• Second Guessing Sully?

After watching the video of US Airways 1549 ditch in the Hudson, and after reading that controllers suggested they go to Teterboro, I wondered what the situation would have looked like to the pilot. So I cranked up Microsoft Flight Simulator X on my iMac (yes, Windows actually runs better on a Mac) to see what would have happened if Sully had gone to KTEB instead.

UPDATE: Also tried returning to KLGA Rwy 13. Added images below.
UPDATE: See info from Airbus pilots before the comments.
UPDATE: See what a goose does to a jet engine
UPDATE: A history of airline ditching with pictures

UPDATE: FAA transcript and audio from the flight are available here.
So I set the sim for January 15th, 2009 at 3:25PM and lined up a 160,000 pound (20,000 under gross wt) A320 on runway 4 at La Guardia.

One minute after takeoff at 3000' I shut down both engines. That's La Guardia under the aircraft in the distance (click images to enlarge).

As I turned west, Teterboro is a small white patch across the river, middle left in the windscreen, above the George Washington Bridge highway.

"We're too low," turning south just north of the GW bridge "We're gonna be in the river"

Seconds before splashdown

Splash, right at the 38th street pier. So the simulator model is accurate and produces the same result.

Here's the profile map

Now let's try for Teterboro and make it as easy as possible—no pax or cargo, minimum fuel, no worries about the steady stream of biz jets and GA traffic that would otherwise defintely be a factor. Same cut at 3000 feet, balloon to 4600' to reach best glide speed of 130 from 250kts climb speed. Over the river headed west, crossing the Hudson, it looks like it might work.

Modified base for Rnwy 24 Teterboro (6000 feet long), still looks do-able.

But after touchdown slightly long thanks to misjudging the tailwind (about 1000') and without reversers, we're off the end. So there may be a way with a light aircraft and better approach. 7000' Rnwy 19 is not an option because of the longer approach, Rnwy 1 worse yet for same reason and it requires an acute turn to final.

Now let's try it at 180,000 pounds, close to gross weight (Vr goes from 131 to 161, and so does best glide speed, I'll wager). Over the river it's not looking good, and the fly-by-wire system won't let me fly slower than 200, which is probably above best glide speed.

Headed straight for the airport, forget runway lineup. We're going to have to put it in the river (not the Hudson). Dumped the flaps and ended up well short (we hit the highway bridge and then went in the drink)

About 2 miles short.


Good call Sully!

Someone asked what woukd happen in the sim if we tried to go back to La Guardia and land on runway 13. Heavy it didn't work in 4 tries. Light (empty), I didn't make it the first time, but it was close. Next time it worked when I turned back almost immediately. Here's what it looked like on approach

And after landing

Here's the map

So once again—Good call Sully!


A new map from FAA with more detailed real life time/altitude/speed info (click to enlarge)
Update #2 from someone who knows a lot more about this than I do:

Reports state geese were flying at 2900'. This would imply that the A320 would have already cleaned up from its original take off flap setting (most likely config 1 which would have a small amount of flap on the trailing edge and a small amount of slat on the leading edge) to a clean configuration and acceleration to 250 kts indicated airspeed, the maximum permitted speed below 10,000' in the US.

The engines would have been in the 'climb gate' which means that the auto thrust system would be engaged with the FMGES (flight management, guidance and envelope system) computers able to automatically set thrust to whatever it requires between idle and approx 90% of the maximum continuous thrust.

The co-pilot was the pilot flying (PF) for this sector with the captain playing the pilot non-flying (PNF) support role (radios, monitoring, system selection, etc). On fly by wire (FBW) Airbuses (Airbii?) the autopilot can be engaged from the later of 100' or 5 seconds after take off but most of us like to play awhile so I don't know if it was engaged or if PF was hand flying at the time.

It would appear that on hitting the birds the power loss on both engines was instantaneous. I would expect that the flight deck would momentarily have gone dark with all the screens blank while the electrical system reconfigured itself onto battery power. During this time a small ram air turbine (RAT) would drop out from the underside of the aircraft with a freewheeling propeller that spins up to 6000ish rpm in the airflow.

Modern Airbus have 3 electrical systems referred to as the Green, Blue and Yellow systems (you can't afford to be colour blind in an Airbus!) with hydraulic dependent systems spread across these 3 providers to allow system redundancy. The engines have pumps attached that normally pressurise the 3 hydraulic systems to 3000 psi however these engines had now stopped so the RAT would supply hydraulic pressure at 2500 psi to the blue hydraulic system only. With only the blue system available the aircraft would have had both elevators but only the left aileron operational (the rudder is electric on the 320 so other redundancy caters for that). The loss of all the engine driven electrical generators would also cause the emergency generator to come on line. This is a small generator that is driven by blue system hydraulic pressure (effectively a windmill in the fluid lines) with enough output to power minimal flight instrumentation, flight control computers, FADEC's (computers governing thrust management), SFCC's (slat/flap control computers), etc, etc. The emergency generator means that the batteries can be saved for any future needs as they are only guaranteed for 30 minutes.

So at this point the aircraft has flight controls and limited electrics. There would then be the most awful buzz of aural warnings and illuminations as the aircraft then reports itself to the pilots as being unfit for use. If the autopilot was engaged it would have dropped out and as the only pilot instrumentation showing would be the captains PFD (primary flight display) and the ISIS (integrated standby instrument system) he would now become the PF while the co-pilot now became the PNF.

In normal circumstances Airbus flight guidance is unlike conventional aircraft as forward and backward movement of the sidestick does not directly control the elevators but does directly control g load demand. Lateral movement of the sidestick does not directly control the ailerons; it sends a request to the flight control computers for a desired roll rate. There are also flight envelope protections in place controlled by the flight control computers that prevent the aircraft exceeding preset pitch and bank angles, min and max speeds, min and max g loadings, etc and when all these are in place the aircraft is referred to as operating in 'Normal Law'. There are another 6 'laws' that the aircraft can fly under (alternate 1, alternate 2, flare, abnormal attitude, mechanical backup) including the reversionary mode the aircraft would have dropped into in this case, 'Direct Law'. In this mode the sidestick movement is effectively directly related to aileron and elevator movement and in effect the aircraft has downgraded itself 3 stages to handle the same as a normal aeroplane. We even have to start trimming!

The aircraft appears to have reached a max alt of 3200' before transitioning to the glide. The Captain is now handflying and will also have taken over the radios while the FO now has the job of dealing with the systems and failures. The Airbus has a system called ECAM (electronic centralised aircraft monitoring) which not only displays normal aircraft system information on 2 screens in front of the pilots in the middle of the panel but also automatically presents checklists and operation procedures during failures scenarios. The upper ECAM screen would be awash with pages and pages of procedures for him to work through however the aircraft
will prioritise the failures and put the engine relight procedures at the top of the list

The ECAM would instruct him to:
1 – Switch on the engine igniters. Jet engines operate with the 'spark plugs' normally switched off as they are a constantly burning fire unlike a piston engine. Relight
will not happen without a spark though.
2 – Return the thrust levers to idle for correct fuel delivery during start sequence.
3 – Request PF to fly at 280kts which is the optimum speed for relight. In light of the low altitude I very much doubt they would have wanted to do this. If they had they would have needed a target pitch attitude of approx 2.5 degrees nose down and assuming a weight of 70 tonnes in still air the glide would have been 2.6nm per 1000'. I suspect the captain would in fact have come back to 'green dot' speed for improved gliding range. Green dot speed is computer generated and displayed as a green dot on the speedtape on the PFD and shows you the exact speed for max lift/drag ratio for that weight in the ambient conditions in the current configuration. I would hazard a guess that on a little Airbus (minibus!?!) this would be just over 200 knots.
4 – Select the emergency generator manually on in case the system has not come on automatically.
5 – Use number 1 VHF or HF radios and Transponder as only those are powered in emergency electrical configuration.
6 – Reset number 1 Flight Augmentation Computer allowing recovery of the electrical rudder trim as the unpowered right aileron would now start to float up hampering control further.
7 – If no engine relight after 30 seconds then engine master switches off for 30 seconds to purge the combustion chambers before restarting the ignition sequence. Below FL200 the APU can be used to assist with engine starting however even if the APU had been running it would not be able to be used within 45 seconds of loss of engine driven generators to prevent interference with emergency generator coupling.

At some point the crew would then have to accept their fate that the engines are unlikely to restart and transfer to the Ditching checklist which is not on ECAM but would have to be accessed from the QRH (quick reference handbook) located to the side of each pilot.
Now the FO had a new list of jobs to perform:
1 – Prepare cabin and cockpit. Ensure cabin crew are notified and doing their thing, secure loose items in the cockpit, prepare survival equipment, tighten harness and select harness lock, etc..
2 – Switch GPWS (ground proximity warning systems) and EGPWS (enhanced GPWS) systems off so that the aircraft does not start shouting 'Too Low Gear' or 'Whoop Whoop Pull Up' at you when you are trying to concentrate on a tidy crash.
3 – Seatbelt signs on. Somehow think this one got into the checklist to appease the lawyers at the subsequent board of enquiry!
4 – Turn off cabin and galley electrical power.
5 – Select landing elevation to zero on pressurisation control panel as this would currently be set to the landing elevation at the planned arrival airfield. If the aircraft
was still pressurised on ditching it might not be possible to open the doors.

The QRH advises the crew to ditch with the gear retracted and the flaps set to the max available setting (normally called Config Full). On the A340 we can achieve Config Full as our RAT supplies the Green hydraulic system. However, looking through the A320 manuals where the RAT supplies the Blue system I can only see a capability to deploy the leading edge slats only. It would be possible to get Config Full by manually switching on the Yellow system electric hydraulic pump to pressurise the Yellow system and then via a PTU (power transfer unit) the Green system would also be powered but this is not SOP so I suspect the aircraft may have ditched with slats deployed and flaps retracted but don't take that as gospel.

At 2000'agl the FO then:
1 - Check that the cabin pressurisation mode selector is in AUTO.
2 – Switch all engine and APU bleed valves off.
3 – Switch on the overhead 'DITCHING' pushbutton. The outflow valve, the emergency ram air inlet, the avionics ventilation inlet and extract valves, the pack flow control valves and the forward cargo outlet isolation valve all close to slow the ingress of water.

At
1000'agl the FO then:
1 – Makes 'Cabin crew seats for landing' PA.

At
200'agl the FO then:
1 – Makes 'Brace for impact' PA.

At touchdown the FO then:
1 – Engine master switches off.
2 – APU master switch off.

After ditching:
1 – Notify ATC.
2 – Press all engine and APU fire pushbuttons to arm fire extinguisher squibs and isolate fuel, hydraulic, pneumatic and electrical couplings.
3 – Discharge all engine and APU fire extinguishers.
4 – Initiate evacuation.

I have left out a lot of the explanatory text from the QRH for brevity but you can see that this is an almighty amount of work to achieve in an ultimate pressure scenario. I have not even touched upon the proper evacuation checklist. I have also done Monsieur Airbus an injustice but drastically simplifying my explanations of the key systems in an attempt to make them more understandable but I hope it is of interest to those that made it to the end of the text!
In my company we do practice this event in the simulator for both ditching and crash on land. In fact I last did a 4 engine inop landing in the simulator just 6 months ago having simulated a departure from Tokyo followed by a volcanic ash ingestion at FL250 in the climb leading to 4 engine flame out with unsuccessful relight attempts. We ran the exercise twice and both times managed to successfully glide back to Tokyo with the only damaged being burst main wheels from hammering the brakes. We practice many, many other horrendous scenarios (such as flying the aircraft to successful airport landings with the loss of all power to the flight control surfaces) so you can see that the only subjects that we are not prepared for are the ones we haven't thought of yet.

Hats off to the entire crew for a most amazing job done brilliantly and top marks to Airbus for showing all the doubting Thomas's that they were so very wrong about the strength of the aircraft.

Comments on the above from another Airbus driver:

The Airbus in everyday operation is a wonderful aeroplane and makes the job easy, unfortunately its when things start to go wrong that it makes life difficult for you. What the description of events doesn't really convey is the time frame across which all this happens.

During the climb they would have heard a couple of large bangs as the birds were ingested and a very noticeable drop in engine note. They would have immediately looked at the engine indications on ECAM realising they have lost power from both engines, a second or two later the whole cockpit would have gone dark with some clunking noises, losing all screens and no matter how brief this is, its always scary! A second or two later just the Captain's screens would have come back and simulatneaously the autopilot would drop out with the audible cricket warning (The Airbus philoshopy is if you have a double failure 'you have control', just when you need the extrra capacity you have to fly it too) . ECAM would be going spare 'binging' away in a panic flicking through drills prioritising them, so for a short while you can't do anything as the screen keeps changing. All in a matter of seconds. If they were just over 3000' when this occured they had just over three minutes before splash down. Not long to pull yourself together, realise your not going to make the airfield ahead, decide on the river, remember the appropriate drill in the QRH, get your FO to start carrying them out and configure for a ditching.

Added to this they had a problem with the cabin crew. After any incident the flight deck will give the cabin crew a NITS brief) Nature of the problem, our intentions, the time frame to landing and any special considerations for their duties) The trouble is they had just taken off, as soon as the wheels are up the cabin crew are released for duties and whats the first thing they do? They get on the PA and try to sell you shite you dont want. So our man couldn't contact the crew or the passengers to tell them what is going on. (A good argument I think to reduce the annoying number of unneccessary sales PAs on flights) No doubt a certain amount of his last three minutes were spent trying to break through the sales crap to announce to everyone that they were making a forced landing. While flying the aeroplane and making the Mayday calls (as only his radio worked.)

Apparently the Captains CV is a thing to behold and well worth looking up, if ever there was a suitable man to be flying that plane that day it was him. There is no doubt that they both did an amazing job and I just wonder if it had been Ryan air, with a 2500 hr Captain and a 200 hour Eastern European First Officer would the outcome have been the same? I doubt it.