Life worth living again!?
Distraught Father Assassinates Controller (Lake Constance, 2002)
Only one pilot obeyed the collision avoidance system
Postscript
Kaloev, the father who killed Nielsen, the controller, was released after two years for good conduct and on mental grounds, to return home and treated as a hero for meting out justice that supposedly had not been done. Indeed, in 2016, he was awarded the highest regional medal by the local Ossetian government, the medal “To the Glory of Ossetia.”
We must remember many children in that community lost their lives on that holiday trip.
Kaloev was bitter because Nielsen whom he assumed responsible was allowed to return to work with no criminal charges at all, though we stand by our account here showing the controller did his best in exceptionally difficult circumstances. In fact, in a way he caused the disaster in trying to prevent it, and the problem was the pilot of one aircraft obeying him and not the TCAS. Had Nielsen not tried, there would as we have said been no collision.
Perhaps there is some consolation for Kaloev, in that now, aged 62 he has married a woman 22 years younger who in late December 2018 gave birth to a twin boy and girl, with him saying,
“Life has turned out so that I have children once more. And I have meaning in my life again. Doctors say that everything is fine with the babies… They were born healthy, everything is fine.”
A systems and managerial tragedy that marked a community; but almost unbelievably life goes on.
A 2017 movie, Aftermath, with Arnold Schwarzenegger is very loosely based on Kaloev.
See Extract
If AF447 had had 737 MAX’s MCAS
Recently there was a fascinating piece by Bjorn Fehrm on LEEHAM News and Comment explaining why Boeing had installed an automatic trim system (MCAS) on the 737 MAX to intervene aggressively should the aircraft be in danger of stalling even with the autopilot disconnected.
The reason for this was that though the 737 as originally designed was naturally stable it sat very low on the ground to facilitate loading at airports with then limited facilities. The bottom of the engine nacelles had to flattened to allow this. However, in order to install the much more efficient larger diameter engines for the 737 MAX, they had to be moved forward. As explained by Fehrm, this was fine at normal angles of attack, but should the angle of attack become too steep the nacelles themselves would produce lift far forward of the centre of gravity, which might result in a disastrous stall with the nose being pushed up further and further. To preclude this, Boeing installed MCAS, the Maneuvering Characteristics Automation System to force the nose down.
Unfortunately, in the Lion Air crash, the pilots did not know that unlike in the previous version of the 737 the forced down trim could not be removed by pulling back on the control yoke–the STAB TRIM CUTOUT switches have to be set to CUTOUT, which is what the pilots did when the same thing happened on an earlier flight of that aircraft.
Interestingly, in another post we cited the case of the XL Airways/Air New Zealand acceptance test flight, that crashed because the pilot could not overcome the upward maximum pitch trim and upward leverage of the low-slung engines causing the aircraft to stall will insufficient height to recover. In that case, two-out-of-three of the angle of attack sensors had frozen at the same angle and the computer dismissed the odd man out. In the Lion Air crash it seems the MCAS was triggered by just one angle of attack sensor showing too steep an angle, which was quite reasonable because the high pitch indicated by one might have been genuine and it was a precautionary measure, and better safe than sorry. If the pilot had been aware of what he should do, or thought of it like the pilot on a previous flight on that aircraft, there was no reason for it to crash.
It is a pity Air France Flight AF447 that crashed into the South Atlantic did not have something like MCAS both stopping the pilot stalling the Airbus A330, and preventing him from impeding recovery by pulling back continually on his sidestick when on full manual control with no protections other than yaw-damping.
Comparing Lion Air 737 MAX Crash in Indonesia and Fatal XL Airways/Air NZ Acceptance Flight #LionAircrash
Like the Lion Air 737 MAX crash in Indonesia, the crash of an A320 acceptance test flight in France in 2008 involved the extreme trim of the horizontal stabilizer that the pilots could not overcome. See Chapter 18: Not All Pilots can carry out Test Flights.
The A320 pilots attempted to check the automatic stall protection system at too low an altitude with little height to recover should something go wrong.
Unfortunately, the angle of attack sensors due to ingress of water used to clean the fuselage had frozen in the level-flight position making the computer believe the aircraft was not going to stall.
When it eventually did stall, the extreme upward trim of of the horizontal stabilizer made it impossible to push the nose down to regain speed, for with the low-slung engines at full thrust also pushing the nose up, the elevators could not overcome the two. The stalled aircraft (not filled with fare-paying passengers) plunged into the sea.
In the Lion Air case, the downward trim came about because a new safety system (which no pilots had been told about) pushed the nose down because of a faulty angle of attack sensor indicated that the aircraft was was nose-up and in danger of stalling.
WHAT THE TWO ACCIDENTS HAVE IN COMMON is failure of the pilots to deal with the extreme trim of the horizontal stabilizer and therefore being unable to recover.
In the A320 case, there was a warning to USE MANUAL TRIM, which the pilots either did not notice or ignored–they anyway had little time.
In the 737 case, it was not so simple as the computer overrode the trim system even in manual, and the trim had to be completely disabled. The pilots did not even know that they should do that, though on when problems had occurred with that very aircraft on a previous flight the pilots had managed to do so and recovered. Unfortunately, the the pilots of the crashed flight were not told about that how those pilots had disabled the trim.
We highly recommend the reader click HERE to see the fascinating article by Bjorn Fehrm on Leeham News explaining why Boeing introduced their new anti-stall system on the 737 MAX to cope with the forward positioning of the larger engine nacelles covering the higher bypass LEAP-1B engines–the 737 conceived many years ago was designed to be very low on the ground, hence the odd (not round) shaped nacelles.
For reference
Boeing’s just issued warning to users of the 737 MAX that was not in any of the manuals.
“This bulletin directs flight crews to existing procedures to address this condition. In the event of erroneous Angle of Attack (AOA) data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.
Additionally, pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:
– Continuous or intermittent stick shaker on the affected side only.
– Minimum speed bar (red and black) on the affected side only.
– Increasing nose down control forces.
– Inability to engage autopilot.
– Automatic disengagement of autopilot.
– IAS DISAGREE alert.
– ALT DISAGREE alert.
– AOA DISAGREE alert (if the AOA indicator option is installed)
– FEEL DIFF PRESS light.In the event an uncommanded nose down stabilizer trim is experienced on the 737 – 8 / – 9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.”
United Airlines “Fuel Emergency” 787 Landing at Sydney
They extract below from our piece on the Avianca incident shows what can happen, though in that the copilot did not declare it was an absolute emergency as it was their last chance to land.
Extract:
Avianca 52 Copilot Failed to Say “Emergency” (New York, 1990)
The survivors and relatives of those who died when Avianca Flight 52 ran out of fuel while attempting to land at New York’s JFK airport were incensed when reminded the official inquiry attributed the accident almost entirely to the first officer’s failure to use the term “emergency” in his radio transmissions to air traffic control.
Avianca Flight 52, January 25, 1990
The lights in the passenger cabin of the Colombian Avianca Boeing 707 flickered as the fuel supply to the engines became erratic. With so little fuel left, no measure could save them other than coming down on a runway or flat, open space. However, JFK airport was fifteen miles away, and the hilly ground of the affluent residential district of Cove Neck, on Long Island, lay ahead.
A few seconds later the engines fell silent, leaving only the rustle of the wind against the fuselage, soon to be drowned out by the screams and exclamations of the passengers realizing they might be facing their maker.
How, in what one would imagine to be one of the most sophisticated air traffic control (ATC) zones in the world, could the pilots and passengers of Avianca Flight 52 find themselves in such a predicament? It was due to what, with hindsight, was a whole series of missed opportunities to avoid disaster.
The first of these was not diverting to their alternate, Boston, when, on approaching the New York control zone an hour and a half earlier, controllers informed them their wait in the holding pattern would be at least forty-five minutes. The pilots possibly thought the controller was being careful and that the wait would not be very much longer. In fact, they had to hold for seventy-seven minutes.
Then, as the aircraft was subsequently handed over from one controller to another, the first officer, who was handling radio communications, used phrases such as “We’re running out of fuel.”
He evidently thought this clearly indicated their fuel predicament, but he failed to convey the true situation to the controllers, who had perhaps fifty aircraft in the sky, all in a sense running out of fuel and all wanting priority. If they started to let aircraft that had not declared an emergency jump the queue, a traffic jam would develop over the airport, perhaps compromising the safety of other aircraft also low on fuel.
Another factor explaining the controllers’ apparent lack of probing into Avianca 52’s status was that, with the aircraft being handed over successively from controller to controller, none had the time to build up a detailed picture. Aircraft have to be pigeonholed in the controller’s mind, and this is particularly so at busy times; for them it is either a normal flight or declared emergency.
When after seventy-seven minutes Flight 52 was allowed to exit the holding pattern (after the crew were asked how much longer they could hold), it was passed on to the approach controller, who, unaware of their predicament, greeted them as follows:
21:03:11 Approach:
Avianca zero five two heavy, New York Approach, good evening. Fly heading zero six zero.
After acknowledging this, the Avianca flight crew, consisting of the captain, first officer, and flight engineer, agreed on the need, when less than a thousand pounds of fuel remains in any tank, to avoid doing anything, such as raise the nose too much or accelerate violently, that might cause it to slosh to one side, leaving the outlet uncovered.
The tower controller, who was about to hand over to a colleague at the end of his shift, simply handed them over to the approach controller.
The captain told the first officer to tell approach they didn’t have fuel, but the first officer, after automatically acknowledging the order to climb and maintain three thousand feet, reverted to saying, “We are running out of fuel, sir.” The controller replied “Okay” and gave them a new heading.
Again, the captain asked the first officer if he had advised ATC they didn’t have fuel. He confirmed that he had, adding optimistically, “And he’s going to get us back.”
The approach controller then gave instructions to two other aircraft. After giving Avianca 52 a new heading, he showed his concern as one can see from the following exchange.
21:26:35 Approach control:
Avianca zero five two heavy, ah, I’m going to bring you fifteen miles northeast and then bring you back onto the approach. Is that fine with you and your fuel?
21:26:43 First officer:
I guess so. Tha [sic] you very much.
The captain asked what the controller said, but before the first officer could tell him, the flight engineer bizarrely said,
“The guy is angry.”
End of extract.
Click HERE for Table of Contents
AF447 Documentary on More4 TV
The More4 TV documentary was good as far as it went but did not include contributory factors such as the captain only having had an hour’s sleep the night before, the poor relationship between the two copilots, and the fact that the captain was probably not in his bunk.
These and others are detailed in our account.
Click HERE for Table of Contents
Why hardly any hosepipe bans in UK?
A ban would reduce the UK water companies income. They seem to prefer to hold off imposing a ban at the risk of having to impose a much stricter one later, or even having to ration supplies.
It was a good call in 2018 for just when an increasing number looked inevitable, the rain came.
Apart from the risk of having impose stricter bans, or even ration supplies, later, this seems fair in that really poor people would not use much more water while the very rich with big gardens and lawns (and water meters?) would pay more, and be able to do so.
Of course this depends on people having meters.
XL Airways-Air New Zealand Acceptance Flight
In updating Air Crashes and Miracle Landings we added this disastrous test flight because it had so many lessons for pilots and programmers of fly-by-wire systems. The lessons learned most likely saved lives on revenue flights. Extract:
Not All Pilots Can Conduct Air Tests (Off French Med. Coast, 2008)
What was expected to be a mere formality turned to disaster
This highlights the danger of pilots who are not test pilots carrying out tests without defining what constitutes a pass or fail, and the problems a pilot can face on taking over manual control from the computer.
XL Airways Flight 888T, November 27, 2008
Faced with a refusal by the air traffic controller at Bordeaux on the French Atlantic coast to allow them to engage in test flights in general air traffic, the pilots of the Airbus A320 had cut short their “acceptance flight” and turned back to Perpignan Airport on the Mediterranean. In just under an hour—half the time intended—they had surreptitiously managed to fit all but one of the tests into their flight plan without air traffic control objecting.
Extract continued:
….
The elevators (operated via the sidestick) could not overcome the combined effect of the pitch trim set at its maximum nose-up and the go‑around thrust of engines set low down under the wings also levering the nose up.At 15:45:42, after rising enough for the stall warning to stop momentarily, the airspeed had fallen to 40 knots. Two seconds later the maximum values recorded were a pitch of +57 degrees (i.e. exceedingly nose up), and an altitude of 3,788 feet, at which point the aircraft lurched over and careered down into the sea. All on board, including three Air New Zealand engineers and a New Zealand Civil Aviation Authority official in the passenger cabin, were killed.
Only sixty-two seconds had elapsed between the time the stall warning first triggered and the moment the recordings stopped!
The Investigation
This crash was very troubling because a month earlier another Airbus, a Qantas A330, had behaved very bizarrely (see Chapter 17) off the coast of Australia, albeit with the pilot managing to recover. After first suspecting the Air Data Inertial Reference Units as the Qantas A330 investigators had done, the French investigators were able to show the cause was the freezing of the water in the mechanisms of the two angle of attack sensors on the left of the fuselage. A third sensor still working was ignored by the system on the “odd man out” principle.
END OF EXTRACT
Click link to —> Table of Contents
BA 2276 777 Uncontained Engine Failure and fire at Las Vegas
<— Click image to see contents of book.
The things that come to mind concerning the British Airways 777 that caught fire as it was about to take off from Las Vegas for London on September 8, 2015 are the passengers standing nearby, with many carrying large items of luggage, and the fact that the UK newspapers referred to the captain, who was possibly making his last flight before duly retiring, as a hero. In fact, the just published final NTSB report shows that it was not that simple.
Firstly, it again seems unbelievable that a report into an accident with the aircraft available for study and any debris retrieved from the runway should take so long–until one remembers the same was true for the one into the precursor to the Southwest
A key point was that the aircraft was only half full and therefore passengers passengers bring their luggage did much affect the fortunate outcome.
The NTSB report can be found by clicking HERE
Passengers with their luggage.
According to the NTSB report, the captain, who was the pilot flying PF, quickly rejected the takeoff at about 77 knots, well before V1, the takeoff decision speed was 149 knots for the flight. The start of the rejected takeoff maneuver occurred 2 seconds after the “bang” sound, and the airplane came to a stop 13 seconds after the rejected takeoff maneuver began. Thus, the captain made a timely decision to reject the takeoff and performed the maneuver in accordance with company training and procedures.
“While the airplane was decelerating to a stop, the fire warning bell sounded. When the airplane came to stop, the captain called for the engine fire checklist. The third item on the checklist was to move the fuel control switch on the affected side (in this case, the left side) to the cutoff position, which shuts down the respective engine. The spar valve terminates fuel flow to an engine after it is shut down. Flight data recorder (FDR) data showed that about 28 seconds elapsed between the start of the engine failure and the time of the spar valve closure, and Boeing estimated that about 97 gallons of fuel had spilled onto the runway during this time. FDR data also showed that 22 seconds elapsed between the time that the captain initially called for the engine fire checklist and the time of the spar valve closure. (Thirteen seconds had elapsed between the time that the captain repeated his call for the engine fire checklist and the time of the spar valve closure.) If the left engine had been shut down sooner, there would have been less fuel on the runway to feed the fire.
The flight crew informed the passengers and flight attendants to remain seated and await further instruction, which was consistent with the flight crew’s training and procedures if an evacuation was not going to immediately occur. The cabin crew reinforced the flight crew’s expectation by instructing passengers to remain seated. As part of the flight crew’s evaluation of the situation, the relief pilot left the cockpit and entered the forward cabin so that he could look outside a window. Before the relief pilot returned, the CVR recorded the captain’s statements indicating that the airplane should be evacuated. The relief pilot returned to the cockpit shortly afterward and informed the captain of the need to evacuate on the right side of the airplane because of the fire. The captain then commanded the evacuation, and a flight crewmember activated the evacuation alarm.
When the relief pilot went into the cabin to assess the situation outside of the airplane, a flight attendant told him that she had been trying to call the flight crew. The CVR recorded a sound similar to an interphone call from the cabin to the flight deck, but the flight crewmembers most likely did not answer the call because they were focused on securing the left engine and deciding whether to evacuate.
After the captain’s evacuation command, the flight attendants assessed their areas and opened the doors that they deemed usable. Five of the eight door exits were initially blocked by flight attendants, which was appropriate given the hazards associated with the smoke, fire, and unusual attitude of two slides. A sixth door, which was initially opened, was blocked once a flight attendant saw flames on the runway, which was also appropriate. Although only two of the eight door exits were used throughout the evacuation, the passengers and crewmembers were able to evacuate before smoke and fire encroached the fuselage.
The captain commanded the evacuation (step three in the evacuation checklist) before calling for the evacuation checklist and performing the first two steps in the checklist. Step two of the evacuation checklist instructs the captain to shut down both engines. The left engine was shut down as part of the engine fire checklist, but the right engine continued operating for about 43 seconds after the captain’s evacuation command. The unusual attitude of two slides (the 3R and 4R slides) resulted from the jet blast coming from the right engine while it was operating.
The captain did not use the QRH to read and do his evacuation checklist items. The right engine was shut down after the relief pilot noticed EICAS indications showing that the engine was still running. Also, the captain’s call for the evacuation checklist occurred after the relief pilot stated that the checklist needed to be performed. (The first officer had stated, just before the relief pilot, “we haven’t done the engine checklist,” but he most likely meant the evacuation checklist.) Because the captain did not follow standard procedures, his call for the evacuation checklist and the shutdown of the right engine were delayed.
British Airways’ engine fire checklist, which was based on the Boeing 777 engine fire checklist, did not differentiate between an engine fire occurring on the ground or during flight. The third step of the checklist instructed the flight crew to cut off the fuel control switch on the affected side to shut down that engine. However, for an engine fire on the ground, the checklist did not include a step to shut down the unaffected engine or indicate that some steps did not apply. If the engine fire checklist had specifically addressed fires during ground operations, the flight crew could have secured the right engine in a timelier manner and decided to evacuate sooner. In February 2018, as part of its final report on the American Airlines flight 383 investigation, the NTSB issued two related safety recommendations, A-18-6 and A-18-10, to address this issue.
The relief pilot relayed pertinent information to the captain and first officer as the emergency unfolded. The relief pilot pointed out the smoke to the flight crew and volunteered to assess the situation outside the airplane from a window in the cabin. After returning to the cabin and reporting his assessment, the relief pilot indicated that the airplane was still on fire on the left side, and the captain commanded the evacuation. The relief pilot also noticed that the right engine was still running and indicated that it needed to be shut down. Thus, the relief pilot played an important role in ensuring the safety of the airplane occupants.
During a group debriefing by the Air Accidents Investigation Branch, the flight attendants stated that some passengers evacuated with carry-on baggage; however, the flight attendants thought that carry-on baggage retrieval did not slow the evacuation. They thought that most passengers who retrieved baggage did so after the airplane came to a stop and before the evacuation was commanded and that the flight attendants’ assertive commands limited further retrieval. The flight attendants at the two most-used exits (doors 1R and 4L) recalled seeing very little baggage at their exits, and neither cited carry-on baggage as a problem. However, the NTSB notes that the accident airplane was only 55% full.
Although not a factor in this evacuation, the NTSB remains concerned about the safety issues resulting from passengers evacuating with carry-on baggage, which could potentially slow the egress of passengers and block an exit during an emergency. The NTSB previously addressed carry-on baggage in a June 2000 safety study on evacuations of commercial airplanes and issued Safety Recommendation A-18-9 in February 2018 as part of its final report on the American Airlines flight 383 investigation.
Probable Cause and Findings
The National Transportation Safety Board determines the probable cause(s) of this accident to be:
The failure of the left engine high-pressure compressor (HPC) stage 8-10 spool, which caused the main fuel supply line to become detached from the engine main fuel pump and release fuel, resulting in a fire on the left side of the airplane. The HPC stage 8-10 spool failed due to a sustained-peak low-cycle fatigue crack that initiated in the web of the stage 8 disk; the cause of the crack initiation could not be identified by physical inspection and stress and lifing analysis. Contributing to this accident was the lack of inspection procedures for the stage 8 disk web.
The press saw this as an example of great airmanship. However with one engine left running, thus delaying the evacuation and with its blast contorting one or more slides, the outcome could well have been less favorable had the aircraft been full with luggage impeding evacuation.
Heathrow Airport Expansion Security Risk?
Even with the best security checks at airports with flights to London’s Heathrow, it would be impossible for not one in hundreds of thousands to miss an explosive device.
Again, aircraft could crash on the city for other reasons.
We are talking about flights continuing for years and years, so the risk though small would be greatly multiplied and significant.
An airport in the Thames Estuary area as suggested by Boris Johnson may one day seem to be a chance regrettably missed.
The inquiry dismissed the idea out of hand. Admittedly it was not popular with the airlines.
There were other options.