The Crash Detectives

by Christine Negroni

  The aviation industry has spent decades creating support for the stresses that pilots encounter, from choosing the right candidates to teaching them how to manage resources. And on almost every flight, new technology and age-old human qualities mesh in just the right way so that flying is safer than the sum of these parts.

  PART FIVE

  Resiliency

  Every day, somewhere in the air, a cockpit crew averts disaster by routinely dealing with equipment malfunctions, weather uncertainties, or unscripted situations.

  — DR. KEY DISMUKES,

  NASA HUMAN FACTORS SCIENTIST

  The Control Metaphor

  The scenario of MH-370’s disappearance that I describe in this book is a tragic illustration of Flach’s metaphorical look at the Wright Brothers flight: control had to be in the hands of the pilot. On MH-370, a rapid decompression triggered a chain of events that required human control, but hypoxia may have stripped the pilots of their mental ability.

  Fallibility sometimes leads to disaster. Far more often, however, resiliency saves the day. Pilots interrupt errors and correct oversights. They find workarounds and reshuffle priorities. They avert problems they don’t even know they have—and not just once in a while, but on nearly every flight, without the passengers even knowing something is amiss.

  On occasion, however, the malfunction becomes obvious.

  Alarms started blaring on the flight deck of Malaysia Flight 124 eighteen minutes after takeoff from Perth Airport on August 1, 2005. The plane was climbing through thirty-eight thousand feet when Capt. Norhisham Kassim and First Officer Caleb Foong were startled by two very conflicting warning horns. The first alerted them that the Boeing 777 was flying too slowly and was in danger of stalling; the next indicated that the plane was flying too fast. Before either man had time to react, they were thrust back in their seats as the front end of the airliner abruptly turned up.

  One experienced 777 captain told me that it had to have been a “WTF moment.” Yet with great understatement, Norhisham recalled that he was “startled.” The nose was high, about seventeen degrees, and rocketing farther skyward at a speed of ten thousand feet per minute. That’s an ascent of more than one hundred miles per hour.

  They had been flying on autopilot when the trouble started so Norhisham shut off the autopilot and pushed the yoke to get the nose down. That caused the autothrottle to rev, pumping more fuel into the engines and giving the descent an unexpected kick so that the plane started a four-thousand-foot dive. Moving the throttles to idle only made the plane bolt upward again, and the aircraft climbed two thousand feet before the confounded pilots could get it to stop.

  The plane was shuddering violently, according to Kim Holst, a passenger from Australia. “A flight attendant dropped an entire tray of drinks and began crawling on his hands and knees back to his seat, and the other flight attendant began praying,” Holst remembered.

  For the pilots, “It was somewhat like riding a bucking horse,” Norhisham said, adding, “As a passenger at the back-most seats, you definitely will feel worse than that.”

  Norhisham and Foong were facing a situation similar to Robert Pearson’s experience on the Air Canada 767: a “garbage in, garbage out” encounter with the airplane’s computerized brain.

  All the fancy electronic gizmos feeding information to the pilots and enabling automated flight rely on sensors in the plane’s air data inertial reference unit, called the ADIRU (pronounced ADD-uh-roo). The ADIRU consists of two sets of three accelerometers. Two accelerometers calculate the side-to-side/up-and-down movement of the wings called roll, two calculate the up-and-down motion of the nose called pitch, and two gauge the side-to-side/front-to-back motion on a horizontal plane called yaw. There are two sets of sensors for each; one is primary, and the second set is a backup. That redundancy provided such a feeling of security to operators of the Boeing 777 that no checklist was developed for what the pilots should do if there was bad information from the sensors. Yet this was what was causing MH-124’s wild ride over Australia.

  The crew knew that the plane was performing erratically, but not why. So as they prepared for a return to Perth, Norhisham hesitated to turn off the autothrottle. He had a handful of airplane, and he was hoping some part of the automation would help reduce the workload.

  Like a bad driver pumping the accelerator, the lever controlling fuel to the engines kept “hunting up and down” as the two pilots struggled to get control of the flight. Norhisham and Foong were engaged in a kind of triage, dealing with the most critical problems as they nursed the 777 back to Perth. Faced with a confounding situation, Captain Norhisham had to give up diagnosing and concentrate on learning how to fly this plane with all its sudden idiosyncrasies.

  Certainly they were relieved to see the approach to the airport, but that feeling was short-lived. They were about to get a last-minute surprise. As the plane descended through three thousand feet, another instrument in the orchestra of alarms began to sound. Wind shear, wind shear, the computerized voice called out, accompanying the shrill series of beeps.

  Pilots are appropriately cautious about wind shear, which is a sudden change in the direction or speed of the wind. It is concerning close to the ground because it can cause a plane to lose lift, with little time for the pilot to recover. On the crippled Malaysia jet, the pilots were loath to get into a situation where they would have to rely on the plane performing as expected, considering how unpredictable it had been so far. Going around and trying the landing again, with all the uncertainties about the condition of the plane, also seemed risky.

  Norhisham was worried. Was the alert real or another unreliable result from unreliable inputs to the ADIRU? The captain had to make a decision. The day was clear, visibility was good, and the wind was manageable, but the sun was going down. “We continued [toward the landing] with full caution,” he said, keeping an eye out for any indication of wind shear.

  “Thank God,” Norhisham said when Flight 124 landed safely with no injuries, though everyone on board the airplane was shaken. Only then did Norhisham stop and think about the “very thin margin of survival.” He had joined a fraternity of pilots who had knowingly broken the last link in the chain to calamity.

  Three and a half years later, Chesley Sullenberger and Jeff Skiles ditched an Airbus A320 in New York’s Hudson River after geese flew into the engines following takeoff from LaGuardia Airport.

  In September 2010, Andrei Lamanov and Yevgeny Novoselov landed on an abandoned runway in northwestern Russia that was half as long as their aircraft required. A total power failure on a the Tupelov TU-154 caused all the fuel pumps to fail, starving the engines and leading to the loss of all navigation and radio equipment on what should have been a five-hour flight to Moscow.

  Praising the actions of pilots like these, a writer for New York magazine called them “a dying breed.” I don’t think that’s true. It is not that few can do what Norhisham and Foong, Sully and Skiles, Lamanov and Novoselov, did. It’s that aviation’s safety net is so expansive and robust that it is a blessedly rare occurrence when the pilots’ full complement of talent, skills, and training is not enough to keep them from falling through it.

  When pilots fail, it is headline news. When they succeed in addressing minor issues before they become major, however, it is for the most part invisible, making human resiliency the most mysterious of the many contributors to the industry’s stellar safety record.

  It is easy to see when things go wrong, writes James Reason in his book The Human Contribution. A professor of psychology and a pioneer in the study of human factors, Reason spent most of his career writing about why people screw up. At a conference in 2009, however, he presented what he considers the much more interesting flip side. Speaking to the annual Risky Business Conference in London, Reason called the subject of his life’s work “human as hazard,” a tedious subject. “It’s banal; it’s so everyday,” he said. The octogenarian’s attention had been turned to “the stuff that legends
are made of,” the qualities that allow humans to be heroes.

  So much time has been spent learning from failure; what can be gleaned from studying the right stuff? This is not just Reason’s question. From the icy day Sullenberger and Skiles ditched their plane in the Hudson, the public has clamored to hear their story. The same is true of the heroes who preceded them. The controlled crash landing of United Flight 232 occurred in 1989 and has been the subject of books and movies. The latest, Laurence Gonzales’s Flight 232: A Story of Disaster and Survival, was turned into a play. People remain fascinated by the horrifying drama and uplifting conclusion.

  To find out what qualities these pilots share, I analyzed five commercial flights that went terribly wrong but were saved from total disaster by the actions of the flight crew. I interviewed these pilots about their experiences, asking them what factors had led to the outcome. Their stories had several themes in common and I’ve grouped them under headings to show that. Innovation was one consistent theme and this should not be surprising. After all, machines do not improvise, and computers are not creative. What pilots bring to the cockpit is their humanity. It is their greatest contribution.

  Knowledge and Experience

  In the middle of an unseasonably warm winter in Australia, Richard de Crespigny and his adult son Alexander took me boating in Sydney Harbour. Windblown and athletic, the men were clearly in their element; in their nautical shirts and deck shoes, they could have been modeling for the Vineyard Vines catalog.

  Then something went wrong with the engine, and de Crespigny had to strip down to his swimsuit and hang on from the fantail to repair the motor so we could get moving. Drenched and oil-spattered, he no longer looked like the man Australia has come to know as Captain Fantastic, but once again his mechanical know-how and experience saved the day.

  Call it maturity, knowledge, or time at the wheel, when a pilot gets to a certain age, there’s little he or she hasn’t seen before. John Gadzinski, a pilot for a U.S. airline and a safety and hazard specialist, says, “You’ve already been vaccinated as far as your experience and reactions go. It’s less and less a deer-in-the-headlights look and more ‘Okay, this is what we’re gonna do.’”

  Still, many experienced airline pilots don’t have de Crespigny’s in-depth knowledge of the Airbus A380. That’s what he was flying on November 4, 2010, when he led a team of five pilots to land a severely crippled airliner with 469 people aboard. For nearly two harrowing hours the jumbo jet circled above the Singapore Strait after an uncontained engine failure blew holes in the wing and fuselage and disabled multiple critical systems.

  It was a clear, sunny morning when Qantas Flight 32 departed Singapore’s Changi Airport. Then, while passing through seven thousand feet, passengers were jolted by a loud bang. Mike Tooke, seated on the left side of the plane, saw “a flash of white off the inner engine. Then there was an incredibly loud second bang, and the whole plane started to vibrate.” Five seconds later, he said, “it felt like we were plunging out of the sky.”

  From below the wing, a stream of atomized fuel was hosing out of the tank. Some passengers took out their phones and recorded the terrifying sight, no doubt believing they were capturing the last moments of their lives.

  On the flight deck, de Crespigny had been about to turn off the seatbelt sign when he heard the two bangs followed by the repetitive beeping of the master warning system. He pushed the altitude hold button, which reduced engine thrust and stress on the engines. It also lowered the nose, which was what caused Tooke to think the plane was “plunging out of the sky.”

  This simple response wasn’t reflex on de Crespigny’s part. He was reaching back to an experience he had had nearly a decade before, when he was a passenger on a Qantas 767 that had an engine explode as the plane was ascending after takeoff. In his book QF32, he writes that he was impressed by how quickly the 767 captain moderated the plane’s violent shaking. Once back on the ground, de Crespigny asked the man what he had done to reduce thrust so quickly and was told, “I just hit the altitude hold button.” The small lesson stuck with him. Remembering and deciding to heed it was the first of many decisions, sometimes quick and sometimes after achingly slow deliberation, that contributed to the happy ending of his own near disaster.

  My friend David Paqua, a general aviation pilot, once told me, “A pilot can have a thousand hours of experience, or he can fly the same hour one thousand times.” Pilots such as de Crespigny use each hour in the air, and even their hours on the ground, to become utterly familiar with the physics and the mechanics of flight. Heck, before QF-32, de Crespigny had visited the factories of both Airbus and Rolls-Royce, gathering material for a technical book he was writing about big jets, including the A380, the plane that gave him such a hard time on that fateful day in 2009.

  By contrast, Robert Pearson, the Air Canada captain whom I wrote about earlier in the book, and whose brand-new Boeing 767 would run out of fuel halfway across Canada in July 1983, told me he didn’t know enough about the plane he was flying on the day of his near catastrophe, and neither did his airline. “These airplanes came out of Boeing flown by test pilots who had known every rivet and bolt,” Pearson said. They arrived at the airline to be flown by “guys like me who knew nothing” about the revolutionary design. His drama began with his not understanding the way the computers assisted the airliner. This complexity masked a very simple problem: the plane was out of fuel. “We didn’t know what the problem was. Even when the engines were failing, we were wondering, ‘How the hell can computers shut down engines?’” Pearson said.

  At the same time, a lifetime of piloting all kinds of planes, including and especially unpowered gliders, enabled Pearson to land the 767 successfully without engines. Each hour in the air can teach something new to even the most experienced pilot.

  When the fuel pump alarms started illuminating on Air Canada Flight 143 that summer day in 1983, Pearson said no one on the flight deck had any idea what could be wrong. The engines were still working, and the flight management computers indicated that there was plenty of fuel. Remember, the pilots had manually entered the pounds of fuel loaded, but the 767 flight management system interpreted the input as kilos, a unit of measurement roughly double that of a pound.

  As a sign of just how confusing all this was to the crew, Pearson’s first announcement to his passengers was that the plane’s computer had gone kaput and the flight would divert to Winnipeg to get things sorted out.

  When the engines spooled down, the pilots realized they could not spend any more time trying to figure it out. That was in the past. What was going to happen in the immediate future—that was up to them.

  Pearson told me that he and the first officer, Maurice Quintal, who died in 2015, needed to focus on how and where they would glide the plane. Pearson was flying, but with only basic instruments. Quintal was doing the math, logging the distance to the closest airfields and comparing it to how quickly the plane was losing altitude.

  “I believed we could make it” to Winnipeg, Pearson said, but Quintal’s calculations showed otherwise.

  While in the military, Quintal had trained at Gimli, an air force base fourteen miles off to the right of where they were flying. They had more than enough altitude to get there—too much altitude, in fact. As the plane approached the airfield, it was too high, and the pilots had no ability to slow it. Quintal lowered the landing gear, but it wasn’t enough. So Pearson used a side slip (or crab) maneuver he had honed towing gliders in his off time. Using the rudder, the panels on the wings called ailerons, and the elevators, he turned the fuselage into the airstream so that the plane’s bulky metal flank would work against its movement through the air. You can mimic the effect by putting your hand out the window of a moving car with the palm facing forward. You’ll feel the resistance right away. That’s what Pearson was counting on to help bring down his speed.

  “We were using the fuselage as an airbrake,” Pearson said. It gave everyone on board a bone-jarringly rocky
ride, but it worked.

  “I had total tunnel vision. I knew Maurice was beside me. I was one hundred percent concentrated on speed and our relationship to that piece of cement.”

  In the stories written about the “Gimli Glider,” Pearson’s experience in gliders is credited for his inspired innovation that day. Pearson argues the point on two levels. First, the crab maneuver was used most often when he was towing gliders, not flying them. “When coming in on approach on a grass field with a metal rope hanging down [from the plane], you come in high because you don’t want to catch the rope on the fence. I’d side-slip every time I came in, and I did a lot of glider towing.” Anyway, Pearson points out, gliders have speed brakes, and without power the 767 he was flying did not.

  More to the point, he says it was all the flying he did that prepared him for that day. Gliders and airliners, for sure, but also aerobatic planes and ultralights, floatplanes and ski planes on ice and snow—decades of experiences all came flooding back, he told me. “There’s something to be gained from everything we do.”

  Synergy and Teamwork

  The philosophy of crew resource management, or CRM, is to merge each pilot’s separate strengths to create a more knowledgeable, more experienced team. With de Crespigny on QF-32 were First Officer Matt Hicks and Second Officer Mark Johnson. In what would prove to be fortuitous, two other captains, Dave Evans and Harry Wubben, were also on the flight deck. De Crespigny was being checked out on the A380, and the pilot checking him was being trained as a check captain (that is, learning how to assess whether a pilot meets government criteria). “So,” de Crespigny explained, “we had a check captain checking a check captain who was checking me.” A total of seventy-six thousand flight hours was represented by the five navy suits.