, they were able to get the turboprop onto the runway. They landed hard, snapping off the wheels, but there were no injuries.

The investigation found that there was considerable corrosion of the wires in the bonding and that some 30% of the wires may have been damaged previous to the lightning strike. As a result, the aircraft’s bondings couldn’t conduct the electric energy from the lightning and the transfer rod, which connected the elevator to the cockpit, was broken.

Into the Heart of the Storm

In 2002, an aircraft ditched into the river in Indonesia after flying through a severe thunderstorm. Garuda flight 421 was a Boeing 737 on a domestic flight when thunderstorms closed in, leaving the flight crew with nowhere to turn. They encountered severe turbulence and rain and hail clattered against the aircraft. The cockpit voice recording includes the sound of rain hitting the fuselage. The rain and hail is so torrential, it is almost impossible to hear the conversation in the cockpit. The recording was entered into the sound database of the UK Air Accidents Investigation Branch who found that the rain was the heaviest ever recorded on a cockpit recorder. Based on tests, investigators believe that the aircraft encountered hail/water content as high as 18 grams of hail per cubic metre of air. This is the equivalent of flying through 10,000 ice cubes per second.

The hail ingested by the engines was well above the certified levels. The engines both flamed out. The flight crew attempted to relight the engines but as they were still flying through the heavy precipitation, the first attempts didn’t work.

As if the situation wasn’t horrific enough, during the flight crew’s second attempt to relight the engine, the aircraft lost all power. The flight crew couldn’t know it at the time but investigators discovered that there was a fault in the newest cell of the battery: the level of electrolyte in that cells was much lower than the others. This denied the crew any chance of restarting the engines.

In a somewhat miraculous ending to a horrific situation, the captain managed to glide the Boeing 737 onto the Bengawan Solo River, where it came to a halt facing upstream with the nose up and pointing slightly to the right. There was only one fatality on impact, a cabin crew member. The rest of the crew and all of the passengers were rescued with only minor injuries by local villagers.


The point of this is not to strike fear into the hearts of nervous passengers but to try to explain how thunderstorms are dangerous and why pilots and air traffic control will work together to avoid them. Stormy weather rarely ends in disaster for commercial jets. In those instances where it is a contributing factor, we almost always see some other issue: bad training, human error or maintenance issues which are the actual cause of the crash.

So when you hear about thunderstorms ahead, don’t panic. Flying through a thunderstorm doesn’t make an aircraft spontaneously wreck like hitting an iceberg at sea.