There’s a regulation that came into force in 2004 (in the USA, offhand I don’t know if the EASA equivalent predates it, I know the Canadian one does not) that obliges lavatory doors to “be designed to preclude anyone from becoming trapped inside the lavatory. If a locking mechanism is installed, it must be capable of being unlocked from the outside without the aid of special tools.”
Most designs just make the occupied/vacant sign part of the lock and have a way to grab it from outside and slide it open.
Any aircraft designed after that date (new approval) would need to meet this standard, but not every aircraft built if the design predates it. Looking at the type certificate data sheet for the 737 I see the standard is required on max aircraft but was not part of the previous generation planes.
Rather silly and forseeable that this could happen.
There’s a bit more to it than that. Everything you’ve said is right, but there’s more.
You’re exactly right about the deadbolt latch part of the door. That can be opened from the outside on NGs and MAXes. There’s a hidden outside lever that moves the deadbolt just like the inside lever does. Unless that linkage has become disconnected. Which is more of a potential problem on the more complex bi-fold doors of the newer interior aft lavs. The single panel doors’ deadbolt is dirt-simple and pretty hard to malfunction.
This being a rapidly growing semi-new airline from the less rigorous part of the world, the issue may simply have been the deadbolt but none of the FA’s had ever been trained on, or remembered being trained on, the existence of a hidden deadbolt release and how to use it. Oops.
The statistically bigger problem, and I’ve seen it, is the ordinary doorknob & spring latch assembly. Which is not that different internally from an ordinary non-locking household (“passage”) doorknob and spring-latch. Because those lav doorknobs get a lot of action, parts wear and / or screws get loose. So now you’ve got a wobbly doorknob that falls off or pulls off while somebody is inside the lav. Of course the outside knob falls off too. Now they’re stuck.
Back in the days of Flight Engineers with small tool kits who could leave the cockpit inflight this was a non-event. Been there, done that. Stick your screwdriver into the latch drive opening that the knob shaft normally occupies & turn. Viola! Nowadays flight engineers, toolkits, and leaving the cockpit are no longer part of the program.
I will speculate that probably what happened here. I’d also speculate that getting them out wasn’t exactly “breaking down the door”. More like “manipulating the spring latch drive lever with a screwdriver.” Unless of course the folks who responded to the gate had no clue what they were doing either.
Of course nothing is simple. But you are confusing simple with time.
Consider the DC-10 Crash in 1979. An engine tore off the plane and it took out the Leading edge slats causing the wing to stall. the resulting crash killed 271 people. It happened May 25th. The type certificate was pulled June 6th. It was restored on July 13th.
It was a more complicated process than the 737 Max-9 door by a significant level of difficulty… They had to figure out the failure from a scattered field of parts and create a fix to the problem.
They didn’t just diagnosis the failure and establish a procedure to fix it they required modifications to systems not related to the engine failure. The added changes made it more robust in the event the leading edge slats were damaged from other causes.
The bottom line is that they are most likely going to do what I speculated upthread and that’s to engage as many experts in the field as is possible to expedite the process.
I spent more time getting a certification for a modification on a small plane than the DC-10 went through. The mechanic who created the mod probably knew more than the people reviewing it. My little plane wasn’t important and they got to it when they got to it which is how it should be.
This situation involves the only major aircraft company in the United States. It’s taking down over a hundred flights a day for 2 carriers. It’s something that needs to be done right and in the minimum amount of time it takes to do it right.
I have very strong opinions about what’s considered reasonable “wear and tear” on an aircraft. The number of times I’ve faced design engineers - or, more often, budget concerned project managers - who think “there’s no literal standard for this part” and so they think they don’t have to fix it is exasperating. Door handles shouldn’t fall off, certainly not in a way that can trap a passenger and prevent them from sitting in a certified seat for TT&L. Add loctite, change the design, impose new inspections, add frangible hinges … There are options, figure it out!
I’m a big fan of 14 CFR 25.601 and 25.1301. The so-called “shit should work” standards. Love 'em.
The challenge from the crew’s POV is you arrive at an airplane with a wobbly door knob. It isn’t perfect, it isn’t even right, but it isn’t broken. The operational FARs do not really recognize that situation. From a regulatory perspective everything is either totally perfect or totally broken.
At a sizeable fraction of departures there is no repair capability available at the airport. At a smaller fraction there is someone reasonably available to adjust or tighten, but not to replace worn or defective parts. The process of documenting the problem and thereby locking out the lav unless a) somebody is available, and b) parts are not needed, will take 30-60 minutes. The process of documenting and successfully tightening is no quicker. Despite the fact that if left alone, that loose knob may well last another 100 flights and 2,500 uses before it finishes falling apart and somebody gets trapped.
The perfect has become the enemy of the good enough. With the result that we have “normalization of deviance”, and semi-wobbly lav doorknobs become part of the everyday landscape. FA’s don’t even notice them, or if they do they don’t mention it to the cockpit at all, or else not timely.
It’s legal to fly with wobbly lav doorknobs. It’s not legal to fly with undocumented wobbly lav doorknobs. Nor with unnoticed wobbly lav doorknobs. For a vague and subjective definition of “wobbly.” It’s especially illegal to fly with noticed but undocumented wobbly lav doorknobs. If such could be proven after the fact. 'Tis a quagmire.
If it was legal for me to take 1 minute to make a maintenance log entry that says “This lav doorknob is wobbly, but IMO fully functional for the foreseeable future, but should be addressed at the system’s reasonable convenience.” we all (crew, public, and maintainers) would be better served. But the FARs prohibit Captains from exercising such judgment. If imperfect and if noticed, it’s totally broken and the full hour-long rigmarole is absolutely positively required every single time, period Amen. Regardless of the knock on consequences such as flight cancellations for time of day, missed connections at the next stop for crew or pax, etc.
The perfect has become the enemy of the way more than good enough.
I completely understand. The engineering side has similar hurdles. “If we agree to fix this, it’ll cost x and take y time and it’s not technically a noncompliance even if customers are annoyed…”
As an industry we definitely get in our own way a lot.
No information about what happened, other than a witness reported hearing a loss of power. Surprisingly, the article is not ‘OMG! Amateur-built airplanes are flying coffins! We have to do something!’ Instead, it talks about the Cozy Mark IV, hears from the original builder, and states that Experimental aircraft must be inspected annually just like certified aircraft, and that they have a similar safety record.
Like commercial aircraft, all home-built planes are required by the FAA to be inspected annually for air worthiness. Cozy aircraft have the same safety record as commercially built planes of similar size, said aeronautical engineer Marc Zeitlin, who consults with the National Transportation Safety Board on crash investigations involving Cozy aircraft, including this one…
“The misconception is that these are put together by baling wire and glue,” said Zeitlin, CEO of California-based Burnside Aerospace. “But they are built using aircraft methodology.”
The MAX just developed yet another a fresh hurdle that is exactly up this alley.
[Background]
Every jet I have ever flown has an engine anti-ice system. Which must be turned on when external temperatures are within a particular range AND you’re taxiing or flying through precip or cloud. Details vary by engine and aircraft type but the concept is universal.
The criteria are described in very black-and-white terms, but there are gray areas in reality. Zapping into solid clouds from the clear or vice versa is an obvious cue to turn the stuff on or off. But when does a bit of gray fuzziness in the surrounding sky turn into “in the clouds?” and as it thins out again, when are you “in the clear”?
As well, the slowly changing temperatures as one climbs or descends or accelerates or decelerates can sneak up on you, leading to anti-ice being off when it should be on or vice versa. Even established in steady-state level cruise the temps can change either slowly or abruptly as you drive along through and between airmasses. If you’re cruising along right near the temp cutoff, the conditions can change unnoticed so the temp is now on the other side of the cutoff. Now you’re misconfigured for the conditions. Oops.
Running anti-ice costs fuel mileage and makes both climbing and descending more difficult. So we’re attitudinally spring-loaded to leave it off unless needed per the criteria. That’s also how our policy guidance tells us to think. At the same time, in much of the winter US the general layered half-assed cloudiness leads us to turn it on the first time we enter the criteria and leave it that way even as we flit in and out of thick clouds, thin clouds, semi clear, and actually clear every couple of minutes. Similarly in the cloudy humid tropics, at least at the higher altitudes
Every jet I’ve ever flown has a max temperature to leave the stuff turned on, with a caution that running it above that temp can overheat and eventually damage the engine cowlings. Some jets have alerts if you make that mistake, others do not. Over the annals of 60 years of jet airline ops (!), many many anti-ices have been left on at temps well above the limit for long periods of time with no obvious immediate result, and no chronic problem of heat-damaged cowlings subsequently failing.
On both the 737 NG & MAX if you leave the anti-ice on above the limit temperature a textual message alert appears on the FMS screen and triggers an idiot light on the forward instrument panel to remind you to look at the FMS for an important message. This has been true for decades now on the NG and on the MAX since their first flight.
[/Background]
Enter the MAX:
About two years ago it was noticed that leaving engine anti-ice on at too-high temperatures on a MAX may cause heat damage to the composite portions of the inlet behind the metal inlet lip we can all see. Which invisible damage may eventually compromise inlet structural strength. Which may, in the event a fan blade comes off, mean the inlet won’t do as good of a job of containing the pieces. Which may then poke a hole in the cabin and hurt somebody as happened in two NG (not MAX) mishaps in the last few years.
Once the heat-based deterioration was noticed on engines and inlets undergoing unrelated repairs, an FAA airworthiness directive (read “mandatory order to do something”) came out to put an especial caution in the MAX pilot manuals saying it’s important to make sure to turn the anti-ice off above the temperature limit.
So the NG manual says, and has said for 30 years,:
Always turn it off above temperature X to avoid damage.
with a note just below
For a MAX be sure to always turn it off above temperature X to avoid damage.
Same X for each.
This is pending a redesign of the MAX cowling to preclude the heat damage in the first place. Which is also wrapped up in a pending redesign of the very different NG cowling to solve those failures I mentioned earlier where the cowling doesn’t always contain a broken fan blade as the certification standards require and have always required.
Anyhow, right now the MAX-8 & MAX-9 are in production with cowlings and anti-ice systems as-is, pending the completed design changes. The only NGs still being built are the naval P-8 variant being sold to the US and other navies. Which also have their old design cowlings being installed pending a redesign to beef them up.
But what of the MAX-7 and MAX-10? They have not yet been issued their type certificates and other than test aircraft, none are being built. Or at least none are being completed past a very early stage of partial production.
There is a large hue and cry building within the industry punditocracy that it would be utterly irresponsible and criminally negligent of the FAA to permit a MAX-7 or MAX-10 to be built or flown until the new cowlings are available, but it’s totally OK to keep building, selling, and flying MAX-8s and MAX-9s with the exact same cowlings and engines.
WTF? But one horse is still in the barn and the other is out in the pasture. That is the difference on which this tempest turns.
Our bureaucracy means well, but somehow common sense seems to have fallen out onto the floor.
Pretty good non-adblocked article with the preliminary info here:
We used to figure 10-15 minutes was about right to handle an engine failure on takeoff and return to landing. Less than 10 and you were probably making hasty mistakes. More than 15 and you were dawdling unnecessarily with what’s usually a straightforward and well-rehearsed emergency scenario.
Absent ongoing in-engine or external fire, and absent further complicators like hydraulic or flap problems, the urgency to return in a twin now flying on one engine would be somewhat greater than a 4-engine airplane now flying on three.
Aside: of the second tier dedicated air freight operators, Atlas has a good reputation for solid maintenance and solid crew training. Unlike certain other operators in that space. It seems to have paid off in this case.
Good thing that didn’t start a propagating fuel + structure fire in the wing. Or if it did, good thing it didn’t become a real conflagration.
For comparison, if these guys (both friends of mine) had taken that into the air, the airplane probably would not have held together long enough to make a pattern and land. Had the engine held together another 5 seconds before blowing, they’d almost certainly have taken it into the air per procedures. Had it lasted another 10 seconds before it blew there’d have been no choice: fly would have been the only option.
Unrelated to any existing discussions, for the professionals: why the 5000 feet standard instrument departure (SID) restrictions in so much of south Florida? I can’t think of anywhere else in the ConUS where such restrictions are so geographically large.
I’m getting this impression from Microsoft Flight Simulator which is using the latest AIRAC cycle. Anytime I depart from a south Florida airport, such as KMIA or KPBI, I am spending the first 15+ minutes tooling along at 5000 due to those restrictions.
Just curious. Some national defense reason? I tried a Web search but couldn’t find anything on-point.
All the SIDs gained those 5000MSL restrictions in about 2021 as part of a comprehensive SID & STAR redesign that totally reworked MIA, FLL, and PBI and all their IFR GA reliever airports. And also touched at the same time many but not all the SIDs & STARs for RSW, TPA, & MCO plus their IFR GA reliever airports.
A huge redesign in other words.
“Why the 5000 and why so far after takeoff?” was a common topic of cockpit conversation since the prior procedures dating back decades had no such restrictions. We never got an official answer.
IMO …
It makes a bit more sense when you notice that most of the STARs have stops at 6000MSL or 7000MSL. The 5000MSL restriction was mostly intended for lost / saturated comm. Basically it kept all departing traffic down low until they were well away from all the arrival streams and the associated airport IFR/jet-sized traffic patterns. Meanwhile all the STARs crossed over the SIDs’ ground tracks at or above 6000, and only descended further once on the other side.
There had been a few too many close calls in the years prior between extreme traffic levels, lots of non-US pilots with language issues, heavy VFR amateur traffic and radio blocking, and plenty of convective weather.
IME …
In the real world, when departing MIA upon first contact with departure control we were 95+% of the time immediately re-cleared up to 7000MSL, which got us out of the lost comm reserved altitude ply and also fit under the predominant arrival streams that would cross our track at 8000MSL. And once clear of that stream, we’d be re-cleared up to 16000MSL. We’d typically cross whichever fix had the 5000MSL restriction at somewhere around FL200 assuming no other delays in the climb. If there was a gap in the arrival stream at that time the initial climb clearance from departure would be right up to 16000MSL. Which was the top of their airspace, with MIA Center above.
On initial contact not being immediately cleared up to 7000MSL was rare enough to warrant asking why not if the controller failed to say why not. Which they usually did, and it was almost always low speed traffic transiting the Class B airspace at 5500MSL or 6500MSL.
Likewise on arrival into MIA the STARs held you at 6000MSL, 7000MSL, or 8000MSL while passing over the SIDs depending on which ones we’re talking about. Getting a clearance to drop below that vertical profile nearing the SID crossing point was your clue that you were arriving during a gap in departures intersecting your track.
PBI & FLL were similar although the common re-clearance altitudes and crossing points were different.
Of course climbing or descending we all knew where all these crossing points were and kept an eye on TCAS to ensure the controller hadn’t goofed and sent us into a conflict.
A lot of 3D chess gets played by both controllers and crews in addition to what the charts tell us.
interesting - on my last flight with LAN (B787 IIRC), I could observe the flight attendent to lock the toilet door from the outside (with the hidden mechanism), to register the toilet as “occupied” to patrons and avoid being used when in the last moments of descend.
Also, I was surprised when the LCD-windows went dark and kept the unwashed millions at bay for about 80% of the flight … by simulating “night” …
overall, good use of “social engineering”, from the crew, I thought …
For the hundredth time (I lost count), thank you for a timely (I’m still in-flight!), thorough, on-point, and above all interesting explanation, @LSLGuy .
Which article contains two and a half mistakes in the headline alone. The airplane was not American Airlines. It was Envoy, American’s RJ carrier. As well, the airplane apparently did not slide off the runway, but rather off a taxiway on the way to the terminal. Lastly, 90% of the readers of that article will assume “New York” means “New York City”. But this event occurred in upstate New York at the tiny Rochester airport in tiny Rochester.
None of those mistakes are as big as the pilot(s) sliding off into the snow. But it still rankles when a reporter can’t even get the who, what, when, where part correct.
Flight VS127 was prevented from taking off on 15 January after a passenger saw that the tops of four fasteners were missing on a panel on one of the wings…
Each of the wing panels on an Airbus A330 has 119 fasteners, so the fact that only four were missing did not impact “the structural integrity or load capability of the wing, and the aircraft was safe to operate”, [an Airbus spokesperson] added.