You are browsing category: Accidents and Incidents
13 June 2014

Remote Control Boeing

In the aftermath of a mystery such as the disappearance of MH370, conspiracy theories always thrive. This one is a big one, as it involves multiple governments, corporate America and the US State Department. Malaysia Airlines flight 370 was not diverted by anyone on board, according to this theory, but was taken over remotely. There are two primary variations. First, that the US Military interfered with the flight, jamming the frequencies as remote controls were used to turn the aircraft away from Vietnamese airspace to land in an unknown location. Second, that criminals have gained control of this technology which is pre-installed into aircraft all over the world. This group of unknown terrorists was able to hack into the secret system to gain control of the aircraft and divert it from its path, without anyone on board able to stop them.

A problem with this theory is that any theoretical remote control of the aircraft would not include the ability to turn off the ACARS, the transponder and the radio. There are fighter jets that carry the ability to jam military radar, such as the EA-18G Growler. However, it would take multiple Growlers to jam the Boeing 777′s signal as it continued on its diversion. This means that it wouldn’t have been terrorist hijackers, who would struggle to get a single military jet from the US Navy, let alone a contingent of them. This narrows the possibility to government military interventions by someone who has the technology but doesn’t have access to Boeing 777s, which doesn’t seem likely. Finally, air traffic controllers on the ground would at least be aware that there was interference, even if they didn’t recognise that the signal was being jammed. The Boeing would not simply vanish from the secondary radar systems.

Scientific American put it best:
How Do You Hide a Boeing 777? – Scientific American

Other theories imply that electronic warfare techniques—jamming, spoofing or degrading signals—might be involved in MH370’s disappearance. Such technologies can prevent enemy fire control radars from getting a fatal lock on aircraft, but they are not a David Copperfield magic trick. They don’t make planes disappear, especially not large commercial airliners, from the screens of air traffic control systems.

I have not yet found a verifiable description of how the assailants could have made the aircraft disappear before the diversion began. For the sake of argument, however, I’ll ignore this issue and focus on the idea of the remote control Boeing.

Obviously, it is possible to fly planes by remote control. Unmanned aerial vehicles, known as drones, are remotely piloted aircraft with no humans on board. The first known military usage of the UAV was 1849. The Austrians besieged Venice and then launched the first air raid in history. The Austrians filled hot air balloons with bombs set to go off in twenty-three minutes. They were then launched from a war steamer where the prevailing wind blew them over Venice. UAVs are used all around the world but they are generally custom designed. Boeing have designed twelve models for use as unmanned aircraft and have two high-altitude, long-endurance UAVs under development: the solar-electric Solar Eagle and the hydrogen powered Phantom Eye.

But that’s not the same thing as taking over a commercial aircraft meant to be controlled by an aircrew with assistance from a Flight Management System. In April 2013, Business Week published an expose to state that it was possible to hack into the flight management system of an aircraft using only an android. However, the FAA were swift to deny that there was any danger. The hacking technique described did not work on certified flight hardware and would not pose a flight safety concern. No aircraft has ever actually been hacked in such a way that it could be used to divert the aircraft without complicity from the flight crew. If someone were to attempt this, it would almost certainly be on the computer-intensive Airbus, not the Boeing with its higher reliance on manual inputs. Besides, if someone were to hack into the Flight Management System to take control of an aircraft, all the flight crew would need to do is turn it off and continue the flight without it. Right now, the technology to remotely take over some random flight management system against the will of the flight crew does not exist.

However, Boeing are definitely interested in developing the ability to take control of their aircraft remotely. In 2006, Boeing applied for the following patent:

Patent US7142971 – System and method for automatically controlling a path of travel of a vehicle

The method and system for automatically controlling a path of travel of a vehicle include engaging an automatic control system when the security of the onboard controls is jeopardized. Engagement may be automatic or manual from inside the vehicle or remotely via a communication link. Any onboard capability to supersede the automatic control system may then be disabled by disconnecting the onboard controls and/or providing uninterruptible power to the automatic control system via a path that does not include the onboard accessible power control element(s).

This system is specifically designed to protect the aircraft against a hijack. Since 9/11, the security of the flight deck has been much improved but the patent documentation explains that people are the weakest factor. The security door leading to the cockpit is still under human control and if one of the flight crew is tricked or threatened, a terrorist can still gain access. Armed guards or air marshals on flights may be overpowered or threatened. The pilot may allow access to the cockpit out of fear of harm to the passengers or crew.

[There is a need for] a technique that conclusively prevents unauthorized persons from gaining access to the controls of a vehicle and therefore threatening the safety of the passengers onboard the vehicle, and/or other people in the path of travel of the vehicle, thereby decreasing the amount of destruction individuals onboard the vehicle would be capable of causing. In particular, there is a need for a technique that ensures the continuation of the desired path of travel of a vehicle by removing any type of human decision process that may be influenced by the circumstances of the situation, including threats or further violence onboard the vehicle.

Here’s a key point: this patent is to protect the entire aircraft against trickery, coercion or threats of violence. It relies on being able to control the aircraft without human intervention of any kind. For example, under predetermined conditions such as an unexplained diversion from the flight plan, a signal is sent which sets an uninterruptable autopilot mode on the aircraft. The aircraft then follows pre-determined control commands to navigate away from populated areas and to a designated landing site where the aircraft would attempt an automatic landing. As described in the patent, the system would not allow someone on the ground or in another aircraft to take control of the aircraft and send it to a new location – the most they could do is set off the emergency evasive manoeuvre to follow the preset pattern.

Another point: this is a patent. The theory goes that the technology not only exists but that Boeing have secretly been putting this system into place in aircraft all over the world. Could this remote-control technology be included in every aircraft? Well, from a commercial point of view, it seems a bit spurious. I can certainly imagine the US military wanting these controls put into aircraft, making it impossible to take control of an aircraft through threats of violence. And yes, I am absolutely convinced that there are aspects of the War on Terror which are not publicly known.

And yet, I find it hard to believe a conspiracy of this magnitude. Boeing’s financial situation is based on the fact that they are selling aircraft to airlines all over the world. Would they really risk ceding the entire international market to Airbus by inserting this technology against the will of their customers? And is it reasonable to believe that not a single engineer or maintenance company would have noticed these additional systems in place which were undeclared and undocumented?

The main argument in favour of this on websites which are presenting the remote control Boeing scenario as likely is the Boeing controversy over the QRS-11 chip.

Here’s an example of the conspiracist explanation:

Are Boeing fitting their aircraft with illegal devices that could enable terrorists to remotely hijack airliners and crash them into high profile targets? In light of what happened on 9/11, Boeing’s blanket denial that this practice has taken place is both highly suspicious and a threat to national security . . .

According to the Seattle Times, “The QRS-11 chip, made by a unit of BEI Technologies in Concord, Calif., is just over 1-½ inches in diameter and weighs about 2 ounces. It sells for between $1,000 and $2,000. Described as “a gyro on a chip,” it is used to help control the flight of missiles and aircraft.” . . .

Recent newspaper reports discussing these devices and the policy to have them in all airliners within three years assure us that they would prevent another 9/11 style outrage – but because anysuch system is vulnerable to hacking allied with the fact that pilots have no way of overriding the autopilot, not even with secure access codes, this only increases the chances of another 9/11 style attack.

One frustrating aspect of these types of theories is that bizarre conclusions are twisted into half-truths in such a way that it isn’t immediately obvious what is true and what is not. Quoted in the Seattle Times, and every other reputable source about the QRS-11 chip controversy, is that the US State Department wanted to stop the aircraft being installed with this chip, as opposed to having a policy to secretly install them into all airliners.

So the factual part of this explanation is that the QRS-11 Gyrochip exists, it is well-documented, it is not a secret and that there was controversy. But it was quite the opposite of “secretly installing it into aircraft sold overseas”.

The QRS-11 is a coin-sized guidance chip used as a part of a commercial navigation system made by French company, Thales. These navigation systems are used by Boeing, Airbus, Bombardier and other aircraft makers.

The US state department fears that the QRS-11 chip could be used in Chinese guided missiles, although the chip was not developed for military applications but was designed as a commercial product. It has been used within some military missile systems because the technology is extremely affordable. Thus, the QRS-11 chip was determined a munitions item, which require a specific presidential waiver from the White House for commercial export to China.

US State department then brought charges that Boeing had embedded the chip in 96 planes sold to Beijing, without the permission of the US State Department. Boeing fought back. “[The gyrochip] is a low-value card that they could find other ways to buy,” he said. “If they want to buy a 737 to pull that part out, I’d love them to buy more 737s.”

Boeing and Airbus continue to sell the chip as a part of their instrument boxes – there’s no secret about it – and Boeing argues that the fines and sanctions in this instant are the overzealous application export controls that threatened to derail overseas sales. That is to say, they rank their position in the global marketplace over US State department sanctions. There’s no question that this chip is being secretly installed in order to gain remote control of aircraft to avoid another 9/11 scenario. The QRS-11 chip is a complete red herring.

If the system exists at all, it is undocumented. Then we still have to presume either that a terrorist group has access to top secret US technology and military aircraft (and yet wants control of a Boeing 777 for nefarious purposes) or that the US has taken the aircraft for unknown reasons, willing to brave an international scandal in order for secret reasons. Without any sort of identifiable motive, I find both of these scenarios hard to believe.

Finally, there’s a question of timing. The Boeing patent for this system was put forward in 2006. The Boeing 777 in question, NM-MRO, was delivered new to Malaysia Airlines in May 2002. Even if one believes the theory that after 9/11, the US State Department started an initiative to install remote control capabilities into every commercial aircraft, the aircraft predates the patent by four years. Even if the technology were a reality, it would not yet have been installed to NM-MRO.

Effectively, in order to believe that remote control abduction of the Boeing 777 explains the disappearance of Malaysia Airlines flight 370, you must accept multiple conspiracies and accept that most everything we know about commercial airliner technology is wrong. It’s not impossible but I find it highly improbable.


This is an update to my book The Mystery of Malaysia Airlines Flight 370, which offers a detailed analysis of the flight and disappearance of MH370. If you are interested in reading more, you can buy it here.

09 May 2014

Ejection 0.8 Seconds Before Impact

The incident happened in 2003 but I only just saw the photograph and video on /r/aviation last week.

Thunderbird no. 6 ejection at Mountain Home airshow in 2003. Photo by SSgt Bennie J. Davis III – Still Photographer, USAF

This looks like a photoshopped picture or a stunt still from of a Hollywood movie but it is 100% legitimate.

The photograph was taken at the Mountain Home Air Force Base in Idaho, where the Thunderbirds were putting on an aerial display. The photographer snapped this photograph of 31-year-old Captain Chris Stricklin from the tower, capturing the exact moment when Captain Stricklin ejected from the F-16. Stricklin ejected less than a second before the F16 hit the ground.

The Thunderbirds are the air demonstration squadron of the United States Airforce, the equivalent of the Red Arrows of the UK Royal Air Force or the Blue Angels of the US Navy.

The Thunderbirds were formed in 1917 as an operational squadron. In 1953 they became the aerobatic display team in 1953, taking the name Thunderbirds from the southwestern US folklore around Luke Air Force Base, Arizona. They became the world’s first supersonic aerial demonstration team in 1956 but had to stop after the FAA banned all supersonic flight at air shows.

They tour the US and the world to perform air demonstrations but they apparently are able to rapidly integrate into an operational fighter unit. They fly F16 Fighting Falcons.

Their standard demonstration is documented on Wikipedia:

From the end of the runway the 4-ship Thunderbird team get ready to begin their take-off roll with the words “Thunderbirds, let’s run em up!” being retransmitted from the team leader’s mic through the PA system for the crowd to hear.

Diamond: Historically, as Thunderbirds 1 through 4 lift off, the slot aircraft slips immediately into position behind 1 to create the signature Diamond formation. Thanks to the 2009 upgrade to the Block 52, the Diamond now has more than enough thrust to continue to climb straight up into their first maneuver, the Diamond Loop.

Solos: Thunderbird 5 takes to the air next performing a clean low altitude aileron roll followed by 6 who performs a split S climbing in a near vertical maneuver rolling over and diving back toward show center pulling up just above the runway and exiting in the opposite direction.

Much of the Thunderbirds’ display alternates between maneuvers performed by the diamond, and those performed by the solos. They have a total of 8 different formations: The Diamond, Delta, Stinger, Arrowhead, Line-Abreast, Trail, Echelon and the Five Card. The arrowhead performs maneuvers in tight formation as close as 18 inches Fuselage to Canopy separation. They perform formation loops and rolls or transitions from one formation to another. All maneuvers are done at speeds of 450-500+ mph.

Stricklin was flying Thunderbird 6, performing the Split S manoeuvre as a part of his solo performance with the Thunderbirds.

The Split S (known in the RAF as the Half Roll and in the Luftwaffe as the Abschwung) is a dog-fighting technique used to disengage from combat. The pilot half-rolls his aircraft so that he’s flying upside down and then dives away in a descending half-loop, pulling out so that he’s flying straight and level in the opposite direction.

At the Mountain Home airshow as that Captain Stricklin did not have enough vertical space to pull out of the half-loop, leading to his last-second ejection. He had performed the Split S manoeuvre over two hundred times.

The astounding photograph was taken by a professional photographer at the control tower and was swiftly leaked to the public despite the fact that the military immediately locked down into an investigation. The photographer posted on the f-16.net message boards.

Thunderbird crash photo (head-on)

I have noticed all over the internet the shot I had taken of the Thunderbird crash at Mountain Home AFB, ID and though I am not at liberty to share the photo; it is out there. I would like to end some speculation and let you know the photo is real.

I’m a Still Photographer for the USAF and I was stationed at MHAFB during the air show. I was on the catwalk of the tower at Mtn Home along with another photog (video) and about seven other (military) spectators. I have shot the T-birds from the tower before and I was pretty excited to do it again (the sky was perfect blue). I followed Thunderbird 6 from takeoff and watched as he pulled into his maneuver. I then noticed something seemed to be wrong, his direction was a little off; he was pulling out and heading right towards the tower. At this point I figured two things: 1. He’s either going to fly past this tower and we’ll feel the heat or 2. This is going to be ugly… I waited for the aircraft to level and clicked the shutter, what I saw through the lens will never go away…

At the same time as I shot I seen a flash of light and horrific sound. I was shooting on high speed continuous and the next couple frames were a ball of fire and my feet, right before I ran. We all ran to the other side of the tower, I tried to get everyone in along with my partner and finally made it in myself. By the time we got inside the 16 had stopped sliding and rested about 100 ft in front of the tower. I then continued documenting the work of our base firefighters as they put out the flames. It was an experience and though I can’t officially make any comments to the matter, I would like to say Capt Stricklin saved lives… enough said.

For those who are wondering the image is not cleared for public release.

Also for those fellow photogs I was shooting with a D1x with a 300mm, 2.8 @ 1000 and 2000

Thanks,
SSgt Bennie J. Davis III
Still Photographer, USAF

The photograph was officially released a few days later, along with the video from the cockpit just before the crash.

Redditors have pointed out that his left arm twitches twice towards the eject lever before committing to the action.

Captain Stricklin sustained only minor injuries. The $20.4 million F16 was destroyed.

This video shows the view from the crowd:

The investigation results were released as a press release a year later:

PRESS RELEASE — Secretary of the Air Force, Directorate of Public Affairs

Release No. 0121045 – Jan 21, 2004

Thunderbirds Accident Report Released

LANGLEY AIR FORCE BASE, Va. – Pilot error caused a U.S. Air Force Thunderbirds F-16 aircraft to crash shortly after takeoff at an air show Sept. 14 at Mountain Home Air Force Base, Idaho.
The pilot ejected just before the aircraft impacted the ground.

According to the accident investigation board report released today, the pilot misinterpreted the altitude required to complete the “Split S” manoeuvre. He made his calculation based on an incorrect mean-sea-level altitude of the airfield. The pilot incorrectly climbed to 1,670 feet above ground level instead of 2,500 feet before initiating the pull down to the Split S manoeuver.

When he realized something was wrong, the pilot put maximum back stick pressure and rolled slightly left to ensure the aircraft would impact away from the crowd should he have to eject. He ejected when the aircraft was 140 feet above ground — just eight –tenths of a second prior to impact. He sustained only minor injuries from the ejection. There was no other damage to military or civilian property.

The aircraft, valued at about $20.4 million, was destroyed.

Also, the board determined other factors substantially contributed to creating the opportunity for the error including the requirement for demonstration pilots to convert mean sea level and above ground level altitudes and performing a manoeuvre with a limited margin of error.

For more information, contact the ACC Public Affairs office at (757) 764-5007 or e-mail acc.pam@langley.af.mil.

The QNH (sea-level altitude) vs QFE (altitude above the ground) is thus seen as a contributing factor.

Stricklin’s home base at Nellis is at 2,000 feet whereas Mountain Home is at 3,000 feet, so the altitude he selected would have been correct at his home base.

The contributing factor of requiring pilots to convert sea-level altitude information to altitude above ground for radio calls was immediately dealt with by the Air Force. Thunderbird pilots now call out MSL (Mean Sea Level) altitudes rather than AGL (Above Ground Level) altitudes and must climb an additional one thousand feet before performing the Split S manoeuvre.

A bystander reported that after the ejection, Stricklin stood silently by the canopy of the aircraft. Then he threw his helmet at the ground and stomped over to the wreckage. He knew that his time as a Thunderbird pilot was over.

However, I was pleased to see that in 2009, Stricklin was commended for his work on safety programmes in the USAF:

2009: CSAF Individual Safety Award – Lt. Col. Christopher Stricklin, 14th Flying Training Wing, Columbus Air Force Base, Miss.
Colonel Stricklin led and managed flight, ground, and weapon safety programs for 3,000 personnel, including 20 essential safety personnel who provided over 3,120 annual hours of on-call service. As a direct result of his efforts, flight mishaps were reduced in nearly every category; down 50 percent in Class A, 70 percent in Class C, 44 percent in Class E, and 50 percent in Controlled Movement Area Violations.

It makes sense to me; if I’d been that close to smashing into the ground, I’d be pretty thoughtful about flight safety too!

02 May 2014

The Alien Abduction of Frederick Valentich

Frederick Valentich was 20 years old when he disappeared. His father believed that one day, the aliens would bring him back. Australia’s most famous case of alien abduction, Valentich’s lost flight is how the Bass Strait Triangle got its nickname.

Valentich's father holds a photograph of his son

Valentich was a pretty average Australian kid. His dream was to become a professional pilot: he applied to the Royal Australian Air Force twice and then settled for the Air Training Corps. He was studying part-time to become a commercial pilot but struggled with the examinations. He had a private pilot’s licence with about 150 total hours flying time and had completed his night rating.

The boy was enthralled with UFOs and the idea of an alien invasion. Shortly before he disappeared, Valentich claimed that he had seen a flying saucer, moving away very fast. His father said that his son was very worried about what would happen if the extraterrestrials attacked.

It was a sunny evening on the 21st of October in 1978, when Valentich booked a training flight in VH-DSJ, a rental Cessna 182 light aircraft at Moorabbin Airport near Melbourne. The weather forecast was good. He filed a flight plan for a trip to King Island, one of the islands of Tasmania.

The Bass Strait lies between Victoria and Tasmania. Pilots always try to reduce the amount of time flying over water, so rather than fly straight across the strait from Melbourne, Valentich’s routing would have taken him southwest along the coast to Cape Otway to then cross the strait to King Island, making it an 85-kilometre (50-mile) stretch across the water. Following this standard route from Moorabbin Airport to King Island Airport, it is a 90-min flight.

It’s not clear why Valentich was going to King Island. He told his family and his girlfriend that he was going there to pick up some crayfish. At Moorabbin he said that he was going to bring some friends back and took four life jackets with him for the return flight. He’d mentioned to his girlfriend that he’d be back by 19:30, clearly not possible with a 18:00 departure.

Another odd detail was that he didn’t phone King Island airport to tell them that he was inbound to them. The small airfield is uncontrolled and there would be no one there after sunset; he couldn’t land there unless he called to ask them to turn the runway lights on. He had the fuel to go there and back without stopping: the round-trip journey is about 235 kilometres (145 miles) and would take about three hours in the Cessna, well within its range. There was no danger, just that he was embarking on a pointless journey. It was simply odd, especially in combination with his unclear plans, and could imply that he had no intention of going to King Island that evening. He might have been up to something nefarious, smuggling along the coast. Maybe he wanted to be alone in the dark looking for UFOs and didn’t want to admit it on a flight plan. Or, it could have been a simple oversight, one that he would have been embarrassed about when he drew near the airport and realised there was no one there. All we know for sure is that he never made that phone call.

18:10 VH-DSJ was refuelled to capacity, giving it 300 minutes flight time.

18:19 Valentich departed Moorabbin Airport and flew southwest as per his flight plan.

18:43 The sun set. Valentich was flying in the dusk over water. Night flying requires a separate rating for visual flights in Australia because it can be disorienting. Flying at night over water is especially so, as the lack of lights means that there is no way of orientating yourself to the ground. So as the sunlight faded, Valentich would have seen a sky full of stars above and darkness below.

19:00 Valentich contacted Melbourne Air Traffic Control and gave his location as over Cape Otway on the south coast of Victoria. Cape Otway has a light-house, which makes it an easy visual reference point. He confirmed that he was proceeding to King Island. His flight plan showed that he would remain below 5,000 feet and that he had estimated it would take him 41 minutes to fly to Cape Otway and then a further 28 minutes from Cape Otway to King Island. He was right on schedule.

Valentich identifies himself by the final letters of the call sign of the aircraft, VH-DSJ. Melbourne Flight Service Unit use this callsign to make it clear who they are speaking to or, when used on its own, simply to acknowledge that the controller has understood what the pilot said.

19:06:14 VH-DSJ (Valentich): Melbourne, this is Delta Sierra Juliet. Is there any known traffic below five thousand?

19:06:23 Melbourne Flight Service Unit: Delta Sierra Juliet, no known traffic.

19:06:26 VH-DSJ (Valentich): Delta Sierra Juliet. I am… seems to be a large aircraft below five thousand.

19:06:46 Melbourne Flight Service Unit: Delta Sierra Juliet, what type of aircraft is it?

19:06:50 VH-DSJ (Valentich): Delta Sierra Juliet. I cannot affirm. It is four bright… it seems to me like landing lights.

The obvious first question is: what did Valentich see out there in the dark?

After the event, some people believed that there was nothing there at all. There were rumours that the whole whole thing was simply a hoax and Valentich was having a laugh before purposefully disappearing. But he had no reason to go and all of the evidence points to the fact that Valentich truly believed in extra-terrestial space craft. The air traffic controller said afterwards that he was convinced that it wasn’t a joke. He was sure that Valentich saw something.

19:07:32 VH-DSJ (Valentich): Melbourne, this is Delta Sierra Juliet. The aircraft has just passed over me at least a thousand feet above.

19:07:43 Melbourne Flight Service Unit: Delta Sierra Juliet, Roger. And it is a large aircraft? Confirm.

19:07:47 VH-DSJ (Valentich): Er, unknown, due to the speed it’s travelling. Is there any air force aircraft in the vicinity?

19:07:57 Melbourne Flight Service Unit: Delta Sierra Juliet, no known aircraft in the vicinity.

It’s possible that the lights were another aircraft small enough not to show up on Melbourne’s radar but it seems to be travelling too fast for that, unless it was military. There were no reports of military aircraft in the area.

Meanwhile, there were a number of reports of UFOs that night. Mt Stromlo Observatory advised that the night of the 21st was the peak of a meteorite storm and they recorded 10-15 meteorite sightings per hour. The uptick in UFO sightings was expected: studies show that 29% of UFO reports are the result of bright stars and planets and a further 9% are explained by meteors. The UFO sightings that night were almost certainly reactions to the meteorite storm. A meteorite might also explain a fast moving craft in the sky. However the meteorite storm doesn’t explain the four clear lights that Valentich reported over him.

19:08:18 VH-DSJ (Valentich): Melbourne, it’s approaching now from due east, towards me.

19:08:28 Melbourne Flight Service Unit: Delta Sierra Juliet.

19:08:42 —: [open microphone for two seconds]

19:08:49 VH-DSJ (Valentich): Delta Sierra Juliet. It seems to me that he’s playing some sort of game. He’s flying over me two, three times at a time, at speeds I could not identify.

19:09:02 Melbourne Flight Service Unit: Delta Sierra Juliet, roger. What is your actual level?

19:09:06 VH-DSJ (Valentich): My level is four and a half thousand. Four Five Zero Zero.

19:09:11 Melbourne Flight Service Unit: Delta Sierra Juliet and confirm you cannot identify the aircraft.

19:09:14 VH-DSJ (Valentich): Affirmative.

19:09:18 Melbourne Flight Service Unit: Delta Sierra Juliet, roger. Standby.

19:09:28 VH-DSJ (Valentich): Melbourne, Delta Sierra Juliet. It’s not an aircraft, it is… [open microphone for five seconds]

19:09:46 Melbourne Flight Service Unit: Delta Sierra Juliet, can you describe the, er, aircraft?

19:09:52 VH-DSJ (Valentich): Delta Sierra Juliet. As it’s flying past it’s a long shape. [open microphone for three seconds] Cannot identify more than that it has such speed. [open microphone for three seconds] Before me right now, Melbourne.

Some of what he saw could be explained by fast-moving meteorites out of the corner of his eye. However, that doesn’t account for a hovering aircraft directly above him. James McGaha and Joe Nickell of the Committee for Skeptical Inquiry believe that they know what he saw.

The Valentich Disappearance: Another UFO Cold Case Solved – CSI

As it happens, a computer search of the sky for the day, time, and place of Valentich’s flight reveals that the four points of bright light he would almost certainly have seen were the following: Venus (which was at its very brightest), Mars, Mercury, and the bright star Antares. These four lights would have represented a diamond shape, given the well-known tendency of viewers to “connect the dots,” and so could well have been perceived as an aircraft or UFO. In fact, the striking conjunction was shaped as a vertically elongated diamond, thus explaining Valentich’s saying of the UFO that “it’s a long shape.”

19:10:07 Melbourne Flight Service Unit: Delta Sierra Juliet, roger. And how large would the, er, object be?

19:10:20 VH-DSJ (Valentich): Delta Sierra Juliet, Melbourne. It seems like it’s a stationary. What I’m doing right now is orbiting and the thing is just orbiting on top of me. Also it’s got a green light and sort of metallic-like. It’s all shiny on the outside.

It’s not clear what Valentich might have meant when he said that was orbiting, possibly that he was flying in a holding pattern in order to get a better look at the “object”. What’s absolutely clear is that his entire attention is taken by the unidentified flying object. The mention of the green light is new.

19:10:48 VH-DSJ (Valentich): Delta Sierra Juliet…[open microphone for five seconds] It’s just vanished.

19:10:57 Melbourne Flight Service Unit: Delta Sierra Juliet.

19:11:03 VH-DSJ (Valentich): Melbourne, would you know what kind of aircraft I’ve got? Is it a military aircraft?

This wasn’t really a conversation that he needed to be holding right at that moment. But Valentich’s curiosity was peaked.

19:11:08 Melbourne Flight Service Unit: Delta Sierra Juliet, confirm that the, er, aircraft just vanished?

19:11:14 VH-DSJ (Valentich): Say again?

19:11:17 Melbourne Flight Service Unit: Delta Sierra Juliet, is the aircraft still with you?

19:11:23 VH-DSJ (Valentich): Delta Sierra Juliet it’s ah no…[open microphone for two seconds] Now approaching from the south west.

There’s a dangerous configuration that has killed many pilots, especially visual pilots who have not been trained to fly by instruments. It’s known as the graveyard spiral or suicide spiral and is common in poor weather conditions…and at night. The spiral is caused by well-known sensory illusions that affect us in aircraft. The pilot becomes disoriented and loses the ability to judge the orientation of the plane. He believes he is flying straight, with the wings level but in fact, he is pulling the yoke slightly, leading the aircraft into a bank. The aircraft starts to to fly a large circle and, if the pilot does not recognise the situation, the plane will begin a gentle spiral towards the ground.

Graveyard spiral – Wikipedia

For example, a pilot who enters a banking turn to the left will initially have a sensation of a turn in the same direction. If the left turn continues (~20 seconds or more), the pilot will experience the sensation that the airplane is no longer turning to the left. At this point, if the pilot attempts to level the wings this action will produce a sensation that the airplane is turning and banking in the opposite direction (to the right). If the pilot believes the illusion of a right turn (which can be very compelling), he/she will re-enter the original left turn in an attempt to counteract the sensation of a right turn. If the pilot fails to recognize the illusion and does not level the wings, the airplane will continue turning left and losing altitude.

The graveyard spiral is initiated by an unintentional turn or a return to level flight after an intentional prolonged turn.

Basically, you get disoriented and put the plane into a slight bank. Now that feels straight and level to you, so if you correct the turn, you feel like you are turning. So you don’t. And the plane very slowly and gently flies in circles that get increasingly tighter as the aircraft descends

Valentich and plane

Valentich said that he was orbiting and “the thing” was just orbiting on top of him, so he was probably in a low, slow turn. He did not have much experience with night flights and only had the most basic instrument training. It was dark and he was flying over water, with no horizon to help him to orient himself. He initially saw four white lights but then mentions a green light. His right wing-tip has a green light on it, a navigation light. What he’s seeing points to an aircraft that is not flying straight and level, it’s slowly spiralling down.

19:11:52 VH-DSJ (Valentich): Delta Sierra Juliet. The engine is, is rough idling. I’ve got it set at twenty three/twenty four and the thing is coughing.

19:12:04 Melbourne Flight Service Unit: Delta Sierra Juliet, roger. What are your intentions?

19:12:09 VH-DSJ (Valentich): My intentions are ah to go to King Island. Ah, Melbourne, that strange aircraft is hovering on top of me again. [two seconds open microphone] It’s hovering and it’s not an aircraft.

His engine is running rough but instead of wondering why this is, he’s still staring out the window at the UFO. Even when asked directly what his intentions are, he doesn’t consider breaking off the water crossing as a result of his engine trouble.

The rough engine coughing certainly sounds like a fuel issue. If he’s flying in a tightening spiral or even upside down, that will decrease the fuel flow, leading to exactly those symptoms. What Valentich needs to do right now is stop watching his UFO and fly the plane.

19:12:28 VH-DSJ (Valentich): Delta Sierra Juliet, Melbourne. [17 seconds open microphone]

There were no further transmissions.

Melbourne declared a Search and Rescue alert immediately and at 19:33, when Valentich did not arrive at King Island, an intensive air, sea and land search started. They scoured the area for four days but were unable to find any trace of the aircraft.

Five years later, an engine cowl flap was discovered on Flinders Island, washed in from the sea. It was positively identified as coming from a Cessna 182 of the same batch as the rental aircraft that Valentich was flying. No other trace was ever found.

Frederick Valentich’s father joined the Victoria UFO Research Centre and continued to hope that his son was alive and abducted by aliens until his death in 2000.

And yet, there’s strong evidence that the young man’s belief in the extra-terrestrial led to his death. It appears that what should have been a brief distraction became a tragic event.


If you found this post interesting, you should pick up my new book, a detailed analysis of MH370: The Mystery of Malaysia Airlines Flight 370

28 March 2014

MH370 Search: Beacons and Pingers and Locators

The press is continuing to speculate as to causes and criminals, but I think we’re all clear now that until we find the aircraft itself, we won’t know what happened. Of course what everyone is hoping for is that we find the “black box” and that it has useful information on it.

A black box is actually a bright-orange container designed for high visibility, which houses the cockpit voice recorder and the flight data recorder. The black box is housed at the rear of the aircraft, on the presumption that following the initial impact, the rear of the aircraft will be moving at a slower speed. The black box is engineered to survive a catastrophe, including crashing down to the bottom of the South Indian Ocean. It is extremely likely that if we find the black box, the contents will be safe and we will get at least some data on the final flight of Malaysia Airlines Flight 370.

However, finding the black box is proving difficult because we simply don’t know where the aircrash was.

Aircraft are fitted with distress radio beacons, often referred to in aviation as ELTs (Emergency Locator Transmitter) or more colloquially as pingers. These beacons send out a distress signal every second in order to help search and rescue determine the location of a downed aircraft. Traditionally, a distress beacon would interface with the International Cospas-Sarsat Programme, a search and rescue satellite system established in 1979 by Canada, France, the United States and the former Soviet Union. However, it isn’t possible for a distress radio beacon to broadcast to a satellite from underwater. The point of the distress beacon was to find survivors as quickly as possible. It was not intended to discover sunken wreckage at the bottom of the ocean.

In 1961, the UK Ministry of Aviation focused on how to locate and recovery aircraft lost in deep water, with the result that commercial aircraft since 1988 carry mounted acoustic beacons for underwater use. All modern commercial jets now carry an Underwater Locator Beacon (ULB). In the photograph above, the Underwater Locator Beacon is the small cylinder on the far right.

A ULB is powered by a lithium-ion battery. Once the beacon is immersed in water, the water closes an electric circuit and the beacon begins to transmit. The ULB will transmit a “ping” at an acoustic frequency of 37.5kHz every second at full power for 30 days. The detection range is 1-2 kilometres in normal conditions and 4-5 kilometers in good conditions. After the 30 days, the ULB will continue to transmit but the range will reduce day by day until it stops altogether. How long it will continue to transmit is based on various factors, including the environment it is in and the age of the beacon and the battery itself which is generally replaced every few years.

After the Air France Flight 447, the Bureau d’Enquêtes et d’Analyses (the French Bureau of Enquiry and Analysis for Civil Aviation Safety) recommended that the ULBs’ transmission period be increased to 90 days.

Honeywell Aerospace, the producers of the black box on Malaysian Airlines Flight 370, have confirmed that the cockpit voice recorder will only have the final two hours of the flight on it. However, the flight data recorder will allow us to recreate the flight itself and the wreckage itself may help to unravel the mystery. The ULB will be attached to the black box and we’re hoping it will lead us to the wreckage of the aircraft in the South Indian Ocean.

Hydro International describes deep-water black box retrieval as “A game of hunt-the-pinger against the clock.”

Deep-water Black Box Retrieval – November 2009, Volume 13, Number 09 – Archive – Hydro International

Localising a pinger from the surface in shallow water is relatively easy, as described above. This task becomes increasingly difficult as water depth increases, however, because the direction is affected by both the horizontal bearing and the depression angle to the beacon (Figure 2). When trying to locate a pinger beacon in deep water, the detection equipment should be installed on a self-propelled underwater vehicle (either an ROV/AUV or a manned submersible). However, this presupposes that the position is already known to within the maximum 2-3km detection range. When aircraft debris is scattered over a large area, as with the recent Air France 447 accident off the Brazilian coast in depths up to 3.5km, a grid search must be conducted using underwater acoustic listening equipment. This equipment must be deployed as deep as possible to overcome the bearing/depression angle conflict (such as on the nuclear submarine described in a news feature in the July 2009 issue of Hydro International). The additional time required to mobilise and carry out this search highlights the second major limitation of fitting CAT aircraft with pinger beacons: that of their limited operational life.

Last week, two different search mechanisms were moved into place in the South Indian Ocean: a Towed Ping Locator 25 and a Bluefin-21, an Autonomous Underwater Vehicle.

The Towed Pinger Locator 25 will be operated by a team on the Royal Australian Navy supply ship Seahorse Standard. The ray-shaped sensor searches for emergency relocation pingers on downed aircraft up to a maximum depth of 20,000 feet.

The US Navy Fact File: Towed Pinger Locator 25

The system consists of the tow fish, tow cable, winch, hydraulic power unit, generator, and topside control console, although not all of these components are required on every mission. Navigation is accomplished by using algorithms incorporating the amount of cable in the water, the depth indication from the pressure sensor and other parameters. The generator provides electrical power for the system or power from the support platform can be used if it is compatible. The tow fish carries a passive listening device for detecting pingers that automatically transmit an acoustic pulse.

The Pinger Locator is towed behind a vessel at slow speeds, generally from 1 – 5 knots depending on the depth. The received acoustic signal of the pinger is transmitted up the cable and is presented audibly, and can be output to either a Oscilloscope, or Signal Processing Computer. The operator monitors the greatest signal strength and records the navigation coordinates. This procedure is repeated on multiple track lines until the final position is triangulated.

The Bluefin-21 automous underwater vehicle is a sonar-equipped robot used to search for transmissions from the Underwater Locator Beacon as well as detect debris on the ocean floor in an attempt to find the wreckage of MH370. The torpedo-shaped vehicle can operate almost up to three miles underneath sea-level and uses an acoustic camera to provide very high resolution sonar still imagery and video.

Diameter 53 cm / 21 in
Length 493 cm / 16.2 ft
Weight (Dry) 750 kg / 1,650 lb
Depth Rating 4,500 m / 14,763 ft
Endurance 25 hours at 3 knots
Communications RF, Iridium and acoustic;
Ethernet via shore power cable
Data Management 4 GB flash drive for vehicle data
Plus additional payload storage

Last week, I was a guest on a radio show where I explained that trying to find the aircraft wreckage underwater with these locators was looking for a needle in a haystack. “It’s worse than that,” interrupted an ex-NTSB investigator. “We don’t even know where the haystack is yet.” That’s a pretty perfect summary of the situation.

The limited range and speed of the Towed Pinger Locator 25 and the Bluefin-21 mean that they are of little use in a large area. A vessel towing a pinger can search about 15 square nautical miles per hour in depths less than 2 km. As the water gets deeper, the grid-search becomes slower.

The current search area, moved today to a zone about 1,850 km west of Perth, is approximately 319,000 km². Even with two ships searching to a depth of less than 2 km, we’d be talking about over a year of non-stop, uninterrupted searching in perfect weather. Unfortunately, the South Indian Ocean is quite a bit deeper with an average depth of 3.9 km, and the Underwater Locator Beacon will start getting weaker in ten days.

The reason that the TPL-25 and the Bluefin-21 are in place is so that if we do find debris, they are ready for action rather than losing more precious time transporting them to the scene.

Right now, though, all our hopes are pinned on the ocean surface search for debris. The photographic imagery captured today is being assessed overnight and weather conditions for Saturday are expected to be “reasonable”.


Previous articles on MH370:

Unravelling the Theories Behind the Disappearance of MH370

Considering the Probabilities of the Fate of MH370

21 March 2014

Considering the Probabilities of the Fate of MH370

So, this has been an interesting week! I have been speaking to various journalists around the world, trying to help them make sense of the facts and wild rumours flying around the MH370 mystery.

I’ve put links to the various articles at the bottom of this post for you to read, if you are interested. I’m happy to say that in every instance, the journalists were bright, interested and very focused on sticking to verifiable information. They all spoke to me for an hour or more and asked intelligent questions.

After answering many questions and narrowly avoiding stating assumptions of fact, I quite liked this post on Reddit which discusses this type of analysis: Defining three terms: Occam’s Razor, The Principle of Total Evidence, and The Dog That Didn’t Bark : MH370.

With the news over the past week, it’s possible to narrow down the possibilities somewhat. However, all of this is still based on assumptions and until we find the Boeing 777, we honestly just can’t make conclusions with any confidence.

First, a recap of what we know:

The aircraft departed from Kuala Lumpur airport at 00:41 local time en route to Beijing. The take-off was normal.

01:07 The last ACARS data transmission was received.

01:19 The First Officer signed off from Kuala Lumpur air traffic control. He should next have contacted Ho Chi Minh City air traffic control as they entered Vietnamese airspace.

01:21 Ho Chi Minh City air traffic control noted that they had not checked in and began asking questions.

01:30 The transponder was disabled or turned off, resulting in a loss of secondary radar information regarding the flight.

02:14 The aircraft appeared on military radar in the Strait of Malacca.

08:11 A satellite over the Indian Ocean registers the last ping from the ACARS on MH370. The series of pings confirmed that the aircraft was still moving.

This is not a lot of information to be going on.

Inmarsat and Rolls Royce have been appointed as technical advisors to the UK Air Accident Investigation Branch which is assisting the investigation by the Malaysian authorities. Inmarsat have confirmed that they are “absolutely certain” that the satellites picked up pings from the aircraft for hours after it vanished. This means that the aircraft had power and continued flying until at least 08:11 – at least six and a half hours after it lost contact.

I like this graphic by @_antialias_ because it very clearly shows the “two corridors” which have been narrowed down as possible flight corridors in which the aircraft must have ended up as a result of the (minimal) satellite data.

For more information on this data, I recommend this article:

TMF Associates MSS blog » Understanding “satellite pings”…

Firstly, it needs to be made clear that the radar transponder “squawks” and the satellite communications “pings” are from completely separate systems (just because its talking about a transponder, that is nothing to do with satellite transponders). The radar transponder sends an amplified signal in response to reception an incoming radar transmission, which has much more power than a simple reflection from the metal skin of the plane, and has additional information about the plane’s ID. If turned off, less sensitive civilian radar will struggle to pick up the plane’s reflection, though military (air defense) radar should still be able to see the plane. But military radar systems are looking for hostile forces and have missed civilian aircraft in the past.

Quite frankly, I don’t think we should even think about trying to solve the mystery with so little to go on, but in Sherlock mode, we can look at probabilities.

An aircraft disaster is never simple: there’s a cascade of failures which combine in such a way to lead inevitably to the incident. Thus, when I refer to something as coincidental, that isn’t proof that it didn’t happen that way. I just prefer simple theories to complicated ones.

So, let’s start with the basic premise: MH370 was either the victim of a deliberate diversion or a series of mechanical failures or a combination thereof.

Diverted to Unknown Location to Kidnap Passengers

It’s been thirteen days since we lost contact with the aircraft and no sign of the passengers has been found. The aircraft managed to land without anyone reporting an unexpected low-flying Boeing 777. No one has made a ransom demand. Not a single mobile phone has managed to connect. 227 passengers and 12 crew have been hidden and fed with no one noticing. Sadly, I think this theory is more a question of hope that they might be alive rather than a likely possibility.

Pilot Suicide

The profiles of the pilots are interesting and I recommend this article on the subject: MH370: profile of missing Malaysian Airline plane’s pilots starts to emerge. Both of them were stable and did not have any signs of extremist views or terrorist connections. The Captain was a family man and the First Officer engaged to be married.

But more importantly, I can’t work out any reason whatsover that a suicidal pilot would disable the plane in such a way to leave it flying for seven hours before crashing due to fuel starvation. It makes no sense: a competent pilot would just crash the aircraft immediately, on the spot. In the heat of the moment, he has the element of surprise, so it’s possible to kill yourself using a commercial jetliner, but there’s no possible advantage to dragging it out like this.

The same applies to the “assassination by aircraft” theory, in which the aircraft was crashed in order to murder one of the passengers. This seems like the most complicated way ever to murder someone, to be frank, and again, I can’t see any reason why you would want to take your time about it.

Stolen Cargo

I’d originally mentioned cargo theft as a possible motive. Take the aircraft, dispose of the passengers and unnecessary flight crew and land in a completely isolated area such as in the desert. There, you meet someone who has agreed to help you transport the gold bullions away with from the plane to sell.

However, the cargo has been confirmed to be lithium ion batteries and not gold bullions or some other item worth its weight in, well, gold, it’s very unlikely that the aircraft was stolen with the intent of landing in a remote area to make off with the cargo. Considering the bad press regarding lithium ion batteries recently, it also explains why the Malaysian government was loathe to release the information, although there is no reason to believe at this stage that the cargo was dangerous.

Mechanical Failure

We still don’t know for sure that there was definitely a deliberate diversion by someone onboard the aircraft. It could have been a purely mechanical failure with no devious intentions whatsoever.

I recommend the article on Wired: A Startlingly Simple Theory About the Missing Malaysia Airlines Jet.

There are two types of fires. An electrical fire might not be as fast and furious, and there may or may not be incapacitating smoke. However there is the possibility, given the timeline, that there was an overheat on one of the front landing gear tires, it blew on takeoff and started slowly burning. Yes, this happens with underinflated tires. Remember: Heavy plane, hot night, sea level, long-run takeoff. There was a well known accident in Nigeria of a DC8 that had a landing gear fire on takeoff. Once going, a tire fire would produce horrific, incapacitating smoke. Yes, pilots have access to oxygen masks, but this is a no-no with fire. Most have access to a smoke hood with a filter, but this will last only a few minutes depending on the smoke level. (I used to carry one in my flight bag, and I still carry one in my briefcase when I fly.)

It’s a good piece and it fits in with the routing – a left turn at the initial point of failure followed by another left turn at the Straight of Malacca, ready to head back to their home airport.

However, I’m not convinced. MH370 departed Kuala Lumpur normally and signed off with the air traffic controller as they left Malaysian airspace and entered Vietnamese airspace. This is extra-ordinarily convenient timing for turning off communication devices and disappearing, so it seems a large coincidence that the ACARS and the transponder coincidentally died as a result of fire just as the crew were changing airspace and switching frequencies. In addition, the fact that the fire took out the ACARS, the transponder and the radio and the flight crew but left the aircraft in a flyable condition for seven hours seems quite unlikely to me.

Aircraft Hid in the Shadow of Another Aircraft

Flying in close formation with another plane large enough to provide a shield is extremely difficult. I find it highly improbable that MH370 managed to catch up to a plane and hide in its shadow without being detected. It’s not impossible and as it has been thirteen days without finding the aircraft, I certainly am not ruling out, but it does feel more like a Bond film than reality.

Once you got into position, it be difficult but not impossible to keep up the formation: the pilots just have to listen to the radio communications for any changes in heading and altitude. I just can’t quite imagine how they got into position in the first place.

The Aviationist » “I’m sure: MH370 escaped in the shadow of another plane” retired Air Force Colonel says

The former radar navigator instructor and tactics officer backs this theory.
“When you fly over water or from point to point, pilots are frequently directed to change frequencies, told to turn, climb, descend, you name it. This is all “in the clear” and not privileged communications, anyone with the right radio on the right frequency would hear it. So, this pilot has planned this out to the nth degree and as he’s coming back across the Malay peninsula, he’s looking to fall in behind another airliner and shadow that airplanes flight path.”

Deliberate Diversion Gone Wrong

It seems likely that any deliberate diversion was not with the intention of crashing the aircraft but to take it to a new location. Without more data, we really can’t begin to guess what that motive might have been.

Any modern aircraft disaster consists of a sequence of failures, which within risk analysis is referred to as the Swiss Cheese model.

Swiss cheese model – Wikipedia

The Swiss Cheese model of accident causation is a model used in risk analysis and risk management. It likens human systems to multiple slices of swiss cheese, stacked side by side. It is sometimes called the cumulative act effect.

In the Swiss Cheese model, an organization’s defenses against failure are modeled as a series of barriers, represented as slices of cheese. The holes in the slices represent weaknesses in individual parts of the system and are continually varying in size and position across the slices. The system produces failures when a hole in each slice momentarily aligns, permitting (in Reason’s words) “a trajectory of accident opportunity”, so that a hazard passes through holes in all of the slices, leading to a failure.

So considering the data so far, I believe that the disaster that struck MH370 is likely to be combination of the two possibilities: a deliberate diversion followed by a mechanical failure.

By this, I mean that MH370 was intentionally “disappeared” as it left Malaysian airspace but before entering Vietnamese airspace, in hopes of delaying search and rescue missions. If so, this was successful: the Boeing 777 was recognised as not responding as expected very early on but was not in fact reported as missing until after its scheduled landing time in Beijing, even though Vietnamese and Chinese controllers knew it had not followed the route to its declared destination.

But then at some later point, something else went wrong, possibly as a result of a struggle for control of the cockpit. Now the aircraft behaviour is no longer in line with the motives for the deviation, which is why it is so impossible to make sense of what was planned.

I had previously considered a simple decompression event like Helios Airways Flight 522 to be unlikely. This was because the aircraft would continue to transmit ACARS and the transponder would continue to supply secondary radar information even though there was no one controlling the aircraft.

However, if the decompression happened after the deliberate diversion, perhaps as the direct result of a weapon (gun, bomb) going off, then it is possible that the aircraft was flying as a ghost plane for the latter part of the flight.

But this is all second guessing, trying to fit the sparse facts we have into some sort of sensible narrative. Have I mentioned that I also write science fiction? It’s a weakness.

Latest News on the Search Operation

Meanwhile, the most important thing is the search operation, to help us to find more.

Here’s the last update from the Sydney Morning Herald:

Missing Malaysia Airline search: ‘We’ve got a lot of hope’ says pilot

Favourable conditions were encountered in the area of ocean being searched for debris that might be related to the missing Malaysia Airlines flight MH370.

But Royal Australian Air Force pilot Russell Adams’ squadron could not locate the two objects spotted on satellite images that sparked the ocean search on Thursday.


A hat-tip to the journalists who were interested in learning more:

Finlo Rohrer: BBC News – Mechanical v human: Why do planes crash?

Tom de Castella: BBC News – Missing Malaysia plane: 10 theories examined

Laura Villadiego: Cinco preguntas (y sus respuestas) sobre la misteriosa desaparición del vuelo MH370 – Noticias de Mundo

Ειρήνη Ψυχάρη: Ειδήσεις – νέα – Το Βήμα Online

14 March 2014

Unravelling the Theories Behind the Disappearance of MH370

I’ll be honest: I was really, really hoping that the mystery of Malaysia Airlines Flight 370 would be solved by today and I wouldn’t have to write about all the second-guessing.

Unfortunately, that’s still (hang on, checking the news one more time) that’s still not happened.

So, let’s go over what we know. All times are Malaysian local time.

Malaysia Airlines Flight 370, codeshare China Southern Airlines Flight 748, was a scheduled passenger flight from Kuala Lumpur, Malaysia to Beijing, China.

On the 8th of March 2014, at Flight Level 350, the Boeing 777 disappeared with 239 souls on board less than an hour after take-off.

Unlike Air France Flight 447, there were no known system failures. The last engine data transmission was received at 01:07.

(Yes, I know about the Wall Street Journal piece. Those were not engine data transmissions. We’ll get to that.)

The flight crew ended communications with Kuala Lumpur air traffic control and should have contacted controllers in Vietnam but never did.

The aircraft disappeared from radar at 01:30.

This was the search and rescue forces as of the 12th and 13th:

Now the guessing games begin. The problem is, this is a mystery and we love mysteries. So everyone wants to try to solve it, to figure out what happened. And right now, we simply don’t have enough data.

One of my favourite articles so far on the subject is this parody in the Onion:

Malaysia Airlines Expands Investigation To Include General Scope Of Space, Time | The Onion – America’s Finest News Source

KUALA LUMPUR, MALAYSIA—Following a host of conflicting reports in the wake of the mysterious disappearance of Malaysia Airlines Flight 370 last Saturday, representatives from the Kuala Lumpur–based carrier acknowledged they had widened their investigation into the vanished Boeing 777 aircraft today to encompass not only the possibilities of mechanical failure, pilot error, terrorist activity, or a botched hijacking, but also the overarching scope of space, time, and humankind’s place in the universe.

I’m seeing a lot of speculation, second-guessing and even anger that “they” have not yet found the plane, thus “they” are clearly not trying hard enough. Frustration is building because we haven’t been able to solve the mystery and find the plane. Communication has been bad, there’s no question, but this is partially because it is very hard to hold press conferences and updates when there is nothing new to say.

In addition, we are looking at different types of facts.

  • facts from governments
  • facts from those apparently close to the investigation
  • facts from media
  • facts from data that is freely available on the internet

Note I’ve neglected to mention facts from arm-chair investigators like me. We don’t have any facts, only possibilities. It’s important to remember that.

Let’s debunk some information first. We’ll start with the “last-minute turn” on the Flightradar 24 data.

You can replay the actual flight on their website:

Bear in mind times on Flightradar are in UTC, not local time to the flight.

Much has been made of the turn the aircraft made shortly before disappearing, which can be seen on the Flightradar 24 data. The implication is that this was the aircraft turning back or heading to an unexpected location. Here’s Flight Radar’s statement on this:

Here is a #MH370 situation update from Flightradar24 because of the many questions we get.

The ADS-B transponder of an aircraft is transmitting data twice per second. FR24 saves data every 10-60 second depending on altitude. On cruising altitude data is normally saved once per 60 seconds. By analyzing all our databases and logs we have managed to recover about 2 signals per minute for the last 10 minutes.

The last location tracked by Flightradar24 is
Time UTC: 17:21:03
Lat: 6.97
Lon: 103.63
Alt: 35000
Speed: 471 knots
Heading: 40

Between 17:19 and 17:20 the aircraft was changing heading from 25 to 40 degrees, which is probably completely according to flight plan as MH370 on both 4 March and 8 March did the same at the same position. Last 2 signals are both showing that the aircraft is heading in direction 40 degrees.

Today there are reports in media that MH370 may have turned around. FR24 have not tracked this. This could have happened if the aircraft suddenly lost altitude as FR24 coverage in that area is limited to about 30000 feet.

FR24 have not tracked any emergency squawk alerts for flight MH370 before we lost coverage of the aircraft.

Earlier in the week, much was made of the fact that two passengers on the jet had boarded with false passports. In the meantime, the two people who had been using the passports have been identified by Malaysian police and dismissed as unlikely to be terrorists.

The popular idea that this flight suffered the same fate as Helios Flight 522 in which the pilots lost cabin pressure and did not put on their oxygen masks seems unlikely. We never lost contact with Helios Flight 522 and in fact tracked it until the final crash. It was a ghost plane with all systems functioning.

In contrast, Malaysia Airlines Flight 370 disappeared. If it were the same scenario, the pilots of Flight 370 would have had to turn off the comms and transponder as a final act before submitting to hypoxia. It’s possible, but it just doesn’t seem very likely.

For the aircraft to disappear from radar like that, it would have been a case of explosive decompression, where the differential pressure at 35,000 feet actually broke up the aircraft. If this were the case, there would be no peaceful drifting of the aircraft until it ran out of fuel.

A bomb on the aircraft would have a similar effect. I’m leaning against terrorist activity because there’s been no verifiable claim of responsibility and for a terrorist action to hold weight, people need to know that it happened. That leaves assassination and I just can’t help but think there are easier ways to get rid of someone than to sneak onto a plane with a bomb and blow yourself up.

Hijack gets complicated fast because not only do you have to overwhelm the cabin crew and get control of the cockpit, you also have to deal with 227 passengers all of whom have mobile phones. Silencing the aircraft and all the passengers is technically possible but again, the ability to disappear without a trace is complicated and seems unlikely. That would also mean that the hijackers not only managed to disappear an aircraft without a trace, but also landing a Boeing 777 without anyone noticing. It seems unlikely unless there’s a conspiracy of the hugest kind.

OK, so now we get to the WSJ article.

Satellite Data Reveal Route of Missing Malaysia Airlines Flight 370 – WSJ.com

Malaysia Airlines MH370 missing jet transmitted its location repeatedly to satellites over the course of five hours after it disappeared from radar, people briefed on the matter said, as searchers zeroed in on new target areas hundreds of miles west of the plane’s original course.
The satellites also received speed and altitude information about the plane from its intermittent “pings,” the people said. The final ping was sent from over water, at what one of these people called a normal cruising altitude.

The data transmission they are talking about is the Aircraft Communications and Reporting System (ACARS).

ACARS is a continuous data monitoring system which transmits data automatically. It is what alerted us to the icing situation on Air France 447. And it is that last data received from the engines at 01:07 as the Malaysia Airlines 370 was in the climb for a cruise at 35,000 feet.

ACARS data is event driven, so the silence from 01:07 to 01:30 when the aircraft disappeared is not meaningful. There was simply nothing to report. The last transmission indicated that the aircraft was operating normally.

So when the Malaysian officials insist that there was no further data transmission from the engines after 01:07, that is completely correct.

However, apparently US sources have found that satellites received “faint pings” from the ACARS system, which appear to be the standard “are you there” broadcast which an ACARS system puts out every thirty minutes.

The Boeing’s ACARS communications connected through VHF. There is an additional fee for an ACARS satellite communication link, which Malaysia Airlines did not pay for. So no data would ever have been transferred from the aircraft to the satellite.

Now, if the aircraft was functional but out of VHF coverage, the ACARS system would automatically try to connect through the satellite communications. However, as that was not a service that the aircraft was signed up for, the satellite would not accept the connection.

This can be compared to going out of coverage with your mobile phone. The phone will continue to try to connect and every network which is not your network will reject those connections.

Now, what the Wall Street Journal is reporting is that eight such connection attempts (pings) were found on the log of the satellite. As those pings happen every 30 minutes, that implies that the aircraft had power four another four hours after it disappeared.

If this is correct (and it has not been verified by anyone actually involved in the investigation, so it might not be), then presumably the aircraft continued to fly for some time after the disappearance. If so, this absolutely implies a manual disabling of the comms system, rather than a systems failure.

Recent reports have jumped on this and come up with theories fit for a Dan Brown novel as to how the aircraft was stolen for nefarious purposes.

Today, various newspapers have claimed that the aircraft may have turned towards the Andamans islands and landed there in secrecy; however that still leaves the slight plot-hole that no one has seen an unexpected Boeing 777.

The editor of the Andaman Chronicle says there is no aircraft there.

“There are no chances that such a big aircraft coming to the Andaman islands can be missed.” And yet the headlines continue.

As long as there is no hard news, speculation and guessing will remain in the forefront. Everyone has a pet theory, ranging from pilot suicide to government plots. My favourite crazy ending to this tragedy so far is the only one that would give us a happy ending: that the disappearance is part of a viral advertisement for a new season of Lost.

I hope that the search parties find some evidence of the aircraft soon. My personal opinion is that the aircraft suffered some catastrophic failure at the beginning of the cruise and is now at the bottom of the ocean. But honestly, until we actually have more data, actual verifiable facts, there’s no real point in guessing.

28 February 2014

B-1B with its Nose to the Ground

On the 5th of October in 1989, a B-1B Lancer departed Dyess Air Force Base with four crew on a routine training flight. Three hours later, the flight crew discovered that the aircraft had a hydraulics fault. As they came in to land at Dyess Air Force Base in Texas, the front landing gearhttp://fearoflanding.com/?p=7373&preview=true failed to lower.

Ex-28th BW Rockwell B-1B Lancer 85-0070

They circled the airfield for four hours, twice being refuelled by an airborne tanker, as they struggled to lower the nose wheel. Supporting the crew on the ground were military personal and mechanics for the aircraft manufacturer; however they were unable to resolve the issue.

The Air Force had the flight crew fly a further three hours and over 1,000 miles to Edwards Air Force Base, where they circled for another two hours. Air Force officials decided to land the plane on Rogers Dry Lake. Rogers Dry Lake bed is a natural clay runway and is the site of most of the Space Shuttle landings (see Brent’s comment below – it looks like I got this wrong).

The $280 million B-1B Lancer is a four-engine supersonic bomber which is 146 ft (44.5 m) long and a wingspan of 137 ft (41.8m). This is almost the size of a DC-10.

The B-1B has a maximum speed of Mach 1.25 (721 knots, 830 mpg, 1,340 km/h) at 50,000 feet and a range of 6,500 nautical miles. A total of 100 B-1Bs were produced.

The bomber made several low-level passes, which confirmed that the landing gear was still partially retracted. They attempted to jar the nosewheel loose with a touch and go. When that failed, they made a final approach onto the lake at 18:15 local time.

This newly released video of the landing was emailed to me by a reader and it is simply amazing.

None of the crew was hurt and the aircraft unbelievably only suffered minimal damage.

Once on the ground, one of the pilots told the press, “It’s been a great day for flying, except for a few glitches.”

21 February 2014

Hijack by the Pilot – Ethiopia Airlines

On the 17th of February, Ethiopian Airlines Flight 702, a Boeing 767-300, departed Addis Ababa at 00:30 local time on a scheduled flight to Rome, with an estimated time of arrival of 04:40 local time.

Somewhere over Sudan, the aircraft transponder, which transmits a signal which is used to identify the aircraft, was changed to broadcast 7500. That is the code used to identify an aircraft as having been hijacked.

At around this time, the Captain was locked out of the cockpit.

Ethiopian co-pilot hijacks plane to Geneva to seek Swiss asylum; passengers scared but safe

One passenger, Francesco Cuomo, told the Italian news agency ANSA that he and other passengers woke up shortly after midnight when the plane started to “bounce.”

“The pilot was threatening (the hijacker) to open the cockpit door and tried to knock it down without succeeding,” said Cuomo, a 25-year-old economist from Italy.

“At this point, a message was transmitted by the loudspeakers in poor English, but the threat to crash the airplane was clearly understood,” he added.

Reddit user OK3n was on the flight.

IamA passenger on yesterday’s Hijacked plane from Ethiopian Airlines to Geneva. AMA!

After entering the plane, I went to my seat: economy class, window-side and next to the right wing. As it was around midnight, I quickly fell asleep during take-off.

I was waken up an hour later due to the sound of all the oxygen mask going down. I immediately thought « what the… »

I looked at my neighbor, she seemed as confused at me. The plane was not behaving oddly so I thought it was a simple technical glitch or somebody pressed the wrong button. Everybody looked at each other, thinking what’s going on. Suddenly, a deep and angry voice talked through the cabin radio: “SIT DOWN, PUT YOUR MASKS ON, I’M CUTTING THE OXYGEN”, three times.

At this point, I realized that the situation is serious: someone is in the pilot cabin and has hijacked the plane. Within a few seconds, the oxygen went down in the cabin: I felt very lightheaded and quickly decided to put on the oxygen mask like the rest of the passengers. Quickly after that, the plane suddenly started dropping down for about 8 seconds then went fast back up, then finally stabilized. People were crying, yelling, praying. I was in complete panic.

I’m not clear what actually happened on the aircraft here and neither was OK3n, who said he wasn’t sure if the pressurisation changed or he was simply light-headed with fear. Certainly, it worked to get the passengers to remain in their seats.

The Italians scrambled to intercept the aircraft when it entered Italian airspace. The co-pilot spoke to the Italian Air Force while two Eurofighter Typhoons followed from behind, out of sight of the cockpit.

The co-pilot declared his intention to divert to Geneva to seek asylum. The Italians were joined by French military jets, who followed the aircraft into Switzerland to ensure the aircraft didn’t deviate from its flight path to Geneva.

Usually I try to insert a bit of witty commentary but sometimes I just can’t improve on reality.

Swiss fighters grounded during hijacking as outside office hours – Yahoo News

Geneva (AFP) – No Swiss fighter jets were scrambled Monday when an Ethiopian Airlines co-pilot hijacked his own plane and forced it to land in Geneva, because it happened outside business hours, the Swiss airforce said.

But although the co-pilot-turned-hijacker quickly announced he wanted to land the plane in Switzerland, where he later said he aimed to seek asylum, Switzerland’s fleet of F-18s and F-5 Tigers remained on the ground, Swiss airforce spokesman Laurent Savary told AFP.

This, he explained, was because the Swiss airforce is only available during office hours. These are reported to be from 8am until noon, then 1:30 to 5pm.

“Switzerland cannot intervene because its airbases are closed at night and on the weekend,” he said, adding: “It’s a question of budget and staffing.”

He explained that French fighters can escort a suspicious aircraft into Swiss airspace, “but there is no question of shooting it down. It’s a question of national sovereignty”.

Meanwhile, on Airliners.net, the Civil Aviation Forum watched the events unfold in real-time.

ET702 ADD-FCO ET-AMF Squawking 7500 (Confirmed Hijack)

It has just overflown its destination, FCO, at 36,000ft.. Hope things are ok onboard..

Aeroporto di Roma website says the flight hasn’t arrived yet, and it should have arrived at 4:40am local time. Hope everything’s okay…

Made a turn for Geneva.

I’m listening to LiveATC Geneva and I think I just heard the word “Asylum”!!

If I heard right they just said they have 35 min of fuel left.

Looks like they are doing another loop while waiting for authorities.

Still waiting for response from Swiss authorities?? Holding at 7000 with only 35 mins on board. The pilots are so calm yet.

Controller said everyone was sleeping so the delay…

20 min fuel left, definitely something about asylum

“We have negotiators on the phone” as reported by GVA ATC.

think I heard: will give an answer on short final

Phew, it’s down.

landed apparently. On fumes!

Captain is leaving by the window. Does not looks like hijackers are in the cockpit

For a 767, 30 minutes worth of holding fuel is about 2000kgs. Looking at the timeline, they must have landed with less than 100 kilos in the tanks. Insane.

OK3n describes the situation on board:

IamA passenger on yesterday’s Hijacked plane from Ethiopian Airlines to Geneva. AMA!

I was thinking : that’s it, we’re crashing into something. Looking down to the window I see a light, two, three, I can’t see what’s ahead. It’s still dark. We’re going fast, we’re flying over many houses now. And suddenly, under us, the airport. Just thinking again about this moment makes me shiver. We are landing. WE, are LANDING. Is this true ? Is this a miracle ? We touched the ground, and the plane eventually stopped completely in a bit away from the plane entrance to the terminal. I remember crying, while most of the people (Italians) were applauding. At this point, for the first time in 6 hours, we got an update from the steward telling us about the copilot, that we are in Geneva and that soon the Swiss police will enter and evacuate the plane.

Here’s the tracking of the last ten minutes of flight with ATC conversation overlaid:

The co-pilot was identified as Hailemedhin Abera, a 31-year old pilot who had worked for Ethiopia Airlines for five years and had no criminal record.

Exclusive: Who’s Ethiopian hijacker Hailemedhin Abera? » Horn Affairs – English

Hailemedhin was raised in Bahirdar city, at the center of city called “kebel zero sost”. He attended school at Megabit haya sement elementary school, then Bahirdar Secondary School in 2000/01.

Subsequently, he joined Addis Ababa University Architecture department, which he quit to join the state-monopoly Ethiopian Airlines.

He was raised by a devotee Orthodox Christians family. Both of his parents are alive and residents of Bahirdar city.

There was nothing to suggest that Hailemedhin had any prior plan of creating an international incident – according to the conversations he had with his close friends a day before he left Addis Ababa.

BBC News – Ethiopian Airlines co-pilot hijacks plane to seek Geneva asylum

The Boeing 767-300 eventually made its unscheduled landing at 06:00 local time.
The initial assumption that a hijacker had gained control over the flight crew proved to be false. The hijacker was the co-pilot, who had locked his Captain out of the cockpit.
“He parked the plane on the taxiway, he cut the engines then opened the cockpit window, threw out a rope and used it to descend to the tarmac,” said Swiss police spokesman Eric Grandjean.
“He ran towards the police and immediately identified himself as the co-pilot and hijacker.”

Over an hour later, the passengers disembarked.

IamA passenger on yesterday’s Hijacked plane from Ethiopian Airlines to Geneva. AMA!

The Swiss entered, released business class, released the crew, released the economy class. By released I mean go outside, hands in the air, and get checked by a bunch of policemen.

We were checked and accompanied very kindly by the Swiss. There were sandwiches, hot chocolate, and free wifi.

The Swiss police spokesman pointed out that it was the first time in Swiss history that a co-pilot had hijacked an aircraft.

hijack

/ˈhʌɪdʒak/
verb
illegally seize (an aircraft, ship, or vehicle) while in transit and force it to go to a different destination or use it for one’s own purposes.
“a man armed with grenades hijacked the jet yesterday”

I immediately balked at the term. The co-pilot was Pilot Flying and in control, so he can hardly be said to have illegally seized the aircraft. He diverted the flight, which he is totally authorised to do as the person in command of the plane. He also locked the Captain out of the cockpit and terrified the passengers but that’s not what defines a hijack.

After much pondering I decided that the best I could come up with was mutiny, as in open rebellion against a ship’s captain. But is that still a legal crime?

Luckily, the Swiss are more serious than I am and swiftly came up with charges. They have described the incident as an unlawful interference with an aircraft and 200 counts of kidnapping, under sections 183-185 which cover false imprisonment and abduction.

Geneva prosecutor did not discuss details of case. “Technically there is no connection between asylum and the fact he committed a crime to come here,” he said.

“But I think his chances are not very high.”

07 February 2014

The Sordid Story behind the Cork Fatal Accident : Manx2, Air Lada and Flightline

This is an in-depth look at the operations behind the crash that I wrote about last week: Manx 2 Fatal Accident at Cork: Below the Required Minima.

This might take a while, so get comfortable.

On the 10th of February in 2011, the Fairchild Metro III attempted to land at Cork in low visibility conditions.

The aircraft carried out two ILS approaches, both of which were continued beyond the OM equivalent point with conditions below required minima. On both of these approaches, descent was continued below [Decision Height], followed by a missed approach. The aircraft then entered a holding pattern following which a third ILS approach was made with conditions below required minima. This approach was continued below DH and a missed approach was initiated. Approaching the runway threshold, the aircraft rolled to the left, followed by a rapid roll to the right during which the right wingtip contacted the runway surface. The aircraft continued to roll and impacted the runway in an inverted position. The aircraft departed the runway surface to the right and came to rest in soft ground.

To understand the situation, we will have to untangle the complex relationships between the companies.

A Spanish bank owned the physical aircraft and leased it to Air Lada. In the accident report, Air Lada is referred to as the Owner. Air Lada subleased the flights to Flightline S.L., referred to in the report as the Operator. The service was sold by Isle of Man company Manx 2, referred to in the report as the Ticket Seller.

The Captain held a Commercial Pilot Licence issued in Spain and had a total flying time of 1,801 hours with 1,600 on type.

Records show that he had operated as a co-pilot (first officer) into Cork on 61 occasions and he flew in on seven occasions as Captain. There’s no records of any diversions on any of these flights. In addition, he’d never operated into Waterford or Kerry, which could have increased reluctance to divert.

He was promoted to Captain on the 6th of Feb 2011, four days before the accident.

Flightline’s Chief Instructor was involved in the training of both the Captain and the First Officer of the accident flight. He stated that although all the pilots were considered to be Flightline pilots, the pilots who flew the Metro III were paid by Air Lada.

He was the sole Class Rating Examiner at Flightline and it was his decision as to how many training sectors a candidate for captaincy would receive. The other Class Rating Instructor at Flightline had left the company shortly before. This meant that he both trained and checked the Captain. He agreed that there should be a separate Class Rating Instructor and Class Rating Examiner, but in the Captain’s case, this was not possible. He felt he would be able to objectively evaluate the Captain. He agreed that the command training of the Commander was very disrupted and thought it was possibly because they were tight in numbers and because the Captain had to travel from Belfast to Barcelona for training. He described the commander as enthusiastic with good crew resource management.

The First Officer held a JAA CPL issued in the United Kingdom and had a total flying time of 539 hours with 289 on type. He was employed as a co-pilot by the operator just three weeks before the crash. He went through a thirty-minute Operator’s Proficiency Check at that time. Flightline’s Chief Instructor described him as ‘was okay for his hours‘.

Flightline did not have any restrictions for newly qualified flight crew, so it was possible for newly qualified commanders and co-pilots to operate together.

The First Officer did not complete the line training and should only have flown with a training captain until he had completed his line training and passed a line check. The Flightline SL records show that all of First Officer’s flights were with line captains who were not instructors.

His CV indicated that he had studied Italian but there was no evidence of Spanish language competency.

It was quite clear that the duty and rest periods of the crew were not correctly documented.

The Co-pilot’s roster for February showed him ‘Libre’ (‘free’) between 8-12 February 2011. As another co-pilot requested a change of duty on 9 February, the Co-pilots duties were changed and he was required to operate the scheduled flights on 9 and 10 February 2011. The identity of the co-pilot was not noted in the flight paperwork of the short positioning flight between EGAA and EGAC on 9 February 2011. The Investigation is satisfied that the Co-pilot operated this flight and subsequently the two return flights to Cork. The two other possible candidates forwarded copies of their personal logbooks to the Investigation which showed they did not operate the sector.

The partner of the First Officer stated, “He did not have very much rest. He was working on a defined route incorporating some night-time flights carrying post.” She last spoke to him at 23:00 on 9th of February, the night before the crash.

Flightline, as the operator, was responsible for the flight crew, including ensuring staff competence and rest periods. The Quality Manager at Flightline stated that Air Lada produced a draft roster for flight crew, which Flightline would monitor and and amend as needed to ensure that flight time limitation rules were followed. Any roster change after the roster was published had to be approved.

However, none of the flight changes prior to the accident flight had been approved and Flightline were unaware that the co-pilot was on the flight until after the accident. The flight crew instruction regarding making a roster change request was in Spanish and no English translation was found. As a result of unofficial roster changes, neither the Captain nor the First Officer were fully rested at the time of the accident flight.

The aircraft had been involved in two previous significant events.

In the early mornings of 21 May 2004, EC-ITP was involved in a take-off incident at Palma de Mallorca Airport (LEPA). On take-off, the aircraft accelerated normally to 60 knots when the nose wheel steering (NWS) system was deactivated the aircraft veered to the right. The take-off was abandoned and reverse thrust applied but the aircraft departed the runway and incurred minor damage which was later repaired.

On 8 November 2009 EC-ITP suffered a heavy landing at Barcelona. As a result, the aircraft was ferried to an overhaul facility in Cologne for repair. This work was completed and the aircraft returned to service in October 2010, four months prior to the accident.

The repair for the heavy landing in November 2009 revealed that the left-hand engine installed in the engine was a loaner – meant for temporary use. It was removed and another loaner engine installed on 15 July 2010. The right-hand engine was removed from the aircraft on 27 April 2010 “for access to repair area” and re-installed on the right-hand side on 13 July 2010.

Despite the change of engine, a full Engine Ground Run check was not run. Instead, the checklist for engine adjustments was used. The engine ground runs did not include power lever split checks at Flight Idle.

On the last approach into Cork that day, the Captain, who was Pilot Not Flying, took control of the power on the last approach. At the decision height, he pulled back the power and called to continue, clearly hoping to spot the runway in the fog.

From last week’s blog post:

They once again descended below the decision height of 200 feet above the ground. However this time, the aircraft reduced power and at the same time experienced a roll to the left.

Terrain Awareness Warning System: ONE HUNDRED
Captain: Go around!
First Officer: Round.
Terrain Awareness Warning System: FIFTY
Terrain Awareness Warning System: FORTY

The Captain applied go-around power which is when they lost control of the aircraft. The aircraft rolled rapidly to the right and the right wingtip contacted the runway surface. The aircraft continued to roll.

It is likely that the First Officer, the pilot flying, did not realise what his Captain was doing with the power and made a control wheel input to the right to correct for the left roll.

The investigation cites three principle factors contributing to the loss of control:

The uncoordinated operation of the power levers and the flight controls, which were being operated by different Flight Crew members.

The retardation of the power levels below Flight Idle, an action prohibited in flight, and the subsequent application of power are likely to have induced an uncontrollable roll rate due to asymmetric thrust and drag.

A torque split between the powerplants caused by a defective Pt2/Tt2 sensor, became significant when the power levers were retarded below Flight Idle and the No. 1 powerplant entered a negative torque regime. Subsequently when the power levers were rapidly advanced during the attempted go-around, this probably further contributed to the roll behaviour as recorded on the FDR.

The Flight Data Recorder was recovered with 106 hours of data leading up to the accident. It showed that there as a mismatch between the torques being delivered by the two engines.

In general, the data showed that the torque being delivered by No. 2 engine exceeded that being delivered by No. 1 engine by up to 5%. It was also noticed that, as the power levers for both engines were being advanced prior to take-offs, the torque response for the No. 2 engine was faster than that for No. 1 engine.

The data showed that the pilots were adjusting the power levers to compensate for the engine torque differential. As the aircraft was descending towards the runway shortly before impact, the No. 1 engine was at 20-23% and the No. 2 engine was at 25-27%.

Then, 8 seconds before impact, a negative torque value was recorded. The next recorded values show the torques on both engines increasing but not in sync.

The next recorded values for this parameter [the No. 1 engine), following at intervals of one second, were +22%, +10%, +7% and +36%. Thereafter, recorded torque values for No. 1 engine rose rapidly. In a similar timeframe, the No. 2 engine torque values were recorded at +8%, 0%, +3%, +5% and +25%. Thereafter recorded torque values for No. 2 engine also rose rapidly to values in excess of 90%.

The negative torque the No. 1 engine caused the left roll. Then as both engines started to increase rapidly, the aircraft rolled to the right to 115° bank before the aircraft impacted.

The issue turned out to be a faulty sensor on the No. 2 engine. The defective engine intake air temperature and pressure sensor was caused by a crack in the side coil of the sensor bulb. The fracture surface was corroded, showing that the crack had been there for some time.

The effects of this fault were

  • Slower engine speed response when the speed lever was advanced
  • Faster engine torque response when the power lever was advanced
  • Higher torque for a given power level angle

Manx 2, based at Ronaldsway Airport on the Isle of Man, is referred to in the report as the "Ticket Seller". They did not have an operating licence or an Air Operator's Certificate, which is the approval required for an aircraft operator to use aircraft for commercial flights.

Instead, Manx 2 had contractual relationship with four AOC holders, including Flightline.

Flight crew on the flights wore a Manx 2 uniform and aircraft were painted with Manx 2 livery. However, the company did not want to have the "regulatory complexity and crewing problems associated with holding an AOC". Manx 2 didn't need an Air Travel Organisers Licence to sell the tickets, as none of the aircraft had in excess of 19 seats.

The UK Civil Aviation Authority was concerned that Manx 2 gave the impression that it was a licensed airline, at which point Manx 2 updated the website to state that it was a Marketing Group and acting as an agent for the four AOC holders.

In 2006, Manx 2 had made an arrangement with Air Lada (the owner of the two Metro IIIs) to use the aircraft using an Air Operator's Certificate held by Eurocontinental Air. In 2009, the UK Department for Transport suspended Eurocontinental's AOC following a series of safety incidents in UK airspace.

Agencia Estatal de Seguridad Aérea (AESA), the Spanish aviation safety and security agency, suspended Eurocontinental's AoC and then revoked it completely in 2011.

Manx 2 stated that it was unaware of the number of safety occurrences reported because they were not included in the occurrence reporting list.

In November 2009, Air Lada and Flightline agreed to the operation of the two Metro IIIs under Flightline's Air Operator's Certificate. Operations and scheduled maintenance of the aircraft were to be conducted under Flightline's AOC while Air Lada would arrange commercial arrangements and flight scheduling. All maintenance costs were met by Air Lada.

AESA accepted the transfer of the two Metro IIIs from a suspended AOC to a new AOC holder as Flightline had different procedures and management structure. The application provided no details regarding how the aircraft would be used. AESA had no knowledge of Air Lada or Manx 2's history with the aircraft, nor that Air Lada were the owners of the aircraft. They were also unaware that the two former Eurocontinental Air pilots had moved with the aircraft to Flightline.

Thus, AESA approved the request to include the two aircraft on Flightline's AOC. The AOC approval forms did not approve low visibility operations for Take-Off, Approach and Landing for either plane. This means that both aircraft were only permitted to operate in CAT I limits.

Once the transfer was complete, in 2010, the two Metro IIIs resumed flying for Manx 2 under Flightline's AOC, offering the new service between Belfast City and Cork as well as night cargo flights for the Royal Mail. Manx 2 worked directly with Air Lada and there is no evidence of any direct contact between Manx 2 and Flightline. Although there were various documents which referred to the operator, the Operations Manager worked for Air Lada and the address and contacts used were all for Air Lada's office in the Isle of Man.

The Isle of Man has its own Civil Aviation Administration and a flight to or from the Isle of Man and the UK by a non-UK AOC holder requires permits from the UK and the Isle of Man. The permits were applied for by the Operations Manager of Manx 2 on behalf of Flightline, with Flightline named as the airline.

A new operational procedures document still in draft had only contacts for Manx 2. The Operator's Quality Manager named in the document was one of the pilots supplied by Air Lada. There was no evidence that Flightline appointed him to this position.

Flightline audited the operation on the Isle of Man two weeks after the new operation started in Ireland. The audit comments include the following:

4. Flight

The meteorology of the Isle of Man in particular, with strong winds and low minimum temperatures, and of England in general, necessitates a different approach to the operation. Both the commander and the co-pilot must be experienced and have a good level of English. Our company should guarantee this. Pilots who are currently operating do not have any problem in this sense.

5. Operational aspects

They must change the normal checklist and adapt it to our company, carry out the pre-flight inspection, sign it and apply the anti-icing system before entering the clouds. It is important to study the [Standard Operating Procedures] well, as well as clearly specifying in its list who is responsible for what and when…

The audit clearly states that experienced crews were required for the scheduled flights. Eight months later, the crew comprised of a Captain with questionable training who had been promoted four days earlier and a First Officer who had not completed his line check.

No further audits were done by Flightline.

Over the three months prior to the accident, there were no pilot reports, defects or maintenance entries made in the Technical Log. The Technical Log for the other Metro III included only two entries in its period of operation, both relating to an ignition problem.

Not a single normal maintenance issue over three months: no lights burned out, no oil top-ups, no defects at all. And no reference to the fact that the pilots were having to manually adjust the power levers to compensate for the engine torque differential. Scheduled maintenance was performed on the plane but, without a report, it’s very unlikely that the crack in the sensor coil could be spotted.

Flightline should have questioned the suspicious lack of defects in two of their aircraft. But for all intents and purposes, operations for the two aircraft were based on the Isle of Man and controlled by Air Lada and Manx 2, while using the operator’s certificate from Flightline in Spain.

Meanwhile, continuing oversight of the operator and its operation fell under the remit of AESA.

In the year before the accident, AESA performed eight audits and inspections were carried out on Flightlines flight operations. The evaluations included how the airline monitors and controls its operations.

However, they were unaware that the two aircraft were operating in the Isle of Man. There’s no obligation for an operator to inform the Authority regarding remote operations, although AESA did state that, had it known that the operation was remote and such a small number of people were involved, they would have taken a greater interest.

In the twelve months leading up to the accident, both Metro IIIs were subject to SAFA (Safety Assessment of Foreign Aircraft) ramp checks in Germany and Ireland. Both inspections included findings and, in one instance, the aircraft was not allowed to depart until the crew cleared the baggage/cargo which was blocking the emergency exits.

During the Eurocontinental Air operation, AESA had sent inspectors to the Isle of Man to carry out an extended ramp inspection. However, as they were unaware that the two aircraft had resumed operations there, no inspectors were sent.

AESA further informed the investigation that ‘in order to have better tools/procedures for proper oversight of a remote operation, EU regulation should require the operators to provide the certifying Authority with a formal declaration stating which are the organizations that ultimately decide the flight’s schedule, routes, crew roster, etc.’

After the accident, the EU Air Safety Committee met with AESA to clarify whether AESA’s surveillance activity of Flightline had provided the evidence that Flightline was capable of adequately supervising its remote operations. AESA stated that ‘they decided to limit the AOC of Flightline to prevent operation of the Fairchild Metro 3s, and that they had initiated the process to suspend the AOC.’

Commission Implementing Regulation (EU) No 390 of 2011 (establishing the European Community list of air carriers which are subject to an operating ban within the Community) stated the following:

Flightline explained that they had entered into a business arrangement with the company Air Lada, not a certified air carrier, to operate two Fairchild Metro 3 aircraft, registrations EC-GPS and EC-ITP, using pilots provided by Air Lada. The Commission pointed out to Flightline that the same aircraft had previously been operating within the AOC of Eurocontinental, another air carrier certified in Spain and that as a result of SAFA inspections and significant safety incidents with the operation of these aircraft, AESA had suspended Eurocontinental Air’s AOC.

The Commission invited the air carrier to make a presentation to the Air Safety Committee and noted that AESA had decided to limit the AOC of Flightline to prevent operation of the Fairchild Metro 3s, and that they had initiated the process to suspend the AOC.

At a meeting on the 19th of October 2011, AESA briefed the Commission on ‘the actions taken to date to address the identified safety issues with Spanish air carriers in a sustainable manner’. Flightline’s AOC was renewed, following corrective actions, but limited to exclude the aircraft of the type Metro III.

In 2010, Welsh ministers working with Manx 2 and FLM Aviation to provide a scheduled air service between Cardiff Airport and RAF Valley on Anglesey. However, the AOC of FLM Aviation, one of the four other operators working with Manx 2, was revoked by the German regulatory authority. Manx 2 continued to sell tickets for the route, replacing FLM Aviation with an air carrier operating under a UK AOC.

In late 2012, Manx 2 informed the investigation that its assets were being sold to a new company as a part of a management buy-out. The new company commenced operation on the 2nd of January 2013 and continued to sell tickets on the route.

The Manx 2 website was updated on 28th of January 2014 with a full statement regarding the final report.

Manx2.com statement on AAIB Final Cork report

Manx2 contracted all the flying to EU airlines licensed and required, as was the Operator, to operate in compliance with the stringent standards and controls of the European Aviation Safety Agency (EASA), recognised to be among the most stringent in the world, under the oversight of their national aviation safety authorities. Unfortunately, the report is clear that the prime causes of the accident were decisions made by the Flightline crew in adverse weather conditions, compounded by inappropriate crew rostering by the Operator and a significant lack of oversight by the Spanish air safety authority.

The investigation concluded that the the commercial model of a ticket seller providing an air service is not in the best interests of passenger safety, as the ticket seller has “an inappropriate and disproportionate role with no accountability regarding air safety”. It’s sad to note that in the end, they didn’t take responsibility and the new company that was formed uses the exact same model.

31 January 2014

Manx 2 Fatal Accident at Cork: Below the Required Minima

Last week, the Final Report covering the accident of Fairchild SA 227-BC Metro III EC-ITP at Cork Airport was released by the Air Accident Investigation Unit in Ireland.

In order to completely understand all the factors that come into play in this 244-page report, I am going to split my analysis into two parts. Today, we’ll look at the specifics on the day of the crash. Next Friday, I will focus on the organisational factors which directly led to this fatal incident.

Over the night of the 9th/10th of February, the aircraft served as a night cargo charter for UK Royal Mail from Belfast to Edinburgh to Inverness.

On the 10th of February at 05:10, the aircraft was repositioned back to Belfast, ready for the scheduled flights of the day.

06:15 The accident flight crew commences duty.

They downloaded flight documentation and meteorological information for Belfast City, Cork and Dublin.

Cork had been operating under Low Visibility Procedures since 15:50 on the 8th of February, two days prior.

06:40 The aircraft, EC-ITP, departs Belfast to reposition at Belfast City.

07:15 EC-ITP arrives Belfast City, leaving the flight crew with a 35 minute turnaround.

The scheduled flight was Belfast City to Cork and back to Belfast City. Waterford Airport was specified as the alternate airport for Cork. No second alternate was nominated.

They fuelled with enough total quantity for the planned round trip to Cork and back to Belfast City with required reserves.

Boarding of passengers was delayed due to the flight crew working on the passenger seats in the cabin.

07:50 The doors closed with all ten passengers on board.

No cabin crew was on the flight, nor was one required, as there was only a limited number of passengers.

The First Officer gave the safety briefing and the flight crew prepared for departure.

08:10 The aircraft is reported as airborne and climbing to Flight Level 120.

08:34 Flight crew establishes communications with Shannon Air Traffic Control.

08:48 Communications handover to Cork Approach Control.

At that time, the Cork Automated Terminal Information Service (ATIS), which offers the latest actual meteorological conditions, broadcast that Runway 35 was active and Low Visibility Procedures (LVP) were in operation.

Cork Approach also informed the flight crew that Runway 35 was active but the visual range at Cork at that time were below the required minima for CAT I operations. They informed them that a CAT II approach was available for Runway 17.

A Category II instrument landing system is used in low-visibility conditions.

08:58 Aircraft establishes on the ILS approach to Runway 17 and contacts Cork Tower.

09:00 Cork Tower relay the Instrument Runway Visual Range, which is below the required visibility of 550 metres for the CAT II approach.

The decision height (or decision altitude) on a precision approach is the point where, if you do not have visual contact with the runway, you must discontinue your approach and climb (a missed approach).

It is the job of the Pilot Not Flying to monitor the approach and act as look out. He’s expected to call attention to deviations from procedure and watch for the decision height. It is his job to call when the approach lights or runway is clearly in sight. The decision height at Cork for the ILS approach to Runway 17 is 200 feet.

In this flight, the First Officer was the Pilot Flying and the Captain was the Pilot Not Flying.

09:03 The First Officer carries out a missed approach. The lowest height recorded by the Terrain Awareness Warning System on the aircraft was 101 feet.

Cork Approach offered radar vectors and the flight crew requested an approach to Runway 35, hoping that, with the sun behind the aircraft, they might be able to make visual contact with the runway.

09:10 The flight crew speaks to Cork Tower, reporting that they are eight nautical miles from the runway. Cork Tower informs the aircrew of the Instrument Runway Visual Range, which is again below the required minima for the approach. The aircraft continues with the approach.

09:14 The First Officer carries out a missed approach.

The lowest height recorded on this approach was 91 feet.

09:15 The flight crew request to enter a holding pattern for “fifteen to twenty minutes” to see if the weather conditions approve.

They maintained the holding pattern at 3,000 feet and requested weather for Waterford Airport, their alternate airport. Waterford was also below the required minima for an approach, so the flight crew requested weather information on Shannon. Conditions there were also below the required minima and Cork Approach offered to get weather for Kerry Airport. Kerry Airport conditions were good, with visibility in excess of 10 kilometres.

09:33 The aircraft is still in the hold when the Instrument Runway Visual Range at Cork shows a slight improvement.

Cork Approach (to a different aircraft): Surface wind zero nine zero degrees seven knots, ah…visiblity three hundred metres in fog, broken at one hundred, IRVR runway one seven now is four hundred metres all round.

Captain: See, it’s improving a little bit now, it’s four hundred.

The required minima is 550 metres.

The flight crew discuss their alternates and agree to hold a bit longer and see if visibility at Cork improves.

First Officer: Kerry’s alright.
Captain: It’s alright okay, so… In case we’ll proceed in the beginning there.
[sound of a bag being zipped or unzipped]
Captain: I always bring with me—brought with me—some notes about the alternative and all this kind of things and I never use it and now I don’t have it here.
First Officer: Is that the thing that’s pinned up on the board in the office?
Captain: Yeah, exactly.

09:39 The conditions improve again slightly and the flight crew decide to attempt a third approach into Cork, although the conditions are still below the required minima.

The Captain briefed the go-around procedure and that although he will be the Pilot Not Flying, he will apply power.

The First Officer by this time has done the flight, two missed approaches in bad visibility and a fifteen minute hold in an aircraft with no autopilot and no flight director. He must be beginning to feel the strain.

Captain: ….Okay go-around in case I apply power, flap one quarter. Okay, go-around flap positive rate gear up, okay, four hundred feet we clean the plane and that’s it.

09:45:22 Flight crew reports established on ILS Runway 17.

09:45:26 Cork Approach reports that the Instrument Runway Visual Range has improved to 550 metres, the required minimum.

09:46:00 Flight crew report to the Tower passing 9NM from the DME, that is, they are nine nautical miles from the runway.

Tower: Flightavia four hundred Charlie, good morning to you again. You are cleared to land runway one seven; the wind is zero nine zero degrees niner knots.
Commander: Cleared to land one seven, Flightavia four hundred Charlie.

09:46:15 The final Instrument Runway Visual Ranges reported by Cork Tower were now below below the required minima of 550.

Tower: Touchdown RVRs five hundred midpoint four hundred stop end four hundred.
Captain: Copied, thank you very much.
First Officer: It’s gone down, woah. I want the other guy’s RVRs, they were better.
Captain: Yeah, fifty feet less.

The RVR is measured in metres not feet, and the RVR was actually fifty metres less, not feet.

As per the briefing, the Captain operated the power levers during the latter part of the approach. This is important because the First Officer, who is the Pilot Flying, is now potentially missing input as to what is happening with the power.

The Captain, as Pilot Not Flying, is also counting down to the minimum descent height of two hundred feet, at which point they must either have the runway in sight or break off the approach.

Here’s what the Pilot Not Flying actually said.

“Okay minimum. Continue.”

Captain: Okay, capture again very good….sorry it’s eh, six hundred for minimum.
First Officer: Thank you.
Captain: Okay, five hundred for minimum. Three hundred for minimum. Watch out, glideslope. Two hundred for minimum. Localiser…yeah. One hundred for minimum.
Terrain Awareness Warning System: FIVE HUNDRED
Captain: Okay….[unintelligible]
Terrain Awareness Warning System: FOUR HUNDRED
Terrain Awareness Warning System: THREE HUNDRED
Terrain Awareness Warning System: MINIMUMS, MINIMUMS
Captain: Okay minimum. Continue.
Terrain Awareness Warning System: TWO HUNDRED
First Officer Okay

They once again descended below the decision height of 200 feet above the ground. However this time, the aircraft reduced power and at the same time experienced a roll to the left.

Terrain Awareness Warning System: ONE HUNDRED
Captain: Go around!
First Officer: Round.
Terrain Awareness Warning System: FIFTY
Terrain Awareness Warning System: FORTY

The Captain applied go-around power which is when they lost control of the aircraft. The aircraft rolled rapidly to the right and the right wingtip contacted the runway surface. The aircraft continued to roll.

One of the surviving passengers was able to describe the moment of impact.

“I do remember looking out and the ground was just feet from below us and it was grass, it was definitely not tarmac. And the pilot then gave the plane thrust, to come up out of the cloud. And at that stage, the cloud was right to the ground. I feel that the plane … immediately after the thrust, veered to the right and tilted…the right hand of the wing caught the ground first and after that it was just mayhem… I couldn’t breathe because all the mud had come up into the fuselage… I do remember pushing the mud away and then being able to breathe…”

09:50:34 The aircraft, inverted, impacts the runway. The recording ends.

09:56 The Instrument Runway Visual Range improved to 650/550/550 on Runway 17. By 10:08, 18 minutes after the accident, the visibility exceeded 2,000 metres.

The two flight crew and four passengers suffered fatal injuries. Four other passengers suffered serious injuries and the two remaining passengers had only minor injuries.

The final report gives the following primary cause:

  • The crew did not give adequate consideration to the weather conditions in Cork.
  • The crew breached the minimum decision height (DH) during all three approaches.
  • The captain applied reverse thrust which caused the aircraft to roll to the left due to the No.1 engine retarding to -9% torque, the No.2 engine stayed at 0% (idle). The power difference was due to a differential in power in the right engine, which was not corrected in maintenance checks. The AAIU believes the co-pilot applied right control inputs to counteract this, subsequently the application of full power to commence the go-around at 100ft coincided with the commencement of a rapid roll to the right and loss of control resulting in the subsequent accident.

How did this happen? Next week, we’ll look at the human factors in play here and untangle the complex relationships between the companies which led to the lack of regulatory oversight specified as a direct contributing factor.