US Airways 1549 and the Miracle on the Hudson

By now millions of people have seen the new movie “Sully” about the flight that became known as the Miracle on the Hudson, in which the crew of US Airways flight 1549 saved the lives of the 155 people on board (and possibly many more in Manhattan) by ditching and safely evacuating an Airbus A320  loaded with passengers, cargo, and 20,000 lbs of jet fuel on the Hudson River on the cold and wintry day of January 15 2009.

NTSB AAR1003 Figure 1

First and foremost, anyone who understands aviation knows that this was a truly amazing bit of flying. There were no fatalities, some fairly minor injuries, and you really have to give 100% respect to the 2 pilots Sullenberger & Skiles, and also for the cabin crew (the 3 FA’s), and the numerous first responders who rushed onto the river as lifesavers. Everybody did their jobs that day, exactly as they should, and nobody died. Nobody.

To be clear, in no way shape form or context will I say or imply anything negative about any of these people. This was a totally unprecedented aviation event that had never occurred before, for which there were no (valid) manuals, no training, and the emergency procedures had to (partially) be improvised. Instinct, skill, experience, good communication (CRM), and (let me honest) more than a bit of good luck…

That was the Miracle on the Hudson.

But “Sully” is a movie. It is not a documentary and it is not 100% accurate (although darn close) and because a movie needs to balance drama, facts, and entertainment, it has to skip over some items.

What then is this article about? It is about the real villains of US1549. It is about problems that were allowed to pass uncorrected, even though they were known and reported years before. It is about the failure of the FAA to validate, test, and verify facts, and it is about the negligence and the deliberately misleading data that was provided by Airbus in order to get the A320 aircraft certified for operations. Is that criminal, was a crime committed? I don’t know. I’m not a lawyer. But I can repeat facts.

Disclosure: To keep this nice and legal, everything I am going to talk about is recorded and documented in the official 213 page accident investigation report of US1549, known as AAR1003, and available at the NTSB site on the web. Anywhere I quote AAR1003, I will use a BOLD font and cite the page number. Anything in italics is a highlight I have added, but is not a highlight in the source document. NTSB_AAR1003.pdf Go ahead, fact check me!

NTSB report AAR1003 cover

It is now time to tighten your seatbelt, bring your seat upright, and get prepared for a bit of turbulence.

The biggest issue/challenge facing US1549 was with the Airbus ditching protocols and procedures, as stated right up front in a portion of the NTSB summary (AAR1003 introduction page xv):

“The National Transportation Safety Board determines that the probable cause of this accident was the ingestion of large birds into each engine, which resulted in an almost total loss of thrust in both engines and the subsequent ditching on the Hudson River. Contributing to the fuselage damage and resulting unavailability of the aft slide/rafts were:

(1) The Federal Aviation Administration’s (FAA) approval of ditching certification without determining whether pilots could attain the ditching parameters without engine thrust,

(2)  The lack of industry flight crew training and guidance on ditching techniques, and

(3) The captain’s resulting difficulty maintaining his intended airspeed on final approach due to the task saturation resulting from the emergency situation.”

Whoa! Did the NTSB just say that the FAA approved a ditching certification (provided by Airbus) w/o determining if it was realistic? Yeah, the NTSB did. Airbus provided a deliberately misleading and over-optimistic stack of documents and specifications about A320 ditching, and the FAA never questioned the data. I don’t want to bore anyone who is not a pilot, but in simple terms Airbus designed the hull and fuselage of this aircraft so it could withstand a degree of impact and damage during a ditching, and would stay afloat long enough for everyone to evacuate. After a ditching, all of the passengers and crew would evacuate using the aircraft emergency exits and their associated floating slide/rafts.

All of this makes sense. Until you read the fine print. Included in the assumptions about the ditching is that 2 aircraft exits would not be usable. So far, that makes sense. After a hard landing or in an emergency, it is reasonable to assume that some exits might be blocked or unusable. Crews and airlines train for this all the time, and evacuation drills always have some exits blocked. Now, go back and really read the fine print again. The Airbus modeling and ditching certification assumes 2 exits on one side (either side) can not be used and that a single raft will be unusable. They never consider that the aircraft might be tail-down or nose-down, and that both of the rear or both of the forward exits and their 2 rafts would be unusable.

A June 10, 1992, Airbus certification report considered two evacuation scenarios: one in which all of the exits were available and another in which two exits on the same side of the airplane were available and one of the largest slide/rafts was unusable. (page 37)

Do you know what happened in the Hudson? Yup. US1549 settled tail down and the rear of the aircraft and cabin quickly flooded. Both of the aft exits were underwater and were unusable. That meant that BOTH of the rear exit slide/rafts could not be inflated and then detached and used as floating refuges for the passengers. “Most of the aft passengers initially attempted to go to the rear exits, but flight attendant B and several passengers began shouting for everyone to go forward because the rear exits were not usable.” (page 106) That is one of the reasons why more than half (86) of the people on US1549 were standing on the wings awaiting rescue – without the 2 rear exits and rafts, they didn’t have enough rafts for all 155 passengers and crew.

“The accident airplane was equipped with 4 slide/rafts, 2 at the front of the airplane and 2 at the back of the airplane…. Because the two aft slide/rafts were unusable after water entered the airplane, only two rafts, with a combined capacity to carry 110 people, were available. However, given that this was a non-EOW flight, it was fortunate that the airplane was EOW equipped and had any slide/rafts available at all for passenger use.” (page 107)

“…non-EOW-equipped airplanes may operate with just evacuation slides and flotation seat cushions.” (page 107)

Did you catch that? Let me repeat it: By law this aircraft was not required to have any detachable slide/rafts. None. It was “fortunate” that this was an EOW aircraft that carried those. Sheer dumb luck.

NTSB AAR1003 Figure 2

Not enough room in 2 rafts, no more room on the wings, and very few lifejackets in evidence. “Only two of the 155 aircraft occupants donned life preservers prior to the water landing.” (page 129) “Most of the passengers who eventually donned, or attempted to don, life vests did so after they were outside the airplane while they were seated in a slide/raft or standing on a wing… only 33 [of 150] passengers reported eventually having a life vest” (page 115)

That gets to the next big issue, the NTSB note about “EOW” and “non-EOW”. In order for an aircraft to be certified to fly extended distances over water (EOW = 50 miles from shore) it has to be configured differently. One of those differences is that it has to carry enough detachable slides/rafts on board so that even if the largest one should be lost/damaged, the remaining rafts can still carry all the passengers and crew. The flight from New York to Charlotte is not an over water flight (by definition), so it was just blind luck that the aircraft carried ANY detachable rafts. Sheer luck. Pure good luck. By the ‘letter’ of the law and FAA regulations, US1549 could have flown without any detachable rafts. None. Zero.

The sober reality is that most planes flying in the USA, and most planes flying the LGA/CLT route are not EOW compliant, they don’t need to be. The passengers and crew were just simply lucky that US1549 was, and that it had detachable rafts. The FAA does not require airlines to carry this basic survival equipment on most passenger aircraft.

Non-EOW airplanes are not required to carry passenger life vests, slide/rafts, or survival kits.  (page 37)

Can you even contemplate how many people might have drowned or died of exposure/hypothermia if none of these slide/rafts had been available? On the day of the accident, the air temperature was around 24F/-5C, the water temperatures were in the 40’s (+5C), and survival times in water under those conditions are less than 10 minutes. Miracle on the Hudson indeed. A miracle of good luck that those rafts (and life preservers) were there. They were very “fortunate” indeed that the aircraft was EOW equipped. Really lucky. A miracle (on the Hudson).

“If the airplane had not been EOW equipped, the rafts that held those [64] occupants would not have been available. Further, at the public hearing, a US Airways representative stated that if the accident airplane had not been equipped with slide/rafts, the flight attendants would have detached the single-lane slides at the forward doors and instructed passengers to jump into the water and hold onto them, exposing many passengers to cold water for sufficient time to likely cause serious injuries and/or fatalities.” (page 107)

Not a nice alternative, no choice except to jump into 40 degree water, maybe without a life jacket, as the plane slowly sinks beneath you…

Both passenger statements and photographic evidence… indicated that the wings were very near to, if not at, standing capacity. Therefore, the wings did not have room for the additional 64 occupants who were rescued from the slide/rafts. If the airplane had not been EOW equipped, the rafts that held those [64] occupants would not have been available. (page 107)

Photo published by New York Daily news

The concern about non-EOW aircraft, lacking life jackets and detachable slide/rafts, being forced to land in water is not new, it has been a concern of the NTSB for 30 years (from 1985), but has NEVER been acted on by the FAA:

Safety Recommendation A-85-41 (1985) asked the FAA to do the following:

Amend TSO-C69a to require quick-release girts and handholds on emergency evacuation slides; amend 14 CFR 121 and 125 to specify a reasonable time from the adoption of the revision of the TSO by which all transport passenger air carrier aircraft being operated under these Parts must be equipped with slides conforming to the revised TSO.

On August 17, 2000, the NTSB stated that it was disappointed and concerned that, in the 12 years since the FAA initially issued the NPRM and in the 15 years since Safety Recommendation A-85-41 was issued, action had not been completed…

On March 29, 2002, the NTSB stated that it was aware that an SNPRM had not been issued and that no efforts were underway to issue one. Given the FAA’s lack of action and the amount of time that had passed since this recommendation was issued, the NTSB classified Safety Recommendation A-85-41 “Closed—Unacceptable Action.”  (page 73)

But wait a second. How reasonable is this concern about EOW vs non-EOW, and do we really need to worry about non-EOW aircraft when we are flying from Los Angeles to Las Vegas, or from Chicago to Boston? How about from New York to Charlotte? The answer in all 3 cases is a surprising Yes. When you takeoff at LAX, your departure and climb has you over the Pacific Ocean before you turn East. Leaving Chicago on the way to Boston, you are in the most critical stages of your climb as you pass over Lake Michigan. And from New York to Charlotte? That is also an overland flight, not classified as “extended over water”, and it was the flight plan for US1549, which ended in the Hudson River.

So, when/where do most accidents and most water landings occur? During takeoff and landing. I think it is insanity that EOW is not mandatory on every single commercial aircraft.

Take off and climb, ORD (Chicago) to Boston

An image of a flight from Chicago to Boston. The 1^st 15 min & the climb to 30K ft is over Lake Michigan.

Since water impact accidents occur primarily during the takeoff or landing phases of flight, not during the ‘extended overwater’ [EOW] phase, and are not limited to aircraft equipped with slide/raft combinations, it is important that the evacuation slides on narrow-body (and, where still used, on wide-body) aircraft be modified to offer a means to avoid immersion. (page 109)

Los Angeles to Las Vegas, starts over the Pacific

Taking off from LAX, heading to Las Vegas… Over-water after takeoff.  So very common.

…at least 179 fully certified airports in the U.S. are located within 5 miles of a body of water of at least one-quarter square mile surface area. Similarly, a 1996 FAA report found that 75.8 percent (194 of 256) of large airports worldwide had at least one overwater approach. The report concluded that “approximately two-thirds of all worldwide accidents occur during those flight phases within close proximity of the airport” and that “the majority of water related mishaps occur within close proximity of the airport during these flight phases.” (page 108)

At this point I think it is clear that the NTSB sees that water landings are a real possibility, a real risk, and not just on flights to London or to Hawaii. It seems self-evident that large (+50 passenger) aircraft need to have slide/rafts and be EOW certified. That’s obvious after US1549. But the FAA does not agree, and has been resisting this action this for 30 years.

Now let me backtrack. After the ditching, the aircraft settled down by the tail, flooding the aft cabin so quickly that the rear exits could not be used. Why? How did this happen? Who was at fault? Was there anyone at fault? Did Sully/Skiles do something wrong? Is this an Airbus design problem?

During the design and development of this aircraft (or any aircraft) the designers know that there will be operational accidents (ie: crashes), and an airframe needs to have enough strength so it can provide a level of protection during a reasonable event. This is really no different than your car, where you expect that the car can protect you up to a certain point (maybe 40 miles per hour), but after that, there is just a limit on what they can ‘build in’ for safety. Aircraft also have these limits, and the manufacturers establish a set of parameters that they design for. Specifically, there are expectations on what a survivable ditching event is going to be, and how strong the airframe needs to be.

Nobody can afford to design and build an aircraft that can withstand a high speed water landing at 500 mph. And nobody is going to trust an aircraft that breaks up and quickly sinks if it lands at 50 mph. As part of the airworthiness certification for the A320, Airbus provided the FAA with a flight profile for a water landing or “ditching” that would maintain hull integrity and give the people on board enough time to evacuate. This profile covers the most important flight profile factors like airspeed, rate of descent, and the pitch (angle) of the aircraft when it hits the water.

OK, so to put this in perspective, the basic parameters that Airbus provided for a water landing are very similar to a landing on a runway, although slower for airspeed. The ditching airspeed needs to be as slow as possible but above the stall speed of 115 knots (~130 mph), the plane should be flying slightly nose-up in pitch (+10 degrees), and it should have a descent rate of around 200 feet per minute (3.5 feet/sec). There’s just one problem here… With both engines out you can’t meet that flight profile, because that profile, as defined by Airbus, is for powered flight. And common sense probably tells you that if an airplane still has engine power, it’s not very likely to need to ditch on the water! But I guess common sense is in short supply in both Toulouse and in Washington.

Restating this: The ditching profile that was provided by Airbus assumed that there was engine power! The profile does not make sense for an unpowered landing on water, where a 150,000 lb (70,000 Kg) airplane has become a glider, being dragged down by gravity, and only able to trade its very limited altitude for airspeed.

NTSB AAR1003 table 2

I added the red/blue highlight above to emphasize the major outlier in the US1549 flight profile.

After the US1549 incident, the NTSB noted this issue in the Airbus ditching profile and requested clarification from Airbus, which was provided: According to Airbus, the ditching certification criteria also assumed that engine power was available… (page 22)

Without engine power, there was no way the US1549 pilots could achieve the (impossible, unrealistic, fantasy) Airbus ditching descent rate of 3.5 fps, and 1-degree glide slope. And because their “out of profile” water landing over stressed the rear portions of the hull, the impact forces were 2x-3x greater (page 23) than what the frame was designed for, the aft skin was ripped off, cargo holds opened, hull ruptured, and this led to the flooding and the loss of the use of the 2 rear exits. The aft hull damage, the flooding, the loss of use of the rear exits… This was NOT the fault of the flight crew!

Photo from FlightStory.net

Although the airplane impacted the water at a descent rate that exceeded the Airbus ditching parameter of 3.5 fps, post-accident ditching simulation results indicated that, during an actual ditching without engine power, the average pilot will not likely ditch the airplane within all of the Airbus ditching parameters because it is exceptionally difficult for pilots to meet such precise criteria with no power. (page 79)

…The NTSB recommends that the FAA and EASA require applicants for aircraft certification to demonstrate that their ditching parameters can be attained without engine power by pilots without the use of exceptional skill. (page 96)

Saying this again, because it is important to understanding what happened; Although Sully pulled back, the self limiting features in the Airbus software system did not permit the action to take place below 100 ft. In short, Airbus software meant that the flight crew could NOT slow the descent!

NTSB 1.16.1.2 “…was in alpha-protection mode from 150 feet to touchdown. The Airbus simulation indicated that, from 1530:36 to 1530:43, the flight control system attenuated the effect of the pilot’s airplane nose-up (ANU) sidestick inputs below 100 feet radio altitude. ” (page 48)

Bad (false, invalid) assumptions about a gentle ditching process led to optimistic estimates on the impact energy and force. In turn, this led to false conclusions about available exits and hull integrity, and how the passengers and crew would be able to evacuate. Finally, all of this garbage was wrapped up in a pretty ribbon and given the seal of approval by the FAA when the A320 was given an EOW certification. Basically, the certification was based on bogus data provided by Airbus, false data (ie: lies). Unrealistic and unattainable flight assumptions & conditions that nobody ever checked or questioned.

In an interesting side note, the B737 which is a direct competitor to the A320, recognizes that tail-down is likely after ditching: Boeing 737 NG is designed such that the aft portion of the airplane sits low in the water after a ditching, which makes the aft exits unusable; therefore the slide/rafts are stowed in overhead bins near the center of the airplane rather than near the aft passenger exits.  (page 37)

US1549 was a miracle indeed. A miracle that the crew (flight and cabin) controlled the situation. A miracle that nobody perished. A miracle that rescue boats and a helicopter were nearby and were on the scene in minutes. A miracle that the aircraft was EOW configured. A miracle that they had any rafts.

100% survival because on Jan 15 2009, US1549 landed in a sea of miracles on the Hudson River.

But let me also be crystal clear about something else. Are Airbus planes or the A320 dangerous or unsafe?  HELL NO. Far from it. Statistically, the A320 (and family) are some of the safest designs and airplanes ever introduced into the market. But, they could/would have been designed to be even safer and more crash-worthy if Airbus had used a realistic ditching model.

And with the prevalence of water around most major airports, the FAA needs to act on 30 year old recommendations from NTSB, and mandate that any/all passenger aircraft (50 seat minimum) flying any routes within the USA must carry life rafts and life preservers.

There is a precedent for a regulation like this… Not enough life rafts? The RMS Titanic…

From the NTSB final findings summary:

• Although the airplane was not required by Federal Aviation Administration regulations to be equipped for extended overwater operations to conduct the accident flight, the fact that the airplane was so equipped, including the availability of the forward slide/rafts, contributed to the lack of fatalities and the low number of serious cold-water immersion-related injuries because about 64 occupants used the forward slide/rafts after the ditching.

• The determination of cabin safety equipment locations on the A320 airplane did not consider that the probable structural damage and leakage sustained during a ditching would include significant aft fuselage breaching and subsequent water entry into the aft area of the airplane, which prevents the aft slide/rafts from being available for use during an evacuation.

• Given the circumstances of this accident and the large number of airports located near water and of flights flown over water, passenger immersion protection needs to be considered for nonextended-overwater (EOW) operations, as well as EOW operations. (page 122)

We can’t undo the past, but we can learn from it. And note that these suggestions are not specific to Airbus, they also apply to Boeing, and to the safety of everyone who travels or flies for a living

• EOW equipment and configuration must be mandatory on 50+ passenger aircraft
• Unpowered & ditching profiles for all aircraft need to be reviewed and validated in simulators
• Pilots need specific training in ditching procedures
• And as passengers, LISTEN TO CREW INSTRUCTIONS, and learn where your life vest is

Look, nobody died, and maybe that is a miracle. But mostly it was skill, some luck, and a really fortunate alignment of coincidences that day on the Hudson that saved 155 lives. Next time, we won’t be as lucky.

(Some updates since I wrote this)

A review of the movie on technical grounds by an active A320 pilot. Link: capnaux

An interview with the aft Flight Attendant (“B”) and her recollections. Link: zmags

Great article by the New York Times, focused on the 3 FAs. Link: Heroines