Navigating Aeronautical Safety–Part 4

For almost a month, this blog has blasted William Langewiesche’s piece on Air France 447 (and gone after the French investigation as well). In the spirit of balance, someone should play devil’s advocate and defend Langewiesche…

Four Eyes Are Better Than Six?

… wait, no we shouldn’t. Two is greater than three?

This is as true for Boeing as for Airbus, because, whatever their rivalries and differences, both manufacturers have come to similar cockpit solutions. The first was the elimination of the flight-engineer position, despite loud objections by the pilots’ unions, which claimed that safety would be compromised.

I seem to recall from elementary mathematics that 2<3. However, a “presidential task force” came to the opposite conclusion:

After a presidential task force in the United States studied the matter and concluded that a third crew member in the cockpit constituted, if anything, a distraction, the unions accepted defeat.

Human beings cannot be reduced to numbers, so obviously the metaphor is flawed…


…until one remembers this is a decision based upon the number of human beings employed. Three pilots versus two pilots—which is the safest number?

Sources in the country’s transport ministry confirmed Bong Dong Won – who was in the cockpit jump seat – repeatedly yelled “sink rate” in the final minute before the crash, it was reported.

If the sink rate – the rate of decrease in altitude – was checked when Mr Bong raised the alarm, it may have prevented the plane from hitting the seawall as it landed at San Francisco Airport, reports said.

But the two pilots at the controls – Lee Kang Kuk and his instructor Lee Jung Min – apparently did not respond to Mr Bong’s shouted warnings, the respected Joongang Daily newspaper said.

The crash killed two Chinese students and left more than 180 injured.

The answer is four or five. Asiana 214, the 777 that crashed at SFO last year, had another captain, Lee Jong-joo, 52, seated in the first-class passenger cabin. Perhaps if Captain Lee was sitting in the cockpit’s other jumpseat (the first was occupied by 41-year old First Officer Bong Dong-won), the senior pilot would have called out to the two captains at the controls, 45-year old Lee Gang-guk and Check Airman Lee Jeong-min, 48, the real problem.

Safety in Numbers

The classic case of CRM at its finest is United 232, a DC-10 crash in Sioux City, Iowa:

With the accolades directed at Captain Al Haynes, it was easy to forget that had Check Airman Dennis Fitch not been present, the crash would have killed far more passengers and crew:

The captain stated that about 100 feet above the ground the nose of the airplane began to pitch downward. He also felt the right wing drop down about the same time. Both the captain and the first officer called for reduced power on short final approach.

The check airman said that based on experience with no flap/no slat approaches he knew that power would have to be used to control the airplane’s descent. He used the first officer’s airspeed indicator and visual cues to determine the flightpath and the need for power changes. He thought that the airplane was fairly well aligned with the runway during the latter stages of the approach and that they would reach the runway. Soon thereafter, he observed that the airplane was positioned to the left of the desired landing area and descending at a high rate. He also observed that the right wing began to drop. He continued to manipulate the No. 1 and No. 3 engine throttles until the airplane contacted the ground. He said that no steady application of power was used on the approach and that the power was constantly changing. He believed that he added power just before contacting the ground.

(Emphasis mine).

Fitch’s reactions tell much more than the NTSB lets on. The italicized portion is wrong—power would have to be used to control the descent only if the elevators and horizontal trim would be disabled (almost like Fitch had anticipated having to fly a widebody airliner without any hydraulics at all). How did Fitch know this? He had been practicing on account of the terror first recognized four years prior:

Dennis E. Fitch, a DC-10 instructor who had read about the JAL 123 crash and had practised flying with throttles alone in a simulator, used a steer-by-throttle technique to guide the United plane to an emergency landing at Sioux City, Iowa.

JAL 123, a Boeing 747-100SR flying from Tokyo-Haneda to Osaka on 12 August 1985, suffered a failure of the pressure bulkhead on climb-out; causing an explosive decompression which tore the vertical stabilizer (part of the tail and entire rudder) off and, far worse, severed and drained the fluid from all four hydraulic systems on the largest airliner designed during the twentieth century. The same climb and descent phugoid that the United 232 crew had to overcome plagued the earlier Japanese crew, who unfortunately never regained positive control over their 747 which eventually slammed into a mountain, killing 520 of the 524 people aboard. How likely would United 232’s crew have saved the lives of 184 of 296 aboard had anyone other than a man that had studied and trained himself extensively in a DC-10 simulator to handle the exact same circumstances been manipulating the throttles of a fatally-stricken DC-10 on 19 July 1989?

Some might argue we are past loss-of hydraulics dangers. These airliners crashed more than 25 years ago and involved widebodies manufactured during the 1970s, before the advent of fourth-generation airliners beginning with the fly-by-wire A320. What is the likelihood today’s highly-automated giants would be subject to such risks…

The process – the first things we dealt with were the engine overheat, as I mentioned, and the shutdown of the engine. In the shutdown process the ECAM has an option of ‘damaged’ or not and of course we chose ‘damaged’ which then leads you through discharging some fire bottles and shutting the engine down with the fire shut-off switch. We did that but unfortunately we got no confirmation of any fire bottles being discharged. Subsequently that was more wiring damage that didn’t give us the indication. As it turns out, we did have one discharged bottle and one that didn’t which was comforting. The Engine 2 was shut down. Part of the damage caused Engines 1 & 4 to go into a ‘degraded’ mode. The engines were still operating and Engine 3 was the only engine that was operating normally. Basically, dealing with all those things took some time, then the next series of messages were hydraulic problems. We had indications that the green hydraulic system was losing all its fluid.

It has already happened to the A380, which in this century has taken the 747’s title as largest airliner in the world. But something is amiss. Remember, the JAL 123 had four independent hydraulics units…

The Airbus A380 carries two and, unlike most conventional aeroplanes, most flying surfaces aren’t powered by hydraulics, they have their own electric-hydraulic actuators. There is a green and yellow system and they spilt their duties between things like brakes, undercarriage retraction/extension. With the green system out we had to deploy the nose gear and body gear using the gravity extension system. With the loss of the green system we dealt with that and curiously we had the hydraulic pumps of Engine 4 indicating failed as well. Engine 3, the trusty engine, was the only engine that was producing hydraulics for the aircraft for the yellow system.

The A380, a four engine behemoth like the 747, has half of the hydraulics redundancy of the much older Boeing. Losing hydraulics is serious business according to Captain David Evans, the senior of the two check airmen conducting Captain Richard Champion de Crespigny’s line check on Qantas 32 in 2010. So, what happens if all hydraulics are lost?

Mechanical Back Up

In the Mechanical Back Up mode, pitch is controlled by the mechanical horizontal stab trim system and lateral direction is controlled by the rudder pedals operating the rudder mechanically. This mode is intended to allow the pilots to maintain level flight while resetting flight control computers after a temporary total loss of power.

Answer—hope Dennis Fitch is available (he isn’t; a brain tumor took his life in 2012). The mechanical backup system is only designed for straight-and level flight in response to loss of fly-by-wire electronics or (more likely) electrical interruption/outright power failure.  Hopefully the horizontal trim and rudder actually work mechanically or electrically if Green and Yellow are breached and drained of hydraulic fluid (doesn’t mention if hydraulic fluid is necessary for operation, does it)? 

Here’s another good question—would the crew of Qantas 32 have performed as well as they had if there were only two pilots in the cockpit instead of five? Back to Check Airman David Evans:

ASChan: You had five crew on the flight deck. Do you think a standard crew of two would have been able to cope?

DE: That’s a very interesting question. Really we’ll never know the answer to that. In reality I would hope to believe that a normal crew complement would have dealt with it, cope with it in exactly the same way as we had. We just had the luxury of two other individuals to confirm the decisions that were being made by the operating pilots.

ASChan: So a standard crew would have done the same thing, but perhaps taken a little longer?

DE: May have done, may have done. But I think the end result would have been exactly the same.

Evans hopes, but he’s wrong. ASChan calls him out on it:

As Captain Evans notes this crew had the ‘luxury’ of five experienced pilots to draw on when the incident occurred. But there are other salient points – the ‘avalanche’ of messages from the A380’s systems (some contradicting each other) meant that the crew drew on their full resources to decide which were important and which could be disregarded.

Having more than two pilots in the cockpit during a serious emergency isn’t a luxury—it should be recognized as a borderline necessity. There are two main impediments to CRM since aviation began weeding out “Clipper Skippers:” fatigue and task saturation. Fatigue shouldn’t have been much of a factor on initial climb-out on a SIN-SYD sector, but five pilots was a godsend when it came to workload. The captain could focus on flying the plane, the first officer worked the message display, and the second officer focused on wing inspection…with two check airmen available to communicate with cabin crew, make announcements, and handle performance calculations. In this regard there never was a need to ‘multi-task’ (the art of performing multiple tasks poorly):

Another key point was in ‘tricking’ the performance calculator to come up with an acceptable landing speed – again a demonstration of superb airmanship so vital in these incidents.

This might be the most striking lesson from the ordeal—automation was a threat to the aircraft in this case. Qantas 32 is the triumph-of-CRM event of the 2010s, and it features, front and center, pilots questioning the validity of computer data. First Officer Matt Hicks was right—146 knots was far too slow an approach speed. ATSB investigators indicated if 146 had been used instead of 165 knots, the A380 would have stalled. Then again, Qantas 32 occurred two years before AC-102-109 and the total revamp of air carrier stall recovery procedures, so I suppose A380 performance data in an emergency circa 2010 would not take in account THE THREAT OF STALLING ON FINAL.

Crashing a 777 on Final

The transitioning captain and new check airman on Asiana 214 on 6 July 2013 did just that. The Korean airline deserves a little credit–three pilots were in the cockpit, and the observing first officer clearly was paying attention when he yelled out “sink rate.”  Asiana is not the same as Korean Air or KLM at Tenerife; deference to the captains was not the issue.

I postulated earlier that had Lee Jong-joo, the 52-year old senior captain on the 777 been in the other cockpit jumpseat instead of his seat in first class, the crash would have been averted. Am I thinking Captain Lee is another Dennis Fitch? No.

The simple matter was that FO Bong Dong-won calling “sink rate” was unhelpful. With the autothrottles intended to be engaged, the PF quite naturally tries pitch back to slow the rate of descent

Also, the drag rise associated with increased pitch for sweptwing aircraft is very rapid at slow speeds. Bleeding off too much speed during landing can result in a sudden and dramatic sink rate. At this point, the aircraft is well behind the power curve. Even large amounts of thrust may not be enough to arrest the resulting “sinker” in time to prevent a hard landing, or worse. Avoiding “low and slow” or idle power approaches thus becomes especially important in sweptwing jet aircraft.

…which in a cruel twist increases the descent rate on slick, swept-wing, turbofan airframes as induced drag rises unless power is applied to compensate. Calling “sink rate” repeatedly did nothing to call attention to the real problem. All three pilots in Asiana 214’s cockpit were task-saturated at that point–no one called the appropriate warning. If Captain Lee Jong-joo had been sitting behind the flying captains, he might have called out the warning that would have saved the lives of three Chinese girls that were killed: “AIRSPEED!


2 thoughts on “Navigating Aeronautical Safety–Part 4

  1. Hi Mumbler, dumb & late question re: United 232: Did Fitch et. al. consider lowering the landing gear at any time before final approach, and would that action have helped stability? Just wondering . . .
    What a great blog . . .

    • Haynes, Records, and Fitch discussed the possibility, but were worried about changing the aircraft’s condition before what would pass for ‘landing assured.’ Lowering landing gear significantly increases drag, and with the total loss of hydraulics the gear cannot be retracted again. Gear also has operational airspeed and altitude limits, both of which were extremely difficult to control on UA 232.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s