It was great to visit with Jeff Skiles and Sully Sullenberger at Oshkosh last week. The two heroes of the Hudson are doing a terrific job of keeping thousands of pilots excited about the EAA’s Young Eagles Program, and we all appreciate their hard work.
Later I started thinking about the way the FAA certification rules worked – or didn’t work – in the case of the Airbus losing both engines after ingesting large birds. Should the certification standards for an airline jet have anticipated such an event and required that there be a way to allow the jet to continue flying safely to a runway?
For transport airplanes, and the rules they operate under, the fundamental safety standard is one in a billion, or 10-9. In other words, the rules are designed so that no foreseeable combination of failures will prevent a transport category jet from reaching a runway more frequently than one in a billion flights. And the rules are designed around a flight, not hours, because no matter how long or short a trip all of the major risk factors are present on every flight.
Why the one in a billion standard? Because zero is an unobtainable, and thus useless, objective for risk assessment. No human activity can be perfect so the rule writers settled on the one in a billion standard many years ago.
The way that extremely high standard is met is by building in redundancy for all critical elements. Obviously, a transport airplane must be able to continue with the most critical engine failed at the worst possible moment. There are multiple electrical, hydraulic, bleed air, and other systems backing each other up. All critical elements of the airframe structure are also redundant. For example, a wing spar is made from at least two, and usually three, pieces and each can carry the necessary load if one fails between inspections. Fuselage skin, on the other hand, is not absolutely critical and as a few incidents recently have proven, a jet can make it down with a chunk of skin blown out.
And in the cabin there are a minimum of two pilots – with more onboard for longer duration flights – and each pilot is fully qualified to operate the airplane if the other is incapacitated, and more importantly, is there to review and confirm the appropriateness of the actions of the pilot flying.
When it comes to bird ingestion the rules require the engine to continue to produce power after swallowing smaller birds. The number of birds ingested in the testing depends on the frontal area of the engine inlet. For big birds such as the geese that Sully and Jeff flew into, the certification rules focus on keeping the engine from exploding. There is so much energy in the rotating components of a jet engine that when a large object such as a big bird breaks some parts the other parts could go flying in all directions, threatening the structure of the airframe. So the engine test for big bird ingestion is to demonstrate that the crew can control the engine and shut it down, and that any parts that go flying out exit the tailpipe, not the sides of the engine.
It’s tempting to say that the FAA and other international aviation regulators missed the obvious risk that big birds could get all engines as they did in the Airbus. That is a risk, but is the likelihood greater than one in a billion flights?
I don’t know if there is a statistic on how many flights jet airliners have made over the decades, but it is certainly more than a billion, and Sully and Jeff are the first I know of to lose all engines to bird ingestion. At least one business jet was left powerless after hitting a flock of birds on takeoff but I don’t know of any other airline jet turned into a glider by birds.
So is one in a billion a high enough standard? It’s hard for me to believe that an even lower risk target is possible. Sully and Jeff were just so unbelievably unlucky, but then handled the more than a one in a billion situation with such perfection that it only increases my admiration for what they accomplished.