You are browsing category: Accidents and Incidents
25 October 2013

Near Miss over Scotland

UK news headlines have highlighted a near miss over Scotland in June this year, when two Boeing 747s lost separation. In the UK, an aviation near miss is known as an airprox and the UK Airprox Board has just released a compendium of the airprox incidents assessed at their September 2013 meeting. I was immediately intrigued as this type of near miss between commercial aircraft isn’t something I would expect to see in 2013 (since Ueberlingen, really).

There were two commercial aircraft heading out to sea for a long crossing. Both were Boeing 747′s, still one of the fastest heavy jets in commercial use.

12:50:40 Aircraft 2 requested a climb from FL320 to FL340. The traffic controller co-ordinated the climb with the next sector and the pilot was cleared for FL340. At the time, the aircraft was 20.1 nautical miles from the Montrose sector.

12:52:00 Aircraft 1 contacted the Montrose sector maintaining FL340.

The two aircraft were 24.3 nautical miles apart and on converging tracks.

The air traffic controller said usually, he would put the electronic strips of conflicting traffic together and suitably highlighted. On this occasion, he hadn’t done this.

12:55:22 A Short-Term Conflict Alert was triggered. The two aircraft were 9.8 nautical miles apart.

In class C airspace, the minimum separation for the two aircraft at the same altitude was 5 nautical miles horizontally.

The Air Traffic Controller was not immediately able to transmit as another aircraft was transmitted on the frequency. As soon as it was free, he transmitted to Aircraft 1. Note that the correct call signs were used at all times and the two call signs were not in any way similar to each other.

ATCO to Aircraft 1 Avoiding action, turn left immediately heading two seven zero degrees, traffic on your right one o’clock.

Aircraft 1: Two seven zero.

ATCO to Aircraft 2: Avoiding action turn right immediately heading zero five zero degress traffic in your left eleven o’clock.

Aircraft 2 acknowledged the call with his call sign.

Here’s the diagram from the report. You can see that the two aircraft are converging, but if Aircraft 1 turns left and Aircraft 2 turns right,
it will be resolved.

These instructions should have separated the aircraft easily.

12:56:00 The two aircraft were 6.6 nautical miles apart and were still on converging headings.

The air traffic controller said he was aware that neither aircraft had given a full readback repeating the instructions but he was concerned that the crew’s workload was high and he didn’t want to distract them further.

He specifically avoided giving them an instruction to climb or descend as he would risk giving instruction that conflicted with the on-board Traffic Collision Awareness System (TCAS), which only gives vertical instructions.

And here’s where it went wrong:

Somehow, the captain of Aircraft 1 believed he had been given an instruction for an immediate right turn. It was clear that this was to keep separation from another aircraft and the captain believed that this other aircraft had been told to turn left to heading 270. As Aircraft 1 turned right, the crew saw Aircraft 2 at the same level, flying straight towards them.

Meanwhile, the captain of Aircraft 2 had understood an immediate left turn for heading 270. He was under the impression that Aircraft 1 was turning right with a heading of 050. He started the turn and then checked with the controller.

Aircraft 2: And just to confirm, did you give us a heading?

ATCO to Aircraft 2: Affirm. Avoiding action turn right immediately heading zero five zero degrees.

Aircraft 2: Zero five zero right turn.

ATCO to Aircraft 1: Avoiding action turn left immediately heading two six zero degrees traffic in your right one o’clock.

Aircraft 1: Two six zero with traffic in sight.

12:56:17 Separation was lost, triggering a high-level Short-Term Conflict Alert. The distance between the aircraft was 4.9 nautical miles with both at FL340.

A second controller came to provide assistance and recommended that the aircraft be given vertical instructions.

ATCO to Aircraft 1: Descend now immediately.

A Traffic Collision Avoidance System (TCAS) is installed into all modern commercial transport aircraft . It interrogates the transponders of all nearby aircraft, receiving their altitude and distance. The TCAS offers traffic advisories to alert the flight crew of nearby aircraft. When the flight crew receives a traffic advisory (TA), they are not expected to perform avoidance manoeuvres, simply to be aware that there is the possibility of a conflict, in which case the TCAS will offer a resolution advisory (RA). It gives the flight crew a chance to locate the other aircraft visually and prepare for the next instruction.

TCAS predictions are based on the assumption that aircraft are flying straight.

As Aircraft 2 turned (correctly) to the right, his TCAS alerted him of the conflict with an instruction to climb to avoid the other aircraft. He reported this to the controller.

Aircraft 2: Resolution advisory in the climb.

The TCAS in Aircraft 1 gave the pilot an instruction to descend. It wasn’t reported but the flight crew followed it.

Although the controller was right to be nervous, his instruction and the TCAS advisory were in synch.

The two aircraft were now 3.5 nautical miles apart with a vertical separation of 300 feet.

12:56:37 Aircraft 1 was at FL332 as Aircraft 2 was climbing through FL344, so vertical separation was regained with the horizontal distance now 2.8 nautical miles.

The potential conflict officially becomes a near miss.

So, the first issue is that both aircraft were placed on the same level when they were less than 25 nautical miles from each other. However, it’s not unusual and within the report, it’s not cited as a cause, simply a contributing factor. The next instruction by the controller was more than sufficient to keep the required 5 nautical miles required separation.

The cause, then, is that both crews somehow misunderstood the controller and followed the instructions that were given to the other aircraft.

It was apparent that both crews had taken each others’ instructions, and the Board found it hard to determine why this had occurred; unfortunately no Human Factor report was available from either crew. The Board was surprised that all four pilots had misheard or misinterpreted the avoiding action instructions despite at least one of the crews reading them back correctly. One airline pilot Member wondered if there could have been callsign confusion; this was discounted because they were not similar, nor could they have been confused with heading information – ATSI confirmed that the transmissions were clear on the RT recording.

Having discounted this, the Board considered other potential causes of confusion. It was possible that the crews may have been distracted because this would have been about the time that they would have been receiving their Oceanic clearances on data-link. Another possibility mooted by an airline-pilot Member was that, having settled into their trans-Atlantic routine, it was unusual for pilots to be issued with avoiding action instructions at that altitude and location. Expecting only routine information to be transmitted at that time, they may have been perplexed by the avoiding action information and instinctively responded without properly assimilating it.

The best explanation given was that flight crew practice avoiding action in conjunction with TCAS alerts (which are always climb or descend) rather than ATC instructions. So it was not a type of instruction that they expected or were familiar with.

PART C: ASSESSMENT OF CAUSE AND RISK

Cause: The pilots of ac on converging tracks flew into conflict because, although they acknowledged timely avoiding action, they did not follow it.
Contributory Factor(s): The Montrose T & P climbed the ac to the same level.

Degree of risk: C.

ERC Score: 102.

I’ve written about the Toyko near miss in Why Planes Crash: 2001 and the Ueberlingen collision is covered in the upcoming 2002 book. So it is a relief to see TCAS doing its job in this case and ensuring that the aircraft did not come any closer. TCAS should only offer a further level of protection but in this case, it did the job.

I’m not sure this incident deserves the press it has been receiving but for considering airprox situations and how to avoid them escalating, it’s sure to continue to gain attention.

You can read the full report here, which covers fourteen reported events. This incident is filed as 2013054, which starts on page 61.

11 October 2013

Cessna Missing Barrington Tops and the 2013 Search

Special thanks to Mark Nolan who filled me in on this and made scans of the original investigation available to me so that I could use primary sources for this post.


On the 9th of August in 1981, a Cessna 210 registration VH-MDX was on a booked flight from Prosperpine to Bankstown, with a refueling stop in Coolangatta.

John Challinor owned the company to which the Cessna 210 was registered. He also owned a motor yacht which sailed from Sydney on the 31st of July. Noel Wildash and Ken Price were two of the crew members. They picked up Challinor, Rhett Bosler and Phillip Pembroke on the Sunday night and headed for Prosperpine.

Challinor had arranged for pilot Michael Hutchins to fly VH-MDX from Sydney to Prosperpine on Saturday the 8th of August to fly everyone back to Sydney.

Saturday night, Hutchins arrived and spent the night on the boat. The next morning he refueled and shortly after 10am he departed Prosperpine for Coolangatta with four passengers on board: Wildash, Price, Bosler and Pembroke.

The aircraft had been serviced from new and had just completed a 100 hourly inspection. It was approved for IFR operations but not for flight into known or forecast icing conditions, as it was not equipped with suitable de-icing equipment.

At Coolangatta, Mr Gordon Grieg, an experienced pilot, was manning the refuelling pumps when VH-MDX taxied in. From the investigation notes:

He said he was surprised at the amount of power used – about 1500 rpm. When the five occupants left the aircraft, he found he knew one of them, Ken Price – well. They looked a bit scared. The pilot looked pale and a little tired. They all went to the Clubhouse and chatted for a while. The pilot seemed impatient to get away again.

Mr Greig said that the wind was making the flight bumpy and unpleasant. The pilot remarked that there was some problem with the gyros or electrics and it was suggested by Mr Greig that they remain overnight at Coolangatta but this was not acceptable to the pilot. They boarded the aircraft, Ken Price taking the right front seat, two medium weight passengers in the centre seats and the largest – a man with a black beard, the left rear seat. The pilot had trouble with the engine start, cranking and cranking, and eventually it fired. The aircraft then taxied and departed. Mr Greig estimated the weight of the men as – Pilot 11 1/2 stone, Ken price 16 1/2 stone, the two centre seat passengers 11-12 stone and the rear seat passenger (he had a black beard) 16 stone.

VH-MDX picked up weather forecasts while they were there.

Weather forecasts indicated a strong west-southwesterly airflow over northern New South Wales, with considerable cumulus or cumulus up to 6000 feet to the east and over the coast. The freezing level was expected to be between 4000 and 7000 feet above mean sea level, and moderate icing was forecast in cloud above that level. A SIGMET (forecast of significant weather which may affect aircraft safety) was current, indicating occasional severe turbulence existed below 12,000 feet to the east of the mountains.

The flight was planned Night VMC (remaining in visual conditions).

They departed Coolangatta and proceeded “without recorded incident” to Taree. Their flight plan had them track along the coast to Taree, then inland via Singleton and Mt. McQuoid in order to avoid the controlled airspace and military restricted areas surrounding Williamtown.

Note: All times are in GMT: add ten hours for Australian EST. I have added punctuation and dropped some of the standard callsign references from the official transcript for clarity.

08:50:31 VH-MDX contact Sydney Flight Information Service 5 on 121.6 to report that they are cruising at 8,000 feet and estimate overhead Singleton at 19:30 EST.

MDX: Ah, Mike Delta Xray was at Taree at five zero eight thousand estimating Singleton at time three zero.

FIS 5: Mike Delta Xray would you prefer a clearance via overhead Willie if it’s available?

MDX: Mike Delta Xray would prefer Williamtown.

08:53:00 Sydney FIS 5 contact Williamtown Tower and then speak to Sector One for clearance.

FIS 5: There’s an aircraft following, a Mike Delta Xray night VMC 210. He was at Taree at five zero…

Sector One: Before you go on, we’re not night VMC so clearance would not be available in controlled area.

FIS 5: It won’t?

Sector One: It won’t be available in my airspace, anyway.

The airspace in Sector One did not have the weather conditions to allow for the night visual flight. However, they agree to check with Williamtown Approach to see if it’s possible for MDX to fly low level along the coast.

FIS 5: Approach, you have Mike Delta Xray, a Cessna 210. He’s overhead Taree at this stage. Sector One advises his airspace is nonVMC. Would there be a clearance available for that aircraft coastal?

Williamtown Approach: I’ll check on the weather and let you know.

FIS 5: OK then and if you could advise the highest level that he could expect.

08:54:30 Sydney FIS 5 call MDX back to let them know the options.

FIS 5: I have checked you with Sydney Control and they advise their airspace high level is non-VMC. A clearance coastal at a lower level may be available, I will advise. So would you prefer to take that or track now via Craven, Singleton?

VH-MDX: I prefer to go coastal.

08:56:00 However, a few minutes later, MDX calls back.

VH-MDX: Rather than wait for the clearance, we’ll track via Craven, thank you.

09:01:13The controllers continue to discuss the weather conditions and the possibility for clearance on behalf of MDX.

FIS 5: OK, he couldn’t wait, he ended up virtually on the boundary so he took off back to Craven.

Williamtown Approach: Was it that critical, was it?

FIS 5: It was that close, yes.

Williamtown Approach: He was running out of gas or something, was he?

FIS 5: No, he just didn’t want to hang around. He was virtually on controlled airspace and he didn’t want to hold in the area, so he’s tracking down to Craven.

Williamtown Approach: Which way is he going? Craven-Singleton or something?

FIS 5: Yes, he was going to go Craven-Singleton.

09:19:19 MDX confirm to Sydney FIS 5 that they are overhead Craven.

VH-MDX: Sydney, Mike Delta Xray at Craven at one eight, 8000, Singleton 36 and we’re experiencing considerable turbulence now and quite a lot of down draught.

FIS 5: Mike Delta Xray, roger. Standby.

09:23:25 FIS 5 is dealing with other flights in the area and discussing the turbulence and clouds at different levels when MDX call back.

VH-MDX: Sydney, Mike Delta Xray is in the clag, in turbulence and would request a clearance to ah 10,000 from 8000.

FIS 5: Echo Sierra Victor, Sydney. Understand the winds at 9000 are westerlies about 70 knots. Are there any clouds in that area?

ESV: Ah negative, there’s no cloud at all above 8000 feet.

FIS 5: Mike Delta Xray, Sydney. Echo Sierra Victor advises no cloud about 8000 feet; however the westerly winds are about 76 knots.

VH-MDX: Just to compound a little problem, I lost my AH and DI and if I could get 10, I’d appreciate it and also a radar steer to Bankstown.

FIS 5: No traffic at one zero thousand. Report cruising one zero thousand. Can you maintain a rate of climb without your artificial horizon?

VH-MDX: Yes, affirmative, I’ll go to ten thousand…

09:25:41 He’s lost his artificial horizon (AH) and his directional indicator (DI). Sydney FIS 5 contact him to make sure his other instruments are working and that he has visual contact with the ground, which means he could work around the failure.

FIS 5: Just to confirm your ADF and VOR on board the aircraft are operating normally.

VH-MDX: My ADF is going all over the place.

FIS 5:Roger. Just confirm in VMC at this time.

VH-MDX: Negative.

(It doesn’t matter how often I read that exchange, I feel sick every time.)

09:26:51 Sydney FIS 5 don’t bother to respond to that call; they go straight for radar identification.

FIS 5: Uncertainty phase declared Mike Delta Xray 0926 in IMC VFR

FIS 5: We’ve got an aircraft who’s in IMC on climb to one zero thousand, without an artificial horizon on track Craven Singleton with a wonky ADF. I’ll see if he’s got a transponder, or which he has, if I can get him to squawk, what code for you, for us, thanks, if we can identify him.

09:28:28 MDX is radar identified thirty-six miles north of Singleton on the Mt Sandon-Singleton track.

But the pilot has a new problem: the aircraft isn’t climbing.

VH-MDX: I’m struggling to get to 85.

FIS 5: Mike Delta Xray Roger

VH-MDX: Ah Sydney, Mike Delta Xray. Can you give me a vector to West Maitland please?

09:31:08 Sydney FIS 5 relay the request to Sector One, who confirm that the aircraft has turned southbound and ask FIS 5 to get his current heading.

FIS 5: Mike Delta Xray, present heading?

VH-MDX: Mike Delta Xray is averaging somewhere around 220.

Sector One: 220, tell him I don’t know what it’s like for cloud. He’s in cloud at the moment, is he?

FIS 5: Yes, mate.

Sector One: And he’s lost his artificial horizon.

FIS 5: And his ADF by the sound of things.

Sector One: And his ADF.

FIS 5: Yes, he’s got problems, this boy.

09:34:15 Sydney FIS give MDX a track for West Maitland and is trying to find out what the cloud cover is like over Williamtown when MDX call back.

VH-MDX: We’ve picked up a fair amount of ice and I can just make out a few towns on the coast. I’d appreciate it .. Oh hell, we just got in a down draught and we’re down at about a thousand a minute.

FIS 5: MDX, roger. Is the aircraft equipped with pitot heating?

VH-MDX: It’s a single (engined) and we’ll try to continue our flight plan.

FIS 5: Roger. The lights are on at Maitland, the lights are on at Maitland.

VH-MDX: Say again Maitland?

FIS 5: The lights are on at Maitland, if you wish to divert and make a landing at Maitland.

VH-MDX: No, we thought we had a … just to compound things, we thought we had a cockpit fire but we seemed to resolve that little problem. West Maitland but would appreciate it if you could leave the lights on for a while.

FIS 5: Mike Delta Xray Wilco.

09:35:43 The only copy of the audio transcript that I could find was very hard to understand. But by now, you can hear the stress in the voices.

FIS 5: Mike Delta Xray, Sydney. If possible could you squawk code now 3000 with ident?

VH-MDX: We’re squawking 300 ident and we’re up and down like a yo-yo.

FIS 5: Roger, we’re looking for you.

VH-MDX: Sydney, MDX. We’re having a little bit of a problem in that our standby compass is swinging like blazes.

FIS 5: Roger, are you able to maintain a gyro heading?

VH-MDX: Negative, we’ve lost the AH and DI, the vacuum pump’s gone.

FIS 5: MDX Roger Sydney.

VH-MDX: And we’re picking up ice

FIS 5: And your present altitude?

VH-MDX: Seven and a half.

FIS 5: Roger and if possible, could you give us some idea of your present endurance when available?

09:37:54 MDX is no longer in a position to answer questions.

VH-MDX: We’re having strife up here, we’re…

VH-MDX: We’re losing a hell of a lot of…

VH-MDX: We’re down to six and a half

FIS 5: Mike Delta Xray, roger, Sydney. Your lowest safe in that area is six thousand, at this time if you continue towards the coast, towards Williamstown, Sir.

09:39:23 The last transmission from MDX is received.

FIS 5: Mike Delta Xray.

FIS 5: Mike Delta Xray, Sydney.

VH-MDX: Five thousand!

FIS 5: Mike Delta Xray, Sydney.

FIS 5: Mike Delta Xray, Sydney.

FIS 5: Mike Delta Xray. Mike Delta Xray, Sydney.

A NASA instructor was conducting a Night/VMC dual training flight in the local area. He diverted to Singleton due to “a wall of cloud” lying on a line to Nelson Bay and heard the exchange between final exchanges between Sydney and MDX.

This is from the investigation notes:

He remembered thinking that the pilot’s voice was very casual when commenting that his aircraft was going up and down like something or other and detailing other problems he was having.

The voice became more panicky, however, and on the last call – which was short and said only “Sydney – 5000” or something like that, it was nearly screaming.

He heard no calls from the aircraft after that.

The last known radar position of the aircraft was recorded as over Barrington Tops at 09:36 GMT.

Sydney Air Search and Rescue immediately diverted a number of commercial flights into the area to carry out a visual search. The aircraft were in the vicinity within ten minutes of the last transmission. A full-scale search was in place by the next morning, despite gale-force winds and temperatures at or below freezing. The search area was centred aroudn the Barrington Tops, described in the search report as “the most heavily forested, rugged, inaccessible part of New South Wales”. If the fuel did not ignite, there would be no visible scar, making it difficult to locate the crash site.

The search continued for nine days.

From the search report:

During the period of the search fixed wing aircraft flew 80 sorties totalling 191 search hours and holicopters flew 109 sorties, totally 175 search hours.

In addition, large ground search parties comprising Police, Forestry, Water Board, Bushwalkers, State Emergency Services personnel supported by 4WD vehicles and trail bikes searched a large part of the most probable area.

The extreme cold at the higher parts of the Barrington Tops and the strong westerly winds made the search dangerous both on the ground and in the air.

Assistance of the RAAF was made available to photograph the complete search area, subsequent analysis failed to reveal any significant information. Action to utilise Satelite information from “Landsat” and the U.S.A.F. also resulted in nil information.

Ground search by Police and volunteers also failed to provide any information as to the whereabouts of the missing aircraft.

Search terminated Tuesday 18th August 1981 following a total of 412.75 hours of unsuccessful air search.

The Air Traffic Controller on duty at Sydney that night posted about it on a blog dedicated to collecting information about the crash: Missing Plane Over Barrington Tops.

I was the ATS officer on the Sydney Sector (FIS 5) who had the misfortune to be on duty when these events occurred. It was one of the worst nights of my life.
[…]
You may like to know that I was also rostered on the same sector the next day when the search got underway in full with daylight, from memory I think there were 22 aircraft including helicopters involved, I remember afterwards being kept so busy as it stopped one thinking about the events of the night before. They (the search aircraft) found a few older wrecks but never MDX or any indication of the crash site.
[…]
There had been numerous accidents where pilots had inadvertently overstressed the aeroplane and pulled the wings off, so it may well be that the wings are in one place or several places and the fuselage body in another and it would be badly compacted either way, so really anybody looking for the aircraft would probably only see perhaps a wing tip or wing and a bit of tail.

The Bushwalkers Wilderness Rescue Squad were involved in the original search and they have never given up. Over the past thirty years, they have been searching through sectors on foot and collating information about the possible crash site.

One of the amazing things about this blog is the friends that I’ve made since I started it. One of those friends is Mark Nolan.

Mark Nolan is a corporal in the Australian Army. He’s also a bushwalker and a pilot. He’s been obsessed with the mystery for years, driven, as he puts it, by wanting to know the end of the story. This year, he found newly released documents in the national archives with new information. Using modern technology, it’s possible that Mark and the Bushwalkers have managed to limit the area where VH-MDX is likely to have crashed. He’s convinced they have a better than average chance of finding it this time, especially because the New South Wales Police Rescue Squad are hosting a full scale search with them:

They will be searching next week, from the 17th to the 21st of October.

Mark, stay safe. We’ll be waiting for you to to tell us every last detail about the search upon your return.

We’re all hoping you’ve cracked it!

04 October 2013

We’ve Lost the Cabin: Update on Southwest Flight 812

Last week, the National Transportation Safety Board released an accident brief about the emergency descent of Southwest Airlines flight 812 to Yuma, Arizona on the 1st of April, 2011.

At 34,000 feet, climbing through to FL360, there was a loud sharp noise. The cabin experienced rapid decompression.

Shawna Malvini Redden, a passenger on the flight, blogged about the experience:

The Blue Muse: Southwest Flight 812: I prefer my plane without a sunroof, thanks

An explosion. A loud rush of air. A nosedive toward the ground. An oxygen mask? I had not anticipated a change in cabin pressure.

With hypoxic fingers, I fumble the mask. With chagrin, I realize it really does not inflate.

To my right, a mother shrieks in hysteria, her panic rising above the din. Ahead, a young man with curly brown hair and an easy smile walks about, helping to affix oxygen masks. Behind me, a woman’s tears stream down her face as the shock sets in.

I realize I have my seat mate’s hand in a death grip.

This is Southwest Flight 812.

The Federal Aviation Commission released the audio recordings after the event which you can hear on the FAA site or read online: PDF Transcripts of Southwest Flight 812, April 1, 2011.

Here’s the initial discussion, with added punctuation and the times given as local time. R6 and D31 are controllers covering specific sectors in the Los Angeles Air Route Traffic Control Center.

15:55:57 Southwest Airlines 812 Southwest eight twelve. Thirty two climbin to flight level three six zero.
15:56:00 R60 Southwest eight twelve LA center roger.
15:57:47 Southwest Airlines 812 Center (unintelligible) eight twelve
15:57:51 R60 Southwest uh I’m sorry who was that
15:57:55 Southwest Airlines 812 …twelve
15:57:56 R60 I missed that last call. Who was that?
15:57:57 Southwest Airlines 812 …twelve
15:58:00 R60 Southwest eight twelve uh was that you?
15:58:02 Southwest Airlines 812 Yes sir (unintelligible) declaring an emergency descent declaring an emergency we lost the cabin.
15:58:08 R60 Yeah Southwest eight twelve I’m sorry, I could not understand that. Please say again.
15:58:12 Southwest Airlines 812 Requesting an emergency descent. We’ve lost the cabin. We’re starting down.
15:58:15 R60 Southwest eight twelve descend and maintain flight level two four zero.
15:58:20 Southwest Airlines 812 Two four zero Southwest eight twelve.
15:58:24 R60 What altitude do you need?
15:58:26 Southwest Airlines 812 (unintelligible) We need uh ten thousand.
15:58:29 R60 Understood.
15:58:33 D31 Sector ten and thirty one.
15:58:35 R60 Yeah this is Sector uh sixty. Southwest eight twelve is a emergency decompression descent he’d like ten thousand feet. Can you approve that?
15:58:43 D31 Uh…
15:58:45 R60 He’s doin’ it anyway.
15:58:47 D31 Yes. Yes, approved.
15:58:48 R60 He’s descending to ten thousand (unintelligible) I’ll be flashing him to you.
15:58:52 Unknown You done good.

The flight was approved for a direct return to Phoenix but then they realised that Yuma International Airport, a “shared use” military and commercial airport, was closer. The flight landed at Yuma at 16:32 local time. A flight attendant and one passenger received minor injuries as a result of the incident; both were treated at the airport.

A section of the fuselage skin about 5-foot by 1-foot (152cm by 30cm) had fractured and flapped open hole in the crown area on the left side, aft of the over-wing exit.

Southwest grounded 80 aircraft as a result of this incident, all Boeing 737-300s which had not already had the skin on their fuselage replaced. Boeing announced a Service Bulletin instructing operators to inspect the aircraft. This was followed by the FAA issuing an Emergency Airworthiness Directive which led to 136 aircraft worldwide being inspected for fatigue cracking.

Now, we finally have a report on the investigation which clarifies a few of the issues.

One aspect of the incident which was surprising is that both of the people injured were airline staff and neither had their oxygen masks on.

Here’s a pop quiz!

When the aircraft loses pressurisation, what is your number one priority?

  1. Getting your oxygen mask on
  2. Helping other people get their oxygen masks on first because real men don’t need oxygen
  3. Get your oxygen mask on
  4. Making an announcement about putting oxygen masks on
  5. Get your bloody oxygen mask on!

If your answer has an even number, please get out of my aircraft.

Seriously, the flight attendant lost consciousness because he didn’t put his oxygen mask on. The passenger, an off duty airline employee stood to help him and as a result also lost consciousness and fell, cutting his face, in a misguided attempt to help the cabin crew member. They both regained consciousness as the aircraft descended.

After the decompression, flight attendant A stated that there were two “high priority” tasks: ensuring that the passengers put on their oxygen masks and establishing communication with the flight crew. He recalled that he went to the forward galley and was about to either call the captain on the interphone or make a P/A announcement to the passengers when he lost consciousness, fell, and struck his nose on the forward partition. Although Southwest Airlines training materials indicated that the first action a flight attendant should take after a decompression was to take oxygen from the nearest mask immediately, he stated that he thought he “could get a lot more done” before getting his oxygen mask on.

Get your oxygen mask on. Now, let’s not speak of this again.

The aircraft was manufactured on May 22nd in 1996 by the Boeing Company at its facility in Wichita, Kansas. The fuselage sections were shipped by rail to the final assembly facility in Renton, Washington.

The Wichita facility was divested in 2005; it’s now known as Spirit Aerosystems. The Boeing policy at the time was to keep documentation for current year plus six years, so the fuselage section build paperwork for the aircraft is no longer available. What’s clear, however, is that work on the fuselage was a “split installation” with the work partially performed at Wichita and finished off at Renton.

The skin panel is a flat piece of aluminium with a doubler bonded to it. The stringers, frames and other internal structures are installed, creating the built-up panel assembly.

Typically a skin panel should have two manufacture markings: one for the skin panel and one for the built-up panel assembly. The built up panel assembly should also have a marking to show that it was approved by the Quality Assurance process.

The three-panel crown assembly from S-10L and S-10R that included the fracture had QA stamps dated February 16, 1996, with the exception of the crown skin panel above the fractured skin panel. The panel assemblies aft of the accident crown panel had QA stamps dated February 27, 1996. One of the three panel assemblies forward of the accident crown panel had a QA stamp dated February 23, 1996, while the other two markings were obstructed. The accident crown skin panel above the fracture and coincident with the lap joint where the fracture occurred only had a stamp for the skin panel manufacture and was dated March 5, 1996.

Emphasis mine.

In tests, they found that the crack growth rate would hit the full length in 38,261 cycles. The aircraft had 39,786 cycles at the time of the accident. So it’s crystal clear: the aircraft had the fault from the start.

Now, I never did metalworking in school but this doesn’t sound good:

Examination of the rivets in the fracture area revealed that 10 of the 58 lower-row rivets were oversized, while the upper-row rivets were standard sized. Numerous bucked tails on the lower-row rivets exhibited a finish that was different than rivets elsewhere on the panel, ranging anywhere from exposed bare aluminum to partially covered with primer to fully covered with primer coating. Additionally, many rivets in the lap joint were under driven, and areas around the driven heads exhibited curled metal consistent with metal burrs. Microscopic examination of the disassembled rivets revealed the diameter of the shank portion in the area adjacent to the bucked tail portion for a majority of the rivets was larger (expanded) compared to the diameter of the shank.

All of the skin panels around were clearly marked and had an inspection stamp from Boeing Wichita and were dated between 18 Jan and 27 Feb 1996. Only this crown skin panel was dated later (5 Mar) and was missing the inspection stamp. Thus, it seems that the crown skin panel must have been replaced during manufacture.

Translation: shoddy repair job at the last minute. The NTSB refer to this as a “lack of attention to detail and extremely poor manufacturing technique”.

We’ll never know why the crown skin panel was replaced or how the Quality Assurance process failed to spot the shoddy repair. It’s not even possible to determine whether it happened at Boeing Wichita or Boeing Renton.

Evidence indicates that during drilling of the S-4L lap joint, the crown skin panel and the upper left fuselage panel were misaligned, so most of the lower rivet row holes were misdrilled. Many of the installed rivets did not completely fill the holes in the lower skin panel, which significantly reduced the fatigue life of the panel. The pressurization loads on the fuselage skin initiated fatigue cracking at rivet hole 85 almost immediately after manufacture. Fatigue cracking subsequently initiated in adjacent rivets along the skin panel and grew over time with each application of pressurization loads. The NTSB concludes that on the accident flight, the cumulative amount of fatigue cracking reached a critical length, and the panel’s residual strength was not sufficient to carry the loads, which resulted in the hole flapping open and rapid depressurization of the airplane.

The Emergency Airworthiness Directive required all Boeing 737 classic aircraft from line numbers 2553 to 332 to have their lap joints inspected for similar multiple site damage from cracking. There were no similar findings on any other aircraft. This appears to be a one-off Quality Assurance error which slipped through the net.

PROBABLE CAUSE
The National Transportation Safety Board determines that the probable cause of this accident was the improper installation of the fuselage crown skin panel at the S-4L lap joint during the manufacturing process, which resulted in multiple site damage fatigue cracking and eventual failure of the lower skin panel. Contributing to the injuries was flight attendant A’s incorrect assessment of his time of useful consciousness, which led to his failure to follow procedures requiring immediate donning of an oxygen mask when cabin pressure is lost.

I know sometimes it is frightening to think about all that can go wrong in a modern aircraft. This site is a top hit for people who have searched on fear of flying and I wince a little each time when I think about what they arrive here to find.

A single panel slipped through the net; no other aircraft manufactured at the same time suffered from the issue. Systemic issues of shoddy workmanship affecting entire batches of aircraft have become a thing of the past.

Every crew member (OK, except one) and even the passengers knew exactly what to do.

The Captain responded immediately with an emergency descent and a plan of action. The professionalism in the flight crew interactions with Air Traffic Control are shining examples of aviation when it works. And thus, what would have been a fatal accident just a few decades ago became an incident – frightening for everyone on the aircraft, to be sure! But in the end, it’s an amazing story that the passengers will repeat at family gatherings for decades, rather than a tragedy. And that’s a triumph of modern aviation.

27 September 2013

The Incredible Story of David Riggs

It made international news: David Riggs’ body was discovered on Friday by a search and rescue team diving a lake in northeastern China after a Lancair 320, carrying the pilot and his translator, struck the surface and crashed. David Riggs, notorious stunt pilot who lost his pilot’s license twice, had been in the news – and on this blog – over the past few years for his escapades.

He’s been in the news before, of course. I first noticed the name in 2008 when he buzzed the Santa Monica pier in a Czechoslovakian L-39.


Two high-performance military jets departed Van Nuys airport in California as a formation flight to gather footage for a film in production called Kerosene Cowboys. The plan was for the jets to do four passes off of the coast of the Santa Monica pier, west of a banner tow aircraft towing a banner for the film. The first passes went as planned and then David Riggs broke away and flew low over the beach area for multiple passes in excess of 250 knots (two of the passes were below 500 feet) and then pulled into a steep climb just before the pier.

He explained that he did the fly-by’s to promote his new movie; there was a meeting including “film market buyers and producers” at the Loew’s Beach Hotel overlooking the pier. Dave Riggs was the CEO of Afterburner Films, Inc.

He had his private pilot certificate revoked but a few months after the sentence, he obtained a Canadian pilot’s license.

Here is a photograph of the L-39, a high-performance jet trainer aircraft, (taken by Chris Kennedy and featured on Airport-Data.com):

248717

If you think it looks vaguely familiar, that might be because you’ve seen the viral YouTube video about a frightening Close Call with Terrain:

Is it the same plane in the video?


Rigg’s revocation turned into a suspension and his US private pilot’s license was restored after 210 days.

He became involved with a business called Mach One Aviation and Incredible Adventures which offered 45 minutes filmed flights in old military training jets with his business partner, Doug Gillis.

On the 18th of May, a group of eight people arrived at Boulder City, Nevada. They’d paid for a 45-minute filmed “adventure flight”. Two L-39s (one of which was Riggs’ plane, although it’s not clear to me whether Riggs was flying it) were taking the passengers out one at a time. They had just departed for the third tour of the day, when Gillis’ L-39 failed for unknown reasons. The L-39 crashed just after take-off from Boulder City Airport, killing Gillis, who was the pilot, and the paying passenger in the rear seat. The final report has not yet been released but the FAA stated unequivocably that at the time of the crash, the company was illegally selling rides in the L-39. Riggs’ pilot license was revoked again as a result of this.

Gillis, Riggs’ partner and the pilot of the doomed L-39, had already had his ATPC revoked three years previous for signing a fraudulent Flight Review Endorsement to a pilot involved in a fatal L-29 crash in 2009.

Shortly after the Boulder crash, Riggs returned to Canada to try to get a commercial license. In 2013, he de-registered his yellow Lancair 360, N360DR, in the US and registered it in Canada.

Kristy Graham, the author of Aviation Criminal | The True Story, contacted Transport Canada in September 2013 and confirmed that Riggs application for a commercial license was not granted as his FAA certificate had been suspended.

Nevertheless, he took his aircraft to China to fly in the Shenyang Airshow.

While there, he took off “in rainy conditions” from Shenyang Faku General Aviation Base. He was apparently practising making his Lancair graze the surface to produce a skiing effect. Around 1pm local time, some part of the aircraft caught the water and it crashed into Caihu Lake.

Local pilot reported missing after his plane crashes in China – latimes.com

David G. Riggs was reportedly flying a Lancair 320, a high-performance single-engine aircraft made from a kit, when he struck the surface of a lake outside Shenyang, where he was planning to perform in an airshow. Aboard was an 18-year-old woman serving as his translator, who was killed, according to the Xinhua News Agency.

Witnesses said Riggs was practising a stunt in the rain that required him to gently touch the wheels on the water to produce a skiing effect. Apparently, the landing gear or another part of the plane caught the water.

His passenger, a 19-year-old translator, was pulled from the water but died later that day.

Tributes paid to ‘beautiful’ Queen’s College student killed in China plane crash (This is The West Country)

Talented musician Justina Zhang, 19, was working as a Chinese translator for Hollywood stunt pilot David Riggs when their aircraft crashed into Caihu Lake in north-east China during a trial flight at around 1pm on Tuesday last week.

His body was recovered three days later and cremated over the weekend.

I watch air shows with glee but a stunt pilot, more than any other pilot, has to be able to do a risk-vs-reward assessment and ensure that he is keeping himself and others safe. Taking a passenger on a trial flight for an air show routine seems in itself a dreadfully poor decision. But looking at his history, it really does feel like it was only a matter of time before he crashed an aircraft and it was probably inevitable that he would take someone with him.

20 September 2013

Loss of Control – Collision with Water

Transportation Safety Board of Canada – Aviation Investigation Report A10P0147

Loss of Control – Collision with Water
Atleo River Air Service Ltd.
Cessna 185F, C-GIYQ
Ahousat, British Columbia
29 May 2010

The first thing that struck me about this TSB Canada report was the title. Loss of control seemed an odd description and certainly isn’t a cause in itself. The title fits the report, though: loss of control was the key factor in this investigation because to start, that was all the investigators knew. How did the pilot lose control and why did he fly the aircraft into the water at a 45° angle? That took longer to work out.

A similar Cessna 185 with floats

The aircraft was a Cessna 185F which had been fitted with floats to allow water landings. It was owned by Atleo River Air Service Ltd. The pilot, who was the company’s aircraft maintenance engineer, had 2,000 hours of flying logged, mostly in the Cessna 185 on the west coast of British Columbia. He was trained, qualified, certified and medically fit.

That day, he was approached by three passengers who wanted to charter the aircraft to take them back home to Ahousat First Nation, on the west coast of Vancouver Island. They had a small amount of baggage: several bottles of liquor, a case of beer and some personal effects.

They had travelled to Tofino by water taxi, but the operator would not take them back to Ahousat.

The Ahousat reservation is only accessible by water or air. The water taxi operator does not allow alcohol to be carried to Ahousat. As a result, the passengers decided to charter the aircraft. They had been drinking but were walking normally and “coherent enough to argue the price of the charter.”

The pilot agreed to take them for the six-minute flight to Ahousat.

They departed Tofino at 1200 Pacific Daylight Time. The route is usually flown at 300-500 feet above sea level. The weather visibility was 8 miles, with a layer of scattered cloud at 1,000 feet and overcast at 1,400 feet. That day, the Cessna flew VFR at about 500 feet.

Two nautical miles from Ahousat, in cruise, the aircraft descended in a steep-nose down attitude. It flew straight into the Millar Channel and overturned. Fishermen and water taxis in the area tried to keep the wreckage afloat but it sank in the 15 metres of water and came to rest on the ocean floor.

Accident flight route from the report

The front seat passenger died on impact. The pilot and the rear passengers suffered blunt force injuries which may have been fatal and certainly would have stopped them from being able to escape the underwater aircraft. Cause of death was drowning.

Two days later, divers found the aircraft wreckage with the pilot and all three passengers still inside. The pilot still had his lap belt on. The aircraft had shoulder restraints but the pilot did not have the shoulder restraint strap connected to his lap belt.

All of the passengers were unrestrained. The right door was ajar. Beer cans were found near the passenger seats.

The emergency locator transmitter functioned but no signal was received until the wreckage was brought to the surface.

The aircraft struck the water at about 45° nose down and sheared off the engine and the pontoons. The V brace, which forms a V between the top corners of the windshield and the top centre of the instrument panel, was bent forward.

The engine was running and the propeller damage was consistent with significant power at impact.

There was no indication of control malfunctions. The aircraft was trimmed for the cruise with the flaps fully retracted. The weather was good.

The aircraft did not spin nor stall. There was no evidence to suggest any mechanical or environmental cause.

The evidence was baffling. The captain had no known medical condition and there was no record of him being depressed or intending to harm himself. And yet, it appeared he’d flown the aircraft straight into the ocean.

Transportation Safety Board of Canada – Aviation Investigation Report A10P0147

The aircraft struck the water at an angle and speed consistent with a deliberate dive, or a loss of control. There is no operational reason why the pilot would perform such a manoeuvre. Had the pilot intentionally caused the aircraft to dive, a level-off should have been possible. Based on the pilot’s demeanour, there was no reason to dive to the point of impact with the water. Therefore, it is concluded that the pilot lost control of the aircraft.

The pilot’s lap belt showed evidence of high loads. The front passenger’s lap belt had no evidence of similar loads. The rear right passenger’s lap belt failed under load, indicating that it was being worn at impact. The rear left passenger’s lap belt showed no distress.

The autopsies showed high levels of alcohol in all the passengers.

The pilot’s right wrist was broken and he had a severe injury to his forehead.

The rear left passenger, sitting behind him, had two broken ankles.

A picture of the pre-accident situation began to form in the investigators’ minds.

The bent V brace and the pilot’s broken wrist were consistent with the pilot bracing himself, or trying to resist a force from behind. However, the autopsy showed no sign of a strike to the back of his head.

The passenger sitting behind him broke both ankles on impact, which suggests she was kicking or pushing the pilot’s seat forward. Investigators believe she may have kicked the seatback with both feet and then pushed it forward, forcing the pilot into the instrument panel and the controls into a dive.

Pilot pushed into controls

[Our tests revealed] that if the pilot’s upper body is not secured by the shoulder harness, a rear passenger could push the pilot’s seatback forward causing the pilot to push the control yoke forward, thereby causing a nose down control input. It was noted that the pilot had no space to leverage his arms and push back sufficiently to overcome the passenger’s leg force from behind. In this scenario, a pilot could not resist a push from the back unless it was expected and the pilot braced accordingly.

The Transportation Safety Board of Canada determined that this was the most likely cause of the fatal accident.

Findings as to Causes and Contributing Factors

  1. It is likely that passenger interference caused the pilot to lose control of the aircraft whereupon it descended in a steep nose-down attitude until it struck the water.
  2. It is possible the passengers’ level of intoxication contributed to their inability to recognize the gravity of the situation and stop the interference in time for the pilot to regain control of the aircraft before impact.
  3. Because there was no locking mechanism on the pilot’s seatback, and because the pilot was not wearing his shoulder strap, he would have been unable to prevent his upper body from being forced onto the instrument panel.

I have to be honest, I’m not sure I would have thought twice about taking the three passengers in my plane in that circumstance, even though they’d been drinking. It was only a six minute flight, after all. My main worry would probably been that someone might be sick in my aircraft — experience with my son has shown me that it is impossible to get the smell out of the cockpit.

However, this accident has really brought it home to me how badly wrong it can go. I can only imagine what the poor pilot must have been thinking as he was smashed against the instrument panel, knowing they had only 500 feet. Every fatal accident is tragic but this is truly the stuff of nightmares.

31 August 2013

Always climb straight ahead to 500 feet before turning?

Captain Jon is a professional flying instructor based at Halfpenny Green in Wolverhampton. He’s a former LHR Airbus pilot turned instructor and has trained Sir Richard Branson, Nigel Mansell, and Jasper Carrot, among others. I first encountered him because of his Ask Captain Jon web site where he talks not just about learning to fly but also about how a good pilot never stops learning. He includes himself in this:

Instructing teaches you that students do the most amazing things, things you wouldn’t expect. In particular they can easily get mixed up in a high work load situation. I remember once sitting in a Cessna on base leg staring out of the side window thinking to myself what a great summer’s day. I wasn’t paying full attention to the student, I admit. I was thinking how peaceful and quiet it was up here until I suddenly realised why it was so quiet. The student had pulled back the mixture control instead of the throttle and we were in fact a glider–he had shut the engine down!

I’m hoping I’ll get to go flying with him one day but in the meantime, I still enjoy reading his blog and I think you will too. That’s why I’m very pleased that he’s agreed to be a guest poster here on Fear on Landing while I sort out my computer problems.

Please give a warm welcome to Captain Jon!


My instructor told me, ‘ Always climb straight ahead to 500 feet before turning’!

Climbing straight ahead to 500 feet may not be the best option at every airfield. Pre-flight planning should involve the take off path too!

Perhaps he never flew off Runway 23 at Cambridge?

When you are learning to fly, you are initially taught to fly by numbers. It’s simpler and safer. The only problem with this type of elementary teaching is that it doesn’t encourage the situational awareness and good judgment which is essential for safe flight.

Let’s go back to basic human factors.

Threat & Error Management (TEM)

Determining the threat and errors that can occur at any stage of flight and managing them.

I should point out that threat and error management is required teaching for all part FCL flying licences, including the PPL (this seems to be unknown by many instructors)

One of the biggest threats to any aircraft, regardless to how many engines it has, is an engine failure on take off. If you mismanage this type of failure by error the consequences are likely to be extremely serious.

In a multi engine aircraft capable of continued SE flight the main decision is to manage the situation so as to allow the aircraft to continue to fly the take off path. In a single engine aircraft that is not going to be an option, so part of the decision has already been made for you, if the engine fails you are going to have land somewhere! You primarily just need to manage that landing so as to minimise the damage to the aircraft, yourself and any passengers.

The first thing to understand very clearly is that the area ahead of the aircraft is very likely going to be unsuitable for a light aircraft to make a perfect approach and landing that you can just walk away from to the sound of applause from astonished locals. You need to be very realistic here as the aircraft is very likely to be damaged, what we to achieve is the minimum damage.

In July 2011 a Piper Tomahawk taking off from Manchester Barton suffered an engine failure. This was the outcome.

Amazingly the passenger survived this accident although he was very badly burnt, the pilot was killed. The aircraft was apparently in a stalled condition when it hit the side of the house. This very sad accident can teach us many lessons.

The first most important one is that it is essential to arrange your flight path on take off to put you in the best possible position should you suffer an engine failure. This very important obvious plan of action has never been given much attention by single engine flying instructors.

The third lesson is that it is essential to keep the aircraft under control, this aircraft clearly wasn’t; it was stalled. No pilot would consciously fly into the side of a house!

The second lesson is that it is essential to try to keep the cabin intact in any off airfield landing.

The fourth lesson is that in any emergency situation at low-level you need to act quickly, correctly and decisively.

Threats

Single engined aircraft will have a very critical flight path with an engine failure after TO below 500 feet.

Many airfield take off paths will have a less than ideal landing areas ahead of the aircraft.

Most PPL’s are low houred pilots with the minimum experience of emergency procedures and mostly have had zero refresher training.

The element of surprise can be one of the greatest factors in preventing a successful outcome to any emergency. An emergency that comes as a total surprise is always harder to deal with.

Errors

  • Incorrect selection
  • Checklist discipline
  • Fuel mismanagement
  • Carburetor Icing

The last two above are most common cause of engine failure in light single engine aircraft.

  • Failure to lower the nose attitude (push over) to preserve airspeed (Barton accident above)
  • Failure to choose optimum lateral take off path after lift off
  • Failure to climb to 500 feet at the best rate of climb speed
  • Failure to brief passengers on emergency procedures
  • Failure to self brief before take off on a possible EFATO (The emergency take off brief)
  • Failure to select a safe alighting area and undershoot
  • Failure to complete the emergency landing checks
  • Failure to safeguard the aircraft after landing

The successful outcome to any emergency situation can only be enhanced by good planning and training.


If you’d like to read more of Captain Jon’s analyses, head on over to Ask Captain Jon’s Flying Training Help Pages where you’ll find lots more like this. Let him know that Sylvia sent you.

16 August 2013

In Defence Of Ryanair’s Safety Record

Ryanair are making international headlines once again…

Ryanair Fires Pilot After TV Show Probes Safety Culture

Ryanair Holdings Plc (RYA) dismissed Captain John Goss and said it plans to pursue legal action against the pilot after he was featured on a U.K. television program this week that questioned the airline’s safety.

“We will not allow a Ryanair employee to defame our safety on national television,” the airline said in an e-mailed statement.

Pilots are wary of raising concerns and are encouraged to carry as little fuel as possible, the Channel 4 “Dispatches” program reported, citing a survey conducted by the Ryanair Pilots Group, which claims to represent more than half of the carrier’s pilots. The fuel issue arose when three jets declared emergencies before touching down in Valencia, Spain, after diversions from Madrid last year. The planes landed safely and in compliance with European regulations, the Irish Aviation Authority said.

Discussion of Ryanair’s policies had already been headline news in the UK following the Dispatches documentary Secrets of the Cockpit on Channel 4, which focused on whether Ryanair are carrying dangerously low amounts of fuel. Dispatches accused Ryanair of operating with a level of fuel that was ‘close to the minimum’ required.

The key conversation that I’m hearing which worries me is not whether Ryanair’s current actions are reasonable but whether or not the airline is safe.

Now, I won’t fly Ryanair as a passenger because I think their booking policies and customer service are atrocious. Their hiring policy is distinctly dubious. There are widespread reports of pilots being bullied within the company. I have no comment on the sacking of the pilot who spoke to the television show but it leaves a sour taste in my mouth. When it comes down to it, I really don’t like defending Ryanair as an airline. However, it is true that Ryanair have never had a fatal accident in one of its aircraft, despite it having one of the largest fleets in the world.

The documentary reported that three jets declared fuel emergencies flying into Valencia. There have actually been four incidents of Ryanair flights declaring low-fuel emergencies over Valencia. The first incident was in May 2010, when a Ryanair Boeing 737 en route from Stansted to Alicante diverted to Valencia. The three detailed in the documentary took place in July 2012 in an incident where seventeen airlines were diverted to Valencia from Madrid.

In order to better understand these incidents, lets start with the regulation. EU OPS 1.375 states that:

The commander shall declare an emergency when calculated usable fuel on landing, at the nearest adequate aerodrome where a safe landing can be performed, is less than final reserve fuel.

Ryanair’s procedures at the time were as follows:

- The Commander shall make an urgency call (Pan ×3) when he believes he will land with less than Final Reserve Fuel.
- The Commander shall make a Distress call (Mayday ×3) when he is committed to an approach from which he will not have enough fuel to conduct a Missed Approach.

Final reserve fuel is enough fuel to fly for 30 minutes at holding speed at 1,500 feet above aerodrome elevation. As a pilot, you should always land with final reserve fuel still in your tanks.

Now the clear problem here is that EU OPS state that an emergency should be declared where Ryanair consider it a situation of urgency, and only when the situation has escalated further are Ryanair pilots told to declare an emergency.

European Union regulation requires that the operator have a fuel policy for the purpose of flight planning to ensure that every flight carries sufficient fuel for the planned operation, as well as reserves to cover deviations from the planned operation.

The fuel requirements include :

  • Taxi fuel (for use on the ground)
  • Flight plan fuel
  • Alternate fuel (allowing the aircraft to get to furthest planned alternate airport if there is a diversion)
  • Extra fuel
  • Final reserve fuel

The extra fuel is added at the Captain’s discretion. Extra fuel is added based on weather conditions, experience of the route, expectation of a diversions en route due to NOTAMS, etc.

The Captain can choose to carry up to 300 kg extra fuel without explanation. Over 300 kg, the Captain has to note an explanation for why he requested the additional fuel. He does not have to get it approved or do anything other than justify his reasoning.

The more fuel the aircraft is carrying, the heavier it is, the more fuel it will burn. So yes, captains are absolutely expected to manage their fuel loads: a Captain who carries 299kg extra fuel on every flight “just in case” would swiftly find himself being taken to task. However, it is the Captain’s duty to ensure that his flight is safe and that includes carrying extra fuel if he believes it may be required.

Now onto the incidents: all of these were investigated and reported on by Spain’s Civil Aviation Accident and Incident Investigation Commission.

14 May 2010

RYR 9ZC, a Ryanair B737-800, departed Stansted for Alicante with 8,200 kg of fuel. The forecast weather conditions were good and there were no expected setbacks and delays for the flight. The Captain decided that the contingency fuel (minimum 5% of the fuel required to fly to Alicante), equivalent to about seven minutes of flight time, would suffice for any diversions they might encounter. Thus, he didn’t request any extra fuel.

When he arrived at Alicante, he discovered that the winds were highly variable. The flight crew attempted a landing on Runway 10 but broke off the approach just three feet above the runway. The crew checked the fuel requirement to divert to Valencia. They believed they had sufficient fuel to try one more approach at Alicante before diverting.

They requested Runway 28, which ATC initially confirmed as showing only calm winds. During this second approach, the wind was reported as beyond limits for Alicante Airport, so the flight crew aborted the approach and proceeded to Valencia.

Valencia was not actually the closest airport. The Captain stated, however, that he had noted the weather conditions at Valencia when they flew past en-route and he was familiar with the airport. He wasn’t sure if Murcia San Javier Airport was open to commercial traffic (it was). Ryanair’s operational flight plan did not make it clear that San Javier Airport required less fuel.

So RYR 9ZC diverted to Valencia. The fuel required for the diversion was 2,259 kg, with a final fuel reserve of 1,139kg.

The aircraft encountered a headwind which was nearly three times that predicted in the operational flight plan. The fuel levels, already low, continued to decrease.

12 minutes after they had initiated the second approach and then diverted, the fuel was down to 1,250 kg. The crew realised that they would land with a fuel amount below the final reserve fuel. In accordance with Ryanair policy, they declared an urgent situation.

18:30:02 RYR 9ZC: PAN PAN, PAN PAN, PAN PAN Ryanair 9 Zulu Charlie errr… fuel…requesting, ummm, vectors immediate to land runway one two. PAN PAN, PAN PAN, PAN PAN

It’s got to be said, that’s not the clearest declaration of urgency that I’ve heard. But we’ll get back to the ATC conversation at the end. For the moment, the point is that they followed their company policy to a tee, with 1,250 kg of fuel left on board.

As they turned onto short final, the fuel remaining was 1,140 kg on board. The company policy is that if they are committed to this approach, that is, they no longer have enough fuel to go around and try again, they must declare an emergency. As they are now on the final reserve that they should not be using, it has become urgent.

18:38:15 RYR 9ZC: MAYDAY, MAYDAY, MAYDAY, fuel emergency now.

The aircraft turned onto final and landed on Runway 12 with 956 kg of fuel remaining, 183 kg below the final reserve fuel.

From the official Spanish report:

The incident was caused by the crew’s inadequate decision-making process in opting to make a second approach, in the choice of alternate airport and in the flight parameters used en route to that airport, which resulted in the fuel amount dropping below the required minimum reserve fuel and in the crew declaring an emergency (MAYDAY).

The company’s fuel savings policy, though it complies with the minimum legal requirements, tends to minimize the amount of fuel with which its airplanes operate and leaves none for contingencies below the legal minimums. This contributed to the amount of fuel used being improperly planned and to the amount of fuel onboard dropping below the required final fuel reserve.

Another contributing factor was the wind information provided by ATC to the crew when preparing the approach to runway 28. This information, though accurate, did not give the crew a clear picture of the changing wind conditions, which would have facilitated their making more suitable decisions.

So, the point is that the aircraft was not at any time unsafe. The aircraft did not have enough fuel, absolutely clear. However, the report concluded that the primary issue was that the Captain decided to try one more approach at Alicante before continuing on, when he did not have enough fuel to do so safely.

This report is particularly important because the low fuel incidents of July 2012 were bundled into the same report. The investigators felt that the sequence of events was so similar that the conclusions and recommendations would all be exactly the same. Thus the incidents did not require a separate report, although they were all investigated separately.

26 July 2012

Around 20:00 UTC, seventeen aircraft were diverted from Madrid Airport because of hailstorms at the airfield. Twelve flights were diverted to Valencia and five were diverted to Alicante. Of those seventeen flights, four declared fuel emergencies. Let’s focus on the three Ryanair flights first.

RYR 2054 was a scheduled flight from Palma to Madrid. The aircraft departed with 613 kg of extra fuel, which was justified in the log report as due to weather forecast (storms).

They attempted an approach into Runway 18R at Madrid but at 20:08 the flight crew broke off and performed a go-around because of the hailstorm. They held northwest of the airport hoping to try a new approach but then at 20:19, they were diverted to Valencia. At 20:55 the flight crew contacted Terminal Area Control Center Valencia. At 20:59 TACC Valencia instructed the aircraft to hold.

The flight crew responded that they could not hold as they did not have enough fuel. Valencia Approach asked if they were declaring an emergency. At 21:00 the crew issued a MAYDAY.

The final reserve fuel for this flight was 1,104 kg. The aircraft arrived with 910 kg of fuel (1,029 kg on touchdown).

RYR 9VR was a scheduled flight from Stansted to Madrid. The aircraft departed with 283 kg of extra fuel, which was justified in the log report as due to delays in Madrid.

They also attempted an approach into Runway 18R at 20:11 and also had to perform a go-around. They were directed to hold northwest of the runway but en route to the hold point, they diverted to Valencia. When the crew first contacted Valencia ATC at 21:01, they were instructed to hold. The flight crew have reported that at that point, there were six aircraft on approach. As a result of the emergency declaration from another aircraft (presumably RYR 2054), their planned approach was delayed even more. at 21:04, the crew informed Valencia ATC that if they did not start their approach within 2-4 minutes, they would have to declare an emergency. At 21:11, the flight crew declared an emergency and at 21:12, the aircraft was cleared for Runway 30.

The final reserve fuel for this flight was 1,119 kg. The aircraft arrived with 1,130 kg (1,160 on touchdown). They landed without ever touching the final reserve.

RYR 5389 was a scheduled flight from Stockholm to Madrid. The aircraft departed with 892 kg of extra fuel which was justified in the log report as due to 20 minute delays expected in Madrid and due to change of the alternate airport.

The alternate airfields for this flight were Valladolid, Zaragoza, Vitoria and Valencia. Valencia, the fourth alternate, was the most distant. The most distant alternate airfield is the one which must be used for fuel calculations.

They performed a go-around at runway 18L at Madrid at 20:12 and also proceeded to the northwest hold. They diverted south by 14 nautical miles before reaching the hold point and then proceeded to another hold point also in the northwest. At about 20:30, the aircraft was diverted to Valencia.

At 21:14, when they still had not been given clearance to land at Valencia, the crew declared an emergency.

The final reserve fuel for this flight as 1,090 kg. The aircraft arrived with 1,120 kg (1,228 kg on touchdown). This flight also landed with a fuel amount that was above the final reserve.

In my opinion, the Dispatches documentary misrepresented these MAYDAY calls. A pilot on the television show says:

If you have to use a MAYDAY call during a flight, that indicates you are in imminent danger…you are saying help me, I’m in danger, I need to land now.

Whereas we know that the declaration of an emergency is required if you can’t land with a minimum of thirty minutes holding fuel in your tanks , even if you are absolutely sure you are going to land safely. It’s straight forward: you may not use the final reserve and if you realise that you are going to, you must declare an emergency.

If you want to get technical, for two of the three flights, the issue was not that the aircraft did not have enough fuel, but that they declared an emergency too early. A less generous soul might consider that they did not want to wait for their turn and jumped the queue by declaring low fuel. But realistically, the second two flights would have dipped into their final reserve fuel had they not declared an emergency.

There was another aircraft that declared an emergency that day: a LAN Chile flight flying from Frankfurt to Madrid. It was also diverted to Valencia. However, this flight declared an emergency due to the “loss of an engine”. The “engine stoppage” as they called it, was the number three engine which had stopped as a result of fuel starvation. I find that a lot scarier, don’t you?

Meanwhile, four other aircraft reported being low on fuel without declaring an emergency. The investigation does not state whether they landed with their final reserve fuel intact or not.

In every instance, Ryanair aircraft carried sufficient fuel for the flight and its alternate. In every instance except one, the Captain had chosen to take extra fuel on board. These flights were in line with regulations and cannot in themselves be considered unsafe.

The incident report discusses Ryanair’s fuel policy as a part of its analysis:

Ryanair’s fuel policy, as stated in its Operations Manual, is based quite specifically on minimizing the fuel load at the start of the flight. Since fuel consumption rises considerably with any additional weight that is transported, the goal of this policy must therefore be to reduce consumption by reducing the weight of the fuel transported as much as possible. As a result of this economic policy, Ryanair aircraft generally land with the minimum required fuel. This policy, which is in keeping with EU OPS 1.375, gives Ryanair a competitive advantage over other airlines that tend to fly with larger amounts of reserve fuel and that therefore use more fuel.

However, the investigators’ warning is not that such a policy is dangerous but that too many airlines might choose to follow it:

It is worth noting that market competition is forcing other airlines to reduce their costs by adopting fuel policies similar to Ryanair’s. This could make it commonplace for airplanes to arrive at their destinations with the minimum required fuel and without reserves in the event of a delay or, as in this case, to attempt a second approach after being given preferential treatment by ATC at the expense of other traffic yielding its approach priority.

The arrival of several aircraft flying with minimum fuel at the same airport could give rise to several simultaneous emergency declarations for lack of fuel, especially if circumstances force deviating to the alternate airport.

The issue at Valencia was that every aircraft declaring an emergency delayed the other aircraft getting in and, if that trend continued, multiple declared fuel emergencies could swiftly turn into a disaster as they can only get in one flight at a time.

The report recommendation is that airports have specific “average delay times” based on local circumstances (for example that Valencia is limited to a single runway) so that airlines can correctly work out how much fuel they need to fly safely.

As a result of this report, ICAO amended their Procedures for Air Navigation Services to allow for a clear definition of minimum fuel and standard phraseology to be used “when it has been determined that the aircraft will infringe upon its final fuel reserves before landing.” As of November 2012, an aircraft must declare minimum fuel when “committed to land at a specific aerodrome and any change in the existing clearance may result in a landing with less than planned final reserve fuel” and must declare a fuel emergency using the phrase MAYDAY MAYDAY FUEL when the calculated fuel on landing at the nearest suitable aerodrome where a safe landing can be made will be less than the planned final reserve fuel.

These changes make the procedure clearer but all of the above aircraft would be expected to declare an emergency under the circumstances that they found themselves in.


Meanwhile, I mentioned the ATC exchange in the May 2010 incident. If you want to read something scary, then read this…

18:30:02 RYR 9ZC: PAN PAN, PAN PAN, PAN PAN Ryanair 9 Zulu Charlie
errr… fuel… Requesting, ummm, vectors immediate to land runway one two. PAN PAN, PAN PAN, PAN PAN

18:30:12 Valencia approach ask RYR 9ZC to repeat

18:30:13 RYR 9ZC: We would like to declare a pan due to errr… a pan
emergency due to fuel…urgency, PAN PAN, PAN PAN, PAN PAN Ryanair 9 Zulu Charlie.

18:30:21Valencia Approach: Confirm you declare emergency?

18:30:23 RYR 9ZC: Urgency, PAN PAN, PAN PAN, PAN PAN, Ryanair 9 Zulu Charlie.

18:30:28 Valencia Approach: Copied, proceed own discretion to runway 12

18:32:00 Valencia Approach informs Valencia Tower in Spanish that the Ryanair flight is arriving at the airport without fuel and that it just declared PAN-PAN, telling them to be ready because he does not know what to do in those cases. Tower replies that it will report it to Coordination (CEOPS) and that they will know what to do.

18:32:04 RYR 9ZC calls Valencia Approach to ask for the latest weather report for Valencia using the abbreviation “met report”. The controller does not understand and asks him twice to repeat.

Finally RYR 9ZC says “we would like to request the weather at the field”. Valencia Approach replies: “OK, the weather is, the wind is 140/5 variable on direction from 110° 217° visibility 10 km or more, the cloud scattered 4,500 ft, QNH 1011. Temperature 16, point 06.”

18:33:49 Valencia Approach (in Spanish) to Tower: Hello, look, we’ve dropped the Ryanair down to 5,000 feet and it looks like he’s proceeding on final, ok? You’re ready, right?

Valencia Tower replies that it has notified Coordination. The planner controller at Valencia Approach reports that the aircraft said PAN-PAN. Tower asks what exactly that means as he has never heard it before. Approach then rectifies and says that what the aircraft said was TAM, TAM…TAM, TAM MEDICAL, which surprises the Tower controller who, while laughing, asks what that is and if the aircraft has really declared an emergency, which is not the same as PAN-PAN, to which Approach replies to stand by.

18:35:38 Approach contacts Tower again to confirm that “the aircraft definitely said just TAM, TAM.” A discussion ensues between them regarding whether it had reported airport in sight so as to initiate the emergency, since Approach had reported the emergency and the airport has to be notified to undo the start of the emergency.

Approach reports that the aircraft is declaring an urgency at that time, to which Tower insists that they have been told emergency, not urgency, and as a result have notified the airport. Approach contacts the aircraft to request information on emergency declaration. The Ryanair crew replies: “We declared urgency, not emergency, RYR9ZC”.

A minute later, Approach contacts again to request number of passengers onboard.

18:38:15 RYR 9ZC: MAYDAY, MAYDAY, MAYDAY, fuel emergency now.

18:38:40 Valencia Approach informs Tower that the aircraft just reported an emergency. Tower replies that the two things were not the same and that they had the airport “in chaos”.

18:38:02 RYR 9ZC reports turning onto final runway 12. Approach transfers the flight to the Tower frequency. The aircraft lands at 18:43 without incident.

Eurocontrol admitted that most of its controllers had no experience in handling serious emergencies and that, as a result of overall safety levels in commercial aviation, would probably not attain such experience on the job. They conceded that this lack of experience made it likely that, when faced with a real emergency, deficient performance could result.

Spain’s Civil Aviation Accident and Incident Investigation Commission recommended promoting the appropriate use of MAYDAY and PAN codes as well as checklists for controllers to better handle emergency situations.

I may not fly Ryanair because I dislike their commercial policies but I see nothing here that makes me believe that they are unsafe.

26 July 2013

UPS Flight 6 Uncontained Cargo Fire

A few days ago, the General Civil Aviation Authority of the United Arab Emirates has released its final report on the Boeing 747 which crashed on the 3rd of September in 2010 after an uncontained cargo fire.

Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent Into Terrain

The 326-page accident report is excellently written and deals with all the issues involved with this tragic flight and an analysis of the situation. Truth be told, it’s hard to think of a more hopeless situation that a modern pilot could find herself in. Here’s a summary of the main points.

11:35 UPS Airlines Boeing 747-400AF, a two-crew four-engine wide-body aircraft, arrives from Hong Kong on a scheduled cargo service.

The Flight Crew reported a failure with the PACK 1 air conditioner during the flight. The ground engineer could not replicate the fault.

The PACKs provide preconditioned air to the pressurised fuselage. The Boeing 747 has three PACKs.

14:51 The Boeing 747 departs as UPS Airlines Flight 6 as a scheduled cargo flight to Cologne Bonn Airport. The First Officer is the Pilot Flying and the Captain is the Pilot Not Flying. They depart on Runway 30R and fly north west over the southern Arabian Gulf.

The First Officer flew the aircraft manually to an altitude of 11,300 feet and then engaged the autopilot after receiving another PACK 1 fault. The flight crew reset PACK 1 which cleared the fault.

The aircraft continued to climb. Shortly before they reached their cruising altitude of 32,000 feet, a fire warning bell sounded and the master warning light illuminated. They had a fire on the forward main deck.

The Captain took control of the aircraft.

15:12:57 CAPT in cockpit: Fire, main deck forward. Alright, I’ll fly the aircraft
15:13:07 CAPT in cockpit: I got the radio, go ahead and run [the checklist]

15:13:14 CAPT to ATC: Just got a fire indication on the main deck I need to land ASAP
15:13:19 BAE-C: Doha at your ten o’clock and one hundred miles is that close enough?
15:13:23 CAPT: how about we turn around and go back to Dubai, I’d like to declare an emergency
15:13:27 BAE-C: UPS six make a right turn heading zero nine zero descend to flight level two eight zero.

Doha was closer, they were about 180 miles from Dubai. However, it is unlikely that the crew understood the extent of the fire.

The crew put on oxygen masks and worked their way through the Fire/Smoke/Fumes checklist.

The fire suppression system automatically shut down PACK 2 and 3. The flight crew manually turned the switches to OFF, in accordance with their check list. In fire suppression mode, PACK 1 should have continued to supply preconditioned air to the upper deck. This provides positive air pressure to the cockpit to prevent smoke and fumes from entering the cockpit area. However, at 15:15:21, PACK 1 stopped operating. This meant that no packs were operating and there was no ventilation to the upper deck and flight deck.

Smoke began to enter the cockpit.

15:15:23 CAPT to ATC: I need a descent down to ten thousand right away sir.

It’s unclear why the Captain requested the descent, although it seems to me he was probably reacting to the smoke and concerned about available oxygen. However, this was not on his checklist, which stated he should fly at 25,000 feet, the optimum altitude to prevent combustion.

His action did not support the fire suppression system which was based on depressurisation and oxygen deprivation.

The uncontained cargo fire severely damaged the control cables, the truss frame supporting the cables and the cable tension.

15:15:37 CAPT: alright. I’ve barely got control
15:15:38 F.O: I can’t hear you
15:15:41 CAPT: Alright
15:15:47 F.O: alright… find out what the hell’s goin on, I’ve barely got control of the aircraft.
15:16:41 CAPT: I have no control of the aircraft.
15:15:43 F.O: okay… what?
15:16:47 CAPT: I have no pitch control of the aircraft
15:15:53 F.O: you don’t have control at all?
15:16:42 CAPT: I have no control of the aircraft.
15:16:47 CAPT: I have no pitch control of the aircraft.

They regained control of the elevator control system through the autopilot. Meanwhile, the cockpit was filling with smoke. Within two minutes, neither crew member could see the control panels or look out of the cockpit.

15:16:57 CAPT: Pull the smoke handle.

Pulling the smoke handle might have caused a pressure differential, drawing more smoke into the cockpit. The Captain contacted ATC to report the situation and then spoke to the First Officer.

15:17:39 CAPT: Can you see anything?
15:17:40 F.O: No, I can’t see anything.

The flight crew attempted to input the Dubai Runway 12 left data into the flight management computer, so that they could configure the aircraft for an auto-flight/auto-land approach, but they couldn’t see the FMC display for all the smoke.

At that point, the Captain’s oxygen supply failed.

15:19:56 CAPT: I’ve got no oxygen.
15:19:58 F.O: Okay
15:20:00 F.O: Keep working at it, you got it.
15:20:02 CAPT: I got no oxygen I can’t breathe.
15:20:04 F.O: okay okay.
15:20:06 F.O: what do you want me to get you?
15:20:08 CAPT: Oxygen.
15:20:11 F.O: Okay
15:20:12 CAPT: Get me oxygen.
15:20:12 F.O: hold on okay.
15:20:16 F.O: Are you okay?
15:20:17 CAPT: (I’m out of) oxygen.
15:20:19 F.O: I don’t know where to get it.
15:20:20 CAPT:(I’m out of) oxygen.
15:20:21 F.O: Okay
15:20:21 CAPT:You fly (the aircraft)

A portable oxygen bottle was behind the Captain’s seat, next to the left-hand observer’s seat, but neither crew member retrieved the bottle. The Captain moved aft of the cockpit area, presumably to try to find the supplementary oxygen. He removed his oxygen mask and smoke goggles and said, “I cannot see.” That was the last recording which included the Captain; he died as a result of carbon monoxide inhalation.

Seven minutes had elapsed since the fire alarm had first sounded. The First Officer was now Pilot Flying, with no support nor monitoring. A nearby aircraft contacted him to relay information to Bahrain. The First Officer established communication and attempted to cope with a swiftly escalating task load, which left him no time to enquire after the Captain.

15:25:42 PF: I would like immediate vectors to the nearest airport I’m gonna need radar guidance I cannot see.

Based on his comments, the investigators believe that the pilot was able to see heading, speed and altitude select windows. He could not see the primary flight displays. He could not read the navigation display. Thus he could set up flight configurations but he couldn’t see the response. He also made numerous comments about not being able to see outside and that the heat was increasing and his oxygen was getting low.

He couldn’t see the radio either, so he couldn’t change frequency although he was now out of range of the controller at BAE-C. The controller asked aircraft to relay information to and from the Boeing. Dubai ATC also transmitted several advisory messages to the flight on local frequencies in hopes of getting a message to the Boeing, including “any runway is available.” They turned on the lights for Runway 30L.

A relay aircraft contacted the Pilot Flying and attempted to pass his information on to Bahrain. The relay aircraft (identified as 751) struggled to relay the information and get answers from Bahrain. The relay system was of little use to the Pilot Flying who didn’t know his own altitude or speed and needed immediate data.

15:29:59 PF: Okay Bahrain give me what is my current airspeed?
15:30:07 PF: Current airspeed immediately immediately.
15:30:14 PF: What is my distance from Dubai International UPS er six what is my distance we are on fire it is getting very hot and we cannot see.
15:30:22 RELAY AIRCRAFT: Okay I ask Bahrain understood and UPS six request the distance from Dubai from now?
15:30:28 PF: Sir I need to speak directly to you I cannot be passed along I need to speak directly to you I am flying blind.
15:30:36 RELAY AIRCRAFT: Understood UPS six we are just changes to another aircraft to be with Dubai to relay with you I ask again to Bahrain Bahrain distance UPS six to Dubai?

The workload of the Pilot Flying was immense. He was communicating through aircraft relays while he controlled the flight and attempted to navigate to Dubai International, with no access to navigation equipment and no possibility of looking out the window. He repeatedly asked the relays for information on height, speed and direction in order to plan his blind flight. There was no opportunity to finish the checklist nor check on the Captain.

The options available to the pilot were limited. The aircraft was seriously compromised but without primary instruments, so the First Officer couldn’t see what was and wasn’t working. He couldn’t even ditch the aircraft in the Arabian Gulf as he didn’t know his own altitude and couldn’t see out the window.

The Boeing 747 approached Dubai travelling 350 knots at an altitude of 9,000 feet and descending.

The computed airspeed was 350 knots, at an altitude of 9,000 feet and descending on a heading of 105° which was an interception heading for the ILS at RWY12L. The FMC was tuned for RWY12L, the PF selected the ‘Approach’ push button on the Mode Control Panel [MCP] the aircraft captures the Glide Slope (G/S). The AP did not transition into the Localizer Mode while the Localizer was armed.

ATC at Dubai asked a relay aircraft to advise the Pilot Flying, “You’re too fast and too high. Can you make a 360? Perform a 360 if able.”

The First Officer responded simply with, “Negative, negative, negative.”

The Pilot Flying set the landing gear lever to down. This caused an aural warning alarm: Landing Gear Disagree Caution.

15:38:20 PF: “I have no gear.”

The aircraft passed north of the aerodrome on a heading of 89° at a speed of 320 knots, altitude 4200 feet and descending.

He had no landing gear. He was fast and high. The fire was still burning and the cockpit was thick with smoke. He couldn’t see a thing. And now he’d overflown the airport.

There was another airfield, Sharjah Airport, which was 10 nautical miles to the left of the aircraft. The relay pilot asked if the Pilot Flying could turn left onto a 10 mile final approach for Sharjah’s runway 30.

19:38:37 PF: Sir, where are we? Where are we located?
19:38:39 RELAY AIRCRAFT: Are you able to do a left turn now, to Sharjah? It’s ten miles away.
19:38:43 PF: Gimme a left turn, what heading?

The relay aircraft advised that SHJ was at 095° from the current position at 10nm. The PF acknowledged the heading change to 095° for SHJ.

However, the Pilot Flying selected 195°. The aircraft banked to the right as the Flight Management Computer captured the heading change. The aircraft entered a descending right-hand turn at an altitude of 4,000 feet. Then there were a number of pitch oscillations commanded by the Pilot Flying as the elevator effectiveness decreased.

The aircraft was heading straight for Dubai Silicone Oasis, a large urban community. I suppose the one good thing in this fiasco is that it never made it that far.

15:40:15 RELAY AIRCRAFT: Okay Dubai field is three o’clock it’s at your three o’clock and five miles
15:40:20 PF: What is my altitude, and my heading?
15:40:25 PF: My airspeed?

The pitch control was ineffective. The control column was fully aft but there was no corresponding elevator movement.

The aircraft was out of control.

15:41:33 The Ground Proximity Warning System sounds an alert: PULL UP

15:41:35 [data ends]

The Boeing crashed into a service road in the Nad Al Sheba military base nine miles south of Dubai.

So what caused the fire to go so quickly out of control?

The cargo loaded in Hong Kong included a large amount of lithium batteries distributed throughout the cargo decks. However, packing slips and package details, showing that the cargo contained lithium batteries and electronic devices packed with lithium batteries, were not inspected until after the accident. At least three of the shipments contained lithium ion batteries which are specified as a hazard class 9 and should have been declared as hazardous cargo.

Lithium batteries have a history of thermal runaway and fire, are unstable when damaged and can short circuit if exposed to overcharging, the application of reverse polarity or exposure to high temperature are all potential failure scenarios which can lead to thermal runaway. Once a battery is in thermal runaway, it cannot be extinguished with the types of extinguishing agent used on board aircraft and the potential for auto ignition of adjacent combustible material exists.

The investigators believe that a lithium battery or batteries went into an “energetic failure characterised by thermal runaway” – in other words a battery auto-ignited. This started a chain reaction, igniting all the combustible material on the deck. The resulting fast-burning blaze then ignited the adjacent cargo, which also included lithium batteries. The remaining cargo then ignited and continued in a sustained state of combustion, that is, the conflagration continued burning until the crash.

The single point of failure in this accident was the inability of the cargo compartment liner to prevent the fire and smoke penetration of the area above pallet locations in main deck fire zone 3.

This resulted in severe damage to the aircraft control and crew survivability systems, resulting in numerous cascading failures.

As the cargo compartment liner failed, the thermal energy available was immediately affecting the systems above the fire location: this included the control assembly trusses, the oxygen system, the ECS ducting and the habitable area above the fire in the supernumerary compartment and in the cockpit.

The probable causes start with the fire developing in the palletized cargo, which escalated rapidly into a catastrophic uncontained fire. The cargo compartment liners failed. The heat from the fire caused the malfunctions in the truss assemblies and control cables, disabling the cable tension and elevator function. The heat also affected the supplementary oxygen system, cutting off the Captain’s oxygen supply. The rate and volume of toxic smoke obscured the view of the primary flight displays and the view outside the cockpit, exacerbated by the shutdown of PACK 1. And finally, the fire detection itself did not give enough time for the flight crew or the smoke suppression systems to react before the fire was a conflagration.

A key consideration that the investigation puts forward is the useful response time in the case of an onboard fire.

A study conducted by the Transportation Safety Board of Canada, in which 15 in-flight fires between 1967 and 1998 were investigated, revealed that the average elapsed time between the discovery of an in-flight fire and the aircraft ditched, conducted a forced landing, or crashed ranged between 5 and 35 minutes, average landing of the aircraft is 17 minutes.

Two other B747 Freighter accidents caused by main deck cargo fires have similar time of detection to time of loss of the aircraft time frames, South African Airways Flight 295 was 19 minutes before loss of contact and Asiana Airlines Flight 991 was eight minutes. Both aircraft had cargo that ignited in the aft of the main deck cargo compartment.

The accident aircraft in this case, was 28 minutes from the time of detection until loss of control in flight. The cargo that ignited was in the forward section of the main deck cargo compartment. The average time is seventeen minutes. This should be factored into the fire checklist that an immediate landing should be announced, planned, organised and executed without delay.

These findings indicate that crews may have a limited time to complete various checklist actions before an emergency landing needs to be completed and the checklist guidance to initiate such a diversion should be provided and should appear early in a checklist sequence.

The English language accident report is very long; it is a very thorough investigation and well worth a read to understand the full context of the flight.

All I can hope is that something good comes out of such a detailed analysis in order to stop such a tragic crash from happening again.


If you found this interesting, you’ll probably enjoy my e-book, Why Planes Crash.

28 June 2013

Engine Failure on Airbus A330 leads to High Speed Rejected Take Off

This video of a Rejected Take Off (RTO) by Simon Lowe is making the rounds. It shows an Airbus A330 at Manchester Airport aborting take-off at high speed directly after a bang as the right engine fails. The Thomas Cook flight was en route to the Dominican Republic.

It is a lovely textbook case of a good reactions in the cockpit:

The aircraft was an Airbus A330-200. The Thomas Cook flight was departing Manchester Airport for the Dominican Republic. The A330 was travelling at around 110 knots when the right-hand engine, a Rolls Royce Trent 772, fails with a bang.

The Pilot Flying sure was on the ball with this one. There’s no time to assess the problem or think about options. Having decided not to continue the take-off and deal with the problem in the air, the Pilot Flying has only seconds to safely stop the aircraft on the tarmac.

The thrust reversers are activated immediately but just for a few seconds and if you watch the tyres you can see the smoke from the wheel braking. There’s a slight deviation from the centreline as the engine goes and immediate rudder deflection to straighten the aircraft. The Emergency Response vehicles are on their way immediately upon hearing the sound, they are already there by the time the Pilot Not Flying has reported the problem.

Simply amazing.

A quick search on AV-Herald shows that this is not the first instance of engine trouble in that aircraft:

The Aviation Herald Search results for “G-OMYT”

Simon Lowe was at Manchester Airport that day to film a large cargo plane, almost certainly the visiting Antonov An-225 Mriya . He told the BBC that it was just luck that he caught the footage, but his YouTube channel is full of great aviation videos. He’s probably best known for this detailed video of a birdstrike, also taken at Manchester:

Meanwhile, there’s a second video of the A330 showing the incident from the side. Eddie Leathwood is a young plane spotter who was sad that he was going to miss the visiting Antonov 225 because he was at school. His uncle went to the airport to film the Antonov for Eddie and so he was on site with the camera out when the A330 was taking off.

It was filmed from the Aviation Spotters area, with the kind of helpful commentary you only find in the North of England:

PS: Simon Lowe also got his cargo plane footage. Wow, the Antonov really is huge, isn’t it!

21 June 2013

The Siren Call of Aerobatics: Cirrus SR22 Crash

It was the 13th of November, 2011. Two pilots were flying a rented Cirrus SR22, on their way home from the Stuart Air Show at Witham Field in Martin County, Florida. The pilot in the left seat was a 23 year-old private pilot. In the right seat, was a 34-year old commercial pilot whose family says had over 6,000 hours experience. The pilots were cousins and best friends.

About 10 miles south of Witham Field, they saw a Sukhoi SU-29 and an Extra-300 flying in formation, piloted by friends. The Cirrus SR22 joined the formation and the planes proceeded southwest.

ERA12FA068: Sunday, November 13, 2011 in Boynton Beach, FL

Shortly after the flight crossed the northern border of the Loxahatchee National Wildlife Refuge, the pilot of the Su-29 observed the accident airplane’s pitch smoothly increase upward to an angle of about 30 degrees. The airplane then began a roll to the left, and pitched nose-down as it rolled to an inverted attitude. As the airplane descended, it began to roll right, before it impacted the marsh below in an approximate 80-degree nose-down pitch attitude.

The pilot of the Su-29 contacted air traffic control as he orbited around the wreck. It was already clear that neither pilot could have survived.

A man walking his dog saw the three aircraft which flew overhead at a low altitude, less than 1,000 feet above the ground. The FAA confirmed this with radar data, the SR22 was flying at a recorded pressure altitude of 521 feet.

Local news coverage the day of the crash:

It was not immediately clear who was flying the plane. The safety restraints had to be cut from the left-seat pilot but it appeared that the right-seat pilot was not wearing his shoulder harness. However, the right-seat pilot was much more experienced, a commercial pilot with over 6,000 hours of flying experience, including helicopters, corporate jets and single and twin engine aircraft.

He was described as “a really good stick” and an “adrenaline junkie” and was clearly well-liked within the group.

He’d obtained his private pilot certificate in 1996 and then gave it up in 2006, when he submitted a “letter of surrender” to the FAA, abandoning his commercial pilot certificate. The reason for his surrender was “in anticipation of FAA certification action” but the FAA file contained no further details or even any reference to incidents that might have led the pilot to expect action.

In 2008, he obtained a student pilot certificate and over the next two years, he obtained his commercial pilot certificate with ratings for single and multi-engine aircraft, rotercraft helicopters, instrument airplane and helicopter.

The SR22 was rented in his name from 11-13 November for personal use. As a part of the rental agreement, the right-seat pilot agreed that the aircraft would not be used or operated by any other person. This, combined with the pilot’s experience and statements by witnesses, has led the NTSB to state that it was “most likely” that the right-seat pilot was in control of the aircraft.

The Cirrus SR22 is a single-engine four-seater and is currently the world’s best-selling single-engine aircraft. The SR22 is best known for the Cirrus Aircraft Parachute System (CAPS) which lowers the aeroplane slowly to the ground in the event of loss of control or other in-flight emergencies. The accident aircraft, registration N661FT, was operated by Air Orlando Flight School as a rental aircraft.

A Blackberry mobile device found in the wreckage had photographs taken that day. The final four photographs were taken from the aircraft directly before the crash.

Two of the photos depicted two other airplanes flying in a trailing formation off of the accident airplane’s right wing, while one of the later photos shows one airplane in a trailing formation off of the accident airplane’s left wing. The airplanes immediately off of the accident airplane’s left and right wings in the two photos appeared to be the same, though the registration number was not visible in either photo. One of the photos also showed that the left seat pilot was wearing a black t-shirt and that both shoulder restraints were on, while another photo showed that the right seat pilot was wearing a gray t-shirt. Only the right shoulder of the right seat occupant was visible, and the occupant did not appear to be wearing that shoulder restraint.

A witness on the ground saw the aircraft shortly before the crash. He was standing with an acquaintance when they heard several loud and low airplanes.

He remarked to his acquaintance about how close each of the airplanes was flying to the others as they flew from the northeast to the southwest. The airplane that was trailing in the formation began to lag behind when the witness looked away. Just then, the acquaintance remarked, “Whoa, that guy snapped a roll!,” referring to the lagging airplane in the formation.

Another witness said that he’d observed two or three low wing aircraft flying southwest in close formation. He said one of the airplanes did a barrel roll before he lost sight of the formation behind trees.

A barrel roll. In a Cirrus SR22. Let’s just make sure this is clear: the Cirrus SR22 is not an aeroplane meant for loop-de-loops. It is neither certified nor designed for aerobatic operations, nor even for turns where the angle of bank exceeds 60°. For an aileron roll, you pull the aircraft into a 90° bank. I mean, you don’t. I don’t. We wouldn’t do this in a plane which isn’t made for it. But it seemed the pilot of the SR22 that day did.

The investigation confirmed the aerobatic maneuvers when they reviewed the data from the flight recorder. And when they reviewed the flight earlier that day. And when they reviewed the flight from the day before…

On November 11, 2011, two days prior to the accident flight, the airplane departed BCT at 1654 and climbed to an altitude of about 2,000 feet, before beginning a shallow descent to 1,800 feet. At 1658, the airplane began to pitch up and roll to the left, reaching about 30 degrees of nose-up pitch and completing 360 degrees of roll. The airplane then continued to FA44, and landed at 1701.

On the morning of the accident flight, the airplane departed from BCT at 1030 and climbed to an altitude of 1,500 feet. At 1037, the airplane began descending and leveled off at an altitude of about 600 feet at 1048. At 1057, the airplane began pitching nose-up and rolling to the left, reaching 32 degrees of nose-up pitch and completing 360 degrees of roll. The airplane completed a low pass down runway 12 at SUA at a GPS altitude of less than 75 feet and an indicated airspeed of 142 knots before it climbed to about 500 feet, circled the airport, and landed at 1105.

After they departed SUA, they climbed to 1,000 feet but the flight recorder showed that at 17:34, the flight descended, with a GPS altitude of 161 feet and the measured pressure altitude was 0 feet. Over the next few minutes, the GPS altitude varied from a high of 195 feet to a low of 38 feet.

Beginning at 1736:18, while flying at a GPS altitude of 61 feet, the airplane began a roll to the left that reached a maximum bank angle of 66 degrees about 4 seconds later. The airplane then began rolling back to the right, and at 1736:19 reached a maximum right bank angle of 70 degrees, after climbing to a GPS altitude of 308 feet. At that time, the recorded pressure altitude was 109 feet. The airplane returned to a relatively level roll attitude about 4 seconds later.

Then the aircraft descended again, reaching a low GPS altitude of 145 feet (the pressure altitude was an invalid negative number).

The pitch angle then began to increase, reaching a maximum of 27 degrees nose-up at 1736:36, at a GPS altitude of 129 feet, and a pressure altitude of 29 feet. Within 2 seconds, a left roll began that continued past 90 degrees, and as the roll increased, the pitch angle also began to rapidly decrease. As the airplane reached 178 degrees of left roll, the pitch had decreased to 30 degrees nose-down, at a maximum pressure altitude of 353 feet. The airplane then began to descend, and the pitch continued to decrease to 67 degrees nose-down one second later, as the roll transitioned past inverted to 138 degrees of right roll. The final recorded data point, one second later, showed the airplane in a 68 degree nose-down pitch attitude and a 42-degree right roll, at a pressure altitude of 205 feet and an airspeed of 156 knots.

That can be hard to visualise but COPA safety have done an excellent video based on the data. The following shows the aerobatics performed in the SR-22 over the course of these two flights and the accident flight:

One of the pilots of the aircraft said that he’d heard that the right-seat pilot had “rolled the Cirrus” in the past but had never seen him do it. But he’d never logged aerobatic flight hours and was not known to have aerobatic experience. Maybe if he had, he’d have better understood the stresses he was putting the aircraft under.

It’s possible that the lack of a harness was the final straw which caused the right-seat pilot to lose control of the aircraft. At that height, in that aircraft, he had no chance of recovery.

The National Transportation Safety Board determines the probable cause(s) of this accident to be:
The right seat pilot’s decision to attempt a low-altitude aerobatic maneuver in a non-aerobatic airplane.

The parachute was found in a bag near the wreckage. The ballistic recovery parachute system activated on impact. However, even if one of the pilots pulled the handle to activate the parachute, it wouldn’t have made any difference, not at that height.

You can read the full report here: ERA12FA068: Sunday, November 13, 2011 in Boynton Beach, FL


If you are interested in air crash investigations, you’ll probably enjoy my e-book, Why Planes Crash.

PS: If you don’t have an e-book reader and would prefer the book in PDF format, just email me at sylvia@fearoflanding.com and we’ll work something out.