Like most people my age, I can recall exactly where I was on January 28, 1986 when I heard the news that the space shuttle Challenger had exploded and broke apart just 73 seconds after liftoff, killing all seven crewmembers. I was driving onto an Air Force base getting ready for instrument instructor pilot training. The guard at the gate asked if I had heard. I didn’t even realize there was a launch that day. The shuttle launches had become, in a word, routine.
Photo: Black smoke from an O-Ring seal in the right Solid Rocket Booster of the space shuttle Challenger, 28 January 1986 (NASA photo)
Click photo for a larger image
Most space aficionados of the time could give you exact details of the O-Rings used to seal the three sections of the Solid Rocket Boosters (SRBs) and the temperature tolerance of the rings (no colder than 53°F) and the temperature at the moment of launch (36°F). They could tell you that the manufacturer (Morton Thiokol) designed the SRBs without meeting the temperature range of the space shuttle itself (31°F to 99°F). All that is true and is interesting in and of itself. But I remember there was much more to it than that. The National Aeronautics and Space Administration (NASA) had been steadily reducing the minimum temperature for launch since the first orbital mission in 1981. I also recall that NASA had established as a goal for 1986 that the shuttle was to become “operational.” Gone were the days of test flights, the space shuttle was to become a viable commercial enterprise. Space travel, they said, had become routine.
After the Challenger explosion, the initial focus was on the O-Rings used to seal three sections of each SRB. Theoretical physicist Richard Feynman demonstrated the fragility of the O-Rings at cold temperatures during a televised hearing by simply dropping a sample of the material into a glass of ice water. The O-ring lost all its resiliency. But even more alarming, Feynman discovered that NASA management did not understand the probability of component failures. NASA placed the risk of a catastrophic malfunction of the shuttle to be 1 in 100,000. “How could they possibly know that?” he asked. He polled NASA engineers and found their estimates to fall between 1 in 50 and 1 in 200.
I didn’t fully understand the real cause of the Challenger disaster until ten years later, when I read “The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA” by Professor Dianne Vaughn. Managers at NASA had learned to accept deviations from their own Standard Operating Procedures from the very start of the program and increased those deviations with just about every launch until that fateful day in 1986. If 53°F was the stated limit, going a few degrees lower should be okay. Until it wasn’t. The O-Rings were installed in pairs and both required by SOP for redundancy. No O-Ring damage was allowed. Until it was. Slowly but surely, NASA moved the goal posts to the very SOPs they had designed.
Professor Vaughn coined the term “The Normalization of Deviance” to describe what happened at NASA. That makes her book an excellent case study for all pilots, even those of us who confine our aviation to the atmosphere.
Since that day in 1986 I have added many more type ratings and with each new aircraft I noticed my tendency to normalize my own deviance after I had become, well, bored with the novelty of the new jet. It is a tendency I have only recently learned to anticipate and sidestep. All of this self-discovery happened in the five years I flew my own Challenger, the Bombardier Challenger 604. That five-year span seemed to be a moment of discovery for many Challenger pilots.
Step One: Accepting Unanswered Questions
More about this Challenger accident: Case Study: CL-604 C-FTBZ.
In the year 2000, the Challenger 604 had one of the sexiest cockpits I had ever seen. There was glass and lots of it. The switches and buttons all turned black when everything was good; I had never seen a cockpit that more fully embraced the idea of a “dark cockpit.” I felt fortunate that my first civilian job was flying this airplane and I showed up at FlightSafety International Tucson energized and motivated to learn. That was on day one.
As ground school progressed, I realized the classroom was paced for the proverbial “lowest common denominator” and the course objective was aimed more towards passing a type rating evaluation than it was learning to master the airplane. While the most challenging part about flying this Challenger was the avionics, all that was left for when we got to our flight departments. I finished school with my new CL-604 type rating with a list of unanswered questions and theories that ran contrary to what I had learned in school. All of this, I knew, was par for the course. As I finally became operational in the jet, I expected to have all of these questions answered and to be proven wrong about many of my preconceived notions. That is what happened, except for four of my complaints.
Photo: How we are taught to think about aircraft systems in modern aircraft
Click photo for a larger image
Complaint Number One. I left initial training with a long list of complaints, the first of which was the superficial coverage of the aircraft systems. We were taught the bare minimum to understand and with some success to troubleshoot the aircraft. You might as well explain that “magic happens” when the subject gets too deep to teach. For example, the CL-604 has more fuel tanks – eight of them – than any two-engine aircraft I’ve ever flown. Fuel loading and consumption patterns were not a part of the curriculum. Relax, I was told, that’s something you will learn once operational.
But out in the field the questions only got worse. I was fortunate to start my 604 career in a large flight department with pilots and mechanics who had several years of experience with the jet. But even these experts were often stumped. Why can’t the airplane continue fueling under some conditions when the fuel truck pauses? Don’t know. Why is fuel ejected from the wing tips when it is nowhere close to full? Don’t know. I started combing through the maintenance manual but came up empty. The manufacturer wouldn’t talk to me. After a while I stopped asking and like the rest of our pilots, accepted the quirky fuel system as just “one of those things” we pilots had to accept in the “magic” category.
Then on October 10, 2000, the Challenger 604 world was given the biggest fuel system mystery of them all. How can fuel that is properly loaded prior to takeoff suddenly shift aft so quickly that pitch control is lost? Don’t know.
Two Bombardier production test pilots, flying Challenger 604 C-FTBZ, discovered the problem while demonstrating aft center of gravity takeoffs from Wichita-Mid-Continent Airport (KICT), Wichita, Kansas. The pilot lost control of the airplane during takeoff, stalling the aircraft, rolling it on a wing, killing all three on board. The Transport Canada accident report blamed fuel migration from the forward auxiliary tank, to the center auxiliary tank, to the aft auxiliary tank, exceeding the test pilot’s ability to maintain pitch control. The 604 had been operational for five years at this point and this had never happened before. Bombardier immediately placed narrower center of gravity limitations on the airplane while those of us operational 604 pilots were left wondering about those fuel tanks. Reading the report, we for the first time learned those fuel tanks were unbaffled and the pipes between each allowed rapid fuel migration. None of us “operational” pilots had ever heard about the problem, but none of us had ever felt such a shift in CG either. A part of the puzzle was missing. We had no choice but to accept the curtailed CG and move on. I moved on.
Step Two: Accepting Non-Standard Procedures
Complaint Number Two. Before we get to complaint number two let me say that during my first year of operational experience, going operational did answer most of my complaints but also added a few. My second complaint centered around non-standardized stick and rudder procedures. Crosswind landing procedures, for example, were left to pilot technique. Having grown up in large Boeing 707s and 747s, rotation rates were critical to avoid tail scrapes and wing stalls. Of the eight pilots in my new flight department, the three Air Force veterans all used the same 3-degree per second rate. Two of the other pilots favored a slower rate to keep the nose lower to scan for traffic. The three remaining pilots insisted a much faster rate was needed to get away from the ground, where the danger was. Nobody seemed to care that the operating manual specified the 3-degree rate. This too I learned to accept as “one of those things.”
One year later a Boeing BBJ sliced into one of our parked 604’s horizontal stabilizer, damaging it beyond repair. Bombardier replaced the stab for us and agreed to have one of their test pilots fly the airplane provided I sat in the right seat. On initial takeoff the pilot snatched back so hard on the yoke I felt the wing shudder. I took the airplane with the “I’ve got it” honed from years as an Air Force instructor pilot and the test pilot immediately let go of the yoke, as if he had a lot of practice doing that. Our director of maintenance was in the jump seat and said, “don’t let him touch the controls again.” After the flight, I asked the pilot why he was so aggressive with the pitch, especially given our newly installed stabilizer. His answer, “that’s the way I fly,” was hardly sufficient.
I thought that would rekindle our flight department debate, but the rapid rotation pilots assured the rest of us that they were doing it safely, had been doing it safely for years, but thanked us for our concern. They were our most experienced pilots, each having flown the airplane since its first year of operational service, nearly five years earlier. I had yet to attend my first recurrent. Once again, I decided to move on.
Step Three: Ignoring Common Sense
More about this Challenger accident: Case Study: CL-604 N90AG.
Complaint Number Three. Perhaps the word “complaint” was too strong. I was uncertain about deice/anti-ice procedures for the Challenger 604 because I had never been taught and I never had the experience. We were based at Houston Intercontinental Airport (KIAH), Texas and were strangers to the mysteries of de-ice/anti-ice except when on the road. By the time I attended my first recurrent I had yet to need a de-ice truck in my operational 604 experience. During my first recurrent at the simulator, the syllabus item was considered complete if I managed to notice the synthetic snow blowing across the synthetic ramp and called for some synthetic deice. After the sim period, I asked, “how does she fly with ice on the wing?” The question was considered a strange one. “Why would you do that?”
I heard from another instructor that a brand-new Challenger 604 flunked its initial airworthiness test flight because it rolled rapidly to one side during full flap stall checks. The only thing wrong with the airplane was a 6-inch strip of paint left on the leading edge of a flap. They removed the paint and the roll tendency went away. I decided that any contamination on the Challenger 604’s wing should not be taken lightly.
I finally got my chance in Anchorage, Alaska, where, with a full coat of Type IV anti-ice fluid, the airplane seemed to fly without complaint even in lightly falling snow. A month later I was in Seattle where an overnight freeze left my wings with a sandpaper-like coating of frost. The other pilot got his vote in early. “It’s nothing a little sunrise can’t take care of.” I was the Pilot in Command, but he was senior to me. I asked for a truck with Type I. As we taxied from the ramp I noted, with no small degree of self-satisfaction, that the other aircraft were still frost covered. When we got home the chief pilot asked me about the bill, which was around $400. I explained the frost situation. “Okay,” he said. “But keep in mind we don’t waste the client’s money just to make ourselves feel good.”
I was thinking about this one month later, the day of the President’s inauguration on January 20, 2001. We had flown into Washington Dulles International Airport (KIAD), Virginia the night before. It had been snowing heavily but all that had turned to rain the next day. When it was time to leave, our wings appeared clean from a distance but there was clearly a coating of frost on the leading edges. We had two 604s parked side-by-side and the other three pilots agreed the frost wasn’t going to be a problem. I was in the process of talking myself into doing something I knew was wrong when the other aircraft’s passengers showed up. We watched as they attempted and failed to start their engines. A pool of frozen water in both engines kept both spools of their engines from rotating. I crawled onto our frost-covered wing and discovered the same problem in our airplane. We towed both aircraft into a warm hangar to thaw out our engines; my frost on the wings argument was postponed.
I managed to avoid frost until the next winter, when another Challenger ended the debate once and for all. On January 4, 2002, Challenger 604 N90AG took off from Birmingham International Airport (EGBB), United Kingdom. Both pilots commented about the frost on their leading edges, even as other aircraft were deicing for amounts of frost reported to be between 1 and 2 millimeters. Immediately after takeoff the 604 rolled sharply to the left, despite the crew’s application of full opposite aileron and rudder. Six seconds after liftoff the bank angle reached 111° as the aircraft impacted 13° nose down; both pilots and all three passengers were killed.
The accident surprised everyone in our flight department. Half of us wondered why two pilots would blatantly ignore the flight manual limitation requiring a wing clear of any contamination, including frost. The other half wondered how these pilots lost control of the aircraft when they had seen the airplane fly just fine with a little frost. The answers to both questions were surprising. Both pilots were suffering from the combined effects of jet lag and a non-prescription drug. While one of the pilots appeared to be concerned about the frost, he didn’t take any steps other than commenting. But why did they lose control immediately after takeoff? The accident report speculates that the hot APU exhaust melted the frost on the right wing only. The aircraft it seemed, had enough lift to fly but not enough roll authority with frost on one wing only. Our chief pilot issued his first ever “all hands” email. We were instructed that under no conditions would we be allowed to takeoff with anything less than a clean wing.
With three years of operational experience, nearly all of my complaints had been answered. I had learned to accept that I would never understand the fuel system and that stick and rudder procedures were more about technique than procedures in this airplane. It was an unhappy result, but I had learned to accept both unhappy answers.
The next year, the National Transportation Safety Board (NTSB) reopened the investigation into the Wichita fuel migration crash. In 2004, the NTSB concluded this second accident investigation and determined that although fuel migration was a problem, the crash was caused by the pilot’s aggressive rotation of 9.6-degree per second. Had the pilot observed the operating manual’s 3-degree per second procedure, the crash would not have occurred. This served only to solidify positions in our flight department and, in the end, no positions had changed.
Step Four: Learning the Hard Way
More about this Challenger Accident: Case Study: CL-600 N370V.
Complaint Number Four. The last remaining complaint was really the first I had noticed during training: none of our pilots had a firm grasp about the airplane’s weight and balance. During initial training the instructor handed us a workbook with step-by-step instructions that we used during an open book exam. I used the workbook to complete the exam and forgot about center of gravity problems until given the task of cleaning out our cockpits of anything extraneous. I found something buried underneath the many manuals, charts, and checklist in the cabinet meant for such things. The mystery item a was piece of metal with three holes cut out meant for a weight and balance chart.
A few of the older pilots recognized the piece of tin immediately and we found the paper chart meant to go with the template. One of the pilots taught me to use it and I realized it did what it claimed. The template allowed us to trace the impact of loading passengers, bags, and fuel onto the chart without any math at all. “Why don’t we use this?” I asked. “It isn’t necessary,” the veterans said. We never had a Center of Gravity (CG) problem, so using it was a waste of time. Everyone agreed we needed to keep the template in the cockpit, in case anyone asked, but we shouldn’t use it because the paper charts cost money. I stuffed one template and one paper chart into envelopes and ensured each aircraft had a set. That task done, I returned to the business at hand: flying the Challenger 604 all over the world.
As my fifth and last year of flying the 604 opened, I was starting to feel bored with the jet, despite still having a few unanswered questions about aircraft systems and procedures. I was no longer troubled with my less than perfect state of knowledge. In fact, most of my effort was steered toward finding another jet to become excited about. But before I could do that, I was reminded about one of my complaints that I had dismissed and forgotten.
Photo: N370V Crash Site, NTSB AAR 06-06, fig. 1
Click photo for a larger image
On February 2, 2005, the crew of an older version of the Challenger 604, N370V, failed to rotate from Runway 6 at Teterboro Airport (KTEB), New Jersey. The aircraft ran off the departure end of the runway at a ground speed of about 110 knots; through an airport perimeter fence; across a six-lane highway (where it struck a vehicle); and into a parking lot before impacting a building. The two pilots were seriously injured, as were two occupants in the vehicle. The cabin aide, eight passengers, and one person in the building received minor injuries. The airplane was destroyed by impact forces and postimpact fire.
Of course, we Challenger pilots were concerned and speculated about something falling between the pilots’ seats and the yoke, or perhaps a control jam. Early accident reports focused on the nature of the operator’s charter business and the aircraft’s CG. It took more than a year for the official accident investigation to conclude, and in that time, I left the Challenger world for a return to Gulfstreams. While the fate of the Teterboro Challenger was old news to me, the findings served as a wakeup call about my path to operational complacency.
Photo:N370V Weight and Balance, NTSB AAR 06-06, p. 110
Click photo for a larger image
The pilots of N370V did not compute their takeoff weight and balance for their flight from Teterboro to Chicago-Midway Airport (KMDW), Illinois. The planned fuel and passenger loading would have been within limits, but the pilots asked for a fuel “top off,” as is a common practice in the airplane when stopping distance isn’t a concern. What these Challenger pilots didn’t understand was that the Byzantine layout of their fuel tanks meant their CG tended to migrate forward once a certain amount of fuel was uploaded. Going from their planned fuel load of 13,900 pounds to 14,600 pounds not only put the aircraft above its maximum allowable takeoff weight but also moved the aircraft’s CG well beyond its forward limit.
Reading the report, I realized that I could have been guilty of the same offense many times during my Challenger 604 career. Asking for a full load of fuel wasn’t uncommon in the limited range jet. As many fighter pilots have said over the years, “You can never have too much gas, unless you are on fire.” When I started flying the airplane, one look at the fuel tank layout and the weight and balance chart told me I needed to get smarter on the subject. The fun and excitement of actually flying the airplane – being operational – allowed me to forget my list of complaints and get on with the business of flying. I had become complacent and my complacency grew with each year of operational flying. It was a pattern I was guilty of many times over the years.
Step Five: The "Sidestep" — Anticipate it Before it Happens
Looking for a few good case studies to kindle your interests? How about a few hundred: Accident Case Studies (sorted alphabetically).
As with many who have come face-to-face with repeated failure, I vowed to do better. I thought that the causes of my operational complacency were inevitable, they were headed my way no matter what I did. What I needed was a way to get out of the way, to sidestep the causes before they had a chance to damage my psyche. My method has taken shape over the fifteen years that have elapsed and seem to work for me. You might give it a try as a starting point.
- Approach initial training with an open, but skeptical mind. Make note of things you learn as an instructor’s opinion until you can get verification from a manual or actual experience. Keep notes and keep a record of unanswered questions.
- Treat operational experience as another learning opportunity. Your fellow pilots, mechanics, and other technicians are instructors of a sort. Make notes of what you learn “out there” while also keeping track of who said what. You will soon learn who is espousing reliable knowledge and who is just making it up.
- Develop a network of like-minded peers who value understanding aircraft systems and procedures as much as you do. Trade questions and answers. Collect source material.
- Study accident case studies with a few questions in mind: How would this problem manifested itself in my aircraft? What would I have done in that situation? What resources do I have in the cockpit to deal with these issues? Go beyond a cursory mind game; dig into your manuals and follow the checklists to become familiar with them and to spot problems where you might need a little more knowledge.
In the years since my Challenger weight and balance epiphany I’ve upgraded airplanes four times. I’ve managed to avoid the boredom that has plagued me in the past, though I’ve probably bored some of my peers with my incessant questioning about aircraft systems and procedures. I am no longer flying a Challenger but with every new airplane I’ve learned to accept each challenge and remain motivated to learn. Even operationally, the learning never stops.
NTSB Aircraft Accident Report, AAR-06/04, Runway Overrun and Collision, Platinum Jet Management, LLC, Bombardier Challenger CL-600-1A11, N370V, Teterboro, New Jersey, February 2, 2005
Vaughn, Dianne, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA, The University of Chicago Press, Chicago and London, 1996.