The One in a Billion Rule

US Airways Flight 1549 was successfully ditched in the Hudson River on January 15, 2009, after the plane experienced a complete engine failure from sticking a flock of geese. Photo courtesy of www.memorieshop.com

It was great to visit with Jeff Skiles and Sully Sullenberger at Oshkosh last week. The two heroes of the Hudson are doing a terrific job of keeping thousands of pilots excited about the EAA’s Young Eagles Program, and we all appreciate their hard work.

Later I started thinking about the way the FAA certification rules worked – or didn’t work – in the case of the Airbus losing both engines after ingesting large birds. Should the certification standards for an airline jet have anticipated such an event and required that there be a way to allow the jet to continue flying safely to a runway? 

For transport airplanes, and the rules they operate under, the fundamental safety standard is one in a billion, or 10-9. In other words, the rules are designed so that no foreseeable combination of failures will prevent a transport category jet from reaching a runway more frequently than one in a billion flights. And the rules are designed around a flight, not hours, because no matter how long or short a trip all of the major risk factors are present on every flight.

Why the one in a billion standard? Because zero is an unobtainable, and thus useless, objective for risk assessment. No human activity can be perfect so the rule writers settled on the one in a billion standard many years ago.

Chesley B. “Sully” Sullenberger (left) and Jeff Skiles (right). Photo by Jim Koepnick.

The way that extremely high standard is met is by building in redundancy for all critical elements. Obviously, a transport airplane must be able to continue with the most critical engine failed at the worst possible moment. There are multiple electrical, hydraulic, bleed air, and other systems backing each other up. All critical elements of the airframe structure are also redundant. For example, a wing spar is made from at least two, and usually three, pieces and each can carry the necessary load if one fails between inspections. Fuselage skin, on the other hand, is not absolutely critical and as a few incidents recently have proven, a jet can make it down with a chunk of skin blown out.

And in the cabin there are a minimum of two pilots – with more onboard for longer duration flights – and each pilot is fully qualified to operate the airplane if the other is incapacitated, and more importantly, is there to review and confirm the appropriateness of the actions of the pilot flying.

When it comes to bird ingestion the rules require the engine to continue to produce power after swallowing smaller birds. The number of birds ingested in the testing depends on the frontal area of the engine inlet. For big birds such as the geese that Sully and Jeff flew into, the certification rules focus on keeping the engine from exploding. There is so much energy in the rotating components of a jet engine that when a large object such as a big bird breaks some parts the other parts could go flying in all directions, threatening the structure of the airframe. So the engine test for big bird ingestion is to demonstrate that the crew can control the engine and shut it down, and that any parts that go flying out exit the tailpipe, not the sides of the engine.

It’s tempting to say that the FAA and other international aviation regulators missed the obvious risk that big birds could get all engines as they did in the Airbus. That is a risk, but is the likelihood greater than one in a billion flights?

I don’t know if there is a statistic on how many flights jet airliners have made over the decades, but it is certainly more than a billion, and Sully and Jeff are the first I know of to lose all engines to bird ingestion. At least one business jet was left powerless after hitting a flock of birds on takeoff but I don’t know of any other airline jet turned into a glider by birds.

So is one in a billion a high enough standard? It’s hard for me to believe that an even lower risk target is possible. Sully and Jeff were just so unbelievably unlucky, but then handled the more than a one in a billion situation with such perfection that it only increases my admiration for what they accomplished.

This entry was posted in Aircraft, Industry & Government, Mac Clellan's Left Seat Blog, Safety, Technology. Bookmark the permalink.

12 Responses to The One in a Billion Rule

  1. Duane Beland says:

    I remember an EC 135 that crashed at Elmandorf AFB, Alaska in 1992 (I think) after ingesting geese in all four engines. That cost the lives of all 21 crew on board. After that the USAF made it a high priority to keep birds off the runways.

    The sad part was that everyone knew that the geese were on the water next to the runways.

    21 lives lost.

  2. This is why practice is so important and particularly with single engine aircraft. Yes, we have slower landing speeds and can get in and out of places you could hardly park an airliner. I’ve had two engine failures over the years and both times my training kicked in with a safe outcome. The key is not only to know what to do, but not panic. With “single engine, single pilot” we do not have the luxury of that one in a billion chance. You know what best glide is and what it looks like so you don’t have to keep looking at the instruments, you know what the plane feels like throughout the envelope, and you fly it till it’s stopped. Fortunately in most single engine planes this is relatively easy to do, is not outlandishly expensive, and does not take a great deal of time. Just work at being precise when doing maneuvers and throw in a few engine out simulations every few flights. Learn you “turn back” altitude and short field landings. Oh! I once hit a deer while landing at night too. No there were not any deer on the runway but just as the mains were getting ready to touch a very large doe decided she needed to be on the other side of the runway. That left me riding on the left main with the runway lights visible above the left tip tank and I had no idea if I still had either a right main or nose gear.

  3. Richard Oberdorfer says:

    After reading about the 2009 Air France into the Atlantic last week it came to mind that the Airbus into the Hudson may be the only commercial Airbus crash that was not blamed on the pilots. I wonder did both the engines fail because of internel failure or did some Airbus computer shut them down because something was abnormal? Then it seems to me a flock of geese at altitude would be as easy to see as a small GA plane, so is this a case of failure to see and avoid?

    • Consider driving down the expressway at 70 and having a mouse run out in front of you. Do you think you could recognize it, and stop before hitting it?

      At altitude and many times the speed of the car the geese represent that mouse. They are a spec and at 500 mph you might have a couple of seconds at most to do any kind of evasive maneuver. By the time you see them, recognize them and react you are probably already past them.

      At 200 mph in a single engine plane you only have a couple of seconds to react and birds are unpredictable. They may go down, up, or to the side. Ducks and Seagulls are brainless, but even smart birds like hawks and geese are still unpredictable. I missed a Hawk by inches that decided to go up at the last second.

      I did hit a flock of pigeon sized birds on climb out one day while taking some friends for a ride in a Piper Cherokee 180 which does not depart any where near as spectacularly as an F-16 or Biz jet. I landed immediately and found the cylinders on the port side packed with birds approaching the “well done” state. Had I continued on it would have been the engine that was cooked to the well done state.

      Even large birds are difficult to see when directly in front of you and at speed almost impossible to avoid.

      When you see the birds they appear to be pretty much stationary. Then instead of appearing to just get closer they suddenly grow in size and are past you. Seeing a bird (or plane ) suddenly grow in size is breathtaking to say the least.

  4. Alex Kovnat says:

    In 1983 there was an incident where ALL THREE engines of a Lockheed L1011 failed, because some mechanic omitted a vital O-ring in all 3 engines. What happened is, the Captain was able to get enough Lb-seconds of thrust impulse to bring the aircraft to a safe landing. So one thing jet engine designers should try to achieve, is to design engines to produce as many Lb-seconds of impulse as possible following catastrophic incidents such as bird strikes, omitting O-seals during maintenance, and so on. BTW I wonder if the captain of that L1011 flight is still alive. If so, perhaps he and Captain Sullenburger ought to appear on stage together at one or more aviation symposiums.

  5. Chuck Genrich says:

    With the new information about the South Atlantic Air France crash, the one in Buffalo and the overflight of Milwaukee it would seem we should pay more attention to the nuts behind the wheel rather than the wheels. Also, it would seem that Richard Oberdorfer has never had the pleasure of meeting our feathered friends on take off. One second everything is fine and they are just “there”, and it can scare the willys out of you.

  6. John Patson says:

    The Hudson Airbus did not make the runway — but in spite of both engines being out — still produced the electricity to make sure the fly-by-wire controls and radio worked to ensure the pilots made the safe ditching they did.
    I am not sure for how long it was without electricity after the motors and the alternators attached to them went, but it was probably only fractions of a second before emergency batteries took over. And under that emergency system there was another in case the batteries ran down before the plan landed.
    For engineers the idea of both multi-million dollar, very high technology engines quitting at the same time must have seemed remote, but thankfully the standards meant they had to design for that eventuality, and they did.

  7. Mac says:

    Hi John,

    All transport category airplanes must have enough battery energy to power all essential items for night IFR flight for at least 30 minutes. In addition, most newly designed fly-by-wire jets have a RAT (ram air turbine) that extends into the slipstream. It’s called a turbine, but the RAT is really a generator with a propeller on the front. The slip stream windmills the prop and turns the generator. Remember when we used to see such devices bolted to the landing gear or wing struts of T-Crafts, Champs and other basic singles? Never thought to call it a RAT back then.

    Mac Mc

  8. Gordon Arnaut says:

    I’m not sure there have been one billion commercial jet flights to date. One billion hours flown, yes, but not one billion flights.

    According to Boeing, stats for 2000 totaled 18 million flights that year worldwide. that number has since increased, but it would have been much lower in previous decades.

    Even if we take 18 million as a yearly average it would take over 55 years to reach one billion flights. Commercial jet service has not been around that long, the Boeing 707 entering service in 1958. (The de Havilland Comet started service in 1952 but was grounded two years later after several in-flight structural failures.)

    Considering the very low amount of jet traffic in those early decades, it would be surprising if even half of one billion commercial jet flights have been completed to date. Probably the actual figure is much less.

    So the 1549 flight does not meet the one in a billion rule of thumb. Moreover, there have been several airliner crashes caused by bird ingestion in both (or more) engines. But only one fatal one, that being an Ethiopian B-737 with loss of 35 souls and 21 injured.

    There have been several more bird ingestions that have knocked out all engines, including a DC-10 on a repositioning flight out of Kennedy in 1975, in which a flock of gulls knocked out all three engines, on takeoff, resulting in an abort and runway overrun. The airplane was destroyed but no fatalities.

    Here is a good report with details on all such accidents, as of 2003. http://www.int-birdstrike.org/Warsaw_Papers/IBSC26%20WPSA1.pdf

    As a Part 25 flight test engineer I know the standards are very high for all systems, especially critical items like wings and engines. But bird ingestion is a very tough problem, you are never going to make an engine bird-proof unless engines, and therefore airplanes, grow much bigger than they are now. It would probably take something like an order of magnitude increase in size…

    • Mac says:

      Hi Gordon,

      The really misleading aspect of any “one in a something rule” is that to be accurate you do not need to see the entire period pass before an event occurs. For the regulatory authorities’ one in a billion goal to be reached, an event could happen on the first flight, or a very early flight, but then not again for a very long time. But the important issue is that the 10 to the ninth certification rule is a goal, not an absolute. If we could figure out how to really avoid all accidents for a billion flights we would raise the bar.

      Thanks for your comments,

      Mac Mc

  9. Gordon Arnaut says:

    Here’s a video of a bird-ingestion test on a RR Trent 900 engine, which are used on the A380: http://www.youtube.com/watch?v=rSafRuLB0c0

    Not sure of the size of the bird, but maximum called for in rules is 8 lb for the big engines. Canada geese can weigh 20 lb, and there are even bigger species in some parts of the world. Rulemakers keep the size down to what engines can actually pass, not the possible size (and destructive potential of the bird). http://www.flightsimaviation.com/data/FARS/part_33-76.html

    The bird test on the video ends up damaging only one fan blade but that could be enough to cause unbalance that could lead to engine shut-down.

  10. George Willenbrock says:

    Another one lost to birds, an Electra coming out of Boston lost due to a large flock of Starlings.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>