Sometimes paranoia's just having all the facts."
—William S. Burroughs
There are many things we do in cockpits designed to keep us safe and most of those are widely accepted as best practices. I say widely accepted because wise pilots who know better tend to have a quiver full of such arrows. But not every pilot is so wise. In fact, pilots in the second group tend to think pilots in the first group are paranoid. Guess which group I am in?
Cabin Altitude Passing 10,000 Feet Aircraft Altitude
Here are two questions for you. (1) How many aircraft have been lost as a result of a rapid decompression at altitude? (2) What is your aircraft's normal cabin altitude after takeoff when passing 10,000 feet?
As far as we know, there has never been an airplane lost due to a rapid decompression. But there have been many lost due to a failure to pressurize. For the second question, you should honestly guess at this. Have an answer in mind? Okay, now consider that your aircraft probably pressurizes at a rate of 500 feet per minute in a climb. So if it takes you 4 minutes to get to 10,000 feet aircraft altitude, your cabin altitude is unlikely to be greater than 2,000 feet. And if your aren't climbing to an altitude much higher than 10,000 feet, your cabin altitude may not even be that high. So knowing the answer to this question, and faithfully checking when passing 10,000 feet aircraft altitude, can save your life. Be paranoid about this. (I am.)
Photo: N48DL, Coast Guard Photo, from NTSB Accident Docket, Item 521814.
There are no documented cases of an airplane lost due to a rapid decompression but there are at least five when the aircraft failed to pressurize properly:
- Beechcraft King Air VH-SKC — The aircraft was unpressurized and the occupants did not receive supplemental oxygen, for undetermined reasons.
- Cessna 421 N48DL — The FAA was negligent enough to permit this airplane to operate at 25,000 feet without oxygen equipment and the pilot was foolish enough to take it to high altitude.
- Helios Airways 522 — A misset pressurization switch left the occupants unconscious until the aircraft ran out of fuel, all aboard were killed.
- Learjet N47BA — The flight crew were unable to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons, all aboard were killed.
- Socata TBM 700N C-FBKK — The aircraft apparently lost pressurization, the oxygen system was turned off at the bottle, the aircraft entered a spiral dive.
Pilot appeared to lose useful consciousness 20 minutes after takeoff.
Pilot appeared to lose useful consciousness about 30 minutes after takeoff.
Pilots appeared to lose useful consciousness 13 minutes after takeoff.
Pilots appeared to lose useful consciousness 14 minutes after takeoff.
Pilot appeared to lose useful consciousness 16 minutes after takeoff.
In many of these cases the reason the aircraft did not pressurize was never proven (VH-SKC, N48DL, N37BA, and C-FBKK) or occurred because of an issue that could have been prevented (Helios Airways 522). In a few of the cases the oxygen system was turned off at the source or was never installed in the first place (N48DL and C-FBKK). But in every case the mishap could have been prevented had the pilot adhered to stricter preflight rules and made a conscious effort to check cabin altitude at a few key moments.
For more about this: Slow Onset Hypoxia.
Passing 10,000 feet in a climb, I always make a point of announcing the cabin altitude. I do this aloud to cement in my brain what this should be normally, and to instill the same in the other pilot. I don't bother with the "Delta P" (Differential Pressure) because that number is meaningless to me. If I told you it was 2.5 psi, would you know if that is normal or not? But if I told you it was 7,000 feet you would know we have a problem. (Our cabin altitude will never get that high if the system is working properly.) But even if it was only 5,000 feet and we had only been airborne for a few minutes I would know that is a problem, since our system is set to climb at 500 feet per minute and it takes it a while to do this. The photo was taken passing 10,000 feet on our way to 40,000 feet and even included a momentary level off at 2,000 feet. And with all that, our cabin altitude was just barely passing 500 feet.
Vertical Speed Mode in a Climb
If your aircraft tends to "hunt" for the right pitch while climbing in a "speed hold" mode, you are at risk. The Gulfstream G450 has the worst tendency to do this. Our FLC (Flight Level Change) mode is designed to maintain a speed with climb power when climbing or idle when descending. It keeps us from stalling. But while it can be very good, every now and then the climb rate varies from 300 fpm to 5,000 fpm. So we are forced to resort to VS (Vertical Speed) mode, which maintains the climb rate (feet per minute) but will allow the speed to decay below target if the rate is too much for the available thrust. Not good. I am paranoid about this.
You might argue that your stall barrier system will keep you out of trouble. You might also argue that your instrument crosscheck will keep on top of things. In 1979, an Aeromexico crew flying a DC-10 almost lost their aircraft because they didn't understand their autopilot didn't care about airspeed when it was engaged without a vertical mode. Their autopilot resorted to vertical speed mode in a climb and the aircraft stalled shortly thereafter. The crew confused the stick shaker for an engine problem and shut down their center engine and witnessed their airplane lose over 10,000 feet before recovering. Incredibly, they restarted the engine and proceeded to fly across the Atlantic.
For more about this: Accident: Aeromexico 945.
In 2013 a Cessna CJ2+ pilot almost lost the airplane because the V/S mode decided the climb rate was more important than keeping the airplane flying. The stall barrier system was defeated by a small sliver of ice in the single AOA probe. He claims his attention was diverted for only a few seconds. The aircraft stalled and the ensuing recovery included five 360° rolls and enough G forces to bend the wings. This pilot is lucky to be alive.
For more about this: Accident: Cessna CJ2+ N380CR.
I also hear about this happening with major airlines, but these events are rarely reported. This is a big problem and we should all be paranoid.
Photo: Setting a vertical speed with watch in hand, from Eddie's aircraft.
Click photo for a larger image
If I am in vertical speed mode during a climb, I take my watch off and hold it in my hand as a reminder something isn't right. (I do the same thing when crossfeeding fuel.) I focus on the speed and if someone wants my attention, I go back to FLC mode. I hate having the watch in my hand, it gets in my way and after a while the metal band starts to irritate the skin. Having the watch in my hand tells me something isn't right and I am anxious to fix what isn't right and get the watch back on my wrist where it belongs.
I've had two times in my forty years of flying where I had serious doubts about having enough fuel to get to where I was going. The first time was in the T-37B where we got held down low for 30 minutes. (I should have declared an emergency.) The second time was after a fuel leak flying between Hawaii and Alaska. (We didn't have many options.) Just thinking about both events makes me cringe. So now I am sufficiently paranoid about fuel loads.
Photo: Inspecting the damage after Flight 143's unorthodox landing, from Flight Safety Australia, pg. 22
The Captain of Air Canada Flight 143 back on July 23, 1983, is still looked upon as a hero in Canada. He is a sought after speaker and his name still invokes teary eyed gratitude amongst the many survivors. (Not one of the 8 crew or 61 passengers was injured. And the fact he was able to glide his Boeing 767 to a safe landing on an abandoned airstrip is quite remarkable. But the question is why was the airplane turned into a glider in the first place? The answer is he screwed up on the fuel load. Now I will grant you that he had a lot of help. Air Canada had recently converted from gallons to liters and from pounds to kilograms. A fuel gauge had been MEL'd and a troubleshooter left the remaining gauges blank as well. The fuelers made their own conversion errors. But the fact remains, the captain took off without enough fuel. In my opinion, he was insufficiently paranoid.
For more about this: Accident: Air Canada 143.
Always have in mind a "brute force" idea of how much fuel it takes to fly any given number of hours. When I flew Boeing 747s, the answer was 25,000 pounds per hour. In my Gulfstream G450, the answer is along the lines of 4,500 pounds the first hour, 4,000 pounds the second, 3,500 pounds the third, and 3,000 pounds thereafter. If we were to suddenly convert to different units, I would have to convert my rules of thumb accordingly. Once the fuel truck is done pumping, run your number in your head and don't let the truck depart until you are satisfied.
When I was a new hire in the GV I retained my practice of always showing the other pilot the gear pins after I had pulled them. We had three pilots in the flight department and I was junior in seniority. The other two pilots said it was unnecessary to show the gear pins as "we" would never forget them. They allowed me to continue my practice but refused to join in. After a year of this, they departed one day with the gear pins installed. To their credit, they ran the proper checklists, landed, pulled the pins, and continued. (You cannot pull the pins on a GV-series aircraft after attempting to raise the gear handle without running a checklist to reset the electronic gear selector valve.) Not every GV-series crew is sufficiently paranoid about this. . .
Photo: Photo: G450 N667HS, Salzburg (LOWS), 11 Apr 2017 (Photographer: Roland Winkler)
Click photo for a larger image
This crew appeared to have forgotten their pins and only found out after moving the gear handle to the up position. They moved the gear handle back down, landed, and pulled the pins. They noticed the gear doors were still down so they activated the hydraulic system used to retract the doors and up came the nose gear. Great confusion ensued.
What they had done would have worked in a GIV or GIII. With the gear handle in the down position, any hydraulic pressure is pointed to the extend position. That isn't true in the GV-series, where the gear handle is simply an electrical switch. Once they raised the gear the gear selector valve attempts to retract the gear until the gear is retracted. With the pins installed, the gear doors open and hydraulic pressure attempts to retract the gear. Putting the gear handle down doesn't stop that. The downlocks on the main gear are very strong and most of the aircraft's weight is on the the main gear. The downlock on the nose isn't quite so robust. This crew forgot to execute the checklist which would have returned everything to normal. Of course the entire problem could have been avoided had they simply remembered to pull the pins in the first place.
For more about this: Not Your Father's Gulfstream.
Of course pilots have been wrestling with this problem since the advent of retractable gear aircraft. As it turns out, our G450 was delivered with a pretty good solution:
Photo: Gulfstream gear pin holder on gust lock handle (from Eddie's aircraft)
Click photo for a larger image
The pin holder has a notch that fits into the gust lock that prevents the flap handle from moving. So this one metal block does several things if you put it on the gust lock when the gear is pinned, and leave it in the door with the gear pins when they are not. First, if it is on the gust lock that means the gear is pinned. But in this state, it also prevents you from moving the flaps with the gust lock on.
Photo: Gulfstream gear pin holder on fuel switches (from Eddie's aircraft)
Click photo for a larger image
We do have this gear pin block, the aircraft came with it. But our mechanic is afraid it will scratch up the paint on the gust lock or flap handles. So as a compromise, we simply rest it on the engine run switches. The key point here is that gear pin block has only two places. If the gear is unpinned, they are in the block and we store that in the forward door of the air stairs. If the gear is pinned, this block lives on the run switches.
But even if you don't have such a thing, there are other similar solutions. If you have a bag you use to store the pins, you can leave that bag over the throttles when the gear is pinned. It just takes a little practice and soon placing this memory device on the throttles will become second nature.
Harnessing Your Paranoia
We often associate people afflicted with paranoia as psychological basket cases, too afraid to leave the house for fear of what might happen to them should they be caught unawares without their tinfoil hats. But our kind of paranoia can be a life saver if properly deployed and acted upon. This isn't going to be easy, but it will be useful if backed up with a little knowledge and backbone.
Five Steps to Better Paranoia
- Know your airplane and procedures
- Do not accept the "We've always done it this way" defense
- Research solutions
- Consider the problem of "many" instances of a problem
- Devise error traps
The best defense to ignorance is knowledge. While you may not agree that many of the problems you are paranoid about reflect ignorance, if there is a solution to be had then you are at least ignorant of that solution. Midair collisions, for example, were considered freak occurrences and measures to avoid these were considered unnecessary. This seems bizarre given current knowledge, but that was indeed the reaction of some following the first commercial midair: Accident: Antoinnette IV & Farman III.
The way we've always done it could very well be the best way to do things in a previous time, previous airplane, or previous environment. Things change. But it could also be that something we had to accept in the past is no longer unsolvable. While there are many examples, one that may seem completely foreign given what we know today is how we originally treated cabin fires. The idea, many years ago, was to fight the fire and consider an emergency landing if that failed. Today, of course, we know our priority is to get the airplane on the ground as quickly as possible, fight the fire as available people and time permit. See: Cabin Fire.
Sometimes a problem seems to be built into the situation; no solution is possible because the problem is unsolvable. Or, as is often the case, an early solution is offered and we pat ourselves on the back and say we've done all we can. Take runway incursions, for example. It happens. We came up with uniform signage. Job done. Oh, wait, we still have runway incursions. Okay, red lights. No, that hasn't worked. Moving map displays with aircraft position. Still no good. My solution may not be perfect, but it is a step in the right direction. See: Pointing and Calling technique.
So how do you know you've got a problem that needs solving as opposed to a rare event that will only happen on the rarest of occasions. Well, do you have many instances of this problem? If you have one event, that is one event. Two events? That's a couple. Three? That makes several. Four or more? That's many. I have a couple of examples that follow.
If you find yourself with a problem that happens many times, it is time to come up with a solution. Consider asking fellow aviators flying the same equipment or opening it up to the community as a whole. Someone may have already solved your problem. Or you can adapt someone else's solution to fit your problem. But it might be up to you to invent the solution yourself. If you've done that, make sure you let everyone know!
Example: Failure to Select Long Range Navigation Following a "Direct To" Instruction
Imagine this: you just departed Boca Raton, Florida and were given a vector around traffic during your initial climb, say a heading of 060 degrees. Just as the traffic passes you and you are passing 10,000 feet, departure clears you direct to the PERMT waypoint and gives you a frequency change to Miami Center. The first officer selects PERMT on the display unit, you concur, and now the FMS is heading to PERMT. The first officer makes the radio call but one of the engines loses an EPR signal. As the first officer finishes with the radio he becomes alarmed at the engine instruments. "Relax," you say, "I've seen this before." With a quick glance at the checklist and a few button presses, you bask in the glory of a minor malfunction conquered. You tell the first officer about the first time you had seen this and then . . . center calls up and asks where you are going. A quick look at the instruments shows PERMT is now behind you and you are headed for Europe. Another glance tells you that you forgot to select LNAV and the autopilot is still flying a 060 degree heading. I don't have to imagine this because it happened to me about 10 years ago.
Photo: On a heading of 060 during a climb from Boca Raton, Florida en route to Bedford Massachusetts, from Eddie's aircraft.
Click photo for a larger image
A technique we had incorporated before the incident was to always point to the "to" waypoint of the PFD to verify the FMS was indeed headed to where we intended. This ensured we had selected the correct waypoint. But this technique was missing a step.
Photo: Pointing to the PDF to verify the correct "to" waypoint had been selected.
Click photo for a larger image
So we started a second step, pointing to the navigation mode of the autopilot, in this case the illuminated LNAV button.
Photo: Pointing to the LNAV button to verify the autopilot is doing what we think it is.
Click photo for a larger image
I get a lot of push back on this about how unnecessary it is. If the LNAV was engaged before, why bother? How much bother is it? If you are flying to MHT with LNAV engaged and get a clearance direct ALB, here are the steps you do now: (1) First officer selects ALB, (2) Captain verifies ALB is correct, (3) First officer executes or activates the instruction. Now I am proposing you add the following: (4) Point to the PFD to verify the correct waypoint while announcing "direct Albany", and (5) Point to the LNAV button and say "LNAV engaged."
For more about this: The Pointing and Calling Technique.
Since we've incorporated this technique, I would say at least 90 percent of the time, the LNAV was already engaged. Of the remaining 10 percent, in a vast majority the captain made the call as he was pressing the button, because that was the next step in the process. But every now and then, the crew looked up there and realized they were in heading mode and had forgotten that. This technique has saved us from the "where are you going" radio call a few times.
Example: Cleaning Solvent on Brakes
Years ago, when I was just hired flying an aircraft I had never before flown, I was alarmed to see how hot the wheel brakes got after landing. I've always used 200°F as a trigger for when I need to start worrying about brake temperatures. As part of my checkout process we had to taxi to the runway, takeoff, fly around the pattern, and land. Repeat twice. Before we even got to the runway the brakes were nearing 100°F. I made a comment but the PIC (and my new boss) said that was normal. The pattern was very quick, maybe four minutes. I landed in the touchdown zone and didn't touch the brakes until taxi speed but the temperatures were over 200°F. The boss kept saying it was normal. I insisted on keeping the gear down for the next two patterns. As we taxied in, the temperatures were around 300°F. (The fuse plugs on this airplane were set at 500°F, as I recall.) The mechanic said all this was normal.
A few days later I saw the mechanic applying a solvent to the brakes. (I think it was MEK, but this was many years ago and my memory fails me.) He said he always did that to keep them clean. I told him that, while he was the expert and I was brand new, in my experience the only thing used to clean brakes was compressed air or water. And if water is used, the brakes had better be cold and they need a long time to dry. He argued with me for a little while but then he made a few phone calls. Later in the day I saw him rinsing the brakes with water. His rationale was that the warning label on the solvent said it should be kept away from heat and perhaps that was reason enough to not use it on brakes. The next day we flew a trip and those brakes never did get above 100°F until the landing. Our peak temperature that day was barely over 100°F. I only flew that airplane for another year, but those brakes were very good and never got too hot.
Letters from Readers
I'm not the only paranoid out there. Here are a few letters.
An excellent article with great examples.
Upon reflection, here are a few additional items that make my personal paranoia list:
- Hail! I’m extremely paranoid about an aircraft that I’m responsible for being hailed on when a little more due diligence on my part could have prevented it.
- Tires! I once saw a passenger boarding a GIV point out a screw in the nose wheel tire to the crew. Needless to say everyone shortly deplaned.
- Pitot Static System! I’ve resorted to employing your pointing and calling technique for pitot tubes and static ports during Preflight.
- A passenger falling down the stairs. I try to position myself in such a way to catch them if they slip.
I'm glad to hear I'm not the only paranoid out there about these things. I think I will add your pointing and calling technique to my pitot/static covers.
A little paranoia is a good thing and I was most interested in reading about the areas you felt paranoid about it. The term paranoia, as applied in your article, equates to enhancing safety through the application of wisdom.
Except for the brakes (we barely see them above 100 degrees) I can most definitely relate to every other area you have identified. With regards to failure to select LNAV following a “direct to” clearance we have implemented the same procedure as yours. Should the PF fail to point to and call out the direct to waypoint and the LNAV button the PM is expected to announce “LNAV available.”
A little technique I have adopted after passengers have boarded and before I climb up the air stairs is to confirm one last time:
- Pitot and TAT probe covers are removed
- Gear pins are removed
- Nose wheel link is connected
- Chocks are removed
- Baggage door and door handle are both flushed with the fuselage
Once I’ve done the above I get onboard, close the main entrance door, and proceed to my seat. To me this little “checklist” is the last opportunity I have to ensure none of these items have been forgotten.
I have a similar technique where before closing the cabin door I kneel in front of the airplane to give it a once over. That started in 2002 when I was in Las Vegas on the way to the airplane when the passengers said they wanted to leave an hour early and to a different destination. I dropped the other pilot and the flight attendant at the airplane with instructions to get everything done as quickly as possible. I dropped the car off at the FBO, ran the new flight plan, and walked out to the airplane. As best I could tell, the exterior inspection was complete and the airplane ready to go. It was late at night and dark. I made sure the flight attendant was set and went forward just as the limo showed up. I greeted the passengers, let them know we needed another five minutes or so, and closed the door. And it was indeed about five minutes. We started up, taxied out, and after takeoff the gear handle would not come up. “I got the gear pins,” the left seater said over and over. We came back, landed, and parked at the FBO where a few of the line guys were waiting. The FBO manager greeted me and started right off with the apologies. We had a cone stuck right between the two nose wheels. He said that one of the line guys saw the airplane with the door closed and thought it was parked for the night. The pilot said he didn’t feel us run over the cone and neither did I. So I now I don’t close the door until we are ready to go and have done my front-of-nose last chance inspection.
NTSB Aviation Accident & Synopsis Narrative, N48DL, ERA12LA290