How is it Possible to Land an Airliner on a Taxiway?

An Alaska Airlines 737 landed on a taxiway at Seattle's SeaTac airport on December 19th at about 8:30 in the morning. While it is not unknown for this sort of thing to happen, it is thankfully rare but also exceedingly dangerous. Luckily for this crew and their passengers, the taxiway was clear at the time and the landing was uneventful.

Taking off or landing on the wrong piece of pavement has been the cause of a number of incidents and accidents over the years. One of the most deadly in recent memory was the crash of a Singapore Airlines 747 which attempted to take off on a closed runway back in 2000 in Tapei and impacted parked construction equipment killing 76.

Another deadly incident was that of Comair 5191 whose pilots mistook a shorter runway for the one they had been cleared to use resulting in an overrun accident and 49 fatalities.

Wrong runway and wrong airport landings also occur but on occasion lady luck smiles on the errant pilots. A Southwest Airlines 737 enroute to Branson, Mo. landed at a small general aviation airport several miles short of its intended destination last year. Quickly realizing their mistake, the pilots were able to stop the plane on the very short runway thereby averting a serious accident.

I even recall an incident from many years ago when an American Airlines plane landed at Biggs Army Airfield instead of El Paso Intl, which was its destination. The two airports are immediately adjacent to one another. I remember this incident because not long after that, I had a student pilot of mine attempt to land at El Paso while our destination was Biggs.

As you can see, wrong runway errors are committed by both inexperienced pilots as well as seasoned aviators.

So with the possibility for such deadly results, how is it that pilots can take off or land on the wrong runway or a taxiway? The answer is that it is not easy to do this but it is easier than you might think. And there is a common factor in all of these incidents and accidents. That factor is complacency.

How Could This Happen?

Alaska Flight 27, a Boeing 737-900, arrived in the Seattle area from Chicago at about 08:15 AM and was vectored by Seattle Approach Control to an ILS approach to runway 16 Right. SeaTac has three parallel runways labeled 16 Left, Center and Right. The "16" denotes the approximate runway heading of 160 degrees (it's actually 163 degrees). There is also a taxiway named "T" or Tango, running parallel to the runways between the center and right runway.

An ILS is a ground based radio guided approach which provides both vertical and horizontal guidance to the pilots. When flying this approach, the pilots would be presented with precise lateral course information. Deviation from the course or a lineup on the wrong runway would be prominently displayed on the instruments. 

For this reason, pilots are encouraged or required to always have ILS information tuned in and displayed even when flying a visual approach. And speaking of which, the weather at the time of the incident was quite good:

KSEA 191637Z 12010KT 10SM SCT022 03/02 A2991 RMK AO2 $
KSEA 191553Z 16007KT 10SM FEW016 BKN025 03/02 A2990 RMK AO2 SLP134 T00280017 $ 

This translates to a thin ceiling at 2500 feet at the top of the hour and no ceiling in the report at the bottom of the hour with the visibility being very good. Clearly weather was not a factor and the aircraft was cleared for an instrument approach to the outside runway. How then did they end up on the taxiway?

Cleared to Sidestep

Just a few minutes before landing, and after the aircraft had switched from Seattle Approach Control to Seattle Tower, the tower controller asked if they'd like to land on the center runway. The aircraft stated that they would like to switch runways and were subsequently cleared to land on runway 16 Center.

This maneuver is called a "sidestep" and is a visual maneuver, meaning that it is accomplished using visual and not instrument cues. A tower controller may offer a different runway to a landing aircraft for a number of reasons such as tight spacing on a preceding aircraft, or perhaps a desire to get an airplane with a flow time airborne. In this case, it appears as if the tower controller was simply doing a favor for the Alaska jet as the taxi time from the closer runway would be shorter. 

The audio from the tower frequency can be heard here. The clearance for the sidestep can be heard at the 28:00 minute point.

So at this point, the aircraft accepted the sidestep clearance and would start maneuvering visually to land on the center runway. What else might have affected the crew's ability to identify the correct runway?

It's hard to say for sure but there are some clues. For one, the center runway has just been completely rebuilt. The new pavement on the freshly rebuilt runway is still most likely clean and lacking the usual rubber deposits that most runways have.

Another consideration would be the angle of the sun. The aircraft touched down at 8:31 AM and sunrise in Seattle that morning was at 7:58 AM. The angle of their approach would have put the sun almost directly in their eyes further obscuring the markings on the taxiway as seen in the graphic below. This would have been made worse as they attempted to maneuver to the left of course to line up on the center runway.

The orange line shows the sun direction at 0831 on Dec 19th

How Could This have been Prevented?

One of the more challenging aspects of aviation is that seemingly routine or innocuous situations may contain hidden danger. And there will rarely be obvious signs pointing out these pitfalls. This is why it is incumbent upon pilots to maintain vigilance during not only difficult weather, but also during a simple visual approach in good weather. Some might say especially during good weather.

Being able to recognize when conditions are subtly changing while having the appearance of normalcy is a core skill used to battle complacency.

Another technique that could have been used would have been to have the non-flying pilot tune in the frequency of the approach to the new runway. Often this can seem redundant if the landing runway is in sight, but this crew is probably now wishing that they had. 

What Happens Next?

There will be an investigation. The FAA has already said that they are looking into the event. The pilots will most likely not be fired but they may face some discipline in the terms of time off from work which means lost income. They will also likely have some retraining or a checkride before flying again.

The pilots may, however, not face any punitive action at all if this event is accepted into a safety reporting program. In these industry-labor-regulator partnerships, mistakes made in good faith can be provided immunity from sanction to enhance the reporting of safety related information.

The hazard that this taxiway presents has already been noted in a warning printed on the airport layout depiction as seen below. That this hazard was known may even mitigate in the pilot's favor. 

We can probably expect to see some new measures such as large letters painted on the taxiway and further warnings designed to prevent this from happening again but nothing is as effective as maintaining a watch against complacency.

Shifting Currents: Will Regional Airlines Survive?

It would  appear to observers of the domestic US airline industry that things are finally settling down. After years of turmoil, bankruptcy and consolidation, the remaining big four US major airlines control nearly three quarters of all domestic airline seats. Low fuel prices have meant a season of record profits as well.

The regional airline market, however, is a somewhat different story. Whipsaw fuel pricing, the introduction of a new class of small jets and a pilot labor shortage along with a reassessment of the relationships between regionals and their mainline partners could be changing the landscape.

The regional airline business model consists mainly of little known companies such as Envoy, Expressjet or Republic Airlines that fly airplanes in their major airline partners' livery. Flying as American Eagle, United Express or Delta Connection, these companies sign "capacity purchase agreements" with their major partner airlines to provide service between major airline hubs and smaller regional airports that don't support a mainline aircraft.

Regional Airlines: How We Got Here

The industry has always existed to ferry passengers from major hubs to small feeder cities, but the introduction of small regional jets from the late 1990s fundamentally changed the dynamics of the business model. These small jets such as the 50 seat Bombardier CRJ 200 and the Embraer ERJ 145 could not only go as high and as fast as their major airline brethren, but could also and more importantly, fly as far.

What this meant is that regional airlines could poach passengers from each other's regional feeder airports. For instance, historically, to fly out of a regional airport such as Twin Falls, Idaho, one would have to take a regional airline to the nearest hub which was within the range of the smaller and slower turboprop aircraft. This probably would have been Salt Lake City where Delta was the dominant major airline. The new regional jets (RJs) allowed regional airlines to now fly directly from a smaller city to a hub in another region such as LA, or Chicago.

It also meant that regional airlines were no longer strictly feeders to their mainline partners but rather operators of parallel airlines under the same corporate identity. The real brilliance of the arrangement, however, was that the regional partners were not covered under the collective bargaining agreements which kept labor costs high at the mainline network airlines. How did this happen?

The Unions Get Snookered

The one aspect of collective bargaining agreements (CBAs) that unions are most jealous of is their scope clause. A scope clause will delineate which work must be accomplished by employees covered under the CBA and which work, if any, can be outsourced. Obviously unions have an interest in keeping the most work in-house and under the agreement.

In fact, unions view scope clause protections as so vital, that those protections are usually set forth in the first section of many airline labor contracts. Thus, the term "Section 1" protections becomes a shorthand for all the restrictions on who may perform work for the company with which the union collectively bargains.

It was a lack of imagination and vision on the part of mainline union negotiators that allowed both existing provisions for the outsourcing of regional flying to remain in airline CBAs, or for those provisions to be imposed after the wave of post 9/11 airline bankruptcies. Mainline union negotiators were caught flat footed by the introduction of the new capable RJs which resulted in stagnation in the amount of flying they controlled. They simply didn't think that the provisions for commuter aircraft flying in their contracts would eviscerate their members' livelihoods.

In 2000, for instance, regional airlines flew a total of 24 billion revenue passenger miles (RPMs), but by 2010 that number had increased three fold to about 75B RPMs. In the same time frame, all network mainline airlines flying stagnated at about 360B RPMs until 2007 followed by an erosion to about 320B RPMs in 2014. The data can be found here and here.

Some, but not all of this mainline stagnation could be attributed to the growth of low cost carriers (LCCs) like Jetblue, Southwest and AirTran airlines, but it became clear that regional airlines were doing a fair bit of the flying that mainline airlines might have done themselves.

In 2011 for instance, regional carriers accounted for 64% of all departures at Chicago's O'Hare airport and 74% at Seatac. Some city pairs such as Nashville - Chicago (O'Hare) have had only RJ service while others such as Austin - Denver might have a mix of RJs and mainline aircraft. Three of the largest regional airlines, Envoy, ExpressJet and SkyWest can be even now counted as major airlines in their own right with each having over a billion dollars of annual revenue.

Alter Egos

What one should be careful to not do, though, is to assume that mainline carriers are in actual competition for business with their regional partners. This is due to the nature of the capacity purchase agreements (CPAs) that mainline and regional airlines have entered into. In a capacity purchase agreement, the mainline carrier simply purchases all the seats on the regional aircraft while retaining the marketing, ticketing, and most importantly, the revenue from the sale of tickets.

The regional carrier gets paid regardless of how many seats are filled or how the customer is ultimately treated. The regional airline is effectively wet-leasing its aircraft to the mainline. You can easily see how incentives line up for a less than optimal customer experience on regional airlines...they're getting paid either way. The lack of amenities, spartan service and cramped cabins have made regional jets increasingly unpopular with the traveling public.

So if the customer experience is so negative, why do the mainline airlines outsource their valuable branding and operations to third parties who get paid regardless of product quality? Cost control. Salaries are notoriously low at regional airlines with some crew members qualifying for food stamps. In fact, due to the long term contracts regionals have with their mainline partners, the only way for a regional airline to increase unit revenue is through cost control and cost reduction, which is exactly what they've done and become very good at.

So who wants to work at such a place? One of the reasons that employees may accept the low wages offered by regionals is that hiring standards are lower, or perhaps employees hope to gain needed experience in the industry in hope of landing a better job at a major airline.

This is especially true for aspiring pilots who can count their flight hours as a form of pay. Most mainline airlines have minimum hours requirements for pilots to be considered for hiring. The only way for a young pilot to get this experience other than joining the military has traditionally been to fly for a regional airline. New federal regulations, however, are changing that dynamic which I wrote about here.

The arrangement between regionals and mainline carriers has many of the usual suspects and social justice warriors in a degree of moral high dudgeon due to low wages, but my view is somewhat moderated. It's simply not true that forcing wages higher will result in a greater quality product while leaving service distribution unchanged. In many cases, smaller cities will just lose scheduled air service as costs climb. This is already happening.

Flies in the Ointment

The regional industry has several other vulnerabilities which may eventually change how they do business. One particular achilles heel is the high seat-mile cost that the small jets have. While the cost to acquire and operate a 50 seat jet is only marginally less than say a 737, a 737 will have nearly three times the seats and therefore three times the ability to generate revenue.

After huge fuel price spikes in the late 2000s it became apparent that the economics of the 50 seat jets didn't really work. As a result, many of those jets are being traded in for the larger 70 and 90 seat versions. A new generation of small jet such as the Embraer E series and Bombardier C series of jets feature larger cabins, first class seating and are as comfortable as mainline Boeings or Airbuses.

Now though, with the larger capacity aircraft, regional airlines are bumping back into union contracts which restrict the outsourcing of aircraft of larger than 90 seats. Coupled with an ongoing pilot shortage, at least two mainline carriers, Delta and United, have considered bringing their regional airline operations back in-house.

Bringing the Flying Home?

Last summer, Delta proposed to their pilots a purchase of 20 Embraer E-190 regional aircraft and United recently approached their pilot union with an offer of increased pay which included the introduction of either the Embraer or Bombardier 100 seat aircraft. While Delta pilots turned their offer down for unrelated issues, pilots at United have yet to vote on the new pact which also includes pay increases.

It seems apparent that with the pilot shortage driving higher pilot salaries, the advantages of outsourcing regional aircraft flying to a third party where customer service may suffer is being outweighed by keeping the flying in-house.

Should Airplanes Be Flying Themselves?

For anyone interested in going deeper down the rabbit hole of the problems of automation and the concurrent (and inevitable) deterioration of piloting skills, William Langewiesche wrote a great long-form recount of the crash and investigation of Air France 447:

 For Flight 447, it was too late: the probes were quickly clogged. Just after 11:10 P.M., as a result of the blockage, all three of the cockpit’s airspeed indications failed, dropping to impossibly low values. Also as a result of the blockage, the indications of altitude blipped down by an unimportant 360 feet. Neither pilot had time to notice these readings before the autopilot, reacting to the loss of valid airspeed data, disengaged from the control system and sounded the first of many alarms—an electronic “cavalry charge.” For similar reasons, the automatic throttles shifted modes, locking onto the current thrust, and the fly-by-wire control system, which needs airspeed data to function at full capacity, reconfigured itself from Normal Law into a reduced regime called Alternate Law, which eliminated stall protection and changed the nature of roll control so that in this one sense the A330 now handled like a conventional airplane. All of this was necessary, minimal, and a logical response by the machine. 

So here is the picture at that moment: the airplane was in steady-state cruise, pointing straight ahead without pitching up or down, and with the power set perfectly to deliver a tranquil .80 Mach. The turbulence was so light that one could have walked the aisles—though perhaps a bit unsteadily. Aside from a minor blip in altitude indication, the only significant failure was the indication of airspeed—but the airspeed itself was unaffected. No crisis existed. The episode should have been a non-event, and one that would not last long. The airplane was in the control of the pilots, and if they had done nothing, they would have done all they needed to do.

It's a great article. Read the rest here.

Air Asia 8501: The Automation Failed First Followed by the Pilots

The final report on the crash of Air Asia 8501 was released on December 1st and serves to highlight a number of problems with highly automated aircraft and the pilots who fly them. If you'll recall, this was an A320 which crashed into the Java Sea killing all 162 passengers and crew last December.

In short, a broken solder joint had caused multiple fault indications in a rudder control unit during the flight. By itself this was not a huge problem, but when the captain attempted to reset some circuit breakers in response, the autopilot disengaged and the underlying rudder fault became a problem.

From the accident report:

The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU (rudder travel limiter unit) failure. The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter intervals. The same fault occurred 4 times during the flight.  

The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CBs (circuit breakers) being reset resulting in electrical interruption to the FACs. 

The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft rolling up to 54° angle of bank. 

Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.

So this crew was confronted with a technical issue which had recurred numerous times. It appears that the captain became frustrated with the repeated messages being generated by the faulty rudder unit and finally pulled the FAC circuit breakers. His goal was to reset the computers which he'd seen a maintenance technician do on the ground. It's an understandable impulse, and one that many users of computers have felt: if it's acting wonky, just reboot it.

It should also be noted that this procedure was unauthorized for the situation. The "electronic centralized aircraft monitor"or ECAM, is a display which alerts pilots if something goes wrong and also provides checklist steps to resolve the issue. Pulling circuit breakers is almost never called for and wasn't the correct procedure here. The captain got ticked at having to address the recurring issue and went off the script to apply his own "fix" by recycling the FAC circuit breakers.

The problem was that in resetting the computers, he was in effect sawing off the branch upon which he was sitting. To understand why, we need a little background on the airplane and its flight control systems. The highly automated Airbus has no direct mechanical linkage between the cockpit and the wings, but is rather controlled by a total of seven computers including two flight augmentation computers or FACs. These computers control the movement of the control surfaces using input from the pilots.

Alternate Law

The computers normally provide protection from unsafe flight regimes such as a stall or upset. However, when the computers sense that there is something wrong with their inputs, they revert to a mode known as "Alternate Law" where the computers no longer provide such protections. Pulling the circuit breakers, or essentially cutting power to the computers caused them to revert to alternate law.

It is here where the real problems began. In control of the aircraft at that time was the relatively inexperienced first officer who had just over 2000 hours total time. After the aircraft reverted to alternate law, the rudder malfunction manifested itself in a deflection of the rudder.

A deflected rudder at altitude can quickly upset a swept-wing transport like the A320 due to an aerodynamic phenomenon known as "roll coupling". This is where a yaw input, or movement about the vertical axis, induces a roll. It is an artifact of the swept-wing design of modern airliners and normally not a problem. Here it became a big problem.

Stall Warning

The aircraft immediately rolled to the left at a rapid rate and yet the first officer did not apply any stick input for 9 seconds, which is an eternity when your airplane is rolling over. This may have been due in part to the "startle effect" where a rapid and unexpected change takes some time to recover from or to "regain one's wits". Another possibility is that the first officer was not looking at the primary flight display but had his attention on the autopilot which had disengaged.

One of the primary rules of aviation is to "fly the airplane first", but after the relatively low workload of cruise, having to take manual control of the airplane can be disconcerting. Add to this the aural warnings of a disconnected autopilot and a rapid roll and there is little doubt that the first officer had his eggs scrambled at that point.

He did, however, manage to right the aircraft to a nearly normal bank. It was at this time, while the pilots were in manual control of the aircraft and without computer protection, that they killed themselves.

After the aircraft again rolled left, the first officer's side stick input was a sharp pull. This caused the rapid climb rate followed by a loss of airspeed and a stall. The data recorder showed input from the left side or captain's stick about 30 seconds after the initial roll but confusion on the part of the captain and apparent panic on the part of the first officer doomed the aircraft.

He had just over 2000 hours total time.

After the abrupt climb and stall, the captain instructed the first officer to "pull down" which is a rather confusing command. Pulling means that the nose will go up, not down. The first officer's reaction was to pull even harder on his stick which is the exactly wrong thing to do in a stall. The nose needed to be lowered so the airplane could regain flying airspeed. At the very least the first officer should have asked the captain what he meant, but in any event any aviator worth his salt knows that control forces must be relaxed, and angle of attack must be reduced in a stall. It's aviation 101. Or should be. 

Dual Input

It was also here that the electronic controls on the Airbus contributed to the problem. Unlike a Boeing which has a two control wheels which are connected mechanically, the side sticks on the Airbus can each provide separate, and opposite, instructions to the flight computers. The aircraft doesn't give priority to either pilot's inputs but rather sums the inputs for a resultant signal. So while the captain was making appropriate inputs to recover from the stall, the first officer maintained his hard pull which resulted in a net nose up command to the flight computers.

Another basic axiom of aviation is that only one pilot flies at a time, and it should always be clear who is in control of the aircraft. The captain failed here by not verbalizing his assumption of control to his copilot. A firmly annunciated "I have the aircraft" should have resulted in the first officer releasing his grip to allow the captain to recover from the stall. That never happened.

This is almost the exact scenario which doomed Air France 447 which I wrote about here. In that accident, a minor upset at altitude was exacerbated by one of the pilots maintaining a backwards pull on his side stick which didn't allow the recovery from a stall. Everyone perished in that crash.

Automation as Blessing...and Curse

A common theme on this blog has been that while the introduction and use of automation on airliners has been an overall boon to both safety and economics, it is not now, nor for the foreseeable future, going to be a replacement for having well qualified pilots who can actually fly airplanes.

That day will arrive eventually, but current technology simply can't yet replicate the required safety margins required to carry passengers.  

Automation has been widely deployed around the world by airlines which operate in countries that lack any significant general aviation or military aviation programs from which to draw pilots. Without these so-called "farm leagues" to train and groom pilots, the trend has been to take very inexperienced pilots with a bare minimum of flight time and to place them into highly automated cockpits. It is there that they will be expected to gain experience before moving into the left seat.

The problem is that highly automated cockpits offer virtually no real experience in real stick and rudder flying. The job consists of managing checklists and systems which the first officer on Air Asia 8501 no doubt accomplished adequately. He just couldn't fly the airplane out of a stall.

An old aphorism states that you can't tell who's swimming naked until the tide goes out. Don't get caught with a naked pilot.

If Our Satellites Saw Metrojet Explode, Why Didn't They See Malaysia Flight 17?

While I normally steer clear of geopolitics, I came across a blog post by Ron Unz asking this question. Unz, if you remember, is an entrepreneur who once ran for governor of California.

Writing in the comments section of an article on the Russian presence in Syria, Unz wonders:

But the real issue has been ignored by our worthless MSM. Within just a couple of days of the airliner’s destruction, America had already released satellite data showing a mid-air explosion, therefore strongly implying a bomb. However, after more than a year, the US has still failed to release any similar satellite data regarding the destruction of MH-17 in Ukraine, which occurred in a war-zone subject to far greater American surveillance.

Malaysia Flight 17 was the 777 which was shot down by a missile while flying over Ukraine. So do I have any idea about or opinion on the downing of MH17? Not in the slightest other than it was probably an unintentional launch by someone who thought they were shooting at a combatant aircraft. I'm not sure I buy the "false flag" theory of an intentional shootdown. That would be truly evil. But it's true that whoever did it, accidentally or not, certainly wanted to pin it on the other side. Here's where the satellites come in.

The US DoD has long been interested in space based intelligence and missile early warning. Dating back decades to the Cold War, satellites have been employed to try to detect missile launches. Given that the flight time for an ICBM is about a half hour or less, having a means to detect launches from space was an important priority.

Fast forwarding to the first Gulf War, the threat of Iraqi Scud missiles made clear the need for expanded theater missile detection in addition to strategic missile warning. The resulting system called the Space Based Infrared System (SBIRS) gives American intelligence agencies real time data on missile launches. The plume from any missile launch can be detected by infrared sensors and one would presume that the system is deployed over not only the entire middle east but also our old Cold War nemesis, Russia.

Of course the "sources and methods" of our intelligence capabilities are, or should be, highly classified for obvious reasons. If an enemy knows what we can see, they will take pains to avoid detection or to spoof those capabilities. For whatever reason, however, adherence to that principle seems to be in short supply these days. So by very quickly confirming that an explosion had been detected over the Sinai Peninsula, the inevitable questions about other events will surface as they have here.

Presumably, if current systems can see a smallish explosion on a jetliner then they would not only have seen the destruction of the much larger Malaysian 777, but also the location of the missile launch that took it down. There are also good reasons why our systems might not have been able to detect the MH17 shootdown as well. Perhaps there were gaps in coverage due to satellite geometry or there might have been interfering weather conditions. Either way, shouldn't the limits of this technology be kept secret?

All of this might make for a good Le Carré novel, but the spies in his novels including the governments they worked for were at least competent.

Falling Out of the Sky - The Mystery of the de Havilland Comet

Square windows were the problem

This week's inflight breakup and crash of a Metrojet Airbus A-321 reminded me of the story of the first jet powered airliner of the postwar era, the de Havilland Comet. The Comet, first flown in 1949, was to be the first airliner to offer a pressurized cabin to passengers. Remember that without pressurization or supplemental oxygen, most humans will suffer hypoxia symptoms above 10,000 ft. Pressurized and heated cabins are the one thing that makes flying long distances at altitude acceptable to the general public.

The mysterious inflight breakup of three Comets shortly after their introduction into commercial service served to highlight the importance of metal fatigue in aircraft design. While consideration was given to the issue in the design stage, it was the design of the windows, which were square, which proved to be the problem. It was at the corners of the windows where stress was concentrated and where metal fatigue caused structural failure which brought the airplanes down.

The full story, which is quite interesting, can be found here. It's a neat engineering whodunit.

Investigators have not as yet officially released the cause of the Metrojet crash, but it is believed that the aircraft suffered a catastrophic structural failure. An onboard bomb is now being suggested as the cause of the crash though consideration is also being given to structural failure due to an old repair. No matter the reason for the failure, any significant structural failure of an aircraft at altitude can sometimes but not always result in the loss of the aircraft.

Why So Much Damage?

So you may ask why does a hole in the fuselage whether caused by metal fatigue or a bomb cause so much damage?

Pressurization of an aircraft is achieved by pumping air under pressure into the fuselage while restricting the outflow. Think of the airplane as one of those large inflatable jump houses at a carnival. A fan blows air in while vents let only some of the air out. Airplanes work in the same way with compressed air coming from the engines acting to inflate the fuselage or "balloon" and an outflow valve to control the amount of pressurization.

Now think about what happens when you drop a shaken can of soda on the ground. Sometimes a small hole in the pop top just squirts out a bunch of soda, but at other times the whole can might rupture and spray everywhere. I've seen flight attendants drop a can of soda in the galley that explodes where soda covers just about everything instantly. You haven't seen mad until you see that.

The same principle applies to a pipe bomb. Burn a small pile of gunpowder in the open and it makes a brief poof. Put that same powder in a pipe and it expands explosively when the metal in the pipe bursts.

The point is, expanding gas when trapped in a pressure vessel can result in tremendous damage when the pressure vessel fails. This is why bombs aboard aircraft are so dangerous. Regardless of where the bomb is placed, it is the pressure shock wave which will find the weakest point in the structure. When the structure fails, the release can do tremendous damage. In the case of the Metrojet crash, the tail section was found separate from the rest of the wreckage. It may have separated due to the failure of the pressure bulkhead at the aft part of the cabin.

Barring 100% prevention of bombing attempts, which seems unlikely, future aircraft design may have to incorporate some sort of predesignated pressure relief panels. They might be designed to fail at a lower pressure than the rest of the fuselage pressure vessel. It's the world we now live in.

Will There Be an Airline Strike?

Florida News Journal

The pilots of Southwest Airlines are the latest airline labor group to reject a proposed labor contract. By a vote of 62% against, the 8000 pilots at Southwest recently voted to turn down a tentative agreement which was forged after three years of negotiations with the low cost carrier. Earlier this year the pilots at Delta Airlines and flight attendants at Southwest also rejected proposed contracts.

Does this mean that there will be an airline strike soon?

While the future is impossible to predict, the answer is probably not. To understand why, it is important to understand how the negotiation process works at airlines. It is somewhat different than at other unionized industries.

Railway Labor Act

Collective bargaining at most unionized industries in the US is governed by the National Labor Relations Act of 1935, also known as the Wagner Act. This law provides for the formation of labor unions and the right to bargain collectively for wages and work rules. The law also sets down the requirements for the conduct of strikes and/or lockouts. Airlines, however, are not included under the provisions of the Wagner Act but rather are governed under a law known as the Railway Labor Act or RLA.

Passed in 1926 as a result of negotiations between the railroads and their unions, the RLA was an effort to balance the rights of workers with the realization that a strike against a railroad could be acutely disruptive to the national economy as a whole. Airlines were included under the jurisdiction of the RLA in 1936.

Under the RLA, contracts never "expire", but rather they become "amendable". Should an agreement not be reached by the amendable date of a contract, both workers and management are obligated to continue on as before while a new agreement is crafted.

Should an agreement not be reached, the RLA provides for specific requirements to be met before either management or labor is "released" to "pursue self help" otherwise known as a strike or lockout. One of these requirements is for an impasse to be declared by a mediator after which a mandatory 30 day cooling off period is observed. Only then would a strike be authorized.

No airline today is anywhere near this happening.

Presidential Emergency Board

And even when it does happen, it might not happen. The RLA contains a provision wherein if a labor action  threatens to "substantially to interrupt interstate commerce to a degree such as to deprive any section of the country of essential transportation service," the National Mediation Board (NMB) may notify the President of an imminent threat to commerce. The President may then appoint a three member board to make recommendations for a resolution. This delays a strike even further.

This last happened in 2001 when President George Bush intervened in a labor dispute between Northwest Airlines and its mechanics by invoking a PEB. Before that, Bill Clinton used a PEB to head off a strike by pilots at American Airlines in 1997. With only four major airlines controlling a majority of air travel, it is possible that airline strikes may be a thing of the past. No president wishes to be seen doing nothing in the face of packed terminals and irate flyers.

But as I mentioned above, no current airline is anywhere near an impasse in negotiations. In fact, due to the ongoing pilot shortage, airline managements may wish to get labor troubles behind them quickly as the competition heats up for a dwindling number of pilots needing to be hired to replace the tsunami of retiring pilots. 

This happened recently at Republic Airlines where management threatened to declare bankruptcy in order to increase pilot wages to attract applicants. Republic had been cancelling flights due to a lack of pilots.

It's nice to be wanted.

Russian Metrojet A-321 Crash in Sinai (Update)

STR/EPA/Picturedesk

A Russian Metrojet A-321 with 224 passengers and crew crashed in the Sinai Peninsula Saturday after being lost on radar. The aircraft was enroute to St. Petersburg from Sharm El Sheikh and was climbing through about 31,000 ft when radar contact was lost. There were no survivors found. The flight data and cockpit voice recorders have been found in good condition.

There were preliminary reports of the pilots having made distress calls but those were later rescinded. The wreckage was found in two major pieces spread over an area of about 8 km. Such a dispersal of debris suggests that the aircraft may have suffered an inflight breakup.

This has led to speculation concerning either a terrorist missile, MANPAD or structural failure. A terrorist group claimed credit for downing the aircraft but these reports have been dismissed as not being credible as has a video that the group released.

Intelligence reports claim that the terrorist organizations known to be operating in the area did not have missiles capable of reaching the altitude at which the aircraft was flying. A notice to airmen (NOTAM) had been released advising aircraft in that area to not operate below 26,000 feet due to terrorist activity. Likewise, analysis of the wreckage will confirm whether or not a bomb had been placed on board.

The aircraft itself, an Airbus A-321, was one of the oldest of the type in operation having been delivered in 1997. While the age of the aircraft should not be a factor in the crash, the aircraft had suffered a tailstrike in 2001 which resulted in significant damage while it was owned by Lebanon's Middle East Airlines. The aircraft was repaired and returned to service.

There have been several instances of airliners suffering structural failure which was due in part to repairs done after tail strikes. The most notable of these was Japan Airlines 123, a Boeing 747, which crashed in 1985 after a faulty tail strike repair failed resulting in a rupture of the pressure bulkhead.

Speculation and conspiracy theories are as usual expected to run rampant. Cutting the wheat from the chaff when an airplane goes down amid geopolitical unrest is always a challenge. Hopefully the truth behind this tragedy emerges unscathed.

UPDATE: The crash area is now being reported as 350 x 500 meters, smaller than initially reported.

UPDATE 2: Analysis of the cockpit data recorder now suggests that the crew had no warning before a catastrophic event brought down the aircraft. Further analysis of the wreckage should be able to discern the nature of the failure and whether it was a bomb or structural failure possibly due to an old tailstrike repair or undiscovered corrosion.

UPDATE 3: While no evidence of a bomb on board the downed Metrojet airliner has yet been publicly produced, David Cameron, PM of the U.K. has  gone on record stating that a bomb was the likely cause of the crash. US officials have also said that they suspect a bomb was the cause. The U.K and now the Netherlands have suspended flights to the Sinai Peninsula in the wake of the announcement.

New Post: You may also be interested in how a bomb can bring down an airliner: Falling Out of the Sky

A New Font

Just an administrative note: I've changed the font to something larger and hopefully easier to read. Let me know if you like it!

Is This the Most Dangerous Airport in America?

American jetliner attempts to parallel park.

No, this airport is probably not the most dangerous one in America. To my knowledge, there has never been an accident here. This picture, which I took about a week ago on a layover, is from Lindbergh Field in San Diego. An American Airlines A-321 is passing over the infamous parking garage structure located directly off the end of Runway 27, which is the primary landing runway.

So how do I know that Lindberg is not the most dangerous airport? After all, the picture is not an illusion. The airplanes really pass about a hundred feet or so above the parking structure. But even though the structure is really close to arriving aircraft, no plane has ever hit it. It just looks dangerous both from the ground and also from the cockpit.

But just because no airplane has hit the building, does that make it safe? And how does one even define the word safe anyway?

There's an old adage that states "Safety is no accident". It's a double entendre meaning either that the definition of safety is the state of not experiencing any accidents, or that the existence of a safe environment is not one that occurs by happenstance. The second of these definitions is the true one. The first one is false. Let me explain.

Low-Probability High-Consequence Risk Analysis

So let's say that you'd like to do a study of road intersections in your town to determine which one is the most dangerous. One way you might go about it is to head down to the local police station to research accident reports. The intersection that had the consistently highest number of accidents is your likely candidate.

But what if there had only been one accident in your town in the previous year? Unlikely as it seems, could you then state with certainty that the intersection at which it occurred is the most dangerous? It's easy to see that sample size is important in determining the usefulness of accident statistics.

When the sample size of accidents approaches zero, as is currently the case in commercial air travel, accident statistics become useless for the purposes of predicting how or where accidents will occur. Other tools are then needed to identify which practices, policies and procedures have inherent risk, the size of that risk, how much risk is acceptable and how to mitigate that which isn't. This field has become to be known as low-probability high consequence (LPHC) risk analysis.

Commercial aviation shares the problem of low probability yet high consequence risk with other large scale applications such as maritime safety, chemical and petroleum refining and nuclear power. The absolute numbers of accidents in all of these fields are very low, but the consequences of any accident can be devastating in terms of life and property. How can operators determine if they are dancing close to the edge of a disaster given the already low numbers of accidents?

The development of LPHC risk analysis was the result of the realization that even in the absence of historical data from which accident trends can be extrapolated, risk must still be identified and mitigated.

How Does It Work?

There have been many books, papers and theses written on this topic, and while a comprehensive survey is beyond the scope of this 'umble blog, several themes keep recurring as one looks around at available sources. One of those themes is that any comprehensive safety effort must involve a sector or industry wide effort to identify potential risks. 

Collaboration is essential and takes the form of industry wide safety partnerships which include both operators and regulators. One of the results of this type of effort in commercial aviation is the Aviation Safety Action Program (ASAP) in which the FAA partners with corporate and labor union representatives to focus on voluntary safety reporting while providing limited immunity from enforcement actions. This program hopes to encourage user participation and the free flow of potentially pertinent safety information.

It's essentially a get out of jail free card if you screw up and then report how it happened. There are time limits for reporting and intentional non-compliance is not covered.

Another arrow in the LPHC quiver is the collection and analysis of data from more common but less serious incidents in order to build an index of relative risk. The idea behind this effort is that any major accident usually involves a chain of events which line up or form a chain leading to a larger failure. Identifying and mitigating risk in each element in a potential chain of events reduces the likelihood that the risk in each of the individual items will be additive.

As an example of this, some years ago my airline used to fly a visual approach to Runway 15 in Burbank. This particular approach had high terrain in the area coupled with no instrument backup and terminated on a short runway with a downhill runway slope giving a false indication of being on the proper glideslope. I really enjoyed flying it because it was a challenge, but an analysis showed that many errors were being made due to the above elements coupled with the lack of experience of some crews who didn't fly it that often. Since then a decision was made to not fly the approach at night. Probably smart.

Data Driven Safety

Data collection capabilities installed on airliners using new generation digital flight data recorders (DFDRs) now allow the mass analysis of trend information on the actual operation of the aircraft. This type of data was never before available with the older analog data recorders. An industry effort called the Flight Data Analysis Program (FDAP) allows the download and use of flight data for safety purposes.

Data driven changes to training programs and even approach procedures identified as problematic have been implemented to mitigate risk which was present but not readily visible without computer analysis.

Again, going back to LA, an analysis of a particular approach into LAX showed that many airplanes were having to make steep approaches in order to land. Most pilots knew that you had to be ready to fly the approach this way, but it was the data analysis from hundreds of flights which provided the impetus to change the approach procedure to one that is more shallow.

Commercial aviation is now one of the safest methods of transportation available rivalling even elevators and orders of magnitude safer than the car you use to drive to the airport. Still, safety experts continue to use advanced data analysis and statistical methods to make it even safer.

Oh, and the most dangerous airport? That's gotta be LaGuardia...but only after you get into a cab at the airport.

Do Pilots Have to Take Routine Tests?

The short answer is yes, of course they do. Anyone venturing into the field of aviation is also volunteering for a career of regular and comprehensive testing. These evaluations take the form of oral tests, written tests, simulator check rides, and line checks in the aircraft from both company designated "check airmen" and FAA inspectors. It's a never ending cavalcade of evaluations from before an aspiring pilot ever steps foot into an airplane all the way to a few months before retirement.

And oddly enough, aviation is one of the few professions that requires such comprehensive testing. Doctors and lawyers, for instance, are mostly good to go once they finish school, though some doctors are now having to test to maintain certification every five or ten years. As a general rule, most professional pilots undergo a formal exam or "checkride" every year, but are always subject to no-notice ride-alongs by evaluators.

Testing from the Start

Each and every certification that a pilot must achieve along the way from neophyte to seasoned captain is accompanied by both written and flying examinations. I took the military route which involved a year of intensive flight instruction to get my wings followed by months of more training in the specific aircraft I was assigned to fly. During USAF undergraduate pilot training (UPT) there were checks for the first solo ride, contact or basic acro flying, instrument flying and finally formation flying in the T-37 primary trainer. It was all then done again in the T-38 supersonic advanced trainer aircraft. 

Besides the designated check rides, each daily ride was graded by the instructor. No pilot was ever more than three failed rides from being booted out of the program. That tended to help student pilots keep focus. Once having graduated, check rides were given for each new certification such as air refueling, night bombing, or in the case of the Navy, carrier qualification. The military has dozens of qualifications depending on the aircraft and mission.

Back to Square One

Back in the civilian world after separating from the service, it mostly all had to be done over again. All of those military ratings count for naught in the civilian world. The FAA does throw a bone to ex-military pilots by granting them a commercial instrument rating for their military training. It's not nothing, but it's not enough to get hired by an airline. For that, a certification known as an Airline Transport Pilot, or ATP rating, is needed. This involved, you guessed it, another checkride with an FAA examiner in an airplane you had to rent.

My future employer at the time also required what is known as a "type" rating, which is a checkout to fly a particular model airplane, in this case a 737. The FAA at that time did not allow checkrides to be flown in the simulator so I had to rent an actual 737 to fly my checkride. It was only $50....a minute! To top it off, the airport we took off from, Seatac, went below minimums while we were doing touch and gos elsewhere so we had to hold for nearly an hour before getting back in. It was spendy, but I got my type rating.

Dial-a-Disaster

Most all airline training today is done in high fidelity three axis flight simulators. These machines, which cost millions of dollars, can faithfully reproduce nearly all flight regimes with very realistic computer generated visuals. The computer can generate any kind of weather that might be encountered to include thunderstorms with lightning and can even insert wayward air traffic that must be avoided.

The simulators are so good that the first time most airline pilots fly a new model plane is on a revenue flight with passengers. The FAA certifies each simulator to make sure they reproduce the airplane's characteristics accurately. The least favorite part about flying these machines though, is the emergency procedure.

In day to day flying, almost nothing ever goes wrong. In fact statistically, an airline pilot today is very unlikely to ever experience an engine failure or other major system failure. But that doesn't mean that these things don't happen, and the simulator is how pilots are kept prepared for these very unlikely events.

Engine failures, fires, hydraulic leaks, landing gear failures, loss of pressurization and flight control malfunctions are just some of the myriad emergencies which can be summoned by the simulator operator. In the military we called it "dial a disaster", and two hours of emergency procedures in "the box" with your employment on the line can really scramble your eggs. Crashing the sim, otherwise known as the red screen of death means that the ride is over figuratively and literally.

What if You Bust?

Failing or "busting" a checkride is a rare event, but it does occasionally happen. Sometimes people are just having a bad day, and other times they come to training unprepared. Checkrides always include an oral exam on policies, procedures and systems, and a knowledge bust can mean the ride is over before it starts. Crashing the sim is rarely the cause of a failure. Poor decision making such as finding yourself in bad weather with low fuel is a more likely cause of an unsatisfactory outcome. Sometimes a diversion is called for.

As airplanes do a much better job of flying themselves due to automation, the emphasis has shifted away from strictly mechanical proficiency towards decision making and teamwork. Crews are expected to work together to solve problems. A recently adopted paradigm for most airline training does not allow for individual failure, but rather the crew will either pass or fail together, just as in the airplane.

If a crew fails a ride, they will be given some remedial training and then take the ride over again. There may or may not be some loss of income during this process as they won't be allowed to fly until passing the retake. In very rare cases, a pilot ends up having more difficulty or has a weakness uncovered. This almost never happens, but the process can lead to being let go for pilots who can't pull themselves together in the sim.

Rest Assured

Airline passengers who have the misfortune of finding themselves on board an airliner with a mechanical difficulty should rest easy in the knowledge that the pilots flying their plane have most likely seen and successfully dealt with the problem many times before it actually happened.

A General War Story

First I must offer apologies, dear readers, as I was slammed the past three or so weeks and have not been keeping up my side of the blogging bargain. But I am now back: tanned, rested and ready to resume providing content for all your aviation blogging needs.

My absence consisted of preparing for my annual check ride, several trips out to Cali for a concert and to assist a charitable work group associated with our old church, and several trips to Colorado Springs. These last trips were for both wifey's college reunion, and to visit the whelps, both of whom are currently matriculated at the Air Force Academy, affectionately known and hereafter referred to as the Zoo.

Why is the school known as the Zoo? Well, a central area known as the terrazzo or "T-zo" where the cadet wing forms up can be viewed by visitors from an elevated area adjacent to the chapel. A civilian school might call this area a "quad". Lore has it that the cadets felt as if they were animals in a zoo while being looked down upon over the fence. Graduates of the school are known as "Zoomies", an appellation which dovetails nicely with a lyric from the Air Force Song: "Here they come, zooming to meet our thunder..."

I always enjoy my trips back to the Zoo. I didn't go there myself, but as a spouse and parent of three Zoomies, there have been quite a few trips up to "the Hill" over the years. And as it turns out, I know nearly as many classmates at my wife's reunions as she does. You see, we met as instructor pilots at Williams AFB in the mid-80s. 

The practice back then was to send a huge chunk of newly graduated 2nd lieutenants from the Zoo to the same pilot training base. A good selection of those pilots would, upon graduation from pilot training, be returned as instructors themselves. Wifey was among this group along with many of her classmates from the Zoo.

The Reunion

So we had our cadets with us talking to old friends with whom we had instructed aspiring pilot candidates in the venerable T-37. My kid's eyes bulged as they realized that a few of our old pals had stayed in and had made general rank. In fact, at 30 years, only the Generals were left on active duty as all others had to retire by then per regulation.

Now as I said, I didn't go to the Zoo but am always prepared to handle the inevitable questions about what inferior school I did attend when at these events. My usual schtick is to state that no, I didn't go to the Academy, but rather to college. And then since my commissioning source was OTS which means I was a  "90 day wonder", I'll say that it only took me only 90 days to learn what it took the Zoomies four years.

This had one of the guys visibly upset but it's only a joke as I have the utmost respect for anyone that graduated from the Academy. I doubt that I would have made it through. 

Ok, back to the story.

The Bachelor Party

I was older and had just returned from an overseas assignment, but was thrown in with this group of fresh faced pilots as their supervisor. For many of them, I was their first boss. So as a captain at age 26, I was more or less in loco parentis for a dozen or so 23 year old lieutenants. You might imagine that this situation had the potential for some less than optimal outcomes, at least from a military decorum and order point of view, and of course you'd be correct.

One result of my engagement to my future wife was that a group of guys in my flight got together and threw me a bachelor party which involved an RV, and a gentleman's club. And that's all I'm going to say about that. But...a seed was planted. (Metaphorically speaking of course!)

It was just a short while later after I'd been given the job of Flight Commander that one of my lieutenants announced that he was engaged to be married. My thought was that since my party was such a success, why not a reprise for one of my guys. So that's what we did. Only we were going to take it up a notch...or two.

I planned the entire event. We rented an RV, put a keg of beer in the shower and drafted a guy in the flight who didn't drink to drive the rig. On the appointed day we collected about a dozen guys and the bachelor, whom I'll just refer to as 'R'. After collecting our merry band of yahoos, we started off for the west side of town to the storied Great Alaskan Bush Company or ABC. 

Following lots of drinking, puerile hi-jinks and general mayhem, we decided to relocate the party back to one of the guys' houses. In an effort to be the consummate bachelor party host and attentive boss, I had also taken care to arrange for some additional entertainment to be provided by a young lady practiced in the art of exotic dance. We had a schedule to keep.

It was on the drive back that events accelerated. "R" being somewhat small in stature and having been fed ample amounts of liquor, started to wobble a bit. Meanwhile, another associate, we'll call him 'J' , had followed us in his newish BMW. It seemed a bit odd to me that he didn't want to ride in the RV, but looking back on it after all these years it made perfect sense. Plausible deniability has its uses.

Well, at some point, one of the more adventurous RV riders, we'll call him 'C', thought it might be a good idea to exit the RV and to climb up on the roof for some "urban surfing" while cruising down the freeway. Even in our inebriated state, the rest of us knew that this was an extremely bad idea and he was pulled back inside. Meanwhile, J pulled up alongside the ship of fools only to have his Beemer splashed with the contents of R's belly as he stuck his head out the RV and hurled.

This development had the ship's complement in stitches, but the best was yet to come. After arrival back at the house, the 'entertainment' arrived and started her show. R had been stripped to his skivvies and was getting a lapdance when who should decide to crash the party? You guessed it, R's fiance and a few friends.

They marched in, surveyed the scene, and then without a word turned and marched out. All I could think was that R would thank us in the morning. There are plenty more girls out there after all. I spent the next day hosing down and deodorizing the RV. Let's hear it for PineSol!

Epilogue

Well, no one knew it, but we had not one, but two future Air Force Generals in our soiree that night. R went on to fly a fighter and retired as a General. And he's still married to the same girl though she never spoke to me again. J, the guy in the soiled BMW, also went on to fly fighters and make General though he'll no doubt deny any and all association with this event.

C, the urban surfer, now flies for American Airlines.

The Las Vegas Miracle

The damage to the British Airways 777 was extensive.

Usually after any kind of incident on an airliner, reporters interview distraught passengers who are only all too willing to relay how hellish things were on the doomed jet. These sorts of interviews make for great television because our brains instinctively fill in all the missing bits of drama that we know must have occurred. After all, we've seen this script played out for years in aviation disaster movies.

The engine failure, aborted takeoff, and fire which occurred on a British Airways 777 in Las Vegas last week, however, was the real deal. Every pilot's nightmare. If Sully's river landing was the miracle on the Hudson, this should be called the Vegas miracle, because those people may not know how truly close they came to being incinerated on that airplane. Of the 157 passengers and 13 crew aboard, there were only 13 minor injuries.

After being incredibly unlucky enough to experience an uncontained engine failure, the odds of which happening are vanishingly small, everyone on the airplane got lucky in that it happened early in the takeoff and that the fire department was very quick to respond. Reports have it that the flames were extinguished a mere four minutes after the aircraft first reported trouble.

Kudos of course have to be given to both the pilots and back end crews who no doubt had a large part in determining the positive outcome of this potential disaster. Much opprobrium has been ladled out, however, to some of the passengers who grabbed their luggage before exiting the escape slides. I'm willing to give a small pass to those folks who might have grabbed their under seat items such as purses, but not so much to those who took time to open the overhead bins to grab rollaboards. Their actions might well have prevented someone behind them from getting out at all.

Catastrophic Failure

The NTSB is reporting that there were several breaches of the engine casing and that several parts of the high pressure compressor spool were found on the runway. What this means is that the engine threw itself apart, most likely due to some sort of flaw or failure in a compressor blade or the spool that holds them.

This failure will likely be a high interest item as failures of this sort are not supposed to happen. These engines are constructed of high strength steel and titanium. Other than spinning on their bearings, the compressor parts are essentially non-moving parts unlike, say, the pistons in your car. Jet turbines are the most reliable of all engine designs, and I wouldn't be surprised if this failure is tied back to an undetected crack or casting flaw.

When you look into the mouth of a jet engine, you are seeing the fan blades. Behind the fan blades are multiple sets of hundreds of more blades, each subsequent set together making up the compressor section. The compressor feeds very high temperature and pressure air into the combustion chamber where it is combined with fuel and ignites. Hot exhaust gases then travel over multiple sets of turbine blades which are connected to a shaft which turns the compressor and fan. It is the rotation of the fan which produces most of the thrust.

That's a simple explanation of what happens normally. Engines are designed so that should a failure of any component in the core of the engine fail, the casing of the engine is designed to contain the flying parts. In fact, during engine certification, explosives are attached to fan blades and detonated while running at full power to demonstrate this capability.

Because there were breaches of the engine casing, this failure is considered "uncontained". The dangers of uncontained failures are manifest including parts being flung into the cabin, other engines, or the wing where the fuel is stored. In 1996 several passengers were killed by parts thrown from a catastrophic engine failure on an MD-88 during takeoff. That aircraft has the engines attached to the fuselage.

The most famous uncontained engine failure was probably that of United 232, a DC-10 bound from Denver to Chicago in July of 1989. While at cruise, the tail mounted engine suffered a failure in the number one fan spool due to metallurgical fatigue. Thrown parts severed the lines in all three of the aircraft's hydraulic systems rendering all of the jet's flight controls useless. Manipulation of the throttles on the two remaining engines allowed the pilots to make a controlled crash at Sioux City which minimized casualties.

Should We Evacuate?

Reports from the incident indicate that the aircraft had barely rolled 1000ft before the engine failed and they rejected their takeoff. This means that the abort was a relatively slow speed one. Having the engine fail so early in the takeoff was fortuitous. Had it happened at a speed closer to V1 or decision speed, it would have been more difficult to stop the airplane and they would not have had the use of the reverser on the failed engine. Having the engine fail right after getting airborne might have been the worst case scenario.

Rejecting a takeoff, the terminology used when stopping before being committed to flying, is not in itself a particularly difficult maneuver, and is practiced routinely in the simulator by all airline pilots. Automatic brake systems help by applying full braking when the throttles are closed. Likewise, having an engine fail directly after lifting off, known affectionately by pilots as a "V1 cut", is also practiced often in the simulator.

Once stopped, one of the more vexing decisions pilots can face is determining whether or not to evacuate their aircraft. It really isn't as clear cut as it may seem. Calling for an evacuation will nearly always result in at least some minor injuries while the potential always exists for more serious ones. Passengers, like cats, will tend to run in all directions and are at danger of being hit by responding emergency vehicles during a full blown evacuation.

There are many situations where keeping passengers on the aircraft might be the safest course of action. After any rejected takeoff, and especially after a high speed one, there may be some smoke from the tires and brakes. This doesn't mean that a fire is imminent. If emergency response vehicles are already at the aircraft to monitor the situation, an evacuation may not be the wisest choice.

Flight attendants, who will have the best information concerning smoke and fire in the cabin, are empowered to initiate an evacuation on their own. That may be what happened here. Passengers interviewed afterwards reported a loud bang followed by the aircraft slowing and smoke entering the cabin. Whoever made the call, it appeared to be well executed save for those carrying luggage.

The most dangerous type of evacuation is the self or passenger initiated one as happened last week on an Allegiant flight after someone thought they saw a fuel spill. The danger here is the contagion of panic to the rest of the airplane. This scenario has a great likelihood for injuries.

Will it Fly Again?

I'd bet against it. Heat strong enough to melt plexiglass windows and burn through aluminum skin may have compromised the structure of the aircraft to where repair is not cost effective. This aircraft was delivered in 1999 and while not ready for retirement at 16 years of age, was not new.

There were also some breathless reports by the crack aviation teams on network news that the fire suppression system was used but did not work. Those systems consist of a bottle or two of Halon and are designed to extinguish a flame in the accessory drive compartment. As the Halon works by denying oxygen to fire in the enclosed spaces of the engine, it clearly wasn't designed to put out a fuel fed fire engulfing the engine. Fuel lines may have been severed by the engine failure as well.

Having an engine come apart in as dramatic a fashion as this is a truly rare event. Thankfully, professional responses by the crew and first responders kept it from becoming a real disaster.

Have you ever experienced a rejected takeoff on an airliner? How about an evacuation? What were your thoughts during the event?

A Top Secret Story

THIS IS A COVER SHEET
FOR CLASSIFIED INFORMATION

ALL INDIVIDUALS HANDLING THIS INFORMATION ARE REQUIRED TO PROTECT IT FROM UNAUTHORIZED DISCLOSURE IN THE INTEREST OF THE NATIONAL SECURITY OF THE UNITED STATES. 

HANDLING, STORAGE, REPRODUCTION AND DISPOSITION OF THE ATTACHED DOCUMENT WILL BE IN ACCORDANCE WITH APPLICABLE EXECUTIVE ORDER(S), STATUTE(S) AND AGENCY IMPLEMENTING REGULATIONS.

I am a Secret Squirrel. I have, or rather had, a top secret clearance as it most certainly expired years ago. My clearance was known as a TS/BI/SCI or Top Secret-Background Investigation-Sensitive Compartmented Information. Having an expired clearance doesn't mean, though, that I am free to tell the secrets entrusted to me. The statute of limitations on classified never runs out even though what I know is long since obsolete.

Getting my TS clearance involved lengthy interviews and an exhaustive questionnaire administered by a very nice, but doggedly determined lady from the Justice Department. I don't remember her name, but it was probably something like Minerva, or Millicent.

Have I ever travelled to a communist country? Do I know anyone who has? Do I have any relatives who have ever advocated the violent overthrow of the US government? Do I have any large debts? Is there anything in my past which may be used to coerce me? And on and on.

The last question, asked as the interview was ending, was probably the one that tripped up the most people: Could you give us the names of two or three people who know you well that we might contact? Of course you'd give the names of friends who would only say glowingly positive things about your character and trustworthiness.

She would then contact those people and ask them if there were two or three other people who might know you. As the circle expanded, a real picture of character would emerge. Quite effective, I imagine.

Well she must've been off her game and not gotten around to certain ex-girlfriends or people I had otherwise slighted, and I was issued my top secret clearance. It was a good thing as well because not having a security clearance for a job that needed one meant you would soon be looking for a new job.

My job at the time was as a pilot flying the KC-135 Stratotanker for the Air Force's Strategic Air Command or SAC. SAC no longer exists, but its primary mission was nuclear war. Ironically, the SAC motto was "Peace is Our Profession" to which we would always add "War is Just a Hobby". We were the guys (and gals) who were going to go to nuclear war "toe to toe with the Russkies" as Slim Pickens so eloquently put it in Dr. Strangelove.

Classified is Serious Business

One thing you quickly realized when offered entrance into the world of secrets is that this was a place untouched by any sense of levity or humor. Getting access to classified documents involved briefings, warnings and the signing of multiple statements continuously reminding of you of your responsibilities when handling classified material including the penalties that awaited should you screw it up. 

They weren't joking. Careers have been wrecked for the inadvertent mishandling of this stuff. (And may yet still be!)

The classified study area itself was in an actual room sized vault. Nothing went in or out. We had no cell phones back then but all the handsets had push to talk mic buttons so conversations couldn't be overheard. Any documents left on a table top had to have a cover sheet to prevent unauthorized viewing. 

And the stuff was boring. Oh my god was that stuff ever boring. Most of it involved details concerning codes and communications. There were flowcharts, and rules, and exceptions to those rules and exceptions to the exceptions. It was stuff we might need to get encrypted messages and what those messages meant. No "deep state" kind of stuff at all. Very disappointing.

And our "comm" class was right after lunch. Staying awake took Herculean efforts. I came to the conclusion that this was secretly some type of Chinese torture resistance training in case we were captured. 

But that changed one day. Most of the material we had been dealing with to that point had been classified "secret". The government has three levels of classification which determine the security measures and procedures used to protect that material. They are "confidential", "secret" and "top secret". Each level has its own increasingly complicated protocols and increasingly severe penalties for breach.

Somewhere it had been determined that we now had the need to be given access to some "top secret" information. Aha! At last I was to be given clearance into the inner sanctum. Now I was to find out if Herbert Hoover really did cross dress, who had really killed Kennedy and maybe even where Jimmy Hoffa was buried.

The Inner Sanctum

On the appointed day we were led into the vault and from an armored combination locked filing cabinet came a thick metal bound and locked notebook. All Maxwell Smart-y. Sadly, Agent 99 was nowhere in sight but it was thrilling nonetheless. Only after signing more documents giving up claim on our souls and firstborns was the notebook opened.

Then came the Geico moment. You know the ad where someone says "did you know that...." and the other person answers "Sure, everybody knows that". Well I looked at this stuff and immediately thought, is that it? Everyone knows that! Where's the REAL secret stuff?!?

Alas, there were to be no great revelations about the inner workings of the US government, the Air Force or even the Strategic Air Command for that matter. What I saw in the vault that day was public, obvious, and common knowledge. Sure it was stuff we "needed" to know but it was just common knowledge to anyone who had sat down and thought about it for a moment. 

My guess is that it was actually the imprimatur of the US government on the information that made it top secret. Essentially an official confirmation of widely held but otherwise unconfirmable knowledge.

Still, if I told you what great secret it was that was revealed that day, I could still go to jail for a long time. Trust me, you wouldn't be impressed.

Or as one smart-alec intel briefer would always end his classified briefings..."for further details, please consult the USA Today".

THIS BRIEFING HAS BEEN CLASSIFIED TOP SECRET/NOFORN. DISCLOSURE TO UNAUTHORIZED PERSONS IS PUNISHABLE UNDER THE UCMJ

So what do you think? Does our government keep too many secrets?

When Flying, Be Ready to Expect the Unexpected

I used a somewhat unusual construction in the title of this post to illustrate a point about the attitude pilots need to take while on the job. What I mean by this is that pilots are not expected to be sitting on the edge of their chairs for every second of every day waiting for something to go wrong. That would be simply exhausting. Rather, pilots should be ready to consider that when things seem amiss, the airplane may be keeping a secret.

Let me give you an example which recently happened to me er, my buddy Joe, as he tells it:

About an hour and a half into a two hour flight, one of our flight attendants asked to come up front to discuss something. This piqued our interest because in the years since 9/11, the procedures used to visit the cockpit have become so onerous that almost nobody does so anymore. It used to be the opposite but that's a topic for another day.

The flight attendant came up and said that a passenger had spotted and was concerned about a liquid he thought he saw on the top of the wing. She then mentioned that yes, in the reflection of the sun off the paint, there did seem to be an area that might've been wet, but it was hard to tell.

We immediately begin to think that we had another nervous flyer ready to believe that death was imminent due to the wing falling off or some other disaster. This happens enough that most pilots have at some point had to deal with excitable passengers claiming to have seen something. This, I'll admit, was my first thought. But I'll also admit that I did take a look at both the fuel and hydraulic quantity gauges. All was in order, so if there was any leak, it was a small one.

There's an old joke about the F-4 fighter. A pilot was asked what he'd do if he found a leaking fluid on his walk-around inspection. He answers "nothing". When asked why, he explains that if it isn't leaking, then that means there's nothing onboard to leak. The point is that all airplanes are plumbing nightmares and to some extent they all leak.

A trip into any wheel well on any airliner will display a dirty and greasy area. It's just like looking under the hood of your car. That grime you see comes from some fluid whether it's oil, coolant, steering or brake fluid that oozed out from somewhere. Airplanes are no different. That's not to say that leaks are acceptable, they aren't. But usually, leaks are from loose fittings that need tightening and present no real problem. Looking for leaks is one of the primary reasons for doing walk-around inspections in the first place.

Big leaks are of course bad because not only will the leaking fluid not be available to do it's intended job, it might cause trouble as it goes some place it is not supposed to go. Fuel is the most obvious example of this, but hydraulic fluid can cause trouble by going where it shouldn't as well. Skydrol, the hydraulic fluid used by most airlines causes burns to unprotected skin, while the stuff the military used when I was there was explosive when it became aerosolized from a high pressure leak.

Yea, you'd think the military would move away from explosive hydraulic fluids being that their airplanes are targets and all, but whatever.

Anyway, I was simultaneously thinking about what fluid might be on top of my wing while also trying to think of some plausible explanation for our flight attendant to tell our worried passenger. If it had been winter, the best explanation would have been that it was deicing fluid. Deicing fluid is designed to stick to the wing surface and gives a wet appearance. As it was summer, all I could think of was that some fitting in the actuators for the leading edge flaps may have been leaking with the fluid running back across the top of the wing.

We ended up assuming that it was most likely that if anything. At this point I kept an eye on the gauges and called ahead to have a mechanic meet the airplane. Was I concerned about this? Minimally, and here's why. First, all my pressures and quantities were perfectly normal. Secondly, should the system have failed for whatever reason, there were still multiple ways to extend the leading edge flaps or even to land without them.

Lastly of course was the possibility that our worried passenger saw nothing but a reflection. Trust me, I've heard worse.

After landing, we had a mechanic take a look. As it turned out, the leak wasn't hydraulic fluid as we'd suspected but was in fact fuel. The fuel line coming out of the wing snakes through the top of the engine strut down to the fuel control unit. A fitting in this line was damp.

Was this a big deal? Not really. That area, as do all areas with fluid lines, has a drain which collects any leaking fluids and vents them overboard safely. A tiny bit had made its way out from under the panel onto the top of the wing which our eagle eyed customer saw. Still, in over 25 years I'd never seen nor heard of a fuel leak on the top of the wing. Most engine fuel leaks drain out of the bottom of the engine cowling.

The airplane was taken out of service due to replacement O-rings not being available at that station, and we got to deadhead to our final destination for the overnight. Just another day on the job.

Would I have done anything differently? No. The actions we took were appropriate, but I was reminded that especially in aviation as in many things, the most obvious conclusion may not always be the correct one. Things are not always what they seem.