Comment by jacquesm

> There are many reasons I won't fly Ryanair

I swore off them a decade ago when I realised how adversarial their relationship with their passengers is.

Until an accident does happen, I have no doubt they'll trouser a lot of cash.

I once had a board member who was also on the board of Ryan Air, and he casually told me a story about when their CEO gave a presentation on adding a credit card -powered interlock on the cabin lavatories. He told them, “They’re my planes and if you have the nerve to shit in them you should have to pay for the cleanup”.

My colleague thought he was portraying the CEO as a cool guy and decisive manager, but I thought the guy sounds like a sociopath.

In safety-critical systems, we distinguish between accidents (actual loss, e.g. lives, equipment, etc.) and hazardous states. The equation is

hazardous state + environmental conditions = accident

Since we can only control the system, and not its environment, we focus on preventing hazardous states, rather than accidents. If we can keep the system out of all hazardous states, we also avoid accidents. (Trying to prevent accidents while not paying attention to hazardous states amounts to relying on the environment always being on our side, and is bound to fail eventually.)

One such hazardous state we have defined in aviation is "less than N minutes of fuel remaining when landing". If an aircraft lands with less than N minutes of fuel on board, it would only have taken bad environmental conditions to make it crash, rather than land. Thus we design commercial aviation so that planes always have N minutes of fuel remaining when landing. If they don't, that's a big deal: they've entered a hazardous state, and we never want to see that. (I don't remember if N is 30 or 45 or 60 but somewhere in that region.)

For another example, one of my children loves playing around cliffs and rocks. Initially he was very keen on promising me that he wouldn't fall down. I explained the difference between accidents and hazardous states to him in childrens' terms, and he realised slowly that he cannot control whether or not he has an accident, so it's a bad idea to promise me that he won't have an accident. What he can control is whether or not bad environmental conditions lead to an accident, and he does that by keeping out of hazardous states. In this case, the hazardous state would be standing less than a child-height within a ledge when there is nobody below ready to catch. He can promise me to avoid that, and that satisfies me a lot more than a promise to not fall.

As others have said, final fuel reserves are typically at least half an hour, and you shouldn't really be cutting into them. What if their first approach into MAN had led to another go around?

With a major storm heading north-easterly across the UK, the planning should have reasonably foreseen that an airport 56 miles east may also be unavailable, and should've further diverted prior to that point.

They likely used the majority of their final fuel reserve on the secondary diversion from EDI to MAN, presumably having planned to land at their alternate (EDI) around the time they reached the final fuel reserve.

Any CAA report into this, if there is one produced, is going to be interesting, because there's multiple people having made multiple decisions that led to this.

I'm not an aviation expert, but generally in safety engineering, safety buffers are not simply calculated as [normal situation] * [safety factor], but [worst case scenario] * [safety factor]

If you ever cut into your safety allowance, you've already fucked up. Your expected design criteria should account for all use cases, nominal or worst-case. The safety factor is there for safety, it is never intended to be used.

"I’m a little confused by what there is to investigate at all."

You're confused why they should investigate how everyone on that flight came within minutes of dying?

Something about the fuel reserves, procedures, or execution was clearly flawed.

Depends if our goal is to have zero aircraft crashes. If the goal is zero, then for any given parameter, you have to define a margin of safety well before crash territory and treat breaching that margin as seriously as if there had been a crash.

Similarly planes are kept 5 nautical miles apart horizontally, and if they get closer than that, you guessed it - investigation. Ofc planes could come within inches and everyone could live, but if we normalize flying within inches, the we are also normalizing zero safety margin, turning small minor inevitable human failings into catastrophe death & destruction. As an example, planes communicate with ATC over the radio and are given explicit instructions - turn left 20 degrees, fly heading 140 etc. From time to time these instructions are misunderstood and have to be corrected. At 5nm separation everyone involved has plenty of time to notice that something was missed/garbled/misinterpreted etc and correct. At 1 inch separation, there's no such time. Any mistake is fatal, even though in theory you are safe when separated by 1 inch.

TBC an investigation doesn't mean investigating the pilots in order to assign blame, it means investigating the entire aviation system that led up to the breach. The pilot's actions / inaction will certainly be part of that, but the goal is to ask, "How could this have been avoided, and ask how every part of the system that we have some control or influence over might have contributed to the outcome"

Well imagine they had to do a go-around on that landing. Go-arounds are extremely normal and might be done for a million reasons; your speed is wrong, your descent rate is wrong, your positioning is wrong, there's bad wind, there's an issue on the ground, etc etc etc. Six minutes of fuel is really not enough to be sure that you can do a go-around. So now, if ANY of those very normal everyday issues occurs, the pilot has to choose between two very bad options: doing a go-around with almost no fuel, or attempting a landing despite the issue. That's just way too close for comfort.

Aviation operates on a Swiss cheese model; the idea is that you want many many layers of safety (slices of cheese). Inevitably, every layer will have some holes, but with enough layers, you should still be safe; there won't be a hole that goes all the way through. In this case, they basically got down to their very last slice of cheese; it was just luck that the last layer held.

>I’m a little confused by what there is to investigate at all.

One of the most important aspects of taking safety seriously is that you do not just investigate things which had an impact, but that you proactively investigate near misses (as was the case here) and even potential incidents.

A plane with 6 minutes of fuel left is always a risk to every person on board and potentially others if an emergency landing becomes the only option.

If you cut into the final reserve, it’s a full-blown emergency requiring a mayday call.

This should not happen. So what’s there to investigate? How it was allowed to happen, and how to prevent it from happening again.

EDIT: it’s a mayday even earlier than that. It’s a mayday once the pilots know that they WILL land with less than the final reserve.

If they have to touch and go, how long would it take until they get the plane around for another approach? In fact, you might not get as far as that touch and go and have to go around. You need some margin for all of these eventualities. The likelihood is low that these happen, but they have to be accounted for.

This reminds of discussions following the Fukushima disaster where one commenter claimed that it wasn't a design flaw, because it was an extraordinary circumstance. I found this appalling, because I do not at all think that was the risk profile that was sold to the public; I think people believed that it was supposed to be designed to safely survive 1000-year earthquakes and the tsunamis that they create.

Likewise, I think that the flying public is lead to believe fuel exhaustion is so rare that when airlines are compliant with regulations, no such disasters across all flights across all carriers will occur during your lifetime.

6 min, is empty, 6 min is purely theoretical, 6 min would not clear for ground handling or a test start, or a fuel system check,6 min would not do a go around. will interesting to see if they release info about what the real amount of fuel left is, and an authorative discussion on how much useable flight time was there. did they actualy make the taxi to the terminal?, or run out on the apron?

Naively as an outsider, this situation seems like everything worked as intended?

I don't remember all of the rules off the top of my head, but if you are ever landing with less than 30 minutes of fuel, something has gone seriously wrong. You are required to take off with sufficient fuel to fly to your destination, hold for a period of time, attempt a landing, fly to your alternate, and land all with 30 minutes remaining. If you are ever in a situation where you may not meet these conditions, you are required to divert immediately. In choosing your alternate, you consider weather conditions along with many other factors. This was, without question, a serious emergency.

From the very brief description in the article, I would say they should have diverted to Manchester at least 25 minutes sooner than they did. I will include the GP's caution, however:

I'd be very wary to get ahead of the investigation and make speculative statements on how this could have happened, the one thing that I know for sure is that it shouldn't have happened, no matter what.

My understanding is that they shouldn't have spent that much time in the air (not intended as a guess for the cause). The margin is there for situations where you can't land earlier, not the margin for scheduling the landing. There is margin for expected potential delays, they were in the other margin that should never be used except in true emergencies.

Thirty minutes.

If at any point you expect to touch down at the nearest safe airport with less than 30 minutes of fuel remaining, you are required by regulation to make a mayday call.

Mayday is a term enshrined in law. It is only to be used when people will die if you do not receive help. In the US, calling it inappropriately can be punished with up to 10 years in jail and a $250k fine. It's protected in this way because as soon as you call mayday, in many situations there are actions that must be taken by law or regulation. Other appropriate uses include things like "our plane is on fire" or "our wing just fell off and we can't steer the plane".

As soon as you think you can't land with the fuel reserves you are _required_ to call mayday, other pilots are _required_ to clear the radio for you, and ATC is _required_ to provide any and all supported possible until you're on the ground.

The investigation is not to figure out who to send to jail or something. The investigation is because a flight just came this >< close to having hundreds of people die. That fuel is there as a safety margin, yes. That's how everyone ended up walking off this plane instead of dying as the plane was ripped apart by some trees somewhere. That is good.

But air travel did not become as safe as it with an attitude of "this hasn't killed anyone yet, all good". The fact there was an incursion into the safety margin should not be looked at as "eh, working as intended" but "holy hell we just came this close to disaster, what went wrong that almost killed all these people? how do we stop that happening again?". That is what an investigation will be looking to figure out.

To put it in vaguely IT terms, this is something like... your application has started corrupting its database, but you have _a_ backup copy. On one hand, you can think "eh, we have a backup, that's what it's there for, who cares". On the other you can go "holy shit, any time we need to restore from the backup we narrowly averted disaster... how do we make sure we're not in that situation again?". The former is probably going to lead to irrecoverable data loss eventually. The second will have you addressing problems _before_ they ruin you.

>One pilot who reviewed the log said: “Just imagine that whenever you land with less than 2T (2,000kg) of fuel left you start paying close attention to the situation. Less than 1.5T you are sweating. But this is as close to a fatal accident as possible.”

Only issue I see is that should there have been stricter rules to diverting way earlier. If winds were such as to make landing harder. Would just directly going somewhere else been the correct choice to force.

If you get shot, but had a bullet proof vest on, and hence didn’t die, technically everything worked as intended.

Personally, I’d still want to figure out why I got shot and work on making sure that didn’t happen again.

Especially if you basically got shot multiple times (for an analogy in this case).

> I’m a little confused by what there is to investigate at all.

So because the safety margin still worked while down to near vapors we should conclude there's nothing to learn for the future to reduce the risk of similar incidents?

That's certainly... a take.

Flight from Edinburgh to Manchester is just a bit more than 1 hour, so after trying 2 landings, diverting to Edinburgh (15-20 minutes flight), 1 more landing attempt, well, you get very close to 2 hours.

Similarly naive outsider, but I've read things here and there. My understanding is that they should have declared mayday (emergency) and landed (potentially at another airport, potentially in the middle of nowhere) _way_ before so that when they have landed they still had 30 minutes or more of fuel in the tanks.

Whether it can be prevented in the future. Should planes fly with even more reserve fuel? It's possible. Or maybe different ways of selecting alternate landing sites?

It may even be the answer is "no, everything went as well as it possibly could have, and adding more reserve fuel to every flight would be unacceptably wasteful, so oh well", but at a minimum they'll probably recommend even more fuel on certain flights into risky weather.

Imagine you're standing on a balcony and discover that the supports are cracked almost all the way through.

Do you shrug and say, that's why they have a safety factor, everything worked as intended? Or do you say, holy crap, I nearly died, how did this happen?

The purpose of the safety factor is to save you if things go badly wrong. The fact that it did its job doesn't mean things didn't go badly wrong. If you don't address what happened then you no longer have a safety factor.

I think a more insightful answer is how often is it acceptable for the reserves to actually be cut into. If this was happening often, then there’s a likelihood of a future disaster. As it is there is 1 isolated case that still ended with a positive outcome. I think it almost adds support for the current reserve levels to be pretty dialed-in.

Might not be about fuel but about why they even tried instead of diverting earlier.

Might even be 100% done by the book but book needs changing (tho I doubt that, it's not exactly first case of "a lot of bad weather")

> How much fuel should they have landed with?

I think about 30 minutes worth of fuel.

Not knowing their flight plan, it could have been that Edinburgh was the first alternate and Manchester the second alternate.

I dont know but maybe they should have diverted sooner. Maybe an hour into the flight?

30min+

ideally, enough to divert to another airport, in the off chance something happens, like a pending emergency at point post.

At what point should they investigate?

0 minutes?

-1 minutes?

One of those YouTube channels where a professional pilot evaluates flying incidents had a similar incident when the pilot started yelling at the tower when they tried to make him go around again. He essentially said he would declare an emergency if he didn’t hear different instructions. I think he had 10-15 minutes when he touched down.

One of the things the reserve is for is if the plane immediately in front of you fucks up the runway, you now have to divert to the next airport. You need at least enough fuel to get there and for the tower to shove everyone else out of the way so you can make an emergency landing.

There are other reasons someone could abort a landing and have to go around again, besides debris in the runway. And sometimes two of them can happen consecutively.

In the case I’m referencing, it was pointed out that p the pilot made things worse by going faster than he was told to fly, using up fuel and also making him too close to a previous plane which forced him to go around the previous time, so it wasn’t all the tower.

Really? Equally as an outsider - it feels like one "go-around" and you're fucked.

[dead]