PLAN “B”

Thinking Outside the Box

During Emergencies

Captain Luis Vireilha, MAS

(United Airlines, ret.)

1
 PLAN “B”
Thinking Outside the Box
During Emergencies
Captain Luis Vireilha, (United Airlines, ret.)
Master of Aeronautical Science
Aircraft Accident Prevention and Investigation

Seminar/webinar information:
https://FlightEmergencies.com

Contact:
Info@FlightEmergencies.com

2
 REVISION DATE
2022-04-10
Updates to this document are made as issues surface requiring clarification.
Typographic corrections or minor changes will not trigger new publishing .

Please help improve the quality of this document by reporting any issues to:
Info@FlightEmergencies.com

REVISION DATE 2022-04-10

- Air France 447 - Expanded (page 345).
- Preventing Loss of Control - Expanded (page 359 through 363).
- Wake Turbulence - New (page 405 & 406).
- Qantas 72 - Expanded (page 341).
- Supplemental 2 - The Fuel load Issue (page 433).
- Swift Air 5017 - Expanded (page 343).
- Transair 810 - Expanded (page 275).

3
 TABLE OF CONTENTS

REVISION DATE ________________________________ 3

TABLE OF CONTENTS __________________________ 4
INDEX OF SUBJECTS ___________________________ 7
INDEX BY AIRLINE & FLIGHT NUMBER_____________16
GLOSSARY____________________________________20
DISCLAIMER __________________________________24
COPYRIGHT © 1990-2022 ________________________24
START HERE __________________________________25
TERMINOLOGY ________________________________29
ACKNOWLEDGMENTS __________________________32
REFERENCES _________________________________33
NOTE FROM THE AUTHOR _______________________34
ABOUT THE AUTHOR ___________________________35
MODULE 1 - DECISION MAKING __________________37
PART 1 - CRM & TEM __________________________________________ 37
PART 2 - CREW RESOURCES ___________________________________ 41
PART 3 - HUMAN ERROR _______________________________________ 44
PART 4 - TRAINING____________________________________________ 53
PART 5 - DECISION-MAKING FACTORS ___________________________ 66
PART 6 - ACTIVE MONITORING __________________________________ 72
PART 7 - EXECUTION __________________________________________ 75
PART 8 - EMOTIONAL CONTROL & BEHAVIOR IN ACTION ____________ 79

MODULE 2 - CRASH DYNAMICS __________________86

PART 1 - OUR MONOCOQUE HOME ______________________________ 86
PART 2 - IN-FLIGHT BREAKUP AND GROUND IMPACT _______________ 88
PART 3 - DEFINITIONS & CHARACTERISTICS ______________________ 90
PART 4 - AIRCRAFT DESIGN & SURVIVAL _________________________ 95
PART 5 - BOMB VS. MISSILE DAMAGE ___________________________ 104

4
MODULE 3 - EVACUATIONS & SURVIVABILITY _____108
PART 1 - PREFLIGHT PREPAREDNESS __________________________ 109
PART 2 - WHEN TO EVACUATE OR NOT __________________________ 116
PART 3 - THE EVACUATION ____________________________________ 122
PART 4 - EVACUATION CONCERNS _____________________________ 128

MODULE 4 - TAKEOFF & RUNWAY ISSUES ________136

PART 1 - REASSESSING THE V1 CRITERIA ______________________ 136
PART 2 - STOP ON THE RUNWAY _______________________________ 153
PART 3 - TAKEOFF’S SECOND SEGMENT ________________________ 162
ADDENDUM - CAPTAIN’S REJECT DECISION _____________________ 164

MODULE 5 - DEPRESSURIZATIONS ______________165

EMERGENCY DESCENT EXECUTION ___________________________ 175

MODULE 6 - IN-FLIGHT FIREFIGHTING PLAN _______178

PART 1 - SMOKE, FIRE & AIRCRAFT _____________________________ 178
PART 2 - PROCEDURES & CHECKLISTS _________________________ 198
PART 3 - SMOKE / FIRE MENTAL MODEL _________________________ 203
PART 4 - INCIDENT EVENTS ___________________________________ 218

MODULE 7 - ENGINE FAILURE / FIRE _____________243

PART 1 - JET TRANSPORT CATEGORY __________________________ 243
PART 2 - INCIDENT EVENTS ___________________________________ 252
PART 3 - LIGHT TWIN-ENGINE AIRCRAFT ________________________ 258

MODULE 8 - FAILURE OF ALL ENGINES ___________262

PART 1 - CAUSES & EFFECTS __________________________________ 262
PART 2 - HIGH & LOW ALTITUDE SCENARIOS _____________________ 276

MODULE 9 - CRASH-LANDING / DITCHING _________282

RECAPPING ________________________________________________ 294

MODULE 10 - REVERSER FAILURES ______________295

PART 1 - FAILURE AND RECOVERY _____________________________ 295
PART 2 - UNCOMMANDED DEPLOYMENT ________________________ 302
PART 3 - FAILURE TO DEPLOY _________________________________ 305
PART 4 - CONSIDERATIONS ON DIFFERENT SCENARIOS ___________ 313

MODULE 11 - EXTERNAL SENSORS FAILURES _____316

PART 1 - BACKGROUND INFORMATION _________________________ 316
PART 2 - TAKEOFF FAILURES __________________________________ 322
PART 3 - IN-FLIGHT FAILURES _________________________________ 326
RECAPPING ________________________________________________ 334
PART 4 - INCIDENT EVENTS ___________________________________ 336
ADDENDUM - USE OF FPV SYSTEM _____________________________ 349

5
MODULE 12 - FUEL FREEZING AND WATER ICING __351
MODULE 13 - NON-NORMAL OPERATIONS ________359
PART 1 - NON-NORMAL EVENTS _______________________________ 359
PREVENTING LOSS OF CONTROL ___________________________________ 359
WEIGHT & BALANCE ISSUES ______________________________________ 363
ENGINE SLOW START ___________________________________________ 365
APU USE ___________________________________________________ 366
TAXI _______________________________________________________ 367
BEFORE TAKEOFF BRIEFING ______________________________________ 369
TAKEOFF ____________________________________________________ 370
APPROACH AND LANDING BRIEFING _________________________________ 374
LANDING GEAR & WHEEL WELL ISSUES ______________________________ 374
OVERWEIGHT LANDING / FUEL DUMPING _____________________________ 383
RUNAWAY STABILIZER __________________________________________ 385
SPOILER EFFECTS _____________________________________________ 391
LANDING GEAR DESIGN LIMITATIONS ________________________________ 394
LOW VISIBILITY MISSED APPROACHES AND TAXIWAY LANDINGS _____________ 395

PART 2 - WEATHER RELATED OPERATIONS______________________ 397

RAIN EFFECTS ________________________________________________ 397
FLYING INTO A TORNADO_________________________________________ 398
TAKEOFF INTO TURBULENCE ______________________________________ 401
AVOIDING TURBULENCE _________________________________________ 402
FLYING IN TURBULENCE _________________________________________ 404

PART 3 - COLD WEATHER _____________________________________ 407

OVERNIGHT REFUEL ____________________________________________ 407
ENGINES PRE-HEAT ____________________________________________ 407
AIRCRAFT DE-ICING ____________________________________________ 408
COLD WEATHER TAXI ___________________________________________ 409
FLAPS ______________________________________________________ 410
SNOW FURROWS ______________________________________________ 414
HYDRAULIC SYSTEM CONTAMINATION _______________________________ 415
PARKING BRAKE _______________________________________________ 415

PART 4 - LIGHTNING AND AIRCRAFT ____________________________ 417

PART 5 - CROSSWIND LANDINGS ON SLIPPERY RUNWAYS _________ 420
PART 6 - VOLCANIC ASH CLOUD _______________________________ 424

SUPPLEMENTAL 1 - POLAR CROSSING ___________427

SUPPLEMENTAL 2 - THE FUEL LOAD ISSUE _______433

6
 INDEX OF SUBJECTS
The Index of Subjects is referenced by Module and Part number and sometimes
subject letter unless otherwise noted, e.g., M1P4C indicates Module 1 Part 4.
Plan “B” is a living document, and page numbers change with each revision,
making cross-referencing by page number impractical.

A
Active Monitoring Terminology, M1P6
Aircraft Control (preventing loss of control) M13 P1
- While in Normal Operations
- If Aircraft is Damaged
Airspeed Unreliable checklist applicability M11 P1
Aisle Path Lights M3 P4
Angle of Attack (AOA) M11 P1
APU use M13 P1
Advanced Qualification Program (AQP) M1 P4A
Ash cloud M8 P1
ATC as a crew resource M1 P2
Audio Warnings M9
Axe (crash-axe) M6 P1

B
Baggage (see carry-on)
Behavior
- Adapt, How to M1 P4C
- Behavior in action M1 P8
- Behavioral biases M1 P5B
Bird strike Search word
Bomb M2 P5, M5
Brake temperature (taxi & takeoff) M13 P1
Briefing (full crew) M1 P2
- Before Takeoff (Pilots) M13 P1
- Debriefing (after event) M1 P2

7
 C
Cabin
- Announcements M3 P4
- Preflight M6 P1
Carry-on (baggage, luggage)
- Retrieval M3 P4
- Storage M3 P1
Checklists
- Annunciated M6 P2
- Applicability M1 P4B
- Electrical Smoke M6 P2
- Unannunciated M6 P2
Cockpit Voice Recorder (CVR) M1 P1
Command, Balanced M1 P5B, P8
Controlled Arrival Terminology, M6 P2
Crash forces M2 P4
Crash-landing M8
Crew resources M1 P2

D
Deadheading employees as a resource M1 P2
De-icing, airplane M13 P3
Decision Making
- Aircraft factors M1 P5
- Environmental factors M13
- Expected world M1 P5B
- Human factors M1 P5
- Mental Model concept M1 P5A
- Monkey board M1 P5A
- Problem solving M1 P1
- Reasons to act M1 P5
- Thinking outside the box M1 P4A
Depressurization
- Cabin Coindot floor M5, M6 P1
- Cabin differential M5
- Complications M5
- Corking effect M5
- Damage Tolerance M5
- Descent execution M5
- Gases Expansion Ratio (GER) M5
- Hammer effect M5
- Landing gear use M5
- Outflow valves relevance M5
- Zipping effect M5

8
Ditching M3 P2, M8
- Cold-water Immersion M9
- Engines M9
- Flaps M9
- Flare M9
- Pitch M9
- Preparing M8 P2
- Reading the seas M8 P2
- Tail damage M9
- Touchdown M9
Doors M3 P4
- Do not open
- Open but close again
Drain mast M6 P1
Dutch Roll M6 P2

E
Equipment Cooling M6 P1
Electrical arcing/wiring M6 P1
Emergency
- Aircraft limitations, regulations & policies M1 P4C
- Captain White’s rule M3 P3
- Captain’s emergency authority M1 P7
- Critical Emergency Terminology, M1 P4
- Declaring an emergency M1 P7
- Deplaning at gate M3 P1
- Descent considerations M6 P3
- Descent execution M5
- Emotional control M1 P8
- Execution M1 P7
- Landing emergency M4 P2
- Mayday M1 P7
- Multitasking M1 P5A
- Preparedness M1 P4C
- Reprioritizing M1 P7
- Startle effect M1 P4C
- Takeoff emergency M4 P2

9
Engine
- A/T OFF considerations M7 P1
- Components M7 P1
- Failure/Fire
- Detection monitoring fail M7 P1
- Extinguishing M7 P1
- Flap asymmetry (fire induced) M7 P1
- Fuel-fire M7 P1
- On the ground M3 P3
- High/low altitude scenarios M8 P2
- In flight M7 P1
- Rub-fire (components friction) M7 P1
- Test M7 P1
- Warning M7 P1
- Ice/water ingestion M8 P1, P4
- Pre-heat M13 P3
- Pressure Ratio (EPR) M11 P1
- Problem, Suspected M7 P1
- Separation M7 P1
- Slow start M13 P1
- Tailpipe fire/torching M7 P1
- Unusual failures M8 P1
- V1 power loss M7 P1
- Wing/ice ingestion M8 P1, P4
- Reverser (T/R)
- Blow torch effect M6 P1
- Deployment before touchdown M10 P1
Engineered Material Arresting System M4 P1
Evacuation
- Carry-on luggage M3 P1, P3
- Cockpit (pilot injuries) M3 P4
- Commands M3 P3
- Doors do not open M3 P4
- Engine fire on the ground M3 P3
- Evacuating passengers M3 P3
- Flaps, inability to extend M3 P4
- Gate, Emergency at M3 P1
- Lifelines M3 P1
- P.A. system M3 P4
- Pre-evacuation M3 P3
- Slide Deployment Failures M3 P4
- Unintentional M3 P4
- Unusual attitude (ground) M3 P2
- Window shades M3 P4

10
 F
Failures -
Multiple, remote, unique or intermittent M1 P4C
Fires
- Area heaters M6 P1
- Axe use M6 P1
- Batteries M6 P1
- Bleed air leaks M6 P1
- Cabin M6 P1
- Cabin door rainwater M6 P1
- Cabin PED Fire M6 P1
- Cabin postfire evaluation M6 P1
- Cargo M6 P1
- Cockpit PED Fire M6 P1
- Cockpit smoke/fire M6 P1, P2, P4
- Effects on fuselage M6 P1
- Fire test M7 P1
- Fluorescent lights M6 P1
- Fuel fire M6 P1
- Galley leaks M6 P1
- In-flight entertainment M6 P1
- Lavatory M6 P1
- Oven M6 P1
- Passenger seat M6 P1
- Personal Elect. Device (PED) M6 P1
- Postfire evaluation M6 P1
- Radar M5 P1
- Recirculation/gasper fans M6 P1, P2
- Reverser blow torch effect M6 P1
- Window heat M6 P1
Flap asymmetry (fire induced) M7 P1
Flap lockout M8 P1
Flashover M6 P1
Flashpoint M6 P1
Flight Data Recorder (FDR) M1 P1
Fuel
- Cooling rate M12
- Dumping (jettisoning) M7 P2, M11 P1
- Freezing M12
- Management M8 P1, P4
- Refuel overnight M13 P3
- Tank explosion M2 P5, M12

11
 G
Gases Expansion Ratio (GER) M5
Go-around asymmetrical power M13 P1
Government Agencies M1 P3

H
Human error M1 P3
- ATC Air Traffic Control M1 P3
- Flight Crews M1 P3
- Pilot airline-owners M1 P3
- Maintenance M1 P3
- Management M1 P3
Hurricane M13 P2
Hydraulic fluid contamination M13 P3

I
Ice crystals M11 P3
Ignition point M6 P1
In-flight entertainment (IFE) M6 P1

L
Landing emergency M4 P2
Landing gear limits M13 P1
Landing Gear retraction issues M13 P1
Landing gear, Unsafe M13 P1
Lavatory M6 P1
Lightning strike effects M8 P1, M13 P1, P3
Low visibility M10 P3, M13 P1
Luggage (see carry-on)

M
Manual Reversion M9
Mayday M1 P7, M5
Mental Model concept M1 P5
Missile M2 P5
Monkey Board M1 P5A

12
 O
Operating a Negative or
Positive Reporting System Terminology
Oxygen
- F/A in cockpit M5
- Lavatory M5
- Passengers M5
- Pilots M6 P2

P
Parking brake M13 P3
Passengers
- Before takeoff M3 P1
- Behavior M3
- Boarding M3 P1
- Brace M3 P1
- Clothing M3 P1
- Flight selection M3 P1
- Seat belt M13 P1
- Seat design M2 P2
- Seat preflight M3 P1
- Seat selection M3 P1
PBE Portable Breading Equipment M6 P2, P3 stage 3
Pilots, Commercial & Military M1 P7
Pressurization panel M11 P2

R
Rain effects M13 P2
Recirculation/gasper fans M6 P1, P2
Reject - see Takeoff M4
Residual attention M1 P4
RTO mode failure M11 P1
Runway Paint Fire Hazard M13 P1
Runaway Stabilizer M13 P1
Runway (stop on the runway) M4 P2

S
Sabre Dance M13 P3
Safety
- Acceptance of risk M1 P3
- Industry Safety Filters M1 P3
- Safety Culture M1 P3
- Safety & Risk M1 P3

13
 - SMS Safety Management Systems M1 P3
Safety Concerns
- Aircraft left/right sides M3 P4
- Cabin announcements M3 P4
- Cabin materials M3 P4
- PBE training M3 P4, M6 P3
- Uniforms M3 P4
- Wing configuration/contamination M3 P4, M13 P3
Smoke
- Behavior during descent M6 P2
- Cabin M6 P1
- Characteristics M6 P1
- Cockpit Oxygen (use) M6 P2
- Crew Check Cabin (to find source) M6 P3
- Electrical M6 P1
- Emergency Vision Assurance Sys. EVAS M6 P3
- In-flight entertainment (IFE) M6 P1
- Lavatory M6 P1
- Oven M6 P1
- PBE (use) M6 P2, P3 stage 3
- Recirculation/gasper fans M6 P1-2
- Removal M6 P2
- Soot M6 P3 stage 3
- Start of smoke event M6 P2
- Temperatures and effects on structures M6 P1
- Types of smoke M6 P1
SMS Safety Management Systems M1 P3
Snow furrows M13 P3
SOB Souls On Board count M3 P3
Speed-brakes/spoilers M13 P1
Stabilizer, Runaway M13 P1
Startle effect M1 P4C
St. Elmo's fire M8 P1, M11 P3
Stress M1 P8
Structural damage M3 P2, M8 P2, P3
Survivability four points M2 P4

T
Takeoff
- Asymmetrical power M13 P1
- Captain’s reject decision M4 addendum
- FAA Rejected TOF Study M4 P1
- Go mode and mini V1 M4 P1
- Go / No Go decision M4 P1
- Impossible turn (FAA) M4 P3

14
 - Light Twins M7 P3
- Overrun Plan M4 P1
- Reject training M4 P1
- Second segment M4 P3
- Speed cross-check M11 P2
- Takeoff or landing emergency M4 P2
Task saturation M1 P4A
TAT probe M11 P3
Taxi
- Cold weather M13 P3
- Flap movement M13 P3
- Sharp turns M13 P1
- Techniques M13 P1
- Unsafe landing gear indication M13 P1
Taxiway landings M13 P1
Toilet M6 P1
Tornado M13 P2
Turbulence M13 P2
Training M1 P4
- Advanced Qualification Program (AQP) M1 P4A
- Avoiding accidents M1 P4
- Communications & procedures M1 P4B
- Connecting the dots M1 P5A
- Decision making M1 P4A
- Preparedness M1 P4C
- Simulators M1 P4B
- Threat identification and risk assessment M1 P4C

V
V1 power loss M7 P1
Vertical separation M11 P3
Vibration M4 P1
Low visibility missed approaches M13 P1

W
Weight & Balance M13 P1
Wheel Well issues M13 P1
Wind strips M8 P1, M13 P3
Window heat M6 P1
Window shades M3 P4
Wing configuration and contamination M13 P3
Windshield M13 P1

15
 INDEX BY AIRLINE & FLIGHT NUMBER
Incidents in italic indicate that Capt. Vireilha has personal knowledge of the event.
Aer Lingus 110 B757 JFK .............. 76
Aeroflot 212 TU154 Stockholm.... 143
Aeroflot 6709 Tu154 Baku ........... 269
Aeroflot 7841 TU134 St Pete ....... 265
Aeroflot TU134 Penza.................. 143
Aeroflot TU154 Georgia ............... 144
Aeroflot TU154 Moscow .............. 338
Aeroflot Tu-154 Russia ................ 244
AeroPeru 603 B757 Lima ............ 340
Air Afrique A300 Dakar ................ 369
Air Asia 8501 A322 Java Sea ...... 345
Air Canada 143 B767 Gimli ......... 269
Air Canada 15 B777 HKG........ 56, 61
Air Canada 797 DC9 Cincinnati... 218
Air Canada 837 B767 MAD ......... 381
Air Canada 877 Toronto .............. 160
Air Florida 90 B737 DCA ............. 342
Air France 187 B747 Delhi........... 143
Air France 358 A340 Toronto ...... 143
Air France 447 A330 S.ATL ......... 345
Air France 4590 Concord Paris ... 151
Air France 54 Concord Dulles ..... 376
Air France 72 B747 Papeete ....... 309
Air France 7775 F100 ..........143, 412
Air France 91 B747 GIG .............. 309
Air India 812 B737 Mangalore ....... 78
Air Mediterranee 8177 A320 ........ 143
Air Micronesia DC10 Kai Tak ........ 84
Air New Zealand DC8 AKL .......... 304
Air Nostrum 8665 CL600 Spain ... 415
Air Ontario 1363 F28 Dryden....... 408
Air Transat 236 A330 Azores ...... 269
Air Yunnan 5210 CL600 .............. 408
Airborne Express DC9 PHL ......... 265
Airbus 400M Spain....................... 162
Airbus Industrie Test 129 A330 ... 363
ALM 980 DC9 SXM...................... 268
Aloha 243 B737 Hawaii ............... 167
American 096 DC10 DTW ............. 48
American 383 B767 ORD ............ 124
American 587 A300 NY ............... 362
16
American 633 DC10 SJU............. 144
American 70 DC10 DFW ............. 144
American 965 B757 Cali .............. 393
American A319 MIA ..................... 311
Ameristar 363 MD83 DTW........... 144
Ariana 312 B737 Delhi ................. 144
ASL Airlines 7332 B737 ............... 144
Austral 2553 DC9 BA ................... 345
Austrian 111 F70 Munich ............. 265
Avianca 52 B707 NY .................... 269
BEA 548 Trident LHR .................... 37
BH Air 5378 A320 Italy ................ 138
BirgenAir 301 B757 DR ............... 339
BOAC 712 B707 LHR ..........184, 252
BOAC 911 B707 Tokyo ............... 242
Braniff 250 BAC111 Omaha ........ 399
British Airtours 28 B737 .......157, 182
British Airways 38 B777 LHR ...... 358
British Airways 5390 BAC 111..... 388
British Airways 56 B744 ............... 300
British Airways 9 B747 Jakarta .... 273
British Midland 92 B737 43, 101, 253
Cameroon 70 B747 Paris ............ 309
Canadair CL600 Bassett.............. 354
Canadair CL600 TEB 2003.......... 145
Canadair CL600 TEB 2005.......... 144
Canadair CL600 Tupelo............... 144
Canadian 17 DC10 Vancouver .... 145
Capitol 26 DC8 ANC .................... 415
Cathay Pacific 780 A330 HKG .... 354
Cathay Pacific 780 HKG .............. 127
Cessna 421 Prime Minister.......... 260
Cessna Citation I Wichita............. 303
China Airlines 140 A300 .............. 360
Continental 1 B747 AKL ................ 63
Continental 1 DC10 LAX................ 64
Continental 11 B707 Unionville ... 172
Continental 140 DC10 LAX............ 51
Continental 1404 B737 DEN ....... 371
Continental 1512 DC10 IAH ........ 222
Continental 1593 B757 SAV ........ 224
Continental 182 B757 MCO......... 370
Continental 208 DC10 EWR .......... 65
Continental 208 DC10 IAH .... 41, 255
Continental 210 B757 SFO .......... 405
Continental 50 DC10 PHL ........... 219
Continental 51 DC10 EWR .......... 220
Continental 588 MD82 DEN ........ 368
Continental 60 B777 BRU............ 364
Continental 603 DC10 LAX.......... 116
Continental 64 B757 LIS .............. 254
Continental 795 MD80 LGA ......... 337
Continental 84 B777 EWR ........... 149
Continental 84 B777 Rome.......... 222
Continental 850 B737 SXM ......... 313
Continental 871 B737 SXM ........... 77
Continental B737 CLE ................. 230
Continental DC10 LGW ............... 126
Continental DC9 IAH.................... 400
Continental Sabreliner ................. 302
COPA 201 B737........................... 362
Crash Test B727 Mexico ............... 95
Crossair 498 Saab 340 ................ 361
Cubana 972 B737 Havana .......... 363
Daallo 159 A321 Mogadishu ....... 166
Delta 1086 MD80 LGA ................. 366
Delta 1141 B727 DFW ................. 413
Delta 1288 MD88 Pensacola ....... 123
Delta 1490 B737 Vancouver ........ 160
Delta 89 B777 LAX ...................... 384
Delta 95 B777 ATL ....................... 379
Delta 9570 DC9............................ 405
Delta B767 LAX....................270, 294
Dornier 328 Manassas ................. 344
Eastern 304 DC8 MSY ................ 404
Eastern 375 L188 Boston ............ 162
Eastern 401 L1011 MIA ................. 38
EL AL 30 B767 Toronto ............... 160
Ethiopian 302 B738Max 49, 342, 385
Ethiopian 604 B737 Ethiopia ....... 264
Ethiopian 961 B767 Comoro270, 289
Etihad Airways A380 LHR ........... 421
EverGreen 46E B747 ANC .......... 401
Falcon 20 Naples ......................... 264
FEAT 103 B737 Taiwan............... 167
FedEx 1406 DC10 SWF .............. 230
17
FedEx 87 MD11 Subic Bay.......... 345
FedEx DC10 Boston .................... 408
First Air 6560 B737 Canada .......... 78
Flybondi 5011 B737 Argentina .... 363
Garuda 200 B737 Indonesia .......... 78
Garuda 421 B737 Indonesia ........ 266
Grand Aire Exp. 179 Falcon 20 ... 270
Gulf Air 71 B737 Abu Dhabi ........ 145
Hapag-Lloyd 3378 A310 Vienna . 268
Hawker Siddeley HS125 UK ........ 264
IAT 302 B707 Belgium ................. 402
Indian Airlines 440 A300 India ..... 269
Indian Airlines 571 A300 India ..... 145
Interflug IL62 Berlin ...................... 231
Iran Air Force B747 Madrid.......... 418
Japan Air Lines 422 B747 ANC ... 409
Jet Airways 2374 B737 Goa 128, 373
Jet Blue 292 A320 LAX................ 375
Jet Star 12 A330 Pacific .............. 347
Jet Star B787 Darwin ................... 346
Kazakhstan Air TU154 ................. 145
Kenya Airways 507 B737............. 361
KLM 4805 B747 Tenerife ............... 38
KLM 867 B747 ANC..................... 273
LAB B727 Trinidad ....................... 270
LACSA 628 B727 Costa Rica ...... 145
LaMia 2933 Avro 149 Colombia .. 271
LANSA 508 L188 Peru ................ 418
LAPA 3142 B737 BA.................... 141
Lauda Air 4 B767 Thailand .......... 299
LAV 109 DC9 Caracas .................. 34
Lear Jet 24 ATL............................ 264
Lear Jet 25B Waterville ................ 336
Lear Jet 35A FLL.......................... 303
Lear Jet 60 Columbia ................... 310
Lear Jet 60 Troy AL ..................... 310
Learjet 45 MexGov....................... 405
Lion Air 386 B737 Indonesia ....... 145
Lion Air 610 B738Max... 49, 342, 385
Logan Air 6780 Saab 2000 .......... 360
LOT 2 B767 Toronto .................... 340
LOT 5055 IL-62 Warsaw.............. 250
Lufthansa 1829 A321 Bilbao ....... 341
Lufthansa 540 B747 Nairobi ........ 301
Lufthansa 8457 B747 UAE .......... 145
Lufthansa A320 Hamburg ............ 422
Malaysia 124 B777 Australia ....... 341
Malaysia 17 B777 Ukraine ........... 106
Metro Cargo IL76 Iran .................. 270
Mexicana 940 B727 MEX ............ 377
Mohawk 40 BAC111 ...................... 50
NationAir 2120 DC8 Jeddah ........ 378
NLM Cityhopper 431 F28 RTM.... 399
Northwest 255 MD82 DTW .......... 413
Northwest 6231 B727 JFK ........... 337
Northwest 705 B707 Miami.......... 404
Northwest 8 A330 Tokyo ............. 346
Northwest 985 A320 DTW ........... 146
Northwest Airlink 3701 CL600 ..... 274
Olympic 3830 Falcon 900 ............ 405
ONA 32 DC10 JFK...............146, 264
Onur Air 2264 MD88 Holand ....... 141
PAA 812 B707 SYD ..................... 146
Pacific W 314 B737 Cranbrook ... 306
Pacific W 501 B737 Calgary ........ 159
Pan Am 103 B747 Lockerbie ....... 167
Pan Am 160 B707 Boston ........... 232
Pan Am 1736 B747 Tenerife ......... 38
Pan Am 214 B707 PHL ................ 418
Pan Am 799 B707 Anchorage ..... 410
Paninter. 112 BAC111 Hamburg . 262
Philippine 137 A320 Bacolod....... 312
Philippine 143 B737 Manila ......... 356
Propair 420 Metro Montreal ......... 378
PSA 182 B727 San Diego ........... 248
Qantas 32 A380 ........................... 206
Qantas 72 A330 Indian Ocean .... 341
Qantas B747 Bangkok ................. 193
S7 Airlines 778 A310 Russia ....... 310
SAA 295 B747 Mauritius.............. 233
Sabena B737 BRU....................... 264
SAS 370 DC9 Oslo ...................... 336
SAS 751 MD82 Stocholm ............ 266
SAS 933 DC8 LAX ................. 38, 121
Saudia 163 L1011 Jeddah ...178, 235
Southern 242 DC9 New Hope ..... 266
Southwest 345 B737 LGA ........... 127
Southwest 350 B737 Kansas ...... 263
Space Shuttle Challenger .............. 48
Spanair 5022 MD82 MAD ............ 412
18
Spantax 995 DC10 MAD ............. 146
SpiceJet 6237 B737 Mumbai....... 147
Spirit Airlines 970 MD82 ICT ....... 343
Sriwijaya 182 B735 Indonesia ..... 303
Sudan Air 2241 B707 UAE .......... 304
Sun Way 4412 IL76 Karachi ........ 248
Swift Air 5017 MD83 Mali ............ 343
Swissair 111 MD11 YHZ........ 48, 236
Swissair 306 Caravelle Zurich ..... 377
Swissair 551 MD80 Munich ......... 238
TACA 110 B737 MSY .................. 266
TACA 510 B767 Guatemala ........ 147
TAM 3054 A320 S Paulo ............. 311
TAM 402 F100 S Paulo ............... 303
TAM 8091 A330 Miami ................ 345
TAP 425 B727 Madeira ............... 306
Tarom 371 A310 .......................... 359
Texas Int. 987 DC9 DEN ............. 147
Thai 114 B737 Bangkok .............. 356
TIA 863 DC8 JFK ......................... 138
Titan Airways A321 London ......... 262
Togo 1 B707 Niamey ................... 239
Tower Air B747 Miami.................. 118
Transair 810 B737 Honolulu ........ 275
TransAsia 536 A320 Taipei ......... 312
Transavia 1277 B737 RTM .......... 363
TransBrasil 801 B707 .................. 392
TransBrasil BAC111 Campinas ..... 79
TransMeridian 3751 CL44 HKG .. 257
Transwede Caravelle ARN .......... 409
Tupolev 154 Russia ..................... 348
Turkish 1951 B737 Amsterdam ... 360
Turkish 5904 B737 Turkey........... 338
Turkish 981 DC10 Paris................. 48
TWA 159 B707 Cincinnati............ 147
TWA 42 B707 Carmel .................. 394
TWA 800 B707 Rome ..........117, 307
TWA 800 B747 NY...... 104, 167, 356
TWA 840 B727 Athens ................ 166
TWA 843 L1011 JFK............147, 339
United 173 DC8 PDX ............. 38, 270
United 23 B757 Dublin ................. 338
United 328 B777 DIA ................... 251
United 553 B737 ORD ................. 392
United 61 B777 N.ATL ................... 47
United 611 B737 PHL .................. 148
United 811 B747 Hawaii ........ 48, 168
United 826 B747 NRT - HNL ....... 402
United 826 DC8 NY ..................... 394
United 859 DC8 DEN ................... 306
United 863 B747 SFO .................. 392
United B756 HNL - LAX ............... 239
United B767 DEN ......................... 270
United DC10 DEN ........................ 308
UPS 1307 DC8 PHL ............240, 241
UPS B747 Dublin ......................... 336
Ural Air 6178 A321 Russia .......... 265
US Air 1549 Hudson ... 264, 287, 291
US Air 1702 A320 PHL ................ 148
19
US Air B737.................................. 375
US Air B737 Kinston NC .............. 372
USAF B2 Guam ........................... 338
USAF C5A Galaxy Ramstein....... 304
USAF KC-135 .............................. 405
VARIG 254 B737 Maraba ............ 272
VARIG 820 B707 Paris ................ 241
VARIG 967 B707 Tokyo .............. 242
WA Sweden 294 CL600 .............. 362
West Carib 708 MD82... 93, 343, 344
Western 2605 DC10 MEX ............. 38
XL German Air 888 A320............. 341
Yak Service 9633 - Yakovlev 42.. 148
 GLOSSARY
Note: - The term Cabin Chief has been adopted in this book to designate the Flight
Attendant in charge of the passenger cabin.

~ - Approximately
< - Less than
> - Greater than
ARFF - Airport Rescue and Firefighting
ABA - Able Body Assistant
ACARS - Aircraft Communications Addressing and Reporting System
ADC - Air Data Computer. For simplicity of presentation in this book, ADC
refers in general terms to data systems, whether they may otherwise
be referred more specifically as CADC, MCU, ADIRS, ADIRU,
SAARU etc.
ADS-B - Automatic Dependent Surveillance - Broadcast. System that allows
air traffic to request and receive digitized information directly from the
aircraft without the participation or knowledge on the part of pilots.
AOA - Angle of Attack
A/P - Autopilot
APU - Airborne (or Auxiliary) Power Unit. - Small turbine usually located
within the tail of an aircraft, whose purpose is to provide electricity
and air for operation of electrical systems and air conditioning.
ASI - Air Speed Indicator
ASR - Approach Surveillance Radar
A/T - Autothrottle
ATC - Air Traffic Control
CA - Captain (common in US) or Commander (common in EU)
CAM - Cockpit Area Microphone
Capt. - Captain
CB - Circuit breaker
CDU - Control Display Unit
CFIT - Controlled Flight Into Terrain - When an airworthy aircraft under the
complete control of the pilot is inadvertently flown into terrain or water
CIR - Captain’s Irregularity Report
CO - Continental Airlines
CPDLC - Controller Pilot Data Link Communications. Pre-formatted text or
equivalent electronic mail (E-mail) between pilots and air traffic
controllers.
CRM - Crew Resource Management
CSD - Constant Speed Drive unit
CVR - Cockpit Voice Recorder (recordings)

20
DBR - Damaged Beyond Repair - this does not necessarily mean there
was substantial damage. In older planes, it usually simple means that
the repair cost does not justify the expense (considering the number
of cycles left on the aircraft).
e.g. - …for example, (Latin phrase "exempli gratia")
E&E - Electronics Bay
ECL - Electronic Checklist
EEC - Engine Electronic Control (computer)
EICAS - Engine-Indicating and Crew-Alerting System
EMAS - Engineered Material Arresting System
EOW - Extended Over Water
EPR - Engine Pressure Ratio
ETOPS - Extended Twin-Engine Operations. Rules that define the operation
of an aircraft with two engines beyond an hour flight from the nearest
shoreline.
EVAS - Emergency Vision Assurance System
F/A - Flight Attendant
F/D - Flight Director
F/E - Flight Engineer
F/O - First Officer
FAA - Federal Aviation Administration
FAF - Final Approach Fix
FDR - Flight Data Recorder
FOD - Foreign Object Damage (to the engines)
FOM - Flight Operations Manual
FPA - Flight Path Angle
FPI - Flight Path Indicator
Ft/m - Feet per minute
G/S - Ground Speed
GPWS - Ground Proximity Warning System
Hazmat - Hazardous materials
IAS - Indicated Airspeed
i.e. - …in other words…
IFE - In-flight Entertainment
ILS - Instrument Landing System
IMC - Instrument Meteorological Conditions
Joule (J) - In this study, Joules are only used as units of “Impact resistance in
aluminums.” - It refers to the energy required to bend or puncture a
material by impact under specified test conditions.
This test measures the multi-axial impact behavior of a material and
can be used as a measure of the rate sensitivity of a material.
Impact resistance is normally measured in Joules of energy as per
the ASTM standards for each specific material.

21
Mach - Speed of the aircraft relative to the speed of sound in certain
conditions of altitude, temperature, etc. E.g., Mach 0.84 would be
equivalent to 84% of the speed of sound at the altitude and the
temperature at which the airplane is flying.
MCAS - Maneuvering Characteristics Augmentation System
MCT - Maximum Continuous Thrust
MEL - Minimum Equipment List
MLW - Maximum Landing Weight
MTOW - Maximum Takeoff Weight
NRS - Negative Reporting System (see Terminology)
NTSB - National Transportation Safety Board
OAT - Outside Air Temperature
Ops - Operations
PA - Passenger Announcement / Passenger Address System
Pax - Passengers
PBE - Portable Breathing Equipment
PED - Personal Electronic Device
PIC - Pilot in Command
PRS - Positive Reporting System (see Terminology)
PWS - Predictive Windshear
QNH - Altimeter setting. From the Q-Code Signals. See
https://en.wikipedia.org/wiki/Aeronautical_Code_signals
RA - Radio Altimeter
RAT - Ram Air Turbine
S/O - Second Officer
SAR - Search and Rescue
SAT - Static Air Temperature
(sic) - As per original (or report)
SMS - Safety Management Systems
SOB - Souls on Board
SOP - Standard Operating Procedure
T/R - Thrust Reverser
TEM - Threat and Error Management
TOD - Top of Descent
TOF - Takeoff
UFIT - Uncontrolled Flight into Terrain
Ullage - Space inside of a fuel tank not filled by fluids
V1 - Decision speed - takeoff can be rejected or continued
V2 - The speed at which the airplane may safely be climbed with one
engine inoperative
VMC - Visual Meteorological Conditions
Vmc - Vmc is the speed below which aircraft control cannot be maintained
if the critical engine fails under a specific set of circumstances (see
14 CFR part 23)
Vr - Rotation speed

22
VS - Vertical Speed
VSI - Vertical Speed Indicator or IVSI Instantaneous Vertical Speed
Indicator

Intentionally Left Blank

23
 DISCLAIMER
Luis Vireilha, flightemergencies.com and the other contributors to this
publication shall not be held responsible for any loss or damage
caused by errors, omissions, misprints or misinterpretation of the
contents hereof.
Furthermore, Luis Vireilha and flightemergencies.com and the other
contributors to this publication expressly disclaim any and all liability to
any person or entity in respect of anything done or omitted, and the
consequences of anything done or omitted, by any such person or
entity in reliance on the contents of this publication.

COPYRIGHT © 1990-2022 by Luis Vireilha

All Rights Reserved. No part of Plan “B” may be reproduced in any
manner without the express written consent of Luis Vireilha, except in
the case of brief excerpts in critical reviews or articles, for personal use
only and not for profit.
All inquiries should be addressed to: Info@FlightEmergencies.com

24
 START HERE
Please read the “Start Here” and the “Terminology” pages before proceeding to
the Modules. They contain essential information.

Reading the “Table of Contents” and the “Index of Subjects” will make the reader
aware of materials that otherwise may be overlooked. The titles may be familiar,
but the content studied here is not part of a pilot’s common knowledge.

Why is this study so important?

Only 7% of flight crews handle non-textbook emergencies well (NASA Technical
Memorandum 2005-213462). This indicates that flight crews are underprepared to
deal with critical emergencies and identifies training as the source of the problem.
As crewmembers we will periodically face unforeseen operational hazards, and
some can be fatal. Most of those events are covered in this study.

Most incidents can be prevented (or achieve a better outcome) by developing high
awareness and operating with unconscious competence (doing the correct thing
without having to think about it).

PLAN “B” (or the FlightEmergencies.com seminar or webinar) presents flight

crews with the necessary preparedness in a cutting-edge approach to decision-
making, leading to the safest course of action. There is no other study of this
magnitude addressing hundreds of items on the prevention of airline accidents.

As military, corporate and airline pilots, we receive the best training available, and
we have deep knowledge of our flight manuals and procedures. Still, this
preparation is not sufficient to meet the needs of a critical, real-world
emergency. Accident analysis finds that even the most qualified and experienced
flight crews with well-thought-of airlines fail to achieve the safest possible outcome.

Aircraft do not crash because of emergencies or even because of the crew’s

response. Instead, planes are lost because of the actions the crew did not take
as they had no awareness of a particular area of knowledge.
The thought process and the required actions to handle a critical emergency
well are not within the crew’s trained skill sets, and they are not part of a
pilot’s education. The information necessary to develop these skill sets can only
be found in accident reports.

Accident Investigations
Accident reports combine an immense source of specific knowledge from the
combined experts in each area involved. No single individual can have such vast
knowledge in every field.

25
However, accident reports do not address what the crews were possibly
experiencing while dealing with the emergency. Because these details matter, the
author brings accounts from his own experiences and other crewmembers'
experiences to help understand that environment.
Accident-based critical thinking is used in this study to develop the best resolutions
during in-flight emergencies. Learning from this broad base of knowledge enables
correct threat identification. It provides a clear understanding of the available
options to help eliminate the less favorable ones making decision-making simpler
and quicker in critical, fast-developing emergencies. The crew’s response needs
to be faster than the emergency, yet correct, which requires the resolution
to be simple and remembered. Most importantly, clear understanding gives the
conviction to act correctly.

About - PLAN “B”

This 30-year study examines the information collected from accidents but not
learned and included in aviation manuals. This knowledge is essential to managing
the most critical situations that flight crews may encounter. There are no new
accidents, only new participants.

The shortcomings identified in accident reports and their recommendations are

considered. Significant information is put together in a manner that has a purpose
and makes sense. The study explains the operational reasons for doing
specific procedures, skipping others, and clarifies how to do them.

The study is presented in two ways:

1 - The E-book explains issues using “meaningful learning” methods, through
multiple narratives establishing the relationship of a concept to real-world
events (incident narratives). This effectively promotes complete understanding
and retention for a longer period.

2 - The live Flight Emergencies presentation uses “active learning” methods,

engaging the attendees by placing them in incident situations and participating in
the resolutions.
For more information on “in person” or virtual presentations, please get in touch
with us. Your comments are welcomed and appreciated.
Email: - Info@FlightEmergencies.com
Or visit our website: - FlightEmergencies.com

It is recommended to read the modules and view the videos in their respective
sequence as information presented in an earlier module will be used in later
modules.

26
About the events mentioned in this study
It is not the intention of this study to review any specific accident. Accident
summaries and key points are discussed to support the point being made. Different
aspects of the same accident may be examined in separate modules.
For example, British Midland 92 human factors aspect, the engine failure, and the
impact forces are reviewed in three distinct modules. In other events, where
different features are related, then the narrative becomes one story.
Older incidents are included with newer ones to give perspective on the length of
time that the same issue has been known. When the same event keeps repeating
itself, it does not reflect on the crew, but it reflects on the training or the system
design. It is an indication that the industry, although aware, lacks the conviction to
pay the price for the necessary changes.

In this study, there is no intention to criticize,

attribute blame or expand on the politics of the issues.
The objective is to promote a strong direction in safety matters.

About the flight crews

This study highlights where we, as an industry, are not performing well, and it is
fundamental to pinpoint our weaknesses to develop better resolutions.

Mistakes, mechanical failures, computer glitches or inadequate computer

programing will always cause flight emergencies. This is emphasized in the post-
accident commentaries.

When reviewing an incident and the decisions and actions taken by a flight
crew, we need to be mindful that it does not reflect on the crew themselves,
but on the training they did not receive.
It is never comfortable to bring a criticism that includes ourselves. But by
recognizing where we could have done better, we encourage others to do
better when a similar event occurs again.

The government agencies, the aircraft builders, and the training institutions are
responsible for doing the research necessary and implement the corrective
procedures, not the crewmembers.

27
About the aircraft
Accounts and references to procedures or airplane systems are taken from the
incident reports of the aircraft involved or similar events.

Readers should always cross-check any information in this book with their aircraft
manual as it is likely to differ. It is recommended to consult both the Aircraft Flight
Manual and the Minimum Equipment List (as if the item involved was inoperative)
to understand the overall implications. Mind that some information may only be
found in the Aircraft Maintenance Manual.

The author brings his research and discovery from hundreds of reports and
presents their findings, conclusions, and recommendations. He also gives his
commentary identified as “Observations (Capt. Vireilha)” to differentiate from
accident reports commentary.

Note:
The US transport aircraft certification process is different than in other countries.
Examples:
- On US-certified aircraft, pilots can quickly override the aircraft’s computers.
- Hydraulic systems must have electric pumps (or other sources) as a backup for
engine-driven hydraulic pump failures.

Aircraft certified by other countries may not, and many do not have these
backups.
- The loss of an engine may cause the loss of its respective hydraulic system, with
substantial implications for the primary and secondary flight controls.
- Also, pilots may not have veto authority over the aircraft’s computers when they
malfunction.

Note: - International Organization for Standardization (Organisation internationale

de normalisation). Dates are listed using the ISO 8601 format yyyy-mm-dd.

Note:
Any use of the first-person language refers to the author, Captain Luis Vireilha.

28
 TERMINOLOGY
Please read this page, it contains essential information.
For easier referencing, the following highlights are used:

Orange Highlight = Start of a Module

Green Highlight = Start of a Part or Discussion of actions

Blue Highlight = Specific information

--- General Highlight.

--- Video, Caution, Note, Words with special meaning.

--- Aircraft Accident / Incident / Event.

The following definitions and concepts have been established for this book:

--- Active Monitoring

While during normal cruise conditions, a continuously updated state of
readiness is maintained for possible alternate LNAV & VNAV paths to an airport
of opportunity should an emergency occur (expanded on M1P6).

--- Controlled Arrival

Landing on a runway in normal conditions is not always possible. For example, an
airplane may have lost all its engines, or it could be running out of fuel, filling up
with smoke, or starting a fire.

Due to these emergency conditions, the aircraft is losing its capability to

continue flying, or loss of control very soon is highly likely.
The Captain should anticipate this and fly a Controlled Arrival to an off-field
landing or crash-landing/ditching before losing control of the aircraft. The
purpose is to prevent an uncontrolled crash (UFIT).

It is essential to have full controllability of flight path and energy to the primary
impact point. After a primary (or secondary) strong impact, the airplane transitions
from displaying aerodynamic properties to a ballistic trajectory over which the pilots
have no control. If the engine(s) are operating, energy control should not be an
issue. However, if the engines are not operating, energy management will
determine forward and vertical speeds, vertical and lateral flight paths and aircraft
attitude at the impact.

29
--- Critical Emergency
Any situation that has the potential to suddenly destroy the aircraft on the ground
or in-flight. Examples are:
- Explosions, loud noises, fire, smoke, vibration, fuel or hydraulic leaks or other
indications perceived as threatening.

It is important to differentiate what is relevant from the inconsequential, or

the basics may be missed in a critical emergency.
When analyzing an emergency, find the facts and how the crew perceived them.
Note what individuals say (CVR) and what they do. Their actions disclose their true
convictions and will explain the development of the event. What they did indicates
what was perceived as the most important. Their actions express their priorities.
- Was this a Critical Emergency (as per the definition above)?
- Did the crew perceive the situation as a Critical Emergency?

--- Ditching
When a land-based airplane in which the flight crew, with the aircraft under control,
knowingly lands in the water (US Airways 1549).
The determining factor for a “Ditching” is for the aircraft to be under intentional
control. The time left for ditching preparations does not change the fact that it is
still a ditching.
It seems there is some disagreement in the definition of ditching, as stated on page
129 of the accident report of U.S. Airways 1549.
https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf

--- Off-field emergency landing

When an airplane lands safely on a landmass outside of an airport (TACA 110).

--- Crash-landing
When an airplane lands on a landmass causing substantial damage to the aircraft
and/or injury to its occupants.

--- Crash (CFIT or UFIT)

An inadvertent aircraft impact into the ground or body of water.

--- Negative or Positive Reporting Systems (RS)

When operating on a Negative RS, the assumption is that all is normal unless
otherwise notified. When working under a Positive RS, assumptions are tested
through confirmation.
Unfortunately, many flight procedures and practices operate on a Negative RS,
and operators should strive to always work under the Positive RS concept.
Note: - See Module 1, Part 4B “Aviation Manuals”.

30
Examples:
- After a rejected takeoff or a landing abnormal condition and in the absence of
further abnormal indications, the crew assumes the situation is stable and most
flights clear the runway. This is operating under a Negative RS.
In most cases, the airplane should stay on the runway until inspected by the
firetrucks and an evacuation is deemed unnecessary. Operating on a Positive RS,
the assumption that is safe to abandon the safety of the runway is verified by the
firefighters. (See Module 4, Part 2, “Stop on the Runway”)
- An engine malfunction without a fire warning - if an engine procedure is performed
without a fire test, the operation is being conducted under a Negative RS.
However, if a fire test is conducted, the operation that follows is being conducted
under a Positive RS. (See Module 7, Part 1, “Suspecting an Engine Problem”).

Intentionally Left Blank

31
 ACKNOWLEDGMENTS
Plan “B” grew from the accident reports that I studied during my piloting career,
from accident reports in which I was involved in and from emergencies that I
experienced. However, I might have never written this study if it wasn’t for the
inspiration and motivation of Captain Robert Thorson (FAA), who mentored me
for many years while I was the chairman of the Air Line Pilots Association safety
committee at United Airlines (NYC).

I am grateful to all of the highly professional crewmembers I flew and spent

many long hours during layovers as they contributed to formulating this book.

Thanks also to my friends Dr. Hillard Chemers, M.D. / A&P, Charles J. Levin
Esq., and Jessica Kirby, who read and helped correct the manuscript.

Thanks to Captain Carlos Mirpuri and his team, who helped with the Airbus
technical assistance. Captain Mirpuri is an owner, founder, and VP of a charter
airline. He is a pilot examiner on the A380, A350, A340, A330 and A320 aircraft.

Thanks to Ben Shipps, FAA designee check airman, for his contribution to
Modules 8 & 9. Ben is the chief flight instructor and owner of Brown’s Seaplane
Base in Winter Haven, Florida.

Intentionally Left Blank

32
 REFERENCES
Specific flight events are referenced from the respective accident reports, Captain
Irregularity Reports (CIR), or as specified at the beginning of the narrative.
Human Resources commentary is referenced from related accident reports and
the following books:
- “Deep Survival,” by Laurence Gonzales.
- “Shackleton’s Way,” by Margot Morrell and Stephanie Capparell.
- “Alive,” by Piers Paul Read.
- “Descartes Error” and “The Feeling of What Happens,” by Dr. Antonio Damasio.

Other Resources
Most events studied in this book have a link to the source.

Flight Safety Foundation: - https://aviation-safety.net

The link directs to the summary page and the Final Report link can be found
towards the bottom of that page. In some cases, the link goes directly to the official
report. If the Final Report has not been published yet (usually one to three years)
an interim, preliminary, or fact-finding report is usually available.

National Transportation Safety Board, NTSB:

https://www.ntsb.gov/Pages/default.aspx
This site may not be user friendly. However, as of October of 2020, the CAROL
system was implemented (Case Analysis and Reporting Online) but the search
engine needs upgrading.
https://data.ntsb.gov/carol-main-public/keyword-search

FAA: - https://drs.faa.gov/browse
This is a recommended link for regulatory research.

33
 NOTE FROM THE AUTHOR
On the 5 th of March of 1991, I was on my second day of teaching a CRM course
to Aeropostal, Linea Aeropostal Venezolana - LAV, in Caracas. The Director of
Operations interrupted the class to announce that LAV 109 was missing. LAV later
found the plane at the top of a mountain due to a navigation-related CRM issue.
All onboard lost their lives. In a small airline of 18 DC9 aircraft where everybody
knows each other, this brought a somber mood to the class.

During the lunch break, a LAV Captain asked me if pilots performed stalls during
maintenance test flying at Continental Airlines (my employer). I told him we did not.
I mentioned that since the UK certification accidents* actual stalls were abandoned
to accept calculated and wind tunnel data. The British CAA concluded that a swept-
wing airplane with T-tail-mounted engines was not likely to recover due to wing-
blanking of the engines and the stabilizer.
He informed me that he would always test-stall the aircraft on those maintenance
flights. I advised him to consider the resolution from the CAA, which sounded very
prudent, but I did not think of anything else to say.
* - BAC-111 prototype 1963-10-22.
This accident gave origin to the term “deep stall” when the wing blanks the
stabilizer, and the plane remains in a stable stall.
- HS-121 Trident prototype 1966-06-03.
Super stall, 30° to 40° angle of attack followed by a spiral stall.

Without knowing it, we had discussed his future fatal accident.

Two years later, during a test flight on 1993-04-02, this Captain initiated a stall
above 20,000 feet from which he did not recover. The three crewmembers and the
eight mechanics onboard lost their lives.

This accident made me rethink our role as instructors, and I realized that it is not
enough to relay information. We must explain the reasoning behind the
procedures, the concepts, or it will not generate conviction (I expand on this matter
on M1P4, Training). This accident became the seed for this study.

This book is dedicated to all aircraft accident victims, past and future.
They lose their lives needlessly, daily.

I intend that this book will reduce the number of future accidents.

34
 ABOUT THE AUTHOR
Captain Luis Vireilha is a magna cum laude graduate of the Master of Aeronautical
Science program from Embry-Riddle Aeronautical University, Daytona Beach,
Florida, 1983.
He took specific training in aviation accident investigation and prevention practices,
techniques and procedures, and since 1990 he has specialized in incident and
accident prevention.

United / Continental Airlines

He joined Continental Airlines in 1983 (which later absorbed United Airlines and
adopted its name) and has over 22,000 flight hours of which over 18,000 are in
command, having flown as Captain since 1986 on the following aircraft:
B747, B777, DC10, B767, B757, B737, B727, DC9-80. Instructor pilot (ASME-IA)
He holds commercial ratings in seaplanes, helicopters and gliders.
Operational areas: North Pole, N. & S. Pacific, Asia, Middle & Far East, N. & S.
America, Caribbean and Europe.

35
Flight Emergencies - The Seminar
He retired from United Continental airlines and now continues his safety work
teaching the seminar “Flight Emergencies.” He has been a guest commentator on
CNN and other TV and radio stations covering major airline accidents.

Airline Pilot Training Center

He owned, and operated as chief flight instructor, Airline Pilot Training Center in
Miami, Florida, from 1980 through 1983. This center, trained ab-initio pilots to a
commercial and flight instructor level, with instrument and multi-engine ratings. He
was also a simulator instructor for Flight Safety in Lakeland, Florida.

Lloyd Aéreo Boliviano / TransBrasil Airlines

- In 1979, he joined Lloyd Aéreo Boliviano as a B727 First Officer, flying
internationally from the highest runways in the world.
- His experience with airline operations started in 1976 as a Flight Engineer with
TransBrasil Airlines on the B727.

Portuguese Air Force

- He started his flying career with the Portuguese Air Force in 1971, learning to fly
in the T6 Harvard.
- This was followed by a position with Lider Taxi Aéreo, as a helicopter pilot in the
Amazon jungle, flying the Sikorsky S58-T and the Bell Jet Ranger 206B and by a
position as a bush pilot, in South West Brazil, flying twin-engine planes.

Additional work experience

- He was responsible for the translation and adaptation into the Portuguese
language of the FAR’s old part 400 (22 volumes) for the Civil Aviation of Angola,
INAVIC, Instituto Nacional de Aviação Civil de Angola, 2007-2008.
- DC9 / MD80 simulator instructor and route advisor for Aeropostal - (Linea
Aeropostal Venezolana). Responsible for writing and updating several sections of
the emergency procedures manual for Aeropostal, 1990-1991.
- Wrote and maintained a simulator review and preparation guide for the B747,
B757, B737 and DC-10, 1991- 2003.
- Since 1990, he devised the curriculum and leads seminars for airlines and
corporations worldwide on the following subjects:
• Flight Emergencies (Plan “B”).
• CRM and Threat & Error Management
• Cabin safety instructor
• North Pole, Pacific and Atlantic procedures.

36
 MODULE 1 - DECISION MAKING

PART 1 - CRM & TEM

“Those that resist it are the ones who need it the most.”

CRM = Crew Resource Management

TEM = Threat and Error Management

CRM has existed for over 60 years, yet CRM-related accidents keep reoccurring
for the same causes. Although this module is not a CRM/TEM refresher, it
introduces new concepts such as a “Mental Model” plan of execution and “Active
Monitoring” and highlights critical aspects.

--- History
Accidents were usually a complete mystery before developing Flight Data
Recorders (FDR) and Cockpit Voice Recorders (CVR). Investigators would arrive
at an accident scene only to find burnt debris, which the forensics of the era could
not decipher. It was thought that human factors caused some accidents. In the late
‘60s, British European Airways (BEA) was the first to develop a “Confidential
Human Factors Incident Reporting Program,” later adopted by the CAA & NASA
and by United and Continental Airlines in 1985 and then by other US carriers.
CRM/TEM concepts are expanding to aviation on different continents and even
into the medical field. However, it is in its infancy in many parts of the globe.

--- BEA 548 - HS Trident - Heathrow 1972-06-18

https://en.wikipedia.org/wiki/British_European_Airways_Flight_548
Video: https://www.youtube.com/watch?v=vvYC-BdPfLQ
This Hawker Siddeley Trident crashed during takeoff at Heathrow. The aircraft was
equipped with a Flight Data Recorder (FDR) but not with a Cockpit Voice Recorder

37
(CVR). It was suspected that this was a human factors accident, which prompted
the requirement for CVRs on board airliners.

The FDR defines what happens, and the CVR discloses why, which allows
documenting that many accidents are caused by human factors such as
personality, attitude issues and distractions from flying duties.

A sequence of human factors accidents* led to developing a training program in

the USA in 1985, Cockpit Crew Concepts (CCC), the origin of CRM.

* Related Accidents:
--- KLM 4805 & PAN AM 1736 - Two B747 - Tenerife 1977-03-27
https://en.wikipedia.org/wiki/Tenerife_airport_disaster
Video: https://www.youtube.com/watch?v=JIGCYUkRRLI
KLM Captain’s haste during takeoff causes collision on the runway (583 fatalities).

--- Western 2605 - DC10 - Mexico City 1979-10-31

https://en.wikipedia.org/wiki/Western_Airlines_Flight_2605
Captain’s history (of ignoring crew input) and the CVR data indicate the other two
pilots stopped advising the Captain and allowed him to fly an approach to a closed
runway, resulting in a collision with the terminal building (73 fatalities, including the
three pilots).

--- SAS 933 - DC8 - Los Angeles 1969-01-13

https://en.wikipedia.org/wiki/Scandinavian_Airlines_System_Flight_933
Distraction with landing gear light indication causes controlled flight into the ocean
on final approach (15 fatalities).

--- Eastern 401 - L1011 - Miami 1972-12-29

https://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_401
Distraction with landing gear light indication causes controlled flight into terrain (99
fatalities).

--- United 173 - DC8 - Portland 1978-12-28

https://en.wikipedia.org/wiki/United_Airlines_Flight_173
Distraction with landing gear light indication causes fuel exhaustion (10 fatalities).

Crew Resource Management (CRM)

CRM indoctrinates flight crews in resource management principles, emphasizing
the merits of shared management for Captains and assertiveness training for other
crewmembers.
CRM breaks down communication barriers. It raises the awareness that pilots and
flight attendants have the right and the duty to speak their minds to the
Captain and their management (chief pilots and F/A supervisors).

38
In a broader spectrum, all aviation personnel (flight and ground) must be one
team with the same goal: - To do their best to ensure each flight’s safety.
“It’s not my job” has no place in aviation where the consequences are high.

CRM encourages a team to devise a shared solution instead of conflicting

individual solutions.

--- Problem Solving

When the perception of a problem is different between people, each works on their
perception, and the actual issue may not get addressed. Different priorities are
assigned to each of its components depending on everyone’s perceptions,
feelings, or interests. These differences may not be noticeable, and only good
communication allows for recognizing these discrepancies. Be aware of this threat
when communicating remotely with the company or the aircraft builder.

On the other hand, crews in-flight work in close quarters and give immediate
feedback, promoting creativity and faster and better-structured resolutions.
For this reason, it is fundamental to create and maintain communication lines open
and active (CRM). Without good communication, crews will be trying to resolve the
problem alone, using time on the perceived issues, which may not be the decisive
ones.
Note: - Be cautious when deliberating an issue with the crew if all agree; something
might be missing. There is a reliance on each other and an expectancy that all
aspects are considered in a team. Working on solutions individually and then
presenting them to the group for assessment (more options are evaluated) may
uncover an otherwise missing opportunity. This method is more appropriate when
deliberating a decision on the ground before the flight.

CRM is the foundation for Threat and Error Management.

CRM has not been successfully implemented in countries where the culture
segregates gender or social equality is not supported.
CRM cannot change the culture of a country or its division of social classes.

Airlines from these countries do not have an “Effective Safety Culture.” Their
employees are routinely overworked, and some accidents reflect crew fatigue. A
simple go-around with an airplane in good mechanical condition can result in a
crash.
When a crew works under the guidelines of these cultures, they are not a team
capable of achieving the best possible outcome from an emergency.
As passengers, we should avoid these airlines. Their marketing advertises
excellent cabin service, but that is not a passenger’s top priority. Arriving alive and
well is. We do not buy a book for its cover.

39
--- Threat & Error Management (TEM)
The Threat Management component of TEM identifies threats and develops
strategies to manage those threats.
Error Management catches errors once they occur and corrects them to return to
safe operations.

Slide 1 can typically be found in aviation manuals. It assumes we start with “Safe
Operations,” and when presented with a threat, we prepare through CRM/TEM to
return to Safe Operations.

Slide 2 has been modified to reflect the ideal scenario as I see it. It assumes that
preparedness must exist before operations can be safe and before
encountering a threat. The “Prepare” condition has been replaced with “Manage.”
If a crew is not prepared before encountering a threat, they will not recognize it
correctly or manage it appropriately.

But what does CRM/TEM do when the crew is in agreement, and the incident
still occurs? This is studied in Parts 4 through 8 of this Module.

Intentionally Left Blank

40
 PART 2 - CREW RESOURCES
“The number one resource is our knowledge and
general preparedness to deal with critical situations.”

Aircraft non-normal events or medical events allow time for consultation with the
company, aircraft manufacturer, Med Link or other external sources. But
emergencies can become time-critical; do not waste your safety margin (time and
fuel) communicating with someone who cannot help you.

--- Deadheading employees

Airlines should have a standard policy that pilots, mechanics and flight attendants
when traveling in the passenger cabin, should introduce themselves before the
flight with their seat number to the Captain and Cabin Chief. They can become an
additional asset during an emergency. Some crewmembers introduce themselves
out of courtesy, but not most, and a valuable resource is lost.

Notification to the working crew of the qualified personnel on board

should not depend on self-initiative and should be SOP by all airlines.

--- Continental 208 - DC10 - Houston 1998-12-25

Based on the Captain’s Irregularity Report (CIR). See narrative on M7P2.
Capt. Vireilha was the pilot in command (PIC).
On this Christmas Day, the entire cabin crew was on their first flight after
graduation a few days prior. During takeoff, an engine fire was followed by an
immediate return for landing. As could reasonably be expected, there was much
confusion during the execution of the cabin crew’s procedures. Although there was
a deadheading crew in uniform, they did not offer assistance, and my cabin crew
did not ask for help either.

After this incident, I became aware of a policy in some airlines: - A F/A with less
than one year of experience must be paired with a more experienced F/A when
forming a crew. This prevents having more than 50% of junior attendants in any
crew and prevents two junior attendants from being responsible for one aircraft
zone. This is an excellent safety policy.
How does this compare to your company procedures?

--- Air Traffic Control

To relieve crew workload during emergencies (task shedding), ask ATC for:
- Local weather.
- Change of runway to accommodate the most straight-in approach (critical
emergency).

41
- Change of missed approach to better accommodate aircraft needs. It is
customary in the simulator to fly runway heading to 2,000 feet to expedite training,
but this may not be ideal during an emergency.
For example, consider the advantages of flying a 360º turn close to the
runway threshold, should the aircraft be dealing with smoke, too fast or too high
for landing (see CO 208 Houston M7P2 & CO 84 Rome M7P2).
- Ask ATC to advise the company about your situation.
A Captain should inform his needs, and ATC will do their best to accommodate the
emergency aircraft. However, controllers may not know how to best deal with your
needs due to a lack of experience or training (see CO 871 M1P7 and CO 1593
M6P4). Be prepared to tell the controller what you need them to do for you.
On the other hand, they may be of exceptional help (see CO 84 Rome M6P4 and
United 328 M7P1).

Crew Briefing - Before Boarding

--- The Preflight Crew Briefing is an opportune time for a Captain to show his
support in bringing down any barriers.

- Display a unifying attitude. Plan on how to address the usual divisive issues in
your company should the crew question you on them.
- Be honest, fair, and knowledgeable, and your crew will trust and follow you.
- Trust is fundamental when making decisions during an emergency.

Your coworkers will well accept a relaxed yet highly professional atmosphere.
Conduct the briefing calmly and transition from the everyday person we are to the
crewmember we must become, ready to battle for the safety of our passengers
and crew (and our very own)! - Be a take-charge Captain; stand up for our duty.
(We voluntarily accepted a responsibility towards our passengers and crew when
we became crewmembers. They trust us and expect that we always do the right
thing).

Captains must create an atmosphere that invites, promotes, and is genuinely

receptive to the crew’s comments. Best solutions may not necessarily come from
the leader but from an environment that encourages the best ideas to emerge.
A leader’s job is to create that welcoming environment.

- All individuals must be willing to abandon ego and bias to make the best choices.
Captains will listen to crewmembers and make their decisions based on the safest
course of action. Once a decision is made, crewmembers must genuinely support
the Captain even when the decision may not be the most well-liked.
Safety is about what is right and not who is right.

42
- The briefing creates the opportunity for the crewmembers to develop a feeling for
each other, team building, and for the Captain and Cabin Chief to choose an
effective management style.
If your crew is:
- Inexperienced
Be prepared to “assist” more than usual and do not rush them. Describe clearly
what needs to be done but avoid turning the flight into a stressful training session.
- Experienced and competent
Share information and workload.
- Crew more experienced than you in specific tasks
Delegate those tasks and observe.

Here are some points you may want to include in the Preflight Briefing:
- Aircraft discrepancies from maintenance log.
- Flight time, departure delays, turbulence (coordinate meal service).
- Reassure the crew of your support if they have issues with ground personnel or
passengers.
- Brief any emergency items as necessary (for example, “Crew Check Cabin”
further discussed in M6P3, and “SOB” discussed in M3P3).

Team divided by the cockpit door

Teaching Plan “B” to different cultures in different continents, I found many airlines
to differentiate between the flight deck and the cabin crew. When this disunion
exists, crews tend not to support each other, which is disruptive to safety. We are
one team in one airplane, sharing the same fate.

This is not the ideal culture for CRM to flourish between crews. Western 2605
(above), British Midland 92 and Saudia 163 are good examples of what can
happen when crews are not working together.

--- British Midland 92 - B737 - E Midland 1989-01-08

https://reports.aviation-safety.net/1989/19890108-0_B734_G-OBME.pdf
See more details on M2P4, M7P2.
The aircraft was experiencing a left engine fire. Since it was at night, the flames
were visible in the aft cabin to three of the six flight attendants. The flight attendants
asked the cabin chief to advise the Captain. He did not like this Captain and
would not speak to him. There was a delay while the flight attendants deliberated
what to do. In a rigid hierarchy system, there was hesitation to bypass their chief
(early CRM and culture). Finally, one F/A went to the cockpit and reported the fire.
By then, the pilots had mistakenly shut down the right-side engine. The left engine
on fire failed on short final, and the aircraft crashed short of the runway. 47 of the
126 people on board lost their lives.

43
 Debriefing
Additionally, inform the crew that if the flight encounters a non-normal event, there
will be a crew debrief after landing. The crew will be more open and receptive to
the debriefing, especially if the pre-departure briefing established the right tone.
Immediately after dealing with a non-normal or emergency (before leaving the
airport), debrief the crew:
- What happened and how did we perceive it?
- What procedures were used and how effective were they?
- What could we have done better?
- What else happened?
Start the debriefing by stating that the intention is to understand what happened
and what changes need to be made (and not to search for or assign blame). When
speaking to the crew, include yourself as part of the team by using the word “us”
instead of “you.”
This approach will help prevent the crew from becoming defensive.

PART 3 - HUMAN ERROR

“The absence of accidents does not necessarily
Indicate the presence of safety.”

Human error does not necessarily mean pilotage error. Studies indicate that most
accidents are initiated by errors from regulators, aircraft manufacturers, airline
management, maintenance or training. Pilots become involved in an accident as
the last link in a sequence of events.

--- Safety & Risk

Aircraft operate continuously in failure mode. Most failures are small, but they are
signs of more significant failures that must eventually happen. An accident not
happening is no guarantee it will not happen, and things that have never happened
before, happen all the time.
Safety is not about engineering risk to zero. Therefore, striking a balance between
safety and risk is challenging. Understanding the risks is vital to seeing the value
of safety; it is not intuitive. Improvements require a sustained effort in partnership
with the right people, and safety improvements need to be tied to profits, or they
will be a difficult sale, a difficult idea to push through.
A firm commitment from senior management is vital in creating a safety climate.

Safety Culture
Formerly, a corporate CEO’s objective was primarily to make money for the
shareholders. They now must be socially conscious as well. When the corporation
is an aircraft manufacturer or an airline, the CEO’s first duty and responsibility is

44
to provide safe public transportation. In seeking profits, the CEO must ensure he
causes no harm.

Every airline management states that their operating priorities are:

- Safety, Comfort, Schedule, and Efficiency. However, many operate in the
reverse order, placing cost-efficiency first, followed by on-time operations and
passenger comfort (which are visible to the flying public) and safety last (difficult
to evaluate and not apparent until an accident).

Safety Filters
Safety starts with good design in aircraft, airports and airspace. Regulators, aircraft
builders and airline management are the primary safety filters. Threats must be
foreseen or identified and addressed here, the first line of defense, or they will go
on to become operational problems.
If the first line of defense fails, then Maintenance & Engineering, the second line
of defense, needs to find and fix the problem before it becomes an in-flight
emergency and possibly a loss of life event.
When there is an aircraft accident, there is a tendency to focus on what the pilots
did or did not do, minimizing the role of the safety filters that should have prevented
the occurrence in the first place.

First line of defense

A. Regulatory Agencies (requirements and guidelines).
B. Aircraft Builders (operating limitations and procedures).
C. Airline Management - Flight Ops, Maintenance and Dispatch (policies).

Second line of defense

D. Maintenance (Shop and Line) – This is the last chance to find and fix an
issue before it becomes an in-flight failure and possibly a fatal event.

Last line of defense

E. Flight Crews (Pilots and Cabin Crew) - Fight for survival.

If an issue passes these lines of defense

it results in an aircraft accident

Note on Government Agencies

The civil aviation authority (of each country) has regulatory and enforcement
authority; however, high-level political interference commonly precludes them from

45
functioning as they should. They are also understaffed at the inspector level and
underfunded.
In the US, the NTSB covers all forms of transportation, from pipelines to
aerospace. They make safety recommendations to federal and state agencies,
transportation providers, and manufacturers, which may or may not choose to
implement them. They are the smallest US government agency with just over 400
employees covering global operations.
Most countries do not have a Transportation Safety Board. Accident investigation
in these countries is delegated to the police or the military, treating them as a crime
scene. The inquiry focuses on assigning blame instead of accident prevention,
usually resulting in prison sentences.

SMS - Safety Management Systems

“The aviation industry has in the past been comfortable maintaining a reactive
position to safety regarding occurrences as isolated incidents, and consistently
taking action only when accidents happen. This attitude gradually became more
calculated, growing into a regulatory system and developing a bureaucracy to
enforce it.
The introduction of SMS is shifting the focus from enforcement-centered to a more
proactive approach and hopefully will give rise to a culture of safety so firmly
established that the perception will be that safety is simply the best, most effective,
and most profitable way to do business.” *
* Flight Safety Information Journal (Oct. 2008)

SMS provides a systematic way to identify hazards and control risk while ensuring
that these risk controls are effective. An implied moral and ethical obligation is
placed on an employer to ensure that work activities are safe and that
management can be held accountable. SMS can heighten the conscientiousness
of guilt of the individual.
Safety Culture is the organizational commitment to safety at all levels of operation,
starting with senior management.

For SMS to work and remain effective, the aviation industry needs to create a
culture of safety.
Development of an “Effective Safety Culture:”
- Data to identify risk >
> Diagnostic data that show the nature of the threats and the types of errors
occurring >
> Preventive / corrective action >
> Measure effectiveness (we only manage what we monitor) >
> Additional preventive / corrective action.

ICAO elements of an Effective Safety Culture

- Role of Senior Management:
- Placing a strong emphasis on safety.

46
- Understanding the hazards within the workplace (leading to incidents/accidents).
- Fostering a climate that encourages feedback.
- Accepting criticism and openness to opposing views (management may be
uncomfortable soliciting and responding to negative feedback).
- Creating clear lines of reporting to facilitate effective and useful communications
regarding safety issues and highlighting their importance.
- Promoting realistic and workable safety rules.
- Ensuring the staff is well educated and trained so that the consequences of
unsafe acts are understood (provide the necessary tools).

In an effective safety culture under SMS, human error is seen as inevitable. The
focus is shifted from a reactive to a proactive method of managing risk (predicting
and preparing for the next possible incident).

Senior management needs to:

- Commit to taking action to reduce risk-inducing conditions.
- Build trust and establish non-punitive reporting systems. Lower-ranking staff
members may be difficult to convince that reporting honestly will not generate
consequences (safety can only flourish in a just culture).
- Promote training in threat recognition and error avoidance and management
strategies for crews (CRM/TEM).
- Promote training in evaluating and reinforcing threat recognition and error
management for instructors and evaluators.

Management Errors
Aircraft on the ground do not make money, and balancing safety and profit is
difficult, but when management gets it wrong, it is at the peril of those on board.
Management is a source of in-flight emergencies. They are profit-driven and
control the operating policies. They pay special attention to on-time departures and
arrivals, clean aircraft and pleasant employees, all visible to the customers.
However, they will defer other not-so-visible (and costly) items to prevent a
departure delay (maintenance, for example).

--- United 61 - B777 - N. Atlantic 2011-06-22

(Based on the CIR. Capt. Vireilha was the PIC).
Approaching NE Canada, there was an aft galley fire. Food grease had
accumulated over time in-between ovens and ignited when the oven was in use.
The mechanic who released the flight from Newark wanted to clean the ovens
before the flight; however, he was instructed by his management to defer the item
until the aircraft’s return to base not to delay its departure.

47
--- Space Shuttle Challenger - Florida 1986-01-28
Presidential Commission Report:
https://history.nasa.gov/rogersrep/v1ch5.htm
https://en.wikipedia.org/wiki/Space_Shuttle_Challenger_disaster
O-ring seal failure results in the explosion of the spacecraft during launch. The
minimum temperature for the launch was 53ºF, the actual temperature was 36ºF
(it had been cooler overnight making the O-rings harder). The launch was ordered
by management despite the strong opposition of five engineers.
This accident was the birthplace of SMS in the US.

--- American 96 - DC10 - Detroit 1972-06-12

https://en.wikipedia.org/wiki/American_Airlines_Flight_96
Cargo door failure. As the pressurized air from the passenger cabin escaped to
the lower cargo, the cabin floor deformed and affected the flight controls. Because
the airplane only had 67 passengers, the bearing of their weight on the cabin floor
caused partial loss of flight controls, and the plane landed safely. Douglas knew of
the faulty design before the aircraft was certified. After this event, the FAA
recommended cargo door placards to be installed.

--- Turkish 981 - DC10 - Paris 1974-03-03

https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981
Turkish 981 suffered a cargo door failure at the same cabin pressure differential
as the previous accident with American 96. However, because the aircraft was full
of passengers, their weight on the cabin floor caused it to collapse with a complete
loss of flight controls (346 fatalities). The baggage handler, who could not read
English-language cargo door placards, was blamed for the crash.

--- United 811 - B747 - Honolulu 1989-02-24

https://en.wikipedia.org/wiki/United_Airlines_Flight_811
(See more details on M5)
A cargo door failure caused an explosive decompression when passing FL 225.
Nine passengers were ejected from the plane. Although the cargo door design is
identical to that of the previous DC10 accidents, the FAA took no corrective action.
Boeing also did not take appropriate corrective action after a similar failure with
Pan Am 125 - B747 - London 1987-03-10.

--- Swissair 111 - MD11 - Halifax 1998-09-02

https://en.wikipedia.org/wiki/Swissair_Flight_111
(See more details on M6P4)
Cockpit fire. Flammable mylar insulation had not been banned despite two
previous similar fires with no casualties (229 fatalities on SR 111).

Both aircraft below were lost due to marketing cost savings and a deficiency in
pilot training (346 fatalities).

48
(See more details on M11P4 and M13P1 Runaway Stabilizer).
--- Lion Air 610 - B738 Max - Jakarta 2018-10-29
https://aviation-safety.net/database/record.php?id=20181029-0

--- Ethiopian 302 - B738 Max - Addis Ababa 2019-03-10

https://aviation-safety.net/database/record.php?id=20190310-0

--- Airline Management - Pilot airline-owners

Self-promoted Captains and Unchecked Egos
Management may look at safety issues with detachment; their lives are not at risk,
and criminal prosecution of corporate management is non-existent. They may view
events as - “It won’t happen, what are the chances? And even if it did happen what
would be the worst-case scenario?” (Insurance coverage).
On the other hand, flight crews (the last line of defense) know that things can
happen and may not have a way out. It may cost them their lives.

However, pilots with a financial interest in their company (pilot-owners) may adopt
management’s point of view.
Events indicate that some pilot-owners are more inclined (than pilot-employees) to
place corporate profits before their Captain’s duties. This influences their
judgment, making them unsafe pilots. There is an additional factor, which is the
path a pilot follows to become an aircraft commander.
When a pilot is an employee of a major airline, there is a selective evaluation
process before qualifying or upgrading. The individual’s past and current
performance during training is reviewed and any shortcomings will be trained to
proficiency. An evaluation of his knowledge, skill and decision making by several
simulator and line instructor pilots and any training remarks will be analyzed. This
may result in having to repeat a maneuver or the simulator ride, retake the course
or delay the upgrade from 90 days to one year to gain experience.

Most importantly, egos are questioned. Character and CRM team spirit are
observed and guided. Any reservations in this area could result in permanent
exclusion to upgrade or career termination. The airline training department and its
instructors are not motivated to pass a pilot, which may cause a crash, the end of
the airline and their careers.

When a pilot is part owner, the above steps do not exist. The pilot-owner
leases aircraft from a company. The training is included in that package (or a pilot
can also buy the type rating from another training facility of his choice). Either way,
he is welcomed as a customer. These training facilities do an excellent job at
teaching how to operate an aircraft, but a pilot’s unsavory character and ego will
not prevent him from obtaining the rating. His behavior will go forever unchecked.
The pilot-owner assigns himself as pilot-in-command and proposes to the Civil
Aviation Authority that he become the company’s check airman designee. This

49
process is routinely approved, and if the pilot does not meet the minimum time
criteria as per the regulations, a waiver is then issued. It is up to the pilot to
establish and follow his safety boundaries, but his limits are limitless if he has an
ego (see LaMia 2933).

The Aftermath
Insurance companies cover aircraft at replacement cost. Each passenger’s life has
a liability cap in the USA (after the Lockerbie Pan Am 103 crash 1988-12-21 when
families received upwards of five million dollars per passenger). In emerging
countries, compensation can be as little as ten to twenty-five thousand dollars per
passenger. The insurance network covers these costs too.

Ticket sales drop for a few days and are back to normal within one week. The
written-off older aircraft is replaced with a new one, which may turn an accident
into a profit for the airline. The result may be a disincentive for some management
to pursue safety matters.

--- Our Acceptance of Risk (our role in incidents)

People accept a certain level of risk and seem to be comfortable maintaining that
same level as conditions improve, for instance:
The development of antilock brakes on vehicles did not reduce accidents, as
drivers felt safer and increased driving speeds.

Developing more powerful aircraft engines allowed shorter, safer takeoff distances
(more runway to stop on a rejected takeoff). Subsequent implementation of
reduced power takeoffs reversed that safety benefit, increasing takeoff distance to
the previous values in favor of lower costs of longer engine time-between-overhaul
(TBO).

The question is where to draw the risk tolerance line,

and the answer lies between necessary and unnecessary risk.

--- Mohawk 40 - BAC111 - Blossburg PA 1967-06-23

https://en.wikipedia.org/wiki/Mohawk_Airlines_Flight_40
The aircraft logbook had several entries:
- Low duct air pressure when supplied by APU
- APU EGT high with both packs on
- APU will not hold both packs
- APU Gen trips when both packs on
- Excessive duct air pressure (dismissed by MX and attributed to defective gauge).
In-flight, pilots commented on pneumatic system indications. Then they informed
ATC of “having a little control problem,” followed by a struggle to maintain control
and loss of pitch control, placing the airplane in an irrecoverable dive.

50
Engine bleed air flowing back through a malfunctioning non-return valve, through
the APU, and exiting into the plenum chamber caused the acoustic linings to ignite.
Fueled by hydraulic fluid, the fire progressed up into the vertical tail fin, causing
the loss of integrity of the empennage.

This aircraft had too many related write-ups nonetheless, it was dispatched under
MEL placards. If there is doubt about the safety of a flight, we should not accept
the risk. The Captain would have been fully justified to refuse this aircraft.

Without finding the actual cause and extent of the problems,

we cannot understand or anticipate the consequences.

--- Continental 140 - DC10 - LAX 1999-01-26

(Based on the CIR. Capt. Vireilha was the PIC).
As flaps were lowered before takeoff, an asymmetry was noted between the
outboard flaps, the right side indicating 3.8º less than the left. Flaps were recycled,
and the same asymmetry was present; however, the indication was normal when
selecting takeoff flap from the full flap position. Approaching the runway, I pulled
the aircraft to the side of the ramp, and maintenance drove to the tarmac to check
on the plane. We were communicating via the ground crew interphone with the
aircraft doors closed. The mechanics measured the flaps and confirmed the flaps
were symmetric while indicating an asymmetry by the cockpit gage. Maintenance
attributed the problem to a defective gage, but I wanted further troubleshooting.
However, both my F/O and S/O lived in LAX and wanted to fly our last leg to NY
to catch their commuting flight back to LAX. They were in a hurry to takeoff. As the
flap indication was normal (by selecting takeoff flaps from the full flap position),
and with the assurances from maintenance, I decided to proceed with the takeoff.

Before takeoff, I briefed the F/O (flying pilot) that if the airplane encountered a
rolling tendency at liftoff, correct with rudder instead of the normal tendency to use
aileron. As an example, I mentioned to the F/O the recent United 863 incident.
As the plane became airborne, the right outboard flap retracted, causing 3.8º
asymmetry with a subsequent roll to the right. The F/O corrected as briefed.

Later we found out that the gage was accurate. The outboard flaps move by cables
coupled to the inboard flaps. Slack in these cables caused the asymmetry.
As the aircraft logbook was not accessible to the mechanics unless I returned to
the gate and this gage cannot be placarded inoperative, maintenance would have
to take the time to resolve this issue. This incident is another example of
unnecessary acceptance of risk, perhaps because of get-there-itis and our
predisposition to a can-do attitude (typical of flight crews).

51
--- Maintenance and Flight Crew Errors
Mechanics, like other highly skilled professionals, take pride in doing their job right
every time. However, they are under pressure from management to return aircraft
to service to meet scheduled departure times. This results in deferred or
misdiagnosed troubleshooting, which leads to in-flight failures and emergencies.

It does not matter how well an aircraft is designed and flown

if it is not maintained well.

Flight crew error is common human error and is to be anticipated. It is usually the
result of not catching and correcting a problem, often due to a lack of awareness
about the subject. Over-reliance on automated and safety systems and ineffective
systems are also common causes of pilotage errors (better definition than pilot
error).

An aircraft preflight (performed by maintenance or flight crew) cannot detect

underneath the aircraft’s skin. Only proper maintenance can give reasonable
assurances.

--- Air Traffic Control Errors

ATC errors have directly caused or contributed to fewer accidents than other
groups.
Some controllers (worldwide) may have unrealistic expectations of the flying
environment, such as time constraints and aircraft operational characteristics,
especially during emergencies. The regulators can improve these conditions by
scheduling joint training with pilots and cockpit jump seat flights.
Others seem to have a very realistic understanding of the environment resulting
in outstanding performance (i.e., United 328 DIA and Continental 84 Rome).

Intentionally Left Blank

52
 PART 4 - TRAINING
“Chance favors only the prepared mind.”
Louis Pasteur

Technology, environment and culture are constantly changing, and safety

departments no longer have Research & Development staff to find or foresee
threats and develop solutions. Their scope is mainly limited to regulatory
compliance. R&D has been diminished, and the repetition of the same incidents
indicates the need for a significant overhaul in training.

Automation was intended to reduce workload and allow pilots to perform their
tasks more efficiently, especially during emergencies. However, when a risk area
is improved, unintentionally, risks move somewhere else, creating new and
unexpected threats. Automation created a new spectrum of accidents that did not
exist before, and training needs to catch this evolution.

As technology advances, the human-machine system needs to be reorganized to

enhance each other instead of operationally interfering with each other. Poorly
designed systems lead crews to make mistakes.

- Inadequate training for flight crews in failure scenarios is commonly cited in

accident reports. It is common to hear that the industry learns from accidents, and
recommendations are made so they will never happen again. Unfortunately, very
little of that becomes a reality. Accident investigations may discover the cause of
the accident but learning only occurs when we change behavior.

(A) - The Problem is the Training

--- Before proceeding, please see the following videos. The first is a three-
minute presentation by the Director of Military Instruction, West Point.
The second is a one-minute illustration of the same concept.
Video 1: https://www.youtube.com/watch?v=0_u8sF1sW4A
Video 2: https://www.youtube.com/watch?v=WkT0BtfOB-M&t=2s
Throughout this study, we will observe that this concept relates well with training
practices and resultant pilot behavior during non-normal events.

See video at Time Stamp 56:50 David Learmount’s commentary on training.

Video 3: https://www.youtube.com/watch?v=XAom93qwoN0

53
 Crews repeatedly follow procedures without understanding the reasoning
or questioning why.

--- Why?
Kids repeatedly ask why, and adults respond - because that’s the way it is. The
motivation to think deeper may stop here, blocked at an early age. People grow up
accepting the existing-conditions, and changes only occur when the need forces a
change. The problem with training is not unique; it is common in every aspect of
our lives and is part of the culture.

Except for a few changes, training departments are still training in the same way
they did in the past, and the same accidents keep reoccurring. The flight crews
tend to be blamed for them, and the training inadequacies go uncorrected.

--- AQP and Classroom Training

In the older traditional classroom environment, crews were indoctrinated on what
the checklists items and procedures aimed to achieve. There was time for
discussion and considerations on managing an emergency (evaluating options,
reordering priorities). Crews understood the topics covered in the checklists, and
they could quickly select what was relevant to accomplish if the need occurred.
The implementation of AQP (Advanced Qualification Program) allowed for a
substantial reduction in training (and knowledge). This left crews to act on their
interpretations and beliefs (not on factual data).

Going through training is like learning how to use all the tools in a toolbox. But
during an emergency, we should only use the tools needed and not all the
tools we could. Anything more than necessary uses time that may cost lives.

The crew’s response needs to be faster than the emergency, yet correct,
which requires the procedure* to be simple and remembered.
* Good checklist working knowledge is necessary.

In an emergency, crews revert to their training (habit-based) and tend to behave

as if they were in a simulator. Still, an emergency is not a training event, and the
transition to the real world usually does not occur. Sensible decisions that apply to
the situation are bypassed, and the safest course of action is not executed.

Most emergency flights land successfully, and some accidents cause few or no
fatalities, being characterized as miraculous despite the relevant pilot actions
not being performed. In most cases, success is linked to survival which was
coincidental. How would these events be viewed if the event had caused the loss
of all on board?

54
Current training is habit-based learning (following procedures) and is inflexible.
Yet, flexibility is the key to adapting procedures and transitioning from the
training environment to the real world.

Intelligent individuals make unrealistic decisions because training removes

the emphasis on thinking. Without thinking, one cannot act appropriately.

- In the training school, it is customary to hear that you cannot teach people to
think, but I believe you can by providing what to think about - the “outside the box
knowledge” (Plan “B”).
What we think about, can become our words and actions, which influence and lead
our crew's activities, resulting in an outcome.

--- Thinking outside the box

Training departments manage compliance to training requirements and
regulations. This standard training provides good mechanical and basic cognitive
skills. Outside of this “training box,” there are other areas of knowledge and more
complex cognitive skills. However, expansion to those areas is restricted by the
airline training budget or the profit margin if the facility is a corporate training center.

This expansion of knowledge and thought is called “thinking outside of the box,”
and it involves two components:
- Acquisition of the less-known knowledge (through incident and accident reports).
- Making sense of this data and understanding the relationship between unrelated
ideas (see Connecting the Dots, M1 P5A).

Standard training does not expand into these areas, and they need to be reached
by self-direction. Autonomy is a more engaging approach and a great motivator. It
depends on the individual crewmember to develop such resourcefulness.

Having to think outside the box to resolve a problem indicates the training box is
missing information. Training departments should expand the coverage for today’s
environment instead of accepting preestablished conditions of decades ago
without reevaluation. The toolbox should not be missing the tools.

- Task-shedding - Training needs to provide checklist working knowledge so

crews can efficiently task-shed. This means selecting which procedures are
relevant to the actual conditions instead of blindly following inconsequential
procedures or checklists.
A good understanding of the checklists is needed to perform the relevant points
and bypass (or reprioritize) the inconsequential or informative items during an

55
emergency. The more critical the emergency, the greater the need to be flexible,
change and adapt.
- Task-shedding is a strategy to manage Task Saturation.*
* See Task Saturation on page 23 of the Air Canada 15 - B777 - Hong Kong 2018-
12-11 accident report.
https://www.thb.gov.hk/aaia/doc/Air%20Canada%20AC15%20Final%20Report%
2028%20Dec21.pdf

(B) - Improving Training

--- Aviation Manuals
Training materials do not expand adequately in some areas. Sometimes they are
incomplete, even misleading, leaving the crews underprepared.
Training needs to promote good operational practices to help prevent events from
happening in the first place. Much of this information was removed from training
manuals. Some viewed it as a technique (and perhaps a possible liability). Still,
airmanship is built on knowledge, know-how and technique. Many pages and
even entire appendices* were lost.
* E.g., Boeing Flight Patterns Handbook - Diagrams of flight maneuvers
exemplifying how to manage aircraft energy. The absence of this information is a
factor in unstable approaches and landing accidents, in the author’s opinion.

Additionally, a Positive Reporting System's consequent decision-making was

substantially degraded. Many procedures now operate under a Negative Reporting
System*.
* See Terminology.

Caution: - Pilot and Flight Attendant Manuals may not match

This discrepancy is commonly found in airlines with two independent training
departments, one for pilots and another for the cabin crew. Manuals from these
airlines may be adopted by other operators, which inherit the same discrepancies.
This difference is evident in the guidance for Smoke/Fire in the Cabin, the most
common emergency and the checklist that requires the highest coordination
between both crews.

In the accident report of Swiss Air 111, lost to a cabin fire in 1998, the TSB of
Canada recommended the creation of an Integrated In-flight Firefighting Plan. The
aviation industry is still flying without one.

The individuals responsible for creating such a plan for an airline must understand
smoke and fire characteristics, their effect on pressurized aircraft structures, and
good knowledge of the previous fire accidents and how these events developed.
Module 6 is a good starting point.

56
--- Communication and Procedures Joint Training
Clear and precise communication is critical, especially during an emergency. Pilots
and flight attendants need to communicate developments during events using the
same aviation language (same set of specialized terms). Different interpretations
will result in a different sense of priorities and an undesired outcome.

The pilot’s decisions are dependent on timely and accurate factual description of
the situation by the cabin crew. The interpretation of the developments during a
smoke emergency is not intuitive. This knowledge needs to be learned and
practiced through exercises.

Pilots and flight attendants need to attend joint integrated safety training as
one team. This is an excellent opportunity to test the assumptions and cross-check
that cockpit and cabin crew manuals do not differ in emergencies that involve both
cabins. Joint training helps prevent the cockpit door from dividing the team
into two crews.

--- Intent > Resolution > Outcome

Aircraft and company manuals are the intent. Training and execution result in a
resolution. The better the resolution, the closer the outcome will be to the intent.
Shortening this gap must be the goal of training.

Practicing procedures in computers and flight simulators is ideal. But when it

comes to emergencies, training needs to go further and be formulated around
“Airmanship Development” in a classroom environment for a higher level of
understanding.

Training needs to explain the operational need for specific procedures,

skip others when necessary and clarify how to do them.

Through classroom training (or webinars), topics need to be explained using

“meaningful learning” methods, through multiple narratives establishing the
relationship of a concept to real-world events (incident narratives). This
effectively promotes complete understanding and retention for a longer period.
Additionally, using “active learning” methods engage attendees by placing them
in incident situations and participating in the resolutions.

57
--- Simulators
Simulator sessions are filled with regulatory compliance and cost-savings
procedures, allowing little room for a comprehensive discussion of in-flight
emergencies. If critical emergencies are discussed, it is usually about the last
accident. Training needs to move from reactive to preventive.

It is common to find in accident CVRs, that crews adopt the casual non-life-
threatening behavior of the training environment engaging in extensive non-critical
procedures. In the training world of simulators, pilots can practice every detail,
which is the appropriate place. But in a real-world emergency where the stakes
are high, we can’t get entangled with the inconsequential. The essential
procedures must be accomplished.
Pilots need to clearly understand the factors to move quickly to what matters.
Without this clear understanding, pilots cannot have conviction, determination, and
successful execution.

--- Checklist Applicability

Although aircraft manufacturers make every attempt to establish necessary non-
normal checklists (NNCs), it is impossible to develop checklists for all conceivable
situations, especially those involving multiple or remote failures.
It is unrealistic to expect perfect-fit solutions. When a checklist does not match
the situation, then it becomes guidance, and adaptation is needed. This
requires a thought process only possible if the applicable knowledge has been
acquired (experienced, taught or trained).

Pilots must have a good working knowledge of all NNCs and emergency checklists
to find what’s needed quickly. This does not mean we need to memorize the
procedures (and we should not). But we should have a general idea of what may
lead to an event, what procedures or checklists are available (and their names),
and how to address the issue and why. In the simulator, I have seen pilots calling
for non-existing checklists and the other pilot wasting time looking for them or being
out of the loop reading non-relevant checklists.

Time-critical emergencies do not allow for extensive procedures. Don’t spend time
(your safety margin) reading checklist sections that cannot help the situation.
Consider the rationality of corrective actions versus their effectiveness.

- One checklist for different scenarios (examples)

Crews need to distinguish the required response to different threat levels.
An engine failure associated with an explosion, fire or vibration is a critical
emergency (undetected internal fire in the pressurized or unpressurized structure,
flap or wing possible failure, etc.).
An engine flameout (or rollback), where the engine continues to turn without
vibration or fire indications, is a lower-level threat (expanded in M7).

58
During a critical emergency near an airport, the focus is to accomplish the
necessary landing preparations and bypass the inconsequential (or
Controlled Arrival preparations if not near an airport).
Once we have what we need to land, extending the flight is an unnecessary risk.
The longer a plane flies, the closer it gets to the next failure, which could seal the
fate of the flight (Transair 810).

Similarly, a dual engine failure at low altitude requires a different response than if
at high altitude. However, the “Dual engine fail checklist” may not differentiate, and
it’s up to the pilot to select which procedures to prioritize in the time left (expanded
in M8 & M9).
Pilots should also know alternate ways of achieving what is needed in critical
moments.
- For example, if the cockpit fills with smoke creating zero internal visibility in
seconds, how to evacuate the smoke quickly? (See VARIG 820).
- A flap or landing gear malfunction on final approach with low fuel does not allow
for a go-around to read and execute abnormal checklists. Know the alternate flap
and gear extension procedures.
- On final approach with gear down, if an all gear down and locked indication is not
displayed, the aircraft is now in a non-normal condition. It is common to see pilots
simply recycling the landing gear, which is most likely not the prescribed
procedure. Know the procedures for your aircraft beforehand, and do not be
tempted to use a normal procedure during an abnormal event as it can aggravate
the situation.

--- A B767 landing in Saipan had an unsafe gear indication. The landing gear was
retracted as part of the go-around procedure. However, the aircraft was in a non-
normal condition, and the landing gear should not have been retracted. The crew
was attempting to resolve the event (holding 30nm south of the airport) when they
realized they only had 4,000 pounds of fuel. They abandoned troubleshooting and
returned with an unsafe gear indication, landing with 1,800 pounds of fuel
remaining. In a B767, this is an extremely low and inaccurate fuel level.

--- Future Guidelines and Procedures

Developers need to include futurism when creating guidelines and procedures -
using what we know and have today to see how these elements could develop in
the future to create different possible training scenarios. We could then evaluate
how our mental models and procedures would play out in those environments.
Need is the mother of all creation. Without need, there is less motivation for
improvement. We can conceive scenarios that create the need to survive these
new events using futurism. The pressure to survive will heighten our intelligence
and capacity to make simple, sensible decisions.

59
 (C) - Training an Emergency
“Emergencies do not kill unlucky crews.
They kill the unprepared.”

--- Preparedness
We should not let our kids be out late at night because that is when bad things
tend to happen, and they can find them. Similarly, due to our exposure as
crewmembers, bad things can find us too. We may be unconcerned because we
believe they will not happen to us. Nevertheless, when they happen, the reality is
very real.
A factor in managing such a situation is how generally well prepared* we are.
The outcome will depend on the preparedness within us before the event. The
pressure of a critical emergency will force us to do what we believe will protect us
and allow our survival. We will bypass anything that stands in the way.
* - Not only technical preparedness but behavioral preparedness (further
discussed in M1P8).
- Regulations and policies always apply in routine operations. However, crews
should not regard these as precluding them from performing the life-saving tasks
they need in critical emergencies. Because as crewmembers, we are rule-
followers, we need to develop a sense of when to bypass certain rules.

- Aircraft limitations have different purposes, and they should be understood.

During the Continental 51 stabilizer failure, we had no choice but to exceed the
flap limit speeds. Later, during the maintenance debriefing, we found out that these
limitations intend to extend the life of the flap actuators and that the structural
limitations were much higher than the placard speeds.
This information can only be found in the maintenance manual (to determine the
man-hours inspection as per the exceedance values). Consequently, pilots are not
aware of the reasoning behind limitations or their actual structural limits.

An emergency has multiple aspects, and we want to turn the odds in our favor, as
many as possible. This allows us to systematically achieve positive outcomes not
because we were lucky but because we are skilled (prepared).
Our definition of LUCK should be to Labor Under Correct Knowledge.

--- Threat identification and risk assessment education

Crews encounter situations they can neither anticipate nor resolve. They tend to
misidentify and underestimate a critical situation. Incorrect decisions are made
even when the prescribed procedures are being followed.
Critical emergencies change the environment in which crewmembers operate,
challenging them to make decisions during unfamiliar events they don’t fully
understand. Emergencies need to be correctly recognized for the potential they
have of becoming catastrophic.

60
Early recognition enables critical thinking to be predictive.

--- Startle Effect

Training is a form of prediction since it attempts to control the future. Training
makes predictions more accurate in a given environment, and it is most effective
when the event happens in a similar environment to which the training occurred.
The way an emergency unfolds affects how the crew responds. The startle effect
can always be expected even when you brief the issue previously (because we
don’t believe it will actually happen). Briefing brings a prepared response sooner
(that is why we brief just before takeoff), but it does not take away the element of
surprise.

The only time surprise does not exist is when a pilot expects that result.
For example, when I practiced spins in the Portuguese Air Force, we had many
airplanes of the same model (T6-G). However, some would enter the spin and
recover easily, and some were a struggle. It was unknown how a particular airplane
would behave. When I had difficulty entering a spin, I knew I would have a harder
time getting out of it, and there was no startle effect.

Additionally, there is a delayed reaction time when the brain is presented with
different cues or is fatigued. The real-world environment is always different than
the training environment.

See Startle Effect on page 23 of this report:

Air Canada 15 - B777 - Hong Kong 2018-12-11 accident report.
https://www.thb.gov.hk/aaia/doc/Air%20Canada%20AC15%20Final%20Report%
2028%20Dec21.pdf

Intentionally Left Blank

61
 Emergencies do not adapt to our level of skill. It is up to us to adapt.

How to Adapt?
We need to develop the ability to:
- Perceive the developing situation.
Having awareness and paying attention allows perceiving. However, to correctly
understand what we perceive, we need to have the appropriate knowledge.

- Believe in it (based on knowledge, without having to live through it).

We think we believe what we know and act accordingly, but we only truly
believe what we feel* (been there, done that). In a threatening situation, it is
in our best interest to believe in it (and not going into denial).
* Example: - A F/A told me that when he fell from his motorcycle at low speed and
felt the skin on his back being pulled by the asphalt, he realized how vulnerable he
was and sold the bike. Although he knew he could fall (even at a higher speed)
before buying the bike, it wasn’t until feeling the pain that he acted on it.
- Did he believe what he knew or only when he felt it?
- Adapt to the new environment.
Adaptation is change. Change what needs to be changed to match the situation.
Change must be based on accurate readings of alterations to the environment.
These depend on updated information being communicated in a timely and clear
format to the individuals who can take the necessary actions. Crewmembers need
to adapt to the new environment quickly.

62
 Develop a sense for facts* and apply the instincts prepared by training
without the need for excessive thought.
* Facts are not emotional, and they are not an opinion.

Disengage from current tasks (task-shed) and pay attention to the development of
events. Delegate these tasks to the other pilot to increase our residual attention.*

*Residual Attention Definitions

- The attention left over to take care of an emergency while not losing control of
the routine.
- That portion of “Total Capacity” above and beyond the amount required for
primary duties. It depends on many variables, some personal, environmental, and
some associated with equipment and procedure design.

--- Multiple, Remote, Unique or Intermittent Failures

Not all emergencies can be foreseen and covered in training. In these cases, crews
will respond with their general preparedness and well-educated guesses.
Intermittent failures are unlikely to be detected even by testing the system.

- Avoiding an accident involves intelligence, knowledge and experience to predict

probable outcomes. Intelligence enables educated guessing, and knowledge and
experience turn good guesses into well-educated guesses.

Experience drives adaptation, and yet a previous experience may both inform
and confuse action. As an example, I will relate two similar events:

--- Continental 1 - B747-200 - Auckland NZ 1992.

During takeoff, airframe vibration was sensed around V1 (typically 6 to 8 seconds
between V1 and VR at heavy takeoff weights). Although I was the pilot flying, I
glanced at the engine instruments and verified they were operating normally.
However, as I took my eyes away from the runway to check the engines, I lost the
runway centerline momentarily, and the aircraft was drifting left by the time it lifted
off. When the First officer called positive rate, it occurred to me it could be a tire
problem, and I told him to leave the gear down. The vibration stopped as we
climbed out.
We asked for a runway check, and tire debris was discovered. We returned for
landing and found out that the aircraft had a left main landing gear tire failure (rear
left). During the first Gulf war (1990-91), our B747 fleet operated under military
specifications, and the Maximum Takeoff Weight (MTOW) was increased by
approximately 20% over the civilian MTOW, which later caused retread tire
failures.

63
During the post-flight debriefing, the F/O commented he found it interesting that I
had said to “leave the gear down” instead of “don’t bring the gear up.” The
statement of what to do was more explicit (than what not to do) and more decisive
than one, which included the words “gear up.”
I noted not to look inside the cockpit should an anomaly occur again during takeoff,
as this was the monitoring pilot’s job. It was so significant to me that I included this
item in my routine takeoff briefing.

The following year a similar event took place.

--- Continental 1 - DC10 - Los Angeles 1993.
Vibration was felt around the V1 range, and I immediately recalled the previous
Auckland incident. At the same time, the tower informed, “Continental 1, you have
a couple of burning tires rolling behind you on the runway.” This statement
convinced the cockpit crew that the problem was tire-related, and I told the first
officer to “leave the gear down” as we approached VR. This time I paid attention
to the centerline and pushed the rudder to maintain it.
I rotated the aircraft to the standard 15° nose-up for liftoff, but it did not climb away
from the runway as expected. Speed started to bleed off, and the Flight Engineer
called out loudly, “power loss, power loss.” In disbelief, I could not help looking at
the gages, and engine three was reading zero. I lowered the nose to about 11°,
and the aircraft, which was barely airborne and bleeding speed, touched down on
the runway two or three times before lifting off again. Looking forward, I could see
dunes at the end of the runway and pulled the aircraft nose-up further. Although
the engine out recommended pitch attitude was 11°, the dunes were a “harder”
rule. I firewalled the engines, which gave me an additional 22% more thrust per
engine* and flew over the beach at about 350 to 400 feet (guess).
The engine core separated into two parts and went out of the tailpipe (contained
failure). This was what the controller perceived as two burning tires rolling behind
the aircraft. None of the cockpit crewmembers heard any loud noise that could be
associated with an engine failure.
* I was unaware of this 22% increase in thrust until the maintenance debriefing
(actually 21-23%, depending on engine model). The fuel control unit is tuned for
firewall thrust. Today’s EEC’s limit thrust unless turned Off or in Alternate mode.

These two incidents are good illustrations of how experience can be ambiguous.
The second event showed me that a compromise monitoring procedure is probably
safer. The flying pilot should focus on the runway centerline while glancing
momentarily at airplane speeds and engines’ indications. The monitoring pilot (MP)
should focus on the engines’ indications and speeds while glancing momentarily
at the runway. Close to V1, the MP should also glance at the flying pilot as a
backup for sudden pilot incapacitation.
Be aware of your own and your fellow pilots’ experiences. Always check (test)
assumptions.

64
Splitters and Lumpers - Multiple Unrelated Failures
It is typical of aircraft fires and other situations to present multiple and unrelated
indications. This creates a troubleshooting problem. When dealing with more than
one non-normal indication, instead of splitting the issues and addressing them
separately, lump them together, and consider a likely source from that point of
view. In other words, look at it both ways, and see if the dots connect.

- The following is an illustration written by Dr. Hillard Chemers, MD / A&P.

One lump or two...or even more? In most occupations, Splitting is easy, Lumping
is difficult.
Mr. Pilot awakes with multiple symptoms: cough, fever and trouble breathing.
Dr. Splitter sees the symptoms as separate items, and treats without deeper
thought – in other words, the easy way. He prescribes a cough suppressant, a
fever reducer and an inhaler.
With an incorrect diagnosis, Mr. Pilot dies...
Dr. Lumper sees the same symptoms, and realizes they are related - not always
an easy process. He prescribes a curative antibiotic for pneumonia. (The non-
urgent symptomatic treatment can be used as needed.)
With a correct diagnosis, Mr. Pilot lives...

The following account is from a flight event example.

--- Continental 208 - DC-10 - Newark 1998-12-31

(Based on the CIR. Capt. Vireilha was the PIC).
The Newark airport arrival ATIS reported moderate rime ice between 800 feet and
8,000 feet, and the engine and wing anti-ice were turned on before descending
into the overcast. When on the approach and established on the ILS localizer, ATC
assigned us minimum final speed. I brought all three engines to idle thrust to
decelerate, full landing flaps were selected and continued the descent.

When leveled at 3,000 feet and at target speed, the thrust levers were advanced.
However, throttle number one was stuck at idle. Throttles two and three were
moved to full power, but with full flaps at 50°, we could not maintain altitude. I
asked for flaps 22°, but they jammed at 41°, and the aircraft started to lose height
at about 200-300ft/min. Then we turned off the wing and engine anti-ice (despite
being in icing conditions) to get additional power. The rudder trim also became
immovable after the first two units.
Eventually, we caught up with the Glide Slope, and at 800 feet, we broke out of the
overcast. It was late afternoon, and against the contrast of the gray environment, I
saw a large and long flock of Canadian geese flying at about 400 feet and crossing
the final for runway 22R. Soon they would be crossing the final for 22L, our landing
runway, at the same height as I estimated we would be. Impact with these large
birds was predictable and unavoidable.

65
We could not climb or go-around. Going above the Glide Slope to fly over them
would place us high and landing long on an icy runway.

Arresting the subsequent higher sink rate would be questionable with an engine
out. Going below the Glide Slope presented this same risk, but short of the airport.
The safest option was to stay the course and endure the encounter with the birds.
As we approached them, I increased power to increase aircraft speed so if we lost
thrust (due to bird ingestion), at least we would have enough energy to carry us to
the runway. We had several impacts, some we heard just around the cockpit, but
the engines kept running. As we landed, the spoilers did not deploy automatically.
I tried to pull the lever manually however, it was stuck in the armed position, and
the spoilers remained in the retracted position.

I reported each discrepancy (throttle, flaps, rudder trim and spoilers) in a separate
aircraft logbook page as per company policy. Each item was assigned to a different
mechanic to expedite the aircraft’s return to flight status. The next day I left on a
two-week vacation, and when I came back, I followed up with our maintenance
department. I was informed that the cables for the flaps were lubricated, and since
then, there had been one jammed flap reoccurrence, so they were lubricated
again. As we looked closer, we discovered the other items were also written up
again in separate flights. Each time, each item was assigned to a separate
mechanic (in different cities or different shifts). This caused the problem to be
handled as split events. Once we “lump” them together, we realized the only
common point for these cables was the center pedestal, and this is where
maintenance went next as the airplane was overnighting in LAX.

Accumulation of debris through the throttle quadrant caused the cables to be

jammed at the bottom of the center pedestal. My flight was the only flight where
all four events happened simultaneously, and it would have been the perfect time
for maintenance to “lump” the troubleshooting.

PART 5 - DECISION-MAKING FACTORS

“A superior airman uses his superior judgment to keep out of
situations requiring his superior skills.”
(Astronaut Frank Borman).

Mistakes, mechanical failures, or inadequate computer programing will always

cause in-flight non-normals or emergencies. Ideally, our behavior would avoid or
prevent most situations. If we don’t get into it, we don’t have to worry about how to
get out of it.

Or we may dismiss it and continue deeper into it, becoming entangled in a complex
emergency. In this case, to reach a successful outcome, we need to have an

66
extensive toolbox of knowledge and skill. The sooner people run out of script, the
more likely they will give up. Quitting is the worst thing one can do, usually sealing
the fate of the flight. Be prepared - have the tools never to give up.

--- Aircraft Factors

Malfunctions or failed systems affect aircraft limitations and restrict options.
Multiple systems failures are not addressed in the Operations Manual or the MEL.
When dealing with several problems in flight (or dispatching with several MEL
placards), one needs to carefully evaluate the compounding of risk with
simultaneous failures of otherwise unrelated systems. Furthermore, it is imperative
to understand the cause and effect of the failures and not simply the MEL-
operational restriction (Mohawk 40, Eastern 304).

--- Environmental Factors

Reviewed in M13 - Non-normal Operations.

--- Human Factors: Knowledge - Skill - Confidence - Conviction

Experience turns information (data) into knowledge, and practice improves skills
to the level where we can perform a task successfully. However, just because we
may have the confidence to act does not mean that we will act. We need to have
a reason to act, and that will be voluntarily due to conviction or forced due
to the circumstances.
One crucial role of training is to promote conviction through the relay of
experiences (such as those in this book). We can think and speak about what to
do, however, nothing happens unless we act, and conviction must be our motive.

Reasons to Act:
1 - Acting Due to Conviction (the good cause)
Conviction is the force behind acting because it is the right thing to do, the “safest
course of action.” Conviction empowers us to stand up to possible resistance from
the system or individuals.* Career advancement concerns cost lives. In safety
matters, we must not be concerned with political correctness, or we will not be
correct at all.
* In general, people do want to do the right thing. Resistance from individuals
comes not necessarily from malicious intent but because of technical ignorance,
sometimes assisted by greed.

2 - Acting Due to Forced Circumstances (the bad reason)

Ignorance of a threat or risk can preclude a pilot from recognizing it and acting
against the risk quickly and properly. An emotional sense of danger may finally
trigger action, for example, waiting for secondary failure indications as the situation
evolves from abnormal to emergency. The longer we wait, the fewer the options
for recovery and the greater the intervention needs to be. But not all individuals
are equally capable of adapting to dynamic situations, and for those less

67
adaptable, there may be no options left. Until we know where we stand in
knowledge, skill, confidence and conviction, we should not act adventurously.
As the saying goes in the duck world, “young ducks, don’t dive deep.”

--- Preparedness and Outcome

Hospital Emergency Room Team versus Aircraft Crew
In an ER, emergencies are routine, and medical teams are expecting them.
However, should the patient die, the medical team does not die with them.

An aircraft emergency is not routine, it is always a surprise, and crews have little
or no experience dealing with real-world emergencies. However, unlike the ER,
when a critical emergency goes wrong, the flight crew becomes a fatality together
with their passengers. Flight crews themselves must survive each emergency they
might encounter. An extremely high level of preparedness and determination to
survive is a must for aircraft crews.
Repeated emergencies only happen to crewmembers who survived earlier
ones*.

* Repeated Emergencies
Flying for the first time with this F/O, he told me he had heard I had several
emergencies as we took our seats in the flight deck. Then he asked me, “if I thought
that we were going to be OK tonight or if something could happen.”
I could feel his concern - I told him I did not know that, but yes, something could
happen. The question was, did he think his chances of survival would be better if
flying with a Captain that never had an emergency before?

Arriving in Hong Kong, as usual, all four pilots shook hands and said, “we cheated
death one more time.” To which I responded, “well, in 36 hours when we go back,
Mother Nature can have another shot at us.”

Intentionally Left Blank

68
 A - The Mental Model Concept
--- Connecting the Dots
Albert Einstein said: - Real thinking occurs when you suddenly see the connections
between unrelated ideas. He was referring to understanding.
Understanding allows connecting the dots, but imagination is required to connect
all the dots. Correct threat identification is critical in initiating the proper response.
However, this may be problematic due to the limited detection capability and lack
of information in an airplane, which may preclude connecting all the dots during an
emergency.

Multitasking in an Emergency
A pilot’s environment involves multitasking, and this is okay for short routine tasks.
However, the brain is a one-channel system (for sending and receiving, one at a
time), and multitasking requires constantly refocusing (using time and energy).

As crewmembers, we do not get to pick when to deal with the different aspects of
an emergency. As they happen, we must quickly reprioritize, which places an
additional burden on an already busy and complex multitasking environment.

During an emergency, the part of the brain needed for creativity - the ability to raise
the knowledge necessary for an alternate plan - is busy dealing with the situation.
One should not expect creative thinking to occur then.

Multitasking obstructs creative thinking making it more unlikely that a new plan is
created. During an emergency, crews revert to their training (based on previously
considered positions) which does not contain guidance for an alternate plan.

69
How can such an alternate plan be created?

--- The Monkey Board

An experiment was conducted by giving a monkey a board with four holes of
different shapes. There were six pegs, but only four could fit on the board. After
completing the task of placing the four pegs in the correct holes but not knowing
what to do with the remaining two, the monkey threw them away.

Not to repeat the monkey’s action of discarding the pegs he did not have a place
for, an alternate plan (our monkey board) needs to be as comprehensive as
foreseeable (have additional receivers for what may come).
We must not discard elements of an emergency that we may not fully understand,
which could become essential to the resolution. When things we don’t understand
happen, they can kill us.

The Mental Model* - We need to create a flow chart of possible environments (a

broad base of information), so we do not run out of script (at the end of a checklist)
and make decisions that are not part of a plan (identifiable on accident CVR’s).
Our decisions need to be made not from what we think we know or believe but
from what we can verify (positive operating system). Let’s not assume we are
correct until we can ascertain we are.
* (Expanded in M6P3 as a flow-chart).

The Hope Factor

A flight crew’s job is self-reliance, and hope cannot be part of any plan. Hope is
the expectation that someone else or that some thing will happen and accomplish
what we cannot. A plan that includes hope is not a plan but simply an adventure
with a high probability of failure.

When developing an alternate plan, we must evaluate the various possible

scenarios and exclude questionable solutions. The more favorable choices will

70
become the Mental Model. When an emergency occurs, we still revert to training,
but now we have an alternate plan that is part of the training.

The Mental Model is the “big picture” of a real-world emergency. It includes the
pertinent items of the checklists and the additional considerations that are needed
(and that may be missing in aviation manuals).
We can transition from the primary plan (procedural checklists) to the Mental Model
safely because our decisions will be made from previously considered positions.

B - The Expected World

We think we see what is there by simply looking, and we end up seeing only what
we expect to see. We build an expected world, process the information that fits,
and exclude the data that might contradict it. Factors that may cause us to miss
important details are: - a closed system, rule-following, narrowing of attention
(focus), and a closed attitude.

--- Behavioral Biases

Humans are subject to biases that influence judgment and decision-making. This
can lead us to make errors preventable through education.

Plan Continuation Bias. Plan and reality are diverging. Deep-rooted tendency to
continue the original plan of action even when changing circumstances require a
new plan. This results from the interaction of three major components:
- Social, organizational influences.
- Inherent characteristics and limitations of human cognition.
- Incomplete or ambiguous information.

Expectation Bias. Not seeing (or hearing) something because it was not part of
the plan. When we expect one situation, we are less likely to notice cues indicating
that the situation is not quite what it seems. This is worsened when we must
integrate new information that arrives piecemeal over time in incomplete,
sometimes ambiguous, fragments.

Confirmation Bias. Seeing something that is not there. There is a tendency to

search for or interpret information in a way that confirms our expectations.

Be aware of these biases and be prepared to navigate through an emergency.

Have a plan and a backup plan but be willing to let go of them if not working in your
situation (adapt, change). Make a plan, even if it is tentative and temporary and
update the plan as you go. Do not allow perfectionism to slow you down, do the
best you can and continue to advance.

71
--- Overconfident, Balanced, and Timid Commanders
Pilots can be classified into three groups, overconfident, balanced, and timid. Most
pilots fall in the overconfident group (50%), followed by an approximately equal
number divided between the balanced and timid groups. The overconfident group
is also the one that contributes to the greatest number of incidents and major
accidents. Therefore CRM/TEM programs target that group more and try to bring
everyone into the middle “balanced group.” All pilots should strive to be balanced
commanders operating between reason and logic.

The overconfident commander spends more time in the fast-thinking part of the
brain, thus taking more risks and higher risks; there is nothing to tell him when to
stop. He is more of a “one-man-band” and less receptive to CRM/TEM practices.
Accidents from this group tend to end suddenly.
He will accept a company-proposed low fuel flight plan (and even remove some
more) without asking his crew if they are comfortable with that amount. This can-
do attitude of the overachiever can be deadly in our environment. Although some
may not view aviation as high-risk, it is undoubtedly a high-consequence
environment.

The timid commanders are characteristically indecisive and may not make
decisions in time to avert a situation. They may not invite input, but they will be
receptive to suggestions if offered, making their choices much more likely to result
from a team effort. They tend to do better when assisted by assertive but balanced
First Officers.

PART 6 - ACTIVE MONITORING

Active Monitoring is a continuously updated state of readiness for possible

alternate LNAV & VNAV paths from cruise conditions. This allows for better
planning while not under pressure and reduces the workload later when dealing
with an emergency.

Flight operations involve a calculated degree of risk. Working with risks requires
diligent attention, and an imminent downturn requires aggressive intervention.
- Diligent attention is, at cruise, Active Monitoring.
- Aggressive intervention requires: - decisiveness in selecting which procedures to
complete and which to bypass - correct and timely execution.

--- Active Monitoring has the purpose of relieving a pilots’ future workload by
preparing for a possible emergency while in routine cruise conditions before
anything happens.

72
Anticipating where to divert, which approach to prepare for, and how to fly there
(observing terrain and weather) reduces the workload during an emergency and
increases a pilot's residual attention leaving the crew better prepared to handle a
situation with much less stress.

At the start of an emergency, there are two new factors to consider:

A - The emergency procedures themselves.
B - The possible aircraft’s new flight path to an alternate airport of opportunity.
Note: - After my first emergency en route, it was evident that factor B was a
workload that had to be moved to before the event started to prevent becoming
overloaded.
By routinely gathering and saving the route data, the next time I fly between the
same airports, I would only have to make minor adjustments for the different routes
(additional airports of opportunity) and weather considerations. It also made my
17-hour flights seem a lot shorter.

In routine operations, pilots monitor the flight's progress passively, watching when
any adjustments need to be made. When practicing Active Monitoring, if an
emergency occurs, deciding where to go (and the new flight path) is already
analyzed and ready to be executed.

During an emergency, the norm is for one pilot to fly the plane while the other takes
care of the emergency. Still, even with a third pilot present on the flight deck, a
time-critical emergency can quickly become overwhelming. However, if practicing
Active Monitoring, the pilots although busy will not be overwhelmed.

If you adopt Active Monitoring, this will facilitate execution during your next
emergency. If flying on an ocean track system, know the procedure to exit the track
without the need for further consultation – time will matter.

--- Airport Selection

Before selecting an airport to monitor, consider the following:

- Airport - Is it safe to land there? Is the airport open currently? If not, can you turn
on the runway lights? Can you obtain current weather, visibility and wind?
If not in day VMC, use radar to locate convective weather between aircraft and
airport.
Airport terrain awareness - Elevation, obstacles and Minimum Sector Altitudes.

- Approach - Runway orientation, runway length, approach Cat I, II or III?

Determine which approach would better suit your flight and be prepared to request
it (even if it is not the active approach). With a time-critical emergency (smoke/fire),
the priority is to reduce the flight time even if having to compromise in other areas.
It is your emergency; ATC will give you what you need (see Continental 1593).

73
- Display Airports - On the Fix page(s), create a 100nm or smaller circle. Adjust
the distance to be within the 20 to the 25-minute range for your aircraft at
emergency descent speeds (for situation awareness). This is about the range limit
of an aircraft's life expectancy during a smoke/fire event. The landing target time
should really be no more than 15 to 20 minutes from detecting smoke.
As selected airports fall out of range behind aircraft, select new ones ahead or
abeam of the flight plan route.

- The Route to the Alternate Airport – Think how to fly from present position to
your chosen runway, taking weather and terrain into consideration.
- Escape Route (when appropriate) Build it on the fix pages (Fix, bearings,
distances) to replace possible paper map loss (e.g., decompression).

- Speed – In a time-critical emergency, you may want to keep the speed up until
near landing. Consider speed intervention or other means of controlling speed to
override possible FMS limitations (e.g., 250 knots below FL100). Inform ATC you
will be flying fast, especially important for ATC to plan for turn radius.

Intentionally Left Blank

74
 PART 7 - EXECUTION
The most important aspect of managing an emergency is the execution.
The best possible outcome depends on educated decisions executed
correctly in a timely manner. Transform thinking into action and take correct
decisive action.
- Our crew is an extension of our vision on how to deal with an emergency. Our
mission as a leader is to direct our crew in a timely and clear format. A crew that
is well led by a skilled leader will outperform.

Caution: - Be aware that when no one seems to have the conviction on what to do,
the first individual to present a plausible plan of action tends to lead the execution,
and it may not be the best solution.

--- It’s safer to deal with an emergency, assuming from the beginning that it
is a critical one and scale it down as we realize it’s not than to scale it up as
it gets out of control, and it is usually too late.

Reprioritize
Monitor relative values and prepare for a rapid reordering of priorities as the
situation deteriorates. Quickly estimate probable outcomes for different courses of
action. Decisions need to address the most critical threat first.
To the perfectionist in us, an emergency is not the time to split hairs - we should
not try to be perfect - we can simply do better and move forward.

What Is the Mission?

As I learned to fly in the military, I was perhaps too mission-oriented - having a
sense of duty to complete the mission. As I became a civilian pilot, I had to unlearn
that motivation.
Too many commercial flights are lost trying to get to their original destination (the
perceived mission). As much as our passengers would like to arrive at their
intended destination on time, they would rather arrive late and somewhere else but
alive. Our mission is much more straightforward as airline pilots - to land safely
somewhere and live to fly later.
Our first duty is the same as a Medical Doctor - to cause no harm.

The Relevance of Declaring an Emergency or Mayday

Flight Crew - Pilots never declare most emergencies. Perhaps they are reluctant
to do so, possibly to avoid having to fill a simple electronic form. However, once
stated, the Captain and the entire crew are protected from any rule or policy
deviations. Most significantly, it places crewmembers (and ATC) in the right frame
of mind, freeing them to adapt and shorten procedures to accomplish the relevant
and applicable items to the specific emergency.

75
In the ever-increasing criminalization of accidents worldwide and the regulatory
uncertainty in which pilots operate, declaring an emergency is the best way to
protect the flight, its crew, and passengers.

Always declare an emergency as early as a perceived emergency is sensed. In

most accidents and incidents, an emergency was never declared, although the
situation called for it. Nevertheless, it is common for pilots not to declare an
emergency and request ATC to provide “priority handling” (e.g., low fuel). Asking
for emergency equipment or saying “roll the trucks” is not an emergency
declaration, either. Declaring a Mayday is the first step in accepting the situation
(bypassing denial) and dealing with it.

ATC - Declaring a Mayday assigns priority to the flight, and that status is passed
along to the next ATC controller. Once an emergency is declared (by pilot or ATC)
the fire trucks will be near the runway. They can assist, even if just to evaluate the
condition of the aircraft before it clears the runway (expanded in M3P2 and
M4P2).
Declaring an emergency gives priority over the next flight to declare an
emergency. Once the emergency services are assigned to the first emergency
aircraft, the next emergency cannot be protected (see Air Canada 877). The
second flight should divert to another airport or hold until the first emergency is
completed (fire trucks may have to refill the extinguishing foam). This can take
longer than the flight should hold, even if it has the fuel reserves to do so. The
second flight may choose to land without the availability of rescue services, but if
anything goes wrong, the passengers and crew are on their own and in a dire
situation. Then, the question to the crew will be - was this the safest course of
action?

--- Aer Lingus 110 - B757 - JFK 2015-09-29

ATC Video: https://www.youtube.com/watch?v=gjpBcGGsE6w
- Note on the video the explanatory communications from the pilots. As pilots, we
need to inform what we require, so ATC and rescue services can better direct their
efforts. Anything beyond that is wasting critical time we may soon need.

- Note at Time Stamp 11:45, the pilot asks the firefighter if he thinks the aircraft is
good to taxi. The pilots knew the nose steering was disabled, and the landing gear
had been on fire. Why would the crew want to assume that liability and jeopardize
their licenses? Luckily, the airport had already decided to bus the passengers and
crew to the terminal (see landing gear unsafe M13P1).
Shortly after departure, the aircraft lost a primary hydraulic system which reduces
flight controllability. Additionally, the plane will land with less flap at a higher speed,
causing hotter brakes. Because the hydraulic system lost its fluid, this is not a
safe scenario. If the system ruptured in the wheel well area (most common),
hydraulic fluid sprayed as a mist at 3,000 psi becomes flammable. The crew

76
did not realize this risk, as the Captain declined to declare an emergency even
after being prompted by the ATC controller.
Both main landing gears were smoking during landing, and the right landing gear
caught on fire due to hydraulic fluid on the hot brakes. Nearby emergency vehicles
quickly extinguished the fire as ATC declared the emergency for the Captain.

--- Captain’s Emergency Authority (CFR 121.557).

If the Captain and/or dispatcher believe that a potential or actual emergency
exists, the Captain and/or dispatcher should declare an emergency to ATC and
take appropriate action to ensure the safety of the flight.
The Captain may take any action he considers necessary under the
circumstances. His actions may deviate from any rules or policies to the extent
required in the interests of safety (see CO 871 below).

The Captain and/or dispatcher should not wait for a situation or condition to
become critical before exercising emergency authority. If unsure about the
need to declare an emergency, err on the conservative side and declare one.
Declaring an emergency is the best course of action whenever the safety of
the flight may be in question.

Unlike the human body that can heal itself, an aircraft cannot. An in-flight abnormal
can only worsen, and what the crew knows about it is only part of the problem.

--- Continental 871 - B737 - SXM 2003-11-03

We do need to be prepared to use the Captain’s Emergency Authority and take
necessary and appropriate action to ensure the safety of the flight, as sometimes
we will be surprised as the events unfold.
On 2003-11-03, I was flying Continental 871 from Newark to Antigua. When we
arrived, there was a large thunderstorm with heavy rain and low ceilings obscuring
the entire island, and we decided not to attempt the approach. After a couple of
turns in the holding, we realized the storm was stationary and decided to divert to
Saint Martin, the only available alternate due to general bad weather.

When contacting the tower, we were informed that the airport was closed. We
could see Saint Martin was in clear weather. Was the single runway blocked by an
accident?
When we questioned why the airport was close, we were informed the tarmac was
full of aircraft that had diverted there, and they could not accept any more
airplanes. I asked if the runway was vacant, and the controller said it was. I
declared an emergency and informed the controller I would be landing and staying
on the runway if needed (ditching would be the next option). Although we were
surprised by the controller’s reasoning for closing the airport, we were even more
surprised by his next statement: - “Captain, are you declaring a full emergency,
and are you willing to do the paperwork for it?”

77
After landing, I had no difficulty parking in the middle of the tarmac, and there was
still plenty of room on the taxiways.
I immediately went to the tower armed with my pen. When I called from the
downstairs phone to have the door unlocked, the controller informed me that there
was no need to do any paperwork. I told him I would still like to visit him in the
tower (considering he was not busy). We had a pleasant talk, but I stressed our
predicament and the possible consequences of his decisions with a less
experienced flight crew. I mentioned that it was misleading information from this
same tower that contributed to the previous ditching of ALM 980.

--- CRM Strategies

First Air 6560, Air India 812, Garuda 200, and so many more fatal accidents
repeatedly happen because CRM practices are not used when they should. I feel
compelled to draw attention to the following strategies.

Escalation - “CUS” = Concerned – Uncomfortable – Not Safe

These words are intended to progressively heighten awareness if a crewmember
determines that their concerns are not being conveyed effectively.
Using the phrases “I’m Concerned about…,” followed by “I’m Uncomfortable
with…,” and finally, “This is not Safe,” reflects an escalating level of intensity in
conveying concern about an issue. If these words are used, they should be
considered a red flag, initiating reexamination of the current course of action.
However, if CUS is not successful, action needs to be taken to prevent an
accident. The following is a strategy example for the non-flying pilot to take
control of the aircraft to prevent an accident.

--- First Air 6560 - B737 - Resolute Bay Canada 2011-08-20

https://tsb.gc.ca/eng/rapports-reports/aviation/2011/a11h0002/a11h0002.pdf
Video: https://www.youtube.com/watch?v=CHnmEp-fHxM

P.A.C.E.
Probe – F/O to CA – “Are you showing us right of course?”
Alert – F/O to CA – “GPS and raw data show aircraft off course to the right.”
Challenge – F/O to CA – “We are going to crash*, we have to go-around.”
Emergency – F/O to CA – I have the aircraft, go-around, max power. (This last
step never happened, and the plane flew into the hill).
*(The F/O could have emphasized an emotional sense of danger by using the word
“crash” to cause the Captain to act. Instead, the F/O mentioned they were heading
towards a hill, which was not enough to change the Captain’s mindset).
Similar CRM accidents:
Air India 812- B737 - Mangalore India 2010-05-22
https://aviation-safety.net/database/record.php?id=20100522-0
Garuda 200 - B737 - Indonesia 2007-03-07
https://aviation-safety.net/database/record.php?id=20070307-0

78
And if in a time-critical situation such as during takeoff and landing:
Two Calls Rule – Response or Action is required. If not, assume control of
the airplane.

--- TransBrasil - BAC111 - S Paulo (Campinas) 1977-01-04

Captain Ondino suffered a heart attack during the second approach in bad
weather. The airplane deviated from the stabilized final criteria (Glide Slope,
localizer, IAS, thrust and VS). The F/O called the deviations without realizing the
Captain was incapacitated. Despite the lack of corrective actions by the flying pilot,
the F/O never took control of the airplane. The aircraft landed hard (uncontrolled),
1,500 feet down the runway, bounced and landed on the nose gear that collapsed.
Then, the F/O brought the throttles to idle power, and the airplane veered off the
runway into a trench, skidding for over 1,000 feet.

PART 8 - EMOTIONAL CONTROL & BEHAVIOR IN

ACTION
“In the heat of the battle, the only thought you can allow yourself
concerns your next correct action.”
Major Antoine de Saint-Exupéry – French Air Force P-38 Pilot.
“The Shakespeare of the French language 1900-1944.”

A WWII General writes about a detail of his morning routine: He describes having
breakfast at his home with his wife and daughters. Then he gets up, hugs and
kisses them goodbye. He puts on his uniform overcoat and his General’s hat as
he gets to the front door. Before leaving his home, he clicks his heels together in
a military attention style. His mindset changes from being a husband and a father
to becoming a General, sending troops to die in battle.

I read this brief in a Time-Life book when I was a young teenager, That defining
moment of mindset change from a loving husband and father to a killer warrior
stayed with me because I really could not relate to it. Was he not a soldier before
clicking his heels?
Decades later, I was a Captain for an airline in financial difficulties, and deferred
and derelict maintenance issues were causing frequent critical emergencies.
Before each flight, I could not help but think, “what kind of an emergency would I
be involved in this time?” I was feeling the cumulative effect of dealing with
repeated stressful events (see list of events* below).

One winter day, I was leaving the serenity of my home on Barnegat Bay, heading
out for a flight. As I got to the front door, I put on my uniform overcoat and my
Captain’s hat. As I inserted the key to lock the front door, I thought, “will this key
come back home, or will it be at the bottom of the ocean tonight?” Now I could

79
relate to the General clicking his heels. At that moment, I changed my mindset to
fight for the survival of my flight. It was the will to return home that would change
me. From that day on, inserting the key into the lock would trigger that same
thought and that same sentiment. It was like putting on an armored suit in
preparation for battle. I became determined to defend the safety of my flights.

* - List of Events (for a selected time frame on DC10 aircraft).

In 52 days, I experienced six serious events. Do not dismiss the effects of repeated
events on your performance capability. When you have an emergency, do not
switch airplanes and continue flying. Ask your company to replace the crew.
Should you have another emergency on the second aircraft, you (and your crew)
will not perform at your best. The FAA (and common sense) requires
crewmembers to disqualify themselves when not fit to fly.
The purpose of this list is simply to show the frequency of emergencies. For more
details on a particular flight, see the Index by Airline & Flight Number.

1998-12-25 CO208 - Eng. #1 fire at 500 feet after takeoff, burns detection loops,
fire extinguishing malfunctions, slats and flaps don’t extend for landing.

1998-12-26 CO50 - Aft galley ceiling fire caused by a fluorescent ceiling light
ballast.

1998-12-31 CO208 - Jammed center pedestal cables during the approach, leave
aircraft with jammed flaps at 41, left engine throttle at idle (unable to maintain
altitude with firewall power on other engines), rudder trim immovable at two right
units, spoilers stuck in the down position and unavailable upon touchdown.

80
1999-01-26 CO140 - Uncommanded flap retraction on the right wing at rotation
during takeoff, causing 3.8 asymmetry.

1999-03-04 CO51 - Loss of elevator and stabilizer control. Engine fire extinguisher
bottle, loose in tail section ruptures, and propelled by its own Halon breaks elevator
mechanism and crimps hydraulic lines.

1999-03-12 CO1512 - Hydraulic failure.

--- Technical and Behavior Preparedness

Previously we discussed the need to have technical preparedness. However, to
achieve the desired results, we also need to have prepared behavior to control
emotions - preparedness to control our so-called “behavior in action.”

Stress
A critical emergency creates operational stress. Strong emotions cause the
release of hormones that interfere with the memory system (storing or recalling)
and with the ability to perceive (reduced visual and auditory acuity). Emotions
impair judgement and the ability to evaluate consequences and make good
decisions.

Plan vs. Reality

As long as the plan reasonably matches reality, we are okay. But when perception
and reality diverge, decisions are caught between two competing parts of the brain,
one perceiving reality, the other denying it (see The Caine Mutiny – Humphrey
Bogart movie).

Emotional Reactions: - (addressed here as the “Bad Guys”)

Denial, Anger, Bargaining (with a higher power?), Depression and Acceptance.
Denial, the result of not believing in a developing situation, is the first step in the
wrong direction and can ultimately lead to losing emotional control. See “Believe
in it” M1P4.
Notice that depression is crossed-out. An in-flight emergency happens quickly and
does not allow time for depression to set in. Depression may or may not materialize
later.

More Bad Guys:

Uncertainty, Confusion, Fear, Vertigo, Claustrophobia, and Panic.
Fear will drive our actions, and preparedness (knowledge and conviction) is
the best defense from reaching this point. This process needs to be stopped
initially by recognizing and believing in it (and not proceeding into denial).

Once exposed to these emotional reactions, and since we may not be aware of
this process, there is no way to understand what’s happening with us. Not being
prepared to deal with all the unexpected information will be overwhelming. Clear

81
thought becomes impossible, and action becomes frantic and unproductive and
can lead to mental collapse.*
* See Air Micronesia DC10 Kai Tak).

Two Helpful Acronyms:

F.E.A.R. - False Evidence Appearing Real
and
S.T.O.P. - (To perceive)
STOP - Means stop. Pause to observe and think.
THINK - Unload tasks so you can think (delegate tasks). If we can’t think, we can’t
act correctly.
OBSERVE - We tend to focus on what we perceive to be the most important detail,
but it may be the wrong thing, and we lose the big picture.

If we only focus on the problem, we may miss the easy solution.

PLAN & ACT - Use your Mental Model as your plan of action. Nothing happens
unless there is action. Shift from reacting to acting on the next correct thing.
Note: - We want to Observe first and then Think about what we observed, so the
correct acronym would be SOTP, but that would not work as well.

--- Behavior in Action

Do not allow denial to set in. Immediately begin to recognize the new reality. Don’t
downplay or ignore it, believe it. Assume responsibility for the emergency. It is your

82
life that is at risk, together with those of your crew and passengers. Control anger
and do not waste time blaming others. (AeroPeru 603, while struggling to fly, the
Captain focused on blaming maintenance). Survive the emergency now, and sort
it out later. Acceptance of the new environment needs to take place quickly.
Transition to the real environment instead of dwelling on the one wished for.
Realize that only our actions will bring about a resolution.

Close the door on the “Bad Guys” and bypass this negative process. The
startling effect is the first thing to occur during a sudden event. Dealing with the
unknown can bring uncertainty and fear, especially when our lives depend on the
outcome. Knowing this, be prepared not to allow room for fear. Keep emotions
working with you, not against you. Feeling fear is not all bad. It means you are not
fooling yourself into thinking this will be easy, and it prepares you to do whatever
you need to do. Some people appear not to panic, but they may be in calm denial
and do not know what to do.

However, many panic attacks happen during routine operations when there is no
real emergency, especially when alone. Make use of fear to energize action and
stay busy. Start small manageable tasks (e.g., start preparing the next position
report or other flight deck duties). This will help to remain calm and prevent fear
from ruling the turmoil of too much emotion.

When the rescuer reaches the victim, they are both in the same place,
but the rescuer knows how to get away from the riptide.

Be an effective crewmember
The general preparedness discussed in the previous Parts is the best tool to keep
emotions at bay. The better prepared we are, the more control we have over the
situation, less stress is generated, and the crew can remain effective. Keep a
positive mental attitude and believe that you will succeed. Have the will to survive.

83
Balanced Commanders
Know your abilities and limitations. Do not overestimate or underestimate
(overconfident or timid commanders). Think and act in a balance between reason
and logic. Be determined, have the will and the skill, do whatever is necessary.

“Active Passivity” - Accept the situation you are in without giving in to it, without
giving up. Do what you can with what you have, now. Things can go wrong, and
sometimes they do, but it doesn’t necessarily mean the end unless we give up.

--- Fight or Flight - Different Behavior in Action

Aircraft Captains are strapped to their seats and may have up to three other pilots
sitting next to them. This environment may be a factor in their “behavior in action.”
They stay in place and fight through an emergency. But not always, as seen below
in an Air Micronesia incident (below).
However, ship Captains are free to move about, and their emergencies afford them
much more time. This freedom of movement and time factors appear to trigger a
flight response. Some Captains display signs of resignation, uncertainty,
confusion, and mutiny within themselves, leading to losing the ability to command.

- Titanic’s Captain Edward Smith retreated to the bridge and was not seen in any
active role during the two hours it took for the sinking.
- Capt. Yiannis Avranas, in command of the cruise ship Oceanos, was seen
smoking a cigarette alone while holding to a pole under the bridge as the boat was
beginning to sink. He and four other officers were the first to abandon ship. Capt.
Avranas stated - “When I give the order “abandon ship,” it doesn't matter what time
I leave. Abandonment is for everybody, if some people want to stay, they can stay.”
- In command of the Costa Concordia, Capt. Francesco Schettino also abandoned
his ship at the beginning of the event. He stated - “I slipped and fell into a lifeboat.”

--- Air Micronesia DC10 - Kai Tak, Hong Kong.

The DC10 began its second missed approach in bad weather and strong
crosswinds. The plane was low on fuel. The Captain advanced the throttles and
rotated the plane nose up while calling for go-around flaps. Then, he suffered a
panic attack. He told the junior co-pilot to take over the plane, and without raising
the landing gear, he unstrapped from his seat and left the flight deck.*

He was aware of another DC10 Captain sitting in first class on vacation with his
wife. He told him he was not feeling well and asked him to land the plane. The off-
duty Captain had been drinking, but he understood the gravity of the situation and
went to the cockpit. The co-pilot was overwhelmed with a complex missed
approach procedure at night with mountains nearby. The landing gear was still
down. The off-duty Captain landed safely.

* Having himself replaced was an excellent decision. The Captain recognized his
incapacitation and that the co-pilot was perhaps too inexperienced to assume

84
control of this situation. The Captain broke the chain of events that could lead to
an accident by leaving the cockpit. Most accidents of this nature result from
individuals persisting in the “can-do” attitude because when they are overconfident,
there is nothing to tell them when to stop.
The Captain stayed on medical leave for a few years until his retirement.

The Kai Tak airport was well known

for its challenging approach and strong crosswinds.

Engine 4 contacts the runway, on this image.

85
 MODULE 2 - CRASH DYNAMICS
Note: - For additional information on Crash Dynamics, see Module 9 - Crash-
landing or Ditching.

Introduction
We all have a driver’s license, but that does not make us motor vehicle accident
investigators. And we may have a pilot’s license or an engineering degree, which
does not make us aircraft accident investigators either. However, understanding
some aspects of this field will help us make better-informed decisions and take
appropriate action during an in-flight emergency.

Summary
In this Module, we will study aircraft skin strength, in-flight structural failures,
ground impacts and some crash forensics. We will also look at energy absorption
design and survival aspects.

PART 1 - OUR MONOCOQUE HOME

The design of the lower shell allows it to withstand tire shrapnel and runway
debris from engine blast. It can resist a 5,000 Joules impact, except for the aft
lower section marked here in red, designed for 19 Joules, the weakest area of
the airplane (fig.1A and 1B).
Recall this factor when reviewing M9 - Crash-landing or Ditching.

Fig. 1A

86
 Fig. 1B

The entire upper shell of the aircraft (fuselage, wings and horizontal stabilizer) is
designed for 95 Joules to protect from dents from hail while on the ground or from
mechanics dropping tools.

The frontal profile of an aircraft, the entire cockpit nose cone, and the leading
edges of the engine nacelles, wings, horizontal and vertical stabilizer can take a
bird impact equivalent to 59,000 Joules.

The side shell (panels marked in red) protects the passengers from engine
fragments. They can take the impact of 1/2 of an engine blade at takeoff thrust, the
equivalent of 180,000 Joules (fig 2).

Fig.2 - Panels removed before scrapping airplane

87
 PART 2 - IN-FLIGHT BREAKUP AND GROUND
IMPACT
Let us consider what may cause an in-flight breakup and the characteristics of
ground impacts.

--- Flight Controls Induced Breakup

Exceeding airspeed redline below flight level 270 (denser air) can cause high loads
and structural failures. Above ~FL270 (between FL270 and 280), the speed
reference changes from knots to Mach number. The red line speed limitations also
change from being structural to becoming aerodynamic limitations.

At higher altitudes, if speed exceeds the red line, aerodynamic flutter combined
with the loss of the elasticity properties of the flight control surfaces can lead to
their failure and separation from the aircraft, leading to loss of control and the
beginning of an in-flight breakup.
For example, a breakup can be induced by displacing the primary flight controls to
correct for attitude deviations caused by turbulence.

Displacing the flight controls can be initiated by the autopilot or by the pilot, and for
this reason, it is recommended to turn off the autopilot and fly the plane manually.
Either way, Flight Path Angle 0.0 and Heading Hold provide safe guidance.
See M13P2 Flying in Turbulence.

--- Debris Field

When an airplane impacts the ground (or sea) intact, the debris field is linear. But
when an airplane suffers an in-flight breakup, the debris field is round or oval
depending on altitude, winds (and sea currents). Light debris may be found many
miles away.

Usually, the first components to separate will be the first ones on the debris trail.
This is not a hard rule. Some larger components may retain aerodynamic
characteristics that are stronger than their ballistic properties, and they may fly a
180° turn and impact the ground earlier in the trail.

During an in-flight breakup, occupants released to the exterior will shred their
clothing during the deceleration from aircraft speed to their respective terminal
velocity (120 mph in belly-to-earth position and up to 180-200 mph in a head-down
attitude). Finding unclothed bodies at the crash site is an indication of a high-
altitude in-flight breakup.

88
--- Finding the Cause
The aircraft components’ edges indicate the cause of failure for each part:
- Most components will likely present rugged edges, an indication of structural
failure due to overload. As the fuselage rips open, wind forces will bend the plane’s
skin and other structures outwards and backward (petalled effect, see M5 Fig.4).
Explosive internal forces will also cause outwards bending, but they will leave
residue identifying the explosive (expanded in part 5 of this Module).
- If one component shows smooth edges, that indicates metal fatigue and is likely
the source of the initial structural failure.

After the loss of control, if the aircraft develops a nose-down dive, it will reach the
ground in less than one minute, depending on the altitude. It may become
supersonic in the last seconds, in which case the only voice recorder sounds will
be from inside the aircraft. External wind noises will be left behind.

If the aircraft is in a stall, it will take about two minutes to reach the ground. If stalled
and spiraling, it will take approximately two and one-half minutes. Vertical speed
will be in the range of 11,000 to 12,000 feet per minute, generating a ~ 36 G impact.

Knowing these characteristics is relevant to an investigation as they indicate how

the airplane descended. For example, the Air France 447 disappearance was a
mystery to the public for a long time. However, the immediate availability of two
bits of ACARS data on that first day gave a good indication of what had happened.

The first abnormal indication, transmitted at the beginning of the last four minutes,
was a rapid rise in OAT to match TAT (within five seconds), indicating freezing of
the TAT probes, as their heating capabilities are being overwhelmed by ice
crystals. Considering the airplane was at FL350, where ice crystals cannot form,
this indicates the flight had penetrated convective weather (explained in M11).
The second abnormal indication was the opening of the negative pressure valves
a few seconds before the end of the transmission, telltale that the aircraft altitude
was going below cabin altitude (dragging the cabin) because of a fast descent.
A few days later, the galleys were found floating in the ocean. They had been
crushed vertically by a 36G impact force, indicating a stalled condition with little
forward velocity. As a comparison, a 200mph vertical down-path would cause a
200G impact force (Space Shuttle Challenger terminal velocity).

Intentionally Left Blank

89
 PART 3 - DEFINITIONS & CHARACTERISTICS
In this Part, we will become familiar with some terms used in this study. Associate
the highlighted italic terms and characteristics with their respective photos, as they
will be used in the other Modules.
The scatter point is the first point of contact between the aircraft and the terrain,
not necessarily the ground or a body of water, and it could be a tree branch or an
antenna.
The primary impact is the point where the airplane (demonstrating aerodynamic
properties), transitions to a ballistic trajectory.
However, in a near-vertical impact, the scatter point and the primary impact may
be close to each other, and the accident becomes a hit and stick.

A high-speed vertical impact generates a ten to 30-foot-deep crater depending on

speed and mass. Only the aircraft’s tail may be readily recognizable, bones are
pulverized, and human remains are usually identified by fingerprinting and DNA
identification. In figure 3, an 80-pound bag contained the DNA of 39 individuals.

Fig.3

A steep angle (but not near vertical) results in a hit and splash. After the primary
impact, the airplane disintegrates into many identifiable pieces. Some complete
bodies may be recovered (arms separate at 180 mph, legs at 220 mph).

Intentionally Left Blank

90
Figure 4 is from a hit and splash of an MD80 with tail-mounted engines. The vertical
arrow indicates the impact of the wings from wingtip to wingtip, leaving a 35 meters
wingspan witness mark (wingspan is 33 meters). The left arrow indicates the
primary impact point, where the airplane’s nose struck the ground. The right arrow
indicates where the tail impacted, creating an impact shadow of 11 meters.
Knowing that the MD80 is 45 meters long, the approximate flight path angle was
60 degrees. These field estimations are close to the last FDR recorded data at
1600 feet of a 58° pitch-down attitude, a 10° bank to the left and a calibrated
airspeed of 384 knots.

Fig.4 - Swift Air 5017

Intentionally Left Blank

91
Fig.5 - In another photo of the same accident, the areas marked in blue indicate
the trajectories of the engines. The right engine being higher at impact, traveled
further, telling the aircraft was in a left bank. When the forward section impacts
the ground, it bounces, shredding the fuselage behind it that is still moving forward
(like a tennis ball thrown at a wall will bounce back). For this reason, the last
components in the tail, such as the tail skid and the aft door indicated by the larger
yellow circle, may be thrown back to a point before the general area of debris.

Fig.5 - Swift Air 5017

Intentionally Left Blank

92
Fig.6 - In this hit and splash of another MD80 at a stalled speed of 150 knots, the
horizontal stabilizer is complete, despite damaged, and rests just forward of the
primary impact point, the square puddle of water where the aircraft center section,
the wing box, impacted the ground in a near flat attitude.

Fig.6 - West Caribbean 708

Intentionally Left Blank

93
Fig.7 - A shallow impact angle and relatively low speed, known as a hit and skip
or slide, causes the aircraft to break into three to four sections and offers the best
chances for survival.

Fig.7

This aircraft impacted the ground in a 22° nose-up in a near stalled condition.
The primary impact was to the tail, which generated rotation around the pitch axis,
increasing the impact forces in the forward cabin and cockpit, where the fatalities
and serious injuries occurred. There was a relative lack of injuries inside the wing
box.

There were five moderate injuries and one minor resultant of the snap effect* of
the fuselage fracture, more noticeable near the windows, two rows forward of the
wing box (row 7). There was a F/A fatality by the right rear door, typical of aircraft
that impact tail first.
* Due to high acceleration pulse.

Survivable accidents result from shallow impact angles at low speeds (forward and
vertical speeds). During T.O., speed is higher than when landing and once the
airplane becomes airborne, it flies over obstacles such as parking lots, highways
and residential areas. During landing, aircraft momentum is decelerating, and the
trajectory is towards a large open flat area with few obstacles. Landing accidents
have therefore, a better survival ratio (3.75 times higher).

94
 PART 4 - AIRCRAFT DESIGN & SURVIVAL
--- Crash Test B727 - Mexico desert 2012-04-27
Video: https://www.youtube.com/watch?v=WvbGiuKbmGM

Three accelerometers were installed in the cockpit, wing box, and tail of this B727
to measure the G forces on this remotely controlled crash test.

Figs.8 & 9 - Notice that despite the flat attitude at touchdown, the cockpit receives
higher impact forces of 12G at a VS of 1500 ft/m. The nose gear is not designed
to shear off like the main landing gears, and it acts as an anchor, adding
deceleration forces to the nose section when not landing on a runway.

Fig.8

Fig.10 - Once the main landing gear shear-off, the fuselage decelerates slower
than the nose, going over it or pushing it aside. Note that the right main gear is
flying over the right wing.

Fig.9

95
--- Survivability - Four Points
1 - During a crash landing or ditching, the G forces that reach the occupants need
to be survivable. They cannot exceed the human tolerances of 20G vertically, 16G
forward and 4G laterally (the neck being the weakest point).
There is a sequence of three impacts: the aircraft impact, the body impact against
the seatbelts and the internal organs impact against the rib cage.

2 - The volume of cabin space must not crush the individual, and aircraft
components must not become lose and injure the occupants.

3 - Seat belt integrity and proper use.

- Passenger cabin: - Seat belts need to be appropriately attached to the seat, and
the belt itself must be straight with no twists. The seat belt should be placed low
on the hipbones so that the strong skeleton of the body will take the belt loads. If
the safety belt is improperly positioned on the abdomen, it can cause internal
injuries. If the safety belt is set on the thighs rather than the hipbones, it cannot
effectively limit the body’s forward motion (submarining)*.

- Flight deck: - All five belts need to be in use to work effectively. The crotch belt
prevents submarining* when stopping fast. The shoulder harness should only be
removed after takeoff when there is enough time to put them back on should a
return to the ground occur. I commonly see shoulder harnesses being released
after retracting the landing gear or when reaching 1,000 feet altitude. This will not
allow sufficient time to put the seat belt back on after a microburst encounter or if
both engines fail.
* When submarining, the occupant slides forward under the seat belt, leading to
additional injuries due to being unrestrained and squeezed between the seat and
the belt. This has happened to pilots (and passengers) during maximum braking
on the runway.

4 - The environment needs to remain survivable: no smoke or fire, and the aircraft
should not sink quickly.

--- Crash Forces

Energy absorption is provided in aircraft design by dissipating G forces over
distance and time to reduce the magnitude of the impact to the occupants. Landing
gear and engines provide minimal energy absorption.

The other aspects of energy absorption are:

- The controlled structural collapse of the fuselage and crush zones
- Aisle floor collapse
- Energy-absorbing seat deformation

96
Fig.10 - In this narrow-body cabin drop test, the bottom of the fuselage buckles
inward, reducing the distance between the impact point and the aisle, represented
by the center arrow. The aisle passengers receive a more significant impact
sooner. Notice that the aisle dummies’ legs are already down while the dummies’
legs by the windows are still up.

Fig.10

Intentionally Left Blank

97
Fig.11 - On the following photo of a wide-body cross-section, notice the lightening
holes on the floor beams - they are oval between the window seats and under the
aisles but round where the seat tracks are attached and in the middle of the cabin
floor.

This design makes the aisles collapse first, reducing the aisle space and
maintaining the integrity of the tracks where the seats are anchored. As the center
floor sinks downwards, it encounters support from loaded cargo containers.

Note the crush zone at the very bottom of the fuselage. The beams that support
the cargo floor are arranged to allow for the flattening collapse of the crush zone.

Fig.11

98
Fig.12 - This Asiana 214 (B777) photo shows the collapse of the center floor with
the seats remaining attached to their tracks. The tiedown chain depends on the
floor tracks holding the seat anchors. The seat structure itself will absorb some of
the impacts, and the passengers held by the seatbelts will absorb the remaining
energy.

Notice that seats ABC on the left are bending towards the aisle as described
previously and that the overhead bins did not collapse because there was no
significant deceleration of the lower fuselage (see fig.15).

Fig.12

Fig.13 - As human tolerance to G forces increases downwards, the controlled seat

collapse is designed to direct some of the crash energy downwards and slightly
forward.

Fig.13

99
Fig.14 - Seat design specifications date from 1952 and changed in 1988 to include
aircraft designed after 1988 and modified in 2009 to include any cabin retrofits.
However, many airplanes flying today have old-style seats. Note the previous
requirements compared to the new ones in parenthesis. The forward strength was
increased from 9 Gs to 16 Gs to the limit of human tolerance. The seat legs are
designed to collapse the rear legs first, before the front legs, creating a down and
forward movement of 3 inches.

Fig.14

If you wonder what type of seat is installed on your flight, push the back of the seat
forward. If it is locked it is a new 16 G seat, and if it folds forward, it is an older 9 G
design.

The floor tracks are designed to sustain the 50-pound weight of the seat itself, plus
the standard winter weight of the passenger multiplied by 16, the 16 G limitation.
However, some conditions can cause an exceedance over this design. For
instance, in a crash deceleration, the luggage in an overhead bin moves forward,
and this extra weight, together with vertical G forces on the bins’ forward support,
can cause them to fail and drop. As a fully loaded bin impacts a row of seats, it
causes an exceedance to the seat anchors. As this fails, they will release an entire
row which impacts the next row, causing a domino effect.

Fig.15 - A “hit and skip” over soft terrain causes the terrain to grab and decelerate
the lower fuselage faster than the top, twisting the cabin and causing the release
of the overhead bins and the dropdown panels (see fig 17).

100
This deceleration does not happen if the crash landing is over a paved area where
the deceleration is more gradual, becoming more of a “hit and slide.”

Fig.15

--- British Midland 92 - B737 - E Midland 1989-01-08

https://reports.aviation-safety.net/1989/19890108-0_B734_G-OBME.pdf
Fig.16 - This accident is represented in the following four pictures. The second
aircraft from right to left indicates the primary 16G impact. Then the plane flies over
the M1 highway striking the embankment with 28G. The forward floor seat tracks
failed due to the 28G forces exceeding the design limitation, releasing the seats
which piled up against the galley and lavatory bulkheads. With one exception, all
cabin occupants forward of the wing suffered fatal injuries to the back of the head
caused by overhead bins and their released luggage. The pilots were severely
injured.

Fig.16

101
Fig.17 - The aircraft fractured into three sections. Of the 42 seats over the
wing box, only two separated, causing one fatality in this section. This photo
shows that the ceiling has lost the dropdown panels and the overhead bins.

Fig.17

Fig.18 - The tail flipped upward and to the right causing slower deceleration forces
in that section with no fatalities. Both engines and all three landing gears separated
without starting fires.

Fig.18

Intentionally Left Blank

102
Fig.19 - A comparison was made between this narrow-body accident and a wide-
body B747. The 16G impact suffered by the B737 would have been reduced to 4.7
G due to the larger crush zone and impact distance to the occupants of a B747.
Undoubtedly on the B747, this would translate to injuries only, instead of fatalities.

Fig.19

For additional information on Crash Dynamics

see Module 9 - Crash-landing or Ditching

Intentionally Left Blank

103
 PART 5 - BOMB VS. MISSILE DAMAGE
TWA 800 & Malaysia 17
Aircraft fuel tanks can explode, leading to thoughts on acts of sabotage using a
possible explosive device. However, explosives bend structures outwards and
leave residue traces, and a missile strike has the distinct signature of multiple
inward perforations.
When TWA 800 was lost after departing JFK airport destined to Paris, many
hypotheses were carefully studied for over four years.

--- TWA 800 - B747-131* - NY 1996.07.17

https://aviation-safety.net/database/record.php?id=19960717-0
The aircraft was lost due to a fuel tank explosion caused by faulty electrical wiring.
It had a center fuel tank temperature of 127°F when it exploded (exceeding the
96°F flashpoint of “Jet A” vapors). Its sister ship was also lost due to a fuel tank
explosion from a lightning strike twenty years earlier, over Spain, on 1976-05-09
(again, faulty electrical wiring). Both aircraft had been built for TWA but were later
sold to the Air Force of Iran, with the second of them returning to TWA years later.
* The number 131 indicates a model 100 built for Boeing’s client number 31, TWA.

Fig.20 - When the center fuel tank of TWA 800 exploded, its forward bulkhead
collapsed, causing a break on the bottom of the fuselage. This started the zipping
effect (M5) of the decompression that progressed around and to the top of the
cabin, causing the nose section to separate downwards.

Fig.20

104
Fig.21 - The aircraft (without the weight of nose section) became tail-heavy and
started to climb until it stalled and crashed into the sea. People on shore heard the
explosion, and when they looked, they saw the aircraft climbing on fire. Some
believed this to be an upward-moving missile.

Fig.21

Fig.22 - Reconstruction of the aircraft clearly shows the vertical fracture on the
fuselage due to the zipping effect of the decompression.

Fig.22

105
--- Malaysia 17 - B777 - Ukraine - 2014.07.17
https://www.onderzoeksraad.nl/en/page/5603/dutch-safety-board-
buk-surface-to-air-missile-system-caused-mh17-crash#fasen

Figs. 23, 24 - In the Malaysia 17 shooting down, the airplane was perforated by
hundreds of high-energy objects shaped like cubes and bowties. Traces of
explosives were found in the wreckage and on missile fragments found. Limited
damage to the cockpit suggests a missile exploded around 15 meters in front, left
and just above the cockpit.

Fig.23

Fig.24

106
Fig.25 - This is an interior view of the cockpit looking forward. Here too, the missile
fragment holes are visible. Many preformed fragments were found in the bodies of
the crew seated in the cockpit.

Fig.25

Note: - When searching through aircraft remains resulting from an explosive

device, the smaller debris are closer to the explosive force's location.

Intentionally Left Blank

107
 MODULE 3 - EVACUATIONS &
SURVIVABILITY

This module is intended for individuals traveling in the passenger cabin, whether
they are crewmembers or not. The guidance is based on the recommendations of
various international transportation safety boards, and it may differ from airline
onboard safety cards, which may not contain the most updated and detailed
correct guidance.

Some Surprising Facts

Accident Survival Ratios
The UK Royal Society for Accident Prevention reports that flying is safer than any
other form of transportation per mile traveled. However, when compared by the
number of trips, flying causes ten times more fatalities than car accidents.

According to a 2008 study by the UK CAA, an analysis of 283 evacuations

worldwide in which there were fatalities found that only 31% of passengers
survived.

Africa represents 3% of global flying but accounts for 18% of the accidents.

Passenger Behavior
In the 2000 study by the US NTSB of 46 evacuations involving 2,651 passengers
and 195 crewmembers, some of the findings were that during an emergency,
competitor behavior comes into play:
- 29% reported seeing passengers push others.
- 18.7% indicated being pushed.
- 12.1% reported climbing over seats to reach exits.
- 10% reported seeing passenger disputes.
- 5.6% said they pushed others.
Note: - During the ditching on the Hudson of US Airways 1549, the aft F/A
instructed “young, able body passengers to climb over seats and go forward” to
expedite evacuating the flooding rear section. Redirecting these passengers away
from the aisle also helped those that stayed. Although this was the correct
decision, it is not part of the training doctrine. Her good judgment and ability to
adapt prevailed.

108
 PART 1 - PREFLIGHT PREPAREDNESS
There are several measures we can take to prepare for a safer flight as
passengers. Some steps start at home when choosing a flight, selecting a seat,
and deciding how to dress. Others are taken upon boarding. Doing all the right
things turns the odds in our favor, and it might make the difference in surviving an
aircraft event.

Which Flight to Choose?

Select big, well-known airlines, even when flying a domestic segment. Government
aviation inspectors are assigned a certain number of aircraft; the larger the airline,
the more inspectors there will be on the property on any given day. More oversight
leaves less opportunity for cutting corners in safety issues the public cannot see.

Select the largest airplane the airline operates on your desired route, as it will be
flown by more experienced pilots and maintained by more experienced mechanics.
They are safer too; as shown in M2P4-Fig.20, wide-body planes have three times
the crush zone of a narrow-body affording a much better cushion during some
accidents, lessening injuries to the occupants.

Wide-body planes also provide a convenience factor. For example: if at an airline

hub there is a wide-body aircraft with 300 passengers and a narrow-body with 100
passengers, and both have a maintenance delay, management will assign the
mechanics to the airplane with the most passengers. If one flight gets canceled
due to maintenance, the airline must accommodate the passengers at its expense
(flights on another airline or hotel rooms).

Airlines also have arrangements with Air Traffic Control and airport authorities to
assign a higher handling priority to bigger airplanes. The logic behind it is that it is
better to have three hundred passengers leave the congested terminal (typical of
when there is bad weather) than just one hundred passengers taking that same air
traffic slot.

Seat Selection
Select an over-wing emergency exit, empty row if possible (less stress on the seat
anchors) and sit by the window. The wing box is the strongest structure of the
aircraft. If this is not available, sit no more than three rows from other emergency
exits, and in this case, sit on the aisle. Most survivors were seated on the
emergency exit or within the three rows closest to it. Usually, there are few
survivors from four or more rows away.

109
 Fig.1

Fig. 1 - Passenger density is higher in the aft section of an aircraft, which delays
an evacuation (fewer exits per passenger). The fuselage behind the wing's trailing
edge is also susceptible to separate from the wing box during a ground fire,
exposing its occupants to smoke within seconds from the beginning of a fire event.

Dress to Survive
Dress, assuming you may have to evacuate from an aircraft on fire. You want to
protect as much of your skin as possible. Wear long-sleeve shirts, pants, and socks
to protect skin from hot smoke or a brush with fire. You don't need heavy clothing,
something light that covers your skin and does not restrict your agility will do. Carry
an extra T-shirt or a ski mask for emergency use to protect your head from fire and
thin gloves. Wool materials are best, never nylon clothes (bonds/fuses with skin).
- What you don’t want to do is to use hairspray (flammable) and dress in a t-shirt,
shorts, and sandals or flip-flops. You may be flying to a beach destination, but you
are not there yet and may have to walk through fire before you get there.

Wear shoes with laces, so they stay on your feet during an evacuation. Losing
your shoes increases the chances of falling and being trampled. Keep shoes on
for takeoff and landing in case of an evacuation.
- If you remove your shoes during cruise flight, they may not fit at the end of a long
flight as feet expand under lower air pressure and prolonged sitting. Wear
comfortable shoes with laces so you can adjust them as needed, but they should
be tight for takeoff and landing.

Boarding
Obtain a pillow, a blanket and a bottle of water when boarding. During a planned
emergency landing, these items will help prevent injuries:
- Place the pillow against the seat in front of you, resting the forehead on it to hold
it in place.
- The blanket can be placed behind the head and held by both hands with the
fingers interlocked.
- Water can be used to wet any exposed skin (hands, if no gloves available) and
clothing around your head.

110
Seat Preflight
Verify if your seat has a life vest. Learn how to use it correctly. It takes about 15
seconds to retrieve a life jacket and up to 80 seconds to put it on correctly.
If the aircraft is “Extended Over Water” equipped, your seat cushion may not be a
floatation device, and the crew will announce life vest locations. Although many
airports are surrounded by water, only on an actual EOW flight is the cabin crew
required to demonstrate the life vest usage.
Check your seat for proper seatbelt installation with no twists. During crash
deceleration, a twisted belt can cut through the body. Twists must be undone at
the seatbelt hookup connection before the flight (by qualified crew or
maintenance).

--- Carry-on Luggage Storage

Fig.2 - Place soft luggage under the seat in front of you to prevent the legs from
being propelled upwards from crash deceleration forces. Breaking the lower legs
by impacting the row-support bar of the seat in front is the number one cause of
passengers becoming immobilized and overwhelmed by smoke (Southern 242).
Be aware that some operators may still be providing outdated different information.

Fig.2

Lifelines
If you accept the responsibilities associated with occupying an over-wing
emergency exit seat, be aware that lifelines exist. View the placard above the
overwing exit sign depicting deployed lifelines, as this is likely the only guidance
available to you. No information is provided to passengers about lifelines during
the preflight safety demonstration or individual exit row briefings. Know the lifeline's
stowage location, usually on the overhead bin immediately above the overwing exit
(verify with the cabin crew).

111
During an evacuation, the cabin crew will likely be at the forward and aft doors,
and the flow of passengers towards them will prevent them from assisting at the
over-wing exits. In previous water landings, had they been retrieved, they could
prevent passengers from falling into the water.

Emergency Evacuation at Gate

The need for an evacuation may happen sooner than expected. Fires at the gate
are examples of evacuations while boarding (fig.3-6).
The main cabin door should remain open with the jetway attached until all cargo
doors have been closed and service vehicles pulled away from the aircraft. This
keeps evacuation routes unblocked and allows for proper slide deployment.

Fig.3

Intentionally Left Blank

112
Fig.4

Fig.5

113
 Fig.6

Before Takeoff
Count seatbacks or armrests (not rows) to the nearest exit and an alternate exit
(forward and aft) because this is what you can touch and feel during an evacuation
(visibility may be reduced). Observe the passengers between you and the exits to
help predict their likely behavior during an emergency. Some passengers will
freeze. Those who think about what they will do are the ones who get out first. If
seated over the wing on a narrow-body aircraft, be prepared to lead an evacuation,
as there are no assigned crewmembers in this area.
During takeoff and landing, be prepared to assume the correct crash position
quickly. Be aware that overhead luggage compartments may collapse, releasing
bags over aisles and seats, injuring people and making the escape route an
obstacle course.

When to Brace
A sudden event during takeoff or landing may not allow time for a “BRACE”
command from the crew. Be prepared to brace on your own if you perceive
something is not normal and aircraft may be out of control.
“BRACE” can be announced in different ways, for example:
“Brace, brace, brace,” or “Brace for Impact,” or similar.

Brace Correctly
- Fasten the seat belt very tight to prevent body acceleration within the slack space
between body and seatbelt.
- Keep legs vertical from the knees to the feet, and do not tuck feet under your seat
(seat collapses forward and down).
- Bend over, so your torso is over your legs. If unable, lean head against the
forward seat, protecting the face with a pillow or blanket.

114
- Place a blanket on the back of your head and hold it with both hands. Interlock
fingers to help keep arms in place (fig.7 – although brace position is correct, fingers
are not interlocked, and blanket is missing).

Fig.7

Intentionally Left Blank

115
 PART 2 - WHEN TO EVACUATE OR NOT
The situations below should trigger all crewmembers to expect mandatory
evacuations due to the high risks involved. The airline should make this a
Standard Operating Procedure, which any crewmember should initiate after
attempting to communicate with the Captain.
- Smoke or uncontrolled fire. Note that air conditioning condensation or steam
from discharging water over hot brakes can often be mistaken for smoke. The
cabin crew needs specific training on this characteristic (expanded in M6).
- Aircraft sinking in deep water. However, if the plane ditched in shallow water
and is not sinking, it may be safer to stay inside and wait for direct entry to the
rescue boat. There is less risk of drowning or exposure to cold water, sharks,
alligators, etc.
- Unusual aircraft attitude or structural damage: - Accident history indicates
this is not a well-understood threat and needs further clarification.

Unusual Aircraft Attitude or Structural Damage

An aircraft in an unusual attitude after a ground mishap is at risk of an imminent

raging fire, particularly when the wings are full during takeoff or taxi for takeoff
(when fuel can easily go overboard through the air vents). This fuel and vapor can
pool underneath the aircraft and ignite, causing the airplane to catch fire.

A main landing gear collapse can cause a 10° wing down and 1.5° nose-up
attitude, which may be difficult to detect after the chaos of a mishap. A nose gear
collapse will result in a more apparent indication.

Fig.8 - Note the unusual attitude (high wing) and fuel pool underneath this DC10.
The aircraft lost directional control and went off the runway due to a tire failure
during takeoff. A wing fuel leak developed due to landing gear damage.

Fig.8 - Continental 603 - DC10 - LAX 1978-03-01

116
Fig.9 - During a rejected takeoff at 80 knots, this B707 surge fuel tank drainage
fails due to a blocked valve. Fuel goes out the vent scoop, ignites, and fire enters
the right-wing tank causing its explosion, followed by the explosion of the center
tank into the passenger cabin.
All on board were killed or injured.

Fig.9 - TWA 800 - B707 Rome 1964-11-23

Fig. 10 - During landing or subsequent taxi, fuel can still go overboard, but a higher
bank angle is required (wings not full). In this Aerolineas Argentinas F28 (1986-07-
16) overrun, overboard fuel did not ignite as the OAT was below the jet fuel ignition
point, and there was no ignition source.

Fig.10

117
Note that ignition sources can be unanticipated.
Fig.11 - Tower Air B747 N621FF (Miami December 1998) the fuel truck exhaust
ignited the fuel vapors at the fuel panel during refueling.

Fig.11

An aircraft can end up in an unusual attitude due to going off the tarmac or having
landing gear damage. This event can cause fuel leaks or hydraulic leaks in the
fuselage, wings, engines, landing gear, brakes, nose gear steering, flaps, slats,
flight controls, emergency electrical/hydraulic generation, Ram Air Turbine (RAT),
cargo doors and airstairs. Most hydraulic fluids are combustible, and a
compromised hydraulic system combined with an ignition source can lead to a fire.
Even special hydraulic fluids with fire-resistant properties will become flammable
when released under pressure, like a mist, through ruptured lines.

--- Structural damage may or may not be visible to the crew on board.
Internal damage is not visible, but resultant leaks may be visible to the firefighters.
Whether confirmed or suspected (possible), the conditions described here
necessitate that the aircraft be evacuated immediately without waiting for the
firefighters’ visual inspection. A pool of fuel could be collecting under the aircraft.

118
 Ditching

A “Prepare For Water Landing” announcement

should be included in manuals (expanded in M8P2).

In preparation for a ditching, an announcement to the passengers should be made

to “Prepare for a Water Landing” so the cabin crew and passengers become
aware and retrieve their life jackets. It takes about 15 seconds to retrieve a life
jacket and 80 seconds to put it on correctly.
However, despite the ditching in the Hudson of US Airways 1549, a “Prepare for
Water Landing” is still not on many airlines’ checklists. This may lead to a repeat
of the US Airways events when the Captain did not advise the cabin they would be
ditching, and the passengers did not retrieve their life vests.
As a passenger, if you are uncertain of the conditions, retrieve your life jacket and
always leave your belongings in the airplane.

Although it is safer to evacuate an aircraft when events happen on land (due to the
risk of smoke/fire), this is not always true when the aircraft is in the water. In some
situations, it is safer to stay on the plane. Passengers have drowned because they
abandoned the aircraft prematurely and they could not swim (fig.12).

Fig.12
Shallow Water - Ditching
An aircraft may go into the water for going off the runway or landing short of the
airport. The water around runways is usually shallow, and the plane may rest at
the bottom on its landing gear and engines, with some part of the cabin remaining
above water. There is no danger of immediate death. One can stand on a seat and
keep most of the body out of the water to preserve body temperature until direct
entry into a life raft or a rescue boat is possible (fig.12).
Some considerations before evacuating:
- Distance to the shoreline and how to reach it. Is external rescue visibly in
progress?

119
- Are life rafts available for all on board? Were some damaged, deployed inside
the aircraft, or not tied to the airplane and lost overboard? (Fig.13)

Fig. 13

- What are the water conditions? For those entering the water and depending on
its temperature, thermal shock can occur in three minutes, and swimming failure
can occur within five to ten minutes. A life jacket will not change this fact (Air Florida
90, US Airways 1549.

Fig.14

120
Deep Water
A planned ditching usually occurs at sea in deep water, and unlike the situations
above, the aircraft will sink. Depending on the aircraft damage, it may take minutes
or hours before the aircraft sinks (fig.15).

Fig.15
Fig.15 - SAS 933 - The center wing section tends to float longer. With its center
fuel tank empty, and the aft fuselage separated but the forward fuselage attached,
the aircraft will pitch down. This lifts the wingtip air vents out of the water,
preventing seawater from filling the wing fuel tanks. If the fire handles are pulled
(closing related bleed valves), this will delay water from penetrating the aircraft (or
using the ditch switch, if so equipped).

Cold-Water Immersion
The risks to people who are exposed to cold water are fairly well documented and
understood. The initial response to immersion (stage 1) has a respiratory and
cardiovascular component. Respirations may become uncontrolled, with reflex
gasping and hyperventilation. This panic response will decrease the breath-
holding time and may lead to aspiration with subsequent drowning.
A February 2008 North Atlantic Treaty Organization Research and Technology
Organization publication stated that the initial cold shock response “kills within 3-5
minutes” and that “death from cold shock is not uncommon.”

In addition, a 2003 Transport Canada publication indicated, “it has now become
clear that over half of immersion-related deaths occur during the first two stages
of immersion, i.e., cold shock and swimming failure.” The report stated that cold-
shock deaths occurred between 3 and 5 minutes, and swimming-failure deaths

121
occurred between 5 and 30 minutes. The report indicated that, during the first 10
to 15 minutes of immersion, “the cold water renders the limbs useless, and
particularly the hands. It can become impossible to carry out any self-rescue
procedure.” The report concluded, “wherever possible, entry into water below 15°C
(59° F) should be avoided. Direct entry into a life raft should be the objective”
(extract from page 76 of the NTSB link below).
https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf

PART 3 - THE EVACUATION

Captain White’s rule (Eastern 853 1965-12-04)
After a crash-landing evacuation, Captain Charles White, uncertain if everyone
was accounted for, went back into the plane that exploded, killing him. A procedure
was developed to prevent a reoccurrence. Known as Captain White's rule, it
accounts for all Souls on Board (SOB) before departure.

--- All crewmembers need to know how many people are on the plane in case
of an evacuation. This number needs to be known after the last cabin door
is closed.
The reason for all crewmembers to share this responsibility is if the pilots and the
chief F/A (usually in the forward section) become injured or killed, any other
crewmember could inform the rescuers. This procedure is not fully complied with
today, as only some pilots and the F/A who passes the information to the pilots
may know. Most times, no one knows. Such was the case of American 383. After
its evacuation, the ARFF personnel asked the Captain for the number of SOB. He
did not know and had to contact their dispatcher by phone to request the number
of souls on board.

- The Captain, during the before takeoff briefing, should mention the SOB
number so all crew in the cockpit can learn this information. This number
needs to be written on the same paper used for flight notes in plain view and
ready for when ATC asks for the number of SOB. It is common to hear pilots
responding, “we will get back to you on that later.” ATC will always ask for
fuel, souls on board and hazardous cargo information. It is not during the
emergency that time should be wasted finding information that should have
been known earlier.

- The chief F/A should inform this number to all cabin crew no later than when
making the PA to arm doors, e.g.: - “Flight attendants arm doors and cross-check,
301” (the number referring to the SOB).

122
--- Pre-evacuation
Usually, the Captain initiates the evacuation.
However, an evacuation can be initiated by any other crewmember who
deems it necessary and is unable to (or not practical to) establish
communication with the Captain. In the interest of safety, do not delay the
evacuation.
F/A’s need to attempt to communicate with the pilots before initiating an evacuation
so that they can clear the evacuation route: retract spoilers, extend flaps,* shut
down all engines and discharge engines and APU fire extinguishers. However, if
unable to communicate with the cockpit, once an exit opens, there is an electronic
annunciation in the flight deck, and the pilots may become aware (if not impaired)
that an evacuation is in progress.
* (airplanes with overwing exits).

--- Delta 1288 - MD88 - Pensacola 1996-07-06

https://aviation-safety.net/database/record.php?id=19960706-0
An uncontained engine failure during takeoff causes two fatalities and several
injuries in the aft cabin. As the aircraft’s electrical power was lost, the aft cabin F/A
could not communicate with the flight deck and initiated an evacuation (fig.16).

Fig.16

Engine Failure/Fire on the Ground

Operators should have a dedicated checklist that shuts down all engines due to
evacuation concerns. There is no requirement to confirm lever and switch selection
with other pilots before shutting down all engines when on the ground.

Caution (pilots): - If the emergency is an engine fire and the aircraft does not have
a separate checklist for Engine Failure/Fire on the Ground, you would not be

123
shutting down the other(s) engine(s) until being on the Evacuation Checklist,
causing a delay in the evacuation announcement.
Cabin crew (or passengers) may start an evacuation on the opposite side of the
fire, which would be the one with the engine(s) still running. Passengers can be
ingested or pushed by the engine(s), causing death or serious injuries. Evacuation
slides on the same side and closest to the operating engine(s) are unusable until
engine(s) are shut down.

--- American 383 - B767 - Chicago 2016-10-28

https://reports.aviation-safety.net/2016/20161028-2_B763_N345AN.pdf
During takeoff, the right engine exploded, and the airplane came to a stop on the
runway. Eight seconds later, with fire visible on the right side, an evacuation was
started on the left side with the left engine still running. Not having a specific
checklist for an Engine Failure/Fire on the Ground (that would shut down all
engines immediately), the pilots followed the normal sequence of executing the
engine fire checklist leading to the evacuation checklist. The pilots were met by the
lead flight attendant when they exited the cockpit, who informed them that
everyone had evacuated the plane. There were 20 injuries during the evacuation.

Discharging engines and APU fire extinguishers should be a standard

evacuation checklist procedure even when there is no fire at that moment.

--- During an evacuation, whether it is due to a fire or not, it should be a standard

procedure for pilots to discharge all the fire extinguishers for the engines and
APU (not needed if ditching). Even if there is no fire when the evacuation starts,
one could start later. Their thin thermal discharge line is not sufficiently large to
release the agent quickly enough during the rapid increase in pressure. Emptying
the fire extinguishers prevents them from exploding when exposed to direct fire.
When they explode, the shrapnel can injure or kill evacuees and rescuers.
Discharging the fire extinguishers also has the benefit of cooling the engines,
reducing the chances of igniting fuel vapors.

Caution: When exposed to a fire, oxygen bottles release over-pressured oxygen

from blown-off valves and increase the intensity of a fire (British Airtours 28).

Intentionally Left Blank

124
Fig.17 - If an evacuation starts before a fire erupts, it is usual to find the fire handles
pulled but with no twist, indicating no attempt to discharge the fire extinguishers.
This is a shortcoming of evacuation checklists that do not specify to discharge all
fire extinguishers.

Fig.17

Once the pilots complete the evacuation checklist and the airplane is configured,
the Captain will give the command to evacuate. The F/O should be exiting the flight
deck at that time to lead the passengers on the ground.

--- Shouting Evacuation Commands

There are several reasons for the cabin crew commands to be shouted. The
guidance needs to be heard over a possible noisy evacuation. We want to block
passengers’ from taking actions that are not part of the evacuation plan (e.g.,
retrieving carry-ons). And we also want passengers to snap out of the daze they
might be experiencing.

The passenger behavior of not taking any action after the plane comes to a stop
is common after a planned evacuation or actual crash event. Passengers have
reported being in disbelief, happy they have survived, and do not realize they are
still in danger. Additionally, when there are crash impacts, passengers report being
in a daze for an undetermined period.

In some accidents, the cockpit may have higher impact forces, causing traumatic
shock to the pilots. Some pilots reported hearing the noise of the evacuation, and
it was this that prompted them into action. If unable to call the pilots, a F/A should
enter the flight deck to bring the pilots back to being functional crewmembers.
F/A's need to enter the cockpit to verify that the pilots are not incapacitated,
particularly if they could not communicate before the evacuation. Sometimes pilots
are left behind.

125
--- Evacuating Passengers
The F/O and one aft F/A should be the first persons off the airplane to guide the
evacuating passengers.
Once off the aircraft, the F/O* (on the right side) and the F/A of the left rear door
should assemble passengers upwind and far away from the plane to avoid toxic
fumes and lessen possible flying debris from explosions.
Passengers should be lined up with the edge of the pavement to account for them
so that crew or airport rescuers do not have to risk going back inside the aircraft
looking for survivors.
See the perfect evacuation of Continental DC10 in London (below).

* Note: - It is common to find evacuation procedures directing the F/O to exit from
his R2 window. The aircraft certification process requires a demonstration that the
passenger cabin can be evacuated in 90 seconds, with 50% of random exits
blocked. The cockpit crew is supposed to evacuate using the cockpit exits.
However, this is not the safest course of action for the pilots. They commonly
become injured (friction burned hands, broken ankles, etc.) and incapable of
performing their outside evacuation duties. The Captain should evaluate the safest
course of action and be prepared to instruct his crew to use cabin door 1
(preferably 1R if the airline has guidance for the 4L F/A to lead the aft section
evacuation and line up the passengers upwind and away from the aircraft).

A Perfect Evacuation
--- Continental DC10 in London
Fig.18 - Engine 2 fire during taxi for takeoff with subsequent evacuation.
Note that passengers are lined up on the taxiway, and the fire trucks (near plane)
are separated from the ambulances (near passengers). The crew did an excellent
job. This is what an evacuation should be. Note the failure of slide 3L to remain
deployed as it contacted the hot engine.

Fig.18

126
--- Cathay Pacific 780 - Hong Kong 2013.04.10
Fig.19 - Note passengers grouping. If passengers are not lined up and counted by
the crew, it is unknown if someone is still on board.
Note the ambulance away from the passengers and in the way of the fire trucks
(this procedure is sometimes known as a Chinese Fire Drill).

Fig.19

--- Southwest 345 - LGA 2013-07-22

Airport authorities may have independent crowd control procedures, which may
not include accounting for the number of people on board before moving them
away. Notice the officer directing passengers towards the airport terminal.
These procedures need to be pre-arranged and coordinated between the airlines
and the airport authorities, fig.20.

Fig.20

127
 PART 4 - EVACUATION CONCERNS
--- Inability to Extend Flaps for Evacuation
Suppose an evacuation occurs during taxi or takeoff. In that case, flaps may not
extend if the engines were damaged or shut down before flap extension (and the
APU is not powering the electrical system). After an accident, it may not be prudent
to leave one engine running to extend the flaps. It would be more sensible to
routinely leave the APU running until completing the takeoff (see APU use in M13).

--- Jet Airways 2374

Figs.21 - After a runway excursion, both engines sustained damage. Although
pilots selected full flaps for the evacuation, the APU was not on, and the flaps did
not move from the takeoff 5-degree position.

Figs.21

128
--- Cockpit Evacuation and Pilot Injuries
The normal and sometimes the only way to evacuate the flight deck is to use the
escape rope. Pilots are not adequately trained on safely exiting through their
windows, and they are not provided with the necessary gloves. Typically, they
become injured in the process. Many jump, breaking their ankles.
- Which leg goes out first, and where will the foot find support?
- While exiting, should the pilot face the front or the back of the airplane?
Always check the procedure that applies to your specific aircraft.

Once they exit through the cockpit window and the bodyweight transfers to the
rope, they tend to slide down and cause friction burns to the hands.
The shearing force can further remove the skin and fat tissue, causing damage to
the tendons, which can be permanent, depending on the severity.
During an emergency, if the aircraft ends up in an unusual attitude, the cockpit
window could be further from the ground, which increases the length of sliding
down the rope (fig.22).

Even one main gear collapse or fire can cause the cockpit
to tilt, raising the evacuating side from the ground.

Fig.22

Gloves should be available for each cockpit seat to prevent injuries, co-located
with the escape ropes and part of the MEL. Leather is better than rubber which
allows heat transfer and becomes damaged more easily.
Until implementation, there are several remedial considerations:
- Many pilots use a towel to protect the uniform trousers from seat belt wear and
tear. These can be used, but heat transfer will occur, and friction can rip the towel

129
when sliding down the escape rope. Some pilots use the food tray linen instead,
but these would be too thin for this purpose. You would be better off using your
uniform coat for hand protection (which should be fire-resistant).
- A better plan would be for pilots to have their own set of leather gloves and wear
them during takeoff, departure, approach and landing. If needed to enter data or
for touchscreen or mouse functionality, the very tip of one glove finger can be cut
(without exposing the fingerprint side). Some sport gloves expose the fingertips,
and they would cause burns when sliding down the escape rope, making them
inadequate.

--- Note: - The following two recommendations from M6P3 and M13P are included
here so Cabin Crewmembers do not miss them.

--- Wing Configuration/Contamination

Occasionally, aircraft crash during takeoff due to the flaps not being set. Cabin
Crew recognition of slat/flap extension can prevent takeoff configuration accidents.
Cabin Crew manuals should include photos of a wing with flaps up and with takeoff
flaps. As a backup, a routine before-takeoff visual check performed by a cabin
crewmember would have prevented many fatal accidents and incidents.

--- PBE Training

Crews should train on how to safely use PBE’s by practicing activating oxygen
generation (live equipment). Actual smoke/fire events indicate that crews are
sustaining burn injuries caused during the oxygen generator activation.

Intentionally Left Blank

130
--- Window Shades
Closed window shades cause loss of outside references and disorientation when
the fuselage rolls sideways or upside down. Aisle-path lighting will be above and
invisible due to smoke, adding to the disorientation. Releasing the seat belt,
without sensing gravity first, causes occupants to fall to the ceiling, creating serious
and fatal injuries on passengers that had survived the crash (United 232). Window
shades should be verified open for takeoff and landing, and passenger safety
cards should have guidance on how to protect yourself when releasing the seat
belt if the plane is inverted (fig.23).

Fig.23

--- Unintentional Evacuation

Some pre-departure safety announcements may include wording similar to:
- “This aircraft is equipped with aisle-path lighting. In case an evacuation becomes
necessary, follow the white lights to the red lights; they indicate an exit.”
Should the emergency lights be turned on before the decision to evacuate, any
passenger who follows instructions may stand up and initiate an evacuation. Once
started, it is difficult to stop. Be aware of the safety PA wording and how that may
conflict with the emergency lights’ timing.

--- Aisle Path Lights

Red lights indicate exits (red light is more visible through the smoke, and the
bottom 3 feet of the cabin stays clear of smoke). However, many passengers
associate red with danger or stop, and they stop and block the momentum. Expect
this and be prepared to bypass the individual and lead the evacuation or command
with instructions to “go go go.”

--- PA System
When using the PA system to initiate an evacuation, consider that it may have
become inoperative in other zones. Always back it up with the megaphone or voice
commands.

131
--- Aircraft Sides
There is a long accident history of cabin crews confusing port and starboard or
aircraft left and aircraft right sides. Instead, sides could be referred to as Captain
side or co-pilot side.

--- Carry-on Luggage Retrieval

During an evacuation, people lose their lives directly or indirectly because of carry-
on luggage in the overhead bins.

There is no record of any evacuation where passengers did not reach for their
carry-ons. People lose their lives because others ahead of them are retrieving their
carry-ons, delaying the evacuation, and preventing others from escaping.

For decades, transportation safety boards have been making recommendations to

regulators to research how to prevent passengers from obstructing aircraft
evacuations by retrieving carry-on luggage. The safety boards have requested an
analysis of a more realistic simulation of passenger behavior regarding carry-on
luggage in the test criteria and procedures for the emergency evacuation
demonstration. Excessive and unnecessary time has passed with no effective
resolutions. No more recommendations or deliberations are necessary. The fix is
simple.

People will always reach for their carry-ons if available, and there are only two
ways to prevent this occurrence. Both procedures preclude luggage from being
available during an evacuation:
- Regulations and cabin design need to change to allow the cabin crew to lock
overhead bins during taxi, departure, and arrival, or:
- A much safer approach would physically remove the overhead bins, precluding
luggage from causing fatal injuries to passengers and bins themselves from
becoming cabin debris and an obstacle course for the evacuation.

Note: - Carry-on proper storage is under the seat. See explanation - Carry-on
Luggage Storage M3P1.

--- Doors do not open

In certain conditions, the aircraft may not depressurize. It may not be apparent until
encountering difficulties in opening the exits - outflow valve impact damaged in the
closed position, loss of electrical power to it, inability to shut down engines, to name
a few.

132
Use the crash ax’s pointed side to hit a window’s corner repeatedly until
reaching and breaking the outer pane. This will depressurize the airplane and
allow the exit doors to open. Fig.24.

Fig.24

--- Doors open but close again

In strong winds or on aircraft in unusual attitude situations, doors may open nearly
all the way but not sufficiently to engage the locking mechanism. In this case, the
door tends to return towards the closed position and perforate the slide or prevent
its deployment.
If the airplane is in an unusual attitude, the lower side doors will be the most
susceptible to this occurrence. Be prepared to manually assist the door opening
until the gust lock is engaged.

--- Slide Deployment Failures (cabin materials)

Magazines and newspapers make the floor slippery during an evacuation, help
feed fires, and prevent slides from deploying by blocking the air inlet of the
aspirator (Asiana 214 B777 San Francisco 2013-07-06, 6 out of 8 slides did not
deploy). Headsets and their strong cords will become obstacles during an
evacuation. Magazines, newspapers, and headsets should only be distributed
after being airborne for a reasonable amount of time, allowing for their retrieval
before landing during an air return. All need to be retrieved before landing. If there
is no time, passengers must be instructed to stow them away.

--- Slide Deployment Failures (wind)

Crosswinds can make slides unusable. Slides are certified for a 25-mph crosswind
which is less than the usually demonstrated crosswind of most aircraft types. If the

133
plane is tilted or if the slide vacuum system becomes obstructed the deployment
may fail at substantially lower crosswind speeds.
This is another important reason pilots align the plane with the wind before
stopping on the runway after a rejected takeoff or a landing emergency (expanded
in M4P2 - The Stopping Procedure).

Fig.25A - Hapag 3378 2000-07-12

Fig.25B - Test Flight Sukhoi 2013-07-21

--- Uniforms
Crew uniform is a safety matter. It should be fire-resistant, and as the word
“uniform” implies, it should give an identical appearance to each crewmember.
However, some airlines provide choices among several combinations of clothing
components in various colors, resulting in each crewmember looking different than

134
the next, defeating the purpose of a uniform. Passengers need to be able to quickly
identify a crewmember, especially during an emergency.
An evacuation is a stressful situation, and people tend to develop a narrowed field
of vision or tunnel vision. People look at faces, and it is easier to see shoulder
epaulets than stripes on the jacket sleeve. All crewmembers, including cabin crew,
should have shoulder epaulets on their shirts to help being recognized as crew, or
passengers may not follow their commands during an evacuation. During taxi,
takeoff, and landing (when evacuations can happen), F/As should not wear their
jackets to clearly display their shoulder epaulets.

People Express (and Frontier Airlines) had plain suits as their uniforms with no
ranking stripes. They cross-utilized their employees on different functions; a
crewmember could also become a ground agent wearing the same uniform. The
FAA realized that being unable to distinguish crewmembers from passengers was
unsafe and discontinued this practice.

Intentionally Left Blank

135
 MODULE 4 - TAKEOFF & RUNWAY ISSUES

PART 1 - REASSESSING THE V1 CRITERIA

Decision speed has always been linked to V1. However, the runway environment
and the aircraft have improved substantially in the last 60 years. Nevertheless, we
are committing to fly based on principles of decades ago. As mentioned in M1P4
(see the video presentation from the Department of Military Instruction at West
Point), we are still doing things the way they have always been done, without
questioning why.

In simple terms, V1 speed principles are based on the capability to:

- Reject the takeoff and stop on the remaining runway* after a single power
loss as the only factor.
- Or continue the takeoff and achieve liftoff on the remaining runway (without the
need to increase thrust if performing a reduced power takeoff).
It assumes that spoilers, anti-skid, brakes, and tires all function correctly and that
airplane acceleration was normal.
Thrust reversers were not part of the stopping criteria for certification purposes.
This process has changed, and the B787 was the first plane certified under the
new standards.
* An overrun is defined by the nose gear passing the end of the runway.
By how much it passes depends on the circumstances and determines the
consequences. Note that at V1, the takeoff may be either continued or rejected.

--- The fact is that some events perceived only at or after V1 can deny flying
capability. When considering a reject at or above V1, the deciding factor needs to
be which scenario is likely to cause the least harm (fatalities, injuries and material
damages).

Go / No Go
During takeoff, pilots keep their hand on the thrust levers until V1 to initiate a reject.
At V1, their hand comes off the thrust levers, and the Go / No Go state of mind
changes into “Go,” and the option to reject fades away quickly.

Many aircraft bypassed the opportunity to reject at or after V1 and became airborne
only to crash a few seconds later, in the second segment.
To better understand the necessity to reevaluate decision speed, we need to
consider the takeoff environment in which the current reject philosophy originated.

136
--- FAA Rejected Takeoff Study
In 1989, the FAA started a study of about 3,000 RTO’s that had occurred between
1959 and 1990 (the findings are contained in the FAA’s Takeoff Safety Training
Aid (AC120-62 dated Sept. 12, 1994) and in the FAA training video “Rejected
Takeoff and the Go / No Go Decision.” This study focused on 74 RTO’s that
resulted in overruns.
The conclusion was that if the pilot had not started the reject procedure by V1,
there was a strong possibility for an overrun (nose landing gear passing the end of
the runway).

--- The Old and The New

Technology, aircraft systems and runways have evolved significantly since the
1959-1990 data used in the FAA study.

The runways
The events took place in shorter and non-grooved or crowned runways. Today’s
longer runways designed for jumbo jets afford more room to stop. With better water
drainage, runways provide improved runway friction and stopping capability both
in the distance and directional control (remaining on the runway allows one to take
advantage of the longer distance).

The engines
Earlier airplanes were underpowered and consequently became airborne closer to
the end of the shorter runways. Almost all takeoffs were at full power, which
resulted in more engine issues during takeoff. Most takeoffs today are performed
at reduced power, and engine events are rare. Having much more thrust, aircraft
accelerate faster and stop faster on account of the increased reverse thrust.

Tires and brakes

- Tires today have a better overall design, generating less stress and less
overheating. Sidewall design improvements benefit crosswind landings (tire
cornering effect). These tires can operate at higher internal air pressure, raising
the aquaplaning speed and resulting in better control of the aircraft during takeoff
and landing.
- Carbon brakes with the assistance of anti-skid are also much more effective in
stopping the airplane.

The RTO procedure

- The rejected takeoff procedure was entirely manual, requiring a pilot to reduce
thrust levers to idle, then pull the spoilers (to transfer the weight to the tires). Only
then could he start applying the brakes before moving his hand again to apply
reverse thrust. By this time, the engines had spooled down.
- Modern aircraft allow a pilot to reject a takeoff by simply bringing the thrust levers
to reverse while automatically deploying the spoilers and the brakes. The reverse

137
uses higher thrust because engines did not have time to spool down and are more
powerful.

The “GO mode” and the “mini V1”

- This FAA study amplified the “GO mode” predisposition in training departments
and the flight crews. Many companies went further in the reject philosophy by
creating a high-speed regime at 100 knots perceived by some pilots as a “mini-
V1,” as it abandons some of the reject decision criteria.
- As this “mini-V1” did away with the 80 knots call out, this speed cross-check lost
part of its function, as it shared the pilot’s attention with the perceived higher priority
of the “Go / No Go” decision (this cross-check is reviewed in M11).

This “GO” predisposition is typified in the following two accidents:

--- BH Air 5378 - Airbus 320 - Verona, Italy 2009-09-01

https://aviation-safety.net/database/record.php?id=20090901-0
During takeoff and approaching 100 knots, the aircraft starts an uncommanded
pitch up (incorrect Weight & Balance). Despite both pilots setting the pitch trim
down, the airplane does not respond and continues to self-rotate, causing a tail
strike. The Captain does not reject the takeoff, and the continued tail scraping
ruptures the pressurized hull. Despite subsequent degradation of flight control laws
to alternate law and direct law and the stall warning activation immediately after
liftoff, the flight continued to its intended destination (“can do” attitude?).
The airplane did not pressurize after takeoff, but this was not noticed until the
10,000 feet cabin altitude automatic warnings came on. At that point, the crew
decided to return for landing.

--- TIA 863 - DC8-63 - JFK 1970-09-08

https://aviation-safety.net/database/record.php?id=19700908-1
The airplane self-rotated 1500 feet into the takeoff, causing a tail strike. The pilots
continued the takeoff, dragging the tail for an additional nine seconds until the
plane became airborne. The DC8 rotated slowly to 75° nose-up, climbing to 400
feet, then rolled 20° right, followed by a rollback to the left until the wing was
perpendicular to the ground, and crashed, resulting in no survivors. A foreign
object caused a nose-up jammed elevator.
The “Go mode and can-do attitude” can be strong sentiments, even in extreme
cases. Both these aircraft could have safely aborted the takeoff.

Intentionally Left Blank

138
 Rejected Takeoff
There is little guidance in the manuals or during training concerning the different
possible symptoms of an unsafe or unable to fly condition. Simulator training
scenarios ensure that there are adequate cues to clearly interpret the nature of the
emergency (engine failures or any fire indications). Still, in the real world, they are
not so clearly defined. A series of muffled thumps may simulate compressor stalls.
A loud bang may suggest a catastrophic failure.
But in the real world, it could be an engine or a tire, or it could also be a bomb or
anything else which is impossible to identify directly. How can the crew have
confidence that the aircraft is safe or capable of flying? It simply cannot.

If the event does not match the pilot’s previous training or actual flying experiences,
decisions are delayed waiting for a secondary indication*. This hesitation will push
the mindset to the “Go mode” as the runway end approaches.
* (See startle effect).

- Airmanship Development (as Initial and as Recurrent Training)

There is a need to discuss uncommon events that may lead to unsafe or unable to
fly conditions. If they are left out, they will be perceived as unforeseen when they
occur. Tomorrow’s “unforeseen” events have been reoccurring for decades.
Examples: early self-rotation or unable to rotate at Vr, unidentifiable threatening
noises or vibrations, difficulty in directional control with no apparent cause and
many others. When one of those conditions occurs, they are likely to be ignored
because they are not part of the plan (expanded in M1P5, Mental Model Concept).

The lack of discussion regarding the consequences of a possible overrun,

alongside the results of becoming airborne with an aircraft unable to fly, leads to
neither of the adverse effects being considered in the decision process.

A more efficient approach is by referencing previous incidents, educating crews on

the symptoms of different anomalies. Correctly perceiving the threats triggers an
early emotional sense of danger and initiates action through conviction.
The analysis provided throughout this book is the type of Airmanship Development
that should exist in recurrent training.

Intentionally Left Blank

139
--- Rejected Takeoff Considerations
Fig. 1 - The following chart is from a modern wide-body aircraft operated by a large
global airline. In that manual, a statement reads: - “Historically, rejecting a takeoff
near V1 has often resulted in the aircraft coming to a stop beyond the end of the
runway.” This statement appears to reference the 74 overruns from the 3,000
rejected takeoffs FAA study of 1959-90.

“Coming to a stop beyond the end of the runway” is a better option than crashing
after takeoff. The fact is that most aircraft (2,926) did stop within the confinements
of the runway. The 74 (2.46%) that stopped past the end of the runway had few
consequences even when the aircraft was a write-off.

But because of the “Go mode” mindset, the much greater risk is how many aircraft
will not reject because of the overrun concern?

Fig.1

--- Note that most considerations are disregarded above 100 knots.
This guidance does not reflect the lessons from the accidents of the past decades.
Let’s review some of these events and consider how consequential they are and
why they should not be ignored.

- Unusual noise or vibration during takeoff typically originates from the larger
and fast-moving components of an aircraft, the engines, the tires (and the
propellers if so equipped). This can be associated with imbalanced engine
components, tire failures or dragging brakes.

140
- Abnormal acceleration can be caused by the above factors. Erroneous thrust
indications (resulting in lower thrust) and overweight conditions can also cause
abnormal acceleration (invalidating takeoff distance calculations and V1) and may
result in an after-takeoff crash once the airplane leaves ground effect.

- Tire failure (shrapnel) can cause an uncontained engine failure or a wing fire. A
dragging brake or a tire issue can cause a wheel well fire and loss of the aircraft.

- The takeoff configuration warning being disregarded above 100 knots (on the
fig.1 chart) appears to assume that because the warning should sound as the
throttles are pushed for takeoff, the reject could be performed before 100 knots.
However, systems sometimes have intermittent failures, and a warning could
activate later. A combination of distractions could preclude the pilots from
processing the warning sounds. Or systems ignorance can lead the pilots to ignore
the warnings. Such was the case with LAPA 3142 and Onur Air 2264, where the
warning sounded throughout the takeoff, but the pilots did not respond.
What would be the reason not to reject for a configuration warning above 100
knots? Why are the above items not on the chart? Accident data clearly indicates
the need. The “100-knots mini-V1” and its associated “GO mode” are an
impairment to safety.

Air Florida 90, Air France 4590 Concorde, Mexicana 940, Nationair 2120, Swissair
603, to name a few, were lost for the events described above and ignored on the
chart. They all presented symptoms of the anomalies, and if the pilots were
schooled on the threats, they could have performed a rejected takeoff.
These conditions will continue to cause new accidents as they have not been
addressed.

--- LAPA 3142 - B737 - Buenos Aires 1999-08-31

https://aviation-safety.net/database/record.php?id=19990831-0
Crew distraction with non-pertinent conversation (family problems) leads to the
flaps not being selected for takeoff. Takeoff configuration warning sounds
throughout the takeoff but is not acted upon (Go mode?).
The airplane stalls after becoming airborne, killing 65.

--- Onur Air 2264 - MD88 - Netherlands 2003-06-17

https://aviation-safety.net/database/record.php?id=20030617-0
As the takeoff starts, the configuration warning sounds, the throttles are brought to
idle, and the plane stops. The stabilizer trim is reset. As the takeoff restarts, the
configuration warning sounds again as the stabilizer is still incorrectly set. But the
Captain ignores it and continues while the warning keeps sounding throughout the
takeoff. At Vr, the airplane does not rotate, the takeoff is rejected at 128 knots, and
the plane overruns at approximately 75 knots (the takeoff restart left 150 to 450
feet of runway behind). The airplane impacts the concrete structures of the
approach lights and comes to a stop 300 feet from the runway. The Captain did

141
not turn away from the centerline. After the evacuation (no fire), the pilots stayed
on board until the airport rescuers came on board (dazed?).
Note that despite initiating the reject after rotation speed, there were no injuries to
the 149 SOB. The plane was repaired.

Runway Overrun Plan

If it appears the airplane may go off the runway, it is important to steer away from
structures or ditches before losing the nose wheel steering. However, if the runway
is equipped with EMAS (Engineered Material Arresting System), damage will be
contained if the airplane maintains centerline.
Before operating to/from an airport, the pilots should become familiar with the
overrun conditions for the different runways. What is the overrun takeoff/landing
plan for this runway, left, right or centerline? Include the words “centerline overrun”
during the takeoff and approach briefing, so this becomes part of the plan on
EMAS-equipped runways. When choosing "left or right overrun," consider steering
away from structures.

With longer runways and increased aircraft stopping capabilities, a reject at or

shortly after V1 if it results in an overrun is likely to be at low speed, causing little
or no damage to the aircraft.
Overruns above 40-50 knots are likely to collapse the nose gear, usually causing
no injuries to the occupants.

A reject after Vr may result in a higher speed overrun. Still if the deceleration
forces are within human tolerances (no sudden impact and stop), the chances for
survival are historically good.

Even a return to the ground after being briefly airborne (controlled arrival) has
fewer consequences than persisting in flying an airplane that is losing its capability
for flight. An in-flight crash during the second segment always results in high
fatalities (vertical speed added to the higher flight speed impact forces). Do not
bypass a “controlled arrival” and turn it into an uncontrolled flight into terrain (UFIT).

Runway Overrun Summary of Events

This list includes takeoff and landing overruns of jet aircraft typically used by
airlines. Only takeoff events where the reject is initiated after V1, Vr or V2 are
referenced. The purpose is to compare the overrun conditions and the
consequences.
The “close to V1” rejects that resulted in overruns were usually because they were
above the MTOW for the conditions, or the pilots did not initiate the stopping
procedure correctly. However, they are included to show that even when this
occurs the consequences are minimal. Some less disciplined operators, especially

142
cargo operators, inform the crew of a lesser than actual aircraft weight. This is
common and significant and can be seen on liftoff towards the end of the runway.
It becomes apparent when the plane does not rotate and turns into an overrun.

Some accident reports do not contain all the desired information, but they have
enough information to reach an educated conclusion. Note that heavy aircraft can
have a time gap between V1 and Vr of up to 8 seconds (especially older models).

Abbreviations:
DBR = Damaged Beyond Repair - this does not necessarily mean there was
substantial damage. In older planes, it usually simply means that the repair cost
does not justify the expense, considering the number of cycles left on the aircraft.
SOB = Souls on Board.

--- Air France 358 - A340 - Toronto 2005-08-02

https://aviation-safety.net/database/record.php?id=20050802-0
Landing overrun at 80 knots. Aircraft destroyed. 309 SOB, no fatalities.

--- Air France 187 - B747 - Delhi 1988-07-24

https://aviation-safety.net/database/record.php?id=19880724-0
V1 156, takeoff rejected at 172. Overrun, main gear collapse. 275 SOB, no
fatalities.

--- Air France 7775 - Fokker 100 - Pau 2007-01-25

https://aviation-safety.net/database/record.php?id=20070125-0
The takeoff was rejected from a height of 107 feet and a peak speed of 165 knots
(Sabre dance). Overrun of 1,115 feet, loss of both main gears. 54 SOB, no
fatalities.

--- Air Mediterranee 8177 - A320 - Paris 2009-02-07

https://aviation-safety.net/database/record.php?id=20090209-0
Landing overrun of 65 feet at 41 knots. Minor airplane damage, no injuries.

--- Aeroflot 212 - TU154 - Stockholm 1978-11-14

https://aviation-safety.net/database/record.php?id=19781114-1
Takeoff rejected at rotation. Overrun of 600 feet. The plane suffered substantial
damage. 74 SOB, no fatalities.

--- Aeroflot TU134 - Penza 1986-06-22

https://aviation-safety.net/database/record.php?id=19860622-1
Takeoff rejected at 133 knots and braking starting at 377 feet from the runway’s
end. The airplane overran down a ravine before it came to a stop. Plane DBR. 59
SOB, one heart attack fatality.

143
--- Aeroflot TU154 - Georgia 1990-10-20
https://aviation-safety.net/database/record.php?id=19901020-0
The plane failed to rotate (overloaded), and reject was initiated. Overrun of 2,562
feet, plane DBR. 171 SOB, no fatalities.

--- American 70 - DC10 - DFW 1988-05-21

https://aviation-safety.net/database/record.php?id=19880521-0
V1 166 knots, reject at 178 knots. Deceleration was normal until 130 knots, where
a rapid decay of deceleration occurred due to eight of the ten brake sets failing*.
Overrun of 1,100 feet at 95 knots, nose gear collapse. 254 SOB, no fatalities.
* The brake set failures were attributed to the brake indicators being at their lower
limit before takeoff. It was not known then that they would not support a maximum
effort stop (this system has been modified).

--- American 633 - DC10 - San Juan 1985-06-27

https://aviation-safety.net/database/record.php?id=19850627-0
Reject at V1 of 141 knots. The aircraft had lost two tires, and the Captain overran
the runway to the safest side (overrun plan). The airplane suffered substantial
damage. 270 SOB, no fatalities.

--- Ameristar Jet Charter 363 - MD83 - Detroit 2017-03-08

https://aviation-safety.net/database/record.php?id=20170308-0
V1 139, Vr 150 knots. Reject at 151, peak speed 173 knots. Overrun of 1,131 feet
at 100 knots, nose gear collapse. 116 SOB, no injuries.

--- Ariana Afghan Airlines 312 - B737 - Delhi 2014-05-08

https://aviation-safety.net/database/record.php?id=20140508-0
Landing overrun of 890 feet. Plane DBR. 132 SOB, a few minor injuries.

--- ASL Airlines Hungary 7332 - B737 - Italy 2016-08-05

https://aviation-safety.net/database/record.php?id=20160805-0
Landing overrun of 984 feet at 109 knots over the airport perimeter fence.
Plane destroyed, no fatalities.

--- Canadair CL-600 - Tupelo 2005-03-09

https://aviation-safety.net/database/record.php?id=20050309-1
V1 128, Vr 134, reject between 140 to 145. Overrun, nose gear collapse and
substantial damage. No fatalities.

--- Canadair CL-600 - Teterboro 2005-02-02

https://aviation-safety.net/database/record.php?id=20050202-0
Rejected after Vr. Plane destroyed, no fatalities.

144
--- Canadair CL-600 - Teterboro 2003-12-16
https://www.ainonline.com/aviation-news/aviation-international-news/2007-02-
01/challenger-pilot-said-yoke-was-jammed-teb-crash
Reject after Vr. Minor damage, no injuries.

--- Canadian Airlines 17 - DC10 - Vancouver 1995-10-19

https://aviation-safety.net/database/record.php?id=19951019-0
V1 of 164 knots, reject was initiated 1.3 seconds later, peak speed 175 knots.
Overrun of 255 feet at 43 knots, nose gear collapse. Substantial damage to the
aircraft. 257 SOB, 6 minor evacuation injuries.

--- Gulf Air 71 - B737 - Abu Dhabi 1997-03-10

https://aviation-safety.net/database/record.php?id=19970310-0
Reject at V1. Overrun, nose gear collapse, aircraft DBR. 115 SOB, no fatalities.
(Report is vague).

--- Indian Airlines 571 - A300 - India 1976-09-29

https://aviation-safety.net/database/record.php?id=19860929-0
Reject at 150 knots during rotation. Overrun, plane DBR. 196 SOB, no fatalities.

--- Kazakhstan Airlines TU-154 - Karachi 1995-01-21

https://aviation-safety.net/database/record.php?id=19950121-0
The plane did not liftoff at rotation (overweight by 12,000 pounds), and takeoff was
rejected at 150 knots after Vr. Overrun of 1,640 feet, nose gear collapse, plane
DBR. 117 SOB, no fatalities.

--- LACSA 628 - B727 - Costa Rica 1988-05-23

https://aviation-safety.net/database/record.php?id=19880523-0
The plane did not liftoff at rotation (incorrect CG). Overrun, plane destroyed.
26 SOB, no fatalities.

--- Lion Air 386 - B737 - Indonesia 2002-01-14

https://aviation-safety.net/database/record.php?id=20020114-1
Reject at V2+15 of 158 knots as the airplane did not liftoff*. Overrun of 902 feet,
plane DBR. 108 SOB, no fatalities.
* Although the flaps had been selected for takeoff (but not verified), the flap system
failed and did not extend the flaps or activate the takeoff configuration warning.

--- Lufthansa 8457 - B747 - UAE 2004-11-07

https://aviation-safety.net/database/record.php?id=20041107-0
V1 162, Vr 174, takeoff rejected at 165 knots, peak speed 175 knots. Overrun of
98 feet, nose gear collapse, plane DBR, no injuries.

145
--- Northwest 985 - A320 - DTW 2001-03-17
https://aviation-safety.net/database/record.php?id=20010317-1
Reject from 20 to 30 feet after self-rotation at 110 knots. Overrun of 700 feet, plane
substantially damaged. 151 SOB, three minor injuries during the evacuation.

--- ONA 32 - DC10 - JFK 1975-11-12

https://aviation-safety.net/database/record.php?id=19751112-1
Fig.2 - Although this reject was initiated below but approaching V1, it is included in
this list as it is a good study case of multiple failures due to outside factors.
The plane suffered an uncontained engine 3 failure due to bird strikes, and the
takeoff was rejected. This resulted in a right wing fire, three tires destroyed, loss
of 50% of brakes and spoilers. The Captain steered the aircraft to the left, exiting
the runway at 40 knots and the right main gear collapsed, impacting the ILS house.
There were 139 SOB, no injuries.

Fig.2
--- PAA 812 - B707 - Sidney 1969-12-01
https://aviation-safety.net/database/record.php?id=19691201-0
V1 138, reject at 140. Overrun of 560 feet (aircraft was 6800 pounds above
MTOW). Substantial damage to aircraft. 139 SOB, no injuries.

--- Spantax 995 - DC10 - Madrid 1982-09-13

https://aviation-safety.net/database/record.php?id=19820913-0
Fig.3 - V1 162 knots. After rotation, airframe vibration was of such magnitude that
the Captain feared that the plane might become uncontrollable, and the takeoff
was rejected at 184 knots. Overrun of 1,474 feet at 110 knots, direct collision with
ILS building. 394 SOB, 50 fatalities.

146
Note that this is the highest speed reject and overrun. Casualties were a result of
the collision with the building.

Fig.3

--- SpiceJet 6237 - B737 - Mumbai 2019-06-01

https://aviation-safety.net/database/record.php?id=20190701-0
Landing overrun of 615 feet at 65 knots. Nose gear collapse.
167 SOB, no fatalities.

--- TACA 510 - B767 - Guatemala 1993-04-06

https://aviation-safety.net/database/record.php?id=19930406-1
Landing overrun of 330 feet at 90 knots. Plane DBR. 236 SOB, no injuries.

--- Texas International 987 - DC9 - Denver 1976-11-16

https://aviation-safety.net/database/record.php?id=19761116-0
Reject at rotation. Overrun resulting in DBR. 86 SOB, no fatalities.

--- TWA 159 - B707 - Cincinnati 1967-11-06

https://aviation-safety.net/database/record.php?id=19671106-0
Reject between Vr and V2 during a brief 67-foot flight. Overrun of 225 feet (DBR).
36 SOB, one fatality.

--- TWA 843 - L1011 - JFK 1992-07-30

https://aviation-safety.net/database/record.php?id=19920730-0
Vr 155 knots, reject shortly after rotation, peak speed 181 knots.
The airplane was destroyed. 292 SOB, ten minor injuries during the evacuation.

147
--- United 611 - B737 - Philadelphia 1970-07-19
https://aviation-safety.net/database/record.php?id=19700719-3
The takeoff was rejected at a speed above V2 and at a height of 50 feet. The plane
landed 1075 feet from the end of the runway and came to a stop 1634 feet past
the end of the runway. 61 SOB, no injuries.

--- US Airways 1702 - A320 - Philadelphia 2013-03-13

https://aviation-safety.net/database/record.php?id=20140313-0
V1 157, rotation at 164 knots, and then the takeoff was rejected. Peak speed 167
knots and maximum height 15 feet. Nose gear collapse, no injuries.

--- Yak Service 9633 - Yakovlev 42 - Russia 2011-09-07

https://aviation-safety.net/database/record.php?id=20110907-0
The company chief pilot is acting as a co-pilot on this flight, performing the takeoff.
He suffers from deep sensibility disorders of the lower extremities. He is unaware
that he is holding the brakes during the takeoff (likely main causal factor, despite
other strong contributing factors). Although V1 is 210 Km/h, pilots believe it to be
190 Km/h. As the plane approaches the end of the runway, a rejected takeoff is
initiated by the Captain, but his chief pilot, the co-pilot, orders him to continue. The
aircraft rotates for flight at 185 Km/h and 400 meters past the end of the runway.
It becomes airborne but crashes shortly after, killing all on board except one.
Had the Captain stayed with his original reject decision, the aircraft would have
stopped on the clear area past the runway, likely causing no injuries.

Passing V1 should not be a commitment to fly

When a flight crew starts a takeoff, it is because they believe the aircraft will fly.
The takeoff should be rejected at any point if this confidence is lost and there is
uncertainty in its outcome.

A takeoff should be rejected anytime the pilot believes that remaining on

the ground is safer than becoming airborne.

V1 needs to be viewed simply as the point after which a reject may (or may not)
cause the aircraft to go off the runway and not as a commit to fly point. Per
definition, V1 does not assure continued flight if the abnormality is anything more
than a single power loss with no other side effects, and that is rarely the case in
the real world.

148
--- Vr, the new decision speed?
Perhaps a more conservative approach would be to have decision speed linked to
Vr. In this case, the pilot’s hand needs to remain on the thrust levers until the
aircraft reaches Vr, rotation speed.
The matter in question is survival. Crashing after becoming airborne will always
have higher consequences than exiting the runway at a lower speed.

The environment has dramatically improved since the 1959/90 FAA study.
The “decision speed” merits a new approach to reflect today’s environment.

--- Continental 84 Newark - B777 - 2007-03-20

Engine failures can occur without producing identifiable loss of directional thrust or
immediate indications, and the electronic engine indications may go blank.

At the V1 call, this aircraft was rocked by an explosion, and the right engine display
went blank. The Captain promptly initiated a rejected takeoff (by then above V1
speed). This was followed by a sudden and complete loss of power on the right
engine. The aircraft was stopped and remained on the runway. An engine fire
started and was extinguished when the flight crew shut the engine down. There
were no injuries.

The type of failure indicates this engine could have directional thrust issues that
would cause uncontrollable rotation around the longitudinal and vertical axis,
leading to ground contact at liftoff and possible loss of control.

The Captain’s decision to reject was based on the loud explosion (critical
emergency). At that moment, there were no other indications to verify what was
happening (the right engine display was blank). The engine was producing takeoff
thrust, and there was no immediate thrust asymmetry.
This Captain had the technical knowledge, and most importantly, he had the
conviction necessary to take the correct actions promptly. He also made the right
decision to remain on the runway while evaluating if there was a need to evacuate
the aircraft.

Intentionally Left Blank

149
Figs.4 - The N1/N2 shaft casing failed, and the engine’s cowling was sagging
below the mechanic’s knee.

Figs.4

Intentionally Left Blank

150
--- Fig.5 - Air France 4590 Concorde - Paris 2000-07-25

(Vr)

During this accident investigation, several rejected takeoff simulations were

performed, with two different speed scenarios and the following common
assumptions:
Loss of tire 2 and engine 2, braking on seven wheels only and reverse use on
engines 1, 3 and 4 only. Takeoff data: V1 150 knots, Vr 198 knots.

- First scenario: If a reject was initiated at 183 knots when a loud explosion was
the only abnormality, the aircraft would overrun the runway at 77 knots.

- Second scenario (after a secondary indication): If a reject was initiated at 196

knots when the Flight Engineer called “stop” (engine 2 failure) and the tower
advised of large flames, the aircraft would overrun the runway at 115 knots.
In either scenario, the survivability would likely be very high despite the left wing
fire.
However, the flight continued the takeoff, climbed to approximately 300 feet,
stalled and crashed into a hotel.

A conventional subsonic jet rejecting after V1 would have runway exit speeds
much lower than Concorde*, resulting in much less damage than what Concorde
would have sustained should its takeoff have been rejected.
* The previous Runway Overrun Summary of Events, illustrated peak speeds
between 184-172 knots and runway exit speeds of 110-90 knots, some from
heights of up to 107 feet with few or no casualties.

151
Concorde had a one-hour gate delay for maintenance on engine 2 inoperative
thrust reverser (same engine which would fail during takeoff).
It was a standard procedure to have the runway inspected for debris before takeoff
due to the critical 50 tire incidents which the Concorde fleet had suffered
previously. To save the three-minute inspection time, the Captain declined this
inspection. There was debris on the runway, and this became Concorde’s 51st and
last tire event.
It killed all 109 onboard, four people in the hotel and ended the Concorde program.

Observations (Capt. Vireilha):

Witnesses to the takeoff testified that the aircraft was already on fire when it
reached the area where the tire impacted the runway debris (a piece of metal).
From the statements of the British AAIB Investigators, the only conclusion one
could reach is that the French Bureau Enquêtes-Accidents (BEA) were not
forthcoming with the physical evidence that could have led to a conclusion different
from those published by the French BEA.
See pages 182 and 186 of the report:
https://reports.aviation-safety.net/2000/20000725-0_CONC_F-BTSC.pdf

Selections from these pages:

- The French judicial authorities did not allow the UK Air Accidents Investigation
Branch to examine all items of the wreckage, including the strip of metal which
burst the tire, except very briefly.
- They specifically prohibited the UK AAIB from participating in the examination of
major components for which the UK had primary airworthiness responsibility.
- They severely restricted access to the crash site and withheld photographic
evidence (aircraft remains were locked in a hanger to which the UK AAIB had no
free access).

Intentionally Left Blank

152
 PART 2 - STOP ON THE RUNWAY
When a navy squadron returned to the aircraft carrier during war times, if a plane
would become immobilized on the deck, it would be pushed overboard to clear the
way for the other planes to land. This made sense because the pilot on the deck
was safe, and the ones still flying could be lost at sea with their planes if they could
not land and had to ditch.

This philosophy was transplanted to airline operations when those pilots became
airline pilots, but it makes no sense in land operations. I recall simulator instructors
directing to clear the runway for a possible aircraft on final, after a rejected takeoff
or a landing abnormal condition. When I became an instructor, I would always
advise against it if a pilot would do this. We should make sense of why we do
things.

When an aircraft moves to a taxiway and then becomes an emergency, the runway
just cleared will not be open for takeoffs and landings as there will be emergency
vehicles using it. Captains are responsible for their aircraft and not for the one on
final. It is the airplane on the runway that could be at the imminent risk of catching
on fire. A fire or explosion with the aircraft doors closed will likely kill or injure
everyone inside (Saudia 163, TWA 800 Rome).

Why We Should Stop on The Runway

The runway is much wider, offering more safety alternatives, including the
option of aligning the plane with the wind to prevent an engine or wing fire
from being blown into the fuselage and to facilitate slide deployment.
Besides, it is faster to stop on the runway than to continue to a taxiway and
then stop. Any delay in stopping as quickly as possible on the runway can
cost people’s lives.

This discussion applies to rejected takeoffs, landing with a pre-existing abnormal

condition or developing uncertainty about the safety of the plane during the landing
rollout.

- If an abnormal occurred in-flight, start the APU before landing as a backup

power source, should the airplane have to be evacuated on the runway.
- Plan a max autobrake short landing roll unless the event is tire-related. Recall
that full brake pedal deflection (standing on the brakes) will provide more
braking power (even than T.O. or Max Auto).

153
A runway is 150 feet to 200 feet wide, compared to a taxiway that is usually 60 to
75 feet wide. Stopping on a runway allows emergency vehicles to circle aircraft
and fight a fire without leaving the tarmac. A taxiway does not allow room for this.

Many airports worldwide do not have ARFF vehicles that can go over soft or wet
terrain without getting stuck. If the aircraft is on a taxiway, these fire trucks will be
limited to fighting a fire from the paved surfaces in front and behind the plane.
Runways are designed to be aligned with the prevailing winds, and taxiways are
not.

--- The stopping procedure

Pilots should mention wind direction before the takeoff and landing briefing. If
having to stop on the runway for a possible developing emergency, the pilot should
turn the aircraft into the wind (nose into the wind, or tail into the wind when a
tailwind is present). An airplane should only stop aligned with the runway if
coincidently the wind is aligned with it too or there is no wind. This helps prevent
wind from spreading a wing or engine fire into the cabin and facilitates slide
deployment should an evacuation become necessary (see Slide Deployment
Failures M3P3). It also prevents the formation of a low pressure on the downwind
side of the fuselage (as seen on BA 28, even with only 6 knots of wind, smoke was
brought forward into the cabin.

- Once at slow speed, deviate downwind from the centerline towards the runway
edge, then turn towards the wind and stop with aircraft wing-box over the runway
centerline. Try to keep the airplane nose, tail and wingtips away from the runway
edges to facilitate emergency vehicle movement around the plane. Still, the
overriding priority is to align with the wind.

- Stopping at an intersection with taxiways would be ideal, however, do not prolong

taxi to reach this point (notice taxiway locations around Continental DC10 London’s
evacuation, M3). If an active runway intersects yours, stop short. If unable, stop
immediately after the aircraft tail clears that runway (to prevent a collision, should
there be aircraft movement on that runway). Advise tower of your specific location
especially during low visibility.

Intentionally Left Blank

154
- Extend full flaps* and retract speed brakes in anticipation of a possible
evacuation. Shut down the engines as soon as flaps reach full down position
(engines may be shut down sooner if APU is online).
Engines idle thrust prevent firefighters from approaching the airplane (and deflect
the extinguishing foam if used). Although an airplane fire may not be present, one
can erupt. Firefighters are more effective if they can approach a fire.
* Extending full flaps allows for overwing evacuation on airplanes with overwing
exits. Additionally, it helps prevent the wind from interfering with the slide
deployment and fire exposure.

Fig.6

- Do not vacate the runway until the fire trucks inspect the aircraft.
However, if conditions are not safe or cannot be confirmed safe (fire trucks not
present), do not wait for the fire trucks’ arrival to initiate an evacuation.
- If the airplane is deemed safe after the firefighter’s inspection, restart the engines,
retract the flaps and taxi to the gate.

Intentionally Left Blank

155
 Rejected Takeoff or Landing Emergency
The following images are from three portions of the Rejected Takeoff or Landing
Emergency checklist of a modern airliner.
Note the misplaced emphasis (highlighted) on clearing the runway before
evaluating the safety of the aircraft.

Fig.7

This type of misguidance is likely the reason why most airplanes clear the runway
immediately while in a non-normal or emergency. They continue to a taxiway and
then stop to evaluate the airplane’s condition. But when an emergency follows, it
is usually too late, and lives are lost. However, the industry does not learn and
change its training procedures.

156
--- “Clearing the runway” is one of the most common daily blunders.
Airport tower controllers sometimes request pilots to clear the runway. However,
they don’t necessarily understand the risks. Remember, Captain, during takeoff
and landing roll, the runway belongs to you and not to the ATC controller.
Clearing the runway caused the loss of 301 lives on Saudia 163 and 47 lives on
British Airtours 28. We only learn when we change our behavior.

If you cannot ascertain the safety of the airplane,

do not leave the safety of the runway (takeoff or landing).

--- British Airtours 28 - B737 - Manchester 1985-08-22

https://aviation-safety.net/database/record.php?id=19850822-0
During takeoff, the crew heard a bang, and the takeoff was rejected at 126 knots.
Suspecting a tire failure, the Captain told the F/O (the pilot flying) to go easy on
the brakes.
10 sec. after the start of takeoff: - The fire bell for #1 engine rang, and the tower
informed BA-28, “there’s a lot of fire, and the trucks are on their way now.”

45 sec. after the start of takeoff: - However, the Captain continued to taxi until
reaching a high-speed taxiway on the right where the runway was vacated, and
the aircraft stopped (fig.7). The six-knot headwind on the runway now became a
left crosswind. This brought a pool of fuel on fire underneath the aft fuselage (from
the left wing fuel leak). This relatively calm wind also created a low pressure by the
right overwing exit, which once it was opened brought smoke forward into the
cabin.

20 sec., after stopping aircraft: - The tail section was breached by fire, and 60
seconds later, it fell into the fuel-fire on the taxiway. Portable oxygen bottles
increased the intensity of the fire in the tail section (when exposed to a fire, they
release over-pressured oxygen from blown-off valves). During the evacuation, an
un-discharged APU fire bottle exploded, injuring passengers and firefighters.

Intentionally Left Blank

157
 Fig.8

Since Feb. 1984, there had been 20 reports of slow acceleration of this engine.
This is a symptom of a disrupted fuel can. It was its catastrophic failure that caused
the engine to explode.

Contributing Factors (Safety Board):

--- The delay in stopping as quickly as possible on the runway costs precious
seconds in evacuation time (47 people lost their lives).
--- Reverser usage contributed to spreading the fire to the passenger cabin.
--- Even more critical was the decision by the Captain to turn off the runway
and stop on a taxiway.

Observations (Capt. Vireilha):

Note on the following very similar accident (PW 501), despite clearing the
runway before stopping to verify aircraft condition, only idle reverse thrust
was used, and there were no fatalities.

Intentionally Left Blank

158
--- Pacific Western 501 - B737 - Calgary 1984-03-22
https://aviation-safety.net/database/record.php?id=19840322-0
Times are expressed in minutes/seconds from reject.
Fig.9 - Note: - Intersection takeoff left approximately 45% of the runway behind.

Fig.9

During takeoff at 70 knots, the crew heard a loud bang together with a slight veer
to the left. Both pilots commented their suspicion on a blown tire on the left. The
Captain immediately rejected the takeoff using brakes and idle reverse thrust and
continued taxi until reaching high-speed taxiway C4 where the runway was
vacated.

Times from start of reject:

23 sec: - Pilots noted that the left N1 was indicating 0%
62 sec: - The F/A entered the flight deck and reported: “a fire on the left wing.”
The TWR confirmed that there was a fire. F/A further stated that “the whole back
left-hand side of it is burning.” The Captain discharged a fire bottle into the engine,
and the FO requested emergency equipment while continuing to taxi to clear
the runway.
1:36 sec: - Cockpit fire warning bell.

159
1:55 sec: - F/A re-enters the cockpit and reports “that it was getting bad in the
back.” Captain then stops the aircraft, and the crew carries out an emergency
evacuation.

Figs.10

Probable Cause (Safety Board):

An uncontained rupture of the left engine thirteenth stage compressor disc
occurred approximately 1,300 feet into the takeoff roll, puncturing a fuel cell that
ignited instantaneously. The fuel-fed fire increased in size and engulfed the left
wing and aft section of the aircraft.

--- Delta 1490 - B737 - Vancouver 1988-01-17

https://aviation-safety.net/database/record.php?id=19880117-0
The takeoff was rejected at 110 knots due to a loud bang from an engine failure/fire
on the left engine. The airplane continued to taxi to a taxiway while the tower
informed the crew of smoke on the left side, and the F/O executed the engine fire
checklist. Once the 200-foot-wide runway 8 was cleared, the airplane stopped on
taxiway W, and an evacuation was started.

--- EL AL 30 - B767 & Air Canada 877 Toronto 2016-12-20

ATC Video: - https://www.youtube.com/watch?v=zilMT9M1yoM
This study case involves two simultaneous events.
Time Stamps are expressed in minutes from the beginning of the video.
1:35 - After takeoff and approaching 12,000 feet, EL AL 30 declares a Mayday for
an engine 2 fire.
2:20 - Crew requests Runway 23L “or the best one you have there.”

160
Before takeoff, you should know what your preferred option is in case of an
emergency return. Do not leave your flight path decision to someone else. Most
controllers are highly capable individuals, but they don’t know what your needs
are. Inform the controller what you need to achieve and let him prioritize your plan
into his traffic flow.

2:45 - Crew requests a 20-mile final.

A long final is a recommended procedure when there are flight controllability
issues. However, when there is a fire or the possibility of one (a critical
emergency), there is always the risk that it may spread without the crew knowing
or being able to control it. Landing ASAP is the priority, and items not
necessary for landing should be bypassed (including dumping fuel).

2:55 - Crew decides to extend flight for fuel dumping purposes.

3:30 - However, the crew asks ATC to stay close to the airport.
For ATC needs, the flight is vectored 50nm North of the airport. That’s a 100nm
extension to the flight that should have been avoided had the crew made the
landing ASAP their priority.

4:10 - At this point, another flight Air Canada 877, also has an abnormal situation
with a low-pressure tire indication. ATC informs they have EL AL that declared an
emergency first and has priority. Emergency equipment will not be available for Air
Canada until the EL AL emergency is over. The option to hold was discussed. A
blown tire can cause loss of direction control with catastrophic results (Continental
603). This crew had a valid concern in landing without emergency equipment
available. If extinguishing foam had to be used on EL AL, the fire trucks would
have to return to the fire station to refill, and this takes time. Another option that
most likely was discussed in the Air Canada cockpit was to proceed to an alternate
airport with fire/rescue services.
8:40 - However, the decision was made to land at Toronto 24R. Air Canada
advised, while still on final, they would be clearing the runway at the end into the
holding bay.

10:00 - As EL AL lands, ATC asks them to exit on H2 and stop there for the fire
trucks, although they subsequently reverse that instruction and said, “that it is ok
to stay on the runway as they are not going to use it anyway.” However, EL AL
cleared the runway onto the high-speed taxiway H2 and then stopped.

Intentionally Left Blank

161
 PART 3 - TAKEOFF’S SECOND SEGMENT
A successful takeoff needs to complete the second segment. However, this is not
always possible. Once airborne, if the aircraft is not capable of continued flight, the
best that can be accomplished is a “Controlled Arrival.”

In second segment accidents, pilots tend to stay in the “Go” mode to the point of
impact in an impossible fight to fly. They dwell on this until the aircraft stalls.
Instead, transitioning to a Controlled Arrival flight would increase survival -
managing aircraft energy to have controllability to the impact point at the minimum
forward and vertical speeds and with wings level (expanded in M9 Crash-landing
or Ditching).

Two Examples of Failed Second Segments

--- Airbus 400M (new plane test flight) Sevilla Spain 2015-05-09
https://aviation-safety.net/database/record.php?id=20150509-0
Software installation errors cause engines 1, 2 and 3 to fail after takeoff. Each
Engine Electronic Control unit uses calibration parameters files to interpret engine
data. Without these files, engines revert to idle power. Engine 4 EEC unit failed
earlier and was replaced before takeoff.
Because engine 4 was still working, the crew attempted to return for landing but
lost control of the aircraft and crashed (day visual conditions).
Would a wings level “Controlled Arrival” have fewer consequences?

--- Eastern 375 - Lockheed Electra - Boston 1960-10-04

https://aviation-safety.net/database/record.php?id=19601004-0
The Electra struck a flock of starlings, a few seconds after taking off from runway
05. A number of these birds were ingested by engines no.1, 2 and 4. Engine no. 1
was shut down, and the prop feathered. Shortly after that, the no. 2 and 4 engines
experienced a substantial momentary loss of power. This caused the plane to
decelerate to stall speed. The left wing then dropped, the nose pitched up, and the
L-188 rolled left into a spin and fell almost vertically into the water (day visual
conditions). Would a wings level “Controlled Arrival” have fewer consequences?

--- The impossible turn is now possible (FAA)

https://www.faasafety.gov/files/gslac/library/documents/2018/Nov/164492/P-
8740-44.pdf
Note: - This paragraph pertains to light planes.
During basic training flying single-engine planes, pilots were drilled on never
attempting to return to the airport should the engine fail after takeoff and always
perform a “controlled arrival” 30° on either side of the runway or of the engine
failure heading. Perhaps this embedded basic training since the early stages of
our aviation age makes an immediate return less intuitive even now.

162
The FAA reversed its philosophy in late 2018, and training for a 45° bank turn to
reverse course for light airplanes is recommended (see link above).
Warning - A return maneuver to the open space of the airport (not necessarily a
runway) can only be done if the plane has sufficient altitude. Otherwise, a safer
crash-landing should be performed within 30° of the engine failure’s heading as
described above.

--- However, even for large jets, the fastest return to the airport (immediately after
liftoff) is a course reversal (180° turn) if winds are not prohibitive. Consider other
parallel or converging runways or even taxiways (if the runway is occupied).
That runway or taxiway may not be certified for your aircraft weight. But if the
aircraft is at imminent risk, this should not be a concern.
BOAC 712 departed from runway 27L with a wing fire and made a left 220° turn to
land on runway 5R. Landing moments before the wing exploded saved many lives.

- Have your return plan included in the before takeoff briefing. Consider using the
“extended RWY centerline” feature or other capabilities your aircraft may have.
75% of the world’s airports have bodies of water in their vicinity (ocean, rivers,
lakes). Mention them on the before takeoff briefing, should the emergency occur
during departure.

- Have the determination to do what it takes to achieve the safest possible

outcome. Your survival may depend on it. Be assertive and clear when relating
your intentions to ATC.

Intentionally Left Blank

163
 ADDENDUM - CAPTAIN’S REJECT DECISION
Unattended Throttles
Another observation from the FAA Rejected Takeoff Study was that First Officer
initiated RTOs had a delayed decision to act, as compared to when the Captain
initiated the RTO. First Officers may be inclined to seek Captain’s concurrence
before rejecting.

This led some companies to implement new policies in which only Captains make
the reject decision and maintain their hand on the throttles during takeoffs,
including those made by the F/O. This transition of hands led to the throttles
being unattended momentarily during takeoff. The safest way to prevent the
throttles from being unattended is by observing the following two norms:

- F/O’s takeoff: - The Captain should push the throttles to stabilize the engines
symmetrically and then adjust to takeoff power. The F/O should not handle the
throttles, as this creates the need to transfer control, leaving the throttles
unattended during the switch of hands which would occur at low speed. A power
loss at that moment (or an engine slow to accelerate) would cause a sharp turn off
the runway.

- Captain’s takeoff: - The Captain should push the throttles to stabilize the
engines symmetrically and then push to approximate takeoff power. Thrust should
then be adjusted with the F/O’s left hand from the left side of the throttles,
underneath the Captain’s hand and the right hand from the right side of the
throttles. The F/O’s hands should never be behind the throttles; this area should
always be clear in anticipation of a rejected takeoff.

- Unattended throttles also occur after a F/O’s landing if the F/O gives the
aircraft back to the Captain when stating “you have the aircraft” and removing his
hand. To prevent this unattended moment, the F/O should not initiate the transition.
Instead, the Captain should push the F/O’s hand off the throttles from below and
state, “I have the aircraft” when he is ready to take control. Someone’s hand should
always be controlling the throttles.
Don’t give the airplane to the Captain. Let him take it.

164
 MODULE 5 - DEPRESSURIZATIONS
Definitions
- Explosive depressurization: cabin air is lost in less than 0.5 of a second.
- Rapid depressurization: 50% of air volume lost in the first two seconds, the
remaining pressure loss in the next 6 seconds
- Witness marks: when a surface has marks or traces of substances from contact
with another surface.

Having a greater awareness of pressurization effects on an airplane’s structure will

help understand failure factors and the logic behind pilots' decisions when dealing
with different emergencies.

Fig.1

--- The Gases Expansion Ratio (GER) determines the exit speed of the air inside
the aircraft and the extent of the damage to the fuselage (fig.1).

Depressurization Damage Tolerance (DOT/FAA/CT-93/69.II)

When the fuselage skin is damaged, the resulting opening will grow as the
pressurized air expands to the outside. The window belts, the ribs between
windows, will contain this opening from developing longitudinally more than one
window bay (or two bays if the damage occurs to one rib itself).
Then, the continued expansion will follow vertically to allow excess air pressure to
escape and precluding an explosive decompression and catastrophic structural
damage (fig.2).

165
 Fig.2

In the cases of Daallo 159 at FL120 and TWA 840 at FL100, these flights were
within 0.7 psi pressure differential from each other when a bomb exploded.

--- Daallo 159 - A321 - Mogadishu 2016-02-02

The bomb's explosive force was relatively small, causing one passenger to be
ejected a short distance, impacting the fuselage and leaving witness marks. The
window belts between two bays contained the longitudinal progression of the
decompression.

--- TWA 840 - B727 - Athens 1986-04-02

The explosive force of this bomb was greater, ejecting four passengers clear away
from the fuselage and leave no witness marks (fig 3).

Fig.3

--- The Zipping Effect

However, if the cabin air expansion ratio (GER) is too great, it can cause a vertical
fracture to continue to expand around the fuselage, separating the aircraft into two
parts. Whether it is a bomb, a central fuel tank explosion or batteries catching fire
and exploding, they will have similar effects (compression of cabin air and shock
waves).

166
--- Pan Am 103 - B747 - Lockerbie 1988-12-21
A bomb blast caused an opening the size of a dinner plate forward of the left wing
leading edge. The zipping of the nose section caused it to break away to the right
knocking out the right inboard engine (3) from the wing within 4 seconds from bomb
detonation (initially misleading investigators to possible catastrophic failure of
engine 3).

--- TWA 800 - B747 - NY 1996-07-17

A fuel explosion created an opening in front of the center tank at the bottom of the
fuselage. The zipping of the nose section causes it to fall away within 4 seconds.
The rest of the aircraft becomes tail heavy, climbs for a few seconds until it stalls
and falls into the sea (fig.4).

Fig.4

--- Corking and Hammer Effects

and the link between two B737-200
Aircraft 151 and 152 from the production line both had high cycles in the harsh
corrosion of the island-hopping environment and suffered the same corrosion-
induced failures, still met with different fates.

--- Far Eastern Air Transport 103 - B737 - Taiwan 1981-08-22

Skin corrosion on the fuselage bottom leads to an explosive decompression
followed by zipping effect and in-flight breakup. Unfortunately, this aircraft serial
number 151, did not benefit from the sequence of events that saved Aloha 243,
serial number 152.

--- Aloha 243 - B737 - Hawaii 1988-04-28

Skin corrosion also led to an explosive decompression at about the same pressure
altitude as FEAT 103. Initially, the fuselage failed as intended and opened a ten-
inch square vent on the left side of the forward cabin ceiling. As the cabin air
escaped at over 700 mph, flight attendant Clarabelle Lansing standing by row 5,
became wedged in the vent. The sudden blockage (corking effect) immediately

167
created a pressure spike in the escaping air, producing a (fluid) hammer effect,
which tore the entire upper lobe of the forward fuselage.
This theory was presented to the NTSB by pressure vessel engineer Matt Austin.

I agree with his theory, especially when compared to other decompressions. When
there is no “corking and hammer effect,” the structural failure patterns suggest that
the air expansion occurs through zipping. I believe the loss of Ms. Lansing
prevented the zipping effect that would have caused an inevitable in-flight breakup.
After having lost the upper lobe of the forward fuselage, (two-thirds of the structural
strength - tension), the aircraft stayed attached by the lower fuselage skin (one-
third of the structural strength - compression) and cabin floor. The forward fuselage
came close to dropping from the wing box, such as in the TWA 800 B747 fuel tank
explosion.

Fig.5 - Note the witness marks on the fuselage by the first passenger window (left
to right).

Fig.5

--- United 811 - B747 - Hawaii 1989-02-24

A failed cargo door caused an explosive decompression when passing FL 225 (air
pressure 6.1 psi). The first seats to be ejected (initial higher GER) were ingested
by the outboard engine 4. The crew oxygen was also ejected.

Intentionally Left Blank

168
As GER dropped, the next seats were ingested by the inboard engine 3. Both right-
side engines failed (fig.6).

Fig.6

Fig.7 - Note the missing eight seats and their respective floor section. Also ejected
was a passenger in the middle section. He refused to fasten his seat belt despite
the F/A’s instructions. Nine passengers lost their lives.

Fig.7

Outflow Valves Position Relevance

Slow Loss of Pressurization
During a pressurization problem, the outflow valve(s) position needs to be looked
at, as this may help understand the issue and may prevent unnecessary actions.

169
--- Open valve(s)
For example, a faulty pressure controller that does not maintain normal differential
during the aircraft’s climb could cause maximum differential pressure to be sensed
prematurely and trigger the opening of the outflow valve(s). A visual check of the
valve(s) indicators would confirm their open position. If manual valve(s) control
cannot be regained towards the closed position, an emergency descent needs to
be initiated.

Note 1: Valve control may be regained at a lower altitude if the faulty sensor no
longer senses an overpressure.
Note 2: After takeoff, if the cabin is climbing with the aircraft, the differential
pressure is zero, and the outflow valve(s) are open, the pressurization system may
be in manual mode, or the valve may have failed open (Helios 522 B737- Athens
- 2005-08-14).
Note 3: It is a good practice to develop a flow procedure (linked to the after-takeoff
checklist) to check for the following:
Brake temperature, normal - Cabin pressurizing - Cockpit oxygen quantity*
* Actual event account: - Just before departure, a gate agent sat on the jump seat
and inadvertently activated the respective oxygen mask on forced flow. With the
flight deck noise, the flow went unnoticed. Climbing through FL250, it was realized
the crew oxygen was depleted, and the flight was forced to return. It is not enough
to check oxygen during the receiving aircraft check. This check should be
repeated, passing FL100.

--- Closed valve(s)

If the valve(s) are fully closed, and the cabin pressure is still being lost, there is a
breach in the pressurized hull (assuming engines and packs are operating
normally). Structural integrity should be verified.
A window or an access skin panel may have failed, but these are bounded by a
frame that limits further damage to the fuselage. History indicates that these
aircraft retained structural integrity (fig.8 blown window and fig.8A blown panel).

Fig.8 blown window

170
 Fig.8A blown panel

However, if the pressure loss cause cannot be found and verified to be structurally
safe, it must be presumed that structural integrity has been lost, and the aircraft
must be flown with extreme care.

Rapid Loss of Pressurization

With a rapid depressurization, significant damage to the fuselage has occurred,
and structural integrity is compromised. This does not necessarily mean that a
catastrophic failure will follow, but it could. That said, explosive decompressions
usually cause an in-flight break up within the first four seconds. If the aircraft
survives this period, then it has a chance of making it to a landing, exercising the
same extreme care mentioned previously. It is impossible to evaluate the true
extent of the damage while in flight. Still, a visual inspection by the onboard crew
is recommended to allow for a general idea of the damage and its possible
significance. Do not delay landing to allow for an exterior inspection performed by
another aircraft or a tower fly-by.

Flight controls and stabilizer trim must be moved cautiously and to the minimum
extent necessary. Speed brake movement (extending or retracting) should be slow
while evaluating any new vibration, in which case movement should be
discontinued. An emergency descent must be entered slowly to prevent a rapid
increase in speed with a resultant pull-up to stop the increasing speed trend.

Flaps should be extended just above minimum maneuvering speeds. Landing gear
should be extended at low speed and only when needed for landing. Do not
generate unnecessary air loads, decelerations or accelerations, and fly at 1G.

Many aircraft have lost a substantial part of their structure and landed safely.
Others with much less damage survived the initial event but broke up in flight later
due to pilot induced air loads. Such was the case of Continental 11.

171
--- Continental 11 - B707 Unionville 1962-05-22
https://en.wikipedia.org/wiki/Continental_Airlines_Flight_11
A bomb exploded in the right aft lavatory at FL390 (air press. 2.8 psi), creating a
two-foot round opening in the lavatory fuselage. The aircraft survived the bomb
blast.
The pilots donned their oxygen masks and initiated an emergency descent at their
cruising speed of M.84. After being established in the descent, the landing gear
was selected down, which created a further nose-down tendency. When the pilot
countered this, the weakened tail section separated.

Note 1: - The emergency descent “landing gear down” procedure was changed
because of this accident to read: “Landing gear down at Captain’s discretion if
structural integrity can be verified” [see closed outflow valve(s) above].

Note 2: - Trivia - The 1968 book and the 1970 movie “Airport” was based on this
accident. Dean Martin played the role of Captain of the flight. The Air Line Pilots
Association opposed Hollywood’s choice as Dean Martin had a reputation for
drinking.
- Life insurance stopped being sold at airports, and time restrictions were placed
for payment in case of suicide. This was the first jetliner to be brought down by a
bomb.
- I flew with the Captain initially scheduled to flight 11. He received the most
important phone call of his life, the day before the trip - Captain Fred Gray wished
to trade flights with him.

Intentionally Left Blank

172
 Complications During Depressurizations
Fig.9 - Depressurizations accompanied by pressure pulses (resulting from bomb
or batteries exploding) tend to have unexpected effects, for instance:
- Some cabin oxygen panels may not open.
- Some open panels may not drop masks.
- Not all masks fall evenly and drop to the correct height.

Fig.9

Incorrect mask deployment can also be generated by unqualified personnel*

stowing masks after firm landings or turbulence. Only aircraft mechanics should
stow masks and for this reason, dropped masks need a logbook entry.
* Pilots, flight attendants, gate agents, etc.

1 - The mask should drop at forehead level, causing the passenger to pull on it
in a normal way to reach the nose and mouth. Oxygen will not be generated without
this pull.
2 - If the mask drops high (above forehead level), it tends to be pulled too hard,
causing the hot generator (at 260°C) to fall from its enclosure and causing burns
to the passenger or starting the seat or floor upholstery on fire.
3 - If the mask drops low, passengers tend to bring the face to the mask, failing to
pull it to activate the oxygen generation flow.
4 - If a mask or a seat row of masks does not drop in front of the passengers, they
are unlikely to act correctly and change to a row of seats where masks have
deployed. If the flight is full, there may not be other available masks, and
passengers can lose consciousness.

Lavatory Oxygen - Some countries, such as the USA and Bolivia, have removed
oxygen generators from lavatories because their components could help build a

173
bomb in flight. However, these airlines do not inform passengers that the lavatories
no longer have oxygen available. If depressurization occurs, the closest mask from
a lavatory may be above a F/A jump seat.

F/A use of Cockpit Oxygen - F/As should be briefed on the location and correct
use of the cockpit jumpseat oxygen mask. F/As may fly different types of aircraft,
and they may not be familiar with their location. If a decompression occurs, a F/A
may attempt to use the pilot’s oxygen mask if unable to find their own. This can
become a challenge if there is only one pilot in the cockpit.

--- Cabin Coindot Floor

During rapid depressurizations, air trapped underneath the aircraft rubber flooring
(named “Coindot” after its raised coin format) expands in the center since edges
are glued, creating a balloon effect on the aisles. This makes it difficult to walk,
and it is common for cabin crewmembers to trip and fall, be unable to assist
passengers, or reach their stations for oxygen. There have been occasions where
F/As lost consciousness and were later assisted by the passengers.

--- Cabin Differential is Cabin Differential, correct?

Is there a difference between an explosive decompression at the same cabin
differential and the same Mach number at FL200 or FL400?

At FL200, air pressure is 6.3 psi.

A cabin differential of 8.4 places the cabin at sea level (6.3 + 8.4 = 14.7 psi sea
level pressure) and the GER would be 2.33 (14.7/6.3 = 2.33).

At FL400, air pressure is 2.7 psi.

The same cabin differential of 8.4, places the cabin at 8,000 feet (2.7 + 8.4 = 11.1
psi or 8,000 feet) and the GER would be 4.11, 76.4% greater than at FL200 (11.1
/ 2.7 = 4.11).

Additionally, at FL200, IAS is greater than at FL400 (for the same Mach number),
which causes greater aircraft skin petalled effect. It also causes cabin contents to
be projected in shorter lateral trajectories.
Outside air temperature also affects the rigidity/flexibility of the airplane skin.
(see Decompression Factors slide on the first page of this Module).

Intentionally Left Blank

174
 EMERGENCY DESCENT EXECUTION
High altitude depressurizations unquestionably require an immediate emergency
descent. Other events, such as smoke detection, will likely require a descent,
although a quick evaluation precedes these.

While this assessment is made and anticipating a possible descent, aircraft speed
should be reduced to minimum clean maneuvering (considering altitude and
turbulence margin). Reducing speed reduces energy, which will help recover some
of the assessment time when the descent is initiated with a resultant higher
descent rate. A very high off-scale vertical speed (IVSI) will develop with a slow
increase in forward speed (until reaching FL275 approximately, where the air is
noticeably denser).

A slower descent rate will result if descent is initiated at cruise Mach (without speed
reduction). Either way, it is important to start the descent to prevent occupants from
developing “the bends” and becoming incapacitated.

Choose a new destination

Recall “Active Monitoring” and have your plan ready to be activated. Consider from
your present position the direction of least risk (away from high terrain, convective
weather, and war zones).

Declare Mayday to ATC

Request the desired airport and desired altitude (low). If there is hesitation from
ATC, be prepared to take control and inform where you are going and what altitude
you are descending to. Tell ATC what you need them to do for your flight, e.g.,
request weather and QNH information, request the runway that best suits the flight
and ask ATC to inform your company of the emergency. Say MAYDAY each time
you check in with a new controller on a frequency change to ensure that the new
controller is aware of your status.

--- The Emergency Descent Entry

The purpose of any emergency descent is to lose altitude quickly and, in most
cases, to land as soon as possible.

The following emergency descent entry guidance is common in aviation manuals.

However, it has the undesirable consequence of increasing the time to land, should
the intended runway not be in the general direction the aircraft is pointed at (see
FedEx 1406).
- “The entry may be accomplished on a heading, or a turn may be made to clear
the airway or track. However, since extending the speed brakes initially reduces
the maneuvering margin, it is recommended that turns not be initiated until the

175
aircraft is established on the descent.” (See Vertical Flight Path below for a more
efficient descent entry).
Although this guidance expresses a valid concern in maintaining an adequate
maneuvering margin, I have seen it unchanged for decades. It was written when
analog airspeed indicators had a white pointer against a black background, and
maneuvering margin was found only in charts in the manual. An aircraft could fly
into a low or high-speed buffet and stall if not maneuvered within well-guessed
safety margins.

Today’s electronic systems calculate and display all the speeds and other
information necessary for the safe operation of the aircraft, allowing for flying with
precision and being able to turn, descend and pull the speed brakes, maintaining
all the parameters.
The priority is to land in the shortest amount of time.

At Mach .80, an aircraft is flying approximately 8 miles per minute. If flying away
from the airport, one minute adds at least 16 miles to the flight path (plus the turn).
At FL250, the air is twice as dense as at FL400, and at FL100, the air is four times
as dense. As the aircraft descends into denser atmosphere, the time flying in the
wrong direction at high altitude will take a lot longer to recover.
Consider the following Emergency Descent Entry (fastest technique).

Horizontal Flight Path

Start by turning to the airport with HDG SEL. At high altitude with A/P on, a heavier
aircraft will turn in a shallow bank (10° to 12°). Disconnect the A/P and fly manually
to allow for a steeper bank (staying above the 1.3 G buffet) by picking up speed
while descending.

Vertical Flight Path

Set lower altitude and initiate descent with VS wheel. Once the nose is clearly
below the horizon, pull speed brakes to flight detent.
As thrust is reduced, push FLCH and continuously keep accelerating speed cursor
to keep Mach near maximum speed. Initially, this will require constant attention.
Speed will be slow to accelerate, but once it starts to accelerate, it will do so
quickly. Switch attention from Mach to knots passing FL280. Be deliberate and
cautious when entering this maneuver (see note 1 below).
Note: - Some engine types can flameout at high altitude and low indicated airspeed
if throttles are brought back to idle abruptly or below a certain speed (e.g., B747
Classic with Pratt & Whitney engines, speed below 300 knots).

LNAV / VNAV
Once both IAS and IVSI are stable and established on the desired HDG (re-engage
A/P if disengaged earlier), program a new route and select an approach for the
airport. Eliminate discontinuities, fly direct to IAF (shortest track taking terrain and
weather into consideration), re-engage LNAV.

176
At this point, there is usually a brief period of lesser activity that can be used to
review events and decisions with the crew. One last chance to catch an error or
improve a planned action.
If flying direct places the aircraft too high for an approach, do not create a longer
track as aircraft could become unairworthy sooner than expected and further away
from the airport. Instead, consider extending the landing gear even if at high speed
(damage to the landing gear doors may occur but not damage to the structure
itself). If this still leaves the aircraft high, landing on another runway or performing
a 360° turn at the outer marker is an alternative to lose altitude. Being close to the
safety of the airport opens options. An aircraft with smoke/fire onboard has limited
time left (see Continental 84 Rome).

Note 1: - Unreliable airspeed indications are expected during descents while

escaping ice crystals or volcanic ash.
(See recommended procedure in M11P3 - Idle Descent Chart).

Note 2: - Because unpressurized flight (intentional or not) may occur during an

emergency, become familiar beforehand with the specific procedures, especially
for Unpressurized Flight above FL100 (aircraft manual and MEL). Note the
electronic compartment limitations, temperature warnings and recommendations.

Intentionally Left Blank

177
 MODULE 6 - IN-FLIGHT FIREFIGHTING
PLAN

PART 1 - SMOKE, FIRE & AIRCRAFT

Transportation Safety Board of Canada

SWISSAIR 111, MD11, Halifax, 1998-09-02
Transcript from the TSB Report A98H0003

“There was no Integrated In-flight Firefighting Plan in place. - Therefore, the

crew did not have procedures or training directing them to aggressively attempt to
locate and eliminate the source of the smoke, and to expedite their preparations
for a possible emergency landing. - In the absence of such a firefighting plan, they
concentrated on preparing the aircraft for the diversion and landing.”

Despite the TSB 1998 recommendation for creating an Integrated In-flight

Firefighting Plan, the aviation industry is still flying without one.

Definitions
Smoke - Odor, smell or fumes is commonly referred to as smoke in this Module.

Ignition point - The minimum temperature at which a substance will continue to

burn without additional application of external heat.

Flashpoint - The lowest temperature at which the vapors of a given liquid will
ignite. TWA 800 - B747 - NY 1996-07-17 fuel tank explosion. Its center fuel tank
temperature was 127°F. The flashpoint of “Jet A” vapors is 97°F.

Flashover - The near-simultaneous ignition of most of the directly exposed

combustible materials (solid fuels in the passenger cabin). If there is a fire inside
an aircraft cabin, the flashover usually occurs after two minutes of doors
opening or fire breaching the fuselage. This is one of the factors which requires
evacuations to be completed in the first 90 seconds. Once a flashover starts, this
fireball can travel from one end of the aircraft to the other end in a mere 3 seconds,
leaving everything on its path on fire (Saudia 163).

178
--- Facts
Onboard smoke or fire is the most likely emergency a flight crew will face, and it
has no technical solution. The only controllable factor is crew preparedness with a
trained response. This trained response must be correctly executed within the
limited time frame of a typical smoke/fire scenario.

Consequently, crews need to have specific education on smoke and fire to

appreciate its unpredictable behavior. Training programs do not have adequate
guidance on identifying the origin (location) of the smoke and how to isolate the
source. Lack of guidance results in delayed and ineffective mitigating actions.
Accident investigations consistently find that most crews tend to underestimate the
severity of a situation.

There were 1300 cabin smoke incidents in five years (2010-2014) within one
British airline and 251 cabin smoke incidents between April 2014 and May 2015 in
the UK (CAA). In October of 2017, British Airways reported 50 smoke incidents in
30 days. There are several smoke/fire incidents per day worldwide, and the trend
is increasing with aging aircraft and the proliferation of portable electronic devices
(PED). A study published by the UK Royal Aeronautical Society estimates that a
flight will have over 500 lithium batteries per 100 passengers.

--- The Challenge

An airliner typically operates at high altitude at transonic speeds (>0.75 Mach) with
a fuselage filled with solid plastic fuel, supported by wings full of liquid fuel. A
smoke/fire event can bring down an aircraft in two to three minutes*, but most
events last 15 to 20 minutes, and a small number have lasted up to 35 minutes.
* Fires outside the pressurized area are usually not noticed by the crew until the
last 2-3 minutes of structural integrity (study from the TSB of Canada).

Aircraft have limited smoke/fire detection and firefighting capability. Warnings may
lag, and the systems may fail or be destroyed. Their respective monitoring systems
may fail too. Crew and passengers are part of the alerting system.
Events end in one of three ways: the fire is controlled (or putts itself out), aircraft
evacuation, or loss of the airplane.

Whenever there is a questionable event with a system that has an inbuilt

test capability, always test assumptions by testing the system.

A similar statement is likely to be included in your manual, either in the Introduction,

Emergency or Non-normal sections.

Aircraft systems capabilities and onboard firefighting equipment are not intended
to control major fires. It should be anticipated that any unknown smoke condition
can worsen rapidly and must be treated as an uncontrollable fire until proven

179
otherwise. Crews must act aggressively at the first indication of smoke to search
for the primary source and extinguishing the fire while it is still in its initial stage.
A flight crew cannot extinguish a fire unless it can promptly reach its primary source
and possible secondary fires. This requires that the crew not only knows how to
use its firefighting resources but also knows how to find the source and how to get
to it. Crews must have the know-how and determination to use destructive-access
techniques when necessary (crash ax).

Smoke/fire Characteristics
Note: - An unknown smoke event is always a MAYDAY and never a PAN, PAN,
PAN (unless it is determined that it can be controlled).

Smoke is hot air that carries minuscule particles of the burning materials, which
will determine its color. In general, white smoke has a high moisture content
(beginning stage) and is cooler than black smoke from a carbon fire. In general,
the darker the smoke, the hotter it is. Smoke reduces visibility and may hide the
primary and secondary fire sources. It causes crew incapacitation due to lack of
vision or inhalation of toxic fumes (e.g., cyanide from fire retardants and wool
clothing and blankets).

--- Cabin airflow direction may mislead as to the location of the primary source.*
* Actual event - In a B777 forward galley oven fire, smoke appeared first in the aft
galley. The cabin crew converged to the aft galley and left the primary source
unattended. Each F/A station needs to remain continuously monitored, especially
during an event.
Intermittent electrical shorts can cause smoldering and smoke of temporary nature
before ignition and fire starts, at which point smoke becomes continuous.
Unnecessary electrical equipment should be off, especially when unmonitored.

Intentionally Left Blank

180
 Types of Smoke

Momentary
Typical of a “flame front,” when a fire starts with a bigger flame sending smoke
further away and then the flame retracts. It can only be detected for a few
seconds initially, then disappears to return later when the fire is established.

Temporary (Non-reoccurring)
Typical of “arcing” or caused by a failing Recirculation Fan, for example.

Periodic (Reoccurring)
Typical of on-demand systems malfunction (e.g., Trim Air, Fuel/Oil Heat
Exchanger, Window Heat, etc.). Smoke reoccurs when the system cycles ON.

Continuous
Fire is in progress.

Note: - The chart above is for educational purposes only and to help produce a
more telling logbook write-up after the event.

For a crew dealing with in-flight smoke, it is irrelevant what type of smoke it
is; the crew must act before secondary indications appear.

--- Temperatures and Effects on Structures

Jet A vapors ignite at 97°F when an ignition source is present.
The lightning strike temperature is about 9,000°F.
A fuel fire on the ground burns at 2,000°F. It burns at 3,000°F during flight.
Bleed air leaks (650°F~700°F) and black smoke (~850°F) can soften the aircraft
skin enough to cause an in-flight structural failure. Although the melting point of
the aluminum used in aircraft construction is about 1,175°F to 1,250°F (standard
fuselage alloy, aluminum sheet 2024-T3), aluminum will soften and becomes
vulnerable to failure much sooner (around 600°F to 650°F) if stressed by cabin
differential.

Electrical wiring, aircraft equipment, and electric motors can overheat and may
cause smoke or fire. If troubleshooting does not resolve the situation when
detected, the problem will reoccur later. For example, on Swissair 111, besides the
faulty wiring that caused the fire, there were an additional 13 faulty wires in other
aircraft areas (only seven years old / 6400 cycles). These could very well have
been “temporary” smoke events in the past where troubleshooting was not
complete.

181
Note: - Pure metals melt at specific temperatures (e.g., arcing copper wire melts
at 1981°F), and alloys melt within a temperature range. Electrical arcing cannot be
protected solely by thermal circuit breakers since electrical arcing current
frequently does not reach thermal CB activation. Aircraft CBs exist to protect the
wiring and not the equipment.

--- The Effect of Fire on the Fuselage

Fuselage skin is 1/16th of an inch thick (1.6mm or about the thickness of one credit
card) on a narrow-body and 1/8th of an inch (3 mm or about the thickness of two
credit cards) on a wide body. It takes 30 seconds on a narrow-body aircraft for a
hydrocarbon fire (on the ground) to breach the cabin (60 seconds on a wide body).
Fuselage areas lined with insulation may delay one to two minutes for a ground
fire to burn through.

However, once exposed to ground fire, the aft fuselage will separate from the
aircraft within 60 seconds as its weight is supported only at the wing box
trailing edge juncture (causing the aft section to drop into the fire).

These failures can be associated with ruptured fuel tanks leaking fuel onto the
pavement, igniting once the vapors reach the engines or hot brakes. Even when
fuel overflows or spills from the wingtip vents, wind can create a pool of fuel
underneath the fuselage.

The forward fuselage weight is distributed between the juncture at the wing box
leading edge and the nose landing gear and will take longer to separate. The
forward fuselage holds fewer people per exit than the aft section, contributing to a
lower casualty rate.

Fire from a Thrust Reverser – Blow Torch Effect

The fiery plume of air produced by the thrust reverser from an engine on fire can
cause the same damage described above, faster, as the fire concentrates in one
area (British Airtours 28). Even the reverser of an engine that is not on fire can
spread a wing fire over a large area (BOAC 712).
For this reason, reverse thrust on the affected side (if known) should not be used
if there is an engine failure/fire during takeoff or landing or a suspicious noise has
been heard.

--- British Airtours 28 - B737 - Manchester 1985-08-22

https://aviation-safety.net/database/record.php?id=19850822-0
Engine 1 caught on fire during takeoff that was rejected using reverse thrust.
The T/R blow torch effect against the fuselage caused the windows to fail in
seconds, and the passenger’s laps were on fire as the airplane was decelerating
on the runway (figs.1).

182
The use of reverse thrust, while the plane had speed, created a depression
underneath the rear cabin that held the vaporized fuel on fire close to the lower
skin weakening its compression strength.
These factors, combined with the subsequent pool of fuel under the aircraft that
was blown by the wind from the left wing fuel leak, accelerated the collapse of the
rear fuselage.

--- During a rejected takeoff (or a non-normal during landing), if an engine

could be in question, reverse thrust should be limited to idle (to cancel
forward thrust) and prevent spreading a possible fire to the fuselage.

Figures 1

183
--- BOAC 712 - B707 - London 1968-04-08
Engine 2 separated after takeoff, and fuel from the respective tank was pouring
out on fire. When the aircraft landed, reverse thrust from engine 1 pushed the fuel
on fire towards the fuselage. This factor, combined with the pool of fire that
accumulated under the aircraft after it stopped, caused the rear cabin to collapse.
The left wing exploded, destroying all escape slides except the forward right cabin
door (figs.2).

Figures 2

184
 Cabin Smoke/Fire
The slides in this section are a suggestion to training departments of similar photos
that should be part of crew training manuals (appropriate to equipment type).
We will review cabin-related issues and ways to improve the resolution of such
events.

--- A better-informed cabin preflight.

Review the location and how to access hidden equipment used only during
emergencies, such as firefighting equipment, galley and lavatory water shutoff
valves.

Have operational systems awareness to be able to differentiate normal from non-

normal.
E.g., when test flushing the toilet, note that the motor should run for about 8
seconds, and water should flow. If the shutoff timing is notably longer, this indicates
a problem with the motor. If a second test flush does not correct the timing, call
maintenance.
Some motors are water-cooled; if the water is not flowing, that is an indication of
another problem. Either of these non-normals could start a fire. If maintenance
cannot resolve the issue, this lavatory should be placarded “Inoperative” and
locked closed.

Be suspicious and investigate anything that is not acting as usual: - systems that
don’t turn on or off, or that behave differently; unusual sounds, flickering lights, or
unrelated system failures.

Intentionally Left Blank

185
--- Crash-ax
Fig.3 - Remove the fire ax from its location and see the difficulty of access due to
the need to remain secure during a crash. Have a feel for its mass. Most cabin
crews have never handled an aircraft’s fire ax (training should have one available).

Fig.3

The ax can assist in removing panels or cutting through to gain (destructive)

access for firefighting or evacuation purposes.
Steel against aluminum does not produce sparks, and the rubber handle protects
from electrical shocks.

As hot air rises, a smoke event in the passenger cabin is usually first noticed in the
ceiling. The ceiling panels cover equipment such as recirculating fans that may
produce smoke or start fires. The ceiling panels act like a tunnel that conduces air
circulation between aircraft zones spreading the smoke. The ceiling panels can
drop by pushing their release buttons (usually located between the ceiling air
conditioning louvers). Although their location is generally known to cabin
mechanics, flight crews receive no such training.
Furthermore, in the case of smoke/fire, smoke obscures the ceiling, which makes
these buttons impossible to find.

If a suspected smoke source is behind a ceiling panel, the panel needs to be

dropped to gain access. If the primary fire is found not to be there, the crew can
visualize where the smoke is coming from and drop down the panel.
Dropping a panel also creates a discontinuity in airflow and prevents sparks from
propagating and generating secondary fires.

186
- To drop down a panel during impaired visibility: - Walk the aisle with the fire
ax pushed against the ceiling while holding it transversally (see photo below).
When the gap between panels is felt, insert the ax to the ax rubber detent, turn it
90 degrees and pull the dropdown panel (fig.4).

Fig.4

These panels are quite large but can store out of the way between the fuselage
and the seats. Some will have DC wiring (speakers and temperature sensors) that
can be cut with the fire ax.

Window side panels can be removed by inserting the fire ax’s pointed side and
pulling a corner. Then use the laminar side to continue to lift the panel using
leverage by holding it at the tip of the handle. Use fire gloves to assist in pulling
them out. Once one side has popped out, slide the opposite side away from the
next panel and lay it on the cabin floor between the fuselage and the seats (fig.5).

Fig.5

A fire flareup is possible any time a panel is removed. Use protective gear and be
ready to pull yourself back. Have another crewmember prepared with a fire
extinguisher.

187
A fire under the cabin floor is harder to reach, nevertheless, do not allow this to
discourage you and abandon trying to reach the fire. Once the heat from the fire
softens the aluminum floor, it will be much easier to cut through (fig.6).

Fig.6

Use the pointed side of the ax to make the initial opening. Then continuing with the
pointed side, use leverage to rip the opening bigger until the laminar side can be
effective in lifting (or cutting).

The floor may be covered by carpet or rubber coindot flooring glued only on the
sides and easier to remove once heated. Cut around the sides to gain direct access
to the metal.

If seats stand in the way, have several strong ABAs pull the seats out of the tracks
once the floor is soft.

Cabin Smoke/Fire Usual Suspects

In order of prevalence:
Lithium battery-operated Personal Electronic Devices (PED’s)
Recirculation fans
Galley ovens
Main cabin door rainwater leakage into the electronics bay
Galley leaks
Lavatory smoke/fire
Fluorescent light ballasts (cabin ceiling, lavatory and galley lights)

188
--- Lithium battery-operated Personal Electronic Devices (PED’s).
Rechargeable batteries are used in consumer products such as cellphones, iPads,
laptops and e-cigarettes. They are popular because they pack more energy into
smaller packages. Still, the batteries can self-ignite if they have a manufacturing
flaw, are exposed to excessive heat, are packed too closely together, are
improperly installed or are loose, damaged, or crushed. PEDs inside luggage in
the overhead bins can become a hidden fire source.

They are most susceptible to igniting when plugged in to charge. Controller

chip failure leads to an overcharge and thermal runaway (fire). It happens
more often with counterfeit batteries without the appropriate inbuilt safety features.
Battery fires can reach up to 1100°F.

Passengers need to be briefed on not changing their seat configuration to retrieve

their lost cell phones as this can crush and ignite their batteries, initiating an aircraft
fire. Currently, both passengers and some cabin crew believe this procedure
is simply to prevent damage to the phones as there is no emphasis on the
fire consequences of crushing the batteries.
In an attempt not to create stress, we are failing to inform passengers adequately.
Passenger announcements must be clear to be effective.

Only a crewmember should attempt to retrieve the cell phone. If unable, do not
change seat configuration for the remainder of the flight, and the passenger
must be moved to another seat. If there are no other seats, the passenger must
sit on a crew-rest seat or a cabin jump seat* for landing. This is an inconvenience
to the passenger, and the airline can compensate later, but do not risk an aircraft
fire, which may become uncontrollable because the source is hard to reach. If the
seat does catch on fire, use the crash ax to rip the materials to view and access
the inside burning area directly.
* - There may be rules or policies covering cabin jump seat use by passengers.
This situation is no different than when a passenger becomes an ABA for a planned
evacuation and sits on the F/A jump seat. As a cabin crewmember, if you have
doubts about how to proceed, ask the Captain for authorization. You are
preventing a possible fire emergency and acting under Captain’s emergency
authority. A Captain can delegate his authority, but he cannot delegate his
responsibility.

--- Fighting A Portable Electronic Device (PED) Cabin Fire:

- Move people away from the fire.
- Use the closest fire extinguisher first while another crewmember retrieves the
most appropriate one.
- Never use ice as it acts as an insulator, merely diverting the fire direction.

189
--- Then use the preferred method as follows:
- Best – A water fire extinguisher can be used safely from a distance of 3 to 5 feet
and lasts about 40 seconds if used continuously and several minutes if used
intermittently. It puts the flames out and cools the battery pack, preventing other
cells from a thermal runaway. Unfortunately, water fire extinguishers did not see
much use in the past, and some authorities discontinued their requirement at the
worst time, when they became necessary, as these are the best to fight PED fires.
Note: - Some airlines no longer have water fire extinguishers onboard and train
cabin crews to use water bottles and non-alcoholic beverages instead. Beverages
are not part of the aircraft Minimum Equipment List (MEL), and a flight could end
up leaving the gate without adequate firefighting capability, especially if combatting
a PED fire, which has become the most common fire event.

- Second best – A Halon fire extinguisher can be used from 3 to 5 feet and lasts
about 8 seconds if used continuously and 60 to 90 seconds if used intermittently.
It removes flames momentarily, but it is ineffective by itself in preventing re-ignition.
It must be followed by water or non-alcoholic beverages. However, Halon removes
oxygen from the area, be cautious when using it in confined spaces (small galleys
and cockpit).
- Cooling the battery pack with beverages requires crewmember to be in
dangerous proximity and with their arm over the PED. These fluids run down
through the cabin floor and can cause short circuits in other electrical components.
Do not use over the electronics bay (doors 1L & 1R area, although some aircraft
also have aft electronics bays).
- Do not move PED unless firefighter crewmember has personal protection* and
moving PED is determined to be the safest course of action. After the fire is
controlled (at least 15 minutes without further thermal runaways), the PED needs
to be stored in a containment case. In the absence of a containment case, one
may use a beverage container with enough water to submerge the PED.
* Personal protection
Fire gloves, long sleeves, eyeglasses, Portable Breathing Equipment (PBE).

--- Recirculation fans are the most common cause of onboard smoke. Although
they reduce bleed air demand and save approximately 0.7% of fuel consumption
(per engine), they don’t bring any safety enhancements. Recirculating air helps to
spread airborne contaminants and diseases. Aircraft are equipped with High-
Efficiency Particle filters (HEPA filters) that will filter most but not all particles.
However, improper installation can leave gaps or cause holes in the filters.
Preventive maintenance is not always performed on schedule, which may cause
the filters to become ineffective. Airline passengers are required to fly with face
masks during pandemics. An additional safety procedure would be to fly with the
Recirculation fans off. Recirculated air passes through the same areas twice and
takes about four minutes to exit the airplane.

190
With “Recirc. Fan(s) Off,” fresh air comes into the cabin and goes overboard within
two minutes, without revisiting the same area. Note that cabin air quality or smoke-
related checklists have recirculation fans (and Gasper fan), turned off as one of
the first steps to prevent smoke from spreading throughout the aircraft and making
it more difficult to identify its source. Turning off the Recirculation Fan(s) may also
eliminate the most probable source of the smoke, the fans themselves.

--- Oven fires are another common cause of onboard fire/smoke. On long flights,
galleys can become cold, and some cabin crews tend to use the ovens as area
heaters by turning the ovens on and leaving the oven doors open. Because
the heat keeps escaping, the ovens never reach the selected temperature and
never shut off. This prevents the cooling cycle to the cable that powers the
oven, causing its premature failure and fire.

However, most oven fires are caused by excess food fat running down the oven
sides. This should be cleaned during the maintenance daily check or detected by
the F/A oven preflight (and reported in the aircraft logbook for pre-departure
maintenance).

- An oven “food fire” can be extinguished by opening the oven’s door and
discharging the fire extinguisher in very short bursts (as burning debris will fly out
towards you at high speed).

- An oven “electric fire” requires specific knowledge of that oven as not all are
accessible in the same manner. If your equipment is different from the one
presented in the slides below, inquire with maintenance.
When encountering a galley smoke event, follow your checklist. After turning off
the Master Galley Switch and the individual Oven Switch, the crewmember should
advise the cockpit of the fire in progress. Some short circuits can bypass the Galley
Master Switch and the cockpit also needs to turn off their Galley switch (fig.7).

Fig.7

191
Now, follow the descriptions on the following slides (fig.8):

Fig.8

If the oven head in question cannot be removed, access the adjacent ovens and
discharge agent so you can fight the fire from the backside (fig.9).

Fig.9

192
--- Main cabin door rainwater leakage into electronics bay. If rainwater has
accumulated by the entry door(s), an electronics bay visual inspection must be
performed before the flight.
- One of my flights on a B737 had accumulated so much water that it took two days
of blowing hot air to dry the E&E (in freezing weather) before the electronics
worked again. On the next flight, we lost all electrics (except for the hot battery
bus) when we were already in an ASR (approach surveillance radar) at 800 feet
and landed in a 400-foot ceiling in Cleveland. We would have been in a highly
critical situation if this was a low visibility approach with no alternate airports within
the 20-minutes we had on battery power.

--- Galley leaks (water, coffee, etc.). Ruptured lines or failure of the heating
element of the drain mast can overflow fluids into the cockpit and electronics bay.
This usually becomes more noticeable during descent when aircraft attitude
changes and retaining pans overflow forward.

--- Qantas B747 VH-OJM – Bangkok 2008-01-07

A forward galley water leak causes the loss of most electrics. See report summary:
https://www.atsb.gov.au/publications/investigation_reports/2008/aair/ao-2008-
003/

Know the location and how to access the water shutoff valves
for the aircraft zone and each lavatory (fig.10).

Fig.10

--- In-flight Entertainment Systems are a common source of malfunctions

(repeated auto restarts), leading to system overheating and possible fire in a
difficult-to-reach location. If the system does not operate normally, do not keep
resetting the system.

--- Lavatory odors vent overboard, making smoke in the lavatory unlikely to be
detected if the door is closed (and the smoke detector has been tempered with or
failed). Lavatories must be visually inspected when suspecting smoke.
Consequently, a lavatory ceiling smoke detector test is an essential preflight
maintenance function (Air Canada 797, VARIG 820).

193
Know how to access the flush motor for the toilets. On this B777, there are two
buttons, one on each side at the bottom as indicated by the red arrows. Push both
buttons simultaneously to unlock the back panel (fig.11).

Fig.11. Note rubber Coindot floor

--- Fluorescent light ballasts (cabin ceiling, lavatory and galley

lights)
Light ballasts’ electrical source is DC and less likely to catch on fire, although some
have started aircraft fires. Know their location as they are usually behind quick
access panels (fig.12).

Intentionally Left Blank

194
 Fig.12

--- Cabin Postfire Evaluation

An inspection from a flight deck crewmember should be performed once a fire has
subsided. The concern is that smoke or fire near the fuselage sides or ceiling
can weaken the structure, which can cause an in-flight breakup. An aircraft
floor fire can damage systems wiring, cables or lines and may cause loss of aircraft
control.

If panels are scorched, an inspection behind them is necessary, as fire may still be
smoldering on the other side of the panel. Apply the fire extinguisher as the panel
is being pulled to subdue a flare-up. Use a burnt-through opening or create one
with the pointed side of the crash ax (be cautious not to perforate outer skin,
scrape, do not hammer). If unable to remove a panel, assume the aircraft skin has
been damaged and consider differential pressure reduction.
Note: - Once a crewmember’s nostrils are contaminated with smoke, it is not
possible to differentiate if smoke is still present or not, as the odor will continue to
be detected.

Cockpit Smoke/Fire Usual Suspects

--- Cockpit window heat cycle interruptions can cause uneven heating and can
contribute to delamination. The window heat cycle may fail, causing uninterrupted
heating that leads to a window overheat or fire condition of the terminal blocks (the
connection between power wires and heating elements attached to the window).
See United B756.

--- Radar. Selecting radar to STBY when not in use reduces the load. Know the
location of its Circuit Breakers (e.g., B772, E6 & E16) and other important CB.

--- Area heaters. If aircraft is equipped with electric shoulder/foot heaters, verify
they are OFF during preflight. Crews often leave them in LOW.

195
--- Fighting a PED Cockpit Fire
A PED fire in the cockpit presents a more complex situation than one in the cabin,
as the use of a fire extinguisher removes oxygen in this small space.
If the PED fire is in the cockpit, the crew must don the oxygen masks before using
the extinguisher. Do not douse the PED with water because of the risk of an
electronics fire. Consider the risks of firefighting activities inside the cockpit.
Instead, bring the containment case into the cockpit and remove the PED with the
fire glove. If the PED is inside a crew bag, remove the bag from the cockpit and
drop the PED into the containment case. Do not charge a PED inside the cockpit.

Cargo Fires
FAA tests in 2014* showed that gases emitted by overheated batteries in cargo
compartments can lead to explosions capable of disabling aircraft fire suppression
systems. This rapid combustion, known as a pressure pulse, builds up pressure
like a bomb, generating a pressure wave that can easily damage the cargo
compartment, thus allowing the escape of the high-concentration
extinguishing agent responsible for keeping the fire under control. Cargo
compartments are not designed to withstand even a fairly small pressure pulse.
*(Malaysia 370 disappeared on 2014-03-08 while transporting 400 pounds of
lithium batteries).

During cargo smoke/fire warning indication, the smoke detector cannot

differentiate between smoke and extinguishing agent once the first discharge is
activated. The warning will remain even if the fire is out. Airflow is reduced to the
cargo bay to minimize extinguishing agent leakage, which prolongs the warning.
The second discharge (usually an automatic slow continuous release 20 minutes
later) will prolong the warning for the same reason. There is no way to confirm if
the fire is contained until the warning goes away, which could be much later, and
the aircraft should have landed long before that.

A cargo fire warning must never be dismissed even if the warning goes
away.* An emergency descent to a landing or in preparation for a possible
“controlled arrival” must be made.

* Exercise:
--- Condition: - After receiving a cargo smoke/fire indication and activating the first
discharge, the smoke/fire indications go silent/out of view. What would you do?

Discussion:
Once a cargo fire warning has been detected, the crew should always
perceive it as an ongoing fire, whether the indication remains or goes away.

196
The fact that a cargo fire warning may not stay on is inconsequential to the fact
that an emergency descent must be made:
1 - If a fire test is made and it produces no warnings (failed):
The detection system has been damaged, and because the fire status cannot be
verified, an emergency descent must be initiated.

2 - If a fire test is made and it tests normal:

Although the detection system may be operational, the extinguishing agent and
smoke are escaping due to structural damage. Concentration is insufficient to
activate the alarm (outflow valve may be in the fully closed position, and cabin
altitude may be climbing). Fire is likely to grow faster because the extinguishing
agent is escaping overboard, and the cargo bay gets more ventilation. An
emergency descent must be initiated.

For these reasons, a cargo fire test before completion of an emergency descent
and before fire warning is extinguished (silent/out of view) is not indicative. This
will be further studied in this Module’s Part 4.
Be completely familiar with your aircraft’s Cargo Fire Protection procedures.

Intentionally Left Blank

197
 PART 2 - PROCEDURES & CHECKLISTS

--- Start of a Smoke Event

A usual first indication is an odor, but smell is not a good indicator of the cause or
location and can be deceptive. Besides, it is impossible to determine if an odor
comes from the originating source or a possible secondary source.

Engage other crewmembers for their opinion and reevaluate. People may not act
on it or may tend to normalize or minimize it. An odor that does not belong is
significant, do not dismiss it as “it is nothing.” Give yourself no more than two
minutes to locate the source.

Accident reports indicate that crews rely on smell to detect and differentiate
between odors from different potential sources. This reliance usually results in the
misidentification of the smell as originating, for example, from an air conditioning
or electrical source, leading the crew to initiate an incorrect procedure and leaving
the actual source unattended. Furthermore, there is an average of 6 to 8 minutes
spent identifying a smell, with no crew action until the appearance of secondary
indications.

A cabin smoke/fire event is the most critical moment for “clear and precise” inter-
crew communication. Firefighting capability will end in the first few minutes, and
what happens next will determine the fate of the flight.
Have a F/A stay on the interphone with the cockpit to describe the development of
the event. During the preflight briefing, you may want to mention that to the cabin
chief (delegation of this task to a F/A may already be in their manual). Be very clear
with your questions. Verify that the responses accurately represent the facts
instead of the situation we wish for (see CVR transcript Air Canada 797).
Example (F/A to pilot):
- “The fire is completely out, and we are now checking for any secondary sources.”
- (Later) “We have checked the entire cabin, and there are no secondary sources.”
OR – The fire is ongoing, and all fire extinguishers are empty.

If this is a four-pilot crew, assign one to stay in the cabin (for his technical
background) to help with inter-crew communication and assist firefighting.

--- Annunciated and Unannunciated Checklists

Annunciated checklists are unannunciated events until detected by the aircraft’s
systems. Pilots should not wait for an electronic checklist to be displayed to guide
them on what to do if they perceive a situation developing. For this, they must be
wholly familiar with all emergency checklists’ general intent (for an expanded
example, see Delta 95).

198
Annunciated checklists
When smoke-related checklists are prompted by systems indications (e.g., lights,
messages, advisories, alerts or warnings), they should only be initiated when
directed by the ECL or QRH (Electronic Checklist or Quick Reference Handbook)
or its equivalent. They should not be initiated by relying solely on smell. Other
similar checklists would be Lavatory or Crew Rest Smoke or IFE/Passenger Items.

Unannunciated checklists caution

Environmental situations would trigger the Cabin Air Quality, Volcanic Ash or
Bio/Chemical checklists. Smoke with no other systems indications should lead the
crew to the “Smoke, Fire or Fumes” checklist, followed by the “Smoke Removal”
checklist. The Smoke Removal checklist should be accomplished only when
directed by another checklist. Smoke removal procedures may change the
airflow and worsen the situation by fanning a source or masking it.

Nevertheless, if smoke becomes the greatest threat (visibility, breathing, or

creating secondary fires), the crew should reorder priorities and hold other
checklists to do the “Smoke Removal” procedure. However, it is effective only after
the smoke source is extinguished.

Smoke checklists, together with the Smoke Removal checklist, can become a five-
page task (with about 50 items), and it will be a challenge to complete it
successfully in a two-pilot crew. Correct execution weighs heavily on how familiar
the crew is with the procedures involved. Good working knowledge of procedures
should allow the crew to accomplish the essentials before smoke precludes
reading checklists.

--- Smoke Behavior During an Emergency Descent

An emergency descent is usually initiated during an unidentified smoke event. As
thrust is reduced to idle, there is less new air coming into the cabin, and the outflow
valve(s) move towards the closed position to control pressurization. This
combination causes a reduction in flow renewal and, together with a lower deck
angle during descent, results in an accumulation of smoke (hot air) in the rear
cabin. Aircraft with upper flight decks tend to accumulate smoke in the cockpit
within the first few minutes.

Descent, with spoilers extended, allows for higher speed and a more expeditious
descent, but it also results in a higher deck angle, which could bring smoke to the
cockpit. In this case, extending the landing gear would lower the deck angle for the
same speed.
If the emergency descent occurs at the beginning of the flight when the aircraft is
heavier, the deck angle will be higher. Towards the end of the flight, when the
aircraft is lighter, more nose-down is required to reach the same speed, resulting
in a lower deck angle. The difference is approximately 2°.

199
During approach, when slowing to flap extension speeds, as the aircraft nose
comes up, smoke comes forward and can penetrate the cockpit, obscuring the
instruments and visibility to the outside. Opening cockpit windows would allow
visibility to the outside from the bottom half of the windows.
Note: - Even if the smoke comes from the back of the aircraft, it will still be
surprisingly hot (Capt. Gilberto, VARIG 820).

INTEGRATED IN-FLIGHT FIREFIGHTING PLAN

(Observations for a blueprint)

The following are blueprint expanded considerations for an Integrated In-flight

Firefighting Plan for pilots and cabin crew. Tailor this plan to your specific
aircraft. Insert checklist items in their correct sequence in a short checklist format.
Plasticize it in white paper, in a bold, large black font for easier reading in reduced
visibility conditions (when e-checklists may not be available).

--- Recirculation & Gasper Fans………………………………..……………… OFF

These two items are common on smoke-related checklists, and they should be an
immediate action item. Recirculating air makes it difficult to locate the primary
source of smoke/fire and can initiate secondary fires. Recirculation fans are
themselves the number one source of smoke events. The Gasper Fan air intake is
typically located in the aft section of the aircraft, and it brings the smoke forward
from the aft cabin during descent. It is urgent to turn off both systems at the first
sign of an odor before the smoke spreads throughout the aircraft, making it
more difficult to identify its source.

--- Equipment Cooling switch……………….………….…………….………… OFF

“Equipment Cooling” OFF switch uses differential pressure to reverse airflow and can be
used manually to remove cockpit smoke. Although its use warns of possible electronic
equipment and displays failures after 30 minutes of flight at low altitude and low cabin
differential pressure, the smoke/fire event will likely be over before this becomes an issue.

--- If or when smoke is present in the cockpit:

Oxygen Masks, Goggles & Regulator.................................................. ON, 100%
To prevent trapping smoke between face and mask, turn oxygen ON 100% before
placing mask. It is harder to locate the knob after the mask is on.

Cockpit oxygen quantity is calculated for an emergency descent and not for
prolonged smoke events. Even if oxygen bottles were full before the flight, the
supply might not be adequate for the duration of a smoke event. If flying with a
reinforced crew of four pilots, consider assigning one pilot to the passenger cabin
to assist F/As with firefighting and save 25% of the cockpit oxygen. Having a
technically trained individual in the passenger cabin communicating with the

200
cockpit also ensures the same aviation language is being used, which will help
coordinate both cabins.

Crew Communications................................................................ ESTABLISH

Previous events have shown that most crews have difficulty in establishing and
differentiating communications between stations. Visibility is limited once oxygen
masks/goggles are on. Know precisely how to switch between cockpit intercom,
ATC, PA and specific F/A stations. Speakers will not work with loss of electrical
power; reception is possible through headphones, which are not usually used at
cruise. It is problematic to put them on once the mask is already on (see CO 1593).

Attempt to locate smoke origin by verifying possible smoke sources:

“ALL CALL” and confirm if there is smoke in the cabin.

--- If smoke is ONLY in the cockpit:

Personal luggage, battery-operated equipment charging in the cockpit?
Window heat – Check advisory lights, feel for even window heat distribution with
the back of the hand, and visually check the wiring.
Area heaters – Verify OFF.
Radar (know CB location, for radar to be OFF, both CBs must be off).
Conduct inspection of the “Electronics Bay” if accessible. Pilot instruments may be
cooled with air from the “E&E.”

--- If smoke is ONLY in the cabin or BOTH in the cockpit and cabin:
Initiate passenger cabin inspection. Each F/A inspects their station first, followed
by the lavatories, overhead bins and aisles.
IFE, Galleys, Cabin Equipment, all OFF.
Test Cargo + Wheel Well + Engine + APU Fire Systems. If any test fails,
accomplish the respective checklist.
Check primary and secondary engine parameters.
Check systems synopsis.
Are there unusual indications, flags or open CB’s?
Test lights (Create a list here of lights that stay “OFF” during a test).
Is aircraft flying in or near electrically charged air (convective cell, could the smell
be ozone-like smell)?
Is aircraft flying over a forest fire? If in IMC, ask ATC.

Note: - Statements from aircraft manufacturers that smoke removal procedures

are only effective after the smoke source is contained are commonly found on
accident reports (but not likely on aircraft manuals). Verify if your manual contains
such guidance.

--- However, if heavy smoke or fire develops, remove smoke to reduce the
risk of suffocation in the cabin, loss of internal visibility or structural failure.
If cockpit oxygen supply is at risk (smoke forward of the wing), request additional

201
PBEs from the cabin. PBE will last 10-15 minutes, depending on the model.

--- Emergency Descent

An Emergency Descent would normally follow an unidentified smoke/fire
situation (refer to M5).

--- Approach Notes

The “Electric Smoke” checklist may call for reinstating some items of the
electrical system power-down procedure before descending through 2,000 feet,
with a warning that this action may aggravate the smoke or fire condition. This has
to do with low altitude / low speed “Dutch roll” and loss of control, induced by yaw
damper loss (Pan Am 160 1973-11-03), and degradation of autoland capabilities
and stopping capability on some aircraft.
If internal visibility is at risk, manually open outflow valve(s). The cockpit window
can be opened when the plane is depressurized. The noise level will be high, but
communication is possible by shouting if the speed is below 220 knots. Keep the
mask on, do not protrude your face out of the window. Be aware that outward wind
can remove lose items from the flight deck.

Intentionally Left Blank

202
 PART 3 - SMOKE / FIRE MENTAL MODEL
Pre-requisites: - M2, M3, M5, M6 Parts 1-2

“Before we can survive an emergency

We must first know how to survive it in our mind.
Achieving this is the result of a plan.”
Laurence Gonzales – Deep Survival

OBJECTIVE
To create a mental model to guide a crew through a smoke/fire event,
while preserving the options for a controlled arrival.

Building the “Smoke/fire Mental Model.”

Flying from A to B.
Fig.1

A smoke/fire event is a complex situation. The crew needs to quickly recognize the
indications and correctly execute appropriate smoke/firefighting procedures. In
most cases, it also needs to generate a flight path change to a new destination*
while maintaining the option for a Controlled Arrival.
* (see Active Monitoring).

This part addresses the considerations regarding the flight path and its three
stages.

203
--- “Crew Check Cabin”
Because there is little time during a smoke/fire emergency, it is necessary to jump-
start a full cabin crew search for the source, and a coded command should be
established by the airline. However, if a code is not in place, the Captain may
assign one and include it in the preflight crew briefing.
Example: “Crew Check Cabin” - Any crewmember detecting smoke should make
the coded command over the P.A. system, and all cabin crew should immediately
stop what they are doing and initiate a search.

--- The “Must-haves”

Some elements must be maintained throughout a flight, structural integrity being
the primary factor in flight sustainability. Although the crew has no means of
monitoring the progression of an impending structural failure, further damage may
be mitigated by the conservative use of the flight controls and of the landing gear
to prevent unnecessary loads (Austral 2553, Continental 11).

Reducing cabin differential or depressurizing may mitigate structural damage

when the smoke/fire is inside the pressurized* area.
* Instead of inside the wings or empennage.

Fig.2 - Firefighting capability, interior visibility and flight controllability are the
factors that pilots can monitor for their deterioration. Firefighting capability is
usually the first to be lost. In some rare instances, fire damages the structure or
the flight controls first, and the aircraft is lost without a chance for recovery.
E.g., Mohawk 40 (Air France 1611, Value Jet 592 not reviewed in this study).

Elements that must be maintained throughout the flight

Fig.2

204
--- Firefighting capability
If a fire is not contained before the fire extinguishers are emptied, it is likely to
continue until it runs out of flammable materials. Some aircraft components
account for self-contained fires (e.g., recirculation fans). It is easier to extinguish a
small fire when it is starting and at a high altitude, especially if the aircraft is
depressurized during descent below FL270*.
* - Since WWII, it has been known that long-range bomber missions could be flown
at 25,000 feet without the benefits of pressurization if an oxygen supply was
available. More recent research by the FAA shows that the maximum altitude
without unfavorable effects is 27,000 feet.

--- Interior visibility

Loss of interior visibility precludes the crew from performing their duties. To prevent
loss of visibility, pilots need to turn off the recirculation and gasper fans, the
equipment cooling and may have to open the outflow valve(s). Pilots also need to
be prepared to open cockpit windows for approach if visibility becomes insufficient
or smoke temperature becomes intolerable (Pan Am 160 and VARIG 820 had
open windows on final). These procedures need to be performed from memory, as
time constraints or loss of visibility can preclude reading checklists. Know your
critical checklist items.

Note: Emergency Vision Assurance System - EVAS

This system may allow for better cockpit visibility during a smoke event. It can
adapt to different airplane types, although its ease of operation needs to be
evaluated by the user.

Caution: - Use of EVAS during a smoke event should not influence the decisions
involved in a controlled arrival, nor should it motivate the pilot to extend the flight.
The safest early termination of the flight needs to remain the priority.

Video on system use:

https://www.youtube.com/watch?v=XC0gvBRVLbQ

205
--- Controllability
Flight control events are a time-critical emergency (even if no fire is present)
because control requirements change as fuel is used or dumped overboard.
Qantas 32 - A380 - Singapore 2010-11-04 was forced to land when lateral
controllability was reaching a critical level before completing the checklists for 53
ECAM error messages. The plane had a 20,000 pounds imbalance between the
left and right wing and landed 100,000 pounds over the Maximum Landing Weight.

During flight control issues, engaging the autopilot may help, as it makes smaller
adjustments and uses less hydraulic fluid than manual control. A/P may also use
different cables or fly-by-wire systems.
Should loss of control occur, use other modes of control such as asymmetrical
thrust or alternate cables (Continental 51, United 232). Alternate flap extension
may be used asymmetrically to control bank and symmetrically to control pitch.

Sluggish flight controls (requiring more input than usual) usually indicate an
impending complete failure. Pilots need to understand the symptoms of a
dying aircraft and its expected lifespan so that they can execute a
“controlled arrival” before the loss of control or an in-flight breakup occurs.
As difficult as the decision to crash-land may be, we should never gamble
the lives of those on board in an attempt to reach an unreachable runway
(Interflug IL62).

Intentionally Left Blank

206
 Stage 1
Remain at Cruise Altitude or Descend?
This is an expanded description of the Smoke Mental Model.
A summary is presented at the end of this part.

Once exposed to an unidentified threatening odor, the assessment, whether it is

safe to either remain at cruise altitude or initiate a precautionary emergency
descent, depends on whether the source of odor can be controlled.

Fig.3 - This is a two-step process. First, the crew needs to find the source, and
then it needs to determine if it can control it. (Recall from Part 2 in this Module, not
to waste time identifying the source by relying on the smell).

If, for example, the crew finds that the smoke is from a burning cell phone that is
accessible, then the crew has confidence that the incident is controllable. In this
case, the aircraft may remain at cruise altitude.

Fig.3

Intentionally Left Blank

207
Fig.4 - However, if the primary source of odor cannot be located within two
minutes, the flight should not continue at cruise altitude and an emergency
descent must be initiated without delay to reduce differential pressure.

Two minutes is enough time to search for a visible smoke source. If it is not easily
discovered, then the source is hidden, and that search needs to be continued
during an emergency descent to safer altitudes.

Fig.4

Dark or thick smoke or uncontrollable fire requires an immediate emergency

descent, bypassing the search (the source is evident) and followed by firefighting
efforts.

In either case, the urgency in initiating the descent is to reduce cabin

differential pressure as fast as possible to prevent a possible in-flight breakup.
Consequently, an emergency descent caused by a smoke/fire event is always
flown with full spoilers deployed.

Descending is also necessary to strategically preserve the option for an off-

field landing or ditching should conditions deteriorate and prevent reaching an
airport.

Intentionally Left Blank

208
 Stage 2 - Emergency Descent

The inability to locate and evaluate the capability to control the

source of smoke starts Stage 2 to an immediate landing.

“C” is an emergency airport of opportunity.

Fig.5

Fig.5 - During the emergency descent, determine* if an immediate landing is

possible and if so, plan to land. Never pass on the opportunity to land.
* If practicing “Active Monitoring” this determination is already planned.

--- Landing or “controlled arrival” considerations

An aircraft may land before a smoke/fire issue is resolved if an airport is nearby.
Choose the closest airport and land on the nearest runway (Continental 1593).
Landing on a short runway is a better outcome than risking an in-flight breakup
over the threshold of a longer runway, even at the risk of an overrun (Propair 420).

Even if the smoke/fire issue appears to have been resolved before landing, in most
cases it is impossible to confirm if the fire is completely out while in-flight. If the
event was in the cabin, there would not have been time to conduct a safety
inspection. Do not delay landing to inspect a damaged area (or to dump or burn
fuel).

If an airport is not available and smoke/fire is out of control, perform a

controlled arrival (off-field landing, ditching).

209
 Stage 3 - Descent Considerations

During the descent, the inability to land ASAP (absence of

airport and inhospitable terrain) starts Stage 3.

Stage 3A - An airport is not available

In this case, while descending, communicate with the cabin to determine if the
smoke/fire is completely extinguished. If it is, have a technical crewmember (i.e.,
pilot or deadheading mechanic) perform a cabin inspection of the area in question.

Stage 3A - Scenario 1 - Fire is out, and no structural damage.

Fig.6 - The smoke/fire is completely extinguished, and no damage to the fuselage
is found or suspected. Consideration could be given to resuming flight to the
original destination. However, landing at the closest airport may be a more
sensible decision in most circumstances.

Stage 3A - Scenario 1 - No structural damage

Fig.6

These are some considerations for landing at the closest airport:

Residual soot can develop breathing issues, contaminate food, and smell may
remain until addressed by maintenance. Do not reinstate “Recirculation and
Gasper Fans.” The need is to renew cabin air with fresh air and not to recirculate
contaminated air.

Reevaluate fuel and range before climbing to altitude. With recirculation fans off,
fuel burn increases approximately 1.5% (two engines). Furthermore, after an

210
emergency descent and a climb back to altitude, fuel reserves may be too low to
handle additional events, even if the aircraft can reach the original destination.
If firefighting resources were used, the aircraft is now under-protected should a
smoke/fire event reoccur.

Stage 3A - Scenario 2 - Fire is out, but structural integrity is lost.

The smoke/fire is completely extinguished, but damage to the pressurized hull is
confirmed or suspected. Depressurize the plane to preclude a possible structural
failure and fly to the closest airport.

Fig 7 indicates a flight descending from an altitude where it was depressurized to

a lower cruising altitude of FL100 (but no higher than FL150) and then descending
to a suitable alternate airport.

Stage 3A - Scenario 2 - Structural integrity lost

Fig.7

If an aircraft is depressurized after a smoke/fire event, its flight plan should have
contingencies to reach an alternate airport while cruising depressurized at 10,000
feet. But the actual environment in remote areas at low altitudes (e.g., polar or
other ocean) is not likely to match the flight plan forecast (due to nonexistent data).
An extra-long-range flight plan is generated on the best estimation of low altitude
meteorological data. Without QNH and temperature information, the altimeter error
could place the aircraft flying 2,000 feet lower than indicated.

Turbulence can significantly decrease range, especially when flying over

mountains at low altitude. A decompression on a polar flight can place the aircraft
5:30 hours away (in smooth air) from the closest runway. Crews may have to

211
deviate from oxygen regulations to the extent necessary to meet the requirements
imposed by the emergency. An airplane may be forced to climb from 10,000 feet
for high terrain, turbulence, or to extend its range.
Considering the facts presented above, which I feel pose a moderate risk to the
flight, if I were in such a predicament, I would feel confident to fly unpressurized
up to 15,000 feet for those six remaining hours.

Note: - Because intentional unpressurized flight may become necessary during an

emergency, become familiar beforehand with the specific procedures, especially
for Unpressurized Flight above FL100 (aircraft manual and MEL). Note the
electronic compartment limitations, temperature warnings and recommendations.

Stage 3B - Fire is ongoing, but high terrain precludes descent

Condition: - Flight is over a large area of rugged high terrain (e.g., Alaska), making
a crash landing a nonsurvivable event, or flight is over a frozen ocean (e.g., North
Pole) where air temperatures would make a successful ditching nonsurvivable.
This scenario is the least likely due to world topography.

Fig.8 - Stage 3B

--- Temporary Level-off at FL250-270

Fig.8 - In the conditions above, the best chance for survival is to descend and level
off at FL250-270, fly at turbulence speed (to protect from effects of a fire-induced
decompression) and depressurize the airplane. An emergency descent (full speed
brakes deployed) to FL250-270 takes approximately two/three minutes from
FL370/410, and likely the smoke/fire situation is not yet under control when
leveling-off.

212
Burn rate - With the aircraft depressurized, there is a decrease in burn rate of 50%
to 54% at FL250/270, and the fire will be easier to extinguish (aircraft has limited
resources). This decreased burn rate (2% per 1,000 feet) was observed on all
FAA’s tested materials. Depressurization had minimal effect on aluminum-lithium
alloy fuselage or lithium-ion battery fires.

PBE - Check with the cabin crew on the fire status before depressurizing the
aircraft. Advise them they must use PBE’s and send the cockpit PBE to the cabin.
The reduction in smoke while the plane is depressurizing may give a perception to
the cabin crew that PBE use is not required. Time of useful conscientiousness is
about 2 minutes at FL250/270. PBE use is for a crewmember to remain functional,
regardless of smoke conditions.

PBE Training - Crews should train on how to safely use PBE’s by practicing
activating oxygen generation (live equipment). Actual smoke/fire events indicate
that crews are sustaining burn injuries caused during the oxygen generator
activation.

A fire extinguisher will empty in 8 seconds if used continuously and in 60 to 90

seconds if used intermittently. Using all firefighting capabilities when the fire is at
its weakest point is the best chance to control it.

The level-off time is being allocated from the passenger oxygen supply time of
approximately 22 minutes. This level-off period should not exceed 3 to 4
minutes. As soon as firefighting capability has ended, the flight needs to
continue descent whether the fire is out or not.

In any situation, clear and precise communication is vital during this most critical
period. Accurate descriptions of the development of the event lead to correct
decisions, which will determine the outcome.
Note: - This scenario (Stage 3B) is the least likely due to world topography.

--- Descend in preparation for a possible Controlled Arrival

Fig.9 - If the fire is still ongoing after exhausting the firefighting capability and
depressurizing the plane, self-extinction is the only possibility, although rare. In-
flight fires tend to cause loss of control or in-flight breakup. At this point, the crew
needs to realize the plane is likely in its last minutes of controllability and a ditching
or a crash landing becomes inevitable.

A high sink rate (full spoilers) is desired to reach low altitude rapidly. A 15° bank
allows for a spiral descent to scan the horizon for ships or for a crash-landing area
(maintaining a very shallow bank, less than 10° for long periods can cause
precession on gyro-driven attitude indicators). Landing lights on will alert others of
the aircraft’s non-normal profile.

213
If over an ocean, selecting the closest “round number” lat./long (e.g., N30 W140)
to fly to and ditch will reduce chances for mistakes when relaying the aircraft’s
position and facilitate rescue efforts.

“D” is the ditching or crash-landing.

Fig.9

Continued descent without a QNH altimeter setting needs to account for a possible
altimeter error (pressure and temperature errors are not a factor in visual daytime
conditions). Close attention to the radio altimeters and vertical speed is required in
IMC upon passing 5,000 feet barometric, as aircraft could be lower. Switch
attention to radio altimeters once they come alive (without QNH, RA height
becomes primary). Descend to radio altimeter lowest safe height for the conditions
with full flaps, minimum target speed and ready for touchdown.

If ditching near a ship, fly-by first approaching from the bow and right over the ship
low and slow to alert the crew. Ships at sea are noisy, and there could be only one
man on watch on the bridge, and he may not be watching. Broadcast the ship’s
name on your emergency frequency. This can be relayed to SAR, which will send
a message to the ship.

--- Final check

Make a final evaluation before committing. Reevaluate the “Must Haves”
(firefighting capability - interior visibility - flight controllability). If the fire is still
ongoing, do not wait, ditch or crash-land. Loss of control usually occurs within a
few seconds from when the fire reaches the flight controls.

214
--- If ditching or crash-landing not required.
If on the other hand the threat is over, there are new considerations.
Retract flaps and climb to FL100 or higher up to FL150, as discussed previously.
Do not cancel the emergency, however, broadcast that the airplane did not ditch.

--- Consider altitude and range.

If an aircraft was depressurized during a fire event (whether structural damage was
found or not), the aircraft should not be pressurized again until maintenance
inspects the aircraft.

If the original destination or any other airports are not feasible:

Reaching any land, even without a runway, would mean the possibility for an off-
field landing.

If unable to reach any landmass:

Ditching within 300nm of shore allows Rescue Services to launch helicopter
rescue. Further than that, Rescue Services can still assist by dropping equipment
from airplanes.

Suppose the ditching position is going to be too far from land. In that case, ATC
can access and relay ship location, and ditching can be planned near a ship (Pan
Am 006 Pacific Ocean 1956-10-16), or a ship can be redirected to a planned
ditching latitude/longitude.

Consider never canceling an emergency verbally or electronically. A declared

emergency and “Captain’s Emergency Authority” go together. The urgency may
be over, but the emergency status remains. After an emergency event, there may
be uncertainty about the safety status of the aircraft, and the flight crew does not
have the means to assure themselves of its airworthiness. A plane that lands with
a declared emergency at an airport different than the original destination is
required to have more comprehensive inspections and maintenance before
returning to flying status. And the “Captain’s Emergency Authority” carries over
until the flight terminates. This protects the Captain and his crew while acting under
Captain’s Emergency Authority.

Intentionally Left Blank

215
 RECAPPING

Fig.10

The presentation of the variables in different scenarios is complex. The following

is a summary of the flow chart described in this part.

Stage 1
During a flight from A to B (green path), an event starts (green 1). If able to locate
and evaluate the capability to control the source of smoke within a two-minute time
frame, the flight may remain at cruise altitude and continue on course (fig.3).
If unable to locate and evaluate the capability to control the source of smoke after
a two-minute search, emergency descent needs to be started immediately to
reduce cabin differential pressure, starting Stage 2 (fig.4).

Stage 2
Emergency descent to an immediate landing if an airport is available.
If an airport is unavailable and smoke/fire is out of control, perform a “controlled
arrival,” terrain permitting (off-field landing, ditching).
- Follow 2 - To C (Fig.5).

216
Stage 3
If landing or a “controlled arrival” is not possible (absence of airport and
inhospitable terrain), the crew needs to evaluate situation development and
consider options as follows:

Stage 3A
The smoke/fire is completely extinguished. However, there is no available
airport.
- Scenario 1 - Aircraft has no structural damage and is pressurized.
- Follow 3 - Yellow - Up to E or B (Fig.6).
- Scenario 2 - Aircraft has structural damage, confirmed or suspected.
Depressurize the plane.
- Follow 3 - Yellow - Down to E or B (Fig.7).

Stage 3B
Smoke/fire is ongoing, and descent must be delayed due to high terrain (fig.8).
(This scenario is the least likely due to world topography).
Temporary level-off at FL250-270 to depressurize airplane and firefighting activity
while in a 50-52% reduced burn rate. If unsuccessful, crash-land or ditch ASAP.
- Follow 3 to red D (Fig.9).

For crash-landing or ditching procedures, see:

M9 - Crash-landing or Ditching.

EXERCISE
Review Mental Model diagram, figure 10. Understand the reasoning for each
decision and how it relates to the flow chart. Then, draw by memory the Mental
Model diagram, recalling the decision process.

Intentionally Left Blank

217
 PART 4 - INCIDENT EVENTS
Events are alphabetized by airline and flight number.

--- Air Canada 797 - DC9 - Cincinnati 1983-06-02 - Aft lavatory fire
http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR86-02.pdf
Notice that this is a deteriorating situation but is being described in a positive way.
This confirmation bias behavior is commonly noticed on the CVR’s of most critical
events. Be aware of this when dealing with your events.

Time Stamps are expressed in minutes from the beginning of the event as detected
by the Cockpit Area Microphone (CAM).
00 At FL330, arcing sounds are recorded by CAM. Pilots are eating and can’t
hear them.
03 Three aft lavatory flush motor CBs trip (CAM).
11 Captain resets CBs (the procedure which allowed for one reset has since
changed).

14 F/A to CA – “Excuse me, there’s a fire in the washroom at the back.” F/O is
sent to the cabin.
17 F/A – “Captain, your F/O says that after a big discharge of CO2 in the
washroom, it seems to be subsiding.”
18 Capt. – “Coming along, okay?” – F/A – “Getting much better, okay.”
19 F/A – “I was able to discharge half of the CO2 inside the washroom even
though I could not see the source* but it is definitely inside the lavatory.”
F/A saw black smoke coming out of the seams of the lavatory’s walls and
discharged the CO2 bottle in the lavatory, and closed the door.
* Would this be a hint to you? If you cannot reach and control the source of
the smoke/fire, self-extinction is the only possibility.
19 Electrical failures start, and an emergency descent begins from FL330. During
the descent, smoke fills the passenger cabin.
32 Captain pressed goggles to the windshield for visibility (day VFR). After
landing, the fire flashed over in 90 seconds. Fire services were not able to put
out the fire, 23 fatalities.

Intentionally Left Blank

218
NTSB Probable cause:
“…an underestimate of fire severity, and conflicting fire progress information
provided to the Captain delayed the decision to start an emergency descent.”
(Clear and precise communication between crews?).

Observations (Capt. Vireilha):

- It took 19 minutes to start the descent and 13 minutes to land from FL330
because cockpit visibility delayed locating the airport.
- Training departments do not emphasize joint cockpit/cabin crew emergency
training. Education on smoke and fire exercises needs to be expanded.

*****

--- Continental 50 - DC10 - Near Philadelphia 1998-12-26

Aft galley ceiling fire
(Based on the CIR. Capt. Vireilha was the pilot in command, PIC).
During the climb, engine 2 CSD temperature started to rise, and CSD was isolated.
Despite this, its temperature continued to climb and approaching the limit, the CSD
was disconnected. Still, its temperature went above the red line. Within seconds a
burning odor was sensed in the cockpit. Although this event was not related to
what would happen next, it did play a role, as the pilots had no way of knowing
what was happening until after the event was over.

Moments later, we heard pounding on the cockpit door, and the F/E opened the
door to two F/A’s. One had smoke coming from her hair (due to smoldering hair
spray), and she stated, “there is a fire in the aft galley ceiling with blue flames and
an orange glow above it.” I sent the F/E to the aft cabin with guidance on how to
fight the fire.

A fluorescent light ballast burned and ignited a dropdown ceiling panel over the aft
galley. A small drip on fire grazed the F/A’s hair. She ran to the cockpit with another
F/A chasing after her, attempting to put out the fire with her blouse.

219
The F/E extinguished the fire by dropping the ceiling panel with the crash ax. He
first used the fire extinguisher on the visible lower side, and when the panel was
on the floor, he used it again on the upper side. After looking into the ceiling
opening and verifying the fire was completely extinguished, he called the cockpit
to advise “all clear.”
*****

--- Continental 51 - DC10 aircraft 76 - Newark 1999-03-04

Loss of pitch control
(Based on the CIR. Capt. Vireilha was the PIC).
Aircraft logbook write-up:
“Flight controls feel sluggish and require larger than normal inputs to respond.”

Maintenance response:
“Performed flight controls ground check. Flight controls have full amplitude*, no
abnormalities noted, OK to continue, request further info.”
* (see Observations at the end).

Narrative:
During rotation to a 15° target pitch, elevator control was sluggish, and attitude
kept increasing to and remained at 17° despite both pilots’ attempts to lower the
nose. Pitch control had been lost after rotation and momentum carried the aircraft
to 17° nose-up. After reaching 4800 feet, thrust was reduced, and the aircraft pitch
was then controlled through differential thrust between center engine 2 (for nose-
down) and wing engines 1 and 3 together (nose-up). Aircraft returned for an
immediate overweight landing 10 minutes after takeoff (no fuel dumping, no CG
change).

History:
On the last leg from Houston to Newark, a bleed air leak had damaged the brackets
that held the fire extinguishers in place in the tail section, and one became loose
and free to move around in that large compartment. This bottle created dents on
hydraulic lines, restricting the passage of the hydraulic fluid. This narrowing caused
the Skydrol to foam, which caused the feel computer to give erroneous flight
control sensing to the pilots.

Although controls felt sluggish and required larger inputs immediately after takeoff
from Houston, the pilots did not report this flight control problem to ATC or declare
an emergency. This was the return home leg of a trip. Autopilot, requiring fewer
inputs/hydraulics than manual flying, flew the airplane at cruise altitude with no
issues.

During our takeoff, the loose fire extinguisher rolled back with enough force to be
punctured. Self-propelled by its own escaping Halon at 1800 psi, it created 20 hard
impact points, disabling pitch control and 50% of roll control. It ripped through

220
electrical wiring and caused an APU fuel leak, which could have started a fire. This
fire extinguisher also hit the other two fire extinguishers, which collapsed. The
combined released Halon of the three bottles combined with low air temperature
possibly prevented a tail fire.

The hydraulic quantities and pressures were normal, and there were no abnormal
indications in the flight deck. Because the hydraulic lines were constricted, there
was reduced or no hydraulic flow (cause of the lack of control). Eventually, the only
indication of a malfunction would have been an overheating of the hydraulic
pumps. The 10-minute flight was not long enough for this to occur. A few minutes
after landing, the aircraft lost the only hydraulic system that had flow and provided
the remaining 50% of roll control.

In the previous four months, there had been four thermal discharges of tail bottles
(APU and engine 2, where the bleed air leak was confined) but no discharges of
wing bottles for engines 1 and 3. All thermal discharges happened in Rio de
Janeiro and were mistakenly attributed to the hot summer. Maintenance computers
were set up to flag repeated issues only if they occurred within 30 days, missed by
just a few days each time.

Observations (Capt. Vireilha):

Tail structural members failed to pass a density check due to prolonged exposure
to high bleed air temperatures. Unable to find a replacement DC10 tail, this aircraft
received a new MD11 tail and returned to service six weeks later.

This aircraft should not have flown until maintenance had found and fixed the
problem. A simple interior inspection of the tail section would have discovered
substantial damage and would not have placed at risk 235 lives.

A ground check of flight controls free displacement to full amplitude, by itself, is not
a good representation of predictability of flight control behavior once airborne and
subjected to air loads. On the Boeing 747, hydraulic pressures were monitored for
fluctuation by the F/E during the flight controls check. On the Douglas DC10, the
F/E was only involved in reading the checklist. From this day on, I would brief the
F/E to monitor and advise if the fluctuation dropped below 2800psi or if there was
no fluctuation.

In a report to the training department, I suggested that the Douglas fleet adopt the
Boeing flight controls check monitoring procedure, as both aircraft hydraulic
systems behave similarly. Unfortunately, politics between the fleets and their
training departments prevented standardization.

Safety is not about rivalry; it is about fair-minded cooperation.

221
--- Eight days later the following event took place:
Continental 1512 - DC10 aircraft 47 - Houston 1999-03-12
Air admitted in elevator hydraulic system.
Extract of follow-up mail to the training department by Capt. Vireilha as the PIC.
During the flight controls check, we found a dip to 1500 psi on hydraulic system 2,
although the Flight Control Position Indicator showed full amplitude (a normal dip
would be from 3,000 to 2,800 psi). A second check gave us a dip to 1,000 psi, and
a third check gave us a dip to 600psi. A F/A in the aft galley called to report unusual
sounds and floor vibration. As we returned to the gate, both Slats and Flaps failed
to retract and remained in the takeoff position.

Mechanics found a flap control valve and several restrictors needing replacement.
Air allowed in traveled to the highest point in the system, and when we checked
the elevators, the cavitation caused the floor vibration and the tail noises described
by the flight attendants. This flight control emergency was avoided because we
monitored the hydraulic pressure gages during the flight controls check.

*****

--- Continental 84 Rome - B777 - 2010-12-24

Cockpit & E&E smoke
Based on the CIR. Capt. Vireilha was the PIC.
Times are expressed in minutes since the beginning of the event as detected by
the crew.

00 – During my bunk rest period, I was informed by the flying pilots that they were
detecting electrical fumes in the cockpit with no systems indications. I told them I
would check the electronics bay (MEC) and be right up (MEC air is used to ventilate
the pilot’s forward panel).
I went down into the MEC and found haze and a strong smell of electrical fumes
on the starboard side but could not pinpoint the origin.

01 – As I turned around to climb back to the main deck, I was surprised to see how
much the forward outflow valve was opened. This could indicate that the aircraft
was already sensing smoke as the forward valve is usually not open as wide.
Unfortunately, the valve was below my feet level, and the haze was above my
head, not providing a good smoke evacuation scenario. Through the outflow valve,
I could see the lights of the western coastline of Italy (clear night). This told me we
were near several major airports.

Note 1: - The MEC has no fire protection. The only way to fight a fire is to send a
crewmember, which is highly problematic due to the lack of specific training.
Landing is therefore automatically a priority.

222
02 – I called the cockpit and informed them that we did have smoke in the
electronics bay and that I wanted them to declare an emergency and initiate an
emergency descent to the closest airport. I then instructed a F/A to wake up the
resting F/As and ask for all firefighting equipment to be brought up to the forward
galley.

Note 2: - After landing, the F/A told me that the firefighting equipment had not been
brought up “because there was no visible fire” (denial, the first emotional reaction).
- Having a pilot crew of four, when I returned to the cockpit, I asked one pilot to
remain in the passenger cabin by the MEC open hatch to monitor if the smoke
developed into a fire and ensure the same aviation language between the two
cabins.

03 – As I took control of the aircraft, I reduced to minimum speed in preparation

for an emergency descent. We were at FL370. and Rome was at eleven o’clock
and 66 miles. I declared a Mayday to Rome control and requested an emergency
descent direct to Rome’s FCO, and we were cleared as requested. An emergency
descent was initiated with speed brakes fully extended, and landing gear retracted.
Shortly afterward, Rome control told us we would not need to change frequencies
and that he could stay with us until landing. Although initially we were cleared to
FL230, two or three minutes later, he gave us a landing clearance on any runway
of our choice. This reduced the cockpit workload significantly, which allowed the
crew to pay more attention to dealing with the aircraft in a quiet environment
(outstanding work from Rome control).

04 – Soon after starting the descent, a status message "Equipment cooling fan R"
came on, perhaps indicating the probable smoke origin. We maintained maximum
speed (barber pole) with full speed brakes deployed and arrived over the outer
marker 500 feet high while decelerating through 300 knots. We made a 360º turn
towards the ocean to lose altitude and speed.

The following slides (bird’s eye view of Rome’s runways and flight profiles):
Early during descent, the option to fly a longer track (displayed in blue) to help lose
altitude was proposed by the F/O and discussed. However, I decided to fly direct
and make a 360º turn on final because it puts the aircraft at the airport sooner,
where options are available (open flat terrain). We could still select the landing
gear down to expedite descent if needed. There would be no options if conditions
deteriorated while the plane was on the longer track and further from the airport.

Intentionally Left Blank

223
Two flight path options:
Considered path (blue)
Actual flight flown (red) (ECL = Extended Centerline)

16 – We made an overweight landing on runway 16R, 12 minutes after starting the

descent. Airport firefighters inspected the exterior of the plane. An interior
inspection found no fire or smoke, and the airplane was then taxied to the ramp.
Maintenance found that the Right Equipment Cooling Fan had seized, the In-flight
Entertainment System had been automatically re-booting continuously, and the
fluorescent cabin lights were flickering. This may have been caused by irregular
voltage and by load shedding from the failure of the Equip. Cooling Fan.

*****

--- Continental 1593 - B757 - Savannah 2002-03-03

Cockpit smoke
(Based on the CIR. Capt. Vireilha was the PIC).
CVR times were not available, but it is estimated from the CIR that from the
beginning of odor detection to landing, the duration was 16 minutes. The flight took
off from Orlando at 10:12 local time destined to Newark, climbed to FL370, and
landed in Savannah at 10:52.

At FL370 off the US east coast, 80nm SE of Savannah, cockpit and aft cabin
smoke was detected. Moments later smoke was visible in the cockpit. (I was alone;
F/O had gone to the lavatory after reaching FL370.)
CO1953 – “Jacksonville center, we have smoke in the cockpit. We need an
emergency descent to Savannah.”

ATC Center – “Uh… it will be a little while before I can let you down; I’ve got USAir
right below you.” (I thought his hesitation was perhaps because my emergency
descent request, although explicit, was not understood as an emergency
declaration).

224
CO1953 – “We are declaring an emergency; we need a left turn, and we need to
start down now.” (F/O returns from lavatory at this time).

Period of silence from ATC… I could not believe his hesitation, and the USAir
Captain must have felt the same way because he then made the following call:

USAir – “Hey Continental, we see you ahead of us, we will make a right turn
towards the East, and you go ahead with your left turn.” I acknowledged and
thanked him, and then I advised ATC I was making an emergency descent to 2,000
feet (over the ocean) direct Savannah. The controller then cleared me as stated.

Unable to raise the cabin crew on the intercom, I made a PA alert to the F/A’s and
the passengers: – “Due to technical difficulties, we will be landing shortly. Please
follow the F/A’s instructions.” – The Chief F/A had experienced a smoke
emergency before at Eastern Airlines, and she knew what to do despite the lack
of communication. Because the intercom had lost power, she came and knocked
on the cockpit door. The door lock had lost power and unlocked, but neither I nor
the F/A knew that. She could hear us breathing oxygen and see and smell the
smoke, so she prepared the cabin for an emergency landing.

Because Savannah was not a regular destination for this aircraft, we did not have
its approach plates on our flight kit. I asked the F/O to get them from the aircraft
library, stored by the cockpit door. When he tried to get up, we realized the oxygen
mask supply hose was not long enough to reach the back of the cockpit. As I did
not want him to remove his mask, I asked him to forget it. I would get whatever
information I could from the aircraft’s database.

A few moments later, the Equipment Cooling Overheat light came on, and the F/O
completed this checklist. I noticed first that the FMC would not take new inputs,
which precluded the selection of Savannah as a destination. However, I could still
see Savannah airport as a green circle (through the ALTN, alternate airports page),
but that would soon be gone. In the next few minutes, we lost the autopilot, the
autothrottles, and EICAS, followed by the Capt. and F/O instruments, including
DME. We were on STBY instruments in IMC and flying as fast as I could without
references from engine gages.

I asked the new ATC controller for vectors to the outer marker of the closest runway
and frequent distance advisories. The controller informed us that they were landing
on runway 10 with SE winds at 15 mph and that the runway was 9300 feet long.
However, he could give me the ILS to runway 1 (closest runway), but that runway
was 7,000 feet long.

The weather was 1,000 feet overcast, light rain, and we would be landing with
about 8 knots of tailwind. We accepted the North runway, and the controller gave

225
us the ILS frequency and cleared us to maintain 2,000 feet to the marker. Although
we had lost most electronics, ATC could see us on radar from transponder 1.

At Glide Slope intercept, the STBY Glide Slope disappeared from view while the
LOC remained operative (later, the same scenario was recreated in the simulator
and the same event occurred). We were fully configured for landing and started
down at about 800 fpm (without Glide Slope and a tailwind, a VS of 800 fpm was
a conservative guess to assure we would not overshoot the short runway). We
broke out of the overcast at 1,000 feet, and with heavy braking, the airplane
stopped halfway down the runway where I had requested the firefighters to be in
position for fast access.

We removed the oxygen masks and did not detect any smell of smoke. I shut down
the engines with the fuel switches and retracted the speed brakes (flaps were
already fully extended for landing). This allows firefighters to approach aircraft
sooner if engines are spooling down. There is no reason to have the engines
running while considering if to evacuate. We can restart later if taxiing is possible
and desired. APU was now our power source, and it had been running from the
top of descent. I did not pull the fire handles and discharge the fire extinguishers
for engines and APU, as I wanted to hear from the firefighters before doing so.

The firefighters reported the electronics compartment had smoke, but no fire and
the battery compartment and both cargo compartments were clear. The passenger
cabin was clear too. We started the engines and taxied to the gate.

Maintenance later found that a self-contained fire of the #1 E&E cooling fan and
other electrical shorts had caused load shedding. The event started when the F/O’s
1.5L water bottle, left on the cockpit floor, tipped over during turbulence and spilled
water into the E&E below. The bottle cap was not properly screwed on. The inside
wall of the electronics bay showed where the water had cleared paths from older
coffee spills. Besides the E&E electrical damage, tire #8 was replaced due to
deflation.

Observations (Capt. Vireilha):

During the descent, I felt the F/O trying to get my attention repeatedly by pulling
on the sleeve of my shirt, harder each time. Because we both had our full-face
masks on, our side visibility was limited. I could not take my eyes off the small
STBY instruments as I was hand flying and trying to maintain maximum speed. I
would briefly look at him but then had to turn my attention back to the instruments.
I tried to communicate with him over the interphone, but he could not hear me
(unknown to us, we had lost power to the speakers). Although I had an earpiece
headset and could receive ATC, the F/O did not have his, so he could not hear
ATC or myself.

226
He could not transmit either, as he was not configured correctly for use with the
oxygen mask mike and interphone (I was flying and doing the radios, he was on
the QRH checklist).

Out of frustration, he removed his oxygen mask and told me, “we needed to land
right away.” I pointed at the disconnected A/P, A/T and the STBY instruments, so
he knew what I was doing. However, he did not know I was receiving vectors to
the airport. He had no instruments to look at on his side, and out the window, all
he could see was gray. He extended flaps and gear from my hand signals.

During the descent, my headset earpiece underneath the oxygen mask straps
became painfully uncomfortable and distracting. I thought of removing my oxygen
mask momentarily to remove the headset, but the flying demands did not allow me
to do it. Had I not been on a headset and because the speakers were working
during part of the descent, once they failed, I could have misinterpreted this to be
a radio failure instead. The lack of communication between the pilots made this a
more complex situation. I had an experienced and competent F/O who understood
what needed to be done and was able to work alone and be an effective
crewmember.

While preparing the cabin for an emergency landing, the Chief F/A chose a strong
individual as an ABA (Able Body Assistant). He agreed to assist, however, as she
briefed him on his possible duties in opening a door, he lost interest in her
teachings and sat on the F/A jump seat and started to pray feverishly. I believe she
replaced him with another individual who was more interested in focusing on the
task at hand.

Later, another passenger who accepted ABA duties wrote a letter to our CEO
complimenting the crew. Interestingly, he commented on “the heavy braking
because of the short runway.” When every second counts, heavy braking and
stopping on the runway would have saved Saudia 163, British Airtours and many,
many others.

This incident could have been avoided if the bottle cap was properly screwed on.
--- Similarly, a B707 at FL230 over Yemen (1985-08-15), suffered a nose-up
runaway stabilizer as a glass of water spilled over the center pedestal. The aircraft
stalled, but the crew recovered control 1,000 feet above the ocean.

Intentionally Left Blank

227
Slide below: - Note descent to 2,000 feet over the ocean to maintain option for
controlled arrival to a ditching if conditions deteriorated.

Intentionally Left Blank

228
To humor the reader, I include a letter from a passenger to our CEO, Gordon
Bethune. Moral of the story - if you, as a crewmember, select an ABA which is not
paying attention to your emergency briefing, replace that ABA.

Gordon Bethune was an excellent CEO that came through the ranks as a
mechanic and a pilot. He understood how to motivate people and took the time to
recognize each employee when an event occurred. He had an open-door policy to
his own office where he would listen to any employee’s comments regardless of
their position in the company. He would also take immediate steps to correct
issues.

229
--- Continental B737 - Cleveland 1988-04-17
Overhead bin fire (report extract)
On final approach, a fire developed above the overhead luggage bins. The crew
declared an emergency, landed, turned off the runway expeditiously and
evacuated as smoke poured from the opened cabin doors.
A fluorescent light ballast burned and ignited insulation blankets and foam air-
conditioning duct insulation. The fire damaged wire bundles, burned through the
back of a stowage bin and ignited a carry-on bag inside the bin.

*****

--- FedEx 1406 - DC10 - Stewart 1996-09-05 - Main deck fire

https://reports.aviation-safety.net/1996/19960905-1_DC10_N68055.pdf
Note increased distance to Stewart as the descent is initiated to stabilize the
vertical path (away from the destination) before addressing the lateral path
(towards destination). See Emergency Descent Entry recommendation (M5).

Time Stamps are expressed in minutes since the beginning of the event as
detected by the crew.
00 CA “What the hell’s that?” (CVR)
04 CA Start of the emergency descent.
04 ATC Albany 11 o’clock, 55nm or Stewart 7 o’clock 25nm.
06 ATC Albany 11 o’clock, 45nm or Stewart 7 o’clock 40nm.
09 ATC Stewart 28nm.
10 F/E Aircraft depressurized.
18 Landing on runway 27 at Stewart.
Note time 04 at 25nm from Stewart and time 09 at 28nm. Five minutes after start
or descent to Stewart aircraft was 3 miles further (see M5 Descent Execution).

Description:
At FL330, smoke was detected in the upper deck by detector 9. Within a couple of
minutes, the smoke moved forward to detectors 8 and 7. As the aircraft started the
descent, smoke was detected only by detector 10. Note that smoke moves back
as the aircraft pitches nose-down.

An emergency descent was made, landing 14 minutes later. Flight control

difficulties were felt on final as the fire was damaging the main deck floor and
ceiling.

The aircraft was taxied onto a taxiway and stopped. Visibility in the cockpit
suddenly went to near zero as the cockpit filled with smoke. This is to be expected
as smoke rolls forward with aircraft deceleration. The crew removed the oxygen
masks and evacuated the plane.

230
Although the aircraft was depressurized ten minutes after the start of the event,
the Captain had trouble opening the side window because the airplane had
repressurized (due to electrical shorts and failures). The crew exited using the
cockpit escape rope.
The fire weakened the aft fuselage structure, causing the tail section to separate
shortly after landing.

*****

--- Interflug IL62 - Berlin 1972-08-14 - Bleed air leak

https://aviation-safety.net/database/record.php?id=19720814-0
Time Stamps are expressed in minutes since takeoff.
13 Crew reports elevator problems and requests return to the airport (ETA 26).
21 Crew requests fuel dumping.
24 Crew detects fire in the tail section, and emergency descent is initiated.
29 Mayday declared, stating pitch control problems. The tail section fails shortly
after.
Cause:
There was a bleed air leak in the rear cargo bay, previously reported several times.
The bleed air leak (approximately 570ºF) had caused the weakening of the
insulation material of wiring and flight controls.
A short-circuit occurred immediately after takeoff, and sparks caused a fire that
weakened the fuselage structure and caused the tail section to fail.

Observations (Capt. Vireilha):

The aircraft could have landed 26 minutes after takeoff (as it was controllable for
29 minutes), but the crew opted to dump fuel instead. In critical emergencies, do
not risk the safety of the aircraft by taking actions that may delay a controlled
arrival.

231
Controllability is one of the must-haves criteria. Typically, the must-haves become
an issue later rather than at the beginning of the event. Still, controllability
degradation is usually one of the first indications, especially in fires outside the
pressurized area.

*****

--- Pan Am 160 - B707 - Boston 1973-11-03 - Hazmat fire at FL310

https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR7416.pdf
In 1973, the Cockpit Voice Recorders only registered the last 30 minutes of flight.
It is uncertain when the smoke event began because the CVR segment starts
when a call to Pam Am Operations is already in progress, troubleshooting possible
smoke sources. The following is a selection of relevant statements of the CVR
transcript.

Time Stamps are expressed in minutes from the beginning of the CVR recording.
03 F/E is raising the cabin for cockpit smoke evacuation.
04 Divert to JFK is initiated (for in-house maintenance).
JFK is 400nm away; Montreal is 100nm away.
05 CA – “There is no smoke in the detectors, is there?” (confirmation bias?).
The visible cockpit smoke discussion has been going on for a while between
the crew and Pan Am operations coordinating return to JFK for company
convenience.
F/E – “Yes there is.” – CA – “There is?” (Denial? What would the visible
smoke in the cockpit indicate if there was no smoke in the detectors? Aircraft
would still be on fire, somewhere).
06 CA - “Smoke getting too thick.” (Now, with secondary indications present,
the crew acts).
08 Flight descends to 2,000 feet to burn more fuel and divert to Boston instead (if
concerned with landing weight why not dump fuel on the way to the airport
without increasing flight time?).
25 Opportunity to land at Pease Air Force Base is bypassed (45nm before
Boston).
27 (ATC asks if they wish to declare an emergency):
CA – “Negative on the emergency, and may we have 33L?” (Denial?)
(Winds 280 V 310/15 G25, - Runway 33L 10,000 ft – Runway 27 7,000 ft)
30 ATC – Do you want to extend the flight any further? (ATC questions why
this aircraft keeps flying instead of landing at Montreal or Pease AFB).
CA – “Negative, want to get on the ground ASAP.”
31 Electrical power is turned off as per electrical smoke checklist (resulting in loss
of yaw dampers, which as aircraft decelerated for approach caused Dutch roll
and loss of control. This low speed, low altitude characteristic was not well
known at the time). Electric Smoke Checklists were modified to reinstate some
electrical steps before descending below 2,000 feet, warning the risk of
reactivating the fire.

232
34 Captain’s window (L2) is open, and smoke is seen coming out.
36 Plane crashes 260 feet short of Boston’s runway 33L in a Dutch roll.

Observations (Capt. Vireilha):

The fire was initiated by an acid leak in the cargo hold, which gave origin to the
FAA “Dangerous goods notification to Captain” form (IATA NOTOC).

PA160 did not declare an emergency, and as controllers changed, they were not
aware there was an aircraft in distress (ATC can now declare a flight as an
emergency aircraft if the Captain does not do so).

PA160 bypassed two landing opportunities and survived a fire for more than 36
minutes before crashing (possibly longest flight while on fire).

This accident, like most, was avoidable had PA160 landed in Montreal while the
aircraft was in much better airworthiness condition. The execution of the Electric
Smoke Checklist, coupled with an error in its execution sealed the fate of the flight.
The F/E started the Electric Smoke Checklist without the Captain asking for it or
announcing it to the pilots.

*****

--- SAA 295 - B747 - Mauritius 1987-11-28 - Cargo fire

http://www.caa.co.za/Accidents%20and%20Incidents%20Reports/Final%20Repo
rt%20ZS-SAS.pdf
Main deck (cabin) cargo fire (6 pallets of batteries).
The smoke removal checklist brought smoke to the passenger cabin (despite
higher pressure in the passenger cabin), and an emergency descent to FL150 was

233
made. The aircraft was depressurized, and the cabin doors opened to evacuate
the smoke (recall stage 3 of the Mental Model).

This was a raging fire and too intense to fight. A partially used fire extinguisher was
found with melted drips on it. This indicates that the F/E using the extinguisher had
to drop it on the floor (to leave the compartment due to the extreme heat), and as
the fire continued, melted drips fell on it. As the airplane crashed into the water,
the melted drips solidified and stayed attached to the extinguisher. The aircraft
structure weakened, causing an in-flight breakup. Passengers’ watches stopped
at the same time, indicating high G impact forces.

Other usual indications of large fire were present, about 80 CB’s had popped out,
and there was a false engine fire warning.

234
Despite the intense fire, soot was not present on the lower three feet of side panels
of the cabin area (cleaner breathable air exists on the lower three feet of the cabin).
SAA 295 fire gave origin to the passenger/cargo firefighter requirements.

Observations (Capt. Vireilha):

This aircraft had a large fire, and the crew realized this early on. This was not a fire
the crew could extinguish or reasonably expect to self-extinguish.
A maximum effort emergency descent to sea level and a ditching presented the
best chance for survival.

*****

--- Saudia 163 - L-1011 - Jeddah 1980-08-19 - Aft cargo fire

https://aviation-safety.net/database/record.php?id=19800819-1
The following video accurately represents the actual events, word by word from
the CVR, an excellent job from the BBC.
CRM Video: https://www.youtube.com/watch?v=emq9EoIHCX8

Time Stamps are expressed in minutes since takeoff.

07 While climbing, aft cargo warnings indicate smoke.
12 Return to Riyadh is initiated (5 minutes to decide and 5+ minutes to backtrack
= more than 10 minutes lost due to return in denser air).
14 Smoke is found in the aft cabin.
17 Engine 2 throttle is stuck, and the engine is shut down. Note that center
engines issues are common during fuselage fires.
F/A (British female) asks Captain (Arab male) five times about evacuation; still,
she is ignored (culture problem and before CRM existed).
F/E told her to evacuate after being on the ground.
Later, Captain tells F/E not to evacuate.
F/E asserts, “yes, no need to evacuate, looking good.”
28 Aircraft lands in Riyadh. The crew continued to the end of the long runway
and into a taxiway with the fire trucks following.

235
31 2:45 minutes after landing, the plane stops, but no evacuation is initiated.
57 (29 minutes after landing) Firefighters opened door 2R. All 301 people on
board were already dead. About 3 minutes later, the interior was engulfed in
flames (flashover).
Observations (Capt. Vireilha):
- Landing with a fire on board, the plane should have come to a quick stop
on the runway and evacuate immediately.
- The NTSB recommends cargo fire detection for narrow-bodies, implemented by
the FAA only after the loss of Value Jet 592 fire, sixteen years later.
- The following common response can be found in many final accident reports: -
We see the problem, but it is an isolated incident, and the economic impact does
not justify acting at this time.

*****

--- Swissair 111 - MD11 - Halifax 1998-09-02 - Electric fire at FL330

https://en.wikipedia.org/wiki/Swissair_Flight_111
The event started 23 minutes before smoke being detected in the cockpit. It began
with a VHF 3 failure due to a smoldering fire of the IFE wiring/insulation in the
cockpit attic.

Time Stamps are expressed in minutes since the beginning of the event as
detected by the crew.
00 F/O detects odor.
01 CA sees smoke momentarily, but both odor and smoke disappear. This is
typical of a “flame front,” although pilots are most likely not aware of this
characteristic as this is not part of a crewmembers’ training.
02 F/A detects odor in the cockpit but affirms the cabin is clear.
03 Smoke reappears. Relying on smell and sight, pilots assess that the smoke is
related to the air conditioning and start the “Air Conditioning Smoke” checklist
despite no system indications directing it.
04 CA declares Pan Pan Pan (smoke comes from fire and is always a Mayday -
critical emergency). He requests “a convenient airport, perhaps Boston.” ATC
gives SW111 a right turn to Boston 300nm away.
05 ATC asks SW111 if they would prefer Halifax 66nm at 11 o’clock (“Active
Monitoring” would have precluded this lack of situational awareness). CA
accepts, and the course is changed to Halifax. The airplane starts a 2,400-fpm
descent at the currently indicated airspeed of 292 knots with speed brakes
retracted. The crew is not flying an emergency descent profile, no sense of
urgency yet.
07 Passing FL297 F/O pulls speed brakes and increases speed to 310 knots, but
CA advises F/O not to descend too fast (maximum speed should be 365
knots). CA also advises cabin they would be landing in 20 to 30 minutes (not
a realistic lifespan expectancy for an aircraft already dealing with smoke for
seven minutes).

236
08 As the aircraft passes FL250, ATC clears SR111 to 3,000 feet as the controller
felt the plane was too high. But pilots request an intermediate altitude of 8,000
feet “while the cabin is being prepared for landing.” (Have the pilots perceived
and believed what is happening, and have they transitioned and adapted to
the real environment? Or is their mindset in the world they wish for?).
09 The aircraft is 30nm from runway 06, descending at approximately 3,300 fpm
through FL210, at an airspeed of 320 KIAS. The pilots agree that a quicker
descent was warranted in case the smoke thickened.
11 Pilots mention fuel dumping to ATC. When conferring about this, the F/O asks
the Captain, “Should we forget about dumping and just land?” Given their
understanding of the situation, the Captain opts for fuel dumping, and the F/O
concurs. (This decision sealed the faith of the flight).
12 ATC gives SR111 a left turn towards the dump area and away from the airport.
This was when the aircraft was closest to the airport at 17nm, leveling off at
10,000 feet and 300 knots.
14 Autopilot disconnects. The F/O informs ATC that they are flying manually and
asks for a protected block of altitudes. ATC clears altitude block 12,000 to
5,000 feet. Captain declares an emergency and states they are starting to
dump fuel (continuation plan bias).
15 A series of electrical failures begin, but pilots continue to fly for another five
minutes.
20 Engine 2 fire indication (false, due to wiring fire). The fuel switch in the cockpit
is shut off.
21 By now, probably with none of the three artificial horizon displays working
anymore, pilots face a dark sea with no surface lights. SR111 struck the water
in a 20º nose-down and 110º right bank. Cockpit temperature was 1100ºF at
impact.

Observations (Capt. Vireilha):

Both pilots were MD11 instructors. The Captain was a check airman and line
instructor, and the F/O was a simulator instructor. Neither pilot had experienced
an actual in-flight emergency at any time during their flying career. The behavior

237
displayed (until a fire broke out in the cockpit) was typical of the simulated training
environment where there is no sense of urgency and their lives are not at risk.

Active Monitoring and an assertive attitude from the pilots leading them to a
maximum effort emergency descent would have allowed a landing in 13 to 15
minutes from the moment smoke was first detected. Even if electrical failures were
beginning to occur before landing, these would not have precluded a visual landing
on the preferred runway 06 as the aircraft was coming straight in, with no
maneuvering required.

Halifax weather was good, with night visibility of more than 6sm, wind 090/10,
scattered clouds at 3,000 feet and broken clouds at 8,000 feet.

For more information, see Transportation Safety Board of Canada Report

A98H0003 Appendix A page 299 and Appendix D pages 305 - 310.
https://www.tsb.gc.ca/eng/rapports-
reports/aviation/1998/a98h0003/a98h0003.html

*****

--- Swissair 551 - MD80 - Munich 1993-10-16

https://www.austrianwings.info/2013/10/swissair-551-rauch-im-
cockpit/
Dense smoke in the cockpit
Ten minutes after takeoff, dense smoke appears in the cockpit overhead panel
(from the emergency power switch). The crew reports minimal visibility and cannot
read checklists (instrument failures and radar vectored landing).
F/O used a checklist to move smoke away from Captain’s instruments. The
Captain could only see the IAS pointer at 4 o’clock, about 150 knots.
Note: - The Captain would not see the speed if he did not have a white needle
against a black background. Speed tape visualization is not adequate when
visibility is impaired due to smoke, aircraft vibration or heavy turbulence. If your
aircraft has another airspeed indicator with a pointer, plan to use that one instead.

Report (Investigation board):

The flight crew did not take timely or appropriate actions to eliminate smoke from
the cockpit. They did not depressurize the cabin, which prevented the opening of
the cockpit window. The pilots reported that they were too preoccupied with flying
and preparing to land the airplane to open the window.

Observations (Capt. Vireilha):

Time after time, investigators are critical of pilots for not executing procedures that
are not memory items when the pilots did not even have visibility to read checklists.

238
Furthermore, there is no training emphasis on depressurizing aircraft or opening
windows in smoke situations.

In general, pilots revert to their training during emergencies and for the most part,
they are doing what they have been trained for. This usually falls short of what is
needed to achieve the best results. However, it is the training that is deficient in
many areas, as indicated in this study.

*****

--- Togo 1 - B707 - Niamey 2000-09-21 - Cockpit electric fire

https://aviation-safety.net/database/record.php?id=20000921-0
200 km from the Niger capital, a fire broke out behind the cockpit bulkhead.
The Captain immediately made an emergency descent to 200 feet over the ground
and flew over the city with smoke billowing from the aircraft. An emergency belly
landing at higher than approach speed was carried out on the runway. In the
process, all four engines separated, and the plane was destroyed by fire.
There were no injuries. A short circuit caused the original fire.

Observations (Capt. Vireilha):

Perfect execution of a Controlled Arrival. From the beginning of the event, the
cabin pressure differential was reduced (through the emergency descent),
lessening the risk of an in-flight breakup.
The aircraft flew the remainder of the flight at a very low height, which would allow
for a quick crash-landing if any of the must-haves was lost.

*****

--- United B756 - HNL to LAX 2017

Unidentified continuous cockpit smoke
An emergency descent is initiated, as continuous cockpit smoke quickly depletes
crew oxygen in forced flow emergency use. As part of preparations for a ditching
at sea, when the F/O leans down to tie the cockpit door open he sees underneath

239
the glare shield the red glow of window R1 terminal block. R1 window heat is turned
off, smoke stops and aircraft climbs back to cruise altitude, diverting to SFO due
to insufficient fuel.

--- UPS 1307 - DC8 - Philadelphia 2006-02-08 - Cargo fire

https://aviation-safety.net/database/record.php?id=20060208-0
This Atlanta to Philadelphia flight is beginning their descent from FL330, 50nm SW
of Washington DC.

Time Stamps are expressed in minutes since the beginning of the event as
detected by the crew.
00 F/O detects wood-burning smell descending through FL310.
01 F/O states, “Smell is pretty strong now.” - For the next twenty minutes, while
descending to the destination, all three crewmembers discuss the different
types of smell from wood to cardboard to non-electrical.
21 Smoke detector detects cargo smoke.
22 CA now informs ATC that they have smoke on board, and requests to have
the equipment meet them, but no emergency is declared.
23 F/O states, “Smelling pretty good now.” - Smoke (hot air) goes to the highest
point in the cabin. DC8 aircraft do not have Leading Edge Slats, and they have
a nose-down attitude when on final approach. Flaps 35 had been selected,
increasing the pitch down attitude, sending smoke to the rear cabin.
25 Aircraft lands and spoilers deploy. Two seconds later, aircraft deceleration
brings heavy smoke into the cockpit, and a decision is made to stop on the
runway and evacuate.

During post-accident interviews, the Captain stated that he considered diverting to

another airport soon after the odor was first detected but chose to continue to PHL
because there was no evidence of a problem, such as the illumination of the cargo
smoke warning lights. The F/O stated that the odor did not appear to be a threat
because the F/E did not see any visible smoke; therefore, the F/O did not believe
there was any need to divert.

Observations (Capt. Vireilha):

When dealing with smoke, first find and control the source. If this cannot be
accomplished, declare an emergency, and follow the Smoke Mental Model. Never
wait for secondary indications.

Intentionally Left Blank

240
 UPS 1307 - DC8 - Philadelphia 2006-02-08

--- VARIG 820 - B707 - Paris 1973-07-11

Aft lavatory fire on approach
https://aviation-safety.net/database/record.php?id=19730711-0
I met the Captain of this flight (Gilberto A. Silva) during the renewal of our flight
physical in Rio de Janeiro on the 30th of September 1975. Capt. Gilberto (as he
was known) described some details mentioned here, which are not part of the
accident report.
During the approach, the cabin crew informed the cockpit that smoke was coming
from the aft lavatory. They reported having difficulty locating the source of the fire
(which made their firefighting actions ineffective).

Capt. Gilberto was on the right seat, giving training to Capt. Fuzimoto on the left
seat. As the cockpit door opened to allow six extra crewmembers to take refuge in
the cockpit, and as the aircraft pitched up to slow down for final approach, dense
smoke rolled through the forward cabin and into the cockpit. Capt. Gilberto felt the
oppressive heat from the black smoke on his neck and shoulders.

With a flying crew of four, there were ten people in the cockpit. An extra
crewmember without an oxygen mask pulled Capt. Gilberto’s oxygen mask off his
face for his use. The loss of interior visibility due to the fast smoke accumulation
made it impossible to read the instruments. Capt. Gilberto opened his cockpit
window (R2), and from the bottom half of this window, he saw an open field on his
right. In a desperate situation, the Captain decided to make a forced landing three
miles short of the runway, with gear and flaps down, in an onion field.

He crossed the flight controls and made a right slip, controlling the aircraft by the
sound of the engines and throttles relative position. He landed sideways, tearing
off all three landing gear and all four engines (5 minutes since initial smoke report).

241
Of the ten occupants in the cockpit, only the F/E died of impact trauma. He was
crushed against his F/E table by standing cockpit crewmembers.

At touchdown, the fire was confined to the area of the aft lavatories. One hundred
twenty-two occupants were poisoned by smoke in the main cabin. Only one
passenger survived, Ricardo Trajano. He was overwhelmed by smoke while
standing, but he started to breed cleaner air when he collapsed on the cabin floor.
See his video narrative (in Portuguese), describing what happened:
https://www.youtube.com/watch?v=pCajQCiXOZ4&feature=youtu.be&app=deskt
op

On 1979-01-30, Capt. Gilberto (VARIG 967 B707) disappeared 30 minutes after

taking off from Tokyo to Los Angeles. Presumably, the aircraft broke up in-flight
due to Mount Fuji’s turbulence, and floating debris was recovered from the sea
(similar in-flight breakup in the same area as BOAC 911 B707 1966-03-05).

Intentionally Left Blank

242
 MODULE 7 - ENGINE FAILURE / FIRE
PART 1 - JET TRANSPORT CATEGORY
--- Engine Fires
Although there are many different causes for engine failures, there are only two
types of engine fires: fuel-fires and friction-fires, also known as rub-fires.

Fuel-fires are caused by fuel leaks or when there is excess fuel directed to the
engine. This can be caused by a failure of a fuel distribution component in the
engine, like the burner can, nozzles, etc.

Rub-fires are caused by engine components rubbing against each other and
characteristically produce engine and airframe vibration.

The fuel not consumed by the engine ignites as it exits and causes a tailpipe fire
or tailpipe torching which, will not trigger a fire warning in the cockpit. A tailpipe fire
may be detected by the ground crew during engine start or by an aft cabin occupant
when the event occurs in flight on wing-mounted engines.

--- Engine components

Newer engine internal components and fan blades are typically made of titanium
alloys, which will ignite before softening (maximum service temperature of 1100°F
and typically operate around 1,000°F environments for several thousand hours).
This permits the engine to continue to run for a short period (even when it is
completely on fire) and generate a fire warning, allowing the crew to secure the
engine before an uncontained failure or engine separation occurs.
Although engines are designed to sustain fires for 15 minutes at 2,000°F, a fuel-
fire in flight can reach temperatures of 3,000°F.

--- Engine separation

The aircraft’s magnesium alloy engine pylons (fuse pins) are designed to burn
through in the event of an uncontrollable engine fire, allowing the complete engine
pod to drop off (in 90 seconds). This is intended to prevent fire damage to the
wing or flaps if extended.

As the engine separates it may destroy the shut-off capability for its respective fuel
and hydraulic system. This will result in the loss of one hydraulic system and
possibly a wing fire. To help prevent this, the engine fire handle needs to be
pulled within the first 90 seconds before the engine separates. This drop-off
pylon design does not apply to engines mounted on the vertical stabilizer or inside
the unpressurized fuselage of the aircraft (center engine, DC10, MD11, L1011,
B727, Tu154 or similar aircraft, and HS-121 Trident, one or both center engines).

243
--- Aeroflot Tu-154, Russia 1984-12-23
Center engine 2 has an uncontrollable fire two minutes after takeoff. As an internal-
mounted engine cannot separate from the aircraft, the fire penetrated the
empennage, and the aircraft control was lost.

Suspecting an engine problem

Examples of possible indications are:
- Slow engine start or slow to accelerate.
- Oil smell/fumes.
- A smell not normally associated with an engine (see Continental 64).
- A different noise or vibration (it can be more intense than expected).
- Uncommanded throttle movement.
- Sudden deceleration (it can be more severe than expected).
- Uncommanded change in flight path (it can be larger than expected).
- Non-normal engine indications.
- Static engine indications despite throttle movement.
- The electronic engine displays disappear from view.

However, electric odor and/or fumes from an engine bearing failure can mislead
the crew into thinking it is from an electric source. An electric smell from an engine
is more likely to occur when the engine is at high power, during takeoff and climb
when the engine seals are under higher pressure preventing the typical oil smell
from coming into the cabin (see Continental 64).

--- Fire Test

Whenever there is an event with a system with an inbuilt test capability,
always test assumptions by testing the system.
A similar statement is likely to be included in your manual in the Introduction,
Emergency or Non-normal sections.

244
A Fire Test needs to be performed anytime an engine issue is possible or
suspected and no fire warning was triggered (e.g., bird strike).
If the test triggers a fire warning followed by the warning stopping after the test
switch is released (normal rest), this confirms the system has integrity and fire is
not being detected now.

If one engine fire warning stays on after the test switch is released, this indicates
the fire triggered the alarm during the test period, and the engine fire procedure
should be accomplished.
If the fire warning fails to test on one engine, its detection system is
compromised. The engine fire procedure should be accomplished for the engine
with the failed fire warning.

Caution - Detection delay

A delay is likely in triggering a fire warning depending on the circumstances (cause,
aircraft speed and altitude). Engine fire detection may also be delayed by reverse
thrust usage or engine at idle thrust.

Caution - Detection monitoring fail

When the fire detection system is damaged, it is common for its detection
monitoring system to fail also. Consequently, do not assume the aircraft has
detection monitoring integrity simply because a message is not displayed (e.g.,
Det Fire Eng. or loop A or B fault or similar annunciation).

An Electronic Checklist (ECL) equipped aircraft needs to sense a fire before

directing the crew to the Engine Fire Checklist. If detection is failed, when the
engine parameters deteriorate, the crew will be prompted to the Engine Failure
Checklist.

The test prevents following the Engine Failure Checklist erroneously

when the Engine Fire Checklist should be followed instead.

--- In summary, test each assumption:

Before starting the Engine Failure Checklist, perform a fire test. If the test fails,
complete the Engine Fire Checklist.
During the execution of the Engine Fire/failure Checklist, if turning the A/T OFF,
or moving the throttle to idle, or moving the fuel control switch to OFF causes the
warning to go silent/out of view, perform a fire test.
After completing either checklist, if the warning is silent/out of view, perform a fire
test.

Suppose the fire warning goes silent/out of view after the throttle has been moved
back. In that case, it is either because of a reduction in engine overpressure or
because the fire detection system coincidentally was destroyed during throttle

245
movement. If a new fire test does not trigger a fire warning, the system has lost
integrity, and the fire may still be ongoing (and only a visual inspection can verify
it).
The engine failure and engine fire checklists are similar down to the step of Fuel
Control Switch to the Cutoff position. Then, the engine fire checklist has two more
steps: to pull the Eng. Fire Switch and discharge the extinguisher(s).

If the fire warning goes silent/out of view after the fire handle has been pulled or
the fire extinguishers have been discharged, perform a fire test. As above, if the
system does not test, fire may still be ongoing, or the engine may have separated
from the airplane.

If the Fire Handle was pulled after engine separation (or not pulled at all),
turning OFF the respective Fuel Pumps will help prevent feeding a possible wing-
fire. This action is not usually in the checklist, and it will prevent cross-feed
capability. Fuel imbalance is a lesser concern than a possible wing fire. In any
possible fire situation (or uncontained failure), even if it is assumed to be under
control, the priority is to land ASAP. This will also diminish a fuel imbalance
situation.

--- Autothrottle (A/T) OFF Considerations

During an engine failure/fire where engine components rub against each other,
friction causes engine deceleration, resulting in loss of thrust. A/T links all engines
to achieve the selected A/T mode. If A/T is controlling speed, more fuel is sent to
the decelerating engine to maintain aircraft speed. However, friction (resistance)
may not allow the engine to accelerate and use that fuel. This excess fuel will ignite
as it exits the exhaust, causing a tailpipe fire (typically with no fire warning,
particularly if at high speed). When the airplane decelerates, and less air is going
through the engine, the fire will move forward and closer to the fire detection loops,
possibly triggering a fire alarm.

When turning the A/T OFF during the “Engine Failure/Fire Checklist and before
retarding the throttle of the engine in question, there needs to be a pause to
evaluate if the elimination of the A/T thrust control resolved the issue. If not, any
reduction in vibration from A/T disconnection could be credited to retarding the
throttle, even if it was the wrong throttle, which could lead to misidentification and
shutting down the wrong engine (British Midland 92).

--- Fire Extinguishing and Speed Considerations

If an engine fire bottle is discharged while the aircraft is flying fast, it may not
extinguish the fire as efficiently as if the aircraft is at minimum practical speed. If
the fire persists after the first discharge, waiting until the airplane has slowed to
minimum practical speed before discharging the second bottle increases the
chances of extinguishing the fire. If maintaining altitude, a plane at idle thrust will

246
decelerate twice as fast with full speed brakes deployed than without speed
brakes.
If the fire continues after the second bottle discharge, increase thrust on the good
engine(s) to MCT and descend to quickly reach maximum speed. This increase in
airflow through the engine will move the fire from inside the engine to behind the
engine tailpipe. The faster the speed, the further away from the tailpipe the fire will
move back. The fire will self-extinguish once enough separation exists between
the outside fire and the ignition source.

As the fire moves back and away from the fire detectors in the engine, it is possible
that the fire warning in the cockpit goes out prematurely. Have a pilot in the aft
cabin monitor the engine tailpipe to confirm when the fire is completely out (no fire
behind the engine).
This procedure was used by a Continental DC10 that had a right-side engine fire
while at high altitude cruise at about 15W on the North Atlantic Track system. There
was no fire warning on the flight deck. The cabin crew (alerted by a passenger)
called the cockpit to advise of visible flames on the tailpipe. After discharging both
fire extinguishers, the fire was still ongoing. The procedure above was then
successfully executed by descending to increase speed while abandoning the
track to return to London.

CO B737 IAH Engine 1 Ground Fire AA B767

LAX 2006-06-02

--- Fire Induced Flap Asymmetry

If unable to extinguish an engine/wing fire before landing, consider landing with a
clean wing or slats only.
If using flaps, extending them to increase the wing area horizontally without
descending into the fire path will prevent flaps from being consumed, causing flap
asymmetry and loss of control. Consider extending flaps only as needed to reach
a landing speed below the tire speed limit and stopping distance.

247
This may be the first or second flap selection gate, usually no more than 10°. Know
the relationship, for your aircraft, between the engine exhaust and the trailing edge
flaps when extended at different positions.
Although flaps do not extend directly into the engine thrust, their proximity to an
engine’s fire torch is sufficient to cause flap failure and asymmetry (note fire
deflection on the COB737 IAH photo above).

The same flap concerns exist during takeoff, although using less flaps. However,
due to performance needs some takeoffs are performed in the 15° to 20° range
making the flaps more vulnerable to fire exposure. Even on airplanes with longer
engine pylons (tailpipe further away from the wing), an uncontained engine
failure/fire can puncture the wing creating a fuel leak. If a fire develops, it can create
a flap asymmetry.

--- Sun Way 4412 - IL76 - Karachi 2010-11-28

https://aviation-safety.net/database/record.php?id=20101128-0
An uncontained engine 4 failure and fire during takeoff burns right outboard flap
causing an uncontrollable right bank and crash. The engine had a history of a slow
start.
In either case (takeoff or landing), the flaps need to be retracted as soon as
possible (at or above 400ft AGL) when dealing with an engine or wing fire.
If flaps are destroyed on one side, an uncontrollable roll will result. In general,
aircraft become uncontrollable with more than 10° asymmetry. Accordingly, flap
selection gates are usually designed within 10° to help prevent uncontrollable
asymmetry should asymmetry protection fail.

--- Pacific Southwest Airlines 182 - B727 - San Diego 1978-09-25

https://aviation-safety.net/database/record.php?id=19780925-0
Ruptured lower right wing and right outboard flap damage from a mid-air collision
with a Cessna 172 propeller cause a wing fire and flap asymmetry resulting in an
uncontrollable right bank.

--- Simulator-training V1 Power Loss Note

It is a standard practice that the engine fire checklist can be called for at or above
400 feet AGL and that engine failure checklist can be called for at Captain’s
discretion, starting at either initial flap retraction altitude or when flaps are up or at
the desired position (engine-out approach flap if returning for a landing).
With a power loss at MTOW V1, the aircraft will climb and accelerate slowly to the
desired altitude and flap configuration. This timeframe can far exceed the 90
seconds an engine is designed to stay attached to its pylon during an uncontained
fire. Mind that the engine could be on fire and producing normal thrust well before
the fire alarm or the crew became aware (especially if a fuel-fire). A fire not
addressed can become uncontained.

248
A simulated V1 power loss without a fire test (starting at 400 feet) is negative
training because the assumption of not being on fire is not tested.

In the interest of procedures development, examples of wording with a sense of

urgency are suggested here for these conditions:
Engine Failure – When a power loss occurs, or an engine problem is suspected,
a fire test will be performed asap at or above 400 feet AGL. If the test fails, the
engine fire checklist will be started without delay.
Engine Fire – When an engine fire occurs, the engine fire checklist will be started
asap at 400 feet AGL.

--- Engine Failure/Fire on the Ground see M3P3

--- Engine Failure/Fire in Flight

An engine flameout that passes a fire test and is not the cause of airframe vibration
is less threatening than if other indications are present (in jets with two or more
engines). The checklist should include considerations for an engine restart.

However, an engine failure can be accompanied by an explosion, a fire

warning, engine vibration, or other threatening indications. This is a critical
emergency, and these events can become catastrophic.

An internal wing or fuselage fire (not detectable) can cause an in-flight breakup in
a few minutes. The priority is to secure the engine (the first 5 items of the engine
failure checklist) and land at the first opportunity. Landing ASAP is safer than
extending the flight to engage in complex checklists while the plane is at risk.
An immediate return for landing is not practiced in simulator training (see “The
impossible turn” M4P3). Pilots may feel rushed and may fear missing something
or making a mistake and being criticized. Consequently, they often bypass the
opportunity to land and extend the flight to complete checklists, sometimes
resulting in losing all on board.

What do we need to land an airplane?

After securing the failed engine, we need to extend the flaps and the landing gear,
arm the spoilers and the autobrake (covered in the checklist). Although we do this
every time we land, it is recommended to visually check these items, cueing them
for instance with the 1,000-foot call on daily operations.
We need to know the recommended flap setting for the engine out configuration if
there is no time to complete checklists or if an engine fails during the approach for
landing.
We also need to start the APU and cancel the GPWS mode 4A - Flaps (intuitive).
As flaps are selected, the appropriate flight speed will display in the speed tape (if
there is no time to get landing data).

249
And we should not be concerned with a possible overweight landing (see
“Overweight Landing” M13P1).
Above, are the primary items needed for a safe landing. For this study, we will
acknowledge other checklist items as secondary.
The risks of extending the flight (instead of landing sooner) need to be evaluated
against the benefits those checklists can bring to the landing.
Besides the engine failure itself, hydraulic, electrical and pneumatic systems may
be affected, and checklists provide information on the possible operational
interference of the secondary items. On modern aircraft, most secondary actions
are automated or duplicated on the approach/landing checklist. These checklists
are, therefore, mainly informative.
We should expect the aircraft to have slightly reduced flight controllability. On the
ground, we should expect that the spoilers and autobrakes may not function.
These are failures we are prepared to override manually on routine operations.
Steering may be hard to operate or become inoperative, in which case, after the
ARFF inspection on the runway, the airplane may need towing. But none of these
factors should preclude a safe landing, sooner rather than later.

The safest course of action is to fly the shortest path to the closest runway and
complete the checklists we can during that time. After securing the engine and
completing the landing checklist items, a safe landing can be made despite
perhaps not having had enough time to read all the secondary checklists (see
Transair 810).
If on final, the airplane is not ready for landing, we can always make one or more
360° turns (see Continental 208 M7P2, Houston and Continental 84 Rome M7P2).
Being near the runway’s threshold at low speed is safer than being 20 miles away.
Once we land and stop on the runway (M4P2), the only concern is whether to
evacuate the airplane or not (M3P2).

--- LOT Polish Airline 5055 - IL-62 - Warsaw, Poland 1987-05-09

https://aviation-safety.net/database/record.php?id=19870509-0
Note: - The IL-62 is a four-engine jet with the engines mounted on the tail, two
engines paired on each side.
Climbing through FL280, engine 2 has an uncontained failure, and debris
punctured the aft fuselage causing a cabin decompression, an aft cargo fire, loss
of elevator control, and engine 1 also had to be shut down. The crew did not get
any fire warnings; however, this was a critical emergency. The plane should be
landed at the first opportunity (airport, open field or ditching). A “controlled arrival”
should be made before a loss of control occurs.
The plane was near Modlin airport, and the pilots could have attempted a
controlled arrival there sooner; however, they returned to Warsaw further away
because of better rescue equipment there.
Despite the extensive damage, the pilots could fly the plane for 31 minutes until
the cargo fire burned through the remaining flight controls, causing total loss of
control. Fatalities: 183, all on board.

250
--- United 328 - B777 - Denver 2021-02-20
ATC Video: https://www.youtube.com/watch?v=G7-zh7Sebr8&t=15s
Time is compressed on the video, and Time Stamps do not correspond to actual
flight times:
1:00 - Fire bell (indicates critical emergency).
1:55 - ATC offers a straight-in approach to runway 7 (closest runway from the
airplane). Pilots inform “…not yet, need to run some checklists.”

2:30 - ATC requests the number of souls on board, and the pilot responds, “…we’ll
get the souls in just a minute.” - This information should be known and readily
available (see Eastern 853 and American 383).
When on base leg for the north runways, ATC asks if they want a left turn into the
airport (second opportunity for landing). The pilot informs “We need to still run a
few checklists…”
2:50 - ATC informs them they will keep giving left turns around the aerodrome until
the pilots are ready for landing on any runway they want. This comes at the cost
of keeping the ARFF stationary until the pilots commit to one runway. Denver (DIA)
is a very large airport with runway thresholds miles apart.

3:10 - Pilots did not decide which runway would be better for their situation and
asked ATC, “…what runway are you planning.”
Considering the wind was from the north at 9 knots, and the failed engine was on
the right side, landing on runway 7 would have been an excellent first choice to
keep a possible fire away from the fuselage. As a second choice, landing to the
north and turning the airplane into the wind before stopping on the runway would
also keep a possible fire away from the fuselage (M4P2).
The flight landed on runway 26, which required the longest flight path, being the
furthest away from the place where the event started 30 miles to the West of the
airport (over Broomfield). Landing to the West, the North wind would have pushed
a possible right engine or wing fire towards the fuselage.

4:30 - ATC directs pilots to:

“…plan a full stop on the runway until ARFF inspect the aircraft.”
This was excellent guidance from ATC. This is precisely the safest procedure pilots
should do however, often, pilots clear the runway before confirming the safety of
the aircraft after a rejected takeoff or a landing emergency.

Observations (Capt. Vireilha):

- Denver ATC demonstrated superior airmanship, offering two landing suggestions
and planning to keep the flight close to a runway should the emergency deteriorate.
This Denver ATC team was well prepared to deal with emergencies, anticipating
the needs and hinting at the safest resolutions.

251
- The pilots performed as trained. Considering this was a critical emergency, the
structural integrity was unknown. Landing ASAP on the nearest runway would
have been the safest course of action.

- Pan Am 160 only had cabin smoke. They did not have an explosion, fire and
vibration, just as UAL 328 did, so they had little reason to be concerned about
structural integrity. However, they also bypassed two landing opportunities, only to
lose control of the aircraft while on final.
Again, the issue is the lack of training in risk assessment and distinguishing critical
emergencies from others (see M1P4).

PART 2 - INCIDENT EVENTS

Study cases are alphabetized by airline and flight number.

--- BOAC 712 - B707 - London 1968-04-08

https://aviation-safety.net/database/record.php?id=19680408-0
BA 712 is a key accident that caused changes in design and procedure.

Note the complexity as the situation develops. Besides the normal cockpit crew,
there is a Check Captain on the jump seat behind the Captain.

Engine 2 failure (explosion) and fire (with no fire warning) occurs shortly after
landing gear retraction during takeoff. Captain calls for the Engine Failure checklist
(Engine Fire checklist was separate. This was the accident that merged both
checklists).

F/E retards the throttle, which causes the landing gear warning horn to sound.
F/O erroneously presses the fire bell cancel button, just as perhaps the fire bell
would be starting to ring.
Then F/E reaches for the fire handle but does not pull as he recalls the Captain
had called for the Engine Failure checklist and there is no fire warning light or bell.
Check Captain looks out the window and reports a large fire. Captain now calls for
the Engine Fire checklist.
Taking off on 27L airplane makes a short circuit to the left to land on 5R.

- The crew believes the F/E has pulled the fire handle and discharged the fire
bottles, as they recalled seeing his hand moved towards the handle. It was hard
to differentiate the fire handle position as it would pull straight out only 1/8 of an
inch. From this accident came the design change to twist the fire handle for easier
visual confirmation.

252
- Bottle discharged lights are on, although they were never discharged into the
engine. The fire bottles were ruptured by the fire, releasing the agent and creating
a low-pressure signal to the lights (discharged).

- Engine fire light is not on.

The engine separated 90 seconds after the fire started (but a fire test was not
performed).

Because the fire handle was not pulled, hydraulics to the engine was not shut off,
resulting in the loss of one hydraulic system (less controllability).
Fuel pumps not turned off (not on the checklist) pushed 225 liters/minute
overboard creating a massive wing fire several times the length of the aircraft.

Caution - Reverser usage when an engine or wing is on fire contributes to

spreading the fire to the passenger cabin.

BOAC 712 engine 2 on fire (bottom left corner of photo) and wing fire.

*****

--- British Midland 92 - B737 - E Midland 1989-01-08

https://reports.aviation-safety.net/1989/19890108-0_B734_G-OBME.pdf
The left engine had a blade failure, with resulting friction and airframe vibration.
Flames were coming out the backside of the engine, easily visible at night to the
cabin crew (see M1p3). The cockpit crew had difficulty in interpreting the engine’s
indications due to being different than the other models operated by British Midland
and for which they had not received training. The airframe vibration also makes it
very difficult to read gages (see Continental DC9 IAH).

After turning the A/T OFF and reducing the throttle for the right engine (without
pausing*) the vibration stopped, which convinced the pilots they had correctly
identified the failing engine as the right-side engine, which was then mistakenly
shut down. The left engine, on fire, failed on short final and the aircraft crashed
short of the runway, killing 47 of the 126 people on board.
* - see Autothrottle (A/T) OFF Considerations M7P1.

253
See video link at time 27:35 - Fan blade fracture and A/T direct link with accident
Video: https://www.youtube.com/watch?v=cv4EwJCwLOc

*****

--- Continental 64 - B757 - Newark/Lisbon 1999-10-31

(Based on the CIR. Capt. Vireilha was the PIC).
As power was applied for takeoff, an unusual odor was noticed in the cockpit with
no abnormal indications. Both pilots associated it with air conditioning odor.
At about 130 knots (before V1) several advisory yellow lights blinked momentarily.
I glanced at them but could only read the top one, TAT probe.
At 1,000 feet, when thrust was reduced to climb power, a vibration and a harmonic
sound were sensed (like an air conditioning duct problem), further convincing the
pilots the problem could be air conditioning related. Aircraft leveled off temporarily
at 10,000 ft for ATC.
When a clearance for FL 230 was received and power increased for the climb, a
strong electric smell was sensed by both pilots. At that point, I knew I was not going
to cross the Atlantic in this airplane and wanted to return for landing. My F/O knew
I had a few emergencies lately and he thought I was overreacting. He thought the
problem was with a tripped CB and wanted to find it (not that he would reset it
anyway).

I called the cabin chief and she reported smoke in the mid-galley area. At that time
both pilots realized that smoke was coming into the cockpit from the 3L & 3R
window vents. Now my F/O also wanted to get off the plane.

An emergency was declared and a fast descent to Newark was initiated from
14,000 feet over NY. We were cleared to 2,000 feet and for the ILS 22L. Expecting
interior visibility to deteriorate, the aircraft was prepared for an autoland. Maximum
speed (barber pole) was maintained until reaching 2,000 feet.
Because our takeoff was at maximum weight and we had only been airborne for a
few minutes we were substantially above the maximum landing weight and the
airplane was slow to decelerate when we reached 2,000 feet. We were flying
straight to the FAF and I commented on making an “S” turn to bleed speed, but the
F/O advised we may not have visibility to reengage for an autoland again. I agreed
and despite selecting landing gear and flaps early we arrived at the FAF with 185
knots and flaps 25. Because landing flaps 30 were never achieved, and the aircraft
was above the max weight and speed for an autoland, I was not sure if the aircraft
would autoland.

Although it was a clear night and we had requested runway lights to be at the
highest intensity, we could not see the runway until 1500 ft AGL due to smoke
glare in the cockpit. (DIM light feature goes automatically to BRIGHT when
plane senses smoke, despite the switch being in DIM position).

254
During approach and final, I held the throttles back at ground idle as at flight idle
the aircraft wanted to accelerate past 185 knots. We did not need any more energy.

Aircraft performed a perfect autoland near MTOW at 185 knots and with flaps 25.
We used max autobrake and we stopped and stayed on the runway, having used
8,000 of the 10,000 feet available. Cockpit windows were opened to evacuate
smoke.
Firefighters inspected aircraft and reported smoke from the right engine and a
brake temperature of 585º.
The right engine had suffered an engine bearing failure (cause of the smoke with
electric odor) but was still operating with no abnormal indications. We never
noticed the failure, as the engines were kept at idle from top of descent to the gate.

*****

--- Continental 208 - DC10 - Houston 1998-12-25

(Based on the CIR. Capt. Vireilha was the PIC).
During takeoff at 500 feet and while making a turn, we received an engine 1 fire
warning. I was hand-flying, and my right hand was next to the Master Caution light,
so I push it in to silence the alarm. Then I called for the Engine Fire Checklist, but
my F/O questioned “what fire?” We all heard the bell, but he could not see a fire
light and he was justifiably unsure of what the problem was.

Note no “Fire” light on the F/O right side

The F/O side does not have a Fire light so when I canceled the warning, my Fire
light and both Master Caution lights went out. The overhead light on the fire handle
would still be on. However, because the sun was setting and it was hitting all three

255
handles, the dim light was not visible. I rolled wings level for a moment to block the
sunlight so both crewmembers could see the Fire light on the fire handle and the
checklist was started.

As the throttle was pulled back, the fire light went out. I asked the F/E to perform
a fire test, which indicated detection system failure (loops A & B). The engine was
shut down and the Engine Fire checklist continued.
As we discharged Fire bottles 1 & 2, their respective discharge light did not come
on. I thought they were damaged by an uncontained engine failure, as they are
located over the engine and behind the leading-edge slats.

Not having fire detection, we were not able to confirm if the fire was out, and we
asked the cabin crew to perform a visual inspection of the engine.
And not having fire protection, we decided to make an immediate return to the
airport while dumping fuel. As we selected Slats (first position of flaps on the DC10)
the Disagree light came on, and the slats and flaps did not move. This reinforced
my belief we had damage from an uncontained engine failure.

We wanted to land straight away but because the slats were locked in the retracted
position, it would take about ten minutes to extend the trailing edge flaps
electrically. We were too close to the airport and did not have that time.

Without slats or flaps our Minimum Maneuvering speed was 286 knots. However,
on final if we limit the bank angle to 15°, we would be able to fly and land at our
second-speed bug of 220 knots. This would be 27 knots above our maximum tire
speed of 193 knots. If the tires would blow, we were likely to lose directional control
and go off the side of the runway. The DC10/MD11 had a history of the main
landing gear not shearing-off as expected and creating a wing-fire instead. We had
already experienced that in our airline (Continental 603 - DC10 - LAX). The wing
could also separate on landing and roll the fuselage upside-down.

I decided to land. The risks of extending the flight not knowing the status of the fire
and the damage to the aircraft were greater than the risks of landing. Whatever
would happen on the ground would be less than losing a wing in-flight.

On final approach I asked the tower to look at us with the binoculars and they did
not see fire or smoke. At that time, we also heard from the cabin crew confirming
the same.

After these two independent reports, I decided to go-around to extend the flaps
electrically so we could reduce the landing speed. I informed the tower that we
needed to stay in place; we wanted to be in a position from which we could land
immediately, in case the fire would re-occur. We stayed on final at 1500 feet,
making 360° turns (clear day conditions).

256
There was no procedure for our situation - one engine inoperative and slats locked
in the retracted position. We discussed how much trailing edge flaps to extend to
have a reasonable landing speed and go-around capability with one engine out.
We agreed to extend flaps to about half-way which would give us 160 knots for
landing (the DC10 can select flaps one degree at a time - dial-a-flap). This was an
educated guess with which all three of us were comfortable.
We landed and stayed on the runway until the firefighters inspected the aircraft.

Observations (Capt. Vireilha):

- The engine fire was a fuel-fire caused by a cracked burner can. Both detection
loops were destroyed by the fire. The fire stopped when the fuel was cutoff. There
was no severe damage to the engine or the airplane.
- Both extinguishers were mistakenly loaded with smaller squibs (for B737 bottles)
and although they both fired the squibs, these were insufficiently powerful to
perforate the bottle’s membrane.
- The Flaps had a history of malfunctions.
- The DC10 fleet was being phased out and inadequate maintenance implementing
cost-saving measures caused the engine fire, the erroneous squib installation of
the extinguisher bottles, and the flap malfunction.

Considerations on dumping fuel:

At the time of this incident, there was no awareness that dumping fuel below 6,000
feet would cause ground damage. It was assumed fuel would vaporize and not
reach the ground. We dumped 4,000 pounds of fuel at 4,000 feet unfortunately
over a residential area. One child had fuel residue on his clothing and his bicycle
paint was damaged. One dog was poisoned and died. Several homes had roofs,
plants and swimming pools damaged.

*****

--- TransMeridian 3751 - Canadair CL44 - Hong Kong 1977.09.02

https://www.gov.uk/aaib-reports/8-1980-canadair-cl44-g-atzh-2-september-1977
Time Stamps are expressed in minutes since the beginning of the event.
00 Engine 4 flames out at liftoff from runway 13. The tower advises of dark smoke
trailing from the engine. The crew reports the engine has been shut down.
There was good weather and no air traffic.
02 The crew does not have a fire warning (fire test?) and informs ATC they wish
to continue climb to 4,000 feet over the ocean to dump fuel for ten minutes.
05 The crew calls ATC stating they have an engine fire and now they want to return
for an immediate landing without dumping. ATC gives then vectors to runway
31.
07 The crew reports “flames seem to be extinguished, just smoke coming out of
the engine.”
08 “The engine’s come off, we are going in, the engine’s...” (transmission ends).

257
Report (Investigation board):
Engine fuel-fire weakened wing structure, causing it to fail.
The crew carried out simulator-perfect flying and execution of emergency
procedures.
Observations (Capt. Vireilha):
- Although the engine failure and fire did not trigger the fire warning in the cockpit,
a fire test could have been performed. The controller informed the crew that he
could see dark smoke trailing from the engine. This did not seem to give a sense
of urgency to the crew. Could it be that we do not listen to what we are not
expecting to hear? (Expectation bias).
- The airplane was only two minutes away from landing had the crew turned around
when the controller informed of the plane trailing dark smoke. Could landing above
maximum landing weight concerns and perhaps not having time to complete
checklists, motivated the crew to commit to keep flying?

PART 3 - LIGHT TWIN-ENGINE AIRCRAFT

Engine Failure at Takeoff
Piston-engine aircraft with a MTOW of 12,500 lbs. (5,670 kgs) or less
(The term light twin generally refers to piston-engine planes weighing less than
12,500 lbs. There is no official definition of this term as per the FAA.)

Critical procedure
Although this book is intended for transport category operations, readers may also
operate light twin-engine aircraft and for this reason this critical information is
included.

In the certification process of light multi-engine aircraft, there is no requirement for

the airplane to climb or even maintain altitude with an engine inoperative while in
the takeoff configuration. Concerning takeoff or landing configuration performance,
the light twin-engine aircraft is, in concept, merely a single-engine aircraft with its
power divided into two units. Most light twins will not maintain altitude with one
engine inoperative in cruise conditions, especially when considering aircraft
conditions (weight) and environmental factors. Some aircraft may maintain altitude
in particular situations at lighter weights, which will be quickly established once an
engine is lost.
With an engine inoperative (with its propeller feathered) and the other engine at
full power, one can expect a descent rate which may allow time to search for a
safer area for a controlled arrival*.
* See definition in Terminology.

When I went to work for Flight Safety in Lakeland, Florida (1983) as a pilot
instructor on the Piper Navajo aircraft, the factory engine-out philosophy during
takeoff was very different than what was (and still is) commonly practiced at

258
flight training centers. At the time, Flight Safety was the official training center
for Beechcraft, Cessna and Piper. New aircraft owners would receive factory pilot
training provided by Flight Safety.

--- Engine Failure During Takeoff

The following is a brief description of the factory-recommended procedure for this
type of light twins (simulator trained).

1 - Adjust the engine levers’ friction lock* before placing your hand on the throttles
to initiate the takeoff. Once your hand is on the throttles, do not remove it until
needed to retract the landing gear. Even at the beginning of the takeoff, an
engine failure will quickly and sharply pull the aircraft off the runway if throttles are
not pulled back.
* This prevents the throttles from moving back during the climb after you have
moved your hand to retract the landing gear (if flying with no monitoring pilot).

2 - Once airborne, climb with the landing gear down and keep your hand on
the throttles to anticipate a possible engine failure. If an engine fails,
immediately lower the nose to maintain speed while adjusting power and
land on the remaining runway or any suitable area (other runways, taxiways or
any open area).

3 - However, if no engine has failed and when the possibility for a safe landing on
the airport area is no longer available, then retract the gear. Your hand should then
move to the propeller controls. Place the index finger on one pitch control and
the middle finger on the other pitch control. If now one engine fails, the
related wing will dip; feather that propeller with the respective finger. This is
a much faster procedure than the traditional “push the rudder to control and
identify, then throttle back to confirm and then feather the propeller” method. The
wing dipping is what identifies which engine lost power. Still, use the rudder to
maintain control but not to identify.

As an engine fails, aircraft manuals state that one must identify which engine has
failed before proceeding, although they may not specify how. The old US Army Air
Force “dead foot, dead engine”* procedure was adopted and is still common
practice; however, it does not work as well on light twins. This procedure worked
well on WWII twin-engine aircraft because they had powerful engines to allow for
high ordnance payloads.
* The “dead foot, dead engine” procedure still works well in cruise conditions, as
the plane has a higher speed.

However, the “dead foot, dead engine” procedure takes too long to execute during
takeoff on light twins with lower power to weight ratio, precious airspeed is lost,
and flightpath angle decreases.

259
Propeller-driven aircraft have immediate wing lift asymmetry when one engine
fails. An increasing angle of attack reduces the efficiency of both the rudder and
the elevator (blanking). Combined with the drag from the opposite unfeathered
propeller, the plane typically rolls at an average of 25-30° per second.
Most engine failures at takeoff result in the aircraft crashing upside-down near the
runway. In many cases, much runway was still available for landing (or safe airport
area for a controlled arrival).

--- Simulator Training

When I was conducting simulator training on this procedure, most pilots were
reluctant to feather as a first action as they were afraid of feathering the wrong
engine. As part of the training, we would intentionally start to feather the good
engine to see how easy it was to recognize the error and quickly push the propeller
pitch forward again. The engine would not have time to feather, and we could then
feather the correct engine without excessive loss of speed.
If you operate this light twins, I recommend you seek this type of training from a
professional simulator training center.

--- Pre-departure briefing

Before a flight, it is recommended to review the airport diagram and open areas in
the direction of your intended departure. Have a plan of where to land at the airport
after becoming airborne or crash-land if unable to fly. Review this plan on your pre-
departure briefing.

Note: - See M4P3 Takeoff’s Second Segment - The Impossible Turn (FAA).

--- The Prime Minister’s Crash

On December 4, 1980, a Cessna 421 crashed immediately after taking off from
runway 35 at Portela Airport, Lisbon, Portugal. All occupants of the aircraft, five
passengers and two pilots, were killed. The Cessna 421 was privately used to
transport five Portuguese government officials, including the Prime Minister, for the
presidential election campaign. Their political party asked me to conduct an
independent investigation of the cause of the accident. This is a summary of that
report.

Although several contributing factors led to an engine failure, the outcome would
be different if the pilot knew the procedures described above.

Summary of Findings and Conclusions:

The flight was delayed, and the flight crew opted for an intersection takeoff, leaving
a few thousand feet of runway behind. With a shorter runway available, the flight
crew did not perform the recommended normal takeoff profile with zero flaps and
decided to use 15 degrees of flaps instead.

260
The left engine failed immediately after gear retraction at liftoff due to fuel
starvation. The pilot flew straight ahead into rising terrain at night until impacting
houses.
Had the pilot used the recommended procedure, he would have opted to use the
full runway length and the normal flaps up takeoff profile. He would have kept the
landing gear down and adjust power on the right engine to fly a descending right
turn to land on runway 03. Even if he could not line up with the runway, he would
be on lower, flat, and illuminated airport terrain, where a safe landing could have
been made.

Common Practice Takeoff - What Not To Do

Video: Timestamp 7:15 through 8:30
Video: https://www.youtube.com/watch?v=lbCDl34YLM8
This video is one of many that can be found on YouTube, and it demonstrates the
takeoff practices generally followed on light twins.
- Notice that any items that can be performed before entering the runway should
be completed before passing the double yellow lines. There should be no
unnecessary procedures; they are distractions.

- Clear traffic on final approach and verify your clearance matches the numbers on
the runway. When aligned, verbalize that the aircraft heading matches the
numbers on the runway. When cleared for takeoff, turn landing lights on.

- Do not remove your hand from the throttles during the takeoff first and
second segments. Observe points 1 & 2 of the “Engine Failure During Takeoff”
procedure described previously.

- Consider observing the silent cockpit concept used at major airlines. Monitor
engines parameters but make specific mental calls (silently) and be prepared to
act on anomalies. The typical “all is good” call is too general and tends to miss
failures. Remember that the priority is to keep your eyes on the runway centerline*.
Any engine or tire failure or dragging brakes will be noticed in a deviation from the
centerline.
* See Continental 1 - B747.

- Verifying and calling “positive rate” is a good procedure to confirm climb and
initiate “gear up” on aircraft certified to climb with an engine failure. This is not the
case on light twins, and the landing gear should remain extended as described
in points 2 & 3 of the “Engine Failure During Takeoff.”

- An engine failure after the “gear up” action will motivate the pilot to fly a plane
that will settle down on the runway. Therefore, the gear should be left in the down
position. Pilots that attempt to climb tend to stall and roll inverted, with much of the
runway still ahead.

261
 MODULE 8 - FAILURE OF ALL ENGINES
It Is Possible to Fly Without Engines
But Not Without Knowledge and Skill
Wilbur Wright

PART 1 - CAUSES & EFFECTS

• Bird strikes.
• Ice/water ingestion.
• Wing-ice ingestion.
• Fuel management.
• Ash cloud.
• Unusual failures.

What causes all engines to flameout also usually precludes their restart.
Exceptions are fuel mismanagement (which, if reversed in time, may allow the
engine to restart) and ash cloud induced loss (where engines may restart in denser
air and higher speeds).

Note: - Besides the common causes addressed in this module, there are unique
factors that can also cause the loss of all engines such as system design,
maintenance, etc., e.g.:

--- Paninternational 112 - BAC111 - Hamburg 1971-09-06

https://aviation-safety.net/database/record.php?id=19710906-0
Aircraft suffered a loss of both engines after takeoff at 300 feet. For better engine
performance during takeoff, water was injected into the fuel-air mixture. This cools
the combustion chambers of the engine and allows for higher compression ratios.
The canisters were mistakenly filled with kerosene instead of water.

--- Titan Airways - A321 - London 2020-02-26

https://aviation-safety.net/wikibase/233878
The aircraft lost about 50% power on both engines after takeoff due to incorrect
biocide treatment on its fuel system but was able to make an immediate return.

262
 BIRD STRIKES
Bird strikes can penetrate the cockpit and incapacitate the pilots, destroy cockpit
areas of flight controls or throttle quadrants, making it challenging to fly the plane.
They can cause engine failures, fire, fuel leaks, etc. They can also damage the
radar, flaps, landing gear or other airplane systems.

Aircraft with pulsating or strobe lights have fewer bird strikes (USAF report).
Airborne radar and landing lights also help in driving birds away.

Bird-Ingestion Certification Tests [14 CFR 33.76(c)] account for the number of
birds ingested and their weight, turbine core and fan impacts, size of the engine
and its fan-speed. If the engine damage is within the certification standards, the
engine should not suffer an uncontained failure and should continue to operate at
reduced thrust for a short time. For example, an engine may run at 75% thrust for
15 minutes and then at 50% thrust for a few more minutes before a complete failure
occurs (depending on the conditions).
However, if the engine damage exceeds the certification standards, an immediate
power deterioration may occur or even an uncontained failure.
Note that 50% fan-speed is likely not enough to sustain flight. If the damage is
suspected to both engines, an immediate landing is recommended within the first
minutes per that engine’s certification (see Southwest 350 below).

--- Southwest 350 - B737 - Kansas City 2022-02-24

https://avherald.com/h?article=4f52e8fc&opt=0
During liftoff, aircraft suffered several bird strikes. Pilots were aware of bird impacts
on the plane’s nose and felt vibration which they associated with nose damage.
They decided to continue climbing to 9,000 feet to be above the icing conditions

263
and communicate with their company. When they realized they had engine
damage, they returned for landing and asked for emergency equipment to be on
standby.
Observations (Capt. Vireilha):
With known damage to the airplane and confirmed vibration shortly after liftoff, the
pilots should have suspected the possibility of damage to both engines. The safest
course of action was an immediate return for landing. An engine fire system test
would also be recommended (see Fire Test M7P1).

--- Ethiopian 604 - B737- Ethiopia 1988-09-15

https://en.wikipedia.org/wiki/Ethiopian_Airlines_Flight_604
Both engines ingested birds at liftoff, resulting in engine temperature rise and
flameout. A wheels-up crash-landing followed, and the aircraft caught fire.

--- Falcon 20 - Naples FL 1976-11-12

https://aviation-safety.net/database/record.php?id=19761112-2
Crashed when both engines lost power on takeoff following a bird strike (seagulls).

--- Hawker Siddeley HS 125 - Dunsfold UK 1975-11-20

https://aviation-safety.net/database/record.php?id=19751120-1
Both engines ingested birds during takeoff. Not having seen or heard the impacts,
the Captain thought the engines were surging. He reduced power and then
selected full throttle. No increase in power occurred. Aircraft overran the runway
and broke up.

--- Lear Jet 24 - Atlanta 1973-02-26

https://aviation-safety.net/database/record.php?id=19730226-0
Loss of both engines during takeoff following a bird strike. Aircraft crashed into
buildings.

--- ONA 32 - DC10 - JFK 1975-11-12

https://aviation-safety.net/database/record.php?id=19751112-1
This accident was reviewed on M4 as a rejected takeoff due to bird strikes.

--- Sabena B737 - Brussels 1978-04-04

https://aviation-safety.net/database/record.php?id=19780404-1
Both engines lost power during rotation following a bird strike. Aircraft crashed into
the ILS housing and was destroyed by fire.

--- US Airways 1549 - A320 - LGA 2009-01-15

https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf
After takeoff, at approximately 3,000 feet, both engines ingested Canadian geese,
resulting in a dual flameout causing the aircraft to ditch.

264
--- Ural Airlines 6178 - A321 - Russia 2020-08-15
https://aviation-safety.net/database/record.php?id=20190815-0
After takeoff, at approximately 750 feet, both engines ingested seagulls, resulting
in a dual power loss causing a gear-up forced landing in a cornfield.

--- If a bird strike appears unavoidable (in-flight), maneuver to avoid the center of
the flock and increase thrust to 100% N1 fan speed to reduce the damage to
the engine core. The engine is more likely to continue working should a bird
be ingested.

Higher speed blades slice birds into smaller pieces, slinging them outward through
the engine bypass and protecting the engine core. Yet, higher kinetic energy from
the impact will cause more damage to the fan blades (N1 Low Pressure
Compressor). The spinner shape is also designed to deflect foreign objects
outward to the bypass duct.

Lower speed blades slice birds into larger pieces, which go into the engine core,
causing more damage. See US Airways 1549 accident report pages 16 and 80.
https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf

ICE/WATER INGESTION
--- Use the radar to avoid and not to penetrate weather systems.
If descending in heavy rain, verify ignition and engine anti-ice on, autothrottle off
and maintain recommended thrust (do not cycle to idle). It may be necessary to
use speed brakes (and sometimes the landing gear down) to maintain turbulence
speed and a reasonable vertical speed during a power-on descent.

--- Aeroflot 7841 - TU-134 - St. Pete, Russia 1985-02-01

https://aviation-safety.net/database/record.php?id=19850201-0
Dual engine flameout after takeoff due to wing-ice ingestion.

--- Airborne Express DC9 - Philadelphia 1985-02-05

https://aviation-safety.net/database/record.php?id=19850205-1
Dual compressor stall due to wing-ice ingestion on takeoff.

--- Austrian 111 - Fokker 70 - Munich 2004-01-05

https://aviation-safety.net/database/record.php?id=20040105-0
During descent in heavy rain, despite the use of spoilers with thrust procedure
(above), idle power periods caused damage to bonded joints of ice protection
panels, blocking airflow and causing loss of thrust on both engines. Aircraft made
an off-field landing 4nm from the airport.

265
--- Garuda 421 - B737 - Indonesia 2002-01-16
https://aviation-safety.net/database/record.php?id=20020116-0
Both engines flamed out in heavy rain while descending through FL180 at idle
power. The crew carried out three unsuccessful attempts to restart the engines
and one unsuccessful attempt to start the APU, followed by a ditching. Clean wing
approach and ditching at 170 knots as pilots believed they had no flaps. Although
the flap gage had lost power, the flaps would extend from windmilling engines
had they been selected early enough.

--- Southern 242 - DC-9 - New Hope GA 1977-04-04

https://aviation-safety.net/database/record.php?id=19770404-1
Total loss of thrust from both engines while penetrating an area of thunderstorms.
Factors: - Captain's reliance on the radar to penetrate the weather system instead
of circumnavigating it. - Radar range being reduced as aircraft approached cells.
Eventually, at the smaller range of 20nm, the crew penetrated the center of a cell
believing, this was a clear area. (NTSB-AAR-78-3 recommendation not to use
the 20nm radar range when near cells).

--- TACA 110 - B737 - New Orleans 1988-05-24

https://aviation-safety.net/database/record.php?id=19880524-0
Both engines flamed out in heavy rain while descending through 16,500ft at flight
idle power. The crew landed on a grass strip next to a levee.
The APU was started at 10,600ft. Both engines were restarted, but neither would
accelerate to idle; advancing the thrust levers increased the EGT beyond limits (#2
overtemp). Pilots reported they shut down the engines to avoid a catastrophic
failure*.
Two months later (1988-07-26), another TACA B737 suffered an engine flameout
while descending through heavy precipitation at flight idle. The co-pilot warned the
Captain, who continued the idle descent until a flameout occurred.
* - Observations (Capt. Vireilha): Exceeding an EGT limitation could damage the
engines. However, in a life-threatening emergency, one should not be
concerned with engine temperature limitations.
Air Florida 90 would have survived if the pilots firewalled the engines. However,
their erroneous EPR’s indicated they were at full power and pilots are not trained
to exceed parameters.

WING-ICE (CLEAR ICE) INGESTION

--- SAS 751 - MD82 - Stockholm 1991-12-27
https://aviation-safety.net/database/record.php?id=19911227-0
Dual engine failure due to surging caused by wing-ice ingestion.
Note: - Engine failures related to wing-ice ingestion occur when the wings flex
upwards during rotation for liftoff and break the clear ice that had formed over the

266
wing while on the ground. This ice is then ingested by the tail-mounted engines,
causing them to fail. Wind strips are usually installed over the wings to help identify
clear ice during preflight, however, if there is no wind, the strips will be motionless,
requiring a tactile inspection.

--- Pre-flight Precautions

- Slats extended allows inspection and de-icing of the wing leading edge behind
the slats.
- Wind strips visual or tactile inspection.
- If parts of the wing not in contact with warmer fuel (from recent refueling) indicate
icing, the horizontal stabilizer top surface, needs to be inspected by maintenance
or de-iced as it is impossible to view from the pilot’s pre-flight walkaround. The
horizontal stabilizer top surface is colder than the wing and is impossible to view
from the pilot’s pre-flight walkaround. (Transwede - Caravelle - Stockholm 1987-
01-06).

Intentionally Left Blank

267
 FUEL MANAGEMENT
The following flights started with adequate fuel for the intended trip, but conditions
changed during the flight. Other fuel-related and fuel freezing/water icing engine
failures are discussed in M12 - Fuel Freezing and Water Icing.

--- ALM 980 - DC9 - St. Martin 1970-05-02

https://aviation-safety.net/database/record.php?id=19700502-0
The weather en route causes diversion from the intended destination of St. Martin
to the alternate of San Juan, followed by a re-route to St. Martin as the weather
had improved. ALM 980 flew one missed NDB approach at St. Martin, followed by
two missed visual approaches (360 degree turns with gear down). Then, it diverted
from St. Martin to St. Thomas with 850 pounds of fuel, changing alternate later to
St. Croix, but while en route, it ran out of fuel and ditched. The Captain reported
that the cockpit PA system was inoperative, and he was unable to warn crew and
passengers of imminent impact, resulting in 23 fatalities.

Probable cause: “…fuel exhaustion from continued, unsuccessful attempts to

land at St. Maarten until insufficient fuel remained to reach an alternate airport. A
contributing factor was the reduced visibility in the approach zone because of rain
showers, a condition not reported to the flight by the St. Martin tower.”

--- Hapag-Lloyd 3378 - Airbus 310 - Vienna 2000-07-12

https://aviation-safety.net/database/record.php?id=20000712-0
This plane departed Crete to Hannover. The right landing gear did not retract, and
the flight diverted to Munich. During the flight, the estimated arrival fuel at Munich
decreased on the FMS. The crew then decided to divert to Vienna instead.
Both engines run out of fuel 12nm short of the runway, at 4,000 feet altitude. The
crew was able to restart one engine for a short time, managing to reach the airport.

268
The aircraft crash-landed in the grass some 500m from the runway 34 threshold.
(See M3P3 photo 25A - Slide Deployment Failures).

--- Air Transat 236 - Airbus 330 - Azores 2001-08-24

https://aviation-safety.net/database/record.php?id=20010824-1
At FL390, when Fuel ADV and fuel imbalance were noted on the Fuel ECAM page,
the crew carries out the fuel imbalance procedure from memory.
At 06:13, at 135 miles from Lajes, the right engine flamed out.
At 06:26, when the aircraft was about 85nm from Lajes at an altitude of about
FL345, the left engine flamed out.
At 06:39, the aircraft was at 13,000 feet and 8 miles from the airport. An engines-
out visual approach was carried out, and the plane landed on runway 33.
Improper engine replacement caused a fuel leak. The crew exercised inadequate
fuel consumption monitoring and management. Outstanding job landing the
airplane.

--- Indian Airlines 440 - A300 - India 1993-11-15

During a weather-related missed approach, a flap-lock occurred, and flaps
remained extended. Diverting to the scheduled alternate, but not the closest
airport, the flight ran out of fuel and made an off-field crash-landing.

--- What flight circumstances can trigger a slat/flap lockout?

• Exceeding wing G limitation with slats/flaps not retracted.
• Abrupt pitch-down-input when leveling off from a noise abatement takeoff.
• Turbulence with flaps not in the UP position (departure, approach and go-
around).
• Improper Flap lever reversal.

--- Aeroflot 6709 - TU-154 - Baku, Azerbaijan 1978-05-19

https://aviation-safety.net/database/record.php?id=19780519-2
Fuel system management at cruise leads to triple flameout and crash.

--- Air Canada 143 - B767 - Gimli, Canada 1983-07-23

https://aviation-safety.net/database/record.php?id=19830723-0
Inoperative fuel gages and confusion converting measured fuel in liters (11,430)
to pounds (x 1.77) and to kilos (x 0.8) causes dual flameout at FL350. Aircraft
glided and crash-landed on a closed runway.
--- Avianca 52 - B707 - NY 1990-01-25
https://aviation-safety.net/database/record.php?id=19900125-0
Prolonged holding patterns due to weather, and the inability of the crew to
communicate their critical fuel status, led this flight to fuel exhaustion and
subsequent crash.

269
The Captain did not speak English and did not understand that the F/O was not
relaying his requests for an immediate landing. F/O simply requested priority
handling without ever declaring an emergency.

--- Delta N103DA - Los Angeles 1987-06-30

https://www.latimes.com/archives/la-xpm-1987-07-03-me-1083-story.html
Both engines were shut down, climbing through 1700 feet. The Captain
inadvertently shut off the fuel instead of resetting the EECs during a
troubleshooting checklist. The engines were restarted at 600 feet over the Pacific
Ocean.

--- Ethiopian 961 - B767 - Comoros Islands 1996-11-23

https://en.wikipedia.org/wiki/Ethiopian_Airlines_Flight_961
https://aviation-safety.net/database/record.php?id=19961123-0
Ditching due to fuel exhaustion caused by hijacking.

--- Grand Aire Express 179 - Falcon 20 - Del Rio TX 2003-04-08

https://aviation-safety.net/database/record.php?id=20030408-0
The first approach was missed due to traffic, but the pilots had not declared a low
fuel emergency to ATC. During the second approach, aircraft ran out of fuel and
ditched in the Mississippi River.
Remarkably this company had lost another Falcon 20 five hours earlier on their
second IFR approach.
https://aviation-safety.net/database/record.php?id=20030408-1

--- LAB B727 - Trinidad Bolivia 2008-02-01

https://aviation-safety.net/database/record.php?id=20080201-0
Bad weather at the destination forced the crew to divert to Trinidad. Aircraft
crashed short of the airport due to fuel exhaustion.

--- Metro Cargo IL76 - Iran 1991-05-24

https://aviation-safety.net/database/record.php?id=19910524-0
A forced landing due to fuel exhaustion was made after three missed approaches.

--- United 173 - DC8 - Portland OR 1978-12-28

https://aviation-safety.net/database/record.php?id=19781228-1
A landing gear “down unsafe” indication causes the flight to circle for about an
hour. After running out of fuel, a forced landing was carried out in a wooded,
populated area.
--- United B767 Denver - N609UA - 1983-08-19
During descent at idle from FL410, as power was added at FL295, the left engine
surged and exceeded maximum EGT. Eighteen seconds later, the right engine
surged and exceeded its maximum EGT. The left and right engines were shut

270
down at FL200 and FL177, respectively. They were successfully restarted at about
FL150. Contaminated fuel nozzles caused the dual-engine flameout.
Coincidentally, the same aircraft had a repeat event from a different source (1986-
03-31):
After takeoff from SFO and while climbing over the water through 3,000 feet, both
engines shut down. The F/O was able to restart both engines and return to the
airport for an uneventful landing.
Cause: - Captain’s inadvertent deactivation of both fuel shutoffs due to physical
impairment (hypoglycemia).

--- LaMia 2933 - Avro 146 - Colombia 2016-11-28

https://aviation-safety.net/database/record.php?id=20161128-0
This 4-engine jet from the Bolivian airline LaMia ran out of fuel 8 miles from the
runway, and it forced another fuel emergency aircraft below him to turn away from
the airport to prevent a mid-air collision on its way down. The plane crashed, killing
71 of the 77 onboard (Chapecoense football squad). This trip was longer than the
aircraft’s range capability. The Captain was the airline owner and had flown this
leg three times before, always landing very low on fuel, as the fuel agents in
Colombia noticed. The flight was cleared for a straight-in approach; this time, it
was not because of the other fuel emergency aircraft.

271
--- VARIG 254 - B737 - Maraba, Brasil 1989-09-03
https://aviation-safety.net/database/record.php?id=19890903-0
Maraba to Belem course is 027°. A new computerized flight plan used a four-digit
representation of the magnetic bearing, with the last digit being a tenth of a degree
without any decimal separator. A course of ‘027.0’ was presented as ‘0270’.
During this recent format change, the Captain had been on vacation and inserted
the 270 radial on the HSI. The F/O copies this error on his HSI, and both pilots fly
the wrong course, giving origin to confusion and becoming lost until fuel
exhaustion.

Label for the colored arrows:

Green = intended course 027.
Yellow = actual initial course flown 270. - Crew was distracted by listening to a
soccer game. Passenger questioned F/A about the sun setting in front of the
airplane instead of on the aircraft’s left side.
Orange = Information was passed on to the pilots, which initially reversed course,
however, they then decided they had flown North of Belem and needed to return
by flying South (red).

272
 ASH CLOUD
Note: - See Ash Cloud in M13 - Non-normal Operations.

--- British Airways 9 - B747 - Jakarta 1982-06-24

https://aviation-safety.net/database/record.php?id=19820624-0
Cruising at FL370, the aircraft entered a cloud of volcanic dust. The crew noticed
St. Elmo's fire on the windshields, and smoke and dust were present in the cabin.
All four engines failed. The crew managed to restart engine no. 4 at FL130 and
restarted the other engines in succession. Because engine no. 2 continually
surged, a 3-engine emergency landing was carried out at Jakarta.

Photo of St. Elmo's fire on the windshields. This can also be observed emanating
away from the radome as a blue flame or around the engine nacelle.

--- KLM 867 - B747 - Anchorage 1989-12-15

https://aviation-safety.net/database/record.php?id=19891215-1
At FL250, the aircraft flew into a normal-looking cloud, which turned out to be a
volcanic ash cloud. Power was added to climb out of the cloud. About 10-15
seconds later, all four engines failed, and the standby electrical system failed. The
crew was able to restart engines 1 and 2 while descending through FL130, and the
remaining two engines were relit at FL110 but only at speeds higher than the
recommended in the start envelope. The aircraft landed safely at Anchorage,
substantially damaged by the in-flight blasting by volcanic ash. The windshields
were damaged, as were internal aircraft systems, avionics and electronics.

273
 UNUSUAL FAILURES
Turbulence
A turbulence encounter with high-altitude ice crystals is likely if the aircraft is within
30nm of thunderstorms on the downwind side. Deviate as necessary to maintain
a minimum distance of 30nm from cells. Previously recommended 20nm lateral
separation from cells has proven insufficient separation from ice crystals and
lightning strikes on EEC-equipped aircraft.
In preparation for this possible encounter, keep engines stabilized by turning on
the ignition and engine anti-ice protection.*
* See M11 - External Sensors.

Lightning Strikes Effects

A direct lightning strike in an engine may lead to an EEC being burnt, with
subsequent irreversible engine auto-shutdown.
Do not overfly cells, as the engines become the closest aircraft components and
the most likely to suffer a direct lightning strike. The 5,000 feet overfly separation
recommendation was in manuals before engines were controlled by EEC’s. New
data suggests this is no longer adequate, however, there is no safe overfly
recommendation. The best practice is not to fly directly over convective cells.

Fuel Pump Failures

If dispatched with a single electrical fuel pump (one inoperative as per MEL), the
engine-driven fuel pump may not be sufficient to supply high altitude demand, and
the engine may flameout or lose thrust should the remaining pump also fail.

Aircraft Pitch Upsets

The aircraft pitch may change beyond normal flight parameters, usually due to
losing control because of severe turbulence, icing or stall. This can cause an
engine to flameout, stall and stop rotating (a combination of the angle of attack and
insufficient airflow to the engine). Engines that suddenly flameout in this manner,
especially at high altitude and high power, experience severe thermal changes that
may result in clearance losses between the rotating and stationary components.
This causes them to rub or bind, leading to turbine core lock, which will prevent a
restart.

--- Northwest Airlink 3701 - CL-600 - Jefferson City 2004-10-14

https://reports.aviation-safety.net/2004/20041014-1_CRJ2_N8396A.pdf
The NWA 3701 pilots demonstrated unprofessionalism by lurching the aircraft
around. Their unawareness created a critical situation by climbing to the maximum
operational altitude of FL410 at slow IAS and in vertical speed mode (many
airplanes have stalled this way).

274
The aircraft manual should state a minimum airspeed (IAS/Mach) for climbing to
high altitude and a minimum airspeed to keep the engine cores rotating (in the
limitations or normal operations sections).

--- BirgenAir 301 - B757 - Puerto Plata 1996-02-06

Shortly after takeoff, the airplane lost the left engine due to an extreme pitch-up
(reviewed in Module 10 - External Sensors Failures).

Fuel Contamination and Fuel Freezing

(Discussed in Module 11 - Fuel Freezing and Water Icing).

--- Transair 810 - B737 Honolulu 2021-07-02

https://aviation-safety.net/database/record.php?id=20210702-0
Video: https://www.youtube.com/watch?v=B3fpQcRSnFE
Note: - Please read the narrative before watching the video.
Flight lost engine one after taking off from runway 8R. However, it was able to
climb to 2,400 feet. At video time stamp 1:45, when cleared to turn to the airport
for a visual approach, the pilot asks for delayed vectors to run checklists. As the
plane flies away from the airport, engine 2 starts to overheat, and the plane loses
altitude. Pilots now request a return to the airport but aircraft ditches at sea before
being able to land.

- Observations (Capt. Vireilha).

- The flight could have landed on runway 4 (or 8) had they turned to the airport
when the opportunity was available. If they wished to extend the flight, they could
make a 360º turn on final, close to the safety of the runway.
(See M7 P1 - “What do we need to land an airplane”).

Clear and precise communication can simplify procedures and save o lot of time.
- Notice how not declaring an emergency does not raise ATC alertness.
- Notice the confusion that is generated and how many times the same questions
and statements are repeated.
- The first radio call from the plane could have been: Mayday, mayday, mayday,
Rhoades 810 needs immediate return for landing, engine failure, two souls
on board, X amount of fuel,* no hazmat.
* Note that fuel should be reported in weight, not endurance and Rhoades is
Transair callsign.
Fuel information is passed to the fire department so they know how much fire
extinguishing agent they may need. Fuel measured in flight time available is of little
value to the firefighters, two hours of fuel on a B737 is a lot less fuel than two hours
on a B747. Pilots must know how many souls are on board before leaving the gate
(see Captain White’s rule M3 P3). And fuel quantity is a direct read. ATC will
always want SOB, fuel and hazmat.

275
- When the pilots realized they could not maintain altitude The next radio call could
have been: - Rhoades 810 is losing the second engine, we may have to ditch,
need vectors to closest runway, any airport.

PART 2 - HIGH & LOW ALTITUDE SCENARIOS

High altitude – An “All Engines Fail” scenario allows time for checklists.
Low altitude – Due to time limitations, “Controlled Arrival” procedures need to be
accomplished from memory. Although this need is easily understood, pilots are not
trained in the procedures and maneuvering requirements of a forced landing with
all engines inoperative.

In the 2005 NASA report, “The Challenge of Aviation Emergency and Abnormal
Situations,” this need is acknowledged. The report states, “some situations may
be so dire and time-critical or may unfold so quickly that all energy and attention
must be given to controlling and landing the airplane, with few resources to spare
for even consulting a checklist.”
Link to NASA TM 2005-213462:
https://ntrs.nasa.gov/api/citations/20060023295/downloads/20060023295.pdf

Note for both high and low altitude scenarios:

The observations in this Part and in M9 were collected from accident reports and
simulator recreations. They provide an overview of what can be anticipated.
Compare these considerations and characteristics to those in your manuals.
Data shows that when all engines fail, most cannot be restarted. The exceptions
are flameouts due to a disruption in the fuel supply system (not fuel starvation),
flying into an ash cloud or unintentional shut down. These recoveries necessitated
altitude and speed.

NOTES ON HIGH ALTITUDE

Training guidance on “All Engines Fail” focuses on high-altitude for which sufficient
time and altitude exists for the flight crew to prepare the airplane and its occupants.
However, these factors need to be emphasized:

- QRH - First or “Immediate Actions” address restart. The top of an engine start
envelope is in the range of FL240/250 (FL280/300 for high bypass turbines).
Simulator training usually starts at these altitudes, and at least one engine starts.
Regardless of relying on airspeed,* bleed air or electric starter for an inflight engine
restart, the RPM must be high enough for continued operation.
* (and low altitude dense air if engine blades are contaminated with volcanic ash).

276
However, airliners typically fly at altitudes above the engines’ restart flight
envelope, and before the engines are likely to start, the crew will be dealing with
other factors.

- Expect simultaneous loss of:

Engine thrust, electrical, pressurization and hydraulic systems.

- Pressurization
Expect the cabin to climb at 1,500 to 2,000 ft/min (initially until electrics are
restored) as outflow valves may not fully close due to electrical power loss and
cabin leaks (consider early manual deployment of oxygen masks).
Outflow valves modulate their aperture according to the cycling of the air
conditioning flow. The valve(s) may stop towards the open or closed position when
the failure occurs, determining the rate of cabin air loss.

- Some considerations:
Max effort descent: - Expect >6,000 ft/min vertical speed.
APU start - altitude capability on some planes.
Engine start flight envelope - altitude and speed considerations?

Intentionally Left Blank

277
- Fast descent to <FL280 is needed due to human physical factors
During an all-engine loss and depending on altitude, preventing “the bends” is the
determining factor for a high-speed descent. This is true in any rapid
decompression at high altitudes to avoid crew immobilization (despite
supplemental oxygen). It’s imperative to prevent cabin altitude from climbing above
FL270 or bring it below FL280 as fast as possible.
Prioritize this over the airspeed range for inflight start prompted in EICAS.
Notice max FL and speed range on the image below:

- Below FL280 reevaluate speed

Consider the terrain and IAS needs for engine restart. Ash contaminated engines
need higher than published speeds and lower altitude (denser air).
The best glide speed is clean configuration, Minimum Maneuvering (top bug). For
normal descent speeds, expect about 3 miles per 1,000 feet of altitude loss. Some
wing designs will fly 2.5 miles per 1,000 ft.

278
- Electrical
Expect loss of all electrical power (initially), except for the battery (on most planes).
Radio transmissions will deplete the battery fast, transmit sparingly but OK to
receive.
Does your aircraft have an unpowered IRS time limit? This would be another
reason to expedite descent to an altitude where electrics may be recovered.

- APU
APU start attempts are not recommended if outside of the start envelope as they
carry a risk of aircraft battery depletion and standby power loss. Even if the APU
has a dedicated battery, APU will not start if the battery is depleted. APU would
be unavailable if engines failed due to fuel starvation.

- Hydraulics
Depending on the airplane type, hydraulics may be limited to what the windmilling
engines provide (e.g., if N2 is above ~ 5% on a CFM56 engine, about 180 KIAS
minimum) or to the APU or RAT capabilities.

Caution - Although the in-flight start envelope recommends a maximum altitude

and minimum speed for relighting, there is no information (to the pilots) on what
aircraft speed that engine may stall.

LOW ALTITUDE CONSIDERATIONS

1 - After losing all engines at low altitude, it is essential to initiate the restart
immediately while the engines have high rotation. Starting the APU provides
an electrical backup that may become necessary to help restart the engines.

Be prepared to execute the memory items to restart your engines. This can be
accomplished in the first few seconds followed by flying the recommended speed
to relight the engines. They may take a couple of minutes to restart. If you don’t
have enough altitude to wait, concentrate on flying the flight path.
Engine computers do not have the Artificial Intelligence necessary to inform the
crew that an engine condition will preclude the start, and time can be wasted on
checklists. History is not indicative of successful engine restarts at low altitude
unless engines failed due to fuel mismanagement (see Delta N103DA and United
N609UA, M8P1).

2 - Failed engines change the idle thrust glide ratio that pilots are familiar
with, making uncertain the accuracy of the progress to a runway or a limited
landing area. If the aircraft is high on the approach, it may not be possible to
correct it due to reduced flight control capabilities. S-maneuvers or cross-controls
may not be viable (or desired).

279
3 - When pilots learn to fly, they receive training on selecting a good area for a
forced landing. Yet, unless they are seaplane rated, they have no training on how
to read the wind effect on a body of water and how to best fly the approach for a
ditching.
Most major airports worldwide (75.8%)* have bodies of water near them, and these
are better emergency landing areas than forests or populated areas. For this
reason, all pilots should be trained in ditching, and all airliners should be
overwater equipped.
* Transport Water Impact and Ditching Performance, DOT/ FAA/AR 95/54
http://www.tc.faa.gov/its/worldpac/techrpt/ar95-54.pdf

4 - After the loss of all engines, an aircraft needs to be flown as the glider it
became:
- Altitude permitting, it needs to fly at best glide speed initially to reach a
clear area to crash-land or ditch.
- Then, for the final approach, it needs to transition to higher-than-normal
speed (to compensate for the lack of thrust) to be able to control the plane
through the touchdown.
Although this is trained for in basic training (student pilot), it is only practiced
routinely by glider pilots.

I hold ratings on seaplanes and gliders, and I recognize the benefit of this
experience (besides being a lot of fun). I highly recommend you seek training on
both, even if you do not wish to apply for the ratings.

--- Reading the Seas

Airline manuals have adequate but brief guidance on reading the sea and wind
(extracts from seaplane manuals). There is extensive experience in landing large
seaplanes, and some were larger than today’s narrow-body jets. These seaplane
manuals are the best source for a water landing (and ditching knowledge).

The following is a brief on the basics of ditching, such as may be contained in

airline manuals. It is included here for the benefit of those who may not have this
information.

- When initially selecting a ditching area from altitude, look for calmer water. It is
found closer to the upwind side of a body of water (where the wind reaches the
water immediately after passing overland). Relative to large transport aircraft, most
lakes or rivers may not produce a problematic wave height even on the downwind
side in considerable winds. Generally, a max wave height is estimated by
calculating 10% of the hull length.
- Do not stretch a glide to avoid rough water (short high-frequency waves).
Overreaching for calm water can lead to a loss of control. Maintain a high-energy
flight path to allow for a correct touchdown attitude.

280
- Recognize surface wind intensity and orientation and land directly into it. For
example, wind perpendicular to waves, parallel wind streaks if present (>8 knots),
or white caps (>10-12 knots). Select an area with the fewest whitecaps.
- However, if there are waves, it is dangerous to land into the wind without regard
to swell systems. Touchdown should be made parallel to the largest swell system,
crabbing into the wind as required until the touchdown. If a smaller secondary swell
system is present, attempt to touchdown on the backside of the secondary swell
while remaining parallel to the larger swell system. Do not touch down into the face
of a wave.

--- Preparing the cabin for a Ditching (from low altitude)

A ditching PA should differentiate from the standard “Brace for impact” of a crash
landing, so the cabin crew and passengers become aware and retrieve the life
jackets. Despite the ditching in the Hudson of US Airways 1549, a “Prepare for
Water Landing” is still not on many airlines’ checklists. This may lead to a repeat
of the US Airways events when the Captain did not advise the cabin they would be
ditching, and the passengers did not retrieve their life vests.

The Captain should make a “Prepare for water landing” announcement as soon
as he decides to ditch. The cabin crew should then instruct passengers to retrieve
their life vests. - “Put on your life vests now. Do not inflate until you are
outside the aircraft.” It takes about 15 seconds to retrieve a life jacket and 80
seconds to put it on correctly. This is unlikely to happen once an evacuation has
started. Passengers unable to retrieve a life jacket promptly usually abandon the
idea and grab a seat cushion, whether it is a floatation device or not.

After the cabin crew instructs the passengers to retrieve their life vests, a “brace”
command should follow. However, it is unrealistic to expect a pilot on a two-person
crew to be making this announcement 30 seconds before impact, as some
manuals suggest. At this time, pilots should be concentrating on skillful pilotage to
reduce impact forces by managing aircraft attitude and energy. The “brace”
announcement needs to be made sooner and by the cabin crew.

Plan early to close all bleed switches and outflow valves (Ditch Switch on some
aircraft). Aim for ditching in shallow water to provide a short distance to the safety
of land. The airplane may rest on the bottom, and a portion of the cabin may stay
above water. A ditching may also happen with the landing gear accidentally down
when landing short of the runway, unable to stop after landing or during a failed
takeoff (first or second segment).

281
 MODULE 9 - CRASH-LANDING / DITCHING
The ability to fly an aircraft must be complemented
by the ability to crash it competently

This Module addresses power-off crash-landing and ditching procedures together.

Differences will be emphasized.

During any crash-landing or ditching, the utmost concern is survivability.

Aircraft energy and flight path to the primary impact point, full flap minimum
speed, and aircraft attitude at impact are the determining factors.

Approach Considerations
--- Flaps
Full flap power-on landings are routine. However, when thrust is not available,
altitude needs to be converted to extra speed for airplane controllability.
Accident data shows that pilots attempt to fly a power-off crash-landing or
ditching at normal approach angles (same visual cues they are familiar with) and
touchdown in a nose-up attitude, such as in a normal landing. This results in a low-
speed approach, high vertical speed, poor flight path control and structural failures
at impact.

- Once reaching an open field or body of water is assured, full flaps should be
selected ASAP. The additional drag from full flaps should not be a concern when
flying a high-energy final. When the priority is survival, even a few knots slower at
impact can make a difference.
Recall that we only manage what we monitor, so pay close attention to aircraft
speed, especially if not flying a high-energy final. Usually, an airplane on final is
controlled with pitch and power. However, without thrust, pitch is controlling both
speed and flight path.

The APU may not start, may not go online even if it starts (Qantas 32 Airbus 380),
or the RAT may not deploy or function properly.
In these cases, windmilling engines may still provide for slow flap extension, and
this is the reason to start flap extension early. If engines are damaged, they may
not give the windmilling capability for full flap extension. Select full flap even if you
believe they may not extend* or may not extend in time. There is nothing to lose,
the more flap that can be extended, the slower the impact speed.
* Note that on US Airways 1549 A320 ditching, the trailing edge flaps extended
(possibly due to windmilling engines or residual pressure), although the Airbus
manual states they would not be available.

282
- When on final, increase speed (up to maximum speed for the actual flaps) to
generate extra energy needed for the flare (from a steeper approach) and extend
controllability to the touchdown point. Depending on the available hydraulic
pressure, flap extension (secondary flight control) may only occur while there is no
demand from the primary flight controls (hydraulic priority valve). Keep control
inputs to a minimum, only when needed (to allow for flap extension), steady, do
not overcontrol.
Note: - Flap indication may be inoperative on battery power, be aware of this and
do not abandon flap extension.

Full flap offers the slowest touchdown speed and a lower deck angle for best
visibility, especially relevant over water when depth perception is drastically
reduced. It also makes it easier to maintain the correct flat touchdown attitude.

Pan Am 006 ditching in the Pacific 1956-10-16

Note: Never extend the landing gear in a ditching.

In the following pages, landing gear comments do not apply when ditching.

--- Crash-landing
Gear should unlock and extend (gravity / wind-milling hydraulics) typically in about
200-400 feet of height (depending on aircraft) but may also have an alternate gear
extension (manual). Memorize the landing gear extension method for your airplane
and consider the height to touchdown.
Although the goal is to touchdown with minimum speed (full flaps), it is better to
land slightly faster in an open field than to crash-land into obstacles at a slower
speed. These considerations could delay flap extension until having the confidence
of clearing the obstacles.
During landing, anti-skid is inoperative on battery power, brake carefully, and plan
to use the full runway length.
If making a gear down, off-field landing, use standard soft field landing techniques.
Nose gear may stay lightly off the ground down to about 80 knots when the
horizontal stabilizer loses effectiveness (TACA 110, Austrian 111).

283
--- Audio Warnings
Know how to deactivate expected audio warnings. They become a nuisance and
may preclude other warnings from activating:
- GPWS mode 4A (too low, flaps) if not on a landing flap by 1,000 feet RA, and
mode 4B (too low, gear) if gear not down by 500 feet RA. These warnings will
come on continuously, prevent other warnings from activating (priority system),
and be very distracting. Both override push buttons are typically located by the
landing gear lever. (Airbus - GPWS SYS and TERR OFF).

Note: - These should only be deactivated after flap and landing gear are acted*
upon, so the purpose of the system is not defeated.
* For example, ditching with full flaps and gear up, once full flaps have been
selected, warnings can be canceled. Whether or not the flaps can reach the
selected position, there is nothing else the crew can do. Know switch location
beforehand, as you may not remember this until the warnings become apparent at
a lower altitude when you are busier.

Manual Reversion
Aircraft with Manual Reversion capability – If on battery power, flight controls
will go to Manual Reversion as speed drops through about 180 knots (CFM56
engine). Slow down through this speed with enough altitude to prevent Manual
Reversion from happening just before the flare*.
* - A B737-100 in Africa had a total loss of hydraulics in flight and flew in manual
reversion for about one hour to reach an airport. The pilots were physically
exhausted and lost control when the aircraft went through Manual Reversion
during the flare, crashing on the runway. Both pilots had taken turns flying for a
few minutes at a time during the flight.
- In a similar future scenario, consideration should be given to reserve the more
robust pilot to fly once on the final approach, assisted by the other pilot with push-
pull inputs when instructed by the flying pilot. During the cruise portion of the flight,
the non-landing pilot would likewise be assisted by a third pilot, or in its absence
by a strong ABA (F/A or passenger).

Flare Considerations
Note: - Landing gear comments do not apply when ditching.
Be aware that on final, the exterior view will be substantially steeper. With
landing gear down, full flaps and no thrust, aircraft can hold speed at about 1.5
dots high on a Glide Slope; it varies with aircraft wing and wind. Simulator tests
found that different aircraft will perform slightly differently, but this gives an
approximate value to start. Adjust pitch as needed. Speed is primary pitch
guidance. This is like the full flap power-off approaches pilots train for when getting
their licenses.

284
Caution - On regular power-on approaches (stable pitch), the touchdown area is
the point on the windshield that is not moving closer or away from you. This norm
does not apply to power-off approaches with a varying pitch starting from a much
higher flare.

Be prepared to flare earlier than usual* to break away from the steep high-speed
final and achieve a less pronounced and safer flare, especially over water. Land
or sea always use radio altimeter to assist until touchdown.
* Without the engines operating, be aware of possible stabilizer/elevator hydraulic
insufficiencies during the flare (check dual-engine fail checklist, know it
beforehand).

Caution - Overwater Flare

To better evaluate when to initiate the flare for ditching, look to the side, to the
shoreline, river embankment or beach. This technique is something that seaplane
pilots do routinely for better height perception. Water, due to its transparency, is
harder to see when compared to a runway. Undulation or seafoam helps to
see the water level.

If at high seas, land flat and parallel to the major swell system.

Intentionally Left Blank

285
 WHAT NOT TO DO
Do not land perpendicular to waves. Do not land nose high.

A perpendicular nose-high impact into a swell will cause the nose to dive into the
next swell. The sudden stop usually fractures the tail, which can go over the
forward fuselage upside-down, causing the rear cabin to sink quickly (SAS 933).
The same effect can be expected in a land impact. British Midland 92 impacted the
tail first, rotating the nose into an embankment. The rear cabin separated, flipping
over the forward fuselage upside-down.

Do not land nose high even in calm water or flat terrain.

A nose-high impact can fracture the fuselage, expediting the sinking. If crash-
landing, it can generate deadly G forces in the forward section and crushing forces
in the aft section.

Touchdown Technique
Expect excess speed to bleed off increasingly faster once the flare begins (no
thrust, engine drag and near-horizontal flight path).
- Once on ground effect just a few feet off the surface, use excess speed to
adjust the flight path. If needed, bank to parallel the surface to be contacted
(and use upper rudder pedal to prevent turn). Paying attention to the fast-
approaching Vref speed, release the backpressure on the controls to attain
a flat attitude at impact (flat with the surface, not the horizon). Touchdown
before the elevator loses effectiveness and the airplane starts to descend on
its tail.

Notice that there is no guidance here for a target pitch because it is not necessary.
The key is to release the backpressure shortly below Vref, just before the plane
wants to quit flying, allowing the fuselage to become parallel to the surface for the
touchdown.

286
This technique will allow for a low touchdown flight path angle with low vertical
speed. The engine nacelles and the aircraft center section (wing box) should touch
down first, just forward of the CG, to prevent tail damage and pitch rotation
(distributing impact forces through the fuselage more evenly). The wing box is
structurally the strongest area.

If ditching with swells present, it is better to ditch slightly earlier and faster but in a
flat attitude than to wait to bleed speed and dip a wing into an incoming swell
(should we miss the timing of when to release the backpressure on the flight
controls). Touchdown in a flat attitude on top or on the backside of a wave. Do not
allow the aircraft to hit and skip into the face of the next wave. If necessary, pull
the spoilers slowly just out of the detent to force contact with the top of the wave
(but do not push the nose down). Once in the water, an airplane will stop quickly.

--- This high-speed technique achieved the best results during the numerous
simulated Airbus ditchings after US Airways 1549 ditched in the Hudson. It
was performed by an Airbus test pilot (page 50 of the report).
https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf

--- The Questionable Recommended Pitch

Airline manuals commonly recommend a touchdown pitch of 10º to 12º, and it
assumes the aircraft has at least one engine operating.

This pitch guidance can be found in manuals for large WWII-era seaplanes when
landing in rough seas. However, large seaplanes had strong keels specifically
designed to withstand impacts with swells. A step on the keel would raise the tail
out of harm’s way. Recall from M2 that airliners bottom fuselage has a 5,000J
impact strength factor and their empennage only has 19J.

Pitch information was also derived from the Langley (US) tests of 1956* and 1953**
and the Mercure (France) tests of 1974*** (1/16 scale models were used).
* - Ditching Investigations and Effects of Design Parameters on Ditching
Characteristics, Report No. 1347 (Langley, Virginia 1956).
** - Experimental Investigations of the Effects of Rear Fuselage Shape on Ditching
Behavior, NACA (today’s NASA) Technical Note 2929 (Langley Research Center,
Hampton, Virginia 1953).
*** - Water-Tank Tests of the Water-Landing Forces, Report No. 74-5 Institut de
Mécanique des Fluides de Lille (IMF Lille, France 1974).

Langley US Navy P2V Neptune video link:

Video: https://www.youtube.com/watch?v=baNe0YL5QvI
Note: - The Neptune was selected for these tests as it carried more passengers
than any other military transport of the time.

287
Timestamp 1:15 - Tests are performed with a touchdown pitch of 10º and with 6º,
without flaps and full flaps. Notice the significant improvement when full flaps are
used. However, in all of them the primary impact is in the tail section (19J impact
strength, the weakest area of the aircraft).

Timestamp 2:15 - Touchdown with 2º of pitch and full flap.

The primary impact was forward of the CG, which caused the nose to bounce and
the aft section to settle gently into the water (both the primary and secondary
impacts were in the 5,000J of the bottom of the fuselage). This attitude is like the
flat touchdown discussed previously.

The video continues, simulating ditchings with damaged under-structures

(representative of combat damage) which caused the nose to dive underwater.
- This was overcome with the installation of an hydroflap just forward of the CG
and abeam the engines.

These tests can establish a parallel between this hydroflap,

and the effect that an aircraft’s belly bulge has on ditching.

--- Unable to Achieve a Flat Pitch

If a flat pitch is not achieved and the touchdown is nose-up but with full flaps, most
of the impact forces will be divided between the full flaps and the tail. As the arm
from the CG to the flaps is much shorter than to the tail, this will lessen the nose-
down rotation.

288
The wing needs to stay parallel to the surface. Full flaps will also attenuate yaw
rotation by providing a broader area of contact and resistance. The inboard flaps
will absorb most of the impact, failing before the outboard flaps.

Full flap ditching and inboard flap failure, Japan 2 DC8 SFO 1968-11-22

The inboard flaps being close to the CG have less effect on yaw. The lesser the
flap the airplane has at touchdown, the greater the risk of a wingtip strike. Yaw
causes side G forces, and they are the most dangerous to the aircraft and its
occupants. Humans have a low 4G tolerance to side impacts.

On the Asiana 214 (B777 SFO 2013-07-06) crash-landing after the primary impact
on the tail, the secondary impact on the left engine and left wingtip caused the
plane to rotate about 330° (around the vertical axis) while in the air. Recall that
after a strong impact, the airplane transitions from displaying aerodynamic
properties to a ballistic trajectory over which the pilots have no control.

--- Ethiopian 961 (B767 1996-11-23). Power-off ditching, touchdown first with a
wingtip. Yaw rotation caused the aircraft’s breakup.
Video: https://www.youtube.com/watch?v=SqKdVo_IcGs

--- Engines
When a jet plane with the engines mounted under the wing impacts tail first (land
or sea), the nose-down rotation around the CG causes the engines to impact
vertically, this usually breaks the forward engine pylon or both pylons and causes
engine separation.

Intentionally Left Blank

289
However, when ditching in a flat pitch and level wings, the engines tend to stay
attached as water flows through the engine (see photos of SAS 933 on M3P2 and
Japan Air Lines 2 below). A crash-landing will pull the engine(s) off the wing as
they dig into the ground.

Flat and level touchdown, all engines stayed attached

Japan 2 - DC8 - SFO 1968-11-22

Further, when ditching in a flat attitude, there is little room for a vertical acceleration
of the forward fuselage, and it usually stays attached to the wing box. This is true
in a crash-landing only if all landing gears are retracted.

The recommended touchdown pitch of 10º to 12º causes the tail to impact
first due to aircraft geometry. This recommendation is contradictory with the
goal of any crash-landing or ditching - to impact with the slowest possible
speed and vertical rate and with the wings level with the surface. By calling
for a pilot’s attention on maintaining a particular pitch, the pilot is being
distracted from the primary task of skillful pilotage preparing for the impact.
Without power, maintaining a nose-high pitch makes the flight path a
resultant effect when it must be the priority.

--- Tail Damage

The less the flaps are extended, the higher the plane's attitude and the more
severe the tail impact, causing large-scale structural failures.
The damage to the lower fuselage typically starts where the cylindrical fuselage
becomes conical, increasing progressively going aft. The impact with the water
ruptures the lower fuselage skin panels, and the forward travel of the aircraft forces
water to accumulate into the unpressurized tail. This continued aircraft movement
creates a water scoop effect that collapses the aft pressure bulkhead, allowing the
water pressure to push up the aft cabin floor. The aft galley floor usually fails,
creating an opening to the bottom.

290
--- On Garuda 421 (Indonesia 2002-01-16), two F/As seated in the aft galley fell
through the floor opening. Both were found with severe injuries in the river behind
the aircraft, and one did not survive. Both rear exit doors were damaged and
unusable. The plane touched down nose high, causing rotation around the pitch
axis and generating serious injuries to five out of six passengers in the forward
cabin.

--- Similarly, US Airways 1549, an Airbus 320 which ditched in the Hudson (2009-
01-15), also touched down in a nose-up attitude, causing serious injuries to the aft
F/A and four passengers. The rear passengers were in 41°F water before the
aircraft came to a stop (thermal shock can occur in three minutes and swim failure
in five to ten minutes). Both rear exit doors were damaged and unusable, and the
aircraft’s floating capability was compromised.

--- On the Turkish 1951 Amsterdam crash-landing (2009-02-25), the aircraft

touched down nose high, causing rotation around the pitch axis and generating
non-survivable G forces in the flight deck and forward cabin. The primary impact
was on the tail, which fatally crushed the aft F/A.

--- Ural Airlines 6178 (Russia 2020-08-15), an Airbus 321 that lost both engines
at 750 feet immediately after takeoff due to bird strikes, was able to crash-land,
gear up in a cornfield. The preliminary report, videos, and photos indicate that the
plane sustained no damage to the tail. The aft cabin crew was not injured. Both
rear exit doors and their slides were not damaged and were used for the
evacuation.
This junior Captain learned the lessons of the past power-off crash-landings and
ditchings. He skillfully managed aircraft energy to maintain control of the plane until
touchdown.
He graduated from a civilian flight school six years before the accident and only
had 3,000 hours of experience. His co-pilot had 600 hours. Well done.

It is crucial to execute the correct touchdown technique to reduce impact forces,

preserve structural integrity and extend post-crash survival. The impact speed
must be the slowest possible and this can only be achieved with full flaps.
When ditching in the open ocean away from immediate rescue, a successful
ditching will make the difference in deploying life rafts. The North Atlantic water
temperature in the summer is 50 F. Swim failure will occur in a few minutes.
It is also easier to find a floating plane than the survivors in the water.

The data collecting technology has evolved tremendously since the 1953/1974
tests, and so has the way aircraft are built. Crash-landings and ditching tests need
to be recreated using modern computer modeling coupled with the plentiful
recorded accident data available.

291
Training must include an emphasis on managing power-off high-energy
approaches to prevent future low-speed approaches and possible loss of control.

--- US Airways 1549 accident report did not include the Flight Data Recorder;
however, the investigators' interpretations of the FDR indicate that there was no
attempt to manage a high-energy final.
https://www.ntsb.gov/investigations/AccidentReports/Repo10rts/AAR1003.pdf

The following is a timeline of the after-bird impact events for streamlined reading.
Note that references pertain to accident report page numbers.

CVR time 15:26:52 – "Flaps up, please, after takeoff checklist." (Page 168).
Four seconds later, the plane impacts birds.
The airplane remains in a clean wing configuration until CVR time 15:29:45, when
"flaps out" are called for at 270 feet (page 181).

"…as the airplane was descending through 270 feet, the flap lever was moved to
the CONF 2 position. As the flaps deployed, the airplane descended to about 210
feet and then climbed briefly, reaching about 360 feet before descending again."
(Page 47).

"…FDR data indicated that the airplane was below green dot speed and at VLS or
slightly less for most of the descent, and about 15 to 19 knots below VLS during
the last 200 feet." (Page 89).

"The airplane's airspeed in the last 150 feet of the descent was low enough to
activate the alpha-protection mode of the airplane's fly-by-wire envelope protection
features. The captain progressively pulled aft on the sidestick as the airplane
descended below 100 feet, and he pulled the sidestick to its aft stop in the last 50
feet, indicating that he was attempting to raise the airplane's nose to flare and
soften the touchdown on the water." (Page 97).

"…the airplane touched down on the Hudson River at an airspeed of 125 knots
(VLS 145 knots) with a pitch angle of 9.5 ..."
"Calculations indicated that the airplane ditched with a descent rate of 12.5 fps
(750 fpm, maximum certificated 210 fpm), a flight path angle of -3.4 degrees, an
AOA between 13 degrees and 14 degrees…" (Page 48).

"The NTSB concludes that the captain's difficulty maintaining the intended
airspeed during the final approach resulted in high AOA's, which contribute to the
difficulties in flaring the airplane, the high descent rate at touchdown, and the
fuselage damage." (Page 89).

292
High Angle of Attack protection.
"The high AOA protection played a positive role in this event… if the Captain had
not switched on the APU, the aircraft would not have stayed in normal law.
Considering the airspeed management and flap configuration, It is likely that stall
alarms would have been triggered several times during the descent, and the risk
of actually stalling would have been high." (Page 194).

"The BEA* comments are in no way intended to criticize the crew’s actions.
However, we wish that a clear distinction be made between crew’s actions that
were adapted to the situation and ones that could be improved if a similar event
occurred again." (Page 189).
* French accident investigators.

- Observation (Capt. Vireilha) - Improvements can only occur when adequate

training is developed. The industry should not expect flight crews to perform
procedures for which they were not trained.

Intentionally Left Blank

293
 RECAPPING

Loss of All Engines - Low Altitude

- Execute the “Immediate Actions” for engine restart and start APU.

Considering the criteria explained previously:

- Select the best area to land, crash-land or ditch. Keep altitude and other
limitations in mind, don’t overreach.

- Altitude permitting, fly best glide ratio speed (minimum clean maneuvering
speed) only until having confidence the aircraft will reach the touchdown
area.

- Then, select full flaps ASAP and increase speed up to maximum speed for
the actual flaps. After flaps have been selected, turn off GPWS audio
warnings.

- Close bleed air and outflow valves (or ditch switch). Are there any other
necessary items in your aircraft?

- When on a high-speed final, push throttles forward slowly and see if any engine
responds. Disregard temperature limitations.
If engines do not respond, shut down engines if called for in your aircraft’s checklist
(know this beforehand).

- From a high-speed final, start flaring high and slowly while evaluating the
need to arrest the vertical speed (elevate pitch as dictated by the VS rate of
change). Maintain high speed to parallel the surface from just a few feet.

- Stay flat while bleeding excess energy. Just below Vref, release the
backpressure on the elevator and allow for a flat touchdown on the aircraft’s
belly and not the tail. Control bank to be parallel to the surface.

- Throughout the maneuver, the speed range is from maximum flap speed to
minimum speed. Dive to maximum speed and flare to impact just below
minimum speed.

294
 MODULE 10 - REVERSER FAILURES

PART 1 - FAILURE AND RECOVERY

An uncommanded Thrust Reverser (T/R) deployment in flight, or a failure to deploy
on the ground, can have critical consequences. Pilots have a small window of
opportunity during which to recover, provided the correct actions are performed.
These immediate actions are not trained for or discussed in the pilot’s manuals.
There is little understanding in the aviation community of the diverse T/R failure
modes in different phases of flight. This module addresses these topics.

Note from Capt. Vireilha

--- On 1999-08-16, I was the Captain of Continental 139, a B757 flying from Newark
to Seattle. While at the gate, the ground crew disconnected external power before
establishing communications with the flight deck and before the aircraft was on
ships’ power. The airplane went dark, and we started the APU, but we could not
get it to come online. Maintenance came on board, and during their
troubleshooting, the engines would not come online either. We replaced one board
on the electronics bay, and about an hour later we left the gate. These electrical
anomalies may have played a role during the T/R deployment that followed.

During takeoff on runway 4L, we went over a small bump when transitioning from
the new runway extension to the old pavement. We passed that point with 115
knots, and the left reverser unlocked light came on at this time. I rejected the
takeoff, and after we came to a stop, the left T/R would not stow in the forward
thrust position. Maintenance locked the T/R before we could depart again.

This uncommanded T/R deployment caused me to research these failures and

realize that there was little awareness of the various T/R failure modes and the
urgency for the corrective action. Aircraft manuals reflect this weakness in their
deficiency of procedures, and training departments lack dialog in this subject.
A couple of weeks later, while discussing this event with another line pilot, he told
me he, too, had an uncommanded T/R deployment during taxi for takeoff.
These events led me to research this matter further and to write this module.

Facts
Wing and engine geometry, T/R design, pylon length, and the number of engines
affect how an airplane reacts to a T/R deployment in flight. Uncommanded
deployment has always been a not-so-unusual occurrence.

295
Under-the-wing engines with aft-mounted T/Rs (behind or close to the wing's
trailing edge) have their reverse plume of air stay entirely under the wing, not
affecting lift. This would afford the time to “read and do” a checklist procedure to
stow the T/R or shut down the engine (fig.1).

Fig.1 - “Target-type bucket” (135°). All thrust is reversed.

Fig.2 - Newer designs commonly have the T/R in the middle section of the nacelle.
Only the fan thrust is deflected, the turbine core thrust is not (fig.2).

Fig.2 - “Cold stream” type reverses 70% of the thrust.

When the T/R is forward of the wing's leading edge, part of its reverse plume of air
goes above the wing and destroys 25% of lift, causing rotation around the
longitudinal axis at a rate of 28° per second*.
Unlike the older design, these systems have a short window of recovery from an
uncommanded T/R deployment.
* Data from Boeing analysis of Lauda Air 004 accident applies to any airframe with
the engines mounted under the wing (cold stream type reversers).

296
Fig.3 - The yellow circles represent the reverse plume of air. Red arrows highlight
the reverse deflected over the wing.

Fig.3

Fig.4 - However, aircraft with longer engine pylons reduce the reverse plume effect
on lift. The yellow circle represents the reverse plume of air clear of the upper side
of the wing.

Fig.4

Fig.5 - Notice inboard ailerons located behind the engines.

Fig.5

297
Fig.5 - If one engine goes into reverse, the resultant plume of air above the wing
renders the aileron behind the engine ineffective. The aircraft then is left with only
one aileron on the opposite wing for control.
(In-flight, with slats/flaps retracted, the outboard ailerons are locked out).

Fig.6 - Additionally, on four-engine aircraft:

- An outboard engine going into reverse would not affect the inboard ailerons
located behind the inboard engines.
- One engine in reverse represents 25% of thrust instead of 50% on a twin-engine,
and the airplane would still have an engine in forward thrust on the same side.
These characteristics allowed four-engine aircraft to survive many T/R
uncommanded deployments at cruise.

Fig.6 - Notice on the B747 the clearance between the engines and the wing.

Fig.7 - Some airplanes are explicitly authorized to use idle reverse in-flight. The
Boeing C17 Globemaster III is approved to use in-flight reverse on all engines. The
Lockheed C5 Galaxy, the Concorde and the DC8 had approved use for the inboard
engines only.

Fig.7 - T-tail aircraft are more affected by rudder blanking, however,

some routinely use reverse just before touchdown.

298
Fig. 8 - Intentional T/R deployment in-flight is prohibited or not recommended in
most airliners regardless of their capability of idle reverse in-flight.

T/R deployment before touchdown.

AA MD80 Video: https://www.youtube.com/watch?v=3mzzt-tiUBk
SAS B737 Video: https://www.youtube.com/watch?v=41C4qMDzT_0

Fig.8

--- Lauda Air 4 - B767 - Thailand 1991-05-26

https://aviation-safety.net/database/record.php?id=19910526-0
Mary Schiavo, Inspector General of the U.S. Department of Transportation
(1990-1996) in her book “Flying Blind, Flying Safe,” pages 187-188, she wrote:
- “When the FAA certified the B767 in 1982, it asked Boeing to consider the
possibility of an in-flight thrust reverser deployment. They submitted a statement
saying that an in-flight deployment had been considered and that, in their opinion,
the aircraft would operate safely. When the FAA reviewed the paperwork, it didn’t
double-check this analysis or the assumption. It simply accepted the statement
and approved the plane’s certification.”

- “When the B777 was being designed, an in-flight thrust reverser deployment test
should have been considered essential, since earlier Boeing models had terrible
problems with thrust reversers that suddenly, mistakenly, activated during flight.
The Lauda accident with the loss of all on board, many of them American citizens,
brought to light the vulnerability of reverser systems.”

299
Reverser Certification Requirement
Requirements for the B707, 747 (1965), DC8 (including retrofits), DC10, L1011
(early 1970’s): “… it must be shown by analysis or test that the aircraft is capable
of continued safe flight in any possible position of the idle flight reverser… in the
most critical reverser condition expected in operation.”

“It was generally believed that because slowing an aircraft for approach reduced
control surface authority, a most-critical condition was thereby created.
B-767 post-accident in-flight reverser controllability tests involved deployment with
the engine at idle power, starting at 10,000 feet and 220 knots and remaining at
idle through approach and landing.”

--- Recovery Maneuver

“Air Disaster - MacArthur Job (volume 2, pages 203-217 March 1996).”
“Boeing, in conjunction with the NTSB and FAA, conducted different simulation
models using Boeing’s 767 engineering simulator reprogrammed with new data
from wind tunnel tests (engine spool-down time of 6-8 seconds, lift loss 25% for
cruise power settings and 13% for idle thrust, up from the previous estimation of
only 10%).”

“Boeing’s Chief 767 Test Pilot found that, if engine thrust was reduced to idle
immediately and full opposite rudder and aileron was used in the first 4
seconds, he was able to recover the simulator to normal flight.
When opposite engine thrust was also reduced to idle, simultaneously with
full opposite rudder and aileron, the recovery window increased to 6
seconds. After these time frames, recovery was impossible.
These characteristics are common to all jet transport aircraft with similar
engine-to-wing coupling, not just the B767.”

“Using the full authority of the flight controls in this way is not part of current training
procedures. Above Mach .83 at load factors above 2.5g, lateral control cannot be
maintained due to reduced effectiveness of flight controls because of aeroelastic
effects.
Despite many design changes (including an improved sensor) the investigation
disclosed however that, if certain anomalies develop in the actuation of the auto-
restow circuitry, they can circumvent the protection afforded by the design.”

Event with Improved Sensor

--- British Airways 56 - B744 - Johannesburg 2009-05-11
https://avherald.com/h?article=4198598d
(Actual takeoff speeds, V1 150, Vr 168, V2 176 KIAS).
During takeoff at 126 knots, T/R 3 indicated unlocked. The crew continued the
takeoff, and at 160 knots, T/R 2 indicated unlocked, initiating the auto-retraction of
the leading-edge flaps.

300
At a radio altitude of 4 feet with 176 knots, aircraft stick-shaker activated, and
significant airframe buffeting was felt for 15 seconds until speed rose to 186 knots.
The aircraft stayed at 56ft for that period. The crew returned to the airport,
assuming they had problems with engines 2 and 3.

Findings: - Although the T/Rs were stowed, the T/Rs sleeves had moved to the
broader aft limit of the improved sensor acceptable travel. A sensed reverser
movement activated the after-landing-system-logic to retract all leading-edge
Krueger flaps inboard of the outboard engines. This design prevented Krueger
flaps vibration due to the reverse use during landing (fig.9).

Fig.9

--- Lufthansa 540 - B747 - Nairobi 1974-11-20

https://aviation-safety.net/database/record.php?id=19741120-0
Fig.10 - LE Flaps were not extended before takeoff as the crew missed the
checklist item to turn the pneumatic system on. The flight stayed in ground effect
until the end of the runway, and then it hit terrain.

301
 PART 2 - UNCOMMANDED DEPLOYMENT
Considerations
A reverse unlocked light may indicate a T/R malfunction. The T/R can be in transit
to full deployment or unlock and remain in forward thrust. This can be confirmed
by the throttle retarding or not. But this interlocking design can fail, too. This allows
the reverse lever to be activated with the engine in forward thrust (and up to full
thrust). Therefore, reverse selection should be executed as a two-step
procedure (wait for green light) during a rejected takeoff or a normal landing.

An uncommanded deployment can occur without any warning light activation

(common failure). If the airplane is on the runway, this can be perceived as
asymmetrical thrust, loss of centerline and a sharp decrease in acceleration, and
would naturally trigger a reject. If the airplane is airborne (takeoff second segment),
this can result in banking (loss of lift on one wing) and loss of airspeed. The pilot
tendency would counter with rudder and ailerons (which would automatically
deploy the spoilers), creating drag, further loss of lift, and faster deterioration of the
conditions.
An A/T disconnecting can be an indication of a disagreement in the takeoff logic.

--- Continental Airlines - Sabreliner - Montrose CO 1973-04-13

https://aviation-safety.net/database/record.php?id=19730413-0
Left T/R deployed shortly after takeoff. The Sabreliner descended from about
1,000 feet in a left bank, striking the ground in a 55° left bank and 10° nose-down
attitude.
Probable Cause: The continued operation of the left engine at climb power after
an in-flight deployment and failure of T/R light to illuminate (fig.11).

Fig.11

302
--- Lear Jet 35A - Ft. Lauderdale 2013-11-19
https://aviation-safety.net/database/record.php?id=20131119-0
Left T/R deployed shortly after takeoff. The pilots thought they were dealing with
an engine failure and could not identify a T/R deployment, causing a slow descent
until impacting the ocean. Unlock light appears to have been on, but the voice
recorder indicates pilots never saw it. Unlock light may not have been on until the
first impact with the water.

--- Cessna Citation I - Wichita KS 1983-04-26

https://aviation-safety.net/database/record.php?id=19830426-0
Both T/Rs deployed (uncommanded) during gear retraction on takeoff.
The Cessna yawed right, struck the ground and caught fire.
The aircraft was washed the day before and the T/R circuit breakers, which had
been pulled, were not reset.
Findings:
• Thrust reversers unlocked
• Inadequate maintenance
• Inadequate aircraft preflight
• Circuit breakers tripped
• Annunciator panel light(s) switched off
• Checklist not followed

--- TAM 402- Fokker 100 - S. Paulo 1996-10-31

https://aviation-safety.net/database/record.php?id=19961031-0
Ten seconds after starting the takeoff, the auto-throttle disconnects and the pilot
reconnects it.
Two seconds after liftoff, a shock is felt, the right engine loses power, and both
throttles retard. The co-pilot pushes them forward, but the right throttle retards to
idle and stays locked in for a few seconds, but then it unlocks, allowing the pilot to
push it forward yet, once again, the right throttle retards to idle.
Never having any T/R deployment light indication, pilots were engaged in a
confusing situation. Aircraft crashed into a building.
Observations (Capt. Vireilha):
- The Fokker 100 T/R light is inhibited above 80 knots and below 1,000 ft.
It seems that the manufacturer did not understand the catastrophic consequences
of a T/R deployment during takeoff. By inhibiting the warning, the pilots were
prevented from making the correct assessment and reject the takeoff.
- The right throttle retarding to idle and failing to lock in that position was an
additional failure of the T/R mechanism.

--- Sriwijaya Air 182 - B735 - Indonesia (sea) 2021-01-09

https://aviation-safety.net/database/record.php?id=20210109-0
The left thrust lever moved back during the climb, reducing thrust on engine one
(the right thrust lever stayed in place). This was a slow change for 83 seconds,
creating an asymmetry condition unnoticed by the pilots who may have been

303
distracted in turning away from the bad weather. The autopilot disconnected, and
the airplane rolled left past 45°. The left thrust lever continued to move back, and
five seconds later, the autothrottle disconnected. The aircraft developed a high-
speed nosedive and impacted the ocean 20 seconds later.
Observations (Capt. Vireilha):
The preliminary accident report indicates that the autothrottle system repeatedly
failed for three consecutive days the week before the accident. Maintenance
cleaned the autothrottle computer’s electrical connector and the TOGA switch and
may have overlooked the reverser unlocked proximity switch signals.

--- USAF C5A Galaxy - Ramstein AFB 1990-08-29

https://aviation-safety.net/database/record.php?id=19900829-0
Immediately after liftoff, the airplane stopped accelerating at 161 knots. It stopped
climbing at 50-100 feet, and the crewmembers experienced severe buffeting. The
left wing dropped and contacted a large tree, ripping off the no. 1 engine. The C-5
rolled left and crashed.
Findings: - Uncommanded deployment of engine 1 T/R during takeoff.

--- Sudan Airways 2241 - B707 - Sharjah UAE 2009-10-21

https://aviation-safety.net/database/record.php?id=20091021-0
After liftoff, the crew informed ATC of having lost an engine. The aircraft entered a
70° bank right turn and crashed 20 seconds later.
Findings: - Engine 4 cowling was found on the runway, and the engine's T/R was
in a fully deployed position. Engine 4 oil access panel was reportedly hard to close
for some time, and there was a visible dent on the nacelle.
Note: - The T/R tracks and nacelle are connected, and their integrity is critical.

--- Air New Zealand - DC8 - Auckland 1966-07-04

https://en.wikipedia.org/wiki/1966_Air_New_Zealand_DC-8_crash
Engine 4 is abruptly throttled to idle to simulate a failure after liftoff. This sudden
force made the T/R lever come back beyond the reverse interlock engaging the
engine T/R, the right wing hit the runway, and the DC-8 crashed.

Intentionally Left Blank

304
 PART 3 - FAILURE TO DEPLOY
--- The Correct Use of Reverse is a Two-step Procedure
During a rejected takeoff or after landing, the T/R levers should be brought
immediately to the interlock position (unlocked or in-transit light), and higher
reverse thrust should be selected slowly while monitoring symmetry. When the T/R
green lights confirm full deployment, then full reverse thrust may be applied safely.

Caution - Aviation manuals may state:

“Thrust reverser must be selected without delay after landing.”
It is correct to select reverser immediately upon landing (to cancel forward thrust),
however, do not rush into full reverse thrust without verifying that each T/R green
light is on. Without this confirmation, the engine without the green light can
accelerate in forward thrust while others are in reverse thrust, creating loss of
control and runway exit.

Be aware that although it takes about 2 seconds for a T/R to deploy, it takes up to
5 seconds to retract. If a selection is undone before the T/R completes its cycle,
the T/R may stop in transit.

Example: Upon reverse thrust selection during landing, the pilot decides to go-
around, cancels reverse and applies forward thrust; this could cause a T/R to stop
in transit or deploy fully. For this reason, it is standard practice not to attempt a go-
around once reverse thrust has been selected.

--- Low Visibility Operations - Use of Reverse

Operations in low visibility present a challenge should a T/R fail to deploy (causing
yaw) during a rejected takeoff or a landing. Their use should be cautious (idle
reverse is recommended if conditions allow).
With the lowest visibility, most airlines operate in, only three centerline lights and
no runway edge lights may be visible. Losing sight of the centerline lights makes it
difficult to know toward which side to correct. If centerline lights are lost, the next
lights could be the runway edge lights as the airplane goes off the runway.

Intentionally Left Blank

305
--- Pacific Western 314 - B737 - Cranbrook Canada 1978-02-11
https://aviation-safety.net/database/record.php?id=19780211-0
After landing and deploying the T/Rs, the pilots see a snow removal plow on the
runway. Reverse thrust is canceled, a go-around is initiated and the aircraft
becomes airborne before the 2,000-foot mark. At liftoff, hydraulic power to T/Rs is
shut off automatically by loss of ground sensing and the left T/R, not being fully
stowed, deploys open (ground/air system logic has since been changed). The
airplane flies over the truck, climbs to 300-400 feet, then becomes uncontrollable
and rolls left. Fatalities: 42 of 49 (fig.12).

Fig.12

--- However, there have been cases where a go-around would have saved the
aircraft even if one T/R did not stow. In this case, the pilot should treat it as
an engine failure and shut down the engine.
Example: (TAP 425 - B727 - Madeira 1977-11-19)
https://aviation-safety.net/database/record.php?id=19771119-1
During the second approach in heavy rain, the aircraft landed at Vref+19 and
entered hydroplaning, causing little deceleration despite full reverse and brakes.
The plane went off the runway at 43 knots and plunged vertically over a 190-foot
cliff, crashing on the beach below. In similar cases where the aircraft is not
decelerating, an early go-around should be considered, especially when there is
altitude to lose, no obstacles ahead, and speed can be gained on ground effect.
These considerations should be discussed during the approach briefing while still
at cruise altitude before the descent.

--- United 859 - DC8 - Denver 1961-07-11

https://aviation-safety.net/database/record.php?id=19610711-1
T/Rs 1 and 2 failed to deploy during landing due to a hydraulic failure. Asymmetric
thrust between forward thrust on engines 1 and 2 and reverse thrust on engines 3
and 4 created an uncontrollable situation leading to the aircraft crashing into a new
taxiway construction.

306
A contributing factor was the failure of the F/O to monitor and call out the thrust
reverse indicator lights status (fig.13).

Fig.13

--- TWA 800 - B707 - Rome 1964-11-23

https://aviation-safety.net/database/record.php?id=19641123-0
Takeoff is rejected at 90 knots due to a power loss indication on engine 4 followed
by engine 2 T/R unlocked indication. As reverse thrust is selected, engine 2
reverser fails to deploy, remaining in forward thrust, and the aircraft goes off the
runway to the right. Surge fuel tank drainage fails due to a blocked valve, and fuel
goes out the vent scoop, ignites and causes the right-wing tank to explode. This
causes the center fuel tank to explode into the passenger cabin, killing or injuring
all on board.
- This accident originated the change from one amber T/R unlocked light system
to a second indication (green) when the T/R transit was nearing full deployment
(proximity switch).

Observations (Capt. Vireilha):

It was a standard procedure to monitor and call out the T/Rs “all green” lights.
Later, with the introduction of the silent cockpit philosophy, only abnormal
indications would be called out. As most T/R deployments are uneventful, this led
to a substantial reduction in callouts. The absence of the “all green” call-out
requirement led to an unintentional reduction in monitoring.

Because we only manage what we monitor, we became susceptible to not catching

T/R failures.

Intentionally Left Blank

307
Fig.14 - A yellow (unlocked) or blue (in-transit), or a green (near* full deployment)
reverser lights have lost some of their operational significance.
* Proximity switch.

Fig.14

It is common to see pilots going into more than idle reverse thrust the moment the
aircraft touches the runway while the yellow unlocked light is on, without any pause
to verify proper deployment, without observing a two-step procedure. If the
reverser fails to fully deploy (green light), engine acceleration will be in forward
thrust and an accident is inevitable.

--- United DC10 - Denver 1988-09-12

https://aviation-safety.net/database/record.php?id=19880912-2
When reverse thrust was selected at touchdown, engine 1 reverser fails to deploy
and accelerates in forward thrust as engines 2 and 3 went into reverse thrust. At
about the same time, the aircraft's nose lifted off the runway to a 4° attitude, and
the aircraft went off the side of the runway, collapsing the nose landing gear. The
DC10 has a pronounced characteristic to raise the nose when the spoilers deploy
upon landing. The F/E did not call out the status of the T/R lights. Engine 1 reverser
only had a yellow light (unlocked only).

Intentionally Left Blank

308
--- Air France 91 - B747 - Rio de Janeiro 1985-12-02
https://aviation-safety.net/database/record.php?id=19851202-0
After touchdown, full reverse is selected on all four engines. Reverser cable for
engine one breaks, and the engine accelerates in full forward thrust while engines
2, 3 and 4 are at full reverse thrust. Aircraft departs the runway to the right (fig.15).

Fig.15

--- Air France 72 - B747 - Papeete 1993-09-12

https://aviation-safety.net/database/record.php?id=19930912-1
After a long touchdown at excessive speed, full reverse thrust was selected, but
engine 1 failed to transit and accelerated in full forward thrust (107% N1). The
speed brakes did not deploy, the autobrake disarmed, and the airplane departed
the runway to the right (fig.16).

Fig.16

--- Cameroon 70 - B747 - Paris 2000-11-05

https://aviation-safety.net/database/record.php?id=20001105-0
After touchdown, the Captain selected reverse thrust on all engines, but he did not
bring the throttle for engine one all the way back to idle. This prevented spoilers
from deploying automatically and autobrake from activating. The Flight Engineer

309
attempted to pull spoilers manually but inadvertently pushed the throttle for engine
one further into forward high thrust. Aircraft departed the runway to the right.
(Fig17) - Note that door four was not used for the evacuation. Due to the height
from the ground, the slides would be hanging down vertically and unusable. Good
job from this smart cabin crew.

Fig.17
--- Lear Jet 60 - Troy AL - 2001-01-14
https://aviation-safety.net/database/record.php?id=20010114-0
After touchdown and T/Rs deployed, impact with a deer rendered the squat switch
inoperative. Loss of this signal caused the T/Rs to stow and thrust to switch to
forward takeoff thrust as the crew did not cancel the reverse thrust. The airplane
continued down the runway until it impacted a ditch.

--- Lear Jet 60 - Columbia SC - 2008-09-19

https://aviation-safety.net/database/record.php?id=20080919-0
During takeoff, a tire failure causes wheel well systems damage, and the takeoff
is rejected. Both reverses fail to deploy, remaining in full forward thrust as the crew
did not cancel the reverse thrust. Aircraft crashes at the end of the runway.
Fatalities: 4 of 6.

--- S7 Airlines 778 - A310 - Irkutsk, Russia 2006-07-09

https://aviation-safety.net/database/record.php?id=20060709-0
Landing with left T/R deactivated, while reducing reverse thrust on the right engine,
left throttle is inadvertently pushed forward to 60% thrust. The plane goes off the
runway to the right at 98 knots. Fatalities: 125 of 203.

310
--- American A319 - Miami 2017-05-27
Fig.18 - At the start of the descent from FL360 and at 290 knots, an Engine
Interface Unit (EIU) indication was displayed in the form of a blinking light, followed
by an ECAM alert of L REV UNLOCK. Large yaw to the left was felt, which was
controlled with the rudder. Autothrust and autopilot were disconnected, and speed
was reduced to 240 knots by raising the nose of the aircraft. No vibrations or other
airframe indications were felt. The left engine remained at idle thrust throughout
the descent, approach and landing.
The QRH procedure did not guide how to deal with the situation, and it did not
address a recovery. The complete procedure with the first steps was found in the
Supplemented Manual.

Fig.18

The following accident is not from an uncommanded deployment or failure to

deploy, but it is significant enough to be included in this study. It is the result of a
counter-intuitive Airbus design involving the operation of an inoperative reverser.

--- TAM 3054 A320 - Sao Paulo, Congonhas 2007-07-17

The accident narrative starts on page 74 of this link:
https://reports.aviation-safety.net/2007/20070717-0_A320_PR-MBK.pdf

Accident Summary
The right engine reverser was de-activated by maintenance. This is an authorized
MEL procedure, provided no operations are predicated on reverser use.

311
Calculations of the Runway Landing Distance (RLD) require both reverses to be
operative if the runway is contaminated.
Airbus original landing procedure with an inoperative reverser required the thrust
lever of the de-activated reverser to be moved to “IDLE,” while the other reverser
was moved to the "REV" reverse position. This conforms with the industry
standard.
However, after two similar landing accidents* in which both aircraft operated with
one reverser de-activated, Airbus changed the landing procedure with an
inoperative reverser. The new procedure required that both thrust levers be moved
to the "REV" reverse position. This disagrees with standard aviation procedures
prohibiting crews from operating inoperative systems.

--- Philippine Airlines 137 - A320 - Bacolod 1998-03-22

https://aviation-safety.net/database/record.php?id=19980322-0

--- TransAsia 536 - A320 - Taipei 2004-10-18

https://aviation-safety.net/database/record.php?id=20041018-0

However, this simplified procedure of operating both reverses when one is de-
activated, adds 180 feet to the stopping distance. The reason is that, immediately
after the activation of the reverser, there is an increase of thrust to the engines.
Computer logic determines which reverser is inoperative and blocks the increase.
This brief time interval during which there is an increase of thrust without the airflow
being reversed, corresponds to the added distance required for the aircraft to stop.

This revised procedure was recommended by Airbus a few months before the TAM
3054 accident and had not been well-received and adopted by all operators. When
pilots are presented with a recommendation to do the opposite of what they have
been trained for (never to use inoperative systems), they understandably may lack
the conviction to execute such a procedure, especially during the stressful moment
of a difficult landing.

Nevertheless, the Captain of TAM 3054 left the thrust lever of engine two
positioned at CL (Climb) perhaps inadvertently or perhaps in an attempt to select
IDLE (similarly as done by the pilots of Philippine 137 and TransAsia 536).
This caused the ground spoilers not to deploy (increasing the landing distance by
about 50%) since both thrust levers must be at the IDLE position, or one of them
be at IDLE and the other at REV (reverse).
Additionally, the autobrake did not function (although armed) because ground
spoilers’ deployment is a prerequisite for such activation.

The aircraft landed at 142 knots. Ground speed was similar to IAS as 8 to 12 knots
of headwind was offset by density altitude. Hydroplaning speed would be about
124 knots if tire pressure was normal (210 psi). The aircraft was 18 knots above
hydroplaning speed while on the runway. The plane veered off the runway crossing

312
the grassy areas and the tarmac, then flying over an avenue and impacting the
TAM building at 96 knots. It killed all 187 onboard and 12 people on the ground.

Report Findings and Observations (Capt. Vireilha):

Aircraft - In these three accidents:
- even with the aircraft on the ground;
- one engine thrust lever at the REV position;
- the ground spoilers armed;
- the autobrake selected;
- and with the application of maximum braking pressure on the pedals;
the power control system still gave priority to the information that one of the levers
was at “CL” (climb). Additionally, this lever did not have any safety or effective
warning devices to alert the pilots of a possible inadvertent setting.

TAM operations - Dispatch of any aircraft with reduced stopping capabilities to a

short, wet and slippery runway should not be authorized or proposed by the
company. Its crew should not accept such flight release. The aircraft was tankering
4,800 pounds of fuel for cost-saving measures, increasing landing speed and
stopping distance.

Airport - Runway 35L had 6,168 feet available for landing and an elevation of
2,631 feet. It had been repaved with asphalt and was supposed to be grooved.
However, the runway reopened before completing the project, just a few days
before this accident, and it was not grooved.

PART 4 - CONSIDERATIONS ON DIFFERENT

SCENARIOS
--- Continental 850 - B737 - St Martin 2004-04-24
Note from Capt. Vireilha: - I was the Captain on this flight, and this was my second
experience with a T/R light coming on. The first event is described on the first page
of this module. This time I was better informed.

At FL410, the right engine T/R light comes on with no other indications, and the
Master Caution fails to illuminate. (Note that non-illumination of warning lights is
common in many events).

I brought both engines to idle and prepared to apply flight controls (cautiously to
the extent needed) if the T/R would deploy.

313
As soon as both engines reached idle thrust, the threat of an irrecoverable loss of
control was over, and the left engine was brought up to the previous cruise thrust,
near MCT.

We informed NY Center of our immediate need for FL240 (engine out altitude).
During the descent, the F/O consulted the Quick Reference Handbook (QRH);
however, no helpful guidance was found for our situation. As the right engine was
not causing vibration, I decided to keep it idle for the remainder of the flight for
systems support (pneumatic, hydraulic, and electrical needs). It also provided
minimal thrust and engine lubrication.
Newark, our destination, reported good visibility with winds at 25, gusting to 32
knots, 30° from the left. The F/O had concerns about the wind and proposed using
both engines and full flaps as in a normal approach and landing. However, I
decided to fly the engine out profile (flaps 15°) for approach and landing. With less
flaps and higher speed, the crosswind factor was not a challenge. The runway was
long and dry, the aircraft was light, and there were no landing distance concerns.
The APU was started before the approach to prevent load-shedding issues should
we have to shut down the engine on final.

--- Using both engines for approach and landing

A T/R unlocked light in flight is an indication that a malfunction has occurred, and
an uncommanded deployment can follow with no further warning. Using the right
engine (with the T/R light on) for landing at other than idle thrust would be
dangerously ill-advised.
- If the T/R would deploy on final with power on, it could cause loss of control. One
single failure (T/R deployment) would create the need for the recovery maneuver,
which calls for both engines to be brought to idle. This is not something one wants
to do fully configured for landing at low altitude.

--- Using only the good engine for approach and landing scenario
Keeping the right engine (T/R light on) at idle for the approach is the safest course
of action. Even if the right T/R deployed, the idle thrust yaw would be easily
controllable, as Boeing and incident history have demonstrated. The right engine
would still be available for thrust needs, should the left engine fail.
However, if the right T/R deployed when thrust was advanced it would be easier
to control as the left engine would not develop thrust. This would still call for the
right engine to be brought to idle, turning the plane into a glider but allowing for a
controlled arrival.
This is a remote scenario as it involves two simultaneous and independent failures
(failure of the left engine and deployment of the right T/R).

--- Engine shut down scenario

Although the aircraft manual calls for an engine shut down when a T/R light is
associated with vibration, it does not provide any guidance if there is no vibration.
Shutting down an engine that is not vibrating eliminates that engine as a backup.

314
On a twin-engine aircraft, loss of the remaining operating engine would result in a
crash-landing.

EXERCISE
Landing Scenario Considerations
On a clear day with calm winds, and on an ILS approach fully configured and
stabilized for landing, a T/R light comes on with no other indications. Options:

A) Continue with a normal approach using both engines.

B) Go-around using both engines and refer to the checklist.

C) Reduce thrust to idle on the affected engine, continue approach on the other
engine, and reconfigure for engine-out landing.

D) Reduce thrust to idle on the affected engine and continue approach on the other
engine with no flap or target speed change.

Options A and B would place the aircraft at risk of losing control should the T/R
deploy with more than idle thrust.

Option C would be preferable if there was enough altitude (>1500 feet, for
example) to perform the following:
- Reduce flaps to the engine out landing configuration, and increase thrust to
increase target speed (by about 15 knots). The aircraft may go under the Glide
Slope until reaching the higher target speed, then reduce the descent rate and
recapture the Glide Slope.
- Cancel GPWS mode A (Flap)
- This will also allow better go-around performance.

Option D would be preferable if at a lower altitude (<1500 feet, for example) when
there is less altitude to stabilize the approach. A go-around from full flaps on one
engine would be more challenging, however, it should have been part of the
training. Typically, this maneuver is trained from a full flap landing and then losing
an engine as the go-around is initiated.

315
 MODULE 11 - EXTERNAL SENSORS
FAILURES
The least understood emergency
a flight crew can face

INTRODUCTION
External Sensors Failures present numerous complex scenarios due to the large
number of components involved and the different ways they may fail.

It is important to differentiate “External Sensors Failures” from “Airspeed

Unreliable.” There is one checklist for “Airspeed Unreliable” with limited scope and
only covers one symptom of what is usually a much larger problem.

Because these failures can rapidly cause a flight divergence, they must be well
understood to be recognized promptly and trigger the correct trained response.

Note: - Paragraphs with accident examples are numbered in red. In these

paragraphs, numbers inside parentheses refer to the incident example in
“Part 4 - Incident Events” at this module’s end.

PART 1 - BACKGROUND INFORMATION

System Design
There are two pitot-static systems:
- Thales part n. C16195AA/AB - (old name, Sextant)
- Goodrich 851GR – (old name, Rosemount). Numerous incidents with the pitot
system caused a redesign in 1996, mandated for aircraft certified after January
2015.

The new Goodrich 851HL has become standard. It has more heat applied to two
areas, increased in the tip by 35% to better handle ice/water issues, and in the
drain hole area to ensure proper drainage. More thermal energy is needed to
evaporate ice crystals than to evaporate liquid water.
It handles water and ice better, however, it is designed to meet regulatory
specifications of -40°C. Although fewer failures have occurred with this latest
system, it still does not account for high-altitude ice crystals.

316
Pitot-static system requirements date from 1947 rules, requiring the system to be
tested up to 9,000 meters (29,500 feet) and -40°C (air is too dry to form ice
below this temperature). It was only after the loss of Air France 447 that high
altitude ice crystals became specifically researched and their existence at higher
altitudes better understood. However, the atmosphere above 30,000 feet still holds
many unknowns (fig.1).

Fig.1

Intentionally Left Blank

317
Systems Structure (Simplified)

EXTERNAL SENSORS

• Pitot tubes
• Static ports (altimetry, gust suppression)
• TAT - Total Air Temperature probes
• AOA - Angle of Attack vanes (probes)
• PT7/2 - Engine Pressure Ratio sensors

DATA PROCESSING

• Air Data Computers, Calculation Systems

INTERFACE

• Electrical Instruments
• Message Systems

Note: - For simplicity of presentation, ADC (Air Data Computer) is commonly

mentioned even when it may pertain to other systems components such as CADC,
MCU, ADIRS, ADIRU, SAARU, etc.

System Failures
Failures to the above systems or their components can occur on the ground or in
flight. The causes are different, and pilot actions for recovery are different. The
pilots will perceive a failure without identification of its origin (external sensors or
data processing).
Note: - References to pertinent incidents start with the next point. Match the
incident numbers in parenthesis with the same number on Addendum 1.

Intentionally Left Blank

318
1 - External Sensors Failures on The Ground
Blockages - Typically, they are localized and do not affect all systems. They are
usually caused by safety covers, washing tape, insect nests, sand or other debris
(see event 1.1).

System leak - A system leak will allow pressurized air into one system, and a
maintenance drain left uncapped will allow one, two or all systems to pressurize
with cabin air (1.2).

System heat - A malfunctioning heating system* for pitot tubes, static ports, AOA
(Angle of Attack) (1.3), or heating not turned on can also cause failures due to
water freezing or icing (1.4 through 1.7). In this case, false indications may not
appear unless and until the aircraft flies through moisture, at which point failures
would start to occur (1.8 & 1.9).
* A partial heat failure may not trigger an advisory or a warning.

Besides the factors mentioned here, systems may also have unannounced and
conditional failures when linked to other systems, such as the ground-air sensor
(1.10).

2 - External Sensors Failure in Flight

A bird strike or large hail can destroy a probe. Volcanic ash and ice crystals can
overwhelm external sensors and probes. Despite the origin of the failure, recorded
data indicates they are not affected simultaneously or in the same manner. The
failures are usually a few seconds apart and of different magnitude.

The sensor location (left/right side or bottom of the fuselage) in relation to the
relative wind makes it susceptible to different pressure effects or compression
during takeoff and landing.
Note: - Instruments are calibrated for installation errors to compensate for this. For
example, the Captain’s ASI is calibrated to be more accurate at low airspeeds
(knots), and the F/O’s ASI is calibrated to be more accurate at Mach. Accordingly,
when manually logging engine parameters at cruise, the Mach number needs to
be read from the F/O side.

Unreliable data from external sensors or internal component failures create false
inputs to other systems. Data computers may follow erroneous but matching data,
locking out correct but disagreeing data. This creates an impossible scenario for
the pilots to troubleshoot. This should not be attempted because the assumed
failure cannot be verified and the risks of losing control of the aircraft during this
period are high.

Volcanic ash consequences are reviewed separately in M8 - Failure of all Engines

(British Airways 9 and KLM 867).

319
Information processing and interface failures can only be prevented before a
flight. Improper maintenance procedures of any component of the systems can
result in failures. Sometimes, minor in-flight troubleshooting may resolve the issue
temporarily, e.g., switching to an alternate air data computer if the problem
originated in the ADC.

How Do Systems Fail?

3 - Pitot System failures may be detected during takeoff (first segment) as a
disagreement between the Captain and First Officer’s airspeeds (see event 3). It
is normal for the standby airspeed indicator to differ slightly because it is not
corrected for ground effect compressibility and installation errors. These
indications are routinely cross-checked against each other during takeoff, but more
importantly, they should be cross-checked against Ground Speed (further
discussed later).

4 - Static System failures are usually detected during takeoff’s second segment
as a stuck VSI or altimeter (4.1). They are harder to detect at cruise unless the
aircraft changes altitude while the altimetry remains constant.
Nevertheless, unstable altimetry does not necessarily mean a fault with the static
system. Accumulation of dust/dirt in Air Data Computers (maintenance of air filters)
can cause the ADC to work at higher temperatures than those for which it was
designed, causing erroneous data output. Altimeters can jump altitude, causing
the autopilot to chase altitude and the airplane to pitch up or down violently (4.2).
Data-spike failures from an ADIRU or other systems can also cause
uncommanded pitch changes (4.3).

Note: - Anytime an airplane begins to move away from your desired path for no
apparent reason, immediately turn off A/P, A/T, stabilizer trim (if moving) and bring
all engines to idle (momentarily) if conditions permit (conditions and recovery
expanded on M10). Do not reengage A/P, A/T, and stab trim until understanding
the cause for the malfunction and having confidence it is safe to do so. Be prepared
to turn the systems off if it reoccurs.
In accident data, it is common to see pilots not taking control of the airplane when
a deviation starts. They allow the plane to deviate too far before attempting to
regain control, making it more difficult. It is also common when pilots encounter
difficulties flying the plane manually to engage the A/P and A/T, perhaps in an
effort that these systems will cope with the event, usually resulting in loss of control.

5 - Angle of Attack (AOA) failures are typically caused by faulty heating allowing
water to freeze in the mounting and preventing the vane (probe) from moving freely
(5.1 & 5.2). Dirt accumulation can also slow or cause erratic vane movement.
These failures are detected as a stall warning or stick-shaker activation during
rotation or an uncommanded pitch during climb or cruise. Faulty computer
programs can also cause pitch changes (5.3 through 5.5). Severe turbulence can

320
commonly cause momentary stall warning or stick-shaker activation, but this is not
an indication of a system malfunction.

6 - PT7/PT2 Engine Pressure Ratio (EPR) related failures are usually caused by
not turning on the engine anti-ice system. A bird strike on the PT2 pressure sensor
can also fail the system.
Taking off in icing conditions with the engine anti-ice off will cause the PT2 to
become obstructed and provide erroneous high EPR indications, preventing the
engines from reaching takeoff thrust (6).

7 - In flight, if encountering icing conditions with the engine anti-ice is off, the same
situation occurs but over a longer period. As the ice starts to block the PT2 probe,
the autothrottles slowly reduce thrust not to exceed this false EPR limit. Aircraft
speed will slowly bleed, and aircraft will increase pitch attempting to maintain
attitude until the aircraft stalls. This can also cause the engines to flameout (7.1
through 7.3).
Although ice crystals cannot form when the SAT is below -40°C, this does not
preclude them from existing at lower temperatures and higher altitudes. Strong
vertical air currents inside thunderstorms push ice crystals up through the top of
the cells. Upward ice crystals can affect an aircraft overflying a cell. As they are
blown by the wind and come down, they can affect an aircraft circumnavigating a
cell even 25nm away in clear weather, highlighting the need to have the engine
anti-ice turned on.

--- Airspeed Unreliable Checklist

On unpressurized aircraft, stuck altimetry may recover by creating an alternate
static source, e.g., breaking the glass of the VSI.

Some pressurized aircraft have alternate static source systems, usually inside the
radome or tail of the airplane. In these aircraft, an external sensors failure
(airspeed unreliable) can be resolved by flying with reference to a pitch and power
chart because altitude can be verified against reliable alternate altimetry.

On aircraft not equipped with alternate static sources, the Unreliable Airspeed
checklist is applicable when other reliable altimetry is available (e.g., GPS). Or the
failure is limited to a single pitot system (single bird strike), a procedure to fly with
reference to the two matching systems would still be valid.

Caution - Aircraft with frozen altimetry report this erroneous altitude from
TCAS and present false traffic separation to ATC and other aircraft.

Aircraft with access to absolute altitude (GPS), although its use is acceptable for
a short time, it is not a safe longer-term plan as other aircraft are flying barometric
altitude. Assume all traffic is at the same altitude as your aircraft and remain clear
of all traffic laterally. Declare Mayday, exit airspace and land ASAP.

321
From the numerous previous events up to that of Air France 447, it is noteworthy
that the recorded flight parameters and the accounts given by the crews did not
reveal any application of the memory items (AT/AP/FD OFF) from the airspeed
unreliable procedure, nor the procedure itself. In other words, there is no record
the Unreliable Airspeed procedure was ever used.

PART 2 - TAKEOFF FAILURES

Unreliable Data
• Indicated airspeed – Altimeters – Vertical speed, Capt. + F/O + STBY.
• Altitude information from ATC because it is reported by the aircraft.
• Ground speed from ATC is reliable as it is provided by ground radar. There is
a slight delay if the aircraft is turning as track updates with each sweep.
• Stall warning, stick-shaker, overspeed and windshear warnings.
• GPWS – (Except Modes 4A and 4B as they are radio altimeter based).
• TCAS commands (unreliable altimetry).
• Rudder ratio, auto-slats, aileron lockout, etc. Any information which has pitot-
static, AOA system input.
• Autopilot, Autothrottle and Flight Director will likely disconnect, however, if they
do not disconnect, turn them off.
The cockpit environment is overwhelmed with unreliable aural and visual
information. No clear identification of what to trust or disregard leads to pilot task
saturation.

Intentionally Left Blank

322
The biggest challenge will be to ignore the readings despite knowing they
are unreliable (fig.2)
TRY THIS:

Fig.2

PREVENTIVE STRATEGIES - Takeoff Phase

Takeoff Speed Cross-check
- Besides cross-checking IAS against each other, IAS needs to be checked against
Ground Speed (G/S).
- Before takeoff (e.g., at the gate with ATIS information), note the wind value and
calculate what G/S should be at the speed cross-check, then remember this value
and include it during the cross-check.

Ground Speed Calculation Examples

Example 1: Takeoff at sea level with no wind:
If IAS cross-check is performed at 100 knots, G/S should also be 100 knots.

Example 2: Density altitude increases True Air Speed (TAS) by about 3% per
1,000 feet of altitude, and so does G/S.

323
Condition: Take off from 5,000 ft field elevation, wind 30° off the nose, 15 knots.
At 100 knots IAS, G/S should be 115 knots with no wind. And with a 10-knot
headwind component, as in this example, G/S should be 105 knots.

8 - During takeoff/landing accidents, IAS has been lower than G/S. A large
difference between IAS and G/S is easily recognizable (8). Because of this under-
reading characteristic of pitot failures, monitoring G/S from the beginning of the
takeoff is advisable as it allows for earlier detection and a safer reject.

Pitot System (airspeed) Failure During Takeoff

Condition:
Failure is not detected during the takeoff roll, and aircraft becomes airborne with
unreliable IAS.

Response:
- Fly ground speed (G/S). Increasing it by 5 to 10 knots while climbing to traffic
pattern altitude will help compensate for density altitude and possible stronger
wind.
- Maintain flap configuration to minimize the need for power changes. Stay in
the traffic pattern and return for landing.
- Confirm pitot heat is on (and engine anti-ice protection if needed).

Caution - Using G/S is better than not having any speed reference, however, G/S
can only be used at low altitude where the aircraft speed range is high, and density
altitude and wind play a smaller role. The G/S variance could be substantial at
higher altitudes should an aircraft turn with or against the wind. Even at 5,000 feet,
50-knot winds are common on a windy day. At high altitudes, winds could be very
high (jet stream), and the aircraft speed range is low, leaving a narrow margin for
error.

If staying in the traffic pattern is not an option due to terrain or weather, plan a
flight to an alternate airport nearby at the lowest safe altitude to reduce the effects
of density altitude and wind on G/S.
If flying to an alternate airport, the use of turbulence recommended speed as target
speed will provide the largest speed safety margin (between minimum clean
maneuvering and maximum operating speed). Remember to declare Mayday and
advise ATC of speed if above 250 knots below 10,000 feet.

Intentionally Left Blank

324
When returning for landing and before selecting Flaps
9 - During approach and before calling for or selecting flaps, note altitude and wind
value and cross-check IAS with G/S to see if they make sense. If this practice is
used routinely, a difference between G/S and IAS will be noticed (9.1 & 9.2).
- Use ILS Glide Slope for speed reference.
If the present altitude is higher than Glide Slope intercept altitude, intercept Glide
Slope at this higher altitude, cross-checking altitude when passing FAF to confirm
not being in a false Glide Slope.
Once established on a 3° Glide Slope, vertical speed can be used to backup
ground speed (due to ILS geometry):
Request tower reported wind and adjust for IAS. Double VS two first digits to
approximate G/S, example:
• VS 600 feet = 120 knots ground speed.
• VS 700 feet = 140 knots ground speed.

Static System (Altimetry) Failure During Takeoff

If an altimetry failure occurs below Radio Altimeter (RA) range, use it to replace
barometric altimeters and fly within RA display capability to return for landing. The
assumption is the aircraft is likely to be in the vicinity of the airport in relatively flat
terrain.
If the terrain does not permit, or if RA indication has disappeared from view:

- Use Pressurization Panel for altitude and vertical speed.

Select pressurization to MANUAL mode and open outflow valve(s). This will
prevent aircraft from pressurizing (Same procedure as tail strike checklist).
The cabin altitude indicator will then function as an aircraft altimeter, and the cabin
vertical rate will serve as the aircraft vertical speed indicator, VSI.
If a return for landing is not possible, continue to a nearby airport at the lowest safe
altitude.
Note: - If experiencing a combined pitot-static failure, combine the procedures
above. Replace IAS with G/S and use pressurization panel for altimetry (after
depressurizing aircraft). If unable to return for immediate landing, use airspeed
unreliable climb and cruise tables (performance Chapter 5) to fly to a nearby
airport, preferably with ILS capability.
- Assure the TAT probe is functional before relying on power (thrust) information
by checking SAT or OAT against TAT (discussed next, in part 3).
Confirm pitot heat and engine anti-ice protection is on.

Intentionally Left Blank

325
 PART 3 - IN-FLIGHT FAILURES
Encounters with high-altitude ice crystals cause interference and failure of the
external sensors. Although crews know how to deal with ice conditions by turning
on ice protection systems, ice crystals encounters are not well understood.

Ice crystals events are predictable, as they have common characteristics

easy to identify, and we should understand them well.

--- Ice Crystals - High Probability Encounter

High altitude ice crystals reported incidents and accidents have happened in the
following five common circumstances:

- Flying above FL290 and especially between FL330 and FL400 (pitot-static
system designed for -40°C and up to FL295).

- Inside clouds (IMC).

- Thunderstorms were present within 30NM laterally, or aircraft was

overflying them.

- Light to strong turbulence (ice crystals coming from above or below).

- A SAT/OAT rapid rise of 10°C to 20°C or a rise to match TAT was recorded.
This is caused by the thermal insulation of the TAT probes. Thermal insulation
happens when severe icing exceeds the anti-icing capability of the TAT probe,
covering it with ice and reflecting its heating to the air trapped inside.

--- Avoid flying into an area that matches all five conditions above and
monitor both SAT and TAT for their normal temperature separation (select
both in view simultaneously).

Note: - Observation of St. Elmo’s Fire on windshields or emanating away from the
radome as a blue flame is an indication of a more severe ice crystal situation. Still,
in most cases, this was not observed.
10 - Examples of Ice Crystal Incidents (10.1 through 10.5).

RISK FACTORS

--- Coffin Corner (risk)

Jet aircraft typically cruise at optimum or target altitude, 1,500 to 2,000 feet below
the maximum altitude where the speed margin is narrow. Once at cruise, the use

326
of ice protection lowers maximum altitude. OPT or MAX CRZ ALT do not consider
the use of ice protection (fig.3).

Fig.3

Aircraft, where the external sensors were compromised, tend to climb inadvertently
above max altitude, sometimes in a few seconds, other times within two minutes,
and inevitably stalled. Altimetry may become unreliable (or frozen), and in some
incidents, pilots did not realize the gradual change in altitude. In other cases,
strong vertical currents pushed the aircraft quickly into an attitude beyond where a
pilot could control.

Above 20,000 feet, stall warning or stick-shaker activation may not occur until after
wing buffet. The pilots may not notice the wing buffet because high altitude ice
crystal encounters are always accompanied by turbulence (from vertical currents),
causing wing and airframe vibration. The crew will likely recognize they have
stalled (after the fact) when the aircraft is already in a deep stall.

--- Vertical Separation (risk)

Fig.4 - Note that two aircraft may only have 400 feet separation when deviating
from weather (wx red areas) following North Atlantic Track (NAT) system rules
(fig.5). Many factors may further reduce this separation. Even in smooth air, the
bank angle will reduce separation.
Turbulence affects aircraft differently according to size, weight, wing rigidity,
airplane speed and vertical wind speed, causing different rates of altitude change.
In other words, if two airplanes are flying on top of one another, do not assume

327
turbulence will cause them both to climb or descend equally, maintaining
separation.
Any divergence in altitude can cause a mid-air collision. TCAS or ATC radar (if on
radar environment) will not warn of an altitude conflict if altimeters are frozen.

Fig.4

Fig.5

328
--- Thrust Settings
Thrust information is unreliable too, due to TAT and EPR probes providing
erroneous information to the EEC’s, rendering N1 readings inaccurate. Attempting
to maintain speed and altitude with pitch control alone while having unreliable
airspeed, thrust and altimetry is an ill-advised procedure. At high altitude, do not
attempt to use ground speed as a speed reference. Even aircraft with alternate
GPS altitude capability while maintaining an absolute GPS altitude will deviate
from the assigned barometric altitude that keeps traffic separation.

Additionally, a TAT probe or Ice Crystal’s advisory, common during external

sensors icing events, calls for a power reduction and switches EEC’s to the
alternate mode. This change in thrust setting will affect speed, stabilizer trim and
vertical flight path, causing the aircraft to deviate from the previous altitude (with
no reliable altimetry to originate a correction).

- Observation (Capt. Vireilha): On a two-hour flight between Tampa, Florida (with

a high-pressure weather system) and New York (with a low-pressure), I noticed
GPS altitude to be approximately 2,000 feet lower while maintaining FL370
throughout the flight.

--- Idle Descent Chart

The safest course of action and the only reliable reference is to use the
recommended pitch and idle thrust from the Airspeed Unreliable, Idle
Descent chart in Section 5 Performance.

Example: Approaching area of possible ice crystals at FL350, prepare descent

card with known data: - i.e., weight 450 = Target Pitch of -0.2 (interpolate).
It is easier to have one made previously and available in your flight kit. See note 2
below.

329
--- Interpolated data - Speed breaks retracted - Idle thrust.
Lower cruise pitch to Target Pitch -0.2 (and start time to calculate descent).
Expected rate of descent: 2300 - Expected speed M.82/280
2:15 minutes from the start of descent, aircraft should be:
Passing FL300. Pitch up to +0.3 VS 1900 280 knots.
4:45 Passing FL250. Lower Pitch to +0.1 VS 1750 275 knots.
7:45 Passing FL200. Lower Pitch to 0.0 VS 1600 270 knots.

Note 1: - If your chart has altitude references every 10,000 feet, ask your technical
support to provide the chart with 5,000 feet increments. These charts exist, but I
have seen the 5,000-foot increment charts replaced with the 10,000-foot, perhaps
because the need is poorly understood.
Note 2: - Although it is important to build an accurate descent card, work with
approximate minutes and do not be concerned with exact seconds. This is not the
time to be “splitting hairs,” keep it simple.

IN-FLIGHT PREVENTIVE STRATEGIES

Prepare descent card when approaching convective areas.

11 - Monitor SAT/TAT ratio (temperature separation). This will alert you if the
airplane is being affected, and changes will happen within a few seconds. Be
prepared to act quickly (11).

Example: - TAT/SAT should be about 31° apart at Mach 83, or about 26° apart at
Mach 77, nearly 1° per M.01 of change. The determining factor is speed and not
altitude. If your aircraft cruises typically at the same speed, the difference will
always be the same (tested cruise altitudes were FL280-FL410).

12 - Use the radar to avoid the convective area altogether, deviating on the
upwind side*. Never penetrate convective areas with the intent to maneuver
around individual cells once inside. Thunderstorms feed on air that climbs
around them in a spring-coil-like movement, resulting in the air between cells
clashing and causing significant turbulence. Maintain a minimum distance of 30nm
from convective cells. The previously recommended separation of 20nm is no
longer adequate for today’s aircraft engines controlled by Electronic Engine
Computers.
* Outside of the convective area, ice crystals are found on the downwind side of
the cells.

- Do not fly over thunderstorms, since engines mounted under the wing are the
closest point and are therefore more susceptible to taking a direct lightning strike.
This condition has caused EECs to burn out, causing the engine to shut down and
prevent an in-flight restart*. Strong updrafts can cause an abrupt and extreme pitch

330
change and an uncontrolled climb to a stall. Air France 447 climbed at 7,000 feet
per minute. See Tupolev 154 FV612 (12)
* Researching our B756 and B737 fleets, I found each had lost one engine that
year due to a direct lightning strike in one engine. Although the engines were
designed to revert to in-flight idle, that was not the case once the EECs were burnt.

- Turn engine anti-ice ON to help protect EPR sensors from ice crystals. Although
some manuals may state that engine anti-ice is not required if the SAT is below
-40°C, that guidance does not consider the new knowledge concerning high
altitude ice crystals.

- Recall the “Target Pitch” value should the exit strategy become necessary.
Target Pitch is easy to remember because it only varies about 2° from a descent
started at a heavy weight at the beginning of the flight to the pitch approaching the
destination when the aircraft is much lighter. For example, the target pitch at a
heavy weight could be +1° versus -1° at a lighter weight for a particular aircraft
model.

- Recall the procedure on how to exit the track or route.

Switch TCAS to look down and display lower aircraft flight levels.

IN-FLIGHT EXIT STRATEGY

Suggestion: When initially entering Oceanic Controlled Airspace, inform ATC of a
desired R2 track offset, if track exit would be to the right (or no offset, if exit would
be to the left). This clears traffic safer and sooner if descent is needed.

If SAT rises rapidly by more than 10° or other external sensor indications are
unreliable, aircraft should exit the area.
- Turn OFF – AT / AP / FD.
- Declare Mayday (places everyone involved in the correct frame of mind).
- Switch TCAS altitude reporting OFF (preclude reporting erroneous altitude or
causing an erroneous TCAS Resolution Advisory - same as with an engine failure).
- If not in immediate VHF ATC contact, follow the track rules. Advise other traffic.

Once cleared of (TCAS) traffic* recall and fly Target Pitch. Retard thrust
levers to idle and start chronometer when the descent initiates**. Do not use
speed brakes, as this would invalidate chart data.
* In the meanwhile, use FPA 0.0 to maintain absolute altitude (for this short period,
it is inconsequential).
** Have monitoring pilot refer to the “Idle Descent” chart to verify and monitor
expected vertical speed versus elapsed time against chronometer, to keep track
of approximate altitude. This may be needed later if altimetry continues to be
unreliable or frozen.

331
Expect systems to recover. Previously reported incidents recovered their systems
between FL300 and FL270, once away from ice crystal conditions and flying into
warmer air (except Airbus aircraft, which remained in Alternate Law). Even if
systems recover, do not climb back into ice crystal conditions.

--- TAT Probe, Ice Crystals or similar advisory light.

This advisory light prompts the crew to a checklist intended to prevent an engine
exceedance and is likely to be on but could be out of view (EICAS page two).

Consider if this procedure is needed at this time, as while at idle thrust, there is no
risk of thrust exceedance. The procedure can be executed later at a lower altitude
and before advancing thrust to level off if advisory persists.
Note that if systems recover at a lower altitude and EECs have been turned to OFF
or ALT, there may be no provision to remind pilots to turn the EECs back on.

--- If systems do not recover:

As aircraft descends into thicker air (FL270/250), a slight pitch change will be
required to maintain speed, resulting in a decreased sink rate. Refer to the Idle
Descent chart and adjust pitch every 5,000 feet (every 2.5 - 3 minutes).

During high altitude ice crystals interference, the attitude indicator is the only
reliable flight instrument,* and precise pitch control is critical to fly speed as
accurately as possible and prevent structural damage to the aircraft (or stalling).
* Besides heading information.

Plan to use the pressurization panel for altimetry. Select Manual mode on the
pressurization control (do not use STBY). Open outflow valve(s) slowly and control
the cabin rate of climb to meet aircraft altitude at the desired altitude.

Example: - The aircraft is assumed to be passing FL250 (this is when the

chronometer timing plays its role*) and the intended level off altitude is FL150 (due
to terrain). Raising the cabin altitude at 2,000 feet per minute will depressurize
aircraft before reaching FL150. This allows the use of the cabin altitude indicator
for leveling off at FL150. (Be aware of passenger oxygen masks deployment and
make an early advisory announcement).
* About 5-6 minutes, if descent started from FL350-370. Be comfortable working
with ballpark numbers. Again, it is more important to accomplish the general plan
than to be slowed by details.

As aircraft descends and meets the rising cabin altitude, the aircraft will drag the
cabin and this will be sensed in our ears, confirming the aircraft is
depressurized. Outflow valve(s) can then be fully open.
Up to this point, a zero-differential does not necessarily mean the cabin is
depressurized if altimetry is still unreliable. Disregard the differential indication to
determine when aircraft meets cabin; rely on the feeling in your ears.

332
With the outflow valve(s) fully open, cabin altitude can be trusted as aircraft altitude
(check local QNH). The aircraft altimetry can only be trusted when:
- It matches the altitude and VSI indications on the pressurization panel, with the
outflow valve(s) fully open and a zero-differential pressure.

The Unreliable Airspeed Cruise chart can now be used. Check and insert QNH in
CDU or pressurization module at the appropriate time.

Exceptions: Aircraft with aneroid auto-override switches will close the outflow
valve once above 11,000 ft cabin altitude (even when the valve is manually open).
Air conditioning packs must be turned off if unpressurized flight is required. These
aircraft may have a descriptive procedure in the Tail Strike Checklist (e.g., B756).
Caution - Land ASAP regardless of recovery status to avoid a repeat event or
other unforeseen problems.

333
Note: - Because intentional unpressurized flight may become necessary during an
emergency, become familiar beforehand with the specific procedures, especially
for Unpressurized Flight above FL100 (aircraft manual and MEL). Note the
electronic compartment limitations, temperature warnings and recommendations.

RECAPPING
Takeoff (Part 2)
• Monitor G/S from the beginning of the takeoff roll. Be prepared to abort takeoff
if G/S cross-check detects IAS failure.
• If airborne, replace unreliable IAS with G/S (valid at low altitude only).
• Speed adjustment for altitude is approximately +3% per 1,000ft of climb.
• Stay within Radio Altimeter height and use it to replace altimeter.
• Use Manual Pressurization for altimeter and vertical speed.

When to Expect High Altitude Ice Crystals (Part 3)

• Flying above FL290 and especially between FL330 and FL400.
• In clouds (IMC).
• Thunderstorms within 30NM or when overflying them.
• Light to strong turbulence.
• SAT/OAT rise of 10° to 20°C or a rise to match TAT.
• St. Elmo’s Fire, although confirming a more severe case of ice crystals, is not
observed in most cases.

How to Prepare When at Cruise

• Monitor TAT/SAT ratio.
• Revisit Idle Descent hart procedure and recall target pitch (or use card).
• Switch TCAS to look down and display lower aircraft flight levels.
• Engine anti-ice on (this may lower Optimum and Max Altitudes, check specifics
for your aircraft).

Exit - Idle Descent

• Start procedure to exit the track at the first indication of failure, likely the
TAT/SAT ratio. Multiple failures sequence will happen in seconds. It is best to
avoid the area as per the indications above and in Part 3.
• Turn OFF – AT / AP / FD.
• Declare Mayday and turn altitude reporting OFF.
• Once cleared of (TCAS) traffic, recall and fly Target Pitch, retard thrust
levers to idle and start chronometer when the descent initiates.
• Expect* and check for systems recovery during descent, possibly between
FL300 and FL270.

334
* Do not expect full recovery from high altitude ice crystals interference on Airbus
aircraft. In all reported events (Addendum 1), Airbus planes remained in alternate
law. There were two exceptions of partial and temporary nature, both on A330,
TAM 8091 (see 10.1) and Northwest 8 (see 10.3).
Caution - A temporary recovery can mislead the crew deeper into an already
critical situation.

If Systems Do Not Recover

Intermediate Cruise - Approach and Landing
• Manual control of cabin rate of climb until aircraft altitude meets cabin altitude.
Then open outflow valve(s) and use cabin altitude as aircraft altimeter.
• Land ASAP.
• For cruise data, refer to the Unreliable Airspeed Cruise chart in Chapter 5.
• Before selecting flaps for approach, verify G/S makes sense when checked
against wind and altitude.
• Use ILS Glide Slope for speed reference.

Intentionally Left Blank

335
 PART 4 - INCIDENT EVENTS
(Module 11 - External Sensors Failures)
Note: - The number preceding each report refers to the point number in this
Module’s narrative (Parts 1, 2 or 3), where the event is mentioned.

1.1 ---
Lear Jet 25B N1JR - Waterville 1984-07-28
https://aviation-safety.net/database/record.php?id=19840728-0
During rotation, stick-shaker activates. A rejected takeoff is initiated, but the
airplane crashes at the end of the runway.
- During preflight, the pilots forgot to remove the pitot tube covers, and during
takeoff, the pilots did not cross-check the airspeed indications.
Observations (Capt. Vireilha): - An airspeed alive call may prevent a higher
speed reject. Consider that at high-altitude airports, a plane will have substantial
groundspeed before airspeed becomes alive.

1.2 ---
UPS B747 - N520UP - Dublin 2000-05-12
https://www.fss.aero/accident-reports/look.php?report_key=576
Soon after liftoff, the flight encounters two windshear warnings while in IMC, with
all pitot-static information matching. However, speeds are bleeding, although
matching. The pilots execute windshear procedures correctly and maintain full
power. Airframe vibration is felt shortly afterward, leading the pilots to believe they
are experiencing a stall buffet. Flying out of the clouds into visual conditions, they
realize they are climbing at high speed. - The vibration was caused by structural
damage to the flaps by overspeed (under-reading of IAS), causing jammed flaps.
The aircraft diverted in visual conditions to another airport for a safe landing.
- The pitot-static system drains were left unplugged by maintenance, allowing
pressurized air into the system, causing all IAS to match and under-read.
Observations (Capt. Vireilha): - An IAS cross-check against ground speed
during the takeoff would have prevented this event.

1.3 ---
SAS 370 - DC9-21 - Oslo 1973-01-30
https://aviation-safety.net/database/record.php?id=19730130-1
During rotation, stick-shaker activates. The takeoff is rejected at 140 knots
(under-reading of IAS) the reversers fail to deploy, and the aircraft overshoots the
runway into fjord and sinks.
- Stick-shaker activation was written up in the previous two days, and it was later
discovered that it was caused by icing of the pitot tubes and AOA probes due to
partial failure of their heating systems.
- Is there an annunciation in your cockpit for a partial heat failure?

336
1.4 ---
Northwest 6231 - B727 - JFK 1974-12-01
http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR75-
13.pdf
On a lightweight charter flight, climbing through FL240, the pilots commented on
the extraordinary performance while pulling the nose-up to control the ever-
increasing speed. Reaching 30° nose-up and 412 knots IAS (165 knots
calculated), the aircraft stalls and develops a steep high-speed spiral descent with
as much as 60° nose-down. As the elevator controls were held nose-up, the angle
of attack remained at 22°, keeping the plane in a stall to the ground.
- The pitot heat system was not activated due to missed checklist items.
- Observation (Capt. Vireilha):
When a paper checklist reading is interrupted, the pilots should read the checklist
from the beginning (not necessary for electronic checklists). Fatalities: all on board.

1.5 ---
Continental 795 - MD80 LGA 1994-03-02
https://reports.aviation-safety.net/1994/19940302-0_MD82_N18835.pdf
During takeoff, IAS increased to 80 knots and then returned to 60 knots indicated
while the plane accelerated. The takeoff was rejected, but the speed was 5 knots
above V1 at the reject point (under-reading of IAS). The aircraft was substantially
damaged when it reached the retainer wall at the end of the runway.
- Pitot heat was not activated during preflight due to missed checklist items.

337
1.6 ---
Turkish 5904 - B737 - Turkey 1999-04-07
https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_5904
Nine minutes after takeoff into a thunderstorm area, the aircraft crashed vertically
into the ground.
- Pitot heat was not activated during preflight due to missed checklist items.
(Fatalities: all on board).

1.7 ---
USAF B2 bomber - Guam 2008-02-23
Video: https://www.youtube.com/watch?v=8ZB-iziY2Bw
https://en.wikipedia.org/wiki/2008_Andersen_Air_Force_Base_B-2_accident
During takeoff, moisture in 3 air pressure sensors caused false IAS leading to a
premature rotation (12 knots too slow). False-negative AOA indications caused the
flight computers to command a 30° pitch up. Combined with the low takeoff speed,
these factors caused the bomber to stall and crash shortly after rotation.
A previous moisture problem with another B2 on the same base caused a rejected
takeoff at 70 knots while the pitot heat was selected off. A second takeoff was
successful after turning the pitot heat on.

1.8 ---
Aeroflot TU-154 CCCP-85327 - Moscow 1986-05-21
https://aviation-safety.net/database/record.php?id=19860521-2
The airliner passed a zone of heavy rainfall and icing during the descent, and IAS
went to zero. The crew immediately added full power and lowered the nose further.
During the subsequent recovery the airplane pulled 3.2g, causing substantial
structural damage, and the airplane was written off after landing.
- Pitot heat was not activated during preflight due to missed checklist items.

1.9 ---
United 23 - B757 - Dublin 2013-10-20
https://avherald.com/h?article=46a38136&opt=0
A reported severe turbulence accident is, in fact, an unreliable airspeed event.
During descent in turbulence through FL250, speed dropped to 125 and then to 90
knots, prompting the co-pilot to push the aircraft nose-down to -16.2° and applying
full power. During the recovery maneuvers, vertical speed reached 12,000ft/min
descent, maximum speed (Vmo) was exceeded by 30 knots and G forces varied
from -0.36g to 1.72g (17 injured people, loss of one hydraulic system and damage
to the wing and body fairings).

338
1.10 ---
TWA 843 - L1011 - JFK 1992-07-30
http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR93-
04.pdf
The stick-shaker activates during rotation. The takeoff is rejected, and the plane
touched down after being airborne for six seconds. The airplane overruns the
runway and is destroyed in the subsequent fire.
The Angle of Attack (AOA) sensor had experienced nine previous malfunctions.
The intermittent malfunction was not detectable during preflight tests. The sensor
caused a false warning when the ground-air sensor on the landing gear went into
air-mode on takeoff.

3 ---
BirgenAir 301 - B757 - Puerto Plata 1996-02-06
Note that the report in English follows the Spanish report.
https://reports.aviation-safety.net/1996/19960206-0_B752_TC-GEN.pdf
During takeoff at 80 knots, the Captain recognizes his IAS is not working. He opts
to continue the takeoff with the F/O’s IAS. Soon after takeoff, the A/P is engaged
while an overspeed indication is active, A/T retards to idle thrust, AC pitches up,
left engine stalls, and the aircraft rolls to the left, crashing inverted into the ocean.
The flight lasted 5 minutes.
- The Pitot tube was obstructed by insects. It was left uncovered for 3-4 days before
this flight. (Fatalities: all on board).
- Observation (Capt. Vireilha): What is the purpose of the takeoff speed cross-
check, if not to initiate a reject, if speeds differ by more than a few knots?

A study of the CVR pilots’ interactions is recommended.

The Spanish report pages are not numbered, but the CVR transcript starts with
“Anexo 2” about 20% into the report (note scrolling reference on the right side of
the page). Also, note at time 03:46:59, the left engine rollback (EPR decrease and

339
EGT increase) and aircraft switching from a 6.5° nose-up and 8.3° right bank, to a
53.3° nose-down and 99.8° left bank.

See ATSB report 200601453 (Rejected takeoff, Brisbane Airport, Qld, 19 March
2006, VH-QPB, Airbus) for another example of pitot blockages by insect nests.
https://www.atsb.gov.au/publications/investigation_reports/2006/aair/aair2006014
53/

4.1 ---
AeroPeru 603 - B757 - Lima 1996-10-02
https://en.wikipedia.org/wiki/Aeroperú_Flight_603
During rotation, the pilots receive conflicting indications of IAS and altimeters
followed by Windshear, Rudder Ratio, Mach Trim, Overspeed, stick-shaker,
warning alert tones and GPWS. After flying for 30 minutes, the aircraft crashed
inverted into the ocean.
- Three static ports on the left side were obstructed by masking tape.
(Fatalities: all on board).
Study of the CVR pilots’ interactions is recommended.
https://www.tailstrike.com/021096.htm

4.2 ---
LOT 2 B767 - Toronto 2009-06-19
https://www.aviation-accidents.net/report-download.php?id=460
At FL330, in light to moderate turbulence, the altimeter jumps up 450 feet with an
overspeed warning. The autopilot attempts to maintain altitude by pitching down
2°, and the Captain disconnects the autothrottle (but not the autopilot) and reduces
thrust to idle. Autopilot pitches further down to 4°, followed by an 8° pitch up. The
Captain disconnects the autopilot and pitches up to 12° with thrust at idle and
climbs 2400 feet to FL354. The overspeed warning stops. Moments later, a second
overspeed is triggered, followed by the stick-shaker causing the aircraft to descend
5500 feet to FL279. Speeds varied between 276 to 339 to 190 knots.

The plane diverted to Toronto, and while holding at 10,000 feet to burn fuel with
autopilot on but autothrottle off, stick-shaker activates and aircraft sinks to 9,600
feet. The aircraft climbs to 10,500 feet during manual recovery, causing the plane
above it to respond to a TCAS Resolution Advisory.
There was no structural damage to the aircraft, nor were any faults in the air data
system identified. The plane was released back into service.
- Three days later, a similar event took place with the same aircraft. This time,
during an examination of the ADC, it was noted that there was a significant build-
up of dust and dirt inside the unit (due to improper air filter maintenance), which
caused an increase in the internal temperature and invalid indications.

340
4.3 ---
Qantas 72 - Airbus 330 - Indian Ocean Australia 2008-10-07
Captain’s debrief five-minute video link:
Video: https://www.youtube.com/watch?v=2cSh_Wo_mcY
https://reports.aviation-safety.net/2008/20081007-0_A333_VH-QPA.pdf
Cruising at 37,000 ft, the autopilot disconnected. That was accompanied by
various aircraft system failure indications and the aircraft abruptly pitched nose-
down 8.4° and descended 650 ft. Two minutes later, the aircraft had a second
uncommanded pitch-down event of 3.5° and descended 400 ft.

Multiple angle of attack (AOA) spikes from only one of the three air data inertial
reference units (ADIRU) resulted in the nose-down elevator commands. The
ADIRU sent data to other systems swapping the identifier label, and altitude data
was labeled as AOA data. This was a repeat event for this aircraft VH-QPA; the
first one occurred on 2006-09-12. A third event occurred on 2008-12-27 with
aircraft VH-QPG.

The Qantas 72 accident caused 110 of the 303 passengers and nine of the 12
crewmembers to be injured, 12 of the occupants were seriously injured, and
another 39 received hospital medical treatment.

5.1 ---
XL German Airlines 888 - Airbus 320 - Perpignan 2008-11-27
https://reports.aviation-safety.net/2008/20081127-0_A320_D-AXLA.pdf
Ice blockage of the angle of attack sensors caused the plane to stall during an
approach to a stall test, from which it did not recover. (Fatalities: all on board).

5.2 ---
Lufthansa 1829 - Airbus 321 - Bilbao 2014-11-05
https://avherald.com/h?article=47d74074&opt=0
AOA 1 and 2 froze at FL310 during the climb. Aircraft logic disregarded different
but correct AOA 3 data, pitching aircraft down at 4,000 ft/min, causing an
uncontrolled descent to FL270 before the pilots could turn off ADR’s.

5.3 ---
Malaysia 124 - B777 - Australia 2005-08-01
Australian Transportation Safety Bureau video link:
Video: https://www.youtube.com/watch?v=1XNnEzFF5fg
A software error causes a false overspeed warning at FL380 and triggers autopilot
to pitch up and climb to FL410. Speed decayed from 270 knots to 158 knots,
followed by a stall. The aircraft recovered and returned to Perth safely.

341
5.4 ---
Lion Air 610 - B738 MAX - Jakarta 2018-10-29
http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/2018%20-%20035%20-%20PK-
LQP%20Final%20Report.pdf
A software error of the Maneuvering Characteristics Augmentation System causes
the aircraft to pitch down and crash after takeoff. A similar event happened on the
previous flight, although the jump seat pilot turned the system off. Maintenance
released aircraft without proper troubleshooting. (Fatalities: all on board).
See observations below, on Ethiopian 302.

5.5 ---
Ethiopian 302 - B738 MAX - Addis Ababa 2019-03-10
https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-AVJ_Interim.pdf
A software error of the Maneuvering Characteristics Augmentation System causes
aircraft to crash after takeoff due to the MCAS’ commanded pitch down. The pilots
turned the MCAS off however, they did not reduce thrust from takeoff power, and
the plane continued to increase speed. This made it impossible to trim the pitch
manually (attempting to turn the stabilizer jackscrew under pressure from high-
speed loads on the stabilizer). The pilots then reengaged MCAS, which re-initiated
the undesired command for pitch down. (Fatalities: all on board).
Observations (Capt. Vireilha):
Both Lion Air 610 and Ethiopian 302 accidents were caused by a design flaw
motivated by marketing cost savings (346 fatalities), as discussed previously in
M1P3 - Management Errors.
However, the Lion Air crew was aware a problem had occurred on the previous
flight, and the Captain could have, before the flight, briefed and prepare to handle
a reoccurrence. The Ethiopian crew had ample opportunity to prepare for this
failure. Had these crews been prepared, both events would have been simply an
abnormal event without the unnecessary loss of 346 lives. This failure is further
discussed in M13P1 - Runaway Stabilizer.

6 ---
Air Florida 90 - B737 - Washington 1982-01-13
http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR82-
08.pdf
After leaving ground effect during takeoff, the aircraft settles back, impacting a
bridge. Takeoff thrust was improperly set due to EPR sensors freezing.
- Full power was never applied even when the crew realized they were going to
hit the ground. The engine anti-ice system was not activated during the after-start
checklist for lack of familiarity with icing events (fatalities 78).

342
7.1 ---
West Caribbean 708 - MD82 - Venezuela 2005-08-16
https://reports.aviation-safety.net/2005/20050816-0_MD82_HK-4374X.pdf
Cruising at FL330 in icing conditions in the proximity of a thunderstorm, the aircraft
is at max altitude for weight. The pilots are using the engine anti-ice intermittently
to maintain speed and altitude.
Freezing of the EPR probes causes EPR indication to increase to the limit with
consequent trust reduction (A/T on). Pitch is up at 7.5°, and the speed has
decelerated to Mach .67 with max climb power indicated (false indication).
The crew starts a descent with a high angle of attack (wing disrupting airflow to the
engines and horizontal stabilizer), and one engine fails, followed by the other at
FL310. Aircraft enters a deep stall and at FL250, IAS is 150 knots and VS is 7,000
feet per minute, increasing to 12,000 fpm until impacting the ground.
(Fatalities: all on board).
Note - WCA 708 accident report also references a similar event with a SAS MD81
in 1998, where at FL330, autothrottle reduced thrust gradually with consequent
speed loss, autopilot increased attitude to maintain altitude, leading to a stall and
flameout of both engines. The crew was able to recover from the stall and restart
both engines.
See observations below Swift Air 5017.

7.2 ---
Spirit Airlines 970 - MD82 - Wichita 2002-06-04
https://reports.aviation-safety.net/2002/20020604-0_MD82_N823NK.pdf
The aircraft experienced a gradual loss of power in both of its engines while
cruising at FL330. The aural stall warning and stick-shaker activated. The pilots
disengaged the autopilot, turned on the engines’ ignition, activated the engines’
anti-ice system, and initiated a descent towards Wichita. The pilots shut down the
right engine when its exhaust gas temperature (EGT) increased to about 600°C
and could restart it again on the second attempt at about 17,000 feet. The left
engine recovered on its own shortly after that.
Cause (from report): - “The flight crew's failure to verify the engine instrument
indications and powerplant controls while on autopilot with the autothrottles
engaged, and their failure to recognize the drop in airspeed which led to an
aerodynamic stall associated with the reduction in engine power. Factors were the
presence of ice crystals at altitude and the icing of the engine inlet probes, resulting
in a false engine pressure ratio indication.”
See observations below Swift Air 5017.

7.3 ---
Swift Air 5017 - MD83 - Mali (Air Algérie) 2014-07-24
https://reports.aviation-safety.net/2014/20140724-0_MD83_EC-LTV.pdf
The flight was deviating from a convective system at FL310, with none of the anti-
ice systems activated. While remaining on the convective system’s edge, PT2 icing

343
caused thrust reduction, speed decrease from 280 to 200 knots and aircraft stall
with no recovery.
(Fatalities: all on board).

Observations (Capt. Vireilha):

In these examples of similar events (West Caribbean 708, SAS MD81, Spirit
Airlines 970 and Swift Air 5017), the crews did not notice the slow degradation of
their flight performance. They were likely distracted by a typical chain of events:
- An en route encounter with a weather system. Circumnavigating the area is not
planned early when first detected, and the flight continues to approach it until the
crew feels compelled to fly through it.
- The misuse of the “Weather Avoidance Radar,” not to avoid the weather system,
but to penetrate it and then try to find a passage between cells. At low altitudes,
this can lead to a tornado encounter. See M13P2 - Flying into a Tornado.

The following image is of SwiftAir 5017’s filed route in green, ATC’s last cleared
route in light blue and the actual route flown in dark blue. A further left deviation of
30 NM would have allowed the flight to stay in the clear. The red square indicates
where the aircraft was found.

8 ---
Dornier 328 Twin Jet N328PD - Manassas VA 2006-06-03
https://reports.aviation-safety.net/2006/20060603-1_D328_N328PD.pdf
The takeoff was rejected at 78 knots due to an “IAS miscompare” advisory. The
actual speed was 152 knots (under-reading of IAS), and the plane crashed through
an airport fence and a road.
Cause: - Partially blocked pitot system.
Observations (Capt. Vireilha):

344
A ground speed check during takeoff would have prevented this event. The fact
that GS was nearly double the indicated airspeed should have been apparent.

9.1 ---
Austral 2553 - DC9 - Buenos Aires 1997-10-10
https://reports.aviation-safety.net/1997/19971010-0_DC93_LV-WEG.pdf
Slats were selected descending through stormy weather at an IAS of 200 knots
(under-reading of IAS). Four seconds later, as slats were deploying, the IAS
jumped to 450 knots (as ice cleared away from the probes), causing slat
asymmetry and an uncontrolled descent until impacting the ground.
Cause: - Icing of pitot tubes during descent. (Fatalities: all on board).
See observations below FedEx 87.

9.2 ---
FedEx 87 - MD11 - Subic Bay 1999-10-17
https://aviation-safety.net/database/record.php?id=19991017-0
Clogged pitot tube drain holes cause IAS to under-read during descent, approach
and landing. The aircraft was about 100 knots faster than IAS and overshoots the
runway, sinking in Subic Bay.
Observations (Capt. Vireilha): - An IAS cross-check against ground speed
before flap selection could have prevented Austral 2553 and FedEx 87 accidents.

10.1 ---
TAM 8091 - Airbus 330 - Miami 2009-05-21
https://avherald.com/h?article=41bb988a&opt=0
At FL370 in moderate turbulence, St Elmo’s Fire is noticed, and a rapid SAT drop
is recorded. Captain’s IAS drops from 260 knots to 60 then increases to 100 knots.
Aircraft descended to FL365 and then climbed to FL380. First Officer’s data then
matched Captain’s data, and AP/AT disconnected.
Aircraft diverged away from the weather, and after 5 minutes, primary data was
restored, but flight remained in alternate law and displayed a rudder travel limit
flag. The data recorder showed a brief blockage of probes.

10.2 ---
Air France 447 - Airbus 330 - S. Atlantic 2009-06-01
https://reports.aviation-safety.net/2009/20090601-0_A332_F-GZCP.pdf
At FL350, the aircraft penetrates a convective area and external sensors freeze.
IAS drops, A/P, A/T and F/D disconnect, aircraft climbs to FL380, stalls and does
not recover.
Similar to Air Asia 8501 - Airbus 322 - Java Sea 2014-12-28.
https://reports.aviation-safety.net/2014/20141228-0_A320_PK-AXC.pdf
(Fatalities: all on board on both accidents).

345
Air France 447 required a significant deviation to avoid a massive weather system,
and he would not have adequate fuel to reach Paris if he did that. The Captain
could have added fuel before departing Rio de Janeiro, or he could have gone
around the weather and then landed in Africa to add fuel, taking a two-hour delay.
Could either of these decisions cause him to be questioned by his chief pilot?
Could this added pressure have influenced him?

The following image represents AF 447 route for approximately 400 km through a
line of weather.

10.3 ---
Northwest 8 - Airbus 330 - Tokyo 2009-06-23
https://avherald.com/h?article=41bb9740&opt=0
At FL390 in moderate turbulence, 25nm away from convective cells but in clouds,
A/P & A/T disconnect and aircraft switches to Alternate Law. The plane has large
speed and small altitude fluctuations, and overspeed warnings. Crew exits the
weather, and the aircraft returned to Normal Law, however, the event quickly
repeated itself, and the airplane remained in Alternate Law for the rest of the flight.
Cause: - Brief blockage of the pitot probes.

10.4 ---
Jet Star 7 - B787 - Darwin 2015-12-21
https://avherald.com/h?article=49126557&opt=0
At FL400, the plane encounters speed fluctuations and difficulty maintaining
altitude due to ice crystal icing of the pitot-static systems.

346
10.5 ---
Additional incidents mentioned on AF 447 accident reports 2, 3
and 4 final:
Between May and Oct 2008, there were nine incidents with Air France Airbuses,
one Lufthansa A320, eight incidents on B777, three on B767, one on B757 and
one on a B747. One Airbus in a holding pattern in Europe stalled and descended
thousands of feet across other aircraft’s holding patterns before recovering.
There were also multiple cases with the Airbus family under the Australian registry.

11 ---
Jet Star 12 - A330 - Pacific Ocean 2009-03-15 & 2009-10-28
(Same aircraft VB-EBA in two similar events).
2009-03-15 Incident report link:
https://avherald.com/h?article=436d8f56&opt=0
2009-10-28 Incident report link:
https://avherald.com/h?article=421fb22e&opt=0

Note that TAT/SAT come together at time 15:37:15 to illustrate the temperature
ratio of a blocked system and the long-lasting effects on normal law from a brief (6
seconds) blockage of probes.

347
12 ---
Tupolev 154 FV612 - Russia 2006-08-22
Video: https://www.youtube.com/watch?v=9uJHIzXQWXk
https://avherald.com/h?article=3e72a756/0016&opt=0
While flying over a thunderstorm, the airliner was pushed up from FL359 to FL384
in 10 seconds with a 46° nose-up attitude. With zero IAS, the airplane stalled and
entered a flat spin until impacting the ground.

Intentionally Left Blank

348
 ADDENDUM - USE OF FPV SYSTEM
Flight Path Vector System
Airbus family cannot use the FPV system. See descriptive note from Airbus (next
page).
Other aircraft need to verify specific engineering for system options. Usually, there
is a statement in the Airspeed Unreliable checklist instructing to use or not to use
the system. It depends on how the FPV system uses barometric vertical speed
input as a source.

The FPV system can be very helpful during a pitot-static systems

failure:
The FPI is an additional confirmation of a positive rate of climb during rotation (Vr)
if the static system is blocked (frozen or erratic altimeter or IVSI).

Do not attempt to use FPA 0.0 to maintain barometric altitude accurately. The
system has no memory. If the airplane was displaced from the original altitude
(turbulence), it would not correct and return to the previous altitude. It would just
reset (0.0) to a new absolute altitude, not barometric altitude.

Use of Autopilot in Flight Path Angle for a pitch mode: during the exit strategy
descent, the A/P could be engaged using FPA for pitch and HDG SEL for roll (leave
A/T OFF, throttles at idle and speed brakes retracted so as not to invalidate the
“Descent-at-idle” chart). Being able to use the A/P in FPA would significantly
reduce crew workload.

Recommended pitch is not the same as FPA. The recommended pitch is the target
aircraft's nose-up or down attitude to achieve the desired path (a negative number)
with a resultant IAS and VS.
If you use the FPV system regularly, you may have noticed that your aircraft may
display, for example, a 2.5° angle of attack during idle descent (path could be -2.5°
below pitch).
From the “Airspeed Unreliable Idle Descent” chart, verify recommended pitch for
weight and altitude, then adjust (subtract) this 2.5 ° from the recommended pitch,
and this number becomes the target FPA.

For example, the recommended pitch is 0.7°, minus typical idle descent AOA of
2.5° (negative entry) equals -1.8°. This number can be set on the FPA window,
and it will be easier to fly accurately on A/P. Verify selection to be FPA and not VS.

349
Note from Capt. Vireilha:
The following is the response received from Airbus regarding their FPV system.

AIRBUS FLIGHT PATH VECTOR SYSTEM

On Airbus A330/A340 and A320 families, the FPV computation is as follows:
1. Definition of the FPV:
The Flight Path Vector (FPV) is a flying reference, which indicates the
instantaneous trajectory of the aircraft.
The two essential parameters which define the FPV are:
- The aircraft Track (TRK)
- The aircraft Flight Path Angle (FPA)

2. Computation of the Track (TRK) and the Flight Path Angle (FPA):
A. Computation of the Track (TRK)
The Track is computed with inertial data only.
B. Computation of the Flight Path Angle (FPA)
The FPA is defined as follows:
FPA = Arctan [(V/S) / (G/S)]
With:
- G/S = the ground speed - measured by accelerometers of the IR
- V/S = the Baro-inertial Vertical Speed (also called Vzbi = Vz Baro-inertial) -
see 3 below

3. Computation of the Baro-inertial Vertical Speed:

The IR software contains a baro-inertial loop to compute the Inertial Vertical Speed
and Inertial Altitude. This loop permits to take advantage of the different qualities
of the inertial and air data systems.
Indeed, the inertial vertical speed is computed by an integration of the vertical axis
of the velocity differential equation. However, this integration leads to a vertical
velocity that is unstable.
Thus, the vertical velocity rate and altitude rate integrations need to be stabilized
by an external altitude reference. This external reference is the pressure altitude
from ADR (label 203). By combining these two terms, a stable estimate is obtained.
To sum up, the IR brings its better behavior in dynamic maneuvers (integrating the
velocity differential equation) while the ADR brings its stability in time (using the
pressure altitude).
Please be aware that certain ADIRU standards (evolution) offer a better availability
of the FPV. Indeed, thanks to GPIRS input, the hybrid vertical parameters (FPA,
vertical speed and altitude) are still computed and emit Normal Operation in case
of total air data outage. In this case, the Hybrid Flight Path Angle is temporarily
substituted to the classic FPA label and then transmitted to be displayed as a
backup parameter.

350
MODULE 12 - FUEL FREEZING AND WATER
ICING

SUMMARY
This paper describes the characteristics of fuel freezing and water icing and how
they affect flight. It explains why aircraft routinely and unknowingly fly with
contaminated fuel and why at “Top of Descent,” not all displayed fuel is available.
The study presents strategies on how to protect the flight.

Note from Capt. Vireilha:

This paper is the result of my research, with the collaboration of my flight crews
and the maintenance departments of Continental Airlines and United Airlines,
between 1992 and 2012. For those 20 years, I took notes of the fuel temperature
on most flights:

- Before aircraft was refueled and after loading new fuel.

- After normal and high-speed climbs (250 knots to 10,000 ft or FL100 - climb
speed 280 minimum, to 340 knots) and at relevant intervals FL180, FL230, FL280,
step climb cruise altitudes and TOC (top of climb).

- During cruise flight, I logged the fuel temperature every hour to monitor the
cooling rate and have the data to predict if the flight would be at risk of a fuel-
freezing situation.

- I also recorded temperatures at TOD (top of descent) and the arrival gate.
This data was collected on the United/Continental domestic and international
routes on the B747, B777, DC10, B756 and B737NG aircraft. It included the polar
flights on the B777.

I first suspected a fuel-freezing situation in 1992 on a B747-200 flight between

Honolulu and Tokyo. The fuel in the right tip tank did not gravity feed into the next
tank, so we lost the use of those 8700 pounds. I recalled that when I was becoming
a B747 Captain, the training department had mentioned that this rare occurrence
was attributed to the valve in the tip tank freezing. Wanting to confirm the cause,
when we arrived in Tokyo, I had maintenance walk the right wing with me to open
the panel and look inside the tip tank. We found the tank filled with frozen slush.
Chunks of ice were blocking the fuel line. That convinced me that there was more
to this than the fuel valve freezing.
The following year, this time on a DC10 between Honolulu and Guam, the 5600
pounds of fuel on the tip tank did not transfer, making the flight fuel critical. The
commonality between these two flights was that in both cases, I was trying to

351
escape powerful headwinds and climbed to maximum altitude early in the flight.
This exposed the flight to colder temperatures for a much longer time. The
increased fuel consumption caused the wing fuel to start being used sooner, and
the smaller volume cooled faster.

Glossary
Cooling Rate is the drop in fuel temperature measured in degrees per hour.
Ullage is the space inside of a fuel tank not filled by fluids.
Note: - In this Module, fuel freezing is sometimes referred to as slush and water
Icing.

What Is Fuel Freezing and Water Icing

And What Is the Concern?

- Fuel Freezing is the solidification of kerosene from its liquid stage into wax
crystals with the appearance of slush. As the fuel temperature decreases below
the specific fuel freezing temperature of the fuel being used, its viscosity increases
and wax crystals are formed, increasing in size and concentration with further
cooling.

- Water Icing is the freezing of water that has infiltrated the fuel system.
A concern is that these solid particles may enter the fuel line at the tank level and
cause a partial or total blockage. This would prevent wingtip fuel from transferring
to another tank and becoming unavailable for the flight or prevent fuel from any
wing tank from reaching the engines.

Another concern is that the indicated fuel quantity at top of descent will be higher
than the available fuel. Not only does the “slush/ice” occupy more volume than
liquid fuel, but it is also not usable fuel.

These concerns are mainly with the fuel supply coming from tanks in the wings or
horizontal stabilizers, the coldest fuel on board. (I did not conduct any studies on
aircraft with fuel tanks in the horizontal stabilizers).

--- Fuel Freezing – How Does It Happen?

When the integral wing tanks are full, fuel is in physical contact with both the upper
and lower wing surfaces and thus affected by their temperatures. These are
subjected to thermal heating due to compression and friction of the air at the wing
leading edge. Wing surface temperature will be colder than TAT but warmer than
OAT.

There are significant time-dependent aspects because cooling is most rapid when
fuel is warmer at the start of any flight when it has more heat to lose. Other factors
affecting wing fuel temperature are heat exchangers, fuel pumps, wing anti-ice,
heat transfer from engine pylon, etc.

352
The effect caused by the sun heating the wings in the thin air at high altitudes is
noteworthy. At sea level, with the earth’s atmosphere above, the difference in
temperature taken in the sun or the shade is only a few degrees. Remarkably,
astronauts working outside of the Space Shuttle encountered temperature
differences in their suits of about 400ºF; from +200º on the side exposed to the
sun to -200ºF on the side in the shade.
At the cruise altitudes of jet aircraft, with only the less-dense layer of the
atmosphere above as protection, the temperature difference will be enough to
differentiate between the scalding aircraft cabin window shades exposed to the
sun and the frigid ones on the shady side. The same effect occurs with the upper
wing surfaces, one exposed to the sun and the other wing, or part of it, in the shade
of the fuselage. Some aircraft only have fuel temperature readings on one wing,
considered by the factory to be the one with the coldest fuel due to less exposure
to the heat exchangers, fuel pumps, etc. In reality, the coldest fuel may well be in
the wing in the shade of the fuselage, which may or may not have a fuel
temperature reading.

As wing fuel starts to be used, the level of fuel in the wing decreases, allowing
outside air to fill the ullage. The thermal heating benefit from the upper wing skin
is then lost, and the fuel’s top layer will be exposed to the outside air temperature
(OAT), which can be much colder than the fuel freezing temperature. The first wax
crystals begin to form, creating a thin layer of slush before the remaining fuel is
near its freezing temperature.

Once wax crystals form, the thawing time will vary with the outside temperature
and layover time on the ground. A typical 30-minute descent will not provide
sufficient fuel temperature increase to liquefy the slush present, and this solid fuel
cannot be relied upon to supply the engines.

--- Water Icing – How Does It Happen?

Water enters the fuel tanks as condensation through air vents (warm moist air/cold
wing combination) or rainwater or other forms of contamination (fuel source), and
most will sink to the bottom. Yet some water will stay on the walls of the ullage part
of the tank. This water will take longer to reach the bottom, and if not drained from
the fuel tanks, it will continue onto the next flight. Fuel feed systems are well-
prepared to deal with water effectively, and some of it will be “digested” upon
engine start and taxi. Normally, the engines’ start is fed from the center tank, and
any water in the wings remains unaffected.

The water in the wings will start to freeze as the flight climbs through the water
freezing level (32ºF/0ºC), typically during the climb, and can stick to the bottom of
the fuel tank or float to the top (due to wing flexing). Either way, the next time the
wing underside temperature rises above 32ºF/0ºC (during descent or after
landing), the ice sticking to the bottom of the tank will become unstuck and float to
the top, joining the ice formed during the flight. Over time (repeated flight cycles),

353
this factor creates a cumulative effect. An extended ground period (if OAT is above
32ºF/0ºC) may provide sufficient time for this ice to melt and sink to the bottom of
the fuel tank and presents an ideal situation to purge the tanks of this water. But
draining water from a tank does not drain any ice floating in the tank.

After we at Continental Airlines became aware of this, we started to drain the fuel
tanks on the B777 on a routine basis every three days and would purge as much
as 50 US gallons of water. Some of my crewmembers were C130 military pilots,
and in polar operations, they were restricted to 16,000 feet because of fuel
freezing. The tropical C-130 operators would purge over 200 US gallons of water.

--- Cathay Pacific 780 - A330 - Hong Kong 2010-04-13

https://aviation-safety.net/database/record.php?id=20100413-2
EPR fluctuations were noticed during the climb. Other parameters were normal,
and engines responded to throttle movement. In agreement with maintenance
control, the flight continued, but fuel contamination damaged the engines causing
loss of thrust control.
Aircraft landed at 231 knots with 70% thrust on the left engine and 17% thrust on
the right engine. Although the left engine contacted the runway during a bounced
landing and the right reverser failed to deploy, the aircraft stopped on the runway
with maximum manual braking. Fifty-seven passengers and six crewmembers
sustained injuries during the evacuation.

--- Canadair Challenger CL600 - Bassett NE 1994-03-20

https://aviation-safety.net/database/record.php?id=19940320-0
As the aircraft was refueled, it was discovered that fuel had water contamination.
Water was drained until clear samples were obtained. The crew believed any
possible remaining water would disperse.
During the first leg, fluctuations in the fuel quantity indicators were found. As a
precautionary measure, the crew elected to top off fuel tanks and drain them again,
but no evidence of water was found.
2 ½ hours into the next leg, the left engine flamed out, followed by the failure of
the right engine passing FL 370.
After 6 failed attempts to restart engines, a crash landing at night was made in a
field and the airplane was destroyed.

--- Dispatch Considerations

A flight dispatched with a light payload will reach a higher cruise level sooner or
even a direct climb to the final cruise level (no step climb), achieving a lower fuel
burn.

In combination with good weather throughout the route, destination and alternate
airports, the required fuel may be substantially lower than usual.
Lower “gate fuel” signifies less fuel in the center tank. This leads to the use of wing
fuel earlier in flight, thus exposing a smaller and decreasing amount of fuel for a

354
longer period at a higher altitude and colder temperatures (except when during a
temperature inversion, more common on polar routes).

--- Cooling Rate Considerations

- Cooling rate is the amount of temperature loss in a period of time and is measured
in degrees per hour.
- Cooling rate is approximately 3°C/hour minimum, but a maximum of 12°C/hour
is possible.
- Once cruise altitude has been reached, the cooling rate is greater when flying
away from the equator along meridians than flying along parallels and is most rapid
when fuel is warmer at the start of any flight (more heat to be lost).
- A smaller fuel amount is more vulnerable to freezing.

--- Preflight Considerations - (Strategies to Manage the Threats)

The fact (the threat) is that jet transport category aircraft may fly daily with some
form of “slush/ice” stuck to the bottom and floating in their wing tanks.

To estimate the condition of the remaining fuel on board when starting a flight,
consider where the aircraft is arriving from (region and flight length) and what type
of remaining fuel is in the wings (Jet A, Jet A1, or a mix?).

What is the temperature of the fuel being loaded? If it is coming from an in-ground
tank, its temperature will be more stable between 12ºC to 14ºC winter and summer,
depending on the piping length to the ramp. If it is coming from a fuel truck, expect
extreme temperature variances depending on the exposure to the elements.

If you deem the flight a fuel-freezing candidate, consider tankering to delay the use
of wing fuel (only the pilot can monitor the factors described above - we only
manage what we monitor).

--- Before refueling, consider transferring the remaining cold fuel in the
wings (possibly with its “slush and ice”) to the center tank. Then, refuel the
aircraft with warmer fuel. This procedure will resolve the “slush and ice”
issue and afford better protection for the wing fuel during the next flight.
--- This is the single, most cost-effective safety measure we can adopt.
Note: - This procedure also has the benefit of lowering the temperature in the
center fuel tank. With high air temperature on the ground combined with center
fuel low quantity and aircraft systems operation (air conditioning packs, etc.)
contributing to an increase in the center fuel tank temperature, this can easily
exceed the 96°F flashpoint of “Jet A” vapors, for a typical ground turnaround time
of 2 to 3 hours. Low fuel levels can also cause fuel pumps to overheat if in use.

It seems suitable to mention that between 1950 and 2006, there were 23 fuel tank
explosions due to lightning strikes, chafing of boost pump wires and other faulty
electrical wiring.

355
--- TWA 800 - B747 - NY 1996-07-17
Studied previously on M2P5. This aircraft was lost due to a fuel tank explosion
caused by faulty electrical wiring. It had a center fuel tank temperature of 127°F
when it exploded.

--- Philippine 143 - B737 - Manila 1990-05-11

https://aviation-safety.net/database/record.php?id=19900511-1
Center fuel tank explosion after pushback.

--- Thai 114 - B737 - Bangkok 2001-03-03

https://aviation-safety.net/database/record.php?id=20010303-1
Center fuel tank explosion during boarding.

--- Cockpit Preflight Considerations

After refueling, when checking fuel load and distribution (checklist item), write
down fuel temperature. If fuel temperature is habitually noted, colder-than-normal
fuel will not go unnoticed. This will help raise awareness for the need to perform a
high-speed climb or other adjustments.

Check fuel slip to ascertain what fuel type was boarded. “Jet A” freezing
temperature is
-37°C. Jet “A1” freezing temperature -47°C.
Note: - different sources may quote a one-degree difference.

356
--- Initial Climb Considerations
The Initial climb will raise fuel temperature if flown at high speed, close to Vmo.
Very effective below FL180. Moderate effect between FL180 and FL280. Little
effect above FL280, especially if fuel burn is taken into consideration.
Lighter aircraft (carrying less fuel) will likely avoid a step climb and be capable of
a direct climb to a higher altitude. This will expose the flight to colder air sooner
and for a longer period.

--- En route Flight Considerations

Note fuel temperature and time when reaching cruise altitude, and hourly after that
or at position report points. The fuel temperature starting point is necessary for
calculating the cooling rate. Calculate and monitor fuel-cooling rate to predict when
decision time will be reached. Anticipate needs for altitude change (descent/climb),
Mach increase or route change. The Cooling rate will slow as fuel loses its heat,
but fuel temperature can continue to drop depending on the balance between OAT
and wing heating sources.

A temperature differential must be maintained between the observed fuel

temperature and the freezing point of the fuel. The aircraft manual may have
considerations for operating within a few degrees of the fuel freezing limits.
Consultation with dispatch and ATC will facilitate an evaluation of options for a
more well-informed decision.

Flight Level Change – If descent is required, it should be within 3,000 to 5,000

feet of optimum altitude, or the fuel penalty may be significant. In more severe
cases, a descent to 25,000 feet might be necessary. Before requesting a “flight
level change,” verify temperatures above and below the current flight level. Recent
experience on polar routes has shown that the temperature may be higher at
higher altitudes (temperature inversion), in which case a climb may be warranted.

Route Change – Before requesting a “route change,” verify the feasibility of

additional alternate airports. These needs should be anticipated. In remote
regions, one may have difficulty and delays in getting flight level or route change
clearances. Careful planning should prevent situations from becoming critical.

Speed Change - Flying faster increases TAT and may delay the onset of freezing
but may not prevent it if altitude is maintained. An increase of 0.01 Mach results in
a TAT increase of 0.5° to 0.7°C.

Fuel burn - It should be noted that any of the previous techniques increase fuel
consumption, possibly to the point at which refueling becomes necessary,
especially for longer flights.

357
--- Descent Considerations
When slush or ice is floating or adhering to the fuel tank walls, this unusable fuel
volume is included in the indicated fuel quantity. Consequently, at the top of
descent, the actual available liquid fuel will be less than indicated and puts
in question any fuel reserve plans (for holding and diversion to an alternate airport).

Crews of aircraft with two or more fuel tanks in each wing may have experienced
fuel freezing/water icing associated with the tank with less fuel closer to the wingtip.
Crews of aircraft that only have one tank in each wing may not be afforded this
warning. The first indication could be thrust deterioration, engine rollback or failure
of one or more engines.

The probability of operational interference is greatest when fuel volume is at its

lowest point during maneuvering for landing with gear and flaps down, which
necessitates higher power (more fuel suction in the tank). Such was the case with
BA 38.

--- British Airways 38 - B777 - London LHR 2008-01-17

https://reports.aviation-safety.net/2008/20080117-0_B772_G-YMMM.pdf
Both engines failed due to fuel freezing, and the aircraft crash-landed short of the
runway after a polar flight.

Situation Awareness
Situational awareness is only possible when the risk is understood well. Only then
can a threat be anticipated and managed effectively. Fuel freezing and water icing
threats may be safely handled by observing the operational techniques above.

Intentionally Left Blank

358
 MODULE 13 - NON-NORMAL OPERATIONS

PART 1 - NON-NORMAL EVENTS

This Module incorporates various issues significant enough to cause an incident
or accident but not extensive enough for a dedicated Module.

Preventing Loss of Control

Loss of control accidents can be prevented by closely monitoring aircraft behavior
(cross-checking the Attitude Indicators). This part looks at the most common
causes and how to avoid loss of control.
Maintaining constant vigilance and good operating practices is fundamental in
preventing an unusual attitude possibly leading to loss of control.

--- Monitoring
While A/P & A/T are on, keep your hands on the control wheel and the throttles if
you need to look back (for instance, to speak with a crewmember while at cruise
altitude). This practice will provide continuous feedback on what the airplane is
doing while not looking at the instrument panel. This practice is necessary when
below 10,000 above ground, even when monitoring the forward instrument panel
(Tarom 371).
This capability may be unavailable on airplanes with no flight control and throttle
feedback to the cockpit (sidesticks and thrust levers operating on detents).

--- Tarom 371 - Airbus 310 - Bucharest 1995-03-31

https://aviation-safety.net/database/record.php?id=19950331-0
A Throttle Resolver Angle (TRA) failure caused a slow thrust reduction to idle on
the left engine during the initial climb. At the same time, the monitoring pilot (Capt.)
became incapacitated, which caused a distraction to the flying pilot (F/O). He likely
did not have his hand on the throttles as he did not perceive their significant
asymmetry. The aircraft rolled to the left and developed a 60° nose-down dive
while rolling 360° around its roll axis and crashed.

--- Autopilot and autothrottle

When an aircraft begins to deviate from the intended flight path, immediately take
control manually. Turn off the autopilot and, if the cause of the deviation is an
engine issue at altitude, disconnect the autothrottle and bring all engines to idle
until regaining control. If necessary, lower the nose to maintain a safe speed.
Visually confirm disengagement on the Flight Mode Annunciator. If the deviation
persists, you may want to perform a tactile check that the respective switches have
moved to the off position (Logan Air 6780).

359
--- Logan Air 6780 - Saab 2000 - Aberdeen UK 2014-12-15
http://avherald.com/h?article=4813ed2d&opt=0
After the airplane received a lightning strike, the crew encountered elevator
difficulties. They assumed the autopilot had disconnected and flew manually.
However, the autopilot was still engaged, and it countered the crew’s inputs.
Most autopilots will disengage when overridden by flight control or stabilizer
manual input. The Saab 2000 appears unique in not having an override mode for
the autopilot. The airplane recovered seven seconds before impacting the ground
due to a random signal interruption, causing the autopilot to disconnect, which
allowed the pilots to pull away from the ground.

--- Approach and Go-around Automation

Automation use close to the ground requires a higher level of awareness and
preparedness to recognize a discrepancy and initiate the correct response due to
the reduced recovery time.

--- Turkish 1951 - B737 - Amsterdam 2009-02-25

https://aviation-safety.net/database/record.php?id=20090225-0
The Captain’s radio altimeter had failed before the approach, which caused the
throttles to stay in “retard” mode during the ILS approach. The autopilot maintained
the glide slope, and with no active autothrottle, the airspeed was gradually
bleeding. The three pilots in the cockpit failed to notice this until the stick-shaker
warning, at which time the flying pilot pushed the throttles forward. However,
neither pilot maintained their hand on the throttles, which retarded to idle. The
plane stalled and crashed.

--- China Airlines 140 - Airbus 300 - Nagoya 1995-04-26

https://aviation-safety.net/database/record.php?id=19940426-0
During a manually flown ILS approach the F/O inadvertently pushed the GO levers
placing the autothrottles in Go-around mode. As the thrust increased an increase
in pitch and a sequence of mistakes leads to a stall and crash.

--- Attitude Display Indicator (ADI)

When an aircraft’s attitude indicator displays an undesired (true or false) attitude,
if the pilot that sees it first responds with incorrect inputs, the airplane ends up in
a dive. When the other pilot realizes there is an issue, his attitude indicator
is already displaying a dive. Because he did not observe the entry into the
unusual attitude, an all brown/black attitude indicator with no horizon
reference offers little guidance to the way out.
Transport category aircraft are not aerobatic planes and cannot recover from high-
speed dives. The elevator does not have enough authority, and the use of the
stabilizer usually initiates an inflight breakup. In the few seconds for an airplane to
impact the ground and under the stress of imminent death, pilots typically do not
recover.

360
--- Crossair 498 - Saab 340B - Zurich 2000-01-10
https://aviation-safety.net/database/record.php?id=20000110-0
Fifteen accidents were attributed to confusion from eastern trained pilots
interpreting western system attitude indicators. In the eastern systems, the artificial
horizon is fixed to the aircraft. In the western system, the airplane symbol is fixed
to the aircraft and displays identical to the exterior view. The Crossair 498 and the
Tarom 371 flying pilot (F/O) were trained in eastern type attitude indicators, which
may have contributed to losing control.

--- Kenya Airways 507 - B737 - Cameroon 2007-05-05

https://en.wikipedia.org/wiki/Kenya_Airways_Flight_507
After takeoff, the Captain (flying pilot) asked for the autopilot to be engaged. The
F/O (non-flying pilot) did not acknowledge this instruction and did not move the A/P
to command. The Captain did not monitor the F/O turning the A/P on (the A/P is in
front and to the Captain's right), and he did not verify an A/P green light on the
FMA. Nevertheless, the Captain assumed the A/P was on, and he removed his
hands from the flight controls. At this point, no one is flying the plane, and the A/P
is OFF.
Uncontrolled, the plane started to bank to the right. As the bank exceeded 40°, the
“Bank Angle” audio warning came on. The Captain grabbed the controls and
banked more to the right, creating a nose-down attitude. Then he quickly banks to

361
the left and then again to the right, losing control of the plane, which flew into the
ground.

--- COPA 201 - B737 - Panama 1992-06-31

https://aviation-safety.net/database/record.php?id=19920606-0
The Captain’s attitude indicator had an intermittent failure at cruise altitude due to
a short circuit. The crew mismanaged the alternate source selection, placing two
of the displays on the failed gyro. This error was not noticed due to insufficient
cross-checking of the attitude indicators. The crew continued to fly, making attitude
adjustments based on false information leading to loss of control. The plane
developed an 80° nose-down dive and disintegrated at 10,000 feet.

--- West Air Sweden 294 - Canadair CL600 - Norway 2016-01-08

https://aviation-safety.net/database/record.php?id=20160108-0
A computer failure caused the Captain’s attitude indicator to pitch up to 50°, while
the pilots were briefing the approach at cruise altitude. When the Captain realized
the issue and before cross-checking with the other two attitude indicators, he
corrected with nose down pitch. Because the airplane was level, his correction
placed the plane in a dive from which there was no recovery.
See how to prevent a similar event: “Approach and Landing Briefing” in this Part.

--- Vertical speed mode - The use of the vertical speed mode for a climb is
discouraged. As the aircraft climbs, it may not be able to maintain the required
vertical speed despite thrust being at climb power. Eventually, speed decreases to
stall speed.

--- Flaps - Operate the flaps when the aircraft is maintaining heading. Avoid
extending or retracting them while in a turn. This practice will afford more time to
recover if a flap asymmetry develops while the plane is in a 30° bank, for example.

--- Rudder pedals - Always rest your feet on the rudder pedals. This practice
will alert you immediately of any unwanted movement and allow an immediate
response. This practice would have saved AA587.

--- American Airlines 587 - A300 - NY 2001-11-12

https://aviation-safety.net/database/record.php?id=20011112-0
Video:https://en.wikipedia.org/wiki/File:American_Airlines_Flight_587_Accident_a
nimation.ogv

If Aircraft is Damaged
Critical damage can be caused without any unusual noise, and it may not be readily
identifiable (Continental 51 DC10 EWR). The damage can be to the exterior or
interior of the airplane structure, and it can be on the inside or outside of the
pressurized hull.

362
If damage occurred after becoming airborne, consideration should be given to not
changing the configuration (and the Center of Gravity) until controllability is
confirmed at a higher altitude away from the ground.

If the damage occurred inflight, testing the minimum configuration change

necessary for landing should also be performed at altitude. Personally, I would feel
more comfortable between 10,000 and 15,000 feet above ground and below
18,000 MSL. When the consequences of flap and landing gear extension are
unknown, this test should not be performed during the approach for landing. Never
become a test pilot at low altitude.

Weight & Balance Issues

--- Transavia 1277 - B737 - Rotterdam 2003-01-12
https://www.aviation-accidents.net/transavia-airlines-boeing-b737-800-ph-hzb-
flight-hv1277/
Ground agents seated 110 passengers behind row 13 and 4 passengers on row
one. The F/A thought that the plane might be too heavy in the rear, and she
reported this to the cockpit crew. The Captain subsequently looked into the
cabin from his position in the cockpit but took no further action.
Pilots noticed that the nose wheel was skidding when lining up on the runway (a
tail-heavy indication or carrying excessive speed during the turn, or both). When
the airplane started the takeoff, the nose aggressively pitched up until the tail
contacted the runway, and the takeoff was rejected.

--- Flybondi 5011 - B737 - Argentina 2018-06-16 (similar event)

https://aviation-safety.net/database/record.php?id=20180716-1

--- Cubana 972 - B737 - Havana 2018-05-18

A similar event, resulting in the fatalities of all on board.
https://aviation-safety.net/database/record.php?id=20180518-0

--- Airbus Industrie Test Flight 129 - A330 - Toulouse 1994-06-30

https://aviation-safety.net/database/record.php?id=19940630-0
This certification test flight requirements called for setting the CG at its aft limit and
shutting down an engine with the autopilot on after becoming airborne.
Unfortunately, the stabilizer trim was mistakenly set at 2.2 units nose up.
Because of this, the plane wanted to liftoff prematurely, and the F/O held forward
pressure on the side stick during the takeoff run. After rotation, the autopilot only
engaged on the third attempt (due to the F/O forward pressure on the side stick).
However, the plane gradually over-rotated to 29° nose up (instead of the intended
14.5°), and the speed decreased to 145 knots. The F/O was flying the plane, and
the Captain did not notice the extreme attitude as he was involved in shutting down

363
the engine. The autopilot altitude acquisition mode further pitched the plane up to
32°, and the speed decreased to 100 knots, causing loss of control.
Rejecting the takeoff when it was felt that the plane wanted to autorotate was the
safest course of action, and it would have prevented this accident.
Fatalities: all on board.

--- Continental 60 - B777 - Newark 2011-06-20

(Based on the CIR. Capt. Vireilha was the PIC).
As I started the rotation, the nose wheels barely came off the runway. I continued
to pull the control wheel back, but it became clear the aircraft was not becoming
airborne with elevator control alone. Instead, I used the electric stabilizer trim to
continue the rotation. The resultant late but swift rotation got us off the runway,
and the airplane flew normally once in the air.
Load planning calculated stabilizer trim was set too far forward, and that was the
cause for the unresponsive rotation. Using the stabilizer trim to rotate worked this
time, but if the problem was any other (than an incorrect stab trim setting), we could
have become airborne with a jammed stabilizer or worst. It would have been safer
to reject the moment I felt the lack of response, despite the fact I had just passed
Vr. (See M4 for reject criteria and Continental 51 for loss of pitch control incident).

Intentionally Left Blank

364
 Engine Slow Start
An engine that is slow to start or accelerate indicates that it needs to be monitored
and operated cautiously until the first opportunity maintenance can inspect it. This
can be a symptom of a disrupted fuel can or a compressor rotor disc failure or
friction from other engine components, leading to an uncontained engine failure
and fire and possible loss of the aircraft.

The following three photos are from a high-power engine run after the pilots
reported the engine slow to start and respond. The HPT rotor disc from engine 1
separated inboard, went through the center wing box and through engine 2,
lodging itself on the outboard of engine 2.

Engine 1 Ground Fire - AA B767

LAX 2006-06-02

365
If this failure sequence had occurred in-flight, this aircraft would likely be lost.
Similar failures had occurred previously to Air New Zealand during climb
https://aviation-safety.net/database/record.php?id=20021208-1
and to US Airways on the ground.
https://aviation-safety.net/database/record.php?id=20000922-0

Air New Zealand’s failure was outboard of engine 1, which allowed the aircraft to
survive the event. Both American Airlines and US Airways, although being on the
ground, were fire-damaged beyond repair.

A “slow start” engine may also be slow to accelerate during taxi or takeoff, which
would support the suspicion of a pending failure. Although when initiating a takeoff,
one can wait for an engine to spool up, afterward, symmetric thrust control
becomes problematic. Consider refusing an aircraft with a slow start or engine
acceleration history if operating to or from possible contaminated runways where
directional control can become an issue.

If reverse thrust is used to reject a takeoff (or during landing), asymmetrical thrust
may develop. If the runway is wet or contaminated, tire friction will be reduced, and
directional control can be lost (nose wheel steering). Asymmetrical thrust can
aggravate the situation if the engines are tail-mounted due to reverse thrust rudder
blanking* preventing correction.
* Delta 1086 - MD80 - La Guardia 2015-03-05
https://aviation-safety.net/database/record.php?id=20150305-0

APU Use
It used to be a standard procedure to turn off the APU with the after-takeoff
checklist to safeguard electrical issues at low altitude. Low visibility approaches
were also flown with the APU running as a backup. Today, the APU has reduced
use, mainly limited to ground support (air conditioning, electrical power and engine
start). Increases in fuel prices triggered this change to the detriment of safety.

The belief that the APU can safely be turned on if something happens during
departure or arrival is ill-founded. For an APU to have a successful start, all the
starting steps need to be successful. Any one failure and the APU will not start.
Further, when something does happen, such as an engine failure or an electrical
issue, load shedding changes things, and the APU was not designed to start while
load shedding is taking place. Qantas 32 (A380) is a good example of how many
electrical things did not go according to the design, including the APU.

366
 Taxi
When beginning to taxi, sense if more than usual thrust is needed to move the
aircraft. This could indicate being in an uneven spot, having “square” tires from a
parked position or soft hot asphalt. However, this could mean dragging brakes or
under-inflated tires, and both are critical threats. Pay attention to the aircraft
directional trend during straight taxi, as the coefficient of friction increases with
speed. If the aircraft is on a flat surface and tends to turn more as speed increases,
return to the gate and have maintenance investigate.

Fig.1 - Some airline manuals and some instructors still reference that a safe taxi
speed is the speed of a man walking fast. That is indicative of times when the
aircraft should not taxi any quicker than its wing walkers.

Today, the norm is to taxi at a speed that you can stop the plane within the visibility
you have. Your manual may limit taxi speed to no more than 20-25 knots. Use the
taxi speed range technique and not constant speed to prevent overheating brakes.
Allow aircraft to pick up the pace, and then use brakes to slow down and start
again. Avoid riding brakes to maintain a constant taxi speed. This procedure
applies in any kind of weather, as it helps to keep brake temperatures lower.

Note on cooling brakes: - When I was operating the B747 during the Gulf war,
with a military MTOW of just over 1M pounds, it was routine to wait about 20
minutes by the runway for the tires’ temperature to drop to normal levels for takeoff.
Although we would taxi slowly, the aircraft weight and the distance to the runway
(Honolulu) would cause the overheat condition. We would line up with the wind
and not set the parking brake for faster cooling.
However, on lighter airplane types that tend to move at idle thrust, we would only
use brakes on one side to hold the plane and then switch sides.

367
The inner disks of a stack can only radiate internally towards each other. The outer
or end disks radiate towards the atmosphere. By holding the brakes one side at a
time, the inner disks transfer heat to the external cooler disks, that when released,
cool with the wind effect. Switching from the left to right side every minute or two
achieves faster cooling. If both sides are too hot, prevent the airplane from moving
by turning the nose wheel to one side before coming to a complete stop and
holding the tiller. Do not turn the tiller if the aircraft is not moving to prevent torsion
on the nose gear and flat spots on the tires.

The nose wheel may skid if starting a turn too quickly, especially if the pavement
is wet. But if these conditions are not present, then a skidding nose wheel is likely
an indication of an improperly loaded, tail-heavy aircraft. Have load planning and
flight crew redo the calculations. Do not rush into an unsuccessful takeoff.
(Transavia 1277)

Light nose gear steering can be expected in some swept-wing aircraft (typically
after landing with an empty center fuel tank). The B727 (or similar) is very
susceptible to this characteristic. Entering a turn too slowly and not having enough
momentum to complete the turn will require increasing thrust during the turn. This
can lift the nose gear tires off the pavement just enough, and the airplane will not
stop turning until the nose gear is off the tarmac.

--- Sharp taxi turns

Do not lock brakes on one side to pivot over the main landing gear during tight
turns. This puts a twisting (torque) force on the landing gear for which it was not
designed. This stress will weaken the landing gear and may cause it to collapse
at a later date. Always allow enough room while turning for all tires to be moving
while the airplane is turning (and prevent flat spots on the tires).

--- Continental 588 - MD82 - Denver 1993-04-27

https://aviation-safety.net/database/record.php?id=19930427-1
The right main landing gear collapsed during landing.
Probable cause: Suspected fatigue from accumulated torsion stress on the gear
(sharp taxi turns)..

--- Unsafe landing gear

Should an unsafe gear indication appear during taxi, stop the aircraft
immediately wherever it is, even if on an active runway, to reduce the risk of gear
retraction. Start the APU and shut down the engines.

Ask maintenance to secure the landing gear. If pins are not available, coordinate
passenger and crew deplaning with stairs and buses (Captain’s responsibility ends
once all have left the airplane, which is now a maintenance aircraft). Have
maintenance tow the plane.

368
If one main gear retracts, engines can contact the ground and can cause a fuel
leak. Wing fuel may also leak through the fuel vent (caused by abnormal attitude),
posing a fire risk. Declare an emergency and ask for fire trucks to monitor.

--- Air Afrique A300 - Dakar 2000-02-12

https://aviation-safety.net/database/record.php?id=20000212-1

Fig.2 - Left main landing gear collapse during taxi to the runway.
After an unsafe gear indication, pilots decided to continue to taxi and return to the
terminal. With gear collapse, the left engine scrapes the ground and starts an
aircraft fire.

Before Takeoff Briefing

Plan "B" discussed several important issues for before-takeoff considerations, and
they are listed here to facilitate their inclusion in your briefing.

1 - Write down the number of SOB on your departure brief card (discussed in “The
Evacuation” on M3P3).
2 - Takeoff Speed Cross-check (M11P2): Calculate what ground speed the plane
should be at the normal IAS speed check, and cross-check both.
3 - Plan to stop and stay on the runway facing the wind if the possibility of a fire
exists (rejected takeoff). Never clear the runway until confirming the safety of the
aircraft (see M4 The Stopping Procedure).
4 - Runway Overrun Plan (M4P1): Right or left (for obstacles), center (if EMAS).
5 - The Impossible Turn (M4P3): Not only a light plane consideration. Even large
planes should have a plan for an immediate return (see Transair 810).
Note: - For light twin-engine aircraft see Engine Failure at Takeoff M7P3.

369
 Takeoff
--- Brake issues
Check brake temperature at the end of taxiing when approaching the runway. If
one brake is hotter than others, have maintenance investigate a possible
dragging brake. This is the only way to detect a dragging brake, which has not
yet reached a temperature where it would trigger a warning in the flight deck.
Taking off with a dragging brake usually results in a wheel well fire and loss of the
aircraft shortly afterward.

- After the After-Takeoff checklist, check brake temperature. The wheel well does
not have overheat detection in most aircraft; it only has fire detection. This check
is a defensive measure as it would alert to extend the landing gear before a
possible wheel well fire warning. To help remember to check temperatures, you
may want to link that to when disarming the autobrake, for example, during the
after-takeoff flow.
- Similarly, check brake temperature after landing upon arriving at the gate, as it
takes a few minutes for brakes to reach higher temperatures. A cooler than
normal brake may indicate a failing brake that can become an issue on the next
flight.

--- RTO mode failure - Loss of directional control

The following event is not something that pilots train for and is indicative of how
easily a situation can be unforeseen.

--- Continental 182 - B757 - Orlando 2000-10-06

Based on the CIR. Capt. Vireilha was the PIC.
As the F/O started the takeoff, we had a direct 15-knot crosswind from the left. At
65 knots the aircraft began to deviate right of centerline, and I felt the F/O applying
full left rudder pedal, but the plane continued to go to the right. I took the airplane
and rejected the takeoff. As I maintained full left rudder and applied brakes, the
autobrake RTO clicked off and the aircraft suddenly turned left and stopped a few
feet from the runway's left edge.

We notified the tower of the reject and asked for the fire trucks as we did not know
what was happening. A couple of minutes later, the cabin crew told me there was
a lot of white smoke from the right side (night conditions). When the fire trucks
arrived, they notified us that the smoke was coming from the left engine. The wind
was pushing the smoke underneath the plane and it was more visible from the aft
cabin’s right side. We had no cockpit indications of any abnormality with the left
engine. Engines were shut down and we were towed to the gate.

370
The F/O and I did not understand why the plane wanted to go to the right so
aggressively when we had a left wind and full left rudder. Brake temperatures were
at 550°F on both sides.

When at 65 knots the autobrake (in RTO mode) builds up the brake pressure in
preparation for a possible RTO, the brake metering valve on each landing gear
closes, precluding the brakes from activating (both valves will open if an auto RTO
is initiated). However, our right-side metering valve had failed (open) and allowed
full brake pressure on the right side when the system “wakes up” at 65 knots. When
I applied manual brakes (auto RTO clicks off canceling auto brake pressure) the
left side valve also opened allowing manual brake pressure on the left side.
Because there was no manual demand on the right side the airplane turned to the
left.

The flight was canceled and the next morning we found that the left engine possibly
had a bearing failure, and it was being replaced.

One lesson to learn from this event - when an aircraft begins to do something you
don’t want, “stop the show,” do not attempt to make it work, it always ends not so
well (see Jet Airways 2374 below).

--- Continental 1404 - B737 - Denver 2008-12-20

https://aviation-safety.net/database/record.php?id=20081220-0
This accident is another example to “stop the show” while you can. The initial setup
was ill-conceived - a company proposed reduced power takeoff in a strong and
gusty crosswind. Alternatively, the Captain could have decided for the full power
takeoff, but this option was not exercised.
From the early stages of the takeoff, the Captain was struggling to maintain
directional control with 88% of full rudder displacement. That was his opportunity
to realize this was very abnormal and to discontinue the takeoff. However, the
reject was not initiated until the aircraft was off the runway. The result was 47
injuries from 115 occupants, substantial damage to the aircraft, and post-crash fire.

--- Asymmetrical Power - Takeoff

It is standard to advance the throttles simultaneously to stabilize the engines at
about 40-55% N1 (depending on the engine) when initiating the takeoff. If one
engine spools up slower than the other, a significant asymmetry can develop once
takeoff power is applied, usually resulting in a sharp unexpected turn and a runway
excursion. Cautiously apply power while monitoring equal thrust acceleration from
the stabilized level.

To prevent loss of control:

- Do not use asymmetrical thrust while turning the aircraft to align with the runway.

371
- If holding brakes, do not release them until verifying stabilized and even thrust on
all engines.
- If not holding brakes, verify thrust remains even on all engines while increasing
thrust to takeoff power.

But a fuel control failure that spools an engine out of control, can also cause
asymmetrical thrust and can be much harder to control. Such was the case with:

--- US Air B737 Kinston NC 1990-07-22

https://aviation-safety.net/database/record.php?id=19900722-0
As engine power was increased for takeoff, the no. 1 engine accelerated beyond
target EPR. Engine shut down had to be done with the fuel shutoff lever. The
asymmetry was mitigated with nose wheel steering. Before the airplane could be
stopped, the nose wheels separated from the landing gear.

Intentionally Left Blank

372
--- Jet Airways 2374 - B738 - Goa 2016-12-27
https://reports.aviation-safety.net/2016/20161227-0_B738_VT-JBG.pdf

Fig.3 - Throttles were advanced for takeoff by pushing TOGA when engine 1 was
at 40% and engine 2 at 28%. Consequently, engine 1 accelerated faster than
engine 2, and the airplane started to veer to the right.
The Captain used full left rudder, full left brake and nose wheel steering to maintain
directional control, however, he did not bring the throttles to idle and abort the
takeoff. Twelve seconds later, the airplane departed the runway and continued in
a 180° turn going over concrete obstacles, which caused substantial damage to
the engines and fuselage. There was no fire.

--- Asymmetrical Power - Go-around

The same principles apply during a go-around, especially if executed from a low
thrust setting and low altitude. If the throttles are pushed up rapidly, and thrust
asymmetry occurs, the resultant yaw usually causes the aircraft to touchdown
outside the runway (see Engine Slow Start).

373
 Approach and Landing Briefing
Because this briefing is conducted inflight, special attention needs to be directed
to always have one pilot monitoring the aircraft to prevent a possible undesirable
event (i.e., West Air Sweden 294).
The following is a suggested way to conduct such a briefing:
The pilot-flying should give the plane to the non-flying pilot. Then he should set his
side (or the airplane) using his approach plates while silently briefing himself. Once
this is complete, he should take the airplane from the non-flying pilot and allow him
to set his side. Once the non-flying pilot is set up then the flying pilot should
verbalize the briefing from memory.

Also recall the following:

1 - Recall the number of SOB from your departure brief card (discussed in “The
Evacuation” on M3P3). It may be needed during the approach or landing.
2 - During approach and before calling for or selecting flaps, note altitude and wind
value, and cross-check IAS with G/S to see if they make sense (M11P2 point 9).
3 - Plan to stop and stay on the runway facing the wind if the possibility of a fire
exists. Never clear the runway until confirming the safety of the aircraft (see M4
The Stopping Procedure).
4 - Runway Overrun Plan (M4P1): Right or left (for obstacles), center (if EMAS).

Landing Gear & Wheel Well Issues

Landing gear retraction
All landing gears failing to retract is usually an indication of a benign technical
issue, such as a hydraulic system valve left in the wrong position after servicing or
the ground/air sensor being damaged by a bird strike. Although other problems
can prevent landing gear retraction, these two are easy to find during the preflight*
if the pilot is trained on where to look.
* (Unless the ground/air sensor damage occurs during the takeoff).

However, if the landing gear retraction failure is associated with hydraulic or other
failures, it can become a more serious in-flight abnormal. Additionally, if hydraulic
fluid is lost in the wheel well, it can cause a fire, especially during the use of the
brakes during landing (Aer Lingus 110).

One Main Gear Fails to Extend (aircraft with two main gears).
If landing with partial main gear, consider touching down offset from the center to
the side of the working landing gear as the airplane will veer towards the side with
the failed landing gear once this side touches the runway.

374
Land on the working gear and hold the wing up on the side with the questionable
gear. Fly the wing until beginning to lose lift and allow it to be lowered onto the
runway gently.
Consider not using spoilers upon touchdown. Spoilers can push the wing down
fast, causing a hard landing on the engine or wing, and they are not needed as
when the wing drops, there is no significant lift anymore.

--- US Air B737 - 2008-04-08

Video: https://www.youtube.com/watch?v=EuzFbwTUEPs
After trying the alternate landing gear extension and bouncing the airplane on the
runway to force the gear to drop, the left gear would not extend. On the second
landing the pilot was holding the wing up, however the spoilers were deployed
causing a hard impact on the engine.
Note: In a similar situation, consider shutting down the left engine (engine-driven
fuel pump) and its respective electric fuel pump as the plane touches down (to
remove fuel pressure and reduce the chances of a fire).

Runway Paint Fire Hazard

When landing with one or more landing gear retracted or damaged, the friction
between the aircraft with the runway paint causes the paint to ignite.
Gear-up landings can become an aircraft fire risk if a fuel or hydraulic leak exists
or develops during landing. Landing slightly offset from the centerline will avoid
most of the runway centerline paint (for the nose gear and fuselage).
See Jet Blue 292.

--- Jet Blue 292 - Airbus 320 - Los Angeles 2005-09-21

Video: https://www.youtube.com/watch?v=epKrA8KjYvg
In this landing on a damaged nose gear, the aircraft is landing left of the runway
centerline. The nose gear tires start to smoke while the tires are off the centerline
painting. Once the pilot brings the nose gear over to the centerline, the paint ignites
each time the tires go over the paint. This intermittent source of ignition finally
catches the tires on fire (see video link).

The wheel well only has fire detection.

It does not have overheat detection or extinguishing capability
(most aircraft).

Wheel well issues commonly result from tire or brake failures. If the failure occurs
while the airplane is at high speed on the runway, it may cut electric wiring or
cables, resulting in fuel leaks or hydraulic systems loss. This may destroy the
ground/air sensor, and loss of reverser capability may occur, resulting in forward
acceleration once the pilot activates the reverse lever (Lear Jet 60 - Columbia SC).

375
- If the landing gear is retracted while a tire/brakes event is developing, it can lead
to a fire in the wheel well. This can result in the quick loss of the aircraft if the
landing gear is not reextended.

Caution - Wheel Well Fire Checklists instruct that once a landing gear is extended,
it should not be retracted again. Even after the fire is completely extinguished, the
risk of raising the landing gear is that tire deformation may cause catastrophic
damage to the wheel well and possible loss of the aircraft (fig.4).

The following incident with AF54 is a good representation of the caution not to
retract the gear after damage is suspected. It is also a CRM decision-making
exercise.

--- Air France 54 - Concorde - Dulles 1979-06-14

Aviation Week & Space Technology.
During takeoff, the pilots heard two bangs and received a brake overheat message
and an indication of the loss of two tires.

Fig.4 - This picture is from one of the 51 tire incidents that Concorde had.
It is not of AF54 on 1979-06-14

Times are referenced to takeoff time.

• 75 seconds - The tower controller informed AF54 of “some flame on what
appeared to be one of the left engines.”
• 86 sec - The cabin crew told pilots that a passenger reported a piece of the wing
flying by a window, leaving a hole in the left wing about 3-4 feet spanwise and
3 feet chordwise.

376
• 6.5 min - A tower flyby confirmed that the two rear tires on the left gear were
destroyed.
• At that point, the pilots state they are going to continue to Paris.
• However, as they attempt unsuccessfully to retract the landing gear, they
receive a flight control system warning, and they decide to divert to JFK.
• 9 min - ATC informed the crew, “there appears to be a fuel stream in trail of you,
a vapor of some sort.” Simultaneously they have a complete loss of the Green
hydraulic system.
• 14.4 min - Crew receives confirmation there was a hole in the wing, and they
lose the Yellow hydraulic system. They only have one hydraulic system
remaining (Blue) and now declare an emergency and request diversion to
Baltimore.
• 16.2 min - Realizing that Dulles had a longer runway and that the left-side
brakes might not work, the crew requests diversion to Dulles, the departure
airport.
• Concorde landed with an LGW 18% over the MLW of 245,000 pounds and
stopped 900 ft from the end of the 11,500 ft runway, despite severely reduced
stop capability.

• Aircraft leaked approximately 16,500 pounds of Jet A1 and Engine # 2 seized

after being shut down.
• Pilots told the cabin crew the aircraft might go off the runway but gave no
instructions to brief the passengers for an emergency landing.

--- Swissair 306 - Caravelle – Zurich 1963-09-04

https://aviation-safety.net/database/record.php?id=19630904-0
At 06:05 AM local, the pilots request to taxi halfway down the runway to inspect
the morning fog. They taxied using considerable engine power while holding
brakes in an attempt to disperse the fog. At 06:13, the aircraft takes off, has a
wheel well fire, and crashes 9 minutes later.
The crash was due to the destruction of essential structural parts of the aircraft by
overheating the brakes during the taxi to “disperse the fog."

--- Mexicana 940 - B727 - Mexico 1986-03-31

https://aviation-safety.net/database/record.php?id=19860331-1
A dragging brake causes a tire to overheat and explode 15 minutes after departure.
Before takeoff, the Captain commented that the aircraft felt slow to accelerate
during taxi. The tire was serviced with air rather than nitrogen. High temperature
and pressure (from the dragging brake) resulted in a chemical reaction with the tire
itself, leading to its explosion. Fuel and hydraulic lines were ruptured, and electrical
cables were severed. Cabin decompressed. Spilled fuel ignited, causing a massive
fire on board. An emergency was declared shortly before the loss of control.

377
--- NationAir 2120 - DC8 – Jeddah Saudi Arabia 1991-07-11
Recommended reading of CVR transcripts on this link:
https://aviation-safety.net/database/record.php?id=19910711-0
At the beginning of the takeoff roll, with only 50 knots of speed, the crew discussed
a sensed unexplainable vibration with oscillating sounds. However, they did not
reject the takeoff.

The engine indications were normal, making it more likely that failing tires or
dragging brakes caused the vibration. That should guide the crew not to retract the
gear (bringing a possible wheel fire onboard), yet the crew retracted the landing
gear.
After takeoff, the aircraft would not pressurize and lost all hydraulics (manual
reversion). Numerous non-related failure indications followed this.
On final, the cabin floor collapsed due to an intense wheel well fire, and passengers
fell overboard through the opening. The plane lost all flight controls and crashed.

Observations (Capt. Vireilha):

The lead ground mechanic had discovered that tires 2 and 4 had low pressure and
advised the charter manager, but neither took any action nor informed the flight
crew.

A low-pressure tire is hard to identify visually. The bottom of the tire will appear
normal, as the other tire will take up the load (although a flat tire will look flat on
top). Under-inflated tires are more flexible, which generates more stress and more
overheating.

On this DC8, the under-inflated tire 2 puts extra weight on adjacent tire 1, causing
over-deflection, rapid overheating and tire structure degradation. Tire 1 fails first,
early during the takeoff roll, followed almost immediately by tire 2. Friction between
the wheel/brake assembly and the runway generated enough heat to raise the
temperature of the tire remnants above that required for a tire fire to be self-
sustaining. When the landing gear was raised, this fire was brought into the aircraft.

--- Propair 420 - Metro - Montreal 1998-06-18

https://aviation-safety.net/database/record.php?id=19980618-0
The airplane taxied from the hangar with the left brakes dragging. During the
takeoff, the plane pulled to the left (despite a right crosswind), and the co-pilot had
to apply constant right rudder pressure to maintain the centerline. The acceleration
was slow, and the takeoff run was more than double the usual distance. These
were good indications to abort the takeoff to investigate the cause. However, the
Captain/check airman was guiding the junior co-pilot and did not perceive the
situation.
After takeoff, the plane lost both hydraulic systems and a “Wing Overheat” light
came on. The airplane could have landed immediately at nearby Mirabel runway
11. However, the Captain decided to return to Montreal. Six minutes later, as the

378
left engine appeared to be on fire, it was shut down, and a decision was made to
land in Mirabel, runway 24. Passing the runway threshold, the left wing failed, and
the plane crashed inverted on the runway.

--- Delta 95 - B777 - Atlanta 2015-01-18

Video: https://www.youtube.com/watch?v=t9n39txMLDo
Timestamps are noted to allow jumping to that frame during video playback.

Observations (Capt. Vireilha):

2:10 - During takeoff, smoke appears from the left main gear tires and is reported
by Delta 1353 taxing to the gate and abeam Delta 95 when the smoke became
visible. When DL95 was notified, the landing gear was already up. The crew should
have perceived this qualified report as a potential wheel well fire, and it should
have raised the alarm to reextend the landing gear immediately. However, DL95
continued the climb without extending the landing gear.

2:45 - Tower advises DL95 they too see smoke from the left side but are not sure
where it is coming from.
3:40 - DL95 declares an emergency to departure control and advises they need to
initiate fuel dumping.

7:20 - DL95 advises ATC that the nature of the emergency is reported smoke from
the left gear during rotation. This confirms that the crew has an awareness of the
problem. However, they do not seem to connect this with the imminent danger of
a possible wheel well fire. There is no sense of urgency in the communications,
and the flight continues to jettison fuel while flying away from the airport with the
landing gear retracted in the wheel well.

10:20 - DL95 is on final and dumping fuel at low altitude (similarly to Delta 89).

13:00 - After landing, DL95 calls the tower as they exit the runway: “Tower, Delta
95 heavy, we are going to try to clear the runway if it is all right with you.” DL95
abandoned the safety of the runway and continued to taxi to stop on a taxiway.

13:35 - The tower asks if they need any further assistance, to which one pilot
responds - “Yeah, we need someone to come look at the plane, Bud.” Continued
communications, after this point, show that the pilots have concerns with the safety
of the plane.
The aircraft stops on the taxiway and keeps the engines running while the fire
trucks check the tire temperatures.
This is not the best practice - See Stop on The Runway (M4P2) and Continental
1593.

379
Delta 95 declared an emergency because there was a fire threat to the left main
gear. However, the crew did not extend the landing gear until it was needed for
landing and flew away from the airport's safety to dump fuel (Swissair 111).

Because the wheel well has no overheat detection, the next event would be a
Wheel Well Fire Warning if there was a fire brewing. As there is no extinguishing
capability, the only procedure is to extend the landing gear. This process is much
more effective as a preemptive measure before a fire is raging in the wheel
well.

A wheel well threat is an unannunciated emergency until detected, when then it

becomes an annunciated fire checklist. Therefore, pilots should not wait for the
electronic checklist to be displayed to initiate preemptive procedures. The landing
gear must be extended as soon as the pilots become aware there might be an
issue.

Intentionally Left Blank

380
--- Air Canada 837 - B763 - Madrid 2020-02-03
Video with actual audio: https://youtu.be/B1hjarmS36U
Timestamps are noted to allow jumping to that frame during video playback.

Observations (Capt. Vireilha):

The tire tread from the left rear wheel (number 5) of the left main gear detached
during the takeoff run, and the number 1 engine ingested fragments. The crew
continued the takeoff but were unable to retract the landing gear. Then they shut
down engine 1 and declared a mayday.

The landing gear issue (fig.5)

3:00 - The crew attempted to raise the gear, but they were precluded due to
damage to the tilt sensor. They also reported a tire explosion and that they knew
they had at least blown one tire.

Fig.5 - Air Canada 837

8:35 - While a Spanish fighter jet was observing the airliner, the Air Canada crew
stated, “there should be no problem” retracting the gear. It is unclear why the crew
felt confident the gear would come up this time if it would not come up the first time
(even if planning to use the override gear retraction procedure).
The fighter jet inspection confirmed the damage. The landing gear should not be
raised after confirming (or suspecting) tire/landing gear damage. As the damaged
gear comes in the wheel well, it can quickly cause the loss of the aircraft, as
observed in previous accidents. The gear may also jam inside and not extend
again, forcing a belly landing.

381
The maximum landing weight (MLW) factor
With Air Canada 837, there are two relevant factors. The aircraft did not have a
fuel dumping system, and Madrid is equipped with EMAS (Engineered Material
Arresting System).

The tire explosion caused the loss of the engine. Considering that the pilots should
be aware of possible additional unknown damage to the aircraft, an immediate
return for landing would be advisable. An emergency at takeoff, climb 5,000 feet,
return and land, takes about 9 to 10 minutes. The aircraft was airborne for 4:11
hours, of which over 3 hours were for the sole purpose of reducing the landing
weight. Leaving the gear down would have reduced this time (higher fuel burn) and
their exposure to low altitude risk (bird strikes, etc.).

The increased exposure to possible hazards for such a long time (and over 50 nm
south of the airport) needs to be balanced against the relative benefit of 7 to 8
knots lower approach speed (approximately one knot per 5,000 pounds of weight
reduction).
The remaining engine could fail later due to bird ingestion or any other reason. Or
tire debris could have caused damage somewhere else on the airplane, which
would be manifested later.
We also need to consider that the runway was 13,116 feet long (3,998 m) and with
an arresting system at the end. It is rare to find such ideal conditions for an
emergency landing. The safest course of action would be to stay close to the
airport and land as soon as possible.

- A Continental DC10 had an uncontained engine 1 failure (left side) at the V1

range during takeoff from Newark. The aircraft was at a heavy weight, and the
takeoff was continued. Shortly after rotation, engine 3 (right side) lost some power.
The Captain firewalled all three engines, including engine 1 that had the
uncontained failure but still rotated and provided some thrust. The Flight Engineer
asked the pilots if they wanted to shut down engine number 1 however, they
decided to keep all the power they could. The airplane came back for an immediate
landing without dumping fuel in under 10 minutes. Although substantially over the
maximum landing weight, it landed safely. It was found that all three engines had
to be replaced. Debris from engine 1 went through the forward cargo pit and
passenger floor into engine 3, and engine 2 was “over-temp” while all engines were
firewalled.

382
 Overweight Landing / Fuel Dumping
(Jettisoning)
There seems to be unwarranted concern regarding overweight landings and
aircraft are lost while dumping/burning fuel when they could land safely. Some
pilots are not aware they can land overweight.

Suppose the airplane is returning to the departure runway. In that case, an

overweight landing is not a stopping capability or a go-around performance
concern - it is simply a man-hours maintenance inspection matter (mainly of the
flap fairings). The landing gear is not normally a concern either (see design limits,
in this Part).

During takeoff, the plane is heavier, it has a higher speed at Vr (than when landing),
and it can stop with a margin of safety on the remaining runway. When it lands, it
is lighter, slower (less weight and more flaps than at takeoff) and is touching down
at the beginning of the runway having much more room to stop.

However, if landing not on the departure runway, reevaluate the required landing
distance and go-around performance.
Flying extra time to dump fuel makes sense in situations when the safety of
the aircraft is not at risk, the issue is not time-critical and does not have
implications to flight controllability (e.g., fuel imbalance, Qantas 32).
When dealing with a technical emergency, be aware that we, as pilots, are likely
not to have the complete information of the developing situation. The aircraft has
limited detection capability and only in certain areas. It is impossible to know the
full extent of the problem until after the mechanics’ post-flight evaluation. We must
always assume the situation can deteriorate and become life-threatening.

For example, an engine malfunction can cause an internal fuel leak/fire in the wing
with no detection capability.

Unless we are confident* that it is safe to extend the flight,

the landing should not be delayed even if overweight.
* (Confidence based on verification and not on baseless assumption).

In the philosophy of keeping it simple:

If the flight is returning due to a non-life-threatening medical emergency (or
similar), it is OK to extend the flight to dump fuel and prevent an overweight
landing.
However, if the emergency is life-threatening, do not dump fuel, land ASAP
and send an overweight landing report.

383
Note: - Fuel dumping below 6,000 feet above ground can cause damage on the
ground.
There is much data substantiating damage when dumping at 4,000 feet and below.
There are reports of fuel dumping at 5,000 feet, however, I could not confirm if
these flights were over inhabited areas or not and if there was ground damage or
not. At 6,000 feet and above, fuel will disperse satisfactorily.
Note: - It is normal to practice Jettison procedures in a holding pattern during
simulator sessions. However, in the real-world environment it is best to dump fuel
while not in a holding pattern to reduce concentration and prevent the plane from
flying through its dispersed fuel should there be updrafts in the area.

--- Fuel Dumping if Ditching or Off-field Landing

In this case, the purpose of fuel dumping is to reduce impact forces and to allow
an intact aircraft to float longer.
The decision to ditch or make an off-field forced landing should be made when
losing the aircraft is highly credible. This would be indicated by a risk of loss of
internal visibility, loss of flight controls, or a persistent fire. Because these events
do not follow a predictable or gradual pattern but tend to happen suddenly, the
crew needs to anticipate this and not delay the “Controlled Arrival” to dump fuel.
Ditching and Off-field landings are addressed in M8 - Failure of All Engines.

--- Delta 89 - B777 - LAX 2020-01-14

News: https://avherald.com/h?article=4d1f4f9a&opt=0
ATC video: https://www.youtube.com/watch?v=mIA90evz8gs

Perceived engine compressor stalls after takeoff when approaching 8,000 cause
a return to LAX.

- Timestamp 1:15 and again at 1:40 - When questioned by ATC, the pilot declares
that he will not dump fuel. However, he later decides to do it without advising.

- Timestamp 3:15 - While descending through 7,300 feet, the pilot informs ATC
that he will pull off the runway because it is just a compressor stall.

Clearing the runway is a thought that should only occur after the aircraft has
been inspected and cleared by the firefighters. The compressor stall was the
only perceived anomaly, but the full extent of the damage cannot be verified in-
flight. The Captain did vacate the runway.

Observations (Capt. Vireilha):

- DL89 lost one engine and the emergency needed to be declared. Although they
did not declare an emergency, the pilots and ATC perceived a state of emergency,
which can be identified in the communications.

384
- It is acceptable to dump fuel while returning to the airport, but ATC needs to be
informed and jettisoning should have stopped when below 6,000 feet and not
continue at low altitude on final. The amount of fuel dumped in that last minute or
two caused undesirable effects on children’s schools, and it had a negligible impact
on the approach speed (about 1 knot per minute of dumping).

Runaway Stabilizer
A runaway stabilizer can be triggered by different systems anomalies on any
aircraft type. The Lion Air 610 and the Ethiopian 302 accidents are examples of an
MCAS-related failure. However, a runaway stabilizer can occur on any airplane.
At the first indication of an undesired automatic pitch trim command, countering
the tendency, cutting electrical power to the trim motor AND maintaining airplane
speed under control (with thrust and/or spoilers) must be immediate actions. Any
delay will cause drastic changes in attitude and speed, quickly.
The airspeed needs to remain near the speed the plane had when the event began.
If airspeed increases, the aircraft will develop an out of trim condition that may be
impossible to recover with manual trimming. Power reduction to idle and spoilers
should be used early on if necessary.
If speed is decreasing, adding thrust will help maintain speed but it may cause a
nose-up tendency (if engines are under the wing). Manual trimming at lower speed
should not be an issue.
Once the situation is under control, do not reinstate failed systems.
Despite the appalling consequences of flights 610 and 302, this failure can be a
non-event if managed correctly.

Runaway Stabilizer Narrative

I was the F/O on a LAB B727 flying between Bolivia and Panama in 1979. The
aircraft was on autopilot, and the Captain had gone to the passenger cabin before
starting the descent to Panama. I initiated the descent with vertical speed, and as
the plane began to descend, the stabilizer trim wheel started to move nose-down
normally. Then, unexpectedly, the A/P disconnected, but the trim wheel continued
to move nose-down at a slow speed. I recognized this was not normal and moved
the stab trim cutoff switches to the off position. I grabbed the controls and pulled
the plane’s nose up to where it needed to be, causing a small bump on our
otherwise smooth flight. Then I pulled out the handle for manual control of the stab
trim wheel. Instinctively, and although I was an inexperienced co-pilot, I did not try
to reengage the autopilot or the electric stab trim. The Captain returned from the
cabin asking - why the bump? I explained what had happened, he agreed to
continue to fly and trim manually, and we landed uneventfully.

385
 Windshield Cracking
Most windshield cracking is from encounters with ice pellets, the result of flying
into adverse weather. Bird strikes can also substantially damage the windshields,
and some failures are attributed to delamination from uneven heating.

Allowing the windshield wipers to stop outside of the retracted or parked position
contributes to the uneven heat distribution. Placing objects against the windshield
also affects heat distribution. These factors contribute to delamination. Once
delamination starts, uneven heating accelerates. Maintenance then needs to
periodically measure the expansion of the bubble to determine when to replace the
windshield.

Window heat cycle interruptions can also cause uneven heating. The window heat
cycle may fail, causing uninterrupted heating to a window and an overheat or a fire
condition of the terminal blocks (the connection between power wires and heating
elements attached to the window). A combination of intense uneven heat inside
and extreme cold outside can cause a window to crack or shatter in flight.
Although the MEL allows flying with a cracked outer pane (and heat off), this was
intended to allow an airplane to reach a suitable repair station. An unheated
window will freeze and fog up, creating zero visibility once the flight encounters
moist air during descent (below FL270). Windshield wipers will not clear this
condition at all, even at high speed.
Should a window crack, or if the window heat fails, consider the consequences of
prolonged exposure to radiated cold air (same temperature as OAT, about -65ºF
or lower) from a window two feet away from the eyes and facial skin. In actual
events on short flights, pilots had to sit as far as possible from the controls. On
longer flights, they had to leave the seat. Because that seat is vacant, the flying
pilot must be on oxygen continuously. The aircraft does not have enough oxygen
to support this event or cope with an additional depressurization. Continued flight
in these conditions is not advised.

--- Structurally Safe?

When a windshield cracks, the window electrical heat must be removed
(conductive heat). Only warm air should be used (convective). Then, the
determination needs to be made if it is safe to continue pressurized flight. Just
because the windshield is still there does not mean it will not burst with the next
structural move (turbulence) or pressurization bump. Refer to the Window Damage
or equivalent checklist.

386
 Fig.6 - If the damage is like a car windshield after an accident,
when one cannot see through it, this is an indication that it is not safe
to remain pressurized.

If the windshield blows out and the pilot behind it does not have the shoulder straps
on, he will be extracted through that opening. Such was the case of BA 5390, next.

Intentionally Left Blank

387
--- British Airways 5390 - BAC 111 - Birmingham 1990-06-10
https://aviation-safety.net/database/record.php?id=19900610-1
The Captain’s forward windshield (L1) was blown out climbing through FL173
(7.6psi) due to its defective installation the night before the flight. The Captain
was sucked out of his seat and held by his legs by a F/A until after landing.
Although the crew believed the Captain was deceased, they held on to his body
to prevent him from being ingested by one of the rear-mounted engines that
would cause an engine failure (fig.7). The Captain survived the incident.

Fig.7

--- The “pen test” – A windshield has several layers of windowpanes (usually
between 3 to 11 depending on the type). If the tip of a pen can touch the crack
from inside the cockpit, then the fracture is on the innermost pane, the one
responsible for holding aircraft pressurization.
If the pen tip is a few millimeters away from the crack, then the problem is with one
of the outer layers and not so structurally critical. Regardless, window heat must
be turned off with the consequences described previously.

When visibility through the windshield is not impaired, it is usually an indication

that it is safe to remain pressurized, however, use your best judgment and
guidance from your checklist and the recommendations of your maintenance
control. They will ask for a description of the fracture - shattered, can’t see through
or spider-web, with good visibility.

388
 Fig.8 - Spider-web fracture, good visibility.

Fig.9 - Spider-web fracture.

Visibility is good despite the rain during landing.

389
Fig.10 - Visibility is not as good after an encounter with ice pellets
and it affects both forward windshields.

Fig.11 - Ice pellets can perforate and damage the windshield

to a point where visibility becomes severely impaired.

390
Fig.12 - The nose radome can be simultaneously damaged by ice pellets. Its
collapse results in the loss of the protection afforded by the lightning diverter
strips. If lightning subsequently strikes the aircraft, it can result in the shredding
of the radome.
A radome implosion prevents the radar antenna from operating and decreases
airspeed by approximately 0.4 Mach, increasing fuel consumption. It also causes
a notable increase in environmental noise on the flight deck (e.g., B787, A350) or
main deck (e.g., B747, A380).

Fig.12

Spoiler Effects
Spoilers work in conjunction with outboard ailerons when slats/flaps are extended
on most transport category aircraft. During crosswind takeoffs, if more than four
units* of aileron correction is applied, spoilers will deploy on the wing with the up
aileron. This will compress the corresponding landing gear strut placing the
aircraft’s tail closer to the ground during the rotation and increasing the risk
of a tail strike.
* - The four units’ reference can be found in Boeing aircraft maintenance manuals
and pertain to the markings on the pilots’ control columns. Without this information,
pilots can visually see the spoiler deployment when parked at a gate facing a glass
terminal. Coordinate with maintenance/ramp before selecting slats/flaps out of the
retracted position.

Using more than four units of aileron correction also increases the takeoff roll,
invalidating the takeoff calculations.

391
Also, the climb gradient will be substantially reduced when more than four
units of aileron are used during an engine out, second segment. Use rudder
only and keep control wheel displacement between eleven and one o’clock (of
control wheel center) if needed for turns, while flaps are not in the UP position.

--- United 863 - B747-400 - San Francisco 1998-06-28

https://en.wikipedia.org/wiki/United_Airlines_Flight_863
Loss of engine 3 during rotation. F/O corrects drift with ailerons causing spoiler
deployment and loss of climb performance, missing San Bruno Mountain by 100
feet.

Spoilers will automatically retract if throttles are pushed forward during landing (on
most modern aircraft). This automated feature does not exist in flight, allowing
simultaneous use of spoilers and thrust as required. During cruise descent in
heavy precipitation, it is recommended to advance thrust from idle to increase the
engines’ water ingestion capability and reduce the possibility of a flameout.
However, this procedure reduces the aircraft’s descent rate to a level that may not
meet the desired VNAV or ATC needs. Spoiler deployment helps increase the
descent to a reasonable rate.

Numerous incidents and accidents have occurred as pilots forget to retract the
speed brakes when they are no longer needed. Regardless of the reason for
spoilers’ use in flight, it is a good practice to keep one hand on the speed brake
lever while they are in use.

--- United 553 - B737- Chicago 1972-12-08

https://aviation-safety.net/database/record.php?id=19721208-1
During final approach, the airplane was high and fast. Spoilers were used to
increase descent but were never retracted. During the subsequently missed
approach, the plane failed to gain altitude and crashed (first B737 to be lost).

--- TransBrasil 801 - B707 - S. Paulo 1989-03-21

https://aviation-safety.net/database/record.php?id=19890321-0
The runway was closing for repairs at noon and the flight’s expected arrival was
just a few minutes later. ATC advised they would keep the runway open until
landing if the flight would keep the speed up.

The ILS Glide Slope was intercepted at high speed with spoilers fully deployed and
idle thrust in clear day conditions. As the aircraft stabilized at approach speed,
thrust gradually increased to maintain the Glide Slope. However, spoilers were not
retracted, and the airplane eventually descended below Glide Slope at full power
and crashed 1.3 miles from the runway.

392
Observations (Capt. Vireilha):
I was a B727 Second Officer for this airline when I flew with Captain Dorival, the
instructor on QD 801. He was viewed as one of our most competent check pilots,
and he was training a F/O to Captain’s upgrade, but this pilot was having difficulties
completing the program.
The CVR indicates that when Captain Dorival (on the right seat) took over by
applying full power, he commanded the F/O (on the left seat) to retract the speed
brakes. The aircraft hit the ground in a nose-high, slight left wing down attitude and
close to stall speed. As the center fuel tank exploded, a fireball penetrated the
cockpit, which froze* the pilots in the positions they were in at that moment. The
Captain’s body was found with his left arm extended, pushing the throttles full
forward. The F/O right hand was holding the speed brake lever in the fully deployed
position. Because there had been sufficient time to retract the spoilers, it is
presumed that the F/O became distressed and did not push the lever forward.
* In a traumatic injury the body can lock in place and/or by fire-induced muscle
rigidity.

--- American 965 - B757 – Cali 1995-12-20

https://aviation-safety.net/database/record.php?id=19951220-1
The flight was approaching Cali from the north and was programmed to land to the
north. A wind change caused the airport to change the landing to the south, making
the aircraft high for the approach. Speed brakes were deployed to assist in losing
altitude.
While reprograming for the new approach, an LNAV error was introduced, and the
aircraft made a left turn towards mountainous terrain. After a GPWS terrain alert,
the crew responded, pulling the nose-up and applying full thrust, but the spoilers
were forgotten in the deployed position. The B757 impacted the mountain 50 feet
from the top.

Approach and Landing

The criticality of 250 knots below 10,000 feet
Turn Radius - Bird Impact

--- Turn radius - Although pilots reduce to 250 knots descending below 10,000
feed, some tend to slow further on their own without requesting or advising of their
needs to ATC. The approach controller plans vectors to predict a flight path (same
turn radius if all planes are at the same speed. When an airplane is slower, it ends
up in a different place than what the controller needed, and a new vector is issued,
e.g., “turn further right, heading….”
Speed of 250 knots needs to be maintained below 10,000 feet unless instructed
otherwise. This is not an issue during departure, as pilots request high speed if
clean maneuvering speed is above 250 knots.

393
This Civil Aeronautics Board ruling resulted from two mid-air collisions between jet
and propeller airliners. Their substantially different speeds were a factor.
- NY 1960-12-16 United 826 DC8 & TWA 266 Constellation.
- Carmel 1965-12-04 TWA 42 B707 & Eastern 853, Constellation.

--- Bird Impact - Some pilots routinely fly faster than 250 knots below 10,000 feet,
a rule that applies to most of the world’s-controlled airspace. The motivation may
be to meet the arrival schedule.
However, the risk/reward criteria do not justify this procedure. Regardless of
airspace regulations and pilot interpretation of aircraft limitations, flying fast for the
short period that aircraft spend below 10,000 feet saves very little time, but
exponentially increases the damage that may result from a bird impact. Depending
on the bird’s size and airplane’s speed, and regardless of the impact being on the
nose cone or the windshield, a bird can penetrate the cockpit with devastating
effects (suggested word search - Bird Strike - for multiple references in this study).

Landing Gear Design Limitations

Commercial aircraft main landing gear max sink rates (not nose gear):
360 ft/m @ MTOW
600 ft/m @ MLW
720 ft/m once in a lifetime
Pilots typically report a hard landing when the touchdown occurs around 240 ft/min,
well below the 600 ft/min maximum limit sink rate.

Fig.13 - Hard landings accidents tend to cause more damage to the downwind
landing gear (and engines as they scrape the runway). It is not the first impact, but
the second that is usually the hardest. M13P5 discusses safe landing techniques.

Fig.13

394
 Low Visibility Missed Approaches and Taxiway
Landings
Aircraft have missed approaches and landed on taxiways for various reasons.
Many could have been avoided by paying close attention to the development of
the final approach cues. However, some circumstances can deceive even the most
seasoned pilots.

A contributing factor is both pilots’ seating position. This item should be part of the
“Low Visibility Briefing Card.” If eye alignment markers are not checked before the
approach, one or both pilots may never see the runway and miss the landing.
Suppose the flying pilot sees the runway at minimums and continues the approach.
In that case, the lower seating pilot will believe the flying pilot went below
minimums because he only saw the runway later.

Another aspect is to consider the surface wind, visualize the crab angle, and where
to expect to see the runway in the windshield. Strong crosswinds can place the
runway closer to the side (corner) of the windshield.

Runways are wider than taxiways, and at the end of a low visibility approach, a
pilot is expecting to land on the wider piece of concrete in front of the aircraft, which
can become a trap.
A low visibility approach with a strong crosswind from the same side of the tarmac
(wider than the runway) is a perfect setup for landing on that tarmac, especially
during daylight when approach lights have less contrast with the environment.

Preventive awareness for this scenario can be created by an approach briefing

that includes seat height, details of what is expected to be seen and their expected
location in the windshield, considering the crab into the wind. Brief that some
approach lights will be behind the aircraft, and runway markings could be covered
by snow. (See Fig. 14)

Intentionally Left Blank

395
 Fig.14

Fig.14 - Landing on runway 4L with a left crosswind, the first visual cues in front of
the pilot would be the wide tarmac PA. Runway 4L would be to the right due to
crabbing into the wind. In the few seconds before landing, pilots have perceived
the plane drifting to the right and corrected to the left landing on the taxiway.
Because the tarmac is physically closer, it also gives a sense of urgency to align
the aircraft.

Intentionally Left Blank

396
 PART 2 - WEATHER RELATED OPERATIONS
Mother Nature is involved in 1/3 of all accidents

Rain Effects
Note: - You may have to divert your flight to a high-altitude airport, even if your
company does not operate it regularly. The landing flare and takeoff rotation
techniques that need to be used to prevent a tail strike (especially when raining)
may not be contained in your manuals. These are described below.
Although manuals account for the accelerate-stop distance performance, there is
very little information on lift degradation due to rain during liftoff and flare at any
elevation.

I had the opportunity to learn about the rain effect on aircraft performance when I
became a B727 pilot for Lloyd Aéreo Boliviano in 1979, flying from the high-
elevation runways in Bolivia (between 8,395 and 13,325 feet).
Although rain affects lift on every takeoff and landing, these effects are not readily
apparent at sea-level operations, but they have significant consequences at high
elevation runways.

--- Where there is water, there is no air, and only air produces lift (and thrust).
When water droplets take the air space above a planes’ wing, less lift is generated
during rotation for takeoff and landing flare. A higher angle of attack is needed to
achieve the same lift.
At high-elevation runways, rotation during takeoff needs to pause at about 10°.
The landing gear shock absorbers extend, and the pilot feels the wheels touching
the runway lightly. Then the airplane can slowly be rotated to 12° waiting for liftoff.
Once airborne, slow rotation can continue to the desired pitch for the second
segment. A typical continuous rotation of 3° per second will likely result in a tail
strike.

Taking off in moderate or heavy rain from a high elevation airport was unthinkable.
We would simply wait for the rain to pass before we would takeoff.

The same loss of lift can be expected while flaring for landing. The presence of
water droplets in the air (taking its place) combined with the higher altitude thinner
air causes the plane to be slow to respond (rate of change). The flare needs to
start earlier than usual to allow time to reduce the descent rate, or the plane will
sink through the flare. A late flare can result in a hard landing, and a more
pronounced flare can result in the tail striking the runway.

397
I watched a Lufthansa DC10 land in La Paz (13,325 feet elevation), and the flare
appeared normal for sea-level conditions, although insufficient for this altitude. The
DC10 could not arrest its sink rate, hitting the runway hard with the right main gear
and bouncing once. As the airplane taxied and turned towards the terminal
building, I could see that the vertical fin was bent to the right due to the weight of
the engine mounted on the vertical fin. The aircraft stayed in La Paz for extended
repairs.

Although airplane manuals account for the accelerate-stop distance performance,

there is very little information on lift degradation due to rain during rotation and
flare at any elevation.

Flying into a Tornado

The USA is the country with the most violent tornados. Cold Arctic air moves over
Canada continuously over frigid land without the benefit of relative warmer ocean
waters. When it clashes with the warm moist air from the Gulf of Mexico, it
produces violent storms.
The USA has on average 1,200 tornados per year, compared with 300 for the
entire European continent and 120 for Canada. However, when compared by area,
the Netherlands has more tornados per square mile, followed by England.
Although of much lesser intensity, they can still cause an in-flight breakup (NLM
431 below).

Tornados are stronger at a lower altitude and more likely to be encountered during
departure or arrival as they cannot be detected by radar (unless they are over
water). They are usually found between thunderstorms (where pilots generally aim
to fly through) or on the trailing end of a line of thunderstorms, especially in a fast-
moving squall line where sometimes several can be found.

Avoiding Tornados
- Departure - Delay the takeoff until the bad weather has passed. Tornados are
fast-moving and usually short-lived.
If a tornado is approaching the aircraft while on the ground, raising the flaps, pulling
the spoilers full up and using the flight controls to maintain the nose on the ground
reduces the chances for damage. Keep the APU running for flight controls and do
not use air conditioning to prevent ingestion damage. Shut down the engines to
avoid FOD*. However, if a tornado approaches the airplane, it may spin the aircraft
around and push it off the taxiway. After the event, do not restart the engines. Have
the aircraft towed to the gate and inspected by maintenance.

398
* Note: There is no need to close the outflow valve to prevent FOD as the extremely
low pressure in the vicinity of the tornado will keep air flowing out of the aircraft at
a high rate.

- En Route Hurricane - Although airlines do not operate to or from airports under

hurricane conditions, they may plan to overfly some of them as the conditions may
be VMC in smooth air. However, this is not safe. An engine failure or a
decompression would force a descent while trying to escape the hurricane. A
critical emergency such as a fire on board would cause a landing in hurricane
conditions placing the flight in extreme peril. Do not accept a flight plan over a
hurricane. Although tornados can be found anywhere around a hurricane, they are
usually concentrated on the frontal right side.

- Arrival - The safest thing to do is to stay away from an area of possible tornados.
They are invisible to radar. Even if you can spot one, others may be undetected in
the vicinity. Circumvent the entire area and hold for weather passage or proceed
to an alternate airport.

Weather Avoidance Radar, as the name indicates,

was designed to avoid weather and not to penetrate it.

--- NLM Cityhopper 431 - F28 – Rotterdam 1981-10-06

https://aviation-safety.net/database/record.php?id=19811006-0
While attempting to fly between two large thunderstorms, the aircraft flies into a
tornado and encounters +6.8 G to -3.2 G forces, fracturing the right wing.

--- Braniff 250 - BAC111 - Omaha 1966-08-06

https://aviation-safety.net/database/record.php?id=19660806-0
- While trying to find a passage between cells in a squall line, in clear weather
(an area where tornados are predominant), aircraft encounters extreme turbulence
causing separation of the tail and outer right wing (elevators were over-extended
upwards). The aircraft was caught in an updraft exceeding the ultimate design load
of 140ft/s (8400 ft/min).

- Winds are pushed down from thunderstorms and travel over the ground, as much
as 20nm forward of the squall line. Then, in an upward motion, they return to the
cell, creating a very powerful roll circulation in front of the squall line and at
the same altitude as the base of thunderstorms. Braniff 250 was flying at 4,000
ft above ground, the same altitude as the base of thunderstorms.

399
--- Continental DC9 - Houston 1987
Narrative from Capt. Vireilha.
The flight penetrates a small tornado at 4,000 ft (in IMC), behind and on the south
end of a squall line with no echoes on radar. The aircraft banks 45° to the right with
full deflection of flight controls commanding a left turn. A high-frequency vibration
was felt for a continuous period, making the instruments impossible to read, and
the aircraft climbed rapidly away from 4,000 feet with power near idle.

The wings returned to level, and the aircraft’s nose was pushed down attempting
to maintain altitude. Airspeed increased from 170 knots to 235 knots, and flaps
were brought to a lower setting to prevent exceeding flap speeds. The aircraft had
analog airspeed indicators with a white pointer against a black background,
allowing me to see the airspeed despite the strong vibration.

Turbulence suddenly stopped as quickly as it began, and we started the descent

from 6800 feet to 4,000 feet in smooth air. The upward event is estimated to have
lasted about one minute.

Intentionally Left Blank

400
 Takeoff into Turbulence
--- EverGreen 46E - B747 - Anchorage 1993-03-31
https://aviation-safety.net/database/record.php?id=19930331-0
Fig.1 - Before takeoff, the tower controller informed EverGreen 46E that another
B747 reported severe CAT at 2,500 feet while climbing out from runway 06R.
EverGreen accepts a takeoff clearance. At 2,000 feet, the aircraft experienced an
uncommanded left bank of approximately 50°. While the desired speed was 183
knots, the speed fluctuated from a high of 245 knots to a low of 170 knots.
Shortly after that, the flight crew reported a huge yaw, the number 2 throttle
slammed to its aft stop, the number 2 T/R indication showed a T/R deployment,
and the number 2 engine electrical bus failed. The plane experienced several
severe pitch and roll oscillations before engine 2 separated. Engine 1 was
maintained at maximum power. On downwind, bank angles momentarily exceeded
48°, alternating with wings level.

Fig.1

Intentionally Left Blank

401
--- IAT 302 - B707 - Oostende Belgium 1998-11-14
https://aviation-safety.net/database/record.php?id=19981114-0
As with the previous accident, engine 3 separates after encountering turbulence
climbing through FL240 (fig.2).

Fig.2

Avoiding Turbulence
--- United 826 - B747 - Tokyo to Honolulu 1997-12-28
https://aviation-safety.net/database/record.php?id=19971228-0
The flight had a severe mountain wave turbulence encounter (+1.8G) two minutes
after receiving a smooth ride report from the Northwest Airlines B747 ahead. With
one fatality and 84 injuries, the Captain decided to return to Narita for medical
assistance. The B747 (N4723U) was declared damaged beyond repair.

Another flight, a Continental B777 over Alaska, was caught in severe turbulence.
The airplane went violently out of control, banking 45 degrees left and right
repeatedly, causing severe injuries to crew and passengers, and diverted to
Seattle. The Captain described that he felt as if the plane’s tail was about to
separate. The aircraft was bent and remained at Boeing for repairs for an extended
period. After this flight, the Captain chose to stay on medical leave until his
retirement.

Turbulence can have a devastating effect on a flight and its occupants. Passengers
who are afraid of flying often state it was due to previous bad experiences.

The best way to deal with turbulence is during the preflight stage, by
selecting a route away from areas of turbulence.

Airline management states that their priorities are safety, comfort, scheduling and
efficiency in this order. When a Captain analyzes the company’s proposed flight
plan, he rightfully assumes that his route was selected according to these criteria.

402
The flight plan computer builds the route according to efficiency (least cost, most
fuel-efficient) and then it is up to the flight dispatcher to tweak the route to avoid
forecasted weather and turbulence. I have seen management-issued bulletins
prohibiting dispatchers from altering the computer-generated flight plan to avoid
turbulence unless it reaches level 4 (moderate). Management’s justification is that
flight plans are put together hours before the plane reaches that segment of the
flight. If with updated weather information, the Captain wants something different,
then he can change the route.

But because the Captain may not be aware of the flight dispatcher’s restrictions,
he usually accepts the route as is, believing it is the least turbulent. And in my
experience, deteriorating weather updates that were available to dispatch before
the flight were uploaded to the aircraft right after takeoff, when I could no longer
add fuel.

A Captains’ duty is to provide a safe and comfortable flight. This is achieved

in part by avoiding weather systems and turbulence.

If you are crossing the Atlantic and the northern tracks go near to weather you are
not confident you can avoid, select a southern route to avoid the turbulence by a
safe margin. Keep in mind that the flight plan was prepared hours before you arrive
at the area in question, and it may have moved far by then. You need to allow for
sufficient separation. Trying to split hairs by selecting the next track or the next
altitude does not distance you sufficiently from the weather.
When your flight plan plows through questionable areas of turbulence, tell dispatch
to avoid that area. Call them for a weather briefing before leaving home and make
the changes then. Dispatch will prefer to work only once on your flight plan. It can
add as much as 20 minutes to an ocean crossing, but your passengers will have
a smooth flight allowing for good cabin service. That is what they will remember
and make them come back.

Intentionally Left Blank

403
 Flying in Turbulence
- Should the flight encounter considerable turbulence, consider turning A/P off and
fly manually to allow the plane to climb and descend, maintaining wings level with
gentle corrections to prevent overstressing the airframe.
The crew should use all five-point harness in the locked position in anticipation of
unexpected severe turbulence.

- Another option is to engage the A/P in Flight Path Angle 0.0° and Heading
Hold. Both modes will return aircraft to level flight without the structural stress of
attempting a return to the previous altitude* or heading*.

- Maintaining altitude and course is secondary, the priority is to prevent an

in-flight breakup. Exceeding the IAS red line at high altitude can create
aerodynamic flutter and loss of the elasticity properties of the flight controls,
leading to their failure, loss of hydraulics and loss of control.

* Note:
- FPA 0.0° holds an absolute altitude without “knowing” what altitude it is. It does
not hold a specific altitude like “Altitude Hold” does.
- Heading Hold simply holds the wings leveled without knowing what heading it
is. It does not hold a specific heading like “Heading Select” does. It engages once
wings are, for example, 2.8° from horizontal (value depends on the system).

--- Northwest 705 - B707 - Miami 1963-02-12

https://aviation-safety.net/database/record.php?id=19630212-0
The flight departed Miami and was climbing to the West. Moderate to severe
turbulence was reported while in the clear but near thunderstorms. Passing 17,500
feet, the aircraft was pitched up abruptly at 9,000 feet per minute to 19,300 feet,
and speed dropped from 270 to 215 knots. This was countered with stabilizer trim
down, followed by a downdraft resulting in a severe pitch down to -2.8 G’s. Wings
and horizontal stabilizers failed in a downward direction, the forward fuselage and
engines separated upward.
The chosen flight path was too close to cells, and improper recovery from unusual
attitude using stabilizer trim led to an in-flight breakup.

--- Eastern 304 - DC8 - New Orleans 1964-02-25

https://aviation-safety.net/database/record.php?id=19640225-0
Pitch Trim Compensator was placarded inoperative and on MEL. However, it
would allow the flight to be dispatched to Atlanta with a speed limit and to remain
in smooth air. Climbing through 4,000 ft aircraft encountered turbulence, pitched
20° nose-down, and continued descent until impacting a lake. The full
consequences of MEL placards need to be understood and considered.

404
--- Continental 210 - B757 - San Francisco to Houston 1996-01-17
Narrative from Capt. Vireilha.
During cruise flight, an American Airlines DC10 just ahead of us reported severe
turbulence and requested an emergency descent and a landing due to injuries on
board. Trying not to fly into that turbulence, we too started a descent with full speed
brakes from FL390 to FL200. However, we kept the original course, and in
retrospect, I should have requested a 90-degree turn for the descent. We lost most
of our electrical instruments when we encountered the turbulence, although we
had both generators online. We lost the A/P, A/T, F/D, Comm/Nav 2 and all the
electronic displays (analog OK).
After landing, maintenance informed us that our E&E rack supports had been
damaged (by the weight of the units under G forces) and allowed the equipment
to slide and become disconnected.

Note on passenger seat belts:

- Passengers not wearing seat belts become projectiles against aircraft internal
structures and typically sustain injuries sometimes fatal.
- Passengers wearing seat belts may be injured by dislodged cabin furnishings or
other occupants falling on them.

--- Olympic Airways 3830 - Falcon 900 - Bucharest 1999-09-14

https://aviation-safety.net/database/record.php?id=19990914-2
This corporate flight had ten passengers in the cabin, seven of whom were not
wearing seat belts. During an aircraft upset, these seven did not survive. The pilots
and the F/A had their seat belts on.

Wake Turbulence
Turbulence from the aircraft ahead at the same approximate altitude has turned
many aircraft upside-down, leading to uncontrolled flight into the ground. A five-
mile separation should be observed. However, a pronounced turn initiated by the
leading plane will quickly reduce the distance below the minimum separation. Wind
will also affect the travel of the wing tip vortex (see incidents below).

--- Mexican Government - Learjet 45 - Mexico City 2008-11-04

https://aviation-safety.net/database/record.php?id=20081104-0

--- Delta 9570 - DC9 - Fort Worth 1972-05-30

https://aviation-safety.net/database/record.php?id=19720530-0

--- USAF KC-135 Stratotanker (Whale 05 Desert Storm mission)

A wake turbulence encounter from the KC-135 ahead caused the following KC-
135 to roll in both directions over 110° generating 2.88G on the left wing and 2.61G
on the right wing. Both engines 1 & 2 separated from the left wing, causing
substantial systems loss. Both engines 3 & 4 on the right wing lost two of the three

405
bolts that held them to the wing but remained attached and functioning. The aircraft
landed safely in a show of outstanding airmanship from the crew.
Learn more about the mission and the pilots:
Aircraft Commander - Lt. Col Kevin Sweeney
https://sweeneyspeaks.com
Co-pilot - Brigadier General Jay N. Selanders.
https://www.nationalguard.mil/portals/31/Features/ngbgomo/bio/3/3062.html
Documentary - Air Crash Investigation, Season 16, Episode 7, Mission disaster.

Intentionally Left Blank

406
 PART 3 - COLD WEATHER

Overnight Refuel
When the ambient temperature is <32°F (<0°C), an overnight aircraft should be
fueled about one hour before departure, instead of the night before. This allows
the fuel to stay in-ground storage, which is about 55°F (12°C). Any residual water,
which may freeze at the bottom of the aircraft's fuel tank, will become liquid again
when in contact with warmer fuel and be purged during preflight.

However, if the fuel to be loaded is already in a fuel truck exposed to the elements
overnight, it would be better to fuel the aircraft the night before to reduce the
amount of moisture in the ullage (the space inside of a fuel tank not filled by fluids).

Engines Pre-heat
It is standard to wait for the engine oil temperature to be in the normal operating
range (green band) before takeoff. But this alone may not be sufficient when
operating in <-5°F (<-20°C). During the takeoff run, colder-than-usual fuel goes
through the fuel-oil heat exchanger, and the engine oil needs to be warmer than
usual to remain in the green band. Otherwise, oil temperatures may drop, and the
Fuel Filter Bypass may illuminate during takeoff or initial climb. I experienced
this unsettling warning during a takeoff’s high-speed regime.

There are two procedures pilots can do to meet this challenge:

- Preheat the engines. When an aircraft has an extended ground time (overnight)
at extremely low temperatures, consider running engines at idle for 5* minutes
before passenger boarding (50-60 minutes before departure time), then shut them
down.
* The manual may recommend 3 minutes, although our cold-weather experience
showed this was not enough when the overnight temperature was <-5°F (<-20°C).

- In addition, before takeoff, ensure oil temperatures are well within the normal
operating range (and not just entering the operating range). This may take up to
20** minutes of idle running before takeoff.
** (In addition to the 5 minutes preheat before passenger boarding).

Intentionally Left Blank

407
 Aircraft De-icing
“Zero Tolerance”
For snow or ice on any aircraft surface

Fig.1 - Snow or ice laying on the upper fuselage or the center engine inlet can be
ingested, which may cause an engine to have an uncontained failure.
FedEx DC10 Boston 2001-03-06 Engine 2 explosion

Fig.1
Wind strips on the wings allow for easier wing-ice detection during preflight.
Without them, overnight frost or ice formation may go undetected.

--- Air Yunnan Airlines 5210 - Canadair CL600

Bautou China 2004-11-21
https://aviation-safety.net/database/record.php?id=20041121-0
The airplane was parked overnight in cold weather conditions. The overnight frost
contaminated the wings with ice, and the plane was not de-iced before departure.
Shortly after rotation, the aircraft stalled and did not recover. Note that ice is more
likely to stay attached on short-wing planes (less flexible wing), causing a stall.

On longer wings, which flex more at rotation, ice tends to break away and can be
ingested by rear-mounted engines, causing engine flameout (see SAS 751,
Aeroflot 7841, Airborne Express DC9).

De-ice with slats fully extended if aircraft flew in icing conditions or landed on a
contaminated runway and reverse thrust was used. The standard de-icing with
flaps/slats retracted does not clear the wings leading edge behind the slats.

--- Air Ontario 1363 - F28 - Dryden Canada 1989-03-10

https://aviation-safety.net/database/record.php?id=19890310-1
It was believed that loose snow over the wing would roll off during takeoff. Instead,
on this flight it quickly turned into clear ice and stuck to the wing, preventing the

408
plane from gaining altitude after rotation. The plane flew in ground effect until the
end of the runway, and then it crashed down a ravine.

--- Transwede - Caravelle - Stockholm 1987-01-06

https://aviation-safety.net/database/record.php?id=19870106-1
Stabilizer stall right after rotation (due to stabilizer ice) causes aircraft to return to
the ground. Do not assume that the upper portion of the stabilizer is clear of ice
simply because the wing appears clear (the wing is warmer). Clear ice is very
difficult to detect visually. Have maintenance perform a tactile check, and if unable,
have the stabilizer de-iced.

Cold Weather Taxi

Do not use fuel conservation procedures. Keep engines always running, especially
when in icy taxiways and windy conditions. This will help keep control and remain
on the taxiway.

--- Japan Air Lines 422 - B747 - Anchorage 1975-12-16

https://aviation-safety.net/database/record.php?id=19751216-0
Fig.2 - Taxiing for takeoff with an 80° wind from the left at 25 knots, the plane
weathercocked 10° on the taxiway. The Captain stopped, set the parking brake,
and shut down the engines asking for a tow truck to return to the terminal. The
plane then weathercocked 70° and slid backward down a slope of -13°, causing
substantial damage to the aircraft. The Captain did not anticipate the predictable
unsafe taxi conditions at the airport and by shutting down the engines, the airplane
became vulnerable to the wind on the icy taxiways. Notice wind-blown slide 5L.

Fig.2

409
 Flaps
When taxiways are contaminated with snow or ice, manuals may recommend
taxiing slowly with flaps/slats retracted to prevent tires from throwing ice into the
flap tracks, which could preclude flap retraction after takeoff. Similarly, flaps should
be retracted after landing before taxiing onto contaminated taxiways.
Caution - When flaps are not extended at their usual time in the checklist, they
may be forgotten (particularly if this item is not repeated on the Before Takeoff
checklist). Be aware of this operational threat. Use TEM for risk mitigation.

Wing Configuration/Contamination
Occasionally, aircraft crash during takeoff due to the flaps not being set. Cabin
Crew recognition of slat/flap extension can prevent takeoff configuration accidents.
Cabin Crew manuals should include photos of a wing with flaps up and with takeoff
flaps. As a backup, a routine before-takeoff visual check performed by a cabin
crewmember would have prevented many fatal accidents and incidents.

--- Pan Am 799 - B707 - Anchorage 1968-12-26

After extending the flaps before taxi, the Captain decided to retract them once he
realized the icy taxiway conditions (as per the recommendation above). Although
the F/O commented, “let’s not forget them,” they did not create a prompt to remind
them. The plane took off with the flaps retracted, becoming unstable after rotation
and crashing in a steep bank. The configuration warning did not sound as it was
set for 45° of throttle advancement, and due to the extremely cold conditions,
takeoff power was achieved with only 43°. This accident prompted the
“configuration warning” to be reset at 25°.
- Observation (Capt. Vireilha):
When I must taxi for takeoff with the flaps in the retracted position, I place the
aircraft logbook in front of my windshield, restricting visibility which would preclude
me from starting a takeoff (triggering flap selection, should we forget).

Caution - There are incidents when takeoffs are unintentionally initiated without
flaps. This will trigger the takeoff configuration warning, prompting less disciplined
pilots to select takeoff flaps and continue the takeoff. Should the slats/flaps not
deploy correctly, the airplane is in danger of becoming unstable in roll. A takeoff
configuration warning mandates a rejected takeoff.

--- Similarity with the “Sabre Dance”

Swept-wing aircraft that takeoff with contaminated wings or without flaps in the
takeoff position, at rotation, become unstable in roll due to one wing staling before
the other. This, in turn, causes oscillations around the roll axis (longitudinal),
generally leading to wingtip ground contact and subsequent aircraft crash.

410
As a wing stalls, the center of pressure moves forward, raising the plane’s nose,
increasing drag and further slowing the airplane. Attempts to lower the nose may
be ineffective if the wing blanks the horizontal stabilizer.
Rapid and excessive rotation pitch and loss of rudder authority (wing blanking) can
exacerbate the effect.
These swept-wing characteristics are accentuated when thrust in the tail adds to
yaw instability (vertical axis). Tail-mounted engines are also more prone to
compressor surges due to wing blanking.

This instability became known as the Sabre dance after the USAF F-100 Super
Sabre. This was first realized during slow-speed approaches and late power
corrections (flying behind the power curve).
Sabre dance video: https://www.youtube.com/watch?v=Q2qqKwndFW0

The pilots of the following flights forgot to select the flaps for takeoff for reasons
other than snow or ice.

Intentionally Left Blank

411
--- Spanair 5022 - MD82 - Madrid 2008-08-20
https://aviation-safety.net/database/record.php?id=20080820-0
The pilots were rushing to takeoff to compensate for a return-to-gate delay. The
flaps were overlooked and not extended. The configuration warning was
inadvertently deactivated by maintenance.
“Sabre dance” and the loss of 154 of the 172 occupants.

Fig.3 - Notice the witness marks on the ground. The airplane was airborne
momentarily as there are no tracks from the runway to the primary impact point.
- Notice the straight nose gear tracks and the zig-zag tracks of the main landing
gears. It is not possible for a pilot to induce such turns at the speed an MD80
becomes airborne. These are indications of the aerodynamic instability described
above due to the slats/flaps not being extended.

Fig.3

--- Air France 7775 - Fokker 100 - Pau, France 2007-01-25

https://aviation-safety.net/database/record.php?id=20070125-0
Immediately after rotation at 128 knots, the airplane banked 35° to the left, followed
by a 67° bank to the right and a second 59°bank to the left (Sabre dance). From a
height of 107 feet and at 165 knots, the Captain rejected the takeoff. The airplane
returned to the ground and, during the overrun, lost both main landing gears and
impacted a truck, unfortunately killing the driver. There were light injuries to some
of the 54 occupants. The accident was the result of wing-ice contamination.

- Observation (Capt. Vireilha) - It is extraordinary that this Captain had the

presence of mind, under these extreme circumstances, to make the correct
decision to reject the takeoff and execute a controlled arrival. Most flights in a

412
similar predicament would continue to try an impossible flight and crash, most likely
killing all on board.
In France, accidents are regrettably criminalized, and the Captain was charged
with homicide of the truck driver.

--- Delta 1141 - B727 - Dallas DFW 1988-08-31

https://aviation-safety.net/database/record.php?id=19880831-2
Fig.4 - Crew distraction with a non-pertinent conversation with a F/A in the cockpit
leads to the flaps not being selected for takeoff. Configuration warning failure.
“Sabre dance” and compressor surge at rotation. Loss of 14 of the 108 occupants.

Fig.4

--- Northwest 255 - MD82 - Detroit 1987-08-16

https://aviation-safety.net/database/record.php?id=19870816-2
Crew distraction with non-pertinent conversation leads to the flaps not being
selected for takeoff. Configuration warning CB was pulled out.

As a fuel conservation procedure, one engine would be shut down after landing.
When advancing the other engine for the taxi with flaps up, the configuration
warning horn would sound, and it was common practice to pull the CB to silence
the horn. If the next crew forgot to push the CB back in before the next takeoff, the
system would remain deactivated.

“Sabre dance” at rotation. Loss of all on board (154) except one 4-year-old girl
(plus two killed on the ground).

Intentionally Left Blank

413
 Snow Furrows
Fig.5 - Do not taxi through snow furrows since wheels can pick up snow/ice, which
can stick to the rims and unbalance the tires, causing vibration or damage to the
underside on takeoff.

Fig.5

Intentionally Left Blank

414
 Hydraulic System Contamination
To circulate hydraulic fluid to the rudder pedals before takeoff, initiate taxi turns
with full deflection of rudder pedals, then complete turn with tiller while holding
rudder pedal. When coming out of the turn, use the tiller until within rudder pedal
authority, then complete turn while releasing rudder pedal pressure. This will help
purge air that may have been admitted into the system and bring warmer fluid to
systems that have not been used. Air that is not purged tends to go to the highest
point in the hydraulic system and could affect elevators during rotation or rudders
during engine out. Using rudders instead of the tiller to initiate turns also makes
turns smoother.

- Water can also contaminate the hydraulic system and freeze in-flight, preventing
proper flight controls actuation (primary or secondary).

--- Air Nostrum 8665 - Canadair CL600

Valladolid Spain 2007-01-24
https://aviation-safety.net/database/record.php?id=20070124-3
There were problems with extending the flaps before landing on the two previous
flights, and the landings were performed with the flaps up. This clue was not
understood, as maintenance could not be duplicate the problem on the ground
(once the ice had melted). On this flight, the flaps did not extend, and the crew
prepared for a flaps-up landing. However, the extra workload contributed to
forgetting to lower the landing gear and not perceiving the 15 GPWS “too low, gear”
aural warnings below 500 feet on final. The airplane landed with flaps and gear up.

Parking Brake
When taxiing in icy conditions, setting the parking brake can lock the brake discs.
Alternatively, to hold the airplane in place for short periods, turn the tiller all the
way to one side just before stopping and hold it in that position. This will prevent
aircraft from moving forward. To resume taxi, start releasing the pressure on the
tiller slowly and when the nose wheel begins to move, steer in the desired direction.
To hold aircraft for longer periods and avoid holding the tiller while turned, use one
brake pedal at a time, switching to the other side after 30 to 60 seconds. Each time
one side is released, the main wheels will move slightly, preventing discs from
sticking together. In icy conditions, a takeoff can be initiated without realizing the
brakes are locked because the coefficient of friction is low.

Capitol 26 DC8 Anchorage 1970-11-27, locked brakes during takeoff.

https://aviation-safety.net/database/record.php?id=19701127-1

415
Fig.6 - The three different types
of nose radome damage.

Fig.6

Intentionally Left Blank

416
 PART 4 - LIGHTNING AND AIRCRAFT
Aircraft systems and their failure modes are designed to sustain lightning strikes
in flight (when ground/air logic is in air mode). Consequently, the less desired
effects of lightning strikes are diverted to when an aircraft is on the ground when
they have less impact on safety. Operational interference can become critical
during takeoff and landing to the aircraft’s systems and structures (figs. 1).

Figs.1

Lightning can be found in:

• Electric storms.
• Cloud to ground.
• Cloud to cloud.
• Cloud to aircraft to cloud or to ground.

How airplanes get hit by lightning strikes in flight

Flying between cloud regions of opposite polarity while the plane is in the electric
circuit, lightning can attach to an extremity such as the nose or wingtip. The
airplane then flies through the lightning flash, which re-attaches itself to the
fuselage at other locations. The current travels through the conductive exterior skin
and structures of the aircraft and exits off some other extremity.

Most aircraft skins consist primarily of aluminum, which conducts electricity very
well. By ensuring that no gaps exist in this conductive path, the design engineers
can assure that most (but not all) of the lightning current will remain on the aircraft's
exterior and exit through the plane’s static wicks. When an airplane is struck by
lightning and its electricity exits via the static wicks, they will melt or burn. During
the postflight or preflight inspection, they may be found missing. If the electricity
exits elsewhere, it usually leaves a small hole in the airplane’s skin.

417
Advanced composite materials are significantly less conductive than aluminum
and contain an embedded layer of conductive fibers or screens designed to carry
lightning currents.

--- Lightning indirect effects

Lightning traveling on the exterior skin of an aircraft can induce transients into
wires or equipment beneath the skin. These transients are called lightning indirect
effects. Careful shielding, grounding, and the application of surge suppression
devices avert problems caused by indirect effects.

Every circuit and piece of equipment that is critical or essential to an aircraft's “safe
flight” must be verified protected by the manufacturers.
The aircraft skin around the fuel tanks must be thick enough to withstand a burn-
through, and all the structural joints and fasteners must be tightly designed to
prevent sparks. Because lightning current passes from one section to another,
access doors, fuel filler caps, and vents must be designed and tested to withstand
lightning. All the pipes and fuel lines that carry fuel to the engines, and the engines
themselves, must be protected against lightning.

Some aircraft lost by lightning strikes:

--- Iran Air Force B747-131 - Madrid 1976-05-09
https://aviation-safety.net/database/record.php?id=19760509-0
--- LANSA 508 - L188 Lockheed Electra - Peru 1971-12-24
https://aviation-safety.net/database/record.php?id=19711224-0
--- Pan Am 214 - B707 - Philadelphia 1963-12-08
(This accident gave origin to the static wicks).
https://aviation-safety.net/database/record.php?id=19631208-0

--- The aircraft’s radome

Radar cannot be contained within a conductive enclosure to function correctly.
Lightning diverter strips applied along the outer surface of the radome protect this
area. If these strips are not properly applied or missing, the radome can be
damaged or separate from the aircraft if hit by lightning.

--- A TransBrasil B727 lost its radome due to a direct lightning hit at cruise altitude.
A St. Elmo's fire blue flame was observed growing slowly and emanating away
from the radome, just before the lightning strike. The speed dropped from M.82
to M.78 without changing the power setting, and the radar stopped working
as the antenna could not turn. The noise level in the cockpit was moderate with
minor high-frequency constant vibration. An after-landing maintenance inspection
found a small square panel missing on the horizontal stabilizer top surface.

418
--- Electronic Engine Computers (EECs)
Lightning can temporarily cause flickering of lights and interference with
instruments but may have more severe consequences. Modern passenger jets
have miles of wires and dozens of computers and other instruments that control
everything from the engines to the passengers’ headsets. These computers, like
all computers, are sometimes susceptible to upset from power surges.
- When circumnavigating thunderstorms and flying in EEC-equipped aircraft, it is
recommended to maintain a lateral distance of at least 30nm. The old policy of
20nm separation does not afford sufficient avoidance for EEC-equipped planes.
Lightning strikes have damaged EECs, causing engines to shut down in aircraft
20nm away from weather cells or were flying over a cell. Recall that radar is used
to detect weather, so it can be avoided rather than penetrated while trying to pick
a way through it.

Private Jets
The FAA has a separate set of regulations governing lightning protection for private
jets not engaged in public transportation. A basic level of protection is provided for
the airframe, fuel system and engines.

Some commercially made aircraft have aluminum skins and do not contain
computerized engine and flight controls, and they are less susceptible to lightning
effects.

--- Ground/Air Switch

The statement of “safe flight” pertains to the certification process requirements and
is intended to protect aircraft systems during flight. As a result, a transport category
aircraft struck by lightning on the ground may display specific surprising
characteristics.

The Ground/Air system logic has both a mechanical and an electrical side. Some
aircraft that were struck by lightning during ground operations (taxi, takeoff and
landing) have suffered a loss of electrical power (Generator Field Relay tripping),
causing a failure to the electrical side of the Ground/Air system. This causes some
aircraft systems to go to Air Mode while the aircraft is on the ground. If an airplane
is struck by lightning during takeoff or landing, the following characteristics may be
displayed:

If a takeoff is rejected, or during landing, and the electric side of Ground/Air logic
has reverted to Air mode:
A) As the throttles are brought to idle, thrust will go into flight idle, not ground idle.
B) Actuation of the T/R levers (the mechanical side in ground mode) will increase
forward thrust, as the T/Rs themselves will not deploy.
C) Auto spoilers and autobrake will become inoperative (disarmed).
D) Any engine above the fuel tank level (tail-mounted engines) may suffer thrust
deterioration or a complete power loss. Although the engine-driven fuel pump

419
 is the primary feed supply, the electric fuel pumps also play a role, especially
at high altitude airports (La Paz 13,335 ft).

If aircraft becomes airborne:

E) Landing gear may not retract, and the flaps may be slow to retract, possibly
with no indication.
F) Fuel dump capability is lost, engine anti-ice valves may fail in the open
position, and wing anti-ice valves may fail in the closed position.
G) If the electric system is not restored, aircraft may have limited battery power
(25-30 minutes). If the APU was not running before the event and does not
have a dedicated battery, starting the APU will further reduce this time if APU
fails to start or cannot power any buses.
Check your aircraft MEL to ascertain which of these characteristics may apply to
you. Taking off or landing with thunderstorms/lightning in the vicinity of the airport
is never recommended.

PART 5 - CROSSWIND LANDINGS ON SLIPPERY

RUNWAYS
Of the off-the-runway accidents, 30% occur in dry concrete and 70% in other-than-
dry conditions.
Ice only provides 16% to 20% friction compared to a dry runway, and wet ice
provides zero friction.

--- Approach Technique

On final approach with a crosswind, an aircraft maintains its flight path aligned with
the runway centerline by crabbing, lowering one wing into the wind, or combining
both techniques.
- When crabbing, the aircraft’s nose is turned into the wind, and an horizontal
component of airspeed is directed against the wind.
- When one wing is lowered into the wind, a portion of vertical lift becomes a
horizontal component opposing the wind.

Either way, as long as one component or the combination of both equals the
crosswind component value, the flight path will remain in alignment with the
runway’s centerline. If this balance changes, then the aircraft will drift away
from the centerline.
- Pilots must understand this same principle also applies once on the
runway.

The wing-down method is not generally used in airline flying because of passenger
comfort (uncoordinated flying). Also, the horizontal component of lift is lost at
touchdown once the wings become level, making the aircraft vulnerable on slippery

420
runways. This method can be considered for small private airplanes landing on dry
runways.

--- Landing
The preferred technique is to touch down by crabbing into the wind. Keep the
aircraft’s main landing gear(s) over the runway centerline and not the cockpit. The
cockpit may be flying over the runway edge lights during strong crosswinds,
depending on how long the aircraft is. Some pilots position themselves over the
runway centerline leaving the main landing gear(s) dangerously close to the
runway edge.
- If the pavement is dry, the aircraft can easily be aligned with the centerline with
rudder input after touchdown.
- If the runway is contaminated, the tire coefficient of friction will be low, and the
crew should plan to maintain the crab into the wind throughout the landing
until the aircraft has traction. As the forward speed decelerates, the side speed
component is reduced proportionally, and the wind may push the plane across the
centerline. Until the tires have friction (below hydroplaning speed), the only
way to maintain the runway centerline is to increase the crab angle* by
applying the upwind rudder. The drift is slow and gradual, allowing time to
adjust the rudder input. Like on final, the aircraft's ground path depends on the
crab angle to generate a side speed component that will match the crosswind.
* - Some manuals recommend using forward thrust to return to the centerline,
however, this will increase the landing distance, and a go-around may be a better
option. A go-around is not a regular option if reverse thrust has been selected.
Caution:
The use of reverse thrust can initiate drift or increase the rate of drift. Use extreme
caution if using more than idle reverse thrust while above hydroplaning speed.

--- Etihad Airways A380 - Heathrow 2020-02-15

Video: https://www.youtube.com/watch?v=0jn1xCjqCFE
- In this video, note that the crab angle keeps increasing as the airplane
decelerates over the runway for a perfect touchdown. Note the position of the main
gears at touchdown. Congrats to this Etihad pilot (fig.2).

Fig.2

421
--- Going Off the Runway
A runway excursion is usually initiated just before touchdown when the pilot
pushes the downwind rudder pedal to remove the crab angle to align the tires* with
the runway. However, this action causes the flight path to change across the
centerline towards the downwind side of the runway. The tires then contact the
runway sideways, and this is what the pilot was trying to avoid.
This new ground path points the aircraft off the runway. What may be challenging
to visualize from the cockpit is that when the crab angle is removed, the pilot
expects to see the cockpit rotating downwind, but the aircraft’s path is changing
downwind, too.
* - The tires and landing gear are designed to sustain crosswind side loads (as per
the demonstrated crosswind in the limitations section), and the tires have cornering
effect capability. Allow the aircraft to touchdown in a crab with its flight path aligned
with the runway, cockpit off-centered, so the main landing gears are over the
runway’s center.

--- Lufthansa A320 - Hamburg 2008-03-01

Video: https://www.youtube.com/watch?v=aYiLaK5bIJo
In this video, note that when the pilot pushes the downwind rudder pedal to align
the aircraft with the runway, it causes the upwind wing to accelerate, generating
more lift and causing the opposite wing to strike the runway.
This Lufthansa flight returned for landing on another runway more aligned with the
wind (let’s do this on our first approach).
This accident raised the awareness that Airbus flight controls amplitude is reduced
by 50% upon contact with the runway.

--- How to Mitigate Operations on Slippery Runways

Check the weather for slippery runways at the destination or possible alternate
airports. Before the flight starts, consider the airport with the worst weather and
plan as if you had to land there.

- Aircraft weight determines approach Vref speed. Reduce unnecessary weight

(tankering fuel, payload which may go on a later flight when conditions have
improved, etc.).

- Tire pressure determines hydroplaning speed. Depending on aircraft type and

tires used, it may be possible to have Vref lower than hydroplaning speed,
however, this is not common. The closer they are to each other, the sooner the
tires will have traction with the runway.

Verify tire pressures at maximum values before departure, they are usually stated
near the tires. Keep in mind in-flight tire “cold soaking,” it is normal to see up to 30
psi drop* by the top of descent. Nose gear tires may have higher pressure limits
than main gear tires. If the aircraft has no tire pressure/temperature reading in the
flight deck, have maintenance bring the pressure to the tire limit. If necessary,

422
make the request as a logbook open item entry which maintenance must close
before departure.
* Note: - A mechanics’ rule of thumb states that tire pressure will change 1% for
each 5°F change in tire temperature. Dr. Hillard Chemers, MD / A&P, explains the
derivation of the tire pressure change mentioned above.

“Charles’ Law (but more appropriately, Gay-Lussac’s Law) states that Pressure (P)
is directly proportional to Temperature (T), or P ∝ T.
Two assumptions are needed to make this useful. First, Tire volume (V) is
assumed to remain constant. Second, the math pertaining to temperature is a
rounded estimate.

Temperature (T) is measured from Absolute Zero (-460°F), and I’ll use an
arbitrary +70°F as the initial ambient (local) temperature. For your flight ops,
replace this with whatever the T is at the time.

Therefore, the starting Absolute T is 460 + 70 = 530°F, for which a 5°F change
yields an approximate 1% change in tire pressure, since 5 divided by 530 is
rounded to 1%. (The 30psi drop mentioned above would imply a 150°F change in
tire temperature – very reasonable with exposure to decreasing OAT).”

--- Before landing on a contaminated runway

Check Vref against calculated hydroplaning speed (multiply 8.6 times the square
root of the actual landing tire pressure).

- Plan on using max flap (for lowest Vref) and max autobrake.

- If using a wind additive correction on final approach, plan to bleed extra speed to
cross the runway threshold at Vref.

- Cross the runway threshold at the correct height. If high, execute a go-around
unless the runway is extra-long.

- Maintain nose into wind correction and do not attempt to line up the aircraft’s
longitudinal axis with the runway centerline. Pushing the rudder to align the plane
just before touchdown increases the speed (and lift) of the upwind wing, causing it
to rise and may result in ground contact by the lower wing and its engine(s).

- Do not attempt a smooth landing. Allow a firm landing to transfer vertical energy
to the runway, causing several knots of IAS loss and bringing aircraft speed closer
to hydroplaning speed. The objective is to gain tire friction with the runway as soon
as possible.

- Cancel forward thrust with idle reverse only. Maintain crab angle until tires have
acquired traction.

423
- As aircraft speed decreases, so does the side component of speed. Be
prepared to increase the crab angle by pushing the upwind rudder if the
aircraft begins to drift downwind. While in hydroplaning, the runway
centerline can only be maintained as long as the side component of airspeed
is equal to the crosswind component.

- Once the ground path is stabilized and all T/Rs have fully deployed to idle thrust
(confirm all T/R lights), start increasing reverse thrust slowly and cautiously.
However, if the aircraft begins to drift, decrease reverse or cancel it. Do not use
asymmetrical reverse.

- When landing on snow-covered runways, do not use high power thrust at slower
speeds (<80 knots) as forward visibility may be lost and engines are likely to stall..

PART 6 - VOLCANIC ASH CLOUD

Note: - This part contains general information for awareness purposes only.
Characteristics that are common to transport category aircraft are mentioned as
examples. Different aircraft types have different systems, and the notes in this part
may not apply.

Ash is made of rock (and glass), and jet engines operate well over the melting
point of this rock. Damage to the turbine is guaranteed should an airplane
inadvertently fly into an ash cloud.
An ash cloud has the appearance of a typical cloud and will not be detected by
radar. Dispatch must plan a route and cruise level that considers the latest ash
cloud location, wind direction and velocity. During the flight, if there is any
uncertainty about safe separation from the location of the ash cloud, the aircraft
must remain in visual conditions while in the vicinity of the area of uncertainty, day
or night, to avoid inadvertent penetration.
Planned engine failure drift down flight path must keep aircraft in the clear. Flight
following from dispatch and in-flight updates of any new eruptions and ash cloud
movement is essential.
Do not trust engine tolerance charts that “allow” flight in the outer edges of the
suspected area. Stay clear of the area, or the aircraft occupants will be breathing
ash.

Intentionally Left Blank

424
Indications When Flying into An Ash Cloud
• Heavy static discharges, windshield and engine nacelle (St Elmo’s fire).
• Bright glow in engine inlets.
• Sulfurous or acrid odor like an electric burn.
• High EGT / engine stall / tailpipe torching.
• Multi-engine flameout.
• IAS failure - Pitot Static failure.
• Electronic compartment overheat.
• Cargo fire warnings (false).

Escape Maneuver
• 180° turn.
• A/T off, idle thrust, ignition on, (auto).
• AC high flow, engine and wing anti-ice on.
• APU on when out of the cloud (consider battery limitations).
• Engine shut down and restart (within the flight envelope).
• IAS (and external sensors) are likely to be unreliable. For engine start, use the
descent pitch from the unreliable airspeed table in Section 5.

--- In the past, engines have restarted because chunks of ash broke away
from the engine blades as they cooled down at lower altitude and high speed.

Restarting Engines
The QRH or the restart portion of the Engine Failure checklist only addresses
restart.
A) - In-flight restart envelope is in the range of about 24/25,000 to 28/30,000 feet
depending on engine bypass type. Restart attempts are usually unsuccessful at
higher altitudes, especially when the ash cloud has contaminated the engine
blades. In previous incidents, engines were successfully started only at lower
altitudes and higher speeds than shown on the restart envelope.

B) - Airplane will most likely be in an Unreliable Airspeed condition. Refer to the

“Flight with unreliable airspeed descent chart” in the Performance section of your
manual. It is a good practice to know what the approximate pitch target is. Keep
in mind this chart assumes engines are at flight Idle. If there is no thrust, the aircraft
will need a slightly lower deck angle.

C) - Expect a very slow start, up to 2-3 minutes, and do not confuse with “No Start
or Hung Start non-normal.” Engine start is considered to progress normally even if
EGT is below limits, but RPM indication is present. In-flight EGT start limit may be
different than the standard (ground) start limit, check your manual. Consideration
may be given to allow the in-flight EGT start limit to be exceeded if the alternative
is an imminent off-field landing.

425
Takeoff on Runway with Ash
Your manual may include a takeoff procedure. It may consist of the following items:
- Air Conditioning off, recirculation fans on.
- Do not use windshield wipers.
- Rolling takeoff to reduce ingestion of ash from the runway.
- Very slippery runway, especially when wet.

Note:
This is a high-risk takeoff; consider it as an emergency evacuation from that area.
Evaluate if the risk of staying is greater than the takeoff itself. Consider waiting for
the runway to be cleaned. There may not be data for takeoff, rejected takeoff or an
air-return for landing.

Fig.3

426
 SUPPLEMENTAL 1 - POLAR CROSSING
Note: - This article is being included due to its informative nature. It was first
published in the May 2009 edition of Flight Magazine.

Glossary
ADS-B (Automatic Dependent Surveillance-Broadcast): System that allows air
traffic to request and receive digitized information directly from the aircraft without
the participation or knowledge of the pilots.

Flight Dispatch
In the weather room at Newark airport, one of the airports serving the NY area, I
meet with the three co-pilots for flight 99 to Hong Kong, which will be in a Boeing
777. I'm in command of this United flight that departs in two hours. But first, we’ll
spend the next fifty minutes reviewing the flight plan.

The four alternate airports en route are Iqaluit, Canada, Svalbard, Norway (not one
of my favorites since it's too far south), Bratsk, Russia, and Beijing (within the
ETOPS route - Extended Twin-Engine Operations). Considering their weather
forecast is a vital part of the planning. The flight plan also includes the forecast for
Hong Kong and Shenzhen, and although the latter is the preferred alternate to our
destination, as it is so close to Hong-Kong when adverse weather affects one, it
affects the other. Fortunately, today's forecast tells us that the weather is good at
both airports, (if you believe in predictions). However, if anything unforeseen
happens in Hong Kong there is always the option over Beijing to change the
destination, which is two hours away.

With the ETOPS data, we place the Polar map on a table, draw the route, highlight
the alternate airports and the entire mountainous area we will fly over. We also
highlight the air traffic control boundaries and their radio frequencies.
After a briefing with the dispatcher regarding operational irregularities we might
face en-route, we determine the amount of fuel we’ll need. Today's flight will take
16:05 hours, and we’ll consume 95 tons of fuel, about 40 tons less than a B747-
400 would use on the same route. Note that we are the only airline to fly a twin-
engine aircraft on the Polar route from NY.

I miss the 90's era (90-94) when I was a Boeing 747 Captain. In those days, it took
us three days to get from NY to Hong Kong, with stops in Honolulu and Guam. We
went the route of the "Gooney birds" (Albatross), as we used to call them, by
overflying the island of Midway, the main resting place of these birds. It fascinates
me to see them elevate themselves in the air after a mad run across the ground,
seeming to mimic the takeoff of an airplane. However, for lack of a thumb finger,
they land awkwardly.

427
The Crew Briefing
Next, we meet at the gate with the twelve cabin crewmembers and go aboard to
first class for the introductions. In a company with 12,000 pilots and 25,000 cabin
attendants, you rarely fly with someone you know.
After covering the flight time and expected conditions en route, I speak about
today's prevailing flight safety issues. The lead flight attendant follows with her
cabin service briefing.

The Flight
Half an hour after takeoff and after reaching the initial cruise altitude, two co-pilots
go to the bunks to take the first rest period. The First Officer and I chose the second
rest period. Discounting the first half-hour to climb and the last hour to descend,
there are 14:30 hours left of cruise flight, which allows 7:15 hours rest for each pair
of pilots.
When the Captain is on his break, the co-pilots on duty will make routine decisions
in common agreement. In case of disagreement or non-normal situations, the
Captain will be called upon. Command responsibility cannot be delegated and
rests with the Captain at all times.

Because it is winter, as we fly north into Canada, it gets dark very quickly. In
summer, this same flight is flown entirely in daylight. The landscape is harsh,
resembling an uninhabited planet. We face many hours of flying over the
snowcapped mountains and ice-bound valleys and an absolute frozen sea. The
stark desolation is stunning, a lonely immensity. The other side of the Pole, Siberia,
is a desert of gray, wavy and empty land in its own right. Life seems to have never
lived there.

The Aurora Borealis (Northern Lights) is the visual effect of particles from the sun's
atmosphere colliding with the earth's atmosphere. Due to the solar wind, the
Aurora Borealis forms an oval-shaped area on the ground around the magnetic
North Pole, with a perimeter of thousands of miles. Its height usually starts 50 miles
above the earth and extends up to 400 miles and may have many different shapes
and colors depending on the gases involved and altitudes.

Tonight, as we enter the Aurora Borealis' perimeter, we fly as usual underneath its
lights. However, I recall one night when we were flying during a solar storm. That
night the "Northern Lights" was a curtain, which extended to the ground. None of
the pilots had ever seen anything like it, we did not know what to expect, and it
was surreal. If solar radiation can cause electrical discharge damage to satellites,
could it cause damage to our plane? (Most of the dense atmosphere is below us).
As the aircraft penetrated that curtain of tiny lights, we attentively monitored all our
instruments and systems, but gladly nothing occurred. The flight through it lasted
four to five minutes, and it was surprisingly smooth. I estimate the curtain to be
between 33 to 42 nautical miles wide (timed it at Mach .84).

428
Although seemingly an uneventful experience, the crew pondered on the
unnecessary and excessive exposure to radiation that we all had gone through,
including our unsuspecting passengers. We can see solar flares eight minutes
after they occur (speed of light distance to the sun), and it takes 93 hours for the
solar wind to travel the 93 million miles to earth (at about one million miles per
hour). That gives a three to four-day notice, and most airlines cancel, reschedule
or reroute over-the-Pole flights during solar storms, but ours did not.

Approximately six hours after takeoff from NY, we arrive at ABERI, a route fix two
degrees from the geographic North Pole, the beginning of Polar Route 1. There
are five Polar routes, one on the European side and four on the Alaskan side. Our
route today is on the European side. These routes should not be confused with the
PTS (Polar Track System), which connects Europe and Asia further to the south.
The first work period is the busiest. We must secure the route clearances, establish
CPDLC (Controller Pilot Data Link Communications) and ADS log (Automatic
Dependent Surveillance), change from RVSM (Reduced Vertical Separation
Minimum) 1,000 feet to 500 meters, and change to the next flight level. We
accomplish the various steps entering the AMU (Area of Magnetic Unreliability)
and fly with true headings instead of magnetic headings. These are some of the
many tasks that lie ahead.

As we approach the Pole, our compass changes rapidly from North to South. We
should not go right over the Pole (within 1 degree) while on autopilot, which could
create a sudden change in the flight's direction. However, if to avoid weather we
need to fly over the Pole, then we must turn off the autopilot and fly manually. We
must make sure the outside temperature does not drop lower than -65ºC.
Otherwise, we might be forced to change our flight plan to alleviate the fuel freezing
in the wings.

Between 84°N on the Canadian side and 80°N on the Russian side, there is no
satellite coverage over the North Pole. Depending on the solar cosmic activity
(Aurora Borealis), there is suppressed HF (High Frequency) voice and data for
periods ranging from 90 minutes to four hours. Even when we cross the Pacific
Ocean, two and half times the size of the North Atlantic, on a flight from California
to Bali in Indonesia or Manila in the Philippines, there is always some form of
contact somewhere on the planet. Still, over the Pole, it’s like being on the other
side of the moon, like the silence that astronauts experience for a scant fifteen
minutes. In contrast, ours can last four long hours! Such isolation from the rest of
the world demonstrates the severe vulnerability of Polar flights.
This is the only region on the planet that I felt was beyond hope. Hope is the
expectation of someone else doing what we cannot, and this is an impossibility
here.

429
Alternate Airports
Our isolation causes a radio silence that prevents receiving weather updates and
reports of changes at alternate airports.
In the Arctic, the ground weather can change quickly and violently to zero visibility,
with sustained winds of 150 km/hour and temperatures of -40ºF. In-flight, I have
seen temperatures as low as -85ºF. Temperature inversions are routine on Polar
routes. Our Polar ETOPS operation allows us to be uniquely at 207 minutes from
a Polar alternate airport (normal maximum allowed is 180 minutes) at a speed of
Mach 0.84 with zero wind. If we lose a turbine and/or cabin pressurization, it may
take up to 5:30 hours to reach the closest alternate airport.

Emergency Airports
If it is impossible to make it to an alternate airport, there are emergency runways
in northern Canada, but besides these, there is nothing. These runways lack
control towers and are short gravel strips in remote locations, often sparsely
inhabited. Examples: Alert (CYLT) at 5500 feet long is the closest to the Pole at 82
degrees North (see the last page); Eureka (CYEU) at 4800 feet and Baker (CYBK)
at 4200 feet, are further to the south. A large airliner that lands at any of them may
not be able to leave. There are no weather forecasts for these runways, but snow
is compacted weekly, and aircraft that operate here are equipped with skis.

If forced to divert to any of these emergency runways, we must land, regardless of

the weather conditions. If the conditions that caused the diversion persist, a fire,
for example, we may need to go below the RNAV (Radio Navigation) approach
minimums even in zero visibility. And we may also have to land on an invisible
snow-covered runway, which gives a new meaning to the so-called non-precision
approach. In fact, during the descent, we must prepare the cabin for a possible off-
field landing, as our GPS may lack updates to correct position errors. We will have
to face the fact that a large airliner may not be able to stop on a short, icy gravel
runway. At best, we can expect to land and stop or overshoot the runway at
minimal speed so that the aircraft does not suffer ruptures that could cause fuel
leaks or the incursion of frigid air into the cabin. Fuel dump is not a consideration
as we will still need this fuel on the ground for the APU (Airborne Power Unit) to
keep the plane warm enough for survival.

We will need to transfer the passengers and crew to the facility served by this
runway, be it a village or scientific station. As we lack appropriate attire for Polar
exposure, a solution will be challenging. Although there is one survival Polar suit
on the plane to enable a crewmember to get to the facility for help, there is no
assurance it can accommodate 300 people. And there is the risk that the
crewmember could lose his way or run into a polar bear.
Until the Coast Guard can come to our aid, we will be at the mercy of the dreadful
climate. Even with good weather, the response of a SAR (Search and Rescue)
team from Juneau, Alaska, would take about 72 hours after receiving our Mayday

430
to mount a rescue operation. A Polar storm would dim the prospects for operational
success severely.
Finally, would the cause of the emergency, say a fire, allow the pilot to make an
instrument approach? And would the fire consume the craft after landing? And
would the APU continue to keep us warm, even as the fuel starts to freeze?

Taken to their extreme, all these factors should force pilots to think carefully about
undertaking Polar crossings. One who has spent significant time over oceans and
remote lands can sense the risks of polar operations, especially in twin-engine
aircraft.
Amid so many ifs and digressions, our passengers enjoy the excellent onboard
service typical of extra-long-range flights while being entertained by a variety of
good music, games and movies from which to choose. This helps to keep their
minds off the plane’s position.

Search and Rescue in the Arctic Region

The U.S. Coast Guard Rescue Coordination Center (RCC) is based in Juneau,
Alaska. It covers the area from Alaska to the North Pole and then south to the
Russian side of the Pole at 100 E and 12 miles from the Russian coast. The RCC
also has the use of its ships and planes in Anchorage and Nome, Alaska.
Then there is Russia, which is responsible for the Search and Rescue only within
the range of its aircraft based in its North but not the Polar Region. By agreement
with the Russian RCC based in Vladivostok in life-threatening emergencies, the
U.S. Coast Guard can extend its coverage within northern Russia. To coordinate
this, Russia has an official on call in Juneau 24 hours a day.
On the other hand, Canada is responsible for the Search and Rescue within its
airspace, which extends to the North Pole.

Passage of the Pole

The stars that are seen in the Arctic sky are different than what I'm used to. I spend
many nights staring at the sky, not as a pilot but as a sailor. I am familiar with the
stars at latitudes where I have sailed the most, but they do not serve me here. On
the other hand, I do not need to find the Northern Star because I'm here at the
North Pole. And from here, all directions are South, 180°.
As we approach Russia, the dawn begins to appear on the horizon, but I will miss
the sunrise this time. The First Officer and I have finished our shift, and it’s time to
retreat to our bunks for the next 7:15 hours.
When we return to the cockpit, it will be night again, and both Russia and Mongolia
will be behind us. We will be about an hour south of Beijing and within an hour of
landing in Hong Kong, where we will see the sun again when we wake up the next
day, 24 hours after seeing the sunset over Canada. Soon we land, park the
airplane, and all four pilots shake hands with each other and happily utter that
moth-eaten idiom, "We’ve cheated death one more time."

431
432
 SUPPLEMENTAL 2 - THE FUEL LOAD ISSUE
The fuel load becomes a significant safety concern when viewed simply as a cost
factor. Airline management purposely plan flights to operate with as little fuel as
legally possible. Conversely Captains should require their airplanes to have
enough fuel to operate safely with realistic options. This is part of a bigger issue,
the airline’s safe and just culture.

As a pilot and operations safety consultant, I have seen this repeated cycle of
airlines pressuring pilots with policies and schemes not to add fuel to the
company’s proposed flight plan.
- Captain, when anyone takes your fuel away, just put it back - it’s that simple.

HISTORY
The Misuse of “Re-dispatch”
When Pan Am started daily jet service between New York and Paris with the
Boeing 707 in October 1958, this aircraft could not return to NY with the legal fuel
reserves if in strong headwinds. The general rule for international flights was to
have enough fuel to fly from the departure city (A) to the destination (B), plus 10%
of this fuel amount for contingencies (C), and then to the most distant alternate
airport (D) plus 45 minutes of reserve fuel. The FAA deliberately created “re-
dispatch” to help this flight reach NY by filing for Boston as the legal destination,
thus reducing the fuel requirement from A to B and, consequently, the 10%
contingency fuel (C). When approaching Boston, if the weather proved to be
favorable in NY, the flight would then re-dispatch to its “alternate” airport of NY,
and if not, the flight would have to land and refuel. Re-dispatch allows flights to
operate routinely to their intended destination, as if flying to the alternate airport,
with a reduced legal fuel amount.

Re-dispatch became a common practice to allow aircraft to reach destinations they

otherwise did not have the range for. Unfortunately, airlines today wildly abuse this
practice to reach destinations they could easily reach anyway. Using re-dispatch
allows the airline to reach its destination with lower legal minimum fuel, and at a
reduced cost. There is nothing wrong with making money safely, but this policy
increases the risk of fewer options at the end of the flight. Although most flight
crews accept this unnecessary re-dispatch (perhaps unknowingly), they should
evaluate the risk/reward factor. There is an increased risk to the flight and the
pilots’ careers should things go wrong.

Flight Procedures
In 1976, the industry experimented with optimizing crews’ flying skills coupled to
aircraft capabilities to save fuel.

433
We were to fly the approach with a smaller flap setting, thus using less fuel. This
configuration would increase the approach speed by 5 knots but provide better
handling and go-around capability. Upon landing, only idle reverse thrust was used
and the aircraft rolled to the end of the runway, metering lightly on the brakes. After
several aircraft overran the end of the runway, airlines abandoned faster
approaches, and full-flap landings became the norm. Although we are using idle
reverse and light to moderate braking policies today, the environment is very
different (and safer). We have longer and grooved runways, auto-spoilers, auto-
brakes, and more thrust at idle reverse.

Another money-saving practice came from the use of reduced power takeoffs. The
first jet airliners were underpowered, which caused them to lift-off towards the last
third of the runway. Most takeoffs were at full power, and the Captain had the
discretion to execute a reduced power takeoff on light flights.
As more powerful engines became available, the lift-off point occurred earlier,
making a possible rejected takeoff safer. However, airlines started to reduce
takeoff power in increments of 2%, 4% and 6%, moving the lift-off point further and
further down the runway. Although this saves engine TBO costs and fuel, it also
decreases the runway length available to stop during a rejected takeoff.

People accept a certain level of risk and seem comfortable maintaining that same
level as conditions improve. Management makes changes in small steps to which
the pilots and a can-do attitude adapt, perhaps without realizing we are giving up
part of our safety margin.

Some Examples
In 2008 Qantas was on the front pages for a long time as their B747 and A380
routinely diverted for unscheduled fuel stops, causing significant disruptions to
schedules. Management was pressing pilots not to add fuel to the flight plan. The
pilots complied, but they would land to add fuel if the winds were not as favorable
as the company had forecast as they reached cruise altitude. In some cases, pilots
had no choice in this decision as Australia’s boundaries (FIR) have minimum fuel
requirements. If a flight is below Air Traffic Control’s charted minimum arrival fuel
for the aircraft type and intended destination, the flight will be redirected to a closer
airport.
The media attention generated from the continued inconveniencing of passengers
triggered management to issue a statement excusing them from any accountability
in the matter; “…our Captains have complete discretion and are the final authority
on the amount of fuel they want for the flight…. “
Many other airlines were and still are using similar practices. It is interesting to see
when profits drive a company to misbehave, just how quickly other airlines follow
suit. They should be equally steadfast in adopting safety improvements.

434
An Internet search of flights low on fuel will bring up hundreds of articles.
These are a few from a well-thought-of airline:

http://www.nbcnews.com/id/24034468/ns/travel-news/t/pilots-claim-airliners-
forced-fly-low-fuel/#.VO-Ge0Iyxqs

http://www.abc.net.au/news/2011-05-20/qantas-pilots-say-theyre-running-on-
empty/2722026

http://www.ausbt.com.au/low-on-fuel-qantas-flight-qf8-from-dallas-diverts-to-
noumea

The Bottom Line

Periodically, the focus is on how much less fuel we can have at landing. There is
no minimum fuel requirement; all requirements are for dispatch (before flight). It is
legal and logical to use the reserve fuel when needed; that’s why it’s there.

Although landing fuel data is recorded and monitored, dangerous trends are not
being adequately identified and addressed by the regulators. An increase in safety
violations and incidents indicates bigger things are highly likely to happen, just like
smaller tremors precede an earthquake. Management has the data to predict
probable outcomes.

The threat is that some aircraft are arriving within a few minutes of empty tanks,
leaving the crew with no options. If we are caught in a situation where we may
become low on fuel, it shows good judgment to divert before we are in a fuel
emergency. The next best thing would be to declare a fuel emergency and proceed
to the closest airport. However, advising Air Traffic Control of minimum fuel and
wanting to continue to the original destination is ill-conceived. Consider it from the
ATC point of view: there are daily instances of several aircraft arriving with
minimum fuel and others declaring an emergency.

In an incident in China, an emergency aircraft was forced to go around to avoid a

collision with a fuel emergency aircraft. The Captain of the fuel emergency aircraft
was arrested, and his license revoked. Fuel emergencies (other than for technical
reasons) are frowned upon in many countries and being low on fuel due to poor
planning is not a reasonable justification. Many countries criminalize incidents and
incarcerate pilots. Be aware of your fuel reserves.

Low fuel for a safe go-around may explain why certain airlines are seeing an
alarming increase in unstabilized approaches that are not discontinued with a go-
around. When an airline is running its fleet low on fuel, this is a management’s
caused problem.

435
The industry is already stretched too thin, but at least one major airline has asked
the FAA to reduce the minimum mandatory reserve fuel. This same airline had one
aircraft run out of fuel just short of the gate. The Captain informed the passengers
it was a “tow-in gate” (although it was not) and requested a tow truck under the
pretext he was not confident of wingtip clearance.

The bottom line is that after decades of enhancements in ways to save fuel, we
have exhausted operational strategies, and future fuel savings must come from
technological advances.

SAFETY AND COMFORT ON YOUR ROUTE

Weather
The company-provided weather forecast is a company-paid forecaster’s opinion
and tends to err on the optimistic side (better weather than independent
forecasters). When the weather is close to minimums, this can generate a lower
fuel load exactly when it’s needed the most. Company-provided information needs
to be compared with unbiased weather providers like the National Weather
Service.

This link will take you directly to “Flight Folder,” which can be found under “User
Tools” at the bottom right:
http://www.aviationweather.gov/flightfolder
800.WXBRIEF (800.992.7433) is another way of getting a live briefing. Follow the
guidance to link your phone to open an account. These are the same people that
used to be with the FAA and are now with Lockheed Martin. They have a lot of
experience and are very helpful.

Pilots should get weather briefings before going to the airport. When they see the
company's proposed flight plan, they already know what to look for.

The Legal Requirement

While it complies with minimum legal requirements, a company's fuel savings
policy tends to minimize the amount of fuel with which its aircraft operate and
leaves none for contingencies below the legal minimums.
It’s not only the landing gear that may not come down; there’s a multitude of
unforeseen failures that will preclude the flight from landing safely. For example,
the airplane could have a flap jam during a go-around due to bad weather. How
does the pilot know if it can reach the alternate in this flap configuration? India
Airlines 440 (1993-11-15) ran out of fuel and crash-landed on its way to the
alternate airport.

436
Dispatch
Airline management says that their priorities are safety, comfort, scheduling and
efficiency in this order, so when a Captain analyzes the company’s proposed flight
plan, he rightfully assumes dispatch selected his route according to these criteria.

In reality, the flight plan computer builds the route according to efficiency (least
cost, most fuel-efficient) and then it’s up to the flight dispatcher to tweak the route
to avoid weather and turbulence. This is an area where the dispatcher may be
limited on what he can do. I have seen “written guidance” (bulletins) from the VP
of flight operations prohibiting the dispatcher from deviating from turbulence unless
it’s a level 4 (moderate). Management’s justification is that flight plans are put
together hours before the plane reaches that flight segment. If the Captain wants
something different with updated weather information, he can change the route.
But because the Captain may not be aware of the flight dispatcher’s management-
induced restrictions, often he accepts the route as is, believing it’s the least
turbulent. In my experience, deteriorating weather updates were sometimes
uploaded to the aircraft right after takeoff when I could no longer add any fuel.
Just as pilots like to fly planes and take care of their passengers, mechanics like
to work on airplanes and fix them correctly the first time around. Because
management pressures maintenance for on-time departures, flight crews must
deal with deferred maintenance placards that have the potential to become in-flight
emergencies.
Dispatchers love aviation too, and they would gladly give the flight the fuel needed
without question, but they are under much more pressure than pilots. Management
is closely watching, and they must play the game or risk losing their jobs.

A Captain’s first duty is to safeguard his passengers' lives and provide a

comfortable flight by avoiding weather systems and turbulence. If, for instance, you
are crossing the Atlantic and the northern tracks go through an area of weather
that is significant enough for you to have concerns, select a southern track or a
random route to avoid the turbulence by a safe margin. Keep in mind that the flight
plan was prepared hours before you arrived at the area in question, and it may
have moved far by then. You need to allow for sufficient separation and plan your
fuel accordingly. Trying to split hairs by selecting the next track or the next altitude
does not distance you enough from the weather.
Comply with your company’s standing directive of safety and comfort first; the
public image, management wants to promote.

THE UNDERLYING ISSUE

Some airlines that lack a safe and just culture likely have questionable fuel policies.

What can pilots do?

Let's do what we can every day with what we have. We don't have to be perfect;
we can just do better.

437
Let's remember that any airline's public policy is safety first. This is what
management must defend when things go wrong. This is when they say to the
media, "…our Captains have complete discretion and are the final authority on the
amount of fuel they want for the flight…" Do not expect management to assume
responsibility for their part of your fuel critical situation; it is your final responsibility,
and it's not their problem. Do not allow yourself to be intimidated into flying with
low fuel. Nobody has ever been fired for being safe and adding fuel. Be consistent,
individually as well as a pilot group.

Consider another company's public policy: - "If you see something, say
something." The company wants you to speak up, be assertive and report what
you see.
But after a long duty day, you may feel tempted to go home. You may end up
venting these work-related issues with your family and friends, which may feel
good but may not be effective. Instead, create a time and place to direct that energy
to someone who can make a difference. Write a letter to that individual, and file
reports with NASA, NTSB and FAA or the equivalent agencies for your country. As
pilots, we file very few reports, however, we have a safety duty to become more
engaged. Walk into your Civil Aviation Authority offices to meet face-to-face with
an airline inspector. I have always found government agencies to be genuinely
very supportive. Save your copies, maintain a paper trail and don't underestimate
the power of your pen.

If Civil Aviation Authorities (CAA) adopted minimum arrival fuel requirements at

their boundaries (dependent on destination), the threat of low arrival fuel would be
largely resolved.
The FAA/CAA could monitor arrival gate fuel, identifying trends from repeat
offenders and allowing for corrective action. Pilot unions could present this issue
to ICAO with worldwide reach. The NTSB and NASA have plenty of pilot reports
as supporting data to justify preventive action.
Unfortunately, this is not how the industry works; they react (after an accident),
resist, and are slow to implement, too little too late. As an industry, we have
changed a few things here and there, but for the great part, we are still trying to do
things the way we did them many years ago.

This may be another one of those challenging moments where CFR 61.153c
requires us to be of good moral character. Our passengers and crew expect strong
Captains, and this is the moment when we must stand up for them.
You may be just one, but you are one! Lead by example. It only takes a few leaders
to lead many.

Be a Captain, do what you must do and add the fuel you need. Your crews will
appreciate flying with you because you make them feel safe, and you will go home
and sleep with good conscience.

438
Seminar/webinar information:
https://FlightEmergencies.com

Contact:
Info@FlightEmergencies.com

END

439