It was once believed that all swans were white. No one considered the possibility of black swans until a Dutch explorer discovered them in Australia in 1697. That is the nature of a Black Swan event: It’s rare, has an extreme impact and is predictable in retrospect.
Let’s examine three Black Swan events in aviation. There is much we can learn from how professional aviators handled, and mishandled, their black swans.
The Impossible Happens
Four minutes after departing Singapore’s Changi airport in November 2010, Qantas Flight 32, an Airbus 380 and the world’s largest passenger aircraft, suffered a catastrophic failure of the number two engine, the inboard engine on the left wing, while climbing through 7000 feet. A turbine disc disintegrated and destroyed the engine, damaged the nacelle, punctured the wing, and caused fuel system leaks. One hydraulic system and the anti-lock braking system failed. The flaps were damaged as were the controls for the number one engine. In all, 21 of the aircraft’s 22 systems were affected. About 65 percent of the aircraft’s roll control was lost. A crash was in the offing and the deciding factors were on the flight deck.
Chaos could have reigned, with no less than three captains aboard. Captain Richard de Crespigny was being checked by a check captain who was himself being trained as a check captain by an even more senior check captain. There were also First and Second Officers aboard.
Recognizing potential conflicts, the captain made clear the chain of command and everyone’s role. He went over it three times before departure.
There are many lessons for us in the way this emergency was managed. You needn’t be an airline pilot to take advantage of them. In fact, you’ll recognize many elements of the Five Hazardous Attitudes and how the crew overcame them.
It Can Happen to You
En route to the airport, the captain asked the crew to visualize emergencies such as an engine failure. We should do the same. Mentally model an engine failure on takeoff, or en route. Consider a fuel tank that refuses to feed, or a door that pops open. Imagine problematic weather and how to circumvent it. During the emergency, the captain admitted, “We were all in a state of disbelief that this could actually be happening. We were worried, but our training kicked in.”
If flying with another pilot: “You have a responsibility to tell me if you disagree with my decisions or think I’m missing anything.” This also applies to passengers—holding charts, spotting traffic, etc.
In Captain de Crespigny’s words, “You have to fly the aeroplane; you have to aviate.” We have heard this many times, but in an emergency, it takes focus to remember that aviating comes first. The captain was flying, so he had to keep the airplane at proper speed and maintain situational awareness as in flying above nearby mountains.
As this crew did, if you have a fuel problem, reassess your fuel state every ten minutes. Then decide whether to continue or just get it on the ground.
How to handle threats? Assess, then fix or mitigate. Focus on what’s working rather than what’s broken. Be realistic but focus on the positives.
Not So Fast!
Act after consideration, rather than blindly obeying checklists. The computer generated over 120 checklists and warnings. One would have had them transfer fuel into a ruptured tank. It is essential not to do anything that will make the problem worse or create new ones. The First Officer and the check captains sorted out the checklists and warnings to do, modify, or ignore.
Avoid complacency and don’t make assumptions. The crew spent about an hour in a holding pattern figuring out the airplane’s condition before landing. The things you don’t know can get you. Be very paranoid and manage every conceivable risk. For instance, this crew managed risk by triple-checking all calculations and by not being rushed.
Teamwork is everything. Communicate clearly. Ensure that everyone knows their role and is empowered to perform it. In our case, that would particularly include ATC, passengers, and having rescue equipment in place before landing.
Taking nothing for granted, the crew prepared for a no-engine landing. The captain tested the A380’s handling at altitude before beginning a visual approach. Believe it or not, he visualized landing it just like a Cessna, and it worked.
Discipline Pays Off
The Airbus stopped about 500 feet from the end of the runway after almost two hours in the air. There were no injuries. The airplane was so broken that after landing all but one cockpit display went blank. They were on emergency power and had one working radio. It took three hours to shut down the number one engine. Repairs took two years and cost $139 million. It’s a wonder that an airplane so broken could still be flown.
In three months Captain de Crespigny resumed flying. “I managed to suck dry the brains of all the other pilots—every bit of knowledge came out of everyone and today I don’t think I’d change anything. I’m very pleased with that.”
Air France 447: Cockpit Chaos
Air France 447, an Airbus A330, was en route from Rio de Janeiro to Paris on a stormy evening in May 2009. The junior copilot was flying.
Over the south Atlantic, the aircraft flew though icing conditions that caused ice crystals to accumulate in the pitot tubes. Like dominoes, this seemingly trivial event led to a cascade of self-inflicted failures that, coupled with serious lapses in airmanship and crew resource management, would doom the airplane.
The first failure was the autopilot which disengaged when it sensed the blocked pitot tubes no longer feeding valid airspeed information. In turn, the airplane transitioned from normal law to alternate law software. One consequence of the transition is that the stall prevention logic in normal law is absent in alternate law. A second consequence is an increase in roll sensitivity. Since the airplane was in turbulence, the pilot overcorrected for a right roll, resulting in alternate left and right rolls. At the same time the pilot made an unnecessary and excessive nose-up input that triggered the stall warning twice as the airspeed decreased rapidly from 274 knots to 52 knots. Although the pilot regained the roll axis, the airplane was now climbing over 7000 feet per minute, about double the normal rate of climb.
The icing event ended in just over a minute after which all instruments read normally, yet the pilot kept holding the nose up.
Things began unraveling quickly. The Airbus climbed to its maximum altitude of 38,000 feet with an angle of attack (AOA) of 16 degrees and full engine power. The airplane decided it had had enough and began to descend nose-high, attaining an AOA of almost 30 degrees.
The captain, who had been resting, entered the cockpit, but by that time the cockpit mood was panicky. Given the turbulence, he supervised the more senior copilot in the left seat and the junior copilot in the right seat. The AOA was up to 40 degrees. The stall warnings stopped as all airspeed indications were rendered invalid by the aircraft’s computer due to the high AOA. Yet the crew could have misinterpreted the absence of warnings to mean that the AOA had been reduced when in fact matters were worse than ever.
At some point, the junior pilot decreased the pitch slightly. Airspeeds became valid but the stall warning sounded off-and-on for the remainder of the flight, stopping when he raised the nose again.
And this is how Air France’s newest A330, a perfectly functioning airplane, descended almost 11,000 feet per minute, nose up at 16 degrees, fully stalled for three and a half minutes from 38,000 feet into the ocean. All 228 aboard perished.
Loss of Control
The ultimate cause of this crash was the junior pilot’s misuse of the controls triggering a loss of control. FAA statistics tell us that 384 people died in 238 GA accidents in 2015, and that loss of control was the number one cause. It can happen anywhere, at any time. Food for thought: There is one fatal accident involving loss of control every four days.
Respect the Weather
Through inattention, AF 447 was headed into the worst of the weather. This accident was triggered by the momentary icing of the pitot tubes caused by that weather. Why fly through when you can go around?
Some years ago, the pitot tube got blocked in a well-known technologically advanced GA aircraft after takeoff. When the airspeed input failed, the software decided that all other air inputs were also invalid, including altitude and rate of climb. This pilot lost control and crashed rather than simply reverting to his standby instruments.
Where were the routine cross-checks integral to every instrument scan? Even without airspeed indication, if the aircraft is straight and level, why climb? Could you fly an airplane without an airspeed indication? Of course. It appears that the junior pilot’s scan broke down, despite plenty of correct information right in front of him.
A Failure to Communicate
There was a total breakdown in crew resource management, specifically, failing to communicate and cooperate. The junior copilot was pulling back on the stick, but the senior copilot could not feel the error since the sidesticks in an Airbus move independently. No one knew that the junior copilot was holding the stick full aft almost the whole time. When the senior copilot pushed the captain’s stick forward briefly, the system did not give that stick priority, but rather averaged the two inputs. The captain, who should have been busy with aeronautical decision-making, added nothing of value.
Recovery from a typical stall begins by pushing the yoke forward. Neither pilot did that. None of the pilots reacted to fully 75 stall warnings. The pilots may have thought they were still in normal law where stalls presumably cannot occur and did not realize that the airplane was in alternate law.
A private pilot I know nearly killed himself by failing to recover from a stall. He was at altitude, doing power-on stalls. He stalled the airplane but failed to recover correctly. Against all training, he instinctively held the yoke full aft and nearly became part of the landscape. At the last moment, he remembered reading something about “letting go.” When he did, the Cessna recovered by itself.
Into the Swamp
In December 1972, an Eastern Airlines Lockheed L-1011 attempted to land in Miami, Florida. When lowering the landing gear, the green nose-gear-down light failed to illuminate. The crew cycled the gear without success.
The captain called a missed approach and was given a holding pattern altitude of 2000 feet. The First Officer engaged the autopilot. Then all three crewmembers plus one additional flight deck passenger began investigating the problem.
The crew became so engrossed in fixing the light bulb that they failed to notice a tone indicating the airplane had deviated from assigned altitude by 250 feet. Given the darkness, the crew could not see airplane’s descending flight path. Still fixated, the airplane descended to 900 feet.
Suddenly the first officer said, “We did something to the altitude…we’re still at 2,000, right?” The captain yelled, “Hey, what’s happening here?” Ground impact came three seconds later. The nose gear was indeed down and locked and the dual indicator lights had both burned out. Somehow the autopilot became disengaged, leaving no one and nothing to fly this enormous airplane.
CRM in Action
Contrast the crew mismanagement here with the strict management of Qantas 32’s flight deck. We have come very far in terms of crew resource management, and most of the progress also applies to single-pilot resource management.
Because the Eastern crew neglected flying’s most fundamental tenet—fly the airplane—a minor failure ballooned into a tragedy. To re-quote Captain de Crespigny: “You have to fly the aeroplane; you have to aviate.”
Implicit in these words is the determination to never give up. These crews never succumbed to resignation, the fifth hazardous attitude. You’re not helpless, and you can make a difference.
Fred Simonds is an active CFII in Florida, where black swans were first reported in 1961.
