Fly by Wire
reviewed by Philip Greenspun; January 2010
Site Home : Book Reviews : One Review
|
|
Fly by Wirereviewed by Philip Greenspun; January 2010
Site Home : Book Reviews : One Review |
This is a review of
Fly by Wire: The Geese, the Glide, the Miracle on the Hudson
It is nice to read a book about aviation, for the general public,
written by someone with experience. "William Archibald Langewiesche"
has an Airline Transport Pilot certificate according to FAA registry,
a current medical, and an expired Flight Instructor certificate. As
far as the FAA is concerned, Langewiesche has roughly the same
certifications as a typical airline captain. Contrast this with the
writings by Malcolm Gladwell, a non-pilot, in the book
Outliers
The book concerns the U.S. Airways Flight 1549 that landed in the Hudson River on January 15, 2009, upstaging George W. Bush's farewell address to the American people (blog posting on that topic).
Fly by Wire includes a thorough discussion of the principal villains and victims in this incident: the Canada goose. The goose population explosion, from 200,000 in 1970 to 4 million today, is the result of government wildlife agencies successfully creating non-migratory flocks of the "Giant Canada" goose by clipping their wings (page 53). The consequences of this government meddling with Mother Nature have cost vast sums of money and certainly quite a few lives. Page 56 describes a Concorde losing two engines (out of four) after ingesting a single Canada goose at JFK; shrapnel from the affected engine took out a second engine; cost to repair was $9 million. As it happens, on page 64 we learn that hydrogen isotope analysis showed that the birds who encountered US Airways 1549 had grown their feathers in northern Canada, i.e., they were traditional migratory geese.
We learn a fair amount about jet engine bird ingestion standards. An engine must be designed to liquefy small birds, but when hit by a 12 lb. Canada goose, it is expected to self-destruct. The designers' goal is only that the damage be contained to the housing surrounding the engine.
The middle portion of Fly by Wire contains an excellent description of the Airbus flight envelope protection system, developed by French engineers in the early 1980s. The Airbus computer systems will not let a pilot stall, overbank, overstress, or overspeed the airplane.
[Amazingly, none of this is available in the very latest American designs. The Garmin G1000 and fancy Garmin autopilot, both entirely computerized and will happily fly a $3 million Cessna Mustang jet (for example) into a stall. Fed by an angle of attack sensor (computers angle between the wing and the relative wind), the G1000 displays a "green donut" indicating an airspeed of 1.3 times stalling speed in the current configuration at the current weight (easy to calculate because an airfoil will always stall at the same angle of attack, regardless of weight, temperature, speed, etc.). If a pilot presses the altitude hold button and pulls back the thrust, the autopilot will keep pitching the airplane up right through the green donut. The autopilot will keep trimming the nose back until the stall warning system activates and the plane is on the edge of a stall. Only when the stall warning horn blares will the autopilot trip off and hand a disoriented pilot back an airplane that is trimmed full nose up for flight at 85 knots. You don't need a fancy fly-by-wire system to protect an airplane from autopilot-induced stalls; the latest Avidyne autopilot for the Cirrus has "flight envelope protection" in which it will accept an altitude loss rather than let airspeed decay below about 90 knots (well above the airplane's roughly 70-knot no-flap stalling speed).]
The famous American Airlines crash into Cali, Colombia is covered. This is a famous example in Crew Resource Management training, though its usefulness is questionable. Both pilots had been U.S. Air Force fighter pilots and were, as is typical for U.S. major airlines, highly experienced. How is a novice regional airline pilot, transitioning from a two-seat 50-knot Cessna 152, supposed to do a better job than these two? Technology would definitely have helped, however. If they'd had a $50 GPS and a $30 copy of Microsoft Flight Simulator, the 189 people on that Boeing 757 would still be alive. But their airplane did not have a GPS nor a synthetic terrain view nor even a color-coded moving map. A radar altimeter, bouncing a signal from the belly of the plane down to the ground and back, plus a rat-simple computer program alerted the crew to the approaching mountain slope. By then it was too late to climb over the mountain without perfect technique and the two Air Force veterans were not quite as good as the fly-by-wire system of an Airbus. [Illustrating the superior toughness of the species, the survival rate of the canines on board was 100 percent: 1 dog, 1 survivor (compared to 4 human survivors out of 193).]
Langewiesche gives us a seemingly clear explanation of a 1988 Airbus A320 crash at an airshow. The captain blamed the computers; the copilot kept quiet; the investigators blamed the captain. Langewiesche says that the crash occurred at "a small secondary airport with a short [2000'] grass runway". Wikipedia says that the crash occurred at LFGB, an airport with a 3675' asphalt runway. The French accident report, as best as I can make out with my junior high school French (studied so long ago that we had to wait for monks to copy out our individual copies of Roman de la Rose), includes an airport diagram showing two runways, one of which is indeed a short grass runway (785 meters or about 2500'). A Google Map image, annotated with the crash site ("vol 296"), confirms that the Air France crew decided to use the grass runway.
The last portion of the book discusses the US Airways 1549 flight into the Hudson per se. Although the weather was perfect, the flight started out slightly inauspiciously with Captain Sullenberger violating the sterile cockpit rule (p49). Below 10,000', the FAA requires that pilots refrain from conversation that isn't directly related to operating the airplane. First Officer Jeffrey Skiles was on the controls in his 35th hour of flying the Airbus (p12). Skiles had 20,000 hours of flying experience, but mostly in the Boeing 737. This was his first trip in the Airbus and it would have been a good time to let him concentrate, but Sullenberger initiated a discussion of the view of the Hudson river; Skiles properly discouraged this with a monosyllabic response and then returned to the standard callouts.
Once they hit the geese, we learn that the Airbus airspeed tape includes a "best glide" speed indication, something that a Boeing or other airliner with American avionics would not have. Langewiesche describes a simulator experiment designed to answer the question "Could they have made it back to LaGuardia?" In the sim, knowing in advance that they were going to suffer a bird strike and that the engines could not be restarted, four out of four pilots were able to turn the A320 back to LaGuardia and land on Runway 13. Sullenberger and Skiles spent about 18 seconds sorting things out before initiating a turn and there was no way for them to make it to LGA by then. Sullenberger's best decision at this point was to restart the auxiliary power unit (APU). The APU is typically switched on as a source of compressed air for starting the engines, then turned off as part of the after-takeoff checklist. Without electric power, any airliner is uncontrollable. Even if the airliner has conventional steel cables running to hydraulic actuators, without a running hydraulic pump there won't be enough pressure to operate control surfaces. The Airbus would have popped out its ram air turbine (RAT; a window fan basically) if the left engine had not continued to produce some electricity, but with the APU running the pilots did not have to worry about the airplane becoming unresponsive.
[Overlooked by both Langewiesche and all of the media reports on the accident is that Sullenberger and Skiles turned in the wrong direction for a Hudson River landing. The winds were 010 at 10 knots, i.e., from the north. This would have favored turning right and landing north into the wind. By doing so, they would have avoided having to clear the George Washington Bridge. Presumably because they were still considering landing back at LaGuardia, the crew turned south and landed with a tailwind. The ground speed was therefore roughly 20 knots faster than it would have been if they'd landed north, which means that the damage to the fuselage was much more severe than it needed to be.]
Sullenberger and Skiles held max glide speed until they were clear of the George Washington Bridge and then, when they no longer needed to make a specific distance, slowed up closer to the minimum sink speed (not indicated on the fancy airspeed tape). The pilots elected not to use maximum flaps, which allow for the slowest possible airspeed but also increase the descent rate dramatically. Proving Langewiesche's thesis that pilots need to be protected from themselves, Sullenberger seemingly flared too high. The pilot of a piston-engine four-seater won't start trading airspeed for a reduction in descent rate until perhaps 10' above the ground. The airline pilot is accustomed to starting the flare at 50' above the ground, partly because of the extra inertia of the heavy airplane and partly because the landings are always power-on. The Airbus fly-by-wire system allowed Sullenberger to pull the stick fully back and let the airplane trade nearly every last knot of airspeed into a reduction of vertical speed. The actual landing was 144 miles per hour, 9.5 degrees nose up, and 13 feet per second (780 feet per minute) vertical descent rate. Aside from the high vertical speed, these numbers are pretty close to what you'd have in a normal landing on a paved runway.
In some ways the automation of a modern airliner hindered the crew, who were beleaguered by a constant stream of audio warnings: "go around", "wind shear ahead", "terrain, terrain, pull up, pull up", "too low, terrain, gear".
The last chapter is devoted to the passengers. One woman texts her husband "my flight is crashing", wishing to spare him the pain of not knowing whether or not she was on the plane. Skiles was buried in the checklist; Sullenberger told everyone to "brace for impact" but did not mention that it would be a water landing, so the flight attendants, who could not see out of the windows, had no idea that they would be conducting a water evacuation. Despite research by Helen Muir, who demonstrated that an airplane evacuation in a dry hangar can turn into chaos by offering people a small cash reward for being among the first 50 percent out, the passengers mostly cooperated to ensure a quick evacuation.
The reason that we're supposed to pay attention to this book is that Langewiesche supposedly presents evidence that the fancy computer-controlled fly-by-wire system in the Airbus was a big factor in the Miracle on the Hudson. However, there is hardly any evidence that the outcome would have been different in, say, a Boeing 737.
Let's look at the things that were critical to passenger safety on this flight:
Let's take each one in turn and see how much help Sullenberger and Skiles got. The Airbus computer system knew that the plane was in flight and could see that the engines were spinning down and that loss of the generators was imminent, yet the software neither suggested turning on the APU nor turned it on itself. The Airbus computer system knew how high above the ground the airliner was, knew about the obstacles and terrain in the area, and knew where the nearby airports were and what runways they had. The computer system also continuously calculated the wind speed and direction by comparing airspeed and groundspeed, heading and track over the ground. The computer system could easily have been programmed with the gliding capabilities of the A320. Did it offer any suggestions about the nearest glidable airport and runway? Did it highlight those airports in a special color on the moving map? No. The US Airways crew's most difficult decision was whether to try to make it back to LaGuardia or to land off-airport and the Airbus computer system provided no help.
In configuring the airplane for best glide, the most important thing would be to get the flaps and gear up while retracting any spoilers. The Airbus provided no help in this regard. There is no big "I'm gliding" button. There is no logic that when the engines spool down and the plane is high above the ground the gear should be pulled up and, if airspeed permits, the flaps pulled back in. As it happens, Sullenberger and Skiles were already configured for best glide so they didn't have to do anything other than set a reasonable airspeed. They got some help from the Airbus computer system, but most jet pilots are aware that best glide speed is somewhere between 200 and 250 knots. In this particular accident, there was no need to glide especially far. In fact, as noted above, the landing would have been gentler if they'd turned right rather than left and landed to the north, into the wind, never needing to clear any bridges over the Hudson.
What about avoiding an aerodynamic stall? Major airline pilots are accustomed to paying a lot of attention to the airspeed indicator. It seems very unlikely that Sullenberger and Skiles would have let a Boeing 737 stall. If they had gotten anywhere near that point, the 737's stick pusher would have put the nose forward and prevented a true stall.
Finally there is configuring the plane for a water landing. The Airbus has a "ditch switch" but it doesn't do most of the things that would help a pilot, e.g., disabling landing gear extension (something that pilots might be inclined to do by habit), suggesting the use of partial flaps if neither engine is operating (to avoid a high descent rate), and notifying the flight attendants that a water landing is imminent. The "ditch switch" on the Airbus is similar to the "close the outflow valves" switches on other airliners and has the effect of sealing up the pressure vessel. In the case of US Airways 1549, the pilots forgot to press the switch, but that probably didn't have a big effect on how quickly the fuselage filled with water. The fuselage was damaged due to the impact vertical speed having exceeded the design limit (certification standards are great at ensuring that the airframe is strong enough to withstand a ditching with one or both engines operating, but sadly nearly all of the airliners that have ever ditched have done so after fuel exhaustion or some other event that resulted in all engines failing).
Langewiesche convincingly shows that the Airbus fly-by-wire system helps a lot of pilots avoid the consequences of their sloppiness. He fails to show that it made any difference to U.S. Airways 1549. Despite this failure, the book is well worth reading.
More:
.
Langewiesche has done a lot of writing for Atlantic magazine and has published several high quality non-fiction books on technical subjects.