The Culture of Aviation Safety
The Culture of Aviation Safety
Up-close examinations of what makes air travel safe, and how and why it becomes risky. Three new case studies.
The business jet that early this month glided onto I-75 near Naples, Florida, not long after impact. The NTSB has now given a clue about what went wrong. (Screen shot from WINK news.)
This post is about three new reports on aviation safety. Two of them are about fatal crashes with apparently very different causes. One is about broader problems that could cause tragedies in the future. Together they illustrate the complexity of keeping commercial aviation safe.
1) Naples, Florida. ‘We’re not going to make the runway.’
Early this month there was extensive news coverage when a business jet came down, amid traffic, in the southbound lane of busy I-75 in Naples, Florida.
The plane, a twin-engine Bombardier Challenger 600, was less than a minute away from a normal landing at Naples airport when it somehow lost power in both engines at once. Its two-person flight crew glided it to a power-off landing amid traffic on I-75 near the airport. This short and dramatic video from VASAviation matches Air Traffic Control transmissions with the plane’s path. The airplane’s call sign is “HopAJet 823”. At times 0:10 and 0:25 you’ll hear its pilot speaking in total calm. At time 0:45, suddenly his plane is in trouble.
The pilot you hear in this recording, and his colleague in the cockpit, both died a few seconds after their last transmission at time 1:00.
Here are the “good” parts of this tragedy:
—Because the pilots guided the plane into the southbound lane of the interstate, going with the flow of traffic, they avoided the numerous high-speed head-on collisions that would have come with landing in the opposite, northbound lane.1 As it was, they landed on top of a truck and flattened it, though its occupant survived.
-Because they steered to land on the highway, they didn’t hit any of the numerous houses or mobile homes all around.
-Because of quick thinking by a flight attendant in the rear of the plane, she and two other passengers managed to escape safely from a rear door before the entire airplane was consumed by fire.
But because the plane was drifting to the right as it landed, it skidded rightward across the freeway and, after hitting the I-beam for a road sign, swerved into a retaining wall. On impact with the wall its cockpit burst into flame, killing both of the pilots. Dashcam videos from motorists showed these last seconds.
After the tragedy, the question in the aviation world was: Why? What could have caused both engines to fail at the same time, so close to a presumably safe landing at the airport? Might it have been a “Miracle on the Hudson”-style bird strike, disabling both engines at once? Contamination in the fuel? Or a clog or problem in the fuel system? Had the pilots cut it too close and simply run out of gas? Was there some other mechanical failure or electronic problem?
This week the NTSB released its “preliminary report,” which you can read here. [Update: the previous link to the report was broken. I’ve added the correct one, which again is this: https://data.ntsb.gov/carol-repgen/api/Aviation/ReportMain/GenerateNewestReport/193769/pdf ] Its most significant finding was this:
Data recovered from the airplane’s flight data recorder revealed that the first of three Master Warnings was recorded at 1509:33 (L ENGINE OIL PRESSURE), the second immediately following at 1509:34 (R ENGINE OIL PRESSURE), and at 1509:40 (ENGINE).
That is: If these readings prove to be correct, then just one second apart, the left and right engines reported oil-pressure failures, a proxy for engine shutdown. Six seconds after that, the master engine-failure warning came on.
Fuel contamination wouldn’t work this way, cutting off both engines at the same instant after an uneventful flight. Nor would running out of gas. In that case, one engine would falter, then the other. Odds are against a bird-strike doing this, especially since the pilots said nothing about it when reporting the loss of both engines to the Naples controller. And while there are rare cases of jet engines ripping themselves apart in flight, it is hard to imagine that this would happen to both of them at once. That would be like two different car tires happening to blow out at just the same time on the freeway.
So—again if these readings hold up—what explanation is left? The full NTSB investigation, which can take many months or even years, will explore all the what-ifs. But after this week’s preliminary report, pilot-world discussion has moved to the “Idle-Cutoff” possibility.
From the NTSB preliminary report, a guide to the flight’s final 90 seconds. The Naples airport the plane was were headed to, and the path toward Runway 23, are highlighted in red. They were less than a minute away from safe landing there. (NTSB)
The focus of attention here involves the “stops” or “gates” that keep a pilot from accidentally cutting all fuel to the engines.
In any flight pilots need a way to reduce engine power as they descend and come in for landing, as you would slow a boat when coming in to dock. Then pilots need to cut power off completely when the flight is done. They do both things by pulling backward on the throttle, toward the rear of the plane. In an airplane pushing in a throttle is like stepping on the gas in a car. Pushing forward means faster. Pulling back means slow down.
Through most of its arc—from full power when all the way forward, to idle when almost all the way back—the throttle travels freely. But as a safety measure, jet throttles have a kind of mechanical stop or gate that requires an extra step before the throttle will move even further back than idle, to “cut-off” or “shut-off.” Those settings essentially turn off the engines, by cutting off all fuel flow.
The idea behind the stops is like the both-hands-required push-and-turn motion you need to open some pharmaceutical bottles. Or, in my stick-shift car, the way I need to push the stick down before shifting into reverse. It keeps things from being done by accident.
In the Challenger’s cockpit, these safety stops consisted of little red levers near each of the throttles. Here’s a cockpit image from the company’s site:
The two white handles in the area I’ve highlighted in yellow are the twin throttles, one for the engine on each side. Normally the “pilot flying,” the one managing the takeoff or landing from either the left or the right seat, would have his or her hand covering both throttles, and push or pull them at the same time. The little red levers below the throttles are the gates or stops, which you have to press to get to full engine cut-off.
Could this have been the explanation? Did the pilots somehow inadvertently move the throttle back, past the stops? In approach and landing, both pilots could be reaching across the center console to work different controls. (For the flaps, the thrust reversers, and other things.) Might one pilot’s arm have hit the stops, at just the time the other pilot was pulling back the throttles? Might the stops themselves have been defective or worn out? Is there any other reason that both engines might have turned off at exactly the same time?
We don’t know yet, and it’s what the NTSB will try to nail down. It’s often the case that things look different at the end of these investigations than they did early on. For the moment, their preliminary report does seem to work against some of the usual suspects. Doctors give us the homily: When you hear hoofbeats, think of horses rather than zebras. As I’ve mentioned before, professional aviation crashes are now so rare that zebras often turn out to be the culprits. Maybe the zebra in this case was a crew member’s arm. Or maybe it will turn out to be something no one is thinking about now.
In the meantime, sympathies to all who knew the pilots, and admiration to them and their flight attendant for managing this with minimum damage to anyone except the two people sitting up front and guiding the plane.
2) Karachi, Pakistan. ‘We can make it, Insha-Allah.’
Nearly four years ago, in May 2020, an Airbus 320 flown by Pakistan International Airlines (PIA) crashed into a residential area near the Karachi airport, killing more than 100 people aboard and causing injuries and damage on the ground.
This week, authorities in Pakistan released their final report on what had gone wrong. Simon Hradecky of The Aviation Journal summarized it here.
If the Naples I-75 controlled-crash showed calm under life-and-death pressure from a flight crew, this episode illustrated the reverse. Remember the classic movie Airplane! The PIA flight was that comic chaos, in tragic form.
The highlights from the official Pakistan government report were these:
The plane’s flight crew was chatting things up and discussing sports, Covid, personal lives, and everything except the flight as they neared the landing at Karachi. This is not what you’re supposed to do.
The crew had left the plane thousands of feet above its assigned altitude, and only vaguely on the correct course, on the way into the airport. In the cockpit the captain was confidently waving aside queries from air-traffic controllers and fellow crew members about the flight’s path.
When the Karachi controllers repeatedly told them they were far too high, and suggested that they “orbit” (or go around) to lose altitude, the captain told the first officer to reply, “Negative Sir. We are comfortable. We can make it, Insha-Allah.” [Spelling from the Pakistani report.]