With a major storm heading eastwards across the UK, the planning should have reasonably foreseen that an airport 56 miles east may also be unavailable, and should've further diverted prior to that point.

They likely used the majority of their final fuel reserve on the secondary diversion from EDI to MAN, presumably having planned to land at their alternate (EDI) around the time they reached the final fuel reserve.

Any CAA report into this, if there is one produced, is going to be interesting, because there's multiple people having made multiple decisions that led to this.

Edit: in other comments here, it seems like Edinburgh to Manchester is a 45 minute flight. So yeah, they could easily have been outside of reserves when they did the go-around at Edinburgh and still had only 6 minutes left at Manchester.

Ive never flown on Ryanair and dont intend to.

Do you have anything other than this single incident to back up your insinuation that they’re less safe than a full service airline?

In theory though that shouldn't matter because as you say, the legal minimum should really be enough.

The consequence of that is everybody ending up in the wrong place, but not in an unsafe way.

Yes, you get "some" back, and its not negligible amount. Typical modern airliner can descend on 15-20:1, giving you over 150-200km (90-120mi) range from typical cruising altitude of 33 000 feet even with engines off. Most everyday descents are actually done by maintaining altitude as long as possible, and then iddling the engines fully for as long as clearance allows. (Ofc you then use engines as you geat nearer, because its safer to be a little low when stabilizing on approach, than a little high)

Thanks to turbofans(edited from turboprops) better efficiency + less drag at higher altitude its actually more fuel economical to command full thrust and gain altitude quickly, than slower climb, or maintaining altitude (which goes against our intuition from cars, where if you wanna get far, you never give full throttle).

But theres still some drag, so you dont get everything back, so you generally want to avoid murking in low altitudes as long as possible. Full thrust repeatedly at lowest altitudes (from failed go arounds) is the least economical part of flight, so you want to avoid those if possible. But its true that the altitude you gain is equivalent to "banking" the energy, just not all of it.

Edit: changed turbofan into turbprop, which is what I meant.

(2) fuel burned stays burned, you don't 'get it back'

(3) the altitude gained may have been adjusted to account for the low fuel situation

(4) the winds are a major factor here, far larger than the fact that 'what goes up must come down', something that is already taken into account when computing the fuel reserve in the first place.

(2) I know glider pilots who fly without any fuel at all, once aloft… sounds not unlike the 150-200km glide range that @MaxikCZ mentions at idle from cruising altitude.

[0] https://aeroreport.de/en/good-to-know/how-does-a-turbofan-en...

[1] e.g. https://ciechanow.ski/airfoil/

Im gonna be a little pedantic, but the weight has surprisingly small effect on glide range, actually none of the weight affect the range directly, its all from secondary effects.

The glide is given mainly by drag and lift (so body and wing geometry), correlated to certain speed. The weight isnt in the equation at all. What weight does, is increases the speed in which the aircraft achieves this maximum glide ratio, and in higher speed you have higher drag, which finally reduces the range.

Thats why many modern gliders have water tanks in wings, to increase the weight of the glider, moving planes speed of best glide ratio higher, allowing for more efficiency at higher speeds. Its worth it if the atmospheric condition provide strong lifts. Pilot can then dump the water in flight to reduce the wing load, allowing them to land with less speed, or just keep in the air longer as thermals get weaker in the afternoon/evening

(source, I used to be a glider pilot)

But of course that doesn’t mean that airliners can’t glide well, the Gimly Glider and Air Transat flight come to mind. But gliders can definitely beat an airliner in terms of performance.

I am being serious, if you cannot tell.

I rough guessed the cost of fuel over a 737's life as $150 million. Where the engines cost something around $30 million. That pushes the engineering economics towards maximizing the engines efficiency.

I'm suspicious that bypass ratio's for turbofans are close to maxed out. The diameter of the fan gets unwieldy. That was the design issue that the 737 Max was trying to get around. With bad results. Possible the future is hybrid designs with two engines and 4 or more electrically driven fans.

The distinction is less pronounced nowadays, because there is no mondern aircraft designed as gliders-but-not-sailplanes, but historically there were planes that fit this niche, mostly military transport of WW1 and WW2 vintage.

Passenger jets (with engines turned off) are relatively decent gliders, but incapable of soaring. So no, you can't get more that about 20:1 glide ratio no matter how good is the weather (for sailplanes).

[1] https://en.wikipedia.org/wiki/CFM_International_CFM56#CFM56-...

2) It stays burned, but the energy is banked in potential energy of the aircraft, namely in a form of altitude. If you run out of fuel 5 feet above ground, you dont get to fly far. When you run out of fuel 35000 feet above ground, you can still choose where to land from multiple options.

3) huh? I dont get what you trying to say, but: Its always more economical to climb, and the faster the better. Ofc you cant climb too high when you intend to attempt to land in 5-10 mins, but nontheless, every feet gained is "banked", and the aircraft is more economical to run the higher you are.

4) I am not saying the winds arent a factor, and in no way I was arguing about how fuel reserves are calculated. My only claim is that: yes, by spending more fuel to gain altitude, you can then "glide" down almost for free later. Its not 1:1, because of constant losses like drag, but its being compensated by higher engine efficiency and less drag at altitude, that its always worth it to climb if you can.

There was a flight that was low on fuel diverting to alternate between 2 islands. The pilot panicked and chose slower climb to intuitively save fuel. They had to ditch the plane in water because of it - if they initiated full climb, they would have made the jump.

Actually, nothing in civil aviation that has a "jet engine" has used anything but a turbofan (or turboprop) since the early 70s with the exception of Concorde and some older business jets.

(Turboprops are jet engines, too, to be precise, with the jet of exhaust gases powering the propeller.)

They are certainly turbine engines, but I thought "jet" was reserved for those engines that propel the vehicle solely by their exhaust stream and bypass air. I am willing to be told I'm wrong, though.

  > fuel burned stays burned, you don't 'get it back'

So you only ever really lost your "altitude" component of energy, not "velocity" one. You run your engines at TOGA (Take Off / Go Around = maximum thrust), thrust to gain mainly altitude, only increasing speed a little bit. Then on another approach attempt you use both the altitude and excess velocity bank again.

In flight, ~all your energy losses go to drag. Doesn't matter if you bank it into speed or altitude, both is exchanged to be at minimums (0 altitude above ground, lowest safe landing speed) at touchdown. If you produce extra energy in your engines, it has to go to either speed or altitude, which you then pull out again, usually by maintaining speed while lowering altitude while having engines at idle.

Yes, you get a lot of the energy back, BUT there is a huge problem!

Large airliners incur a LOT of additional drag to slow down while landing. Some of that is entirely intentional, some is less intentional.

It is highly preferred to deploy the landing gear before touching down. Failure to do so may lead to a hard landing and additional paperwork, so airlines do not allow the captain to exercise their own discretion.

Extending the flaps maintains lift at lower speed, and higher flap settings allow even lower speed. The highest flap setting generally also deploys leading edge slats.

If the wheels of the airliner touch down and detect the weight of the plane then spoilers kill the lift of the wings, air brakes fully deploy, as well as thrust reversers.

All of these things add drag, which uses up all that energy you've been converting.

The upshot is that each landing attempt uses a LOT of energy, and you have to use fuel to replenish that energy after every attempt.

In other words, yes you get it back, but only for one landing attempt.

Indeed, which is what the airplane would have done on its way down to land. So it's more like riding the brakes on your way down the hill, and now at the bottom when you realize you need to abort the landing, you are at low speed and it's quite an exercise to get back uphill to try again

More dangerous than inadvertently spinning with too little airspeed is the possibility of shock cooling when relying on a forward slip for too much altitude loss. It really does need to be well-controlled.

In general forward slips are safe, but yes you have to make sure you keep the nose down/speed up. There's little in aviation that isn't dangerous if you aren't careful.

But not because “you don’t get the energy back”. (As recursive suggested about a downhill bike ride which is the part i am disagreeing with.) You do get it back, but because you want to land you bleed it away to drag. And once it is bled away you don’t have it anymore.

So we don’t disagree about the practical implications for flying. I’m disagreeing with recursive’s particular statement about downhill cycling and what it implies about the physics of the problem.

If you coast all the way down the first part, you'll get about 20 feet up the other hill before you need to start pedaling. This is a direct analogy to "getting your energy back" by losing elevation.

But you don’t have to believe me. Look at the video of this glider doing an unlicensed airshow: https://youtu.be/QwK9wu8Cxeo?si=L-0Mfmu8wk1ZlQU7

It is a glider so it can’t “pedal”. You can see it steeply descending from 5:13 to 5:30 while it is speeding up and then the pilot picks up the nose and trades some of his speed for elevation again. And then he does it again around the 7 minutes mark.

You have two buckets of “water”. One bucket is kinetic energy and the other is potential energy. You can trade one for the other. You can also “lose” from the total volume of “water” due to drag (or friction in the case of the bike or roller coaster). Or you can add more “water” to your system by pedaling or thrusting with your engines. This is just simple physics 101. Also simple lived experience if you ever have the opportunity to fly an airplane.

1: https://pedalchile.com/blog/uphill

It's not currently feasible to harvest it into fuel. It's (very very nearly) all lost to drag, on purpose.

One of the challenges of aeronautics is the efficient disposition of the potential energy without converting it all into kinetic energy (ie speed) so that the landing happens at an optimally low speed - thus giving you a chance to brake and slow down at the end.

An electric fan aircraft absolutely can recharge it's batteries on descent. The fans simply act as turbines, creating drag to slow the aircraft and electricity to charge the batteries. Large commercial airliners already have a small turbine that works this way, the Ram Air Turbine (RAT) which is used to generate electrical power in emergencies.

RAT is only used when sh*t hits the fan. Even then, it can help you power some hydraulics / electrical, not “store” energy for further flight.

The OP asked - in a low fuel situation, can the energy spent on a climb get effectively recovered - and the answer is not really. We convert as much as we can into unpowered (low-powered) descent. But once you are at a spot where you make a final decision to land or not, you are by design low and slow - and all that energy you had 15m ago is gone.

If you need to keep flying, those engines need to spool back up. And that takes fuel.

Isn't it when air hits the fan, technically?

(Sorry.)

Such aircraft do exist. For example, the Pipistrel Velis Electro trainer. And more recently, the Rhyxeon RX4E became the first electric aircraft to be type-certified for commercial passenger operations.

It's likely that we'll see many more electric fan aircraft in the coming years/decades, whether powered by batteries and/or hydrogen fuel cells, or hybrids with both conventional turbofan and electric propulsion in order to improve efficiency and environmental performance.

While it’s a real plane, I think we can both agree this is more of a prototype than what the general public would consider to be a passenger plane.

Yes, energy recovery is possible. It’s not happening currently in commercial aviation.

So the entire climb "up", you are also wasting energy fighting the thick air. On the way back "down", that air again fights you, even though you are basically at idle thrust.

Your fuel reserves are calculated for cruise flight, so time spent doing low altitude flying is already at a disadvantage. "Two hours of reserves" is significantly less than that spent holding at a few thousand feet. Fuel efficiency while climbing is yet again dramatically worse

It sounds to me like they tried harder at their intended destination than maybe they should have, followed by going to an alternate airport that probably wasn’t a good choice in the first place, and then having to divert to the final airport where luckily they could land in time.

§ 91.167 Fuel requirements for flight in IFR conditions.

(a) No person may operate a civil aircraft in IFR conditions unless it carries enough fuel (considering weather reports and forecasts and weather conditions) to—

(1) Complete the flight to the first airport of intended landing;

(2) Except as provided in paragraph (b) of this section, fly from that airport to the alternate airport; and

(3) Fly after that for 45 minutes at normal cruising speed

If the plane is going fast as well, that exhaust is more or less stationary relative to the ground. The engine works to exchange the position of the plane with the position of the air in front of it.

If the plane is going slow, it's accelerating the air backwards. That's where the work is going, making the engine less efficient.

Think about it this way: if the jet airplane is tied to the ground, its engines are running at 0% efficiency, working hard to blow the air backwards. You wouldn't want to stand behind a jet engine when the plane is about to take off, when that's effectively the case.

The same applies to propeller-driven planes, of course. But those can vary the prop speed as well as propeller pitch, having more control on how fast the air is being pushed backwards. This allows the engine to be efficient at a wider ranger of speeds, particularly, at the slower range.

But the propeller has a limit of how fast it can push the air back. When the prop blades start reaching the speed of sound, weird shit starts happening [1]. So propeller-driven aircraft have a limit on speeds at which they can go efficiently.

Jet engines (turbofans when it comes to airliners) trade off low efficiency at low speed / low altitude (where the airplane is spending a small percentage of flight time) for higher efficiency at high speed / high altitude.

Variable pitch turbine fans[2] aim to address this tradeoff, but the tech has yet to catch on.

[1] https://en.wikipedia.org/wiki/Republic_XF-84H_Thunderscreech

[2] https://en.wikipedia.org/wiki/Variable_pitch_fan

Jet needs to suck air from front. If air is stopped, sucking is hard. If air is already being thrown at you, you don't even need to suck, just let it come in.

This is one of the multiple layers of defense that airlines employ. In theory, no one single failure should cause a major incident because of redundancies and planning. Airlines rely on the "Swiss-cheese" model of safety. Each layer has its own risks and "holes" but by layering enough layers together there should be no clear path between all of the layers. In theory this prevents major incidents and given the commercial airline's safety records I'd say it works pretty fucking well. Landing with minutes of fuel left should be exceptional. But it also shouldn't be fatal or a major risk due to the other layers of the system. ATC will move heaven and earth to land a plane low on fuel or with engine trouble safely. And everyone else in the system having 30+ minutes of extra fuel gives the space for this sort of emergency sorting.

I think this also reflects on the "efficiency" that MBA types bring to companies that they ruin. If an MBA sees a dozen landings with an extra hour of fuel, their mind starts churning at saving money. Surely an hour of extra fuel is too much and just wasted. Wasted because every extra gallon of fuel you take off with is extra weight you have to carry throughout the flight. Surely things would be more efficient if we could make sure planes only carry enough fuel to make their trip with very minimal overhead. And when everything goes perfectly according to plan, these decisions work out fine. Money is saved. Bonuses are paid. But the inevitable always happens. That's why it's called inevitable. Lives are lost. Wrists are slapped. Some people at the bottom lose their jobs. The world moves on.

I have no clue how else to think about it though.

I.e. prevent the journey from occurring if weather conditions are likely to be adverse above a certain threshold?

They landed safely, that is what is important. There is great cost to have extra fuel on board, you need enough, but it doesn't look to me like more was needed. Unless an investigation determines that this emergency would happen often on that route - even then it seems like they should have been told to land in France or someplace long before they got to their intended destination to discover landing was impossible.

6 minutes is way out of the comfort zone. They might not have made it in that case.

So I don't think 220kg is enough to do a go-around in a 737 (well, a go-around would've been initiated with a bit more than 220kg in the tank - they burned some taxing to the gate - but you get my point.) I've read around 2,300kg for takeoff and climb on a normal flight in a 737-8. A go-around is going to use close to that, it's a full power takeoff but a much shorter climb phase up to whatever procedure is set for the airport and then what ATC tells you.

I just flew 172s but even with those little things we were told, your reserve is never to be used.

These people came very, very close to a disaster. Fortunately they had as much luck left as they did fuel.

ChatGPT suggests way lower numbers for take off / climb in a 737-8.

600-1000kg from brake to reaching cruise.

Straight from the horse’s mouth: https://web.archive.org/web/20230630013840/http://www.boeing...

In the first table they list 2307-2374 kg of fuel for takeoff and climb.

Isn’t a 737-8 the max 8 variant? It uses newer dual CFM LEAP-1B engines. How does it compare? I can’t really find the data. The spec you’re referring to is for the older 737-800.

Another fortune cookie:

https://www.aircraft-commerce.com/wp-content/uploads/aircraf...

It suggests an overall savings of ~14% over the 737-800 but doesn’t look at specific takeoff/climb comparison.

I wasn’t posting the LLM output as a source of truth. I was just using it to question the uncited value. And I still really don’t know the answer. If you’ve got another data source I’d love to get it.

They happen a few hundred times per day at ~100 k flights.

So yes they will do an "investigation". It's not a criminal investigation. It's to understand the circumstances, the choices, the procedures, and the execution that ended with a plane dangerously close to running out of fuel.

This will determine if there were mistakes made, or the reserve formula needs to be adjusted, or both.

Don't tell me about cost, just stop. Let MAGA-Air accept some plane deaths to have cheap fares.

Low fuel happens, but this is (very) exceptional.

https://globe.adsbexchange.com/?icao=4d2256&lat=54.720&lon=-... is the track of this flight.

Went around at EDI at about 19:10Z, landed at about 19:51Z, so about a 41 minute flight.

If you define X the amount of fuel you need after you land.

And you say that X needs to be enough to make an emergency landing.

And we define that the amount of fuel required for an emergency landing should cover the amount required for the landing operation while still having X in the tank when landed.

X > X + landing_cost

The plane already had made 3 failed attempt before and was redirected to two different airports.

0 minutes?

-1 minutes?

You're confused why they should investigate how everyone on that flight came within minutes of dying?

Something about the fuel reserves, procedures, or execution was clearly flawed.

Edit: Here is the Wiki on incidents... https://en.wikipedia.org/wiki/Fuel_starvation_and_fuel_exhau...

There were also two factors in the landing, that allowed for this to happen. You're going to be coming in really fast for a landing, when gliding in a commercial jet, and you don't have access to your thrust reversers to slow it down. There was a repurposed runway, that they used to land, that just happened to have been used as a drag racing track and had a guard rail. They were able to slow down by scraping across that. It also just so happened the nose gear didn't deploy fully so scraping the nose of the plane against the ground also helped slow it down.

Needless to say it was a bunch of very fortunate events that allowed it to not end in disaster. In any case I would consider it very risky.

You also have to keep in mind, it wasn't just rubber against asphalt, it was rubber on a wheel that spins. I'm not sure if the front nose gear on a 767 has any brakes but even if it did, I can't imagine it would be sufficient at the speeds they were going.

Rubber likely grips much better than metal, however three wheels have massively lower surface area than the body of the plane, or even a small section of it like the head.

Of course we don't land tireless for other reasons (metal transfers heat exceptionally well unlike rubber, paint doesn't survive high speed impact, and it tends to deform upon impact with anything, making any future flights unsafe), but the fastest way to slow down if you don't care about safety or comfort would probably be to land tireless, if you could introduce some rotational spin, that might be faster (more force directed in multiple directions).

Also, on the note of "coefficient of friction", remember that this number is not just some innate property of a molecule - as the metal scratches the pavement and deforms, its coefficient of friction goes up as micro-deformities accrue.

The Gimli Glider was a case of many items of luck lining up.

https://en.wikipedia.org/wiki/LaMia_Flight_2933

From "all engine failure is never expected and not covered in training" to "Pearson was an experienced glider pilot familiar with techniques rarely needed in commercial flights" to the amount of maneuvers they had to execute on a barely responding aircraft

I’m not an expert in this field, but it would seem that the weight of extra fuel would increase operating costs, so it’s is effectively insurance. How much extra fuel should be carried to account for unplanned events like this, while not carrying so much that it becomes cost prohibitive.

This is just clarifying the question from the perspective of an outsider.

That said, an investigation would be pretty reasonable, even if only to confirm that the abornamlity were forces majeures

- This does not happen once every 100k flights. That's once per day

- If this were happening once every 100k flights we would be adding another half hour to the reserve tomorrow.

If you ever cut into your safety allowance, you've already fucked up. Your expected design criteria should account for all use cases, nominal or worst-case. The safety factor is there for safety, it is never intended to be used.

The approach is basically “accounting for everything that might go wrong to the best of our experience, including problems arising from the complex interactions between the airplane and supporting ground systems and processes, this is how much fuel you need in the worst case scenario. And now lets add more to give us a cushion, and we will treat consumption of this last reserve as tantamount to a crash.”

One of the most important aspects of taking safety seriously is that you do not just investigate things which had an impact, but that you proactively investigate near misses (as was the case here) and even potential incidents.

A plane with 6 minutes of fuel left is always a risk to every person on board and potentially others if an emergency landing becomes the only option.

The investigations into incidents aren't usually particularly long or noteworthy and often the corrective action will be to brief X on dangers of Y, or some manner of bulletin distributed to operators.

Of course, Manchester is also a Ryanair base. There are two Ryanair bases closer to Prestwick (Edinburgh and Newcastle), but maybe the weather was bad there too? If the fuel situation was so dire, questions might be asked during the investigation why they didn't pick a closer airport with good weather that wasn't a Ryanair base (if one existed), but ultimately it's the pilots' decision to fly a bit further to an airport they are familiar with, and second guessing them with the benefit of hindsight is probably not a good idea...

It may even be the answer is "no, everything went as well as it possibly could have, and adding more reserve fuel to every flight would be unacceptably wasteful, so oh well", but at a minimum they'll probably recommend even more fuel on certain flights into risky weather.

Do you shrug and say, that's why they have a safety factor, everything worked as intended? Or do you say, holy crap, I nearly died, how did this happen?

The purpose of the safety factor is to save you if things go badly wrong. The fact that it did its job doesn't mean things didn't go badly wrong. If you don't address what happened then you no longer have a safety factor.

Personally, I’d still want to figure out why I got shot and work on making sure that didn’t happen again.

Especially if you basically got shot multiple times (for an analogy in this case).

Similarly planes are kept 5 nautical miles apart horizontally, and if they get closer than that, you guessed it - investigation. Ofc planes could come within inches and everyone could live, but if we normalize flying within inches, the we are also normalizing zero safety margin, turning small minor inevitable human failings into catastrophe death & destruction. As an example, planes communicate with ATC over the radio and are given explicit instructions - turn left 20 degrees, fly heading 140 etc. From time to time these instructions are misunderstood and have to be corrected. At 5nm separation everyone involved has plenty of time to notice that something was missed/garbled/misinterpreted etc and correct. At 1 inch separation, there's no such time. Any mistake is fatal, even though in theory you are safe when separated by 1 inch.

TBC an investigation doesn't mean investigating the pilots in order to assign blame, it means investigating the entire aviation system that led up to the breach. The pilot's actions / inaction will certainly be part of that, but the goal is to ask, "How could this have been avoided, and ask how every part of the system that we have some control or influence over might have contributed to the outcome"

We should aim for 1 every 10-100 years or something reasonable like that.

Any regulation short of "carry infinite fuel" will be a trade-off, and entail some risk and anyone involved in setting these knows that. Zero may not be our actual target or even possible, but it is a useful aspiration to ensure that everyone is pulling in the right direction.

Likewise, I think that the flying public is lead to believe fuel exhaustion is so rare that when airlines are compliant with regulations, no such disasters across all flights across all carriers will occur during your lifetime.

* they're derived from an estimated probability of the event (independently) happening each year. It doesn't mean that it won't happen for n years. The probability is the same every year.

* the probabilities are estimates, trying to predict extreme outliers. Usually from less than 100s of years of data, using sparse records that may have never recorded a single outlier.

* years = 1/annual_probability ends up giving large time spans for small probabilities. It means that uncertainty between 0.00001% and 0.00002% looks "off by 500 years".

https://practical.engineering/blog/2025/9/16/an-engineers-pe...

This should not happen. So what’s there to investigate? How it was allowed to happen, and how to prevent it from happening again.

EDIT: it’s a mayday even earlier than that. It’s a mayday once the pilots know that they WILL land with less than the final reserve.

So because the safety margin still worked while down to near vapors we should conclude there's nothing to learn for the future to reduce the risk of similar incidents?

That's certainly... a take.

Aviation operates on a Swiss cheese model; the idea is that you want many many layers of safety (slices of cheese). Inevitably, every layer will have some holes, but with enough layers, you should still be safe; there won't be a hole that goes all the way through. In this case, they basically got down to their very last slice of cheese; it was just luck that the last layer held.

One of the things the reserve is for is if the plane immediately in front of you fucks up the runway, you now have to divert to the next airport. You need at least enough fuel to get there and for the tower to shove everyone else out of the way so you can make an emergency landing.

There are other reasons someone could abort a landing and have to go around again, besides debris in the runway. And sometimes two of them can happen consecutively.

In the case I’m referencing, it was pointed out that p the pilot made things worse by going faster than he was told to fly, using up fuel and also making him too close to a previous plane which forced him to go around the previous time, so it wasn’t all the tower.

Might even be 100% done by the book but book needs changing (tho I doubt that, it's not exactly first case of "a lot of bad weather")

Besides regular weather (which airliners aim to avoid except during take off and landing) there are many other factors at play here. There are several almanacs that are used for fuel calculations & navigation, they are updated annually.

The fastest jet stream (the aviation equivalent of the trade winds) recorded is north of 400 Kph, having that with you, against you or perpendicular to your flight path will have a substantial influence on fuel consumption and flight duration.

I agree with you that it may well end up with a regulatory change but that's one of many possible outcomes here. I will definitely keep an eye out for the report on this flight's investigation. It is going to make for very educational reading.

I don't remember all of the rules off the top of my head, but if you are ever landing with less than 30 minutes of fuel, something has gone seriously wrong. You are required to take off with sufficient fuel to fly to your destination, hold for a period of time, attempt a landing, fly to your alternate, and land all with 30 minutes remaining. If you are ever in a situation where you may not meet these conditions, you are required to divert immediately. In choosing your alternate, you consider weather conditions along with many other factors. This was, without question, a serious emergency.

From the very brief description in the article, I would say they should have diverted to Manchester at least 25 minutes sooner than they did. I will include the GP's caution, however:

I'd be very wary to get ahead of the investigation and make speculative statements on how this could have happened, the one thing that I know for sure is that it shouldn't have happened, no matter what.

If at any point you expect to touch down at the nearest safe airport with less than 30 minutes of fuel remaining, you are required by regulation to make a mayday call.

Mayday is a term enshrined in law. It is only to be used when people will die if you do not receive help. In the US, calling it inappropriately can be punished with up to 10 years in jail and a $250k fine. It's protected in this way because as soon as you call mayday, in many situations there are actions that must be taken by law or regulation. Other appropriate uses include things like "our plane is on fire" or "our wing just fell off and we can't steer the plane".

As soon as you think you can't land with the fuel reserves you are _required_ to call mayday, other pilots are _required_ to clear the radio for you, and ATC is _required_ to provide any and all supported possible until you're on the ground.

The investigation is not to figure out who to send to jail or something. The investigation is because a flight just came this >< close to having hundreds of people die. That fuel is there as a safety margin, yes. That's how everyone ended up walking off this plane instead of dying as the plane was ripped apart by some trees somewhere. That is good.

But air travel did not become as safe as it with an attitude of "this hasn't killed anyone yet, all good". The fact there was an incursion into the safety margin should not be looked at as "eh, working as intended" but "holy hell we just came this close to disaster, what went wrong that almost killed all these people? how do we stop that happening again?". That is what an investigation will be looking to figure out.

To put it in vaguely IT terms, this is something like... your application has started corrupting its database, but you have _a_ backup copy. On one hand, you can think "eh, we have a backup, that's what it's there for, who cares". On the other you can go "holy shit, any time we need to restore from the backup we narrowly averted disaster... how do we make sure we're not in that situation again?". The former is probably going to lead to irrecoverable data loss eventually. The second will have you addressing problems _before_ they ruin you.

From the article, they did issue a mayday call, when the closest airport was presumably Edinburgh. Then they flew to Manchester and landed.

hazardous state + environmental conditions = accident

Since we can only control the system, and not its environment, we focus on preventing hazardous states, rather than accidents. If we can keep the system out of all hazardous states, we also avoid accidents. (Trying to prevent accidents while not paying attention to hazardous states amounts to relying on the environment always being on our side, and is bound to fail eventually.)

One such hazardous state we have defined in aviation is "less than N minutes of fuel remaining when landing". If an aircraft lands with less than N minutes of fuel on board, it would only have taken bad environmental conditions to make it crash, rather than land. Thus we design commercial aviation so that planes always have N minutes of fuel remaining when landing. If they don't, that's a big deal: they've entered a hazardous state, and we never want to see that. (I don't remember if N is 30 or 45 or 60 but somewhere in that region.)

For another example, one of my children loves playing around cliffs and rocks. Initially he was very keen on promising me that he wouldn't fall down. I explained the difference between accidents and hazardous states to him in childrens' terms, and he realised slowly that he cannot control whether or not he has an accident, so it's a bad idea to promise me that he won't have an accident. What he can control is whether or not bad environmental conditions lead to an accident, and he does that by keeping out of hazardous states. In this case, the hazardous state would be standing less than a child-height within a ledge when there is nobody below ready to catch. He can promise me to avoid that, and that satisfies me a lot more than a promise to not fall.

The reason they had less than 30 minutes of fuel was because the environment wasn't on their side. They started out with a normal amount of reserve and then things went quite badly and the reserve was sufficient but only just.

The question then is, how much of an outlier was this? Was this a perfect storm that only happens once in a century and the thing worse than this that would actually have exhausted the reserve only happens once in ten centuries? Or are planes doing this every Tuesday which would imply that something is very wrong?

There are multiple controllers interacting with the system (the FADEC computer in the engines, the flight management computer in the plane, pilots, ground crew, dispatchers, air traffic controllers, the people at EASA drafting regulations, etc.), trying to keep it outside of hazardous conditions. They do so by observing the state the system and the environment is in ("feedback"), running simulations of how it will evolve in the future ("mental models"), and making adjustments to the system ("control inputs") to keep it outside of hazardous conditions.

Whenever the system enters a hazardous condition, there was something that made these controllers insufficient. Either someone had inadequate feedback, or inadequate mental models, or the control inputs were inoperational or insufficient. Or sometimes an entire controller that ought to have been there was missing!

In this case it seems like the hazard could have been avoided any number of ways: ground the plane, add more fuel, divert sooner, be more conservative about weather on alternates, etc. Which control input is appropriate and how to ensure it is enacted in the future is up to the real investigators with access to all data necessary.

-----

You are correct that we will not ever be able to set up a system where all controllers are able to always keep it out of hazardous states perfectly. If that was a thing we would never have any accident ever – we would only have intentional losses that are calculated to be worth their revenue in additional efficiency.

But by adopting the right framework for thinking about this ("how do active controllers dynamically keep the system out of hazards?") we can do a pretty good job of preventing most such problems. The good news is that predicting hazardous states is much easier than predicting accidents, so we can actually do a lot of this design up-front without first having an accident happen and then learning from it.

I don't think this philosophy can work.

If you can't control whether the environment will push you from a hazardous state into a failure state, you also can't control whether the environment will push you from a nonhazardous state into a hazardous state.

If staying out of hazardous conditions is a dynamic control problem requiring on-the-fly adjustment from local actors, exactly the same thing is true of staying out of failure states.

The point of defining hazardous states is that they are a buffer between you and failure. Sometimes you actually need the buffer. If you didn't, the hazardous state wouldn't be hazardous.

But the only possible outcome of treating entering a hazardous state as equivalent to entering a failure state is that you start panicking whenever an airplane touches down with less than a hundred thousand gallons of fuel.

Flight plans require you to look at the weather reports of your destination before you take off and pick at least one or two alternates that will let you divert if the weather is marginal. The fuel you load includes several redundancies to deal with different unexpected conditions[1] as well as the need to divert if you cannot land.

There have been a few historical cases of planes running out of fuel (and quite a few cases of planes landing with only reserve fuel), and usually the root cause was a pilot not making the decision to go to an alternate airport soon enough or not declaring an emergency immediately -- even with very dynamic weather conditions you should have enough fuel for a go-around, holding, and going to an alternate.

[1]: https://www.casa.gov.au/guidelines-aircraft-fuel-requirement...

That being said, the fact that (AFAICS) they first tried to divert to a closer airport where the weather was similar rather than an alternate with clear weather was probably one of the causes of this event.

As for 'N', for turboprops it is 45, for jets it is 30.

I intend to come back to it some day, but I do not think that day is today.

Just a thought I had while reading your introduction: this is applicable even to running a successful business model. I'm honestly having trouble even putting it into words, but you have my analytical mind going now at a very late hour... Thanks!

(Knowing, of course, that it will still be read mainly by engineers. But that's the charm.)

Edit: please post your link from above as a separate submission.

Also, your train-of-thought is pretty deep; bulleting runs out of steam and gets visually confusing, especially with the article table-of-contents on RHS, you're only using <50% of screen width. Suggest you need numbered/lettered lists and section headings and use the full screen width.

(note: obviously sarcastic but kids really do have some amazing insights that we forget when trying to chase KPIs or revenue)

    #12: One of my advisors will be an average five-year-old child. Any flaws in my plan that he is able to spot will be corrected before implementation.
    #60: My five-year-old child advisor will also be asked to decipher any code I am thinking of using. If he breaks the code in under 30 seconds, it will not be used. Note: this also applies to passwords.
    #74: When I create a multimedia presentation of my plan designed so that my five-year-old advisor can easily understand the details, I will not label the disk "Project Overlord" and leave it lying on top of my desk.

(Will now be checking out your blog.)

https://catless.ncl.ac.uk/Risks/

That being said: I have - for some years now - started to read air accident board reports (depending on your locale, they may be named slightly different). They make for a fascinating read, and they have made me approach debugging and postmortems in a more structured, more holistic way. They should be freely available on your transportation safety board websites (NTSB in America, BFU in Germany, ...)

https://sre.google/stpa/teaching

Disclaimer: currently employed by Google, this message is not sponsored.

I think about 30 minutes worth of fuel.

Not knowing their flight plan, it could have been that Edinburgh was the first alternate and Manchester the second alternate.