[Peetwo]

Reversing through the Swiss Cheese??

Following on from the last under the ICAO Annex 14 minimum standard and recommended practice for RESA it says...

Dimensions of runway end safety areas

3.5.3 A runway end safety area shall extend from the end of a runway strip to a distance of at least 90 m where:
— the code number is 3 or 4; and
— the code number is 1 or 2 and the runway is an instrument one.

If an arresting system is installed, the above length may be reduced, based on the design specification of the system, subject
to acceptance by the State.

Note.— Guidance on arresting systems is given in Attachment A, Section 10. 

3.5.4 Recommendation.— A runway end safety area should, as far as practicable, extend from the end of a runway

strip to a distance of at least:



— 240 m where the code number is 3 or 4; or a reduced length when an arresting system is installed;

— 120 m where the code number is 1 or 2 and the runway is an instrument one; or a reduced length when an arresting

system is installed; and
— 30 m where the code number is 1 or 2 and the runway is a non-instrument one...

And in Australia this is the notified difference (both of which are listed as less protective for those two SARPs:

Australia requires the RESA to be provided at the end of the runway strip and is to extend for the distance of 90m for a code number 3 or 4 runway used by air transport aeroplanes. In all other cases, the minimum length of the RESA is to be 60m for Code 1 or 2 runways.

With that in mind read the following article from two days ago by the Fort Fumble (white hats) at Flight Safety Australia magazine...  

At the sharp end
By staff writers -
May 20, 2019

In a matter of seconds, with incomplete information, a flight crew has to make a life-or-death decision

 Ameristar flight 9363, Ypsilanti, Michigan, USA, 8 March 2017

The thing that makes aviation terrifying, or exhilarating, is that every time you advance the throttles to take off you are putting your reputation—not to mention your life—on the line. The impressive statistical safety of commercial flight may obscure this truth but does not cancel it. As the old hands say, ‘you are only as good as your last landing.’ The author Tom Wolfe put it more poetically, but equally accurately, in his phrase, ‘chosen or damned … it blows at any seam’.

The captain of this flight was a 54-year-old man with a solid, if unexceptional, aviation career of more than 15,000 hours. He had nearly 8500 hours in the Douglas DC-9 but was ‘back in school’ on this flight, undergoing type training on the DC-9’s derivative, the MD-83, under the eye of a check airman. This pilot was 41 years old with 9660 hours, also mainly on the DC-9.

From the beginning, it was clear that the afternoon’s flight would present distinct challenges, although nothing its two experienced pilots would not have dealt with over their long careers. It was a very windy day, with gusts of 50 knots, strong enough for the nearby Detroit Metro airport to be using its almost-forgotten east-west runways. The cockpit voice recorder (CVR) recovered from the wreck of the aircraft showed the two pilots factored weather into their flight plan from the outset.

A completed take-off speed card found on the flight deck showed they calculated V1 (take-off decision speed) at 139 knots, VR (rotation speed) of 142 knots, and V2 (minimum take-off safety speed) of 150 knots.

The CVR recorded the check airman advising the captain to ‘delay rotation until at least V2 … wait for me to call it’.
The captain also briefed about the effect the wind would have should there be an emergency. He emphasised the check airman should ‘really keep an eye out on what our airspeed is doing today. In the event of an engine fire or failure at or after V1, we’re going to continue the take-off … if you get any kind of a [windshear] warning, it’s going to be max thrust, all the way to the firewall thrust. If necessary … we’ll fly out of the shear, back me up on the airspeed calls.’ The captain concurred with the check airman’s briefing that in an emergency they would fly to Metro, rather than attempt a return to Ypsilanti.

At one point in these deliberations, a ground handler entered the flight deck for a sign-off and observed, ‘should be pretty fun getting this thing off the ground huh?’ Behind them, the cabin crew were ordering extra sick bags.

The MD-83 spent about an hour in taxi and holding, partly because high winds had closed the Ypsilanti tower and the flight crew had to broadcast their intentions for departure and obtain clearances by mobile phone. The captain’s brief, bitter and vulgar judgement on this state of affairs (‘what a cluster****!’) was the only utterance on the CVR not consistent with exemplary professionalism. In the light of what happened next, it would be churlish to deny him the momentary pleasure of this outburst.

By 1451:12 the aircraft was lined up for departure from the 2300 metre runway 23L.The check airman called for the captain to begin take-off roll. At 1451:55, the check airman said ‘V1’. Six seconds later (1452:01), he called ‘rotate’ followed three seconds later (1452:04) by ‘V2’. A second after that, the captain said, ‘hey, what’s going on?’, and three seconds later, ‘abort’. The check airman said, ‘no, not above … don’t abort above V1 like that’. The captain’s reply was succinct: ‘It wasn’t flying.’

Without hesitation, the check airman turned his attention to applying maximum reverse thrust, deploying the spoilers and assisting the captain on the wheel brakes. They had committed themselves to a most unenviable situation. At 173 knots, (89 metres/second) with the end of the runway 500 metres ahead, their predicament was exactly as described in the sour old pilot’s joke: they would be the first to arrive at the scene of the crash that was now inevitable. But no later analysis suggested any better decision than the one they had made in under five seconds.

The cabin crew had been similarly observant and decisive. The CVR recorded them in chorus, shouting, ‘Heads down! Stay down!’ as the aircraft sped towards the end of the runway.

The aircraft was travelling about 100 knots when it left the paved surface of runway 23L and overran a blast pad. It then travelled about 300 metres across a grassy surface before striking the airport perimeter fence and hitting a raised, paved road at about 40 knots. It came to a stop, fuselage intact, but on its belly. The check pilot called the cabin: ‘Evacuate! Evacuate! Evacuate!’

It was just over two minutes since take-off began and 19 seconds after the captain called ‘abort’.

Now it was the passengers’ turn to rise to the occasion. They were a college basketball team and staff, on their way to Washington DC, meaning that, unlike a typically composed passenger group, many of them knew each other. The cabin crew told the National Transportation Safety Board (NTSB) investigation the passengers were ‘incredibly calm and responsive … followed flight attendant directions … and did not take or attempt to take luggage or personal belongings with them’.

After exiting on the slides, the passengers remained orderly and quickly moved away from aircraft. All 110 passengers and six crew survived. There was only one injury—a cut knee that required stitches.

Why it happened

The ‘probable cause’ (in the NTSB’s words) of the crash was clearly visible on the hulk of the aircraft. The right elevator was deflected downward. Investigators found it was jammed and could not be moved by hand. An actuating crank and links were found locked over-centre beyond their normal range of travel and had been bent.

Analysis of the flight data recorder (FDR), which was recovered undamaged, showed the right elevator had been deflected 16 degrees down and even after the captain pulled strenuously on the yoke, had risen to no more than 13 degrees down.

The aircraft had been parked at Ypsilanti for two days, sheltered from the winds by an unusually large hangar (a building which had been part of the gigantic Ford Willow Run factory that made bombers during World War II). The combination of strong westerly winds and the building’s size had generated local turbulence, including vertical gusts which had moved the right elevator’s actuating crank and links beyond their normal range of travel and locked them over-centre. A computer simulation confirmed this.

The MD-83’s elevator design dates back to the Douglas DC-9 of 1965 and uses neither hydraulic power nor gust locks. Instead, the elevators are damped and moved by tabs, similar to the trim tabs of smaller aircraft. It is these tabs that are attached to the control yokes by unpowered pulleys and cables. When the crew had, quite correctly, made a full-and-free-movement control check before take-off, the tabs had responded perfectly. The NTSB concluded the deflection and damage on the T-tailed MD-83’s right elevator, 10 metres above the ground, could not have been detected in the crew’s walk-around.

The NTSB found the right elevator’s jammed condition ‘rendered the airplane unable to rotate during take-off’. Esteem for the crew shines through the deliberately bland and neutral language of the report. ‘The captain’s decision to reject the take-off was both quick and appropriate,’ and ‘the check airman demonstrated disciplined restraint in a challenging situation’.

‘Had the check airman simply reacted and assumed control of the airplane after the captain decided to reject, the results could have been catastrophic.’

The NTSB also noted how the airport’s runway safety area (RSA) had been upgraded to comply with Federal Aviation Administration (FAA) standards. The improvements included removing a taxiway, relocating the perimeter fence and road, filling in a 10-metre ravine (which might have broken the aircraft’s fuselage as has often happened in other overrun crashes), moving or making frangible approach lighting systems, and removing structures and concrete markers. The project had cost $US20 million, with the US Federal Government paying $19 million.

However, there were unresolved safety issues—how to identify jammed elevators on the DC-9/MD-80/Boeing 717 series was one. Others included the potential inadequacy of ground gust limit loads for the certification of transport-category aircraft, the lack of procedures for operators to monitor the wind that affects parked aircraft, and evacuation slide malfunction. The front right slide had not inflated, and the tail cone exit door had been jammed, briefly, by a seatbelt.

The combination of factors that had produced the crash was a textbook example of James Reason’s Swiss cheese analogy. Small holes aligned in layer after layer of supposedly impregnable defences, allowing chaos to sneak through. As the NTSB said, ‘Rarely could all of the safeguards in place to ensure an airplane is airworthy before departure (such as proper aircraft maintenance, pre-flight inspections, and control checks) fail to detect that an airplane was incapable of flight, as occurred with the jammed elevator on the accident airplane. Perhaps even more remarkable was that a flight crew would be placed in a situation in which the airplane’s inability to fly would not be discoverable until after it had accelerated past V1 during a take-off roll.’

But it is important to remember that Swiss cheese theory also works in reverse. Well-trained crews on the flight deck and in the cabin, disciplined passengers, and an airport operator that took its runway safety obligations seriously, had downgraded a tragedy into a hull loss and an anecdote to thrill future generations. The basketball team caught another flight and won their game.

 
The Swiss cheese in reverse: "....and an airport operator that took its runway safety obligations seriously, had downgraded a tragedy into a hull loss and an anecdote to thrill future generations..."

The ICAO SARPs are generally regarded as the minimum recommended standard that a signatory State should be complying with. How have we got to the point in Australia where we are actively encouraging to set safety risk mitigation standards below even the minimum recommended international practice...  

TICK...TOCK miniscule - whom ever you maybe??  

MTF..P2