System of Denial: The crash of Comair flight 3272
On the 9th of January 1997, a Comair commuter flight was maneuvering for approach to Detroit, Michigan, when the plane abruptly flipped upside down and plummeted 4,000 feet to the ground, instantly killing all 29 passengers and crew. Caught by surprise, there was nothing the pilots could do to save their plane — by the time they realized anything was wrong, the aircraft was already hopelessly out of control.
When NTSB investigators arrived at the scene, they might not have realized that the Comair disaster would take them down an organizational and regulatory rabbit hole of unfathomable proportions. The proximate cause — ice on the wings — turned out to be only a tiny part of a much broader and more troubling story, one which involved research that went unheeded, a history of close calls involving the Embraer EMB-120 Brasilia, a series of troubling miscommunications, and a persistent myth about flight in icing conditions that was putting passengers around the world in danger. The findings showed that this danger was sitting there in plain sight, and it seemed that almost everyone was aware of it except for the people who most needed to know. Indeed, Comair flight 3272 was an accident caused not by the actions of a pilot or even a company, but by the breakdown of the regulatory system itself — a series of boardroom decisions and failed attempts to communicate critical information which condemned 29 people to death long before their ill-fated flight ever took off.
◊◊◊
If one had to guess the largest airline that you’ve never heard of, the now-defunct Comair might be high on the list. Founded in 1977, at its peak Comair was the world’s biggest regional airline, with over 170 planes operating short-haul flights throughout the US Midwest and South on behalf of Delta Airlines. Delta was a major stakeholder, and Comair flights normally flew under the brand name Delta Connection, so if you flew with Delta Connection in the aforementioned regions in the 1990s or 2000s, you were probably flying with Comair, whether you realized it or not.
Before Comair switched to an all-jet fleet in the 2000s, the airline operated a large number of Brazilian-made Embraer EMB-120 Brasilia twin turboprops, which flew short routes with up to 30 passengers. The hub for these operations was Cincinnati, Ohio, and it was there, on an utterly ordinary winter day in January 1997, that we pick up the story of flight 3272 — a story that was in fact already in its final chapter.
Flight 3272 was a regularly scheduled service from Cincinnati to Detroit in neighboring Michigan, operated by an EMB-120. On January 9th, this flight was mostly full, with 26 passengers and three crew on board. In command were 42-year old Captain Dann Carlsen and and 29-year-old First Officer Kenneth Reece, who had a combined 2,500 hours on the EMB-120. Both were remembered by their colleagues as knowledgeable and conscientious pilots who took their jobs seriously; both had passed training with flying colors.
Before flight 3272 even left the ground, the pilots knew that they would face bad weather all the way to Detroit. In fact, their pre-flight weather information package, generated automatically by the airline, included a number of warnings about light to moderate ice and turbulence in clouds along their route, including in the Detroit area.
Ice in particular is something to which the pilots of any small plane must pay attention. When flying in clouds with a high moisture content at temperatures near freezing, ice tends to accrete on the cold, metal exterior of an aircraft, especially on the leading edges of the wings and tail, where it can interfere with the smooth airflow that keeps the airplane aloft. This can be particularly dangerous for small aircraft like the EMB-120, because their smaller wings are more easily affected by quantities of ice that would not trouble a plane with bigger lifting surfaces. For that reason, the EMB-120, like all transport category aircraft, was equipped with capable anti-icing and de-icing systems to ensure that all critical areas, including the propellers, important sensors, and the leading edges of the wings and tail, could be kept ice-free in all but the most severe conditions.
Aware that they would likely encounter icing conditions as they approached Detroit, the pilots lined up with the runway and took off at 15:09, climbing away through the dense clouds which blanketed the region. With First Officer Reece at the controls, they climbed to their cruising altitude of 21,000 feet, comfortably above the storms and turbulence. The brief cruise phase proceeded without incident, and at 15:39, flight 3272 was cleared to begin its descent into Detroit. Four minutes later, Captain Carlsen contacted Detroit approach control to report that they were at 11,000 feet, and the controller began directing the flight toward an instrument approach to runway 3R at Detroit Metropolitan Wayne County Airport.
At the approach control facility, controllers were dealing with a buildup of traffic due to poor weather conditions in the area. With numerous aircraft on approach, controllers worked to slot each of them into the sequence as safely as possible, trying to keep an adequate distance between them. Flight 3272, being a relatively slow turboprop, did not have the highest priority — it would have to yield to faster and less maneuverable jets. And so at 15:45, upon making contact with an America West Airbus A320 heading for the same runway, the controller ordered flight 3272 to reduce its speed to 190 knots so that the A320 would have time to slip into the sequence ahead of it. Captain Carlsen acknowledged, and the controller followed up with a clearance to descend to 7,000 feet.
At 15:47, descending toward 7,000, First Officer Reece announced, “Let’s run the descent check.”
Captain Carlsen pulled out the checklist and read off the first item. “Ice protection?”
“Windshield, props, standard seven,” Reece replied.
“Ignition?” Carlsen asked.
“Auto,” said Reece.
His decision to turn on the “standard seven” anti-icing systems, which protected the windshield, props, and five major sensors, showed that he was aware that they were flying into icing conditions. So was the decision to turn on engine auto-ignition, which was consistent with Comair’s guidance for flying in the presence of ice.
As the plane continued to descend on autopilot, the pilots finished the descent check, and the clouds closed in around them. Tiny droplets of near-freezing precipitation surrounded the plane, slowly adhering to the wings and tail, but the layer of ice was so thin that the pilots could hardly have noticed.
At 15:49, recognizing that flight 3272 would still come in too close behind the A320, the controller called the pilots and told them to reduce their speed again, this time to 170 knots. Captain Carlsen acknowledged, and First Officer Reece rolled back the throttles until the plane achieved the new speed. Carlsen then made a routine report to company operations, while First Officer Reece monitored the progress of the flight and the performance of the autopilot. As far as he could tell, everything was normal.
At 15:52, a new controller contacted flight 3272 and cleared them to descend to 4,000 feet. One minute later, still concerned about separation, the controller said, “Comair thirty-two seventy-two, turn right heading one eight zero, reduce speed to one five zero.”
“Heading one eight zero, speed one five zero, Comair thirty-two seventy-two,” Captain Carlsen acknowledged.
The controller didn’t seem to hear him. “Comair thirty-two seventy-two, reduce speed to one five zero,” he repeated.
Captain Carlsen acknowledged again, and First Officer Reece said, “This guy’s got — ”
“They always gotta tell us twice,” said Carlsen.
“He’s got a short term memory disorder, I think,” Reece joked.
“Is that what that is?”
“Yeah, he’s got Alzheimer’s, that’s what it is,” said Reece. Without any hesitation, he rolled back power again, letting the speed drop from 170 knots toward 150 knots.
Outside the plane, ice continued to build up on the wings, forming a thin, almost imperceptible layer. Slightly at first, but increasing in salience, this layer of ice began to interfere with the airflow over the wings, altering their fundamental aerodynamic characteristics.
To understand the importance of this effect, it helps to review some basic principles of aerodynamics. In normal flight, the amount of lift produced by a wing is a function of several factors, including, most importantly, airspeed, and the angle of the wing into the airstream, or angle of attack (AOA). As angle of attack increases, lift increases, but because more of the wing faces into the oncoming air, drag also increases, which causes airspeed to decrease. An inverse relationship thus exists between airspeed and angle of attack: as one increases, the other decreases, maintaining a constant amount of lift. However, this relationship only remains true up until the angle of attack reaches the critical point, where the air can no longer flow smoothly over the top of the wing, resulting in a dramatic reduction in the wing’s lifting capability. This causes the airplane to stall and fall from the sky.
Normally, an airplane in a certain configuration and at a certain altitude will always stall at the same, predictable angle of attack, regardless of its speed, pitch attitude, or any other parameters. This predictability allows for the incorporation of stall warning systems, which activate when the angle of attack reaches a particular pre-programmed value well below the critical AOA.
The insidious thing about ice on the wings is that it disrupts this predictable balance. By interfering with the airflow over the top of the wing, a layer of rough ice will cause the wing to stall at a lower than normal angle of attack. This reduces the margin between the predetermined activation threshold of the stall warning and the actual stall, in some cases by so much that the plane actually stalls before the stall warning goes off.
◊◊◊
At 15:53 and 59 seconds, as flight 3272 approached 4,000 feet, the controller instructed the pilots to turn left to a heading of 090 degrees, or due east. Captain Carlsen acknowledged, and First Officer Reece entered the new heading into the autopilot control panel. The autopilot began to turn to the left at 15:54 and 5 seconds; three seconds after that, with the speed still dropping toward 150 knots, the plane reached 4,000 feet and leveled off automatically.
In order to maintain 4,000 feet at this reduced airspeed, the autopilot needed to keep the amount of lift constant by increasing the angle of attack, taking advantage of the inverse relationship described above. In normal flight, this would not have presented a problem, but what neither the pilots nor the autopilot realized was that the buildup of ice on the wings had made this impossible: in fact, in order to maintain lift at a speed of 150 knots, the required angle of attack was higher than the reduced critical AOA caused by the ice. Unless the pilots immediately increased their speed or pitched down to reduce the AOA, the plane was going to stall.
Five seconds after the start of the left turn, the bank angle reached 23 degrees, which the autopilot deemed sufficient to complete the turn to heading 090. In response, the autopilot started to move the controls back to the right — but the plane didn’t respond.
In fact, at an airspeed of 156 knots and falling, the angle of attack was already approaching the critical point, and the left wing was beginning to stall. During a stall in a turn, the inside wing typically loses lift first; as a result, the left wing started to drop, and the left bank continued to steepen, despite the autopilot’s attempts to turn back to the right. In fact, turning right might have made the loss of lift even worse, because the ailerons control bank angle by increasing the angle of attack on the “up” wing, which in this case was the already compromised left wing.
Still unaware that the autopilot was losing control of the plane, First Officer Reece observed that their speed was approaching 150 knots and increased engine power to prevent it from decreasing further. However, due to the excess drag from the ice and the high angle of attack, his input was insufficient, and the speed kept decreasing. A split second later, it dropped below 150 knots, and a warning light flicked on to inform the pilots that they were overshooting their speed target. “Looks like your low speed indicator,” said Captain Carlsen.
“Thanks,” said Reece, increasing engine power even more. For unknown reasons, the right engine spooled up to a power output 30% higher than the left engine, further exacerbating the plane’s desire to pull to the left — either because Reece was sloppy with the throttle levers, or because the left engine had ingested ice. Either way, the asymmetric thrust significantly worsened the situation. The left roll rate increased rapidly, until the plane banked beyond the autopilot’s authority limit, reaching 45 degrees within four seconds.
At that exact moment, the stall warning burst into life, shaking the pilots’ control columns to warn them of an imminent loss of lift, although by that point the left wing had already stalled. As per the system’s design logic, the activation of the stick shaker stall warning in turn caused the autopilot to disconnect with three rapid-fire chimes.
As soon as it disconnected, the autopilot ceased its attempts to turn to the right, and the controls snapped back to the left. The effect of this input was catastrophic, as the plane rolled from 45 degrees to 146 degrees left in less than two seconds. Before the pilots could even figure out what was going on, the plane was upside down and plummeting from the sky.
“Oh shit!” Captain Carlsen exclaimed, reaching for his control column to assist First Officer Reece. But the plane was already out of control, in an inverted dive, pitching toward 50 degrees nose down.
“BANK ANGLE,” said an automated warning system. “BANK ANGLE!”
The plane rolled wildly from side to side as it plunged toward the ground, the pilots frantically shouting as they fought for control, alarms blaring in the cockpit. But there was precious little time for them to recover at such a low altitude. The cockpit voice recorder captured one last exclamation of terror, and then, just 16 seconds after the autopilot disconnected, flight 3272 plowed nose first into a snow-covered field at enormous speed. The plane utterly disintegrated, gouging out a crater in the earth and throwing debris high into the air, leaving behind only a blackened smear across a sea of white.
◊◊◊
Although first responders rushed to the scene of the crash, located in rural Monroe County some 30 kilometers southwest of the airport, they found only a smoking hole in the ground surrounded by mangled wreckage. There was no possibility of survival; all 29 passengers and crew had died instantly on impact.
As news of the disaster spread, the National Transportation Safety Board launched a team of investigators which arrived in Michigan late that night. Setting to work the next morning, they recovered the flight recorders, interviewed witnesses, and reviewed relevant documentation. It didn’t take long, however, before they began to suspect that flight 3272’s sudden demise had something to do with ice. After all, the forecast called for icing conditions over the accident site, and what’s more, other pilots encountered ice accumulation in that same area. In fact, the pilots of Northwest Airlines flight 272, a DC-9 flying two minutes behind the ill-fated turboprop, encountered moderate to severe icing which built up at a rate of about 1/2 inch (1.27 cm) per minute, forcing them to request a change of route.
The black box data confirmed that flight 3272 suffered from a performance degradation which could only have been the result of ice on the wings. All parameters were normal until the last five minutes of the flight, after the plane began its descent from 7,000 feet. From then on, its speed decayed more quickly than expected, and the autopilot had to make larger control inputs to attain the desired flight path. Then, when they leveled off at 4,000 feet, the aircraft started to stall at a speed of 155 knots. At that configuration and altitude, the stall angle of attack would normally be reached at 114 knots; therefore, the stall AOA must have been reduced by the presence of ice, allowing a stall to occur at a higher than normal airspeed.
Simulator tests showed that the pilots had few opportunities to recover. If they had been flying manually, they would have noticed the degradation in performance, but in the event, the autopilot masked the fact that the plane was not flying normally. The first indication that something was wrong was when the autopilot tried to turn to the right, only for the plane to keep turning left. Within seconds, the bank angle increased beyond 30 degrees, the maximum which could be commanded by the autopilot; the fact that this occurred meant something was wrong by definition, but there was no alarm to alert the crew. The pilots finally noticed signs of trouble when their airspeed did not stabilize at 150 knots despite First Officer Reece’s attempt to add power, but before they could fully comprehend the situation, the autopilot disconnected automatically, the controls snapped to the left, and the plane rolled upside down in just 1.8 seconds.
This increasing left roll occurred because the inside wing had begun to stall. Since this wing was not flying, the autopilot’s attempts to turn right using the controls were ineffective; the only way to level out was to restore normal airflow over the wing by decreasing the angle of attack. However, because the stall warning did not go off until after the stall had begun, the pilots were not made aware of the problem until it was too late. And finally, the unlucky coincidence of the asymmetric engine thrust did them in: in fact, tests showed that without the thrust imbalance, the left roll rate would have been sufficiently reduced for the pilots to have gained control before the plane rolled inverted. In the event, they reacted quickly, taking manual control less than two seconds after the autopilot disconnected, but the roll rate was so rapid that it would have taken superhuman reflexes to keep the plane right-side-up. At that point, they were all but doomed — considering the speed of the resulting dive and the degradation of the controls due to the ice, there simply wasn’t enough time to recover before hitting the ground.
In interviews with investigators, many other Comair pilots expressed doubt that it was safe to decelerate to 150 knots in known icing conditions, and some said that they would have asked the controller to assign them a higher airspeed — but none could provide a consistent answer as to what the minimum speed in icing conditions actually was. Some said it was 160 knots, others said it was 170, still others said there was no firm minimum and that it was up to the pilot’s judgment. This last group turned out to be correct, as a thorough examination of Comair’s manual showed only a minimum of 170 knots specifically while holding in icing conditions. The Flight Standards Manual (FSM) in fact contained no minimum speed applicable to the “maneuvering for approach” phase which flight 3272 was in when it crashed. Comair had issued a memo in December 1995 instructing pilots not to fly below 160 knots in icing conditions during any phase of flight, but it was only posted for 30 days, and there was no mechanism to ensure that pilots had read it.
Because of this lack of specific information, it was up to the pilots to decide whether an order to decelerate to 150 knots was appropriate for the conditions or not. The pilots of flight 3272 were clearly aware that they were in conditions where icing was possible, given that they activated the “standard seven” anti-icing systems, but the rest of their conversations suggested that they were unaware of any ice buildup on their plane, and in fact they probably thought everything was normal until very shortly before the end.
The NTSB did conclude that the pilots’ decision to accept a speed of 150 knots contributed to the accident, because it would have been more prudent to fly faster under the circumstances. However, their report also issued a forceful rebuttal to those who sought to blame the pilots entirely: “During the investigation of this accident,” they wrote, “arguments were made that the pilots caused the accident because they accepted an airspeed 10 knots slower than Comair’s FSM recommended for holding in icing conditions. However, the Safety Board notes that an EMB-120 … operated at 150 knots without any ice accretions, would have a 36-knot margin between its operating airspeed and the stall speed. This margin would likely appear to be an adequate safety margin to a pilot who did not recognize that the airplane was accumulating ice.”
All of this analysis showed that an insidious performance degradation occurred which placed the pilots into an unrecoverable situation with little to no warning. That raised two important questions: how much ice was actually on the plane, and were the conditions better or worse than those which the EMB-120 was certified to withstand?
To answer the first question, the NTSB turned to the National Center for Atmospheric Research, or NCAR, in order to analyze the weather data and estimate the intensity of the icing encountered by flight 3272. The scientists at NCAR found that light icing was probable below 7,000 feet, while moderate icing was probable in a narrow band between 3,900 and 4,100 feet. Above 4,100 feet, the diameter of the freezing droplets in the cloud would have been very small, in the vicinity of 10–30 microns (a micron being one millionth of a meter). Droplets of this size were not considered by the FAA to be hazardous to aircraft. In the 4,000-foot zone, the size of the droplets could have ranged between 40 and 400 microns, edging into the potentially dangerous zone, but the airplane was only in this altitude range for 25 seconds before the loss of control. That meant that the bulk of the ice on the wings of flight 3272 probably came from tiny droplets less than 40 microns in diameter accumulated during its five-minute descent from 7,000 feet.
This discovery was especially important because droplets under 40 microns in diameter fell within the range that the EMB-120 was certified to withstand without experiencing any controllability issues.
According to the Federal Aviation Regulations, Part 25, Appendix C, to be certified to fly in icing conditions, an airplane’s manufacturer was required to prove that no adverse control behavior would occur if the plane was continuously exposed to freezing droplets up to 50 microns in diameter for up to 45 minutes. Manufacturers typically demonstrated compliance by covering the wings of an airplane with “artificial ice shapes” designed to mimic a worst-case accumulation of ice under the aforementioned conditions. While working to get the EMB-120 Brasilia certified by Brazil’s Centro Tecnico Aeroespecial, or CTA, and the US Federal Aviation Administration (FAA), Embraer had flown an EMB-120 fitted with irregular ice shapes up to 7.6 centimeters in length over a large portion of the wing, as well as ice shapes up to 1.9 centimeters on areas protected by deicing equipment, and found no controllability issues. Transport Canada conducted additional tests while certifying the EMB-120 to operate in that country, and similarly found no problems. In fact, the tests showed that even with these large ice shapes attached to the wings, the plane would reach the stall AOA at an airspeed of about 136 knots, well below the speed of flight 3272 when it went out of control.
At this point, you’re probably asking: if the EMB-120 was totally controllable when exposed to icing for 45 minutes, why did flight 3272 lose control after just five? It was here that investigators noted a potentially important difference between the certification tests and the actual flight: namely, that the pilots of flight 3272 hadn’t activated all of their deicing equipment.
The most important deicing systems on the EMB-120 are the wing leading edge deicing boots. When turned on, these rubber boots embedded in the leading edges of the wings inflate and deflate cyclically, cracking away layers of ice which develop in flight. Since ice on the leading edge produces the most adverse aerodynamic effects, the deicing boots are very effective at mitigating the consequences of in-flight icing, as long as the rate of ice buildup falls within the boundaries of FAR Part 25 Appendix C. Furthermore, the certification tests for flight in icing conditions assumed that the pilots would activate all deicing systems, including the leading edge deicing boots.
However, on flight 3272, the performance analysis suggested that there was no cyclical removal of ice buildups during the plane’s descent from 7,000 feet. Furthermore, neither of the pilots ever mentioned activating the deicing boots — only the anti-icing systems for the propellers, windshield, and sensors. If the deicing boots were not activated, could that explain why the behavior of flight 3272 differed from the certification tests? The answer would turn out to be way more complicated than it might seem at first glance.
◊◊◊
As all of this was going on, scientists at NASA were conducting tests on a representative wing in a special chamber designed to replicate in-flight icing conditions. What they found was that even with the deicing boots inactive, flight 3272 would have accumulated only a thin layer of ice no more than 0.625 cm in thickness. This was much less severe than the 7.6-cm ice shapes used in the certification tests. However, at this point the scientists made an important discovery: although this layer of ice was thin, it was very rough, with a sandpaper-like consistency, which resulted in severe aerodynamic degradation. In fact, the effects of a layer of sandpaper-type ice accumulated after just five minutes in normal icing conditions were as great or even greater than the effects of the massive artificial ice shapes using in testing. Only trace amounts of this ice were required to increase the stall speed by 30% and drag by 40%, and further accumulation made little to no difference. Not-so-coincidentally, a 30% increase in a stall speed of 114 knots produced a new stall speed very close to that at which flight 3272 actually stalled. However, according to NASA, activating the deicing boots prior to entering these conditions would significantly reduce the danger.
These tests showed that despite theoretically falling within the boundaries of FAR Part 25 Appendix C in terms of droplet size and length of exposure, the icing conditions encountered by flight 3272 resulted in a particular pattern of buildup which, unless the deicing boots were activated, would induce worse aerodynamic degradation than anything encountered in testing. Furthermore, these findings were not a surprise, because the fact that trace amounts of sandpaper-type ice could have catastrophic effects on lift had been known since the 1930s. And yet, despite this knowledge, the provisions of FAR Part 25 Appendix C did not require manufacturers to test the behavior of their airplanes with trace amounts of sandpaper-type ice on the wings. At this point you might be starting to see the problem — but we’re actually still closer to the tip of the iceberg than we are to the bottom.
◊◊◊
The next major discovery would emerge out of the NTSB’s analysis of Comair’s procedures for flying in icing conditions. In addition to the matter of speed, discussed earlier, there was also the question of whether the pilots should have activated the deicing boots. After all, it seems like common sense that all the deicing equipment should be turned on when flying in icing conditions — right?
As it turned out, however, that was not at all the case. In fact, Comair’s FSM specifically instructed pilots to wait until at least ½ inch (1.27 cm) of ice had accumulated on the wings before turning on the leading edge deicing boots. The reason for this rule was spelled out on that very page, with an all-caps header: “CAUTION: Premature activation of the surface de-ice boots could result in ice forming the shape of an inflated de-ice boot, making further attempts to de-ice in flight impossible.”
This was a phenomenon known as “ice bridging.” The idea was that if the deicing boots are activated too early, when the layer of ice is too thin and malleable, then the inflation of the boot could simply push the layer outward instead of cracking it, causing a shell of ice to form in the shape of the fully-inflated boot. This could pose a serious flight safety risk because further ice buildup would occur on top of this shell, and the deicing systems would be unable to remove it. Therefore, pilots at many airlines, not just Comair, were taught to wait until they observed ice buildups between 0.625 cm and 3.75 cm in thickness, with the exact value varying from one company to the next. This meant that even if the pilots of flight 3272 were aware that they had ice on their wings, at no point during the flight would this ice have reached sufficient thickness for them to activate the deicing boots.
And therein lay an astonishing paradox: planes were being certified to fly in icing conditions corresponding to the FAR Part 25 Appendix C envelope, and the certification tests assumed that the deicing boots were active; however, ice thicknesses within that envelope could be dangerous if the deicing boots were not activated, and pilots around the world were being told not to activate the boots until after those thicknesses were exceeded. This was quite simply a recipe for disaster — and, as the NTSB would soon discover, a lot of people already knew it.
◊◊◊
On Halloween night of 1994, a French-built ATR-72 twin turboprop operating American Eagle flight 4184 abruptly plunged from the sky and crashed while holding over Roselawn, Indiana. All 68 passengers and crew on board were killed. A landmark investigation by the NTSB found that the ATR-72 suffered from previously unidentified severe controllability problems when flying in certain types of icing conditions. This discovery prompted the FAA to require new examinations of a wide range of turboprop aircraft types, including the Embraer EMB-120 Brasilia.
In a series of meetings involving the FAA, Embraer, and EMB-120 operators over the course of 1995, a worrying trend of icing-related in-flight upset events involving the EMB-120 began to receive significant attention. In six identified cases which occurred between 1989 and 1995, EMB-120 aircraft had stalled, rolled sharply to the left, and lost significant altitude due to ice accumulations which were either too slight for the pilots to notice, or were judged by the pilots to be insufficient to warrant use of the deicing boots. In all of these cases, the pilots managed to recover, although some of the flights plunged up to 3,000 feet before the crews regained control. Concerned by the pattern of incidents, an FAA engineer who had been examining the cases wrote a draft report in January 1996 which concluded that the EMB-120 could become dangerously unstable in roll when subject to ice accumulations which appeared insignificant to flight crews; that a minimum speed of 160 knots in icing conditions was inadequate; that the stall warning might activate too late; and that the autopilot might not disconnect in time for the pilots to avert a major upset.
For whatever reason, however, this bombshell report was never officially endorsed by the FAA and was never widely circulated outside the agency. Instead, following the meetings about the EMB-120 upset events, Comair told its pilots that the common causes of the incidents were a “lack of airspeed control” and a “failure to recognize the ice accumulation and utilize the installed deicing equipment.” Comair appeared to be unaware that the ice buildup in these incidents was likely below its own company threshold for activating the deicing boots.
However, while Comair didn’t take the findings seriously, Embraer definitely did. Recognizing that even small amounts of ice could be potentially dangerous, the company drafted a change to the EMB-120’s Aircraft Flight Manual (AFM) which instructed pilots not to fly below 160 knots in icing conditions, and to activate the deicing boots “at the first sign of ice formation,” instead of waiting for ice to build up to some arbitrary value. This change, known as revision 43, was officially adopted by Embraer and sent to the FAA for approval in early 1996.
When revision 43 arrived in the FAA’s mailbox, it sparked enormous controversy. Many specialists at the agency were appalled: after all, wouldn’t this procedure encourage pilots to activate the deicing boots too early, resulting in dangerous ice bridging? An equal number took the opposite stance: ice bridging, they claimed, wasn’t a real problem — it was a myth with no basis in scientific fact.
In order to settle the debate, FAA officials solicited input from Embraer and B. F. Goodrich, the manufacturer of the deicing boots on the EMB-120 and many other aircraft. B. F. Goodrich informed the FAA that it had conducted tests on this matter years ago, and found that modern deicing boots presented no danger of ice bridging whatsoever. In fact, a study sponsored by the UK Civil Aviation Authority in 1995 had found that ice bridging was only a problem on old aircraft with piston engines, which used engine-driven pumps to inflate their deicing boots. These deicing boots lacked power and inflated more slowly than the deicing boots on aircraft with turboprop engines, which were powered by compressed bleed air siphoned directly from the turbine. On these latter aircraft, which by 1997 comprised the overwhelming majority of those in service, ice bridging simply could not occur. In B. F. Goodrich’s experience, the only adverse side effect of activating the deicing boots sooner was that they would undergo more cycles, reducing their service lives. In terms of safety, this was hardly a concern.
On the basis of these findings, the FAA approved revision 43, and Embraer distributed it to all EMB-120 operators in April 1996. However, Comair, and four of the six other US airlines which operated the EMB-120, rejected the change, reporting that it was inconsistent with their existing training and procedures, and, in their view, it would expose their aircraft to the unacceptable danger of ice bridging. Consequently, Comair and the four other operators declined to adopt revision 43, and continued instructing their pilots to delay deicing boot activation. Incidentally, this also meant that Embraer’s attempt to establish a minimum speed of 160 knots in icing conditions was also not incorporated into Comair’s Flight Standards Manual.
Somehow, the airlines hadn’t gotten the message that ice bridging wasn’t real. Clearly a major breakdown of communication had occurred — but where? This proved to be the NTSB’s next avenue of inquiry.
By interviewing numerous FAA employees and examining the agency’s organizational structure, investigators were able to pinpoint how this miscommunication occurred. The first problem was that the adoption of revision 43 was discretionary — the only way to force operators to adopt it was for either Brazil’s CTA or the US FAA to back it up with a legally binding airworthiness directive, but neither agency did so.
When Comair rejected revision 43, it did so with the knowledge of the FAA Principal Operations Inspector, or POI, whose job was to ensure that Comair was operating in accordance with regulations. However, while the POI had seen both revision 43 and Comair’s justification for refusing it, he had not been informed of the basis on which the FAA approved the revision — that is, the testimony from B. F. Goodrich, explaining that ice bridging was not a problem on turboprop aircraft. This occurred because of the organizational practices within the FAA, in which operators forwarded a manufacturer’s proposed procedural revisions to the POI, while no communication normally took place between the POI and the FAA experts who had approved those revisions. Consequently, the POI was unable to inform Comair that it was making a decision based on incorrect information.
The end result of this massive miscommunication was that all the effort undertaken by Embraer, the FAA, and countless experts and scientists amounted to nothing, and EMB-120 aircraft across America continued to fly in icing conditions without a clear minimum speed and with rules that discouraged the pilots from activating the deicing boots in a timely manner. The persistence of this state of affairs made an accident inevitable. It was just a matter of where and when — and in the end, the unfortunate souls aboard Comair flight 3272 paid the price. In its final report, the NTSB did not beat around the bush: in their view, had revision 43 been incorporated into the manual, the pilots likely would have either requested to remain at 160 knots, activated the deicing boots, or both, and the accident would have been avoided.
The NTSB did not stop there, however. In fact, it argued, the problems with the EMB-120’s controllability could have come to light much earlier if the FAA’s icing certification standards reflected the known dangers of thin layers of sandpaper-type ice. Despite the fact that sandpaper-type ice was already known to be dangerous when FAR Part 25 Appendix C was written in the 1950s, it did not require manufacturers to test the handling characteristics of their aircraft when exposed to this type of ice. This glaring blind spot persisted for decades despite growing knowledge, in many cases obtained as a result of fatal accidents, which indicated that the required tests were inadequate. And yet, even after FAA experts concluded that the EMB-120 was fundamentally unstable when exposed to trace amounts of sandpaper-type ice, the agency didn’t conclude that this type of ice needed to be included in certification tests — instead, it simply approved revision 43 to the Embraer AFM, and called that good enough. Although this step, had it been taken properly, would have prevented the crash of flight 3272, it would not have solved the broader problem of accidents caused by trace amounts of ice on the wings.
In its report, the NTSB wrote: “The Safety Board notes with disappointment that this was the latest in a series of limited actions taken by the FAA to address the problems of structural icing in transport airplane certification and operation. Basic knowledge about the aerodynamics of icing (including the knowledge regarding the hazards of small amounts of surface roughness/ice) has been well established for the past 50 years, and there is nothing that has been learned in the most recent, post-accident wind tunnel tests and analyses that could not have been learned before this Comair accident.” Indeed, the NTSB had drawn similar conclusions following icing accidents in 1968, 1978, 1985, 1987, 1991, and 1994, as well as in a special safety report issued in 1981, but despite numerous recommendations to do so, the FAA had never updated the contents of FAR Part 25 Appendix C. If they had, then the adverse controllability characteristics of the EMB-120 would have been discovered years earlier.
As a result of these findings, the NTSB concluded that the FAA’s failure to establish adequate certification standards for flight in icing conditions, and its failure to ensure that airlines adopted the contents of revision 43, amounted to the primary causes of the accident.
◊◊◊
Following the crash and the publication of the NTSB’s damning final report, substantive changes were finally made to prevent similar accidents from happening again in the future. The FAA launched an industry-wide campaign to root out the myth of “ice bridging,” and it became standard practice to activate the deicing boots immediately upon entering icing conditions. The FAA mandated that all EMB-120s and several other aircraft types be fitted with automatic ice detection systems; Comair increased its minimum speed in icing conditions to 170 knots; and the FAA required all manufacturers to provide clear minimum maneuvering speed information for flight in icing conditions. The FAA also established standardized communication channels between FAA experts and POIs stationed at airlines; created a new database to more carefully track airworthiness matters involving foreign manufacturers; and most importantly, launched major research initiatives designed to ensure that the requirements of FAR Part 25 Appendix C were realistic and covered all ice shapes that were likely to form in flight, including thin layers of sandpaper-type ice. These resulted in a series of revisions to FAR part 25 to reflect state-of-the-art knowledge of aircraft icing, which continued all the way through 2016, including via the addition of further testing criteria not originally identified by the NTSB. As a result, it is now known exactly how every aircraft currently in service will react to all the types of in-flight icing which are likely to occur, and limitations exist to ensure that controllability is not compromised.
The crash of Comair flight 3272 is the definition of a “system accident”: a disaster made not only possible, but inevitable, by the network of rules and regulations governing every level of airline operations, from the top ranks of the FAA down to the cockpit of the accident flight. It was born from fundamental blind spots in the certification process, and from widespread contradictions between that process and the reality on the ground. It was not the result of inadequate knowledge: even before the accident, every piece of the puzzle was already known to someone, somewhere, in some capacity, from the truth about ice bridging, to the dangers of sandpaper-type ice, to the handling characteristics of the EMB-120. Instead, there was a failure by these various stakeholders to bring the pieces together into a coherent whole, until the tragic accident in Detroit did it for them. Twenty-nine people, each with family, friends, and plans for the future, perished in a snowbound field because of these abstract decisions made by myriad individuals across time and space. Some were more innocent than others; many were simply misinformed. Learning the truth about their actions has not and will not bring those 29 people back — but, more than 25 years later, we can say that it has saved countless others from following them into the abyss.
_________________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 230 similar articles
