Pilot Nick - 9 min read

What happened

On September 6, 2026, at 17:53 UTC, a Boeing 767-300 freighter registered N1997A, operated by 21 Air on behalf of Amazon Air, landed on runway 30 at Miami International Airport at the end of a flight from San Juan, Puerto Rico. Two crew members were on board. It was the aircraft’s third rotation of the day, after Cincinnati to Miami and Miami to San Juan.

It did not stop on the runway. According to the sequence established by the NTSB, the aircraft went past the northwest end of the runway, struck navigation aids, then hit a van belonging to a contract cleaning company, parked inside the airport boundary with seven people on board. It then went through a fence and struck a car travelling on Northwest 67th Avenue before coming to rest beside a parking lot. A fire broke out.

The FAA announced an investigation. The NTSB sent a team of thirty-two and held a first press briefing on September 7 at 4 p.m. local time, without releasing any technical findings. Nothing below prejudges their conclusions. It is only what the public ADS-B trace, made available for download by Flightradar24, allows us to establish once it is re-referenced to the official geometry of the airfield.

The runway

Runway 30/12 is 9,360 feet long. That is the full pavement length. Landing-performance calculations use a different number.

For a landing on runway 30 the threshold is displaced by 945 feet, meaning the usable landing area begins that far beyond the physical start of the runway. The FAA declared distances apply a further reduction at the far end. The landing distance available, or LDA, is 7,913 feet, or 2,412 metres. Runway 12/30 is also the only runway at the airport not aligned with the other three, whose full pavement lengths are 8,600, 10,506 and 13,016 feet.

The 7,913-foot figure is the basis for the landing-distance comparison here. If the estimated touchdown position is correct, roughly 4,100 feet remained within the declared landing distance, with about 4,600 feet of pavement to the runway end. The stopping margin also depended on landing weight, speed, runway condition and the deceleration achieved after touchdown..

What the trace shows

The file contains 537 timestamped position points, with barometric altitude, ground speed and heading. The sampling is irregular, from several minutes apart in cruise down to two or three seconds over the last two minutes of the flight.

The analysis that follows was done from the trace downloaded on the morning of September 7 and re-referenced to the official runway geometry, using the FAA-published coordinates of the two runway ends as the axis and the origin. It is not my work. I have checked the numbers against the approach plate, the METAR and the ADS-B Exchange track, and I present them here with my own reading as a line pilot. The data is public, and anyone can download the same files and repeat the same steps.

The profile reads in three stages, and that breakdown matters a great deal more than the simple observation of a high approach.

From 11 NM to 5 NM from the threshold, the aircraft descends on a 3-degree path with a deviation between 13 and 41 feet, and a lateral deviation of less than 0.06 degrees from the runway centreline. That is instrument-guidance precision, and nothing on this segment announces what comes next.

Between 4.6 and 3 NM, the aircraft stops descending and holds between 1,550 and 1,600 feet. The 3-degree path keeps going down and passes underneath it. In about thirty seconds the deviation grows from 123 to 501 feet, with the aircraft even regaining 50 feet of altitude along the way. This is where the vertical margin was lost, and nowhere else. The level segment coincides with a fall in ground speed, from 227 knots shortly before it to 180 during it, followed by a recovery to 195.

The ILS or LOC RWY 30 approach chart in force that day gives this segment its full meaning. The glideslope is set at 3.00 degrees and crosses the threshold at 51 feet. The published intercept fix, BIRDD, carries an altitude of 1,600 feet and sits 4.8 NM from the threshold. The aircraft reaches 1,600 feet at 4.8 NM, exactly where it was supposed to, and that is the point from which it stops descending. So it did not fall off a path it was holding. It arrived at the right place, at the right altitude, and did not begin the final descent. The glideslope passed beneath it.

From 2.2 NM the descent resumes at 5.4 and then 6.7 degrees, more than double the published slope. This is a catch-up dive rather than an approach running parallel to the path and offset above it, and it never converges. The slope only eases back toward 4.4 degrees over the last 2,000 feet, when there is no longer enough height left to recover the speed as well. The aircraft crosses the threshold at 110 feet above the ground, instead of the 50-foot reference, at 177 knots ground speed.

Laterally, centreline tracking stays excellent until 1.4 NM, then the aircraft drifts up to 129 feet right of centreline near 1 NM before converging again. The drift begins at the precise moment the catch-up dive starts.

Touchdown is around 3,800 feet past the displaced threshold, with an uncertainty of about 400 feet due to the quantisation step of the transmitted altitude. The regulatory touchdown zone ends at 3,000 feet. Ground speed at contact is 159 knots.

Touchdown, seen from the ground. The trace puts it around 3,800 feet past the displaced threshold.

The weather

The sequence of hourly observations at Miami says a lot. At 17:13, wind variable at 3 knots. At 17:53, the time of touchdown, wind from 190 at 17 knots gusting 26, with two decisive entries in the coded remarks: a wind shift recorded at 17:37, and a peak wind measured from 180 at 26 knots at 17:52, one minute before the landing. By 18:53 the wind had dropped back to calm. A thunderstorm was over the field, and the cell passed through during the landing. On runway 30, the reported wind implies a tailwind component of about six knots, increasing to roughly nine knots if the 26-knot gust came from the same direction. However, the remarks record a separate peak wind from 180° at 26 knots at 17:52 UTC. That corresponds to a tailwind component of approximately thirteen knots. These figures are calculated from airport weather observations; they do not establish the exact wind the aircraft encountered during the flare and touchdown.

Two other aircraft flew the same approach that afternoon, one twenty minutes before, one two minutes after. Their traces are what turn a single profile into evidence, and they're below.

Read more

Pilot Nick — 9 min read

You’re somewhere over the North Atlantic, seat reclined as far as economy allows.

Dinner trays are cleared. The cabin lights are dimmed to that amber half-dark of every overnight crossing. Someone two rows up laughs at their movie. Outside the window there’s nothing at all — black water under a black sky.

You trust, without ever thinking the word “trust,” that the two people up front will notice anything wrong long before you do.

We take that seriously. And twenty-eight years ago this week, on a night exactly like the one you’re picturing, two pilots noticed something wrong three and a half minutes before they told anyone.

It still wasn’t enough.

Welcome back to Black Box — the series where I take the aviation incidents that made history and break them down the way a pilot actually thinks about them.

Not the dramatized version. Not the Wikipedia summary. The cockpit view: what the crew saw, what they decided, what they felt — and what it teaches us about how flying became one of the safest things you can do on this planet.

This episode is different from the ones before it. BA009 had a happy ending. This one doesn’t. But no single flight taught modern aviation more and if you’ve ever wondered what happens when pilots smell smoke, this is the story behind the answer.

Let’s go back to that night.

What happened on September 2, 1998 ✈️

Swissair Flight 111, a McDonnell Douglas MD-11, lifted off from New York JFK at 8:18 p.m. bound for Geneva. On board: 215 passengers, 14 crew. A routine red-eye for one of the most respected airlines in the world, Swissair was so trusted the Swiss called it “the flying bank.”

Fifty-three minutes into the flight, cruising at FL330 — 33,000 feet, the captain and first officer noticed an odd smell in the cockpit. A few minutes later, a wisp of visible smoke. Then, strangely, it seemed to clear.

They read it as an air conditioning problem. And honestly? Most of us would have. Bleed air systems produce strange smells often enough that every airline pilot I know has a story about one. Ninety-nine times out of a hundred, that smell is nothing.

Three minutes and thirty-seven seconds after the first whiff, they radioed “Pan Pan Pan” — the international call one notch below Mayday and asked to divert. They picked Halifax, Nova Scotia, ran the checklist for smoke of unknown origin, and set up for the approach. They asked to dump fuel, because the jet was well above its maximum landing weight.

What they could not know: above the ceiling panels behind the cockpit, a fire was crawling through the insulation. No detector up there. No extinguisher. Not even an access panel to look through.

Thirteen minutes after the first smell, the flight data recorder began logging system failures in rapid succession. The autopilot dropped out. Displays went dark, one after another. The crew declared an emergency. A minute later the radios and both recorders quit — the last five and a half minutes of that flight exist only in radar returns and wreckage.

At 10:31 p.m. local time, about five nautical miles off a small fishing village called Peggy’s Cove, the MD-11 hit the ocean. All 229 people aboard died.

From first smell to impact: about 21 minutes.

The line the documentaries get wrong

Every retelling of this accident eventually circles the same question: should they have skipped the checklist and dived for the runway?

Investigators from the Transportation Safety Board of Canada spent four and a half years on that question. They pulled 98 per cent of the airplane off the seabed, piece by piece, and rebuilt the forward fuselage in a hangar. Then they ran the numbers on a perfect emergency: no checklist, no fuel dump, an immediate maximum-effort descent to Halifax from the moment of the first smell.

The airplane still doesn’t make it. The fire moved faster than physics allowed any approach to be flown.

Sit with that for a second, because it’s the hardest sentence in the whole report and the one nobody puts in a headline: the crew was not the problem. If they had been, the fix would have been simple — train better pilots. Instead, the industry had to face something far more expensive. The airplane itself was wrong. And so were hundreds of others flying that same night.

Subscribe now

The spark and the fuel

The TSB traced the fire’s most likely origin to an arcing wire —a power cable feeding the in-flight entertainment network, a seat-back video and gambling system added to Swissair’s MD-11s after they left the factory, under a supplemental approval process that never seriously examined how it fit into the rest of the aircraft.

An arc, on its own, is just a spark. Sparks need fuel.

The fuel was the insulation. The MD-11’s thermal acoustic blankets — the quilted batting that keeps a cabin warm and quiet — were covered in metallized PET, a film that had passed the flammability test of its era. In a lab, with a small vertical flame, it looked fine. In a real airplane, once ignited, it carried fire along the crown of the fuselage like a fuse.

A spark from a system that shouldn’t have been wired the way it was. Fuel from a material that should never have passed its test. Burning in a space no crew could see, reach, or fight.

That’s what killed 229 people. Not a bad decision. A blind spot the whole industry shared.

You now know what happened that night, the spark, the fuel, and the hardest finding of all: that no crew alive could have outflown it.

Read more

Pilot Nick - 7 min read

Seat 24A, Munich, Saturday afternoon, 15 August.

The engines spool up, the seat presses into your back, the runway lights start to smear past the window. Then it keeps going, longer than you remember, and the far end of the runway stops being an idea and starts being a thing you can see.

The nose finally comes up. There is a thud somewhere behind you. The aeroplane climbs away, and a few minutes later the captain tells you that you are going back to Munich.

That was Vietnam Airlines flight VN34, a Boeing 787-9 bound for Hanoi with 271 passengers and 16 crew. Everybody walked off it. Ten days later, the part I keep coming back to is the two hours after the tail hit the ground.

What we actually know

Confirmed by the German BFU, which is leading the investigation: the aircraft rotated late on runway 26L, a runway 4,000 metres long. Its tail contacted the ground during the rotation, leaving longitudinal scrape marks along the underside of the rear fuselage. It went past the paved surface before it was properly flying, damaging lights at the runway end. Four of the eight main gear tyres burst, and the breakdown matters: numbers 1, 3 and 5 on the left main gear, and number 3 on the right.

The crew’s account is worth reading slowly. Around halfway down the runway, the speed stopped increasing for about two seconds. It picked up again. Then, at V1, they saw it decrease a second time. They judged there was no longer enough runway to stop on, pushed the thrust levers to maximum, and rotated with roughly 300 feet of concrete left. The warnings arrived once they were airborne: a tail strike, and tyre pressure problems.

They told air traffic control they were coming back, dumped fuel down to landing weight, and flew two low circuits so controllers on the ground could look at the gear with their own eyes. They landed on runway 26R at 15:57 local, about two hours after they had left. No injuries.

The evidence on the concrete

Photographs of the departure end of 26L show two long dark skid tracks running off the paved surface and into the grass, one from each main gear, getting heavier towards the end. That is the signature of wheels that have stopped rolling freely and started dragging. Video review puts the right main gear braking from roughly 210 metres before the runway end, with those wheels locked at and past it, and aerial photographs the following day indicate both brakes were active before the end.

Both sides show marks, so this was not one seized wheel. But three of the four burst tyres are on the left, and the left gear is the one that came back trailing smoke and left the aeroplane disabled on the runway. Whatever was happening was heavier on the left, and that asymmetry has a consequence the crew would have felt. Drag on one side pulls the nose towards it, and holding the centreline against it takes rudder and takes attention, at exactly the speed where a pilot has least of both to spare.

Why the brakes are the question

The 787 has electric brakes, the first airliner in service built that way, using a system from Safran Landing Systems. On every other big jet, pressing the pedals sends hydraulic pressure down a brake line to squeeze the carbon discs. On the 787 there is no brake line and no hydraulic fluid at the wheel. Pedal movement becomes an electrical signal, controllers interpret it, and electric motors on each brake unit clamp the discs directly.

That changes the shape of this investigation. A hydraulic brake drags when a valve sticks or a seal fails, and you find that with a spanner. An electric brake drags when an actuator, a controller or the logic behind them holds clamping force nobody asked for, and you find that in data and software.

One more thing before the theories, because it decided how this flight ended. V1 is the last speed at which we can stop on the runway that remains. One knot after it, the runway behind us is too short to stop in, so we take the problem into the air. The second speed decrease came after V1, so there was no decision left to make. The crew’s job became getting the aeroplane airborne, which they did at the cost of a tail strike and four tyres.

Metal is cheap. That trade is one we brief out loud before every departure.

Read more

Pilot Nick - 4mn read

Concorde cruised at Mach 2, above 50,000 feet, where the air was too thin to breathe and the aircraft’s skin could heat to 127°C.

You would think an aeroplane like that belonged in clear skies, miles above the weather.

Then you open the Air France Concorde Operating Manual and find something rather unexpected:

Category 3. Decision height: 10 feet. Minimum use height: zero. Runway visual range: 150 metres.

In other words, the fastest passenger aircraft ever built was also certified to land itself in fog so thick that the pilots might not see the runway until they were almost on it.

And it did it with technology designed in the 1960s.

France had already done it with the Caravelle

Concorde wasn’t France’s first CAT III aircraft.

On 9 January 1969, an Air Inter Caravelle arrived at Orly from Lyon with 56 passengers on board. The airport was covered in fog. Captain Larribière let the aircraft fly the approach and landing automatically.

It became the first automatic landing in commercial service under Category 3 conditions in French civil aviation.

The approval had come two months earlier, after years of testing. Trials had been running since 1962, and a Caravelle had already made a zero-visibility automatic landing at Toulouse in March 1963.

Exactly who deserves to be called “first” is still debated. The Caravelle, Hawker Siddeley Trident and Smiths Industries prototypes all have a claim, depending on whether you mean the first experimental autoland, the first certification or the first one carrying passengers.

But one thing is clear: France was at the very front of the race to make airliners land automatically in dense fog.

And that experience mattered when Concorde came along.

Sud Aviation, which developed the Caravelle, became part of Aérospatiale, which assembled Concorde at Toulouse. There wasn’t much direct technical inheritance between the two systems. Concorde’s electronics, sensors, monitoring and servos were completely different.

What carried over was something harder to put on a wiring diagram: experience.

The engineers already knew an automatic landing could be made reliable enough for airline service and they knew what it took to convince the certification authorities.

Share

Concorde made the problem much harder

By the 1970s, autoland itself was no longer unique. The Boeing 747 received CAT III certification in 1971. The Trident followed with CAT IIIa in 1972 and CAT IIIb in 1975.

But neither of them landed like Concorde.

Concorde approached at around 14 degrees angle of attack, nose drooped, on a delta wing with no flaps or slats.

That 14-degree attitude wasn’t for show. Concorde had no conventional high-lift devices. On approach, the delta wing had to generate the lift itself, helped by the powerful vortices forming over the wing.

The result was a very nose-high approach.

Even with the famous droop nose lowered, the view ahead was restricted. The aircraft was fast, draggy, and operating with less energy margin than a conventional airliner.

On a 747, the flaps generate enormous amounts of lift while allowing the aircraft to fly at a relatively modest angle of attack.

Concorde didn’t have that luxury.

If speed began to decay or thrust came back too quickly, things could deteriorate rapidly.

And then there was the landing gear.

The main gear sat a long way aft under the delta wing. Changes in aircraft weight and centre of gravity altered the geometry at touchdown, which made programming the automatic flare particularly difficult.

The system somehow had to take this fast, nose-high, flapless delta and place its main wheels precisely onto the runway.

In fog.

Automatically.

Every time.

Concorde had its own rulebook

Even its certification was unusual.

Concorde was approved under TSS Standard 1-2 — Transport SuperSonique, a regulatory framework written specifically for the aircraft.

The numbers in the Air France manual are remarkable:

Decision height: 10 ft
Minimum use height: 0 ft
Runway visual range: 150 m
Maximum headwind: 25 kt
Maximum tailwind: 10 kt
Maximum crosswind: 15 kt

For US operations, the crosswind limit was reduced to 10 kt.

And all of this was being achieved with analogue technology.

Two autopilots and two very important green lights

Concorde had two autopilots: AP1 and AP2.

For a full CAT III automatic landing, they could work together in LAND mode. In front of the pilots, two landing situation indicators showed exactly what capability remained.

A green LAND 2 light meant at least one autopilot was operating correctly in LAND mode.

That was enough to perform an automatic landing, but the system was fail-passive. There was no longer another complete channel waiting to take over.

LAND 3 was the one you really wanted.

It meant both autopilots were engaged, both autothrottles were operating correctly in IAS ACQ mode, and the split system bus separating the two autopilot channels was open.

Now the system was fail-operational.

If one autopilot failed on short final, the other could take over and continue the automatic landing.

And the crew didn’t simply trust that redundancy was there.

Before every CAT III approach, they tested it.

The captain disconnected AP1. LAND 3 disappeared and LAND 2 illuminated. The crew checked that AP2 was still flying the aircraft correctly.

Then AP1 went back on.

LAND 3 returned.

Only then had the system proved that it could lose an autopilot and keep flying.

Read more

PIlot Nick — ✈️ 8 min read

You’re in 27A, halfway through a flight, and the captain comes on to say we’ll be holding for twenty minutes before landing.

The cabin does that small collective shift. And somewhere in the back of your mind, a question surfaces that nobody says out loud: do we have enough fuel for that?

You picture a gauge. You picture a needle. You think about your car on the motorway with the orange light on.

Up in the cockpit, I’m not thinking about a needle at all. I’m thinking about a number I calculated ninety minutes before you boarded and twenty minutes of holding was already in it.

The Reframe

Here’s the part that surprises almost everyone: we don’t fill the tanks.

Not usually. Not close. A long-haul jet leaves the gate with tanks that are often nowhere near full, and a short regional flight can leave with less fuel than the trip to the airport used in your car proportionally speaking.

People assume this is about money. Airlines being cheap. It isn’t, or at least it isn’t only that.

It’s physics. Fuel is heavy. Every kilo of fuel you load has to be lifted off the runway, accelerated to 500 knots, and held up in the air for the entire flight and lifting it and holding it burns fuel. Carry an extra ton across the Atlantic and you’ll burn a meaningful slice of that ton just transporting the rest of it. It also comes straight out of what the aircraft can carry in passengers and cargo.

We call it the cost of carriage. Fuel you don’t need isn’t free insurance. It’s ballast you pay for by the mile.

So instead of filling up, we build a number. And the number gets built the same way every single time, on every airline, on every flight in the world.

What Happened Over The Atlantic

A few winters back, westbound over the North Atlantic, the destination forecast was doing that infuriating thing forecasts do low cloud, a front that couldn’t commit to an arrival time, and all of it predicted twelve hours before we’d actually need it.

I’m standing at the flight plan with a coffee going cold, and I’m adding.

Two tonnes for the weather. Another for the holding I’m imagining. Something for an alternate airport I don’t much like the look of.

My first officer asked the question that reorganised my thinking: “What are we protecting against and when do we actually find out if it’s real?”

The answer was: over Ireland. Five and a half hours in. Not now, in the dark, at a gate in North America, guessing at a forecast that was still half a day from being tested.

So we carried enough to reach the point where we’d know, plus everything the rules require and not one tonne more for the stories I was inventing about what came after. As it turned out, the front cleared early. We landed comfortably.

That’s really what fuel planning is. Not “how much can we take?” but “how much do we need to still have every option open at the moment we have to choose?”

How The Number Actually Gets Built

Read more

Pilot Nick - 6 min read

Around 180 people were sitting on a British Airways A320 at 3,000 feet over London on 6 July, on their second attempt at landing at Heathrow, when the stall warning went off for the second time that evening.

The aircraft lost roughly 800 feet, swung left of the approach path, then came back onto it, lined up with the runway and landed. Passengers described a violent manoeuvre and screaming in the cabin. Nobody was hurt. Nothing was damaged.

I’ve watched the coverage build all week, and reporters have run a long way ahead of the facts. The official account of that flight is about forty words long. Almost everything dramatic you’ve read came from somewhere else.

So this is the flight in the order it happened, from someone who flies that approach for a living.

What the investigators have actually said

British Airways flight BA919 was inbound from Düsseldorf. On the first approach, one of the aircraft’s air data units failed. That triggered a stall warning, the flight control system dropped into a simpler mode called alternate law, and the crew declared a PAN.

They broke off the approach and went into a holding pattern to work the problem. Coming back in, a second stall warning sounded at 3,000 feet, followed by what the AAIB calls “a potentially abrupt recovery manoeuvre.” The crew upgraded the PAN to a MAYDAY, which cleared them straight in.

They landed about thirty minutes after abandoning the first approach.

That’s the whole official account. The AAIB has opened an investigation and published no cause. It has not said the aircraft stalled. It has not attributed anything to any crew member.

That last sentence has gone missing from most of the coverage.

What actually broke

An air data unit is the aircraft’s source of truth about the air it’s flying through. Speed, altitude, pressure. Those numbers feed your instruments, and they feed the computers that decide what the aeroplane is allowed to do.

Normally those computers will not let you fly the A320 outside its safe limits. You can pull the stick fully back and the aircraft simply refuses to stall. All of that protection is built on trusting the speed reading.

When an air data unit fails, the computers lose confidence in the speed they’re being fed, so they hand more control back to the pilots. The aeroplane still flies exactly as it did a second earlier. Some of the automatic safety net thins out, and the crew flies it more by hand, following a procedure every airline pilot practises in the simulator.

There’s an awkward consequence. Once that safety net is gone, the aircraft can no longer prevent a stall, so it warns you about one instead. And that warning is calculated from the same suspect speed reading.

So a stall warning in that situation might be real, or it might be a ghost produced by bad numbers. The crew gets a few seconds to work out which. Responding to a real one costs altitude, and guessing wrong in either direction is expensive.

That ambiguity is the hard part of this flight. I suspect it’s most of what the investigation is about.

The four things that crew got right

Read the sequence again with a pilot’s eyes and you can see a procedure running underneath it.

They flew the aeroplane first. When the speed reading can’t be trusted, the opening move is to set a known attitude and a known power setting, from memory, no discussion. You put the aircraft in a shape you know produces flight, and you sort out the instruments afterwards.

They stopped trying to land. A go-around with a degraded aircraft over west London is the cheapest decision on the menu. Every problem gets easier with height and time, and both of those you can only buy by climbing away.

They bought time in the hold. This is the part passengers never see. That holding pattern is where the checklists get run, the fault gets identified, the landing numbers get recalculated, and two people say out loud what they’re about to do next. Circling for twenty minutes is what a crew does when nothing is on fire and they’ve decided to spend time rather than luck.

They said the words that clear the airport. PAN is the international call for an urgent problem that isn’t yet life-threatening. MAYDAY means distress, and it hands you the runway, the radio and every fire truck at Heathrow. Upgrading from one to the other mid-approach is a crew deciding they’d rather have too much help than too little.

None of that would make a decent film. That’s rather the point of the job.

Read more

Pilot Nick - 9 min read

Is It Actually Safe to Fly a Boeing Right Now?

Two Boeing headlines landed ten days apart this month. One of them looks much worse than it is, and the other one is the reason I’m not worried.

Pilot Nick - 9 min read

You booked the flight weeks ago. Last night you opened the seat map, saw the aircraft type in small grey letters (737 MAX 8), and made the mistake of searching it.

Two stories came back, both from the past two weeks. One said the FAA is letting Boeing sign off on the safety of its own airplanes again. The other said 453 Boeing 737 MAX jets registered in the US may have passenger seats that were installed wrong.

So now you’re holding a boarding pass and trying to run a risk calculation with no instruments.

I fly for a living, and when both of those crossed my feed I read them the way pilots read everything, which is looking for the part the headline left out. Both stories are true. Neither one would move me off that flight. How I got there is more useful to you than my saying so, so that’s what the rest of this is.

The question is aimed at the wrong thing

“Is it safe to fly a Boeing” sounds like a question about metal. But the manufacturer is one of the weakest predictors of whether a given flight goes well.

One number in IATA’s 2025 safety report does most of the work here. Across 38.7 million flights there were 51 accidents, and the long-run rate has fallen from 3.72 per million flights in 2005 to 1.32 last year. Fine. Now look at how that risk sits. IATA member airlines ran 0.72 accidents per million flights. Non-members ran 3.09. Same skies, same weather, airplanes rolling out of the same handful of factories. The gap is a factor of four, and it’s about how the airline is run.

I won’t soften the other half of that report. 2025 was the worst year for airline fatalities since 2018, with eight fatal accidents and 394 people lost, and the worst single event was a Boeing 787. Air India 171 went down 32 seconds after takeoff from Ahmedabad, killing 260 people. Anyone telling you aviation had a quiet year is reading a different document.

That report also shows how tightly those deaths concentrated. Air India 171 and the PSA Airlines midair over the Potomac accounted for more than 77% of everyone lost on board an aircraft last year. Fatal accidents involving large jets are rare enough now that two of them move the global number.

So the question worth asking isn’t about the badge on the tail. It’s what stands between a known problem and your seat.

What actually happened in July

On July 17 the FAA announced that Boeing can again issue airworthiness certificates for finished 737 MAX and 787 airplanes, effective the 20th. That restored a delegated paperwork authority the agency stripped in 2019 after the Lion Air and Ethiopian crashes, and again for the 787 in 2022 over production quality. The scope is a lot narrower than the headline suggests, and I’ll unpack it below.

Ten days later the FAA proposed ordering airlines to inspect the seats on 453 US-registered 737 MAX jets. It had received a report that certain track-mounted seat assemblies were installed with the aft fitting shear plungers not lowered and not engaged in the seat tracks. In plain English, some seats might not be locked properly to the floor. In severe turbulence or a hard landing, the FAA said, they could injure people or block the aisle during an evacuation.

Read those two together and the second one looks like it demolishes the first. I read it the other way round. Somebody found badly installed seats, wrote it up, and within days the regulator moved to get hundreds of airplanes checked. One week after handing Boeing back a privilege, the same agency published a defect against Boeing’s best-selling airplane.

The part of my job passengers never see

Most of what keeps you safe is paperwork.

Every airplane I fly has a technical log, and every defect goes in it. Not the interesting ones. All of them. A flickering cabin light, a coffee maker that trips a breaker, a seatbelt buckle that won’t latch, a seat that shifts under my hand on the walkaround. Once it’s written down it belongs to the system, and that airplane doesn’t move until someone qualified either signs it off or defers it under the Minimum Equipment List, which spells out what’s allowed to be broken, for how long, and with what limitations. None of that depends on my judgment being sharp at 5 a.m., which is the entire point of it.

What the system can’t survive is a culture where writing things down costs you something.

That’s the real lesson of the Alaska Airlines door plug in January 2024, the panel that came off a MAX 9 at 16,000 feet with four bolts missing. When the NTSB finished in June 2025, the finding wasn’t about one careless mechanic. Boeing had failed to provide adequate training, guidance and oversight to prevent it, and the paperwork trail for that panel didn’t exist. Boeing then spent close to two years capped at 38 airplanes a month, because the FAA didn’t trust the factory to go faster than that.

Five things I check, and four you can check yourself

1. Find out which airplane you’re actually on. “A Boeing” covers a jet designed in the 1960s and one certified last year, and headlines almost never tell you which. Your booking email or the seat map in the airline app will name the exact variant: MAX 8, MAX 9, 787-9, 737-800. Look it up before you read another word about it. The MAX 8 entered service in 2017 and the MAX 9 in 2018, both went through a 20-month grounding, and both came back with mandated changes to the system behind the two crashes. Seven years of that kind of scrutiny isn’t nothing.

2. Read the fix, not the fear. When a story breaks, scroll past the headline until you find what’s being done about it. If there’s a specific part, a specific number of airplanes and a deadline, somebody has already found the problem, measured it and assigned it to people with tools. The seat story gives you all three: 453 jets, the aft fittings on track-mounted seats, inspections ordered. The stories that hold my attention are the ones where nobody can say yet what went wrong.

3. Who flies it matters more than who built it. The airline sets the maintenance standards, the training, and whether a tired first officer feels able to speak up. Here’s the one lookup I’d actually give you: IATA runs a public list called the IOSA registry, airlines that pass a recurring international safety audit. Type your airline’s name and “IOSA” into a search bar. Carriers on that registry ran 0.98 accidents per million flights last year. The ones not on it ran 2.55. Same airplanes, roughly two and a half times the rate.

4. If you’re reading about it, it already got caught. People get this one backwards. The seat problem reached your phone because somebody spotted it, wrote it up, and a regulator moved on it within days. That’s the machine working out loud. What hurt people on the Alaska door plug wasn’t a story in the news, it was a paperwork trail that didn’t exist.

5. The one I can’t hand you. Whether people inside get punished for reporting problems. It happens where neither of us can see it, and it’s the one I’d trade the other four for. In February an Air India crew wrote up a fuel control switch on a 787 that wouldn’t stay locked in RUN, and that airplane was out of service by the end of the day. Nobody had to be brave for that to happen. It’s just what the book says to do.

Every safety statistic in this article rests on people willing to write down inconvenient things.

Leave a comment

The five checks are the whole method, and they’ll get you through most headlines on your own.

Below the line I run all five against the three Boeing questions filling my inbox this week: the seat inspection order on 453 MAX jets, the FAA handing certification authority back to Boeing, and whether it’s safe to fly a 787 while the Air India investigation is still open. Plus a check I use when a story breaks about an airplane I’m scheduled to fly.

“I’m booked on a 737 MAX 8 next Tuesday. Should I move?”

Read more

Pilot Nick — 8 min read — Black Box Series

You've almost certainly heard of the Miracle on the Hudson — the airliner that glided onto a river in New York with both engines gone. You've probably never heard of the one that pulled off something just as remarkable a year earlier, two miles from London Heathrow, with even less time to react.

On the 17th of January 2008, British Airways Flight 38 was seconds from an ordinary landing.

A Boeing 777 with 152 people aboard was on final approach to Heathrow — two miles out, 720 feet above the rooftops of west London closing out a routine ten-and-a-half-hour flight from Beijing.

Then both engines quietly stopped making power. No fire. No bang. No warning horn for what was happening. The autothrottle called for more thrust and got almost nothing back, and in the space of a few seconds a 150-tonne airliner became a glider — too low, too slow, sinking toward houses, a busy road, and the airport fence.

The crew had less than a minute to solve a problem that appeared in no checklist on the aircraft.

This is what actually happened, why it happened, what changed because of it, and the system the pilots used when the book ran out.

What everyone gets wrong about how pilots survive

Here’s the assumption most people carry: pilots stay alive in emergencies because there’s a checklist for everything.

Engine fire? There’s a page. Depressurization? There’s a page. Flip to the tab, run the drill, breathe. Most of the time, that’s exactly right. The checklist is one of the quiet miracles of aviation — it turns panic into a to-do list.

But a checklist can only cover the problems someone has already survived and written down. It’s a memory of other people’s disasters.

Flight 38 hit the one nobody had written down. And that’s the moment training actually earns its keep.

Read more

Pilot Nick — 6 min read — Black Box Series

I saw the headline before I finished my coffee.

Passenger sucked out of Ryanair window. A photo of a hole where a window should be. A 61-year-old man in a hospital in Thessaloniki. And somewhere in a drawer, your own boarding pass for next week.

You read it twice. And a small, quiet voice asks the question you’ve been not-asking for years: what is actually holding that thing together?

Up in the flight deck, we’ve been rehearsing this exact morning for twenty-five years. Not the headline — the morning. The bang, the mist, the yellow masks, the turn back. Every six months, in a simulator, with someone marking us on it.

So let me tell you what happened over northern Greece at 06:20 this morning, from the seat with the controls in it.

What most people get wrong

When you read that a window failed and a man was pulled halfway out of it, your brain draws one conclusion: the aeroplane is fragile.

Here’s the thing. The aeroplane held.

Something broke a window. And then nothing else broke. The fuselage stayed intact. The wings stayed on. The remaining engine kept turning. The crew flew it home and landed on the runway they’d left an hour earlier.

The aeroplane was never in danger. The man in that seat was.

Those are two completely different sentences, and almost every article you’ll read today collapses them into one.

What actually happened

Ryanair FR1879, a Boeing 737-800 registered 9H-QEU, operated by Malta Air, lifted off runway 28 at Thessaloniki at 06:12 local, bound for Memmingen. Seventeen minutes late. A completely ordinary Friday.

Eight minutes later, climbing through FL150 — 15,000 feet, their maximum altitude that morning — there was a bang. Initial reports, and I stress the word initial, say an engine failed and debris from it struck the fuselage and destroyed a cabin window on the right-hand side.

The cabin depressurised. The masks dropped. A 61-year-old Serbian passenger at that window was pulled partially into the opening — head and shoulders before his wife and travelling companions hauled him back in. He is in hospital in Thessaloniki tonight with a neck injury and friction burns, and he is expected to be fine.

The crew declared an emergency and then did something that will confuse you if nobody explains it: they did not land immediately. They flew for another forty minutes and touched down at 07:08.

Two things in that paragraph deserve more than a news cycle. Start with the window.

Four panes, not one

The thing you lean your head against on a 737 isn’t a window. It’s four components stacked together.

The inner pane is the one you touch. Non-structural. Its entire job is to keep passengers, elbows and toddlers away from the panes that matter. It holds nothing back.

The airflow dampener sits behind it — the layer with the little hole everybody notices and nobody explains. It balances pressure between the panes and stops them fogging.

The middle pane is the fail-safe. Fully structural, certified to hold roughly 1.5 times normal cabin pressure on its own, with no help.

The outer pane is the one carrying the load right now, on every flight you’ve ever taken.

Read that again. The outer pane fails, the middle pane takes over — rated for half again more pressure than the cabin will ever ask of it. That’s this entire industry’s design philosophy in one small oval of acrylic: assume the primary structure fails, and make sure the backup doesn’t care.

For the cabin to lose pressure this morning, both structural panes had to go. Together. In the same instant.

That is an extraordinarily rare event. It’s why every pilot I know read this story twice.

Share

The first thing we do is nothing

There’s an old phrase in this trade: wind the clock. From the days when cockpits had mechanical clocks, and the instruction to a startled crew was, literally, wind the clock before you touch anything.

Give yourself eight seconds.

Because the aeroplane in that moment is not falling out of the sky. It’s flying — badly, loudly, alarmingly, but flying. An engine failure on a twin-engine airliner is a condition the machine is certified, tested and licensed to handle. Every pilot flying you today was examined on it inside the last six months.

The failure is almost never what hurts people. What hurts people is the ninety seconds afterwards.

Reach for the wrong switch. Shut down the good engine. Rush a heavy aeroplane at a runway because the cabin is screaming.

So we drill the order until it’s reflex. Aviate. Navigate. Communicate. Fly it. Point it somewhere. Only then, talk.

The five steps

Step 1 — Fly the aeroplane. Someone puts hands on the controls and keeps the wings level. It’s said out loud: “I have control.” One person flies. One person deals with the problem. Nobody does both.

In real life: stabilise before you strategise.

Step 2 — Wind the clock. Almost nothing in an emergency requires an instant response. The exceptions are memorised and fit on one hand.

In real life: the urge to act fast is almost always the emotion talking.

Step 3 — Diagnose before you decide. The FR1879 crew had a bang, a decompression, engine indications and a cabin in chaos. Four problems — or one problem wearing four costumes. Shutting down the wrong engine has killed more people than engine failures ever have.

In real life: name the real problem before you fix the loud one.

Step 4 — Buy back margin. This comes in two halves, and the difference between them is the whole morning.

Half one is not optional. A cabin that loses pressure gets an immediate emergency descent below 10,000 feet, where the outside air alone keeps everyone conscious. The masks that dropped aren’t an endless supply — they’re chemical oxygen generators, good for around twelve minutes. That’s not a limitation. That’s the specification. Twelve minutes is comfortably more than any airliner needs to reach breathable air. The clock the masks start is a clock the aeroplane is built to beat.

Half two is a choice. Once level and breathing, the crew held, and burned fuel. A 737 eight minutes into a two-hour flight is heavy, and landing above maximum landing weight risks a hard, hot, brake-fire arrival on the runway you’re already going to need. So they traded forty minutes for a normal landing. With a hole in the aeroplane. On purpose.

The first half bought oxygen. The second bought margin. They are not the same decision, and this crew did not confuse them.

The masks are the most misunderstood object on the aeroplane, I wrote the whole story of what's actually inside them here: if you want to know more 👇🏻

Step 5 — Communicate last. Only once it was flying, understood and set up did they talk to ATC, to the cabin, to the company. Not because passengers don’t matter — because a pilot on the radio is a pilot not flying.

“Pilots aren’t calmer than you in an emergency. We’re just slower deliberately, systematically slower at exactly the moment everyone else speeds up.”

The framework above is the whole system. Using it while the masks are swinging in front of your face is another thing entirely.

Read more

Pilot Nick — 9 min read

Two families walk into the same terminal for the same flight.

The first arrives three hours early — checked in already, passports backed up on paper, kids fed a real breakfast at the gate. The second cuts it to ninety minutes, hits a longer-than-expected line, and jogs the last hundred yards while a gate agent gives them the look.

Same airplane. Same departure time. One family starts vacation relaxed. The other starts it with an elevated heart rate.

The difference isn’t luck. It’s a handful of decisions made days before anyone reached the airport. After thirty years and 10,000-plus hours up front, here’s what I wish every passenger knew before flying this summer.

✈️ Before you book

Fly early. Your airplane has to physically exist at your airport before it can take you anywhere — a 6:15 a.m. departure usually slept at the gate overnight, clean of yesterday’s delays. Every flight after that first wave inherits the problems of the one before it.

More here 👇🏻

• The numbers back it up. Flights between 6 and 9 a.m. run on-time roughly 82-84%. Anything after 7 p.m. drops to the high 50s-low 60s. (Full hour-by-hour breakdown here.)

• Summer raises the stakes. Afternoon thunderstorms build almost on schedule — a morning departure beats the storm to the runway.

• Nonstop ≠ smartest. On a storm-prone route (Florida to the Northeast, say), one canceled nonstop leaves you with nothing. A connection through a busy hub gives you a backup flight.

• Pick your day. Tuesday and Wednesday run noticeably less congested than Friday or Sunday.

• Pick your date. The real crunch isn’t July 4th itself — it’s the Thursday/Friday before, the Sunday after, and the first two weeks of August. Push to late August and everything eases up together.

• Pad your connection. Treat the posted minimum connect time as a legal floor, not reality — add 30-45 minutes this summer.

• Flying late? Have a backup. Pick a flight with another same-day departure behind it on your route — that’s your rebooking safety net.

• The wing-seat thing is real physics, not folklore. An airplane pivots around its center of lift, roughly at the wing — like a seesaw. Sit up front or in back and you ride the far end of the seesaw; sit near the wing and you’re closest to the pivot. (More on my go-to seat here.) “Safer seating,” though, is mostly fiction — survivability isn’t meaningfully seat-dependent on modern aircraft. More here 👇🏻

🎒 Packing like a pilot

I’ve lived out of a carry-on for two decades. Three rules run the whole system: redundancy without bulk, multi-functionality, and accessibility. (The full system is here.)

• The 5-4-3-2-1 capsule — five underwear/sock sets, four shirts, three bottoms, two layers, one jacket, all wrinkle-resistant, quick-drying fabric — covers up to ten days.

• Bag matters: a soft-shell spinner flexes into tight overhead bins better than a hard case.

• Check a bag? Still pack one outfit and your toiletries in the carry-on — cheap insurance against a bag that misses your connection.

• AirTag every checked bag. Turns “somewhere in the system” into “in a specific building in Charlotte” — far more useful to tell an agent.

• Power banks: carry-on only, never checked. It’s a safety regulation, and several airlines now restrict in-cabin use too.

• Passport: never in a seatback pocket. More get left there than almost anywhere else on the plane.

• Slip-ons + easy-access liquids — standard 3-1-1 rules (3.4 oz, one quart bag) still apply at most checkpoints.

• Bag fees jumped hard this spring, and a couple of carriers now charge Basic Economy more than standard fare for a first bag. Prepay online for a small discount, and check whether a travel card you already carry includes a free checked bag.

More here 👇🏻

Read more

Pilot Nick — 6 min read

You’re scrolling on your phone. A widebody drops toward a runway, rolls hard to the right, and its wingtip hangs a few feet above the concrete. Your stomach goes with it. You brace for the crash.

That was me on Thursday. And my honest first thought was:

This is fake.

I was so sure it was AI-generated that I almost scrolled past it. The wing was too low. The bank was too aggressive. The whole thing looked like one of those eerily smooth clips a machine spits out to farm outrage. I’d have bet money on it.

I lost that bet. It’s real. The lessor that owns the aircraft confirmed it. And the reason I was so certain it had to be fake is exactly why it’s so hard to watch now that I know it isn’t.

So let me walk you through what I saw and why a pilot’s brain refuses to accept it at first.

Why my gut screamed “fake” ✈️

1. Reason one: nobody does this in 2026.

Not because pilots have lost their sense of fun — a low pass, flown properly and briefed and approved, is a real and lovely thing. But a low pass like this one, uncoordinated and scraping the numbers? We know exactly how that movie ends, because we’ve watched it before.

In January 2008, Cathay Pacific’s chief 777 pilot, Ian Wilkinson, took delivery of a brand-new 777-300ER at Paine Field in Everett. After takeoff he turned back and buzzed the field, gear up, around 28 to 30 feet over the runway, with 50-odd people on board — including the airline’s chairman. Onlookers loved it. The video hit the internet. Within weeks he was fired and his first officer was suspended.

Seventeen years later, the playbook hasn’t changed. Camera, internet, regulator, consequences. Every professional pilot knows that story. Which is why my brain said: no one who knows that story would re-shoot it over a Texas resort.

2. Reason two: this wasn’t a slip. It was a decision.

In aviation we lean on something called just culture. The simple version: if you make an honest mistake a slip, a lapse, a judgment call that went sideways under pressure you’re not hung out to dry, because punishing honest error just teaches everyone to hide it. We protect the people who own up. That’s how the whole safety system keeps learning.

But just culture has a hard edge. It protects mistakes. It does not protect reckless, deliberate acts. And this was deliberate. The jet wasn’t even supposed to be there — it left its planned route to detour over the owner’s home field and set this up on purpose. You don’t accidentally arrive at zero feet in a steep bank. You choose it.

3. Reason three: you know the world is watching.

This is the part that truly breaks a pilot’s logic. You don’t need to imagine the camera anymore. In 2026 you can assume one is rolling, always. You know the clip goes viral by dinner. You know the FAA opens a file. You know your certificates — your career, your livelihood are suddenly on a regulator’s desk. The math never closes. The upside is fifteen seconds of applause. The downside is everything. So why? That’s the question I still can’t answer.

The detail that made no sense to me: clean config

Here’s what turned my disbelief into something closer to anger.

The jet was clean no flaps, gear up. To a non-pilot that sounds like a footnote. To me it’s the whole story.

A safe low pass is basically a planned go-around. You’d typically be configured — some flap, often the gear down — which lets you fly slower with a fat margin above the stall, engines spooled and ready, the airplane stable and predictable. That’s the version where, if something twitches, you have room.

Clean is the opposite. No flaps means the wing makes less lift at a given speed, so your safe minimum speed is higher and your cushion gets thinner the slower you go. Now roll that into a steep bank a few feet off the ground. Banking raises the speed at which the wing quits flying and tips your lift away from holding you up. And on a jet with a wingspan over 200 feet, the instant you roll toward the runway, the low wingtip is suddenly far closer to the ground than the wheels ever were.

Clean and slick is the configuration you pick if you want to look fast and dramatic. It is also the one that leaves you the least room when anything goes wrong — a gust, a patch of your own wake, a half-second of sink, a touch too much bank. There was no margin in that picture. None.

And history rhymes here too: in the Cathay case, the single detail that turned what might’ve passed for a normal missed approach into a fireable stunt was the gear being up. Same tell. Seventeen years apart.

Leave a comment

The facts, straight

Let me separate what happened from the noise online.

The aircraft is a 17-year-old Boeing 777-200LR, registration N705DN — a former Delta jet from 2009, retired around 2020. It was bought by Jetran, a Texas lessor, and converted into a freighter (the 777-200LRMF) by Mammoth Freighters.

It’s the first of five bound for Qatar Airways Cargo, which is the launch customer for the type. That’s why it wears Qatar’s livery.

On Wednesday, June 24, it was on a ferry flight from Grissom Aeroplex in Indiana to Fort Worth Alliance in Texas. It detoured to Horseshoe Bay Resort Jet Center — Jetran’s home base, a field with a 6,000-foot runway rated for aircraft up to regional jets, not widebodies — and made the pass. Here’s the part worth slowing down on. The lowest altitude FlightRadar24’s receivers recorded was 950 feet — which sounds survivable until you understand what that number is. ADS-B reports barometric altitude above sea level at standard pressure. Correct it for the actual air pressure that day (1018 hPa) and the field’s elevation (1,080 feet), and the jet was sitting between 0 and 25 feet above the ground. Runway level. The wingtip came within feet of the concrete in the bank.

The FAA is looking into it for careless or reckless operation and minimum-altitude rules. That can cost a pilot their certificates.

And the most important correction of all, because the comments got it wrong for two days straight:

This is not Qatar Airways. The plane wears the paint, but the title hasn’t transferred. Jetran still owns it. No Qatar pilots were on board. Jetran said plainly that the flight didn’t reflect operational standards, that the aircraft isn’t owned, operated, or registered by Qatar, and that it expects a full investigation and accountability. Blame the paint if you want — but blame the right people.

Leave a comment

What I keep coming back to

I wanted it to be fake. Fake is harmless. Fake is a machine showing off.

Real means two qualified people, in a working flight deck, decided the picture was worth the risk — to themselves, to a $100-million-plus airframe, and to anyone who happened to be near that runway.

The wing didn’t touch. This time.

That’s the only line between a viral clip and a smoking hole, and it’s the thinnest line I’ve seen all year. We don’t fly to the edge of that line for applause. We fly to keep a wide, boring, beautiful margin between us and it — every single time.

Fly Safe, Pilot Nick

Pilot Nick — 5 min read

The headline was built to make your stomach drop.

A Qantas jet. Halfway from London to Perth. Not enough fuel to finish.

Forced down in a mining town in the middle of the Australian outback.

If you’ve got a flight booked, that’s the exact sentence your brain files under see, I knew it.

Here’s the part the headline skipped: from inside the cockpit, this was a good day.

Let me show you why and why this week, of all weeks, the timing is almost too perfect.

What actually happened

QF10, a Boeing 787-9, left London on one of the longest passenger routes on Earth — roughly 17 hours nonstop to Perth on June 22, 2026.

Somewhere over the Indian Ocean, the wind turned. Headwinds stronger than forecast. (A headwind is just air pushing back at you; fight it for hours and you burn more fuel to cover the same distance.)

So the crew ran the numbers, reached a calm conclusion, and set the 787 down at Karratha a regional airport about 1,500 km north of Perth. One hour on the ground, top up the tanks, on to Perth.

No emergency. No danger. A late arrival and a refuel. That’s the entire story.

Fun fact: Karratha mostly serves the fly-in, fly-out crews of the region’s iron-ore mines. It had only been cleared to handle big international jets a few weeks before QF10 came knocking. Talk about timing.

Why pilots don’t panic about fuel

Here’s the thing most passengers never hear.

A pilot is almost never surprised by fuel. It’s the most predictable thing on the airplane before the engines even start, we know roughly to the kilo what we’ll have at every point along the route.

The fuel isn’t the wild card. The wind is.

So we don't plan for the wind we want. We plan for the wind that ruins the day and we carry the fuel for it in named layers.

On top of the fuel to actually get there, we add contingency fuel usually around 5% of the trip set aside for exactly this: a headwind stronger than forecast, or not getting the cruising altitude we asked for and burning more down low. Then comes alternate fuel: enough to fly to a backup airport if we can’t land at the destination. And underneath all of it sits the final reserve typically 30 minutes of flying we are never, ever allowed to touch.

Layers on layers. That’s the whole game.

There’s something else hidden in that flight plan, too. Over a long ocean crossing, it already names the nearest place to land at every single point along the way. Karratha wasn’t a frantic search at 38,000 feet. It was on the list the whole time, quietly waiting to be useful.

And we usually see it coming a long way off. We’re running fuel checks for the entire flight, so a developing shortfall shows up early often hours before it actually matters. That’s plenty of time to get on the radio to our operations team on the ground and set up the fuel stop calmly, in advance. By the time a jet like QF10 touches down to refuel, the people on the ground have been expecting it for hours.

So “ran low on fuel” is the scary translation. The cockpit translation is dull: the wind was worse than forecast, so we used a backup we’d written before we ever left London.

Dull is the goal. Dull is the entire job.

Now here’s why this week is wild

That little outback detour landed just days after Qantas unveiled the most ambitious flight in its 105-year history.

It’s called Project Sunrise. From October 2027, Qantas plans to fly Sydney to London nonstop — up to 22 hours in the air, the longest scheduled passenger flight the world has ever seen.

To pull it off, Airbus built them a special jet: the A350-1000ULR. Engineers bolted in an extra 20,000-litre fuel tank and stretched its range by around 1,000 nautical miles — far enough to make a route that used to be physically impossible.

And here’s the trade-off that tells you everything. This jet will carry just 238 passengers, instead of the 400-or-so a standard A350 could hold. Qantas gave up real, revenue-paying seats to make room for fuel — and for space to stretch out on a flight that lasts nearly a full day.

That’s the razor’s edge of ultra-long-haul. The longer the flight, the more every kilo of fuel and every gust of wind matters.

Which is exactly why a stronger-than-forecast headwind nudged a 787 into Karratha this week and exactly why Qantas is engineering so much margin into the 2027 jet. This week was a tiny, accidental preview of the whole challenge.

If the engineering grabs you, I took the full tour a few weeks back — four pilots, choreographed sleep in a hidden crew bunk above the cabin, and an 80-hour test programme aimed almost entirely at that new fuel tank — in 22 Hours. 4 Pilots. 10,573 Miles. Inside the Longest Flight in History. If today’s fuel story pulled you in, that one’s the full flight-deck breakdown.👇🏻

Leave a comment

Fun fact: The name Project Sunrise is a nod to the 1940s, when Qantas flying boats crossed the Indian Ocean in around 33 hours so long that passengers watched the sun rise twice on a single flight. The new jet is faster. The spirit is identical: respect the distance, plan for the long haul.

What this should actually tell you

If flying makes you nervous: a fuel diversion isn’t the system breaking. It is the system. The plane that lands early to top up is being flown by people who would always rather be an hour late than a drop short.

If you fly often: this is the new normal at the edge of the map. The longer the route, the bigger a vote the wind gets and the more an unscheduled stop becomes a sensible footnote instead of a scare.

And if you just love airplanes: you’re watching the limits of flight get pushed in real time. A mining-town runway, an extra fuel tank, and a 22-hour leap — all in the same week.

The three numbers I’d be watching on QF10 and the one I’d never let drop…

Read more

Pilot Nick · 4 min read

Summer flying is crowded, tight, and easy to get wrong this year. So here’s the short version — 28 years at the front of the airplane, distilled into the things I’d actually tell you at the gate.

A smooth trip isn’t luck. It’s set up on the ground, before you leave. Here’s how.

1. Take the first flight of the day. Delays compound as the day goes on — your evening flight is hostage to every problem the airplane had since breakfast. Mornings get cancelled less and fly through the smoothest air. Best single choice you can make.

More on why the worst-looking departure is secretly the smartest:

2. Go nonstop or leave real room. A nonstop can’t misconnect. If you must connect, give yourself 90+ minutes at a big hub in summer. The $40 you save on a tight layover is a loan, and the interest is your vacation.

3. Book in the window. Roughly 1–3 months out for domestic, 2–8 for international. Fly early in the week — it’s usually cheaper than weekends. Set a fare alert and let the price come to you instead of refreshing tabs at midnight.

4. Pick your seat on purpose. Over the wing if turbulence rattles you — it’s the steadiest part of the airplane. Aisle, forward of the wing, if you want a fast exit and first crack at rebooking. Skip the very back; it moves the most.

The exact seat I tell every white-knuckle flyer to book:

5. Skip the lines before you reach them. If you don’t have TSA PreCheck, Global Entry, or CLEAR, this is the summer to get them. And whatever you do — arrive earlier than feels necessary. Rushing is rocket fuel for stress, and summer security is slow. The shortcut most passengers walk right past:

6. Pack light and stay powered. Carry-on only means you never wait at a belt and never lose a bag. Bring a charged battery pack every delay drains your phone exactly when you need it. Screenshot your boarding pass in case the terminal Wi-Fi quits. Ten days, one carry-on — here's exactly how I do it:

7. Track the airplane, not just the flight. Turn on your airline app's push notifications — you'll often know about a delay or gate change before the agent announces it, and the first person to act gets the good seat on the next flight. The pro move: open Flightradar24 and find your inbound aircraft, the plane that becomes your flight. If it hasn't left its last city yet, your "on time" departure isn't. Apps like Flighty go further, predicting delays and flagging aircraft swaps before the airline says a word.

8. Nervous flyer? Tell the crew. We’re trained for it and genuinely glad to help. Then: slow your exhale longer than your inhale, keep your eyes on the horizon, and skip the second coffee — caffeine mimics the exact racing-heart feeling your brain reads as fear. The bumps are uncomfortable, not dangerous.

9. Can’t-miss trip? Fly in the day before. A wedding, a cruise, a flight you absolutely cannot miss is not a same-day-arrival trip in summer. The extra hotel night is the cheapest insurance you’ll ever buy.

That’s the whole list. Do the unglamorous work on the ground, and the flight becomes what it almost always is — ordinary, and over before you know it.

Before you go ✈️

Quick one for you — the Fly Calm Masterclass is the thing paid readers ask me about most, and summer is when it earns its keep. Maybe you’re the nervous flyer in tip #8, or maybe it’s your partner, your parent, or your kid who white-knuckles every takeoff.

If that’s you or someone you love, you can gift it — paid readers get a bundle rate.

Gift the Fly Calm Masterclass

Fly Safe, Pilot Nick

Pilot Nick - 6 min read

You probably saw it yesterday. The headline writes itself:

If you’re someone who already grips the armrest at takeoff, your stomach just went through the floor. The one thing you assumed was a given that the person in the left seat is allowed to be there suddenly feels like a question.

So take a breath.

I want to walk you through this one the way I’d brief it to my own crew. Because the headline and the reality are two very different aircraft.

Here’s the part I’ll say plainly before anything else: the man could fly the plane. That was never the allegation.

What actually happened

On Tuesday, Peel Regional Police announced the results of an investigation they’d named Project Icarus. They allege that a former Air Canada captain named in the coverage as Geoffrey Wall, now retired captained more than 900 domestic and international flights between 2009 and 2025 without holding the licence Canadian rules require for the job.

He’s facing seven criminal charges, including fraud, forgery and public mischief. Transport Canada has also levied a monetary penalty.

I’m going to keep using the word allegedly, because that’s what these are: allegations. Nothing here has been proven in court, and a charge is not a conviction. But the documented facts of the licensing gap are not really in dispute even Air Canada has acknowledged it.

So let’s talk about what that gap actually is. Because “without a licence” is doing an enormous amount of work in that headline, and it does not mean what you think.

“Without a licence” doesn’t mean what you think

There isn’t one pilot’s licence. There’s a ladder of them.

To fly passengers for an airline, you build up through a series of certifications, each one a higher bar than the last. The big two that matter here:

• A Commercial Pilot Licence (CPL) — this lets you fly professionally and get paid for it. It takes serious training, exams, and a flight test.

• An Airline Transport Pilot Licence (ATPL) — the top rung. In Canada, this is the licence a captain of a large airline aircraft is required to hold. You earn it mainly by clearing a battery of additional written exams — air law, meteorology, navigation, flight planning — on top of an experience requirement of well over a thousand hours.

Here’s the crux of the case. Police and Air Canada both say the accused held a valid Commercial Pilot Licence and was fully trained. What he allegedly lacked was the ATPL — the captain-level credential. The alleged crime isn’t that an untrained stranger wandered into the cockpit. It’s that the paperwork certifying he’d cleared that top rung was, police allege, fraudulent.

That’s a meaningful difference. “Unqualified to fly” and “missing a specific certification while demonstrably able to fly” are not the same sentence even though the headline blurs them into one.

The part that should reassure you

Now the most reassuring part of this whole story, the one almost no headline will mention.

In Canada, an airline pilot’s competence isn’t checked once, at licensing, and then trusted forever. It’s checked relentlessly, for your entire flying career.

Every six months, I’m back in a simulator being put through my worst day, engine failures, fires, failures stacked on failures and graded on it. Every twelve months, a certified check pilot rides in the cockpit on a real flight and watches everything I do. Air Canada has confirmed its pilots go through exactly this: recurrent training every six months, plus an annual flight check with a Transport Canada check pilot.

By the airline’s own account, this captain was repeatedly tested in the simulator and in the actual aircraft and met or exceeded the standard, year after year.

I’ve sat through dozens of these checks. I can tell you there is no faking your way through them. A check pilot watching you fly an approach in a crosswind, or handle an engine failure at the worst possible moment, sees through anything in about ninety seconds. Whatever the paperwork said, the flying was independently graded by the regulator over and over again.

So when the headline implies that 900 flights’ worth of passengers were at the mercy of someone who couldn’t do the job — the evidence we have points the other way. The flying was watched. Closely. The whole time.

These are the layers that were quietly protecting you on every one of those flights:

1. A fully qualified first officer in the other seat, trained to take over instantly.

2. Standard operating procedures that mean any two qualified pilots can fly together safely, even as strangers.

3. Recurrent simulator checks every six months, grading each pilot on emergencies you’ll thankfully never see.

4. An annual line check with a regulator’s check pilot riding along on a real flight.

5. The aircraft itself built with layers of redundancy so that no single point, human or mechanical, is the only thing keeping you in the air.

A licence is one layer. This story is about that one layer being allegedly faked. Every other layer was doing its job.

So if he could clearly fly the plane, why does the missing licence matter at all?

That’s the part worth paying attention to. And it’s where this story stops being reassuring and starts being important.

The five layers above are the whole reassurance and they’re real. But knowing he could fly the plane and understanding why the missing licence still matters are two very different things.

Read more

Pilot Nick - 8 min read

Thirty seconds.

That’s roughly how long it took a Boeing 767 over New Jersey to go from a textbook approach to clipping a light pole on a highway. At 500 feet, by the crew’s own account, the airplane was on speed and on profile. By the time it reached the airport boundary, it was about six feet off the ground — over a turnpike that sits short of the runway, where a stabilized approach would have it crossing the actual threshold near fifty feet.

That’s the whole story, and it’s worth understanding exactly how thirty good seconds became thirty dangerous ones.

I’ve now read the NTSB’s preliminary report on the May 3rd United approach into Newark a few times. I want to do something different with this one. Not reassure you — teach you. I’m going to put on my analyst hat and walk through this approach the way I’d debrief it in a training department, line by line.

Two things before I start.

1. One: the report is preliminary. The NTSB has not published a probable cause, and won’t for a while. Nothing below is an official finding. It’s my read of the published flight-data and cockpit-voice information, as a pilot who has flown this exact kind of approach hundreds of times.

2. Two: this is not a pile-on. Every honest pilot reading this report feels the same cold flicker of there but for the grace of God. The value here isn’t blame. It’s the lesson — because the lesson is one that keeps the rest of us alive.

First, the thing my regulars already know: what “stable” actually means

If you’ve read my earlier pieces on the stabilized approach, you can skip this. For everyone else, here’s the spine of the whole thing, because you cannot understand this incident without it. You can read below my article on approach stabilization:

Long before the runway, every airline approach has to pass through a gate, a specific altitude, usually 1,000 feet in cloud or 500 feet in visual conditions. At that gate, the approach must be stable, which means all of these are true at once:

• On path — on the correct vertical glidepath and lined up on centerline.

• On speed — at the target approach speed, not fast, not slow.

• Configured — gear down, flaps set for landing, nothing left to change.

• Controlled descent — a normal rate down, not a dive.

• Thrust set — engines spooled to a sensible power, not idle.

• Briefed and checked — every checklist complete, both pilots on the same page.

Here’s the part that matters most: if the approach is not stable at that gate, the rule isn’t “try to fix it.” The rule is go around. Climb away, sort it out, come back and try again.

A stabilized approach is not bureaucracy. It is the single most reliable predictor of a safe landing in all of aviation. Unstable approaches are behind a huge share of landing accidents — and almost every one of them had a go-around available that wasn’t taken.

Hold that thought. We’ll need it.

Leave a comment

The approach that was working

Now the flight. And I want to be fair to this crew, because the front half of this approach was normal.

It was a gusty afternoon — wind from the west at 19 knots, gusting 30, enough to give them what the captain described as moderate turbulence. Their landing runway had been changed three times during the descent, finally settling on runway 29, a runway with no precision electronic glidepath, where you fly the last segment visually using the runway’s approach lights.

At 500 feet, the first officer reported they were on speed and on profile. The captain answered the automated five-hundred-foot callout with one word: stable. By the book, that’s the gate passed.

So far, so normal. Gusty, busy, but normal.

Then came the choice that, in my read, set the trap.

The duck-under and what really happened…

It's a technique nearly every pilot has used and gotten away with. Below, I'll show you exactly what he did, the thirty seconds it came apart, and the one option that sat on the table the whole way down to six feet.

Read more

Pilot Nick · 10 min read

You’re three hours into a normal flight. The cabin lights are dim. You’ve already eaten one meal, watched half a movie, and looked at your watch twice. Your seatmate is asleep with their mouth slightly open.

You shift in your seat and do the math you don’t really want to do.

Three down. Seven to go. Maybe eight if there’s a headwind.

Now imagine fourteen to go.

Or eighteen.

Or twenty-two.

That’s the question Qantas is about to answer for the first time in commercial aviation history and on Tuesday, June 2, the airplane built to answer it left the ground in Toulouse for the first time.

Up at 35,000 feet, the question we’re asking is different from yours. We’re not asking how you will get through it. We’re asking how we will.

What just happened in Toulouse

On June 2, 2026, the first Airbus A350-1000ULR — the Ultra Long Range variant built specifically for Qantas — completed its maiden flight from Toulouse. Three hours and 43 minutes. Cruise at 41,000 feet over the Bay of Biscay. Two Airbus experimental test pilots and four flight-test engineers on board.

That sortie was the official beginning of an 80-hour flight-test programme that will run for about two months, focused almost entirely on one part of the airplane: the fuel system.

Because this isn’t a normal A350.

The A350-1000ULR carries a 20,000-litre extra rear-centre fuel tank that adds roughly 1,000 nautical miles of range over the standard -1000, giving the airplane a total range approaching 10,000 nautical miles. When it enters service, it will be the longest-range commercial airliner ever built surpassing the A350-900ULR that Singapore Airlines uses on the Singapore–New York run.

Qantas has ordered 12 of them. The first won’t be delivered until April 2027 (the original end-2026 timeline slipped due to supply chain issues). But the airplane that will fly Sydney to London Heathrow nonstop — 10,573 miles, the longest commercial route in history is now flying, and Qantas expects to launch commercial service in the first half of 2027.

For context: today’s longest commercial flight in the world is Singapore Airlines’ SQ23/SQ24 between Singapore Changi and Newark Liberty — roughly 9,537 miles, 18 to 19 hours in the air, flown by the A350-900ULR (the previous generation of the same family). That’s the route the industry already considers the edge of the operational envelope.

Project Sunrise adds roughly four more hours and another 1,000 miles on top of it.

That much you can read in the press release. Here’s the part the press release doesn’t tell you.

The airplane is the easy part of Project Sunrise. The humans are the hard part.

What 22 hours actually feels like up front

I’ve flown 8-hour transatlantic legs, 12-hour Asia–Europe legs, 14-hour Asia –US legs. I have never flown 22 hours nonstop, because no commercial pilot ever has. Even Singapore Airlines SQ23 — today’s longest commercial sector — tops out at 18 to 19 hours.

Project Sunrise is asking the industry to push that envelope by another four hours. Which, in flight-deck terms, is enormous.

Here’s why.

In the cockpit, the metabolic cost of flying isn’t the actual stick-and-rudder work — the autopilot does most of that. The metabolic cost is the constant vigilance. You’re monitoring six fuel tanks, four engine indicators, weather radar, traffic radar, ATC frequencies in three regions, oceanic crossing procedures, alternate airport availability over the next 1,500 miles, and the dozen subtle ways the airplane talks to you when something is starting to drift. You’re doing that at 41,000 feet in a 12% humidity, 800 mb pressure environment that is steadily dehydrating you, regardless of how much water the cabin crew brings up.

For 8 hours, this is manageable.

For 18, it requires choreographed sleep.

For 22, it requires choreographed everything.

Leave a comment

The 5 things Project Sunrise had to solve before a single commercial passenger could board

The aircraft modification is one of five solvable problems. Here are the other four and how the system answers each one.

1. The range problem (solved by the engineers)

An A350-1000, off the showroom floor, cannot do Sydney to London nonstop. It’s roughly 800 nautical miles short, depending on payload and winds.

So Airbus took the most fuel-efficient widebody on the market and added a 20,000-litre rear-centre tank. The fuel system now has to manage a larger, more complex weight distribution which is why this week’s flight tests are 80 hours, two months, and focused almost entirely on the fuel system. The certification is not about whether the engines run. It’s about whether the new fuel architecture is safe in every fuel-loading scenario, including the one where you suddenly need to divert with 80% of your fuel still on board.

2. The duty-time problem (solved by the regulators)

The standard regulatory duty-time limit for two pilots is in the order of 13 to 14 hours from sign-on to engines off. A 22-hour flight, by definition, blows through that limit before you’re halfway across the Indian Ocean.

The fix is a 4-pilot crew. Two captains, two first officers effectively two complete cockpit teams. All four are in the cockpit for takeoff and landing — standard procedure at every ULR carrier, because the highest-workload phases of the flight deserve the highest level of human redundancy. The rotation happens during cruise: each pilot gets one long rest break (~4 hours) and one short break (~2.5 hours) in a dedicated crew bunk above the main cabin, choreographed so the pair flying the approach is the most rested one.

In real life: when you board a Project Sunrise flight, there are four pilots on your manifest, and all four are up front when you push back from the gate. The system is older than you think — Singapore, Qantas, Emirates, and Cathay have been running variants of this for over 20 years on slightly shorter ULR routes.

3. The biology problem (managed by science, not engineering)

The human circadian rhythm does not know what year it is, what time zone you crossed, or what your boarding pass says. It runs on a roughly 24-hour clock anchored to light.

On a 22-hour flight, you will cross every time zone on Earth. Your body will not know what time it is, even after you land. This isn’t a passenger problem — it’s a pilot problem, because the pilots flying your approach are the same pilots whose circadian rhythm has been shoved through a blender.

This is why Qantas has spent years on circadian research. The cabin lighting is engineered to push passengers (and crew) onto destination time within the first few hours. Meals are timed deliberately. The pilots’ rest cycles are choreographed against their personal sleep timing, not just the clock.

4. The “fresh for the approach” problem (the hardest one)

This is the one keeping the safety analysts up at night.

The approach and landing phase of any flight is the most safety-critical part. It’s also, in a normal flight, the part the pilots are freshest for, because they’re at the start of their duty period.

On a 22-hour flight, the approach happens at the end of the duty period. The pilots flying you into Heathrow have, in theory, been awake or rested-poorly for most of the last day. The system mitigates this — the pilots who land the airplane take the long mid-flight rest break specifically so they’re as fresh as possible for descent — but it cannot eliminate the basic biological cost of being on duty for 22 straight hours.

5. The unknown-unknowns problem (still being tested right now)

This is what the next 80 flight-test hours are for.

Every ultra-long-range aircraft brings a category of failure modes that didn’t exist on shorter flights: fuel pump behavior during a 22-hour cycle, hydraulic system aging on a single sortie, crew rest area performance over long durations, cabin pressurization stability over 22-hour cycles, even avionics cooling behavior when the systems have been running uninterrupted for a day.

None of these are likely to fail. All of them have to be proven.

The framework above is the system. But the most useful thing for a passenger isn’t understanding the engineering — it’s understanding what your actual experience will be in three real scenarios most ULR passengers worry about.

Read more

🕒 9 min read · Black Box Series · Episode 03 · Pilot Nick

You’re in seat 9F.

It’s a routine afternoon — Denver to Chicago, drinks served, descent still an hour away. The sun is hitting the wing through the window. You’re maybe halfway through your magazine.

Then a bang you feel in your ribs.

Not a clunk. A bang. The whole airplane lurches sideways. Your tray slides. Somewhere behind you, a glass breaks. The engines — you can’t quite put your finger on what’s different, but something is off.

The seatbelt sign comes on. The captain’s voice comes over the PA, calmer than it has any right to be.

“Ladies and gentlemen, we’ve had a problem with our number two engine. We are diverting to Sioux City.”

That’s the polite version.

Up at FL370, the cockpit just lost the airplane.

If you’re new here Black Box is the series where I take a real aviation incident and break it down the way a pilot actually thinks about it.

Not the news version. Not the dramatized version.

The version from the left seat.

What the crew saw. What they decided. Why. And most importantly for the nervous flyers reading this what changed afterwards, so that you never have to.

Here’s what almost nobody — passenger or pilot — fully understood about wide-body airliners on July 19, 1989.

A DC-10 has three hydraulic systems. Three. Each one independent, each one rated to fly the airplane on its own. You can lose one. You can lose two. The third one will still move the rudder, the elevators, the ailerons, the flaps, and the landing gear.

The design philosophy was simple: no single failure should be able to take all three. The probability of losing all three hydraulic systems on a DC-10 was calculated at roughly one in a billion flight hours.

Then a fan disk in engine number two — the one mounted in the tail — failed.

Not a crack the airline missed. A microscopic metallurgical defect, present in the titanium since the disk was forged 18 years earlier, that finally let go after 41,000 cycles of heating and cooling and spinning at 8,000 rpm.

The disk burst.

Shrapnel sprayed through the tail at hundreds of miles per hour and severed the lines of all three hydraulic systems — every one of which, for design reasons that made sense in 1968, happened to pass within a few feet of each other right behind that engine.

In about two seconds, the crew of United 232 had a DC-10 with no working flight controls.

No rudder. No elevators. No ailerons. No flaps. No spoilers. No nose-wheel steering. Nothing.

And the good news — yes, there is some — is what they did next.

Captain Al Haynes had been flying for 33 years. 30,000 hours. He’d never seen anything like this. Nobody had.

His first instinct, the one drilled into every airline pilot, was to grab the checklist. Loss of all hydraulics. He looked. There was no procedure.

There was no procedure because the situation wasn’t supposed to be possible.

The airplane was now in a slow right roll, pitching gently up and down in a long, lazy oscillation pilots call a phugoid — the natural rhythm an airplane settles into when nobody is flying it. Nose up, slow down. Nose down, speed up. Sixty seconds per cycle. Beautiful, almost, except they were 37,000 feet over Iowa with 296 people behind them.

First Officer William Record was on the controls and feeling nothing. The yoke moved freely. None of it did anything.

In the cabin behind them was a man named Dennis Fitch an off-duty United Check Airman who happened to be deadheading home. A DC-10 instructor. He’d actually trained for a hydraulic-loss scenario in a simulator, just out of curiosity, and discovered something interesting: you could sort of steer an airplane with the throttles.

Push the left engine forward, the airplane yaws and rolls right. Push the right engine, it rolls left. Add thrust to both, the nose comes up. Pull both back, the nose drops.

Fitch walked into the cockpit, introduced himself, and offered to help.

Haynes pointed at the center pedestal.

For the next 44 minutes, Fitch knelt on the floor between the captain and first officer, his hands on two thrust levers, flying the airplane the way nobody had ever flown an airplane before. Haynes ran the radios and the cabin. Record held the useless yoke. Second Officer Dudley Dvorak worked the system pages, looking for anything that could be saved.

Four pilots. Two engines. Zero flight controls. One runway in Iowa.

This is the part nobody trains for. So here’s what they did instead.

The 5 things the crew did right — without a checklist

These weren’t steps in a procedure. They’re what airline pilots now study as the textbook for “no procedure exists.”

1. They flew the airplane first.

Before anything else — before the radios, before the cabin, before the diversion — they flew.

In that order, always. The temptation when something catastrophic happens is to start talking, start asking, start fixing. The crew of 232 did none of that for the first 90 seconds. They figured out what the airplane was doing, then what it would do next, then what it might let them do.

2. They accepted the airplane they had.

Haynes never tried to get back the airplane they’d taken off in. He worked with the one he had. No working controls? Fine. What does work? Two throttles. Okay. We fly with two throttles.

3. They put the right person on the right job — immediately.

Fitch was a passenger. Fitch was also the only person on board who’d ever thought about flying a DC-10 with throttles alone. Haynes didn’t care about rank, schedule, or who was supposed to be where. He looked at the problem and put the most-qualified hand on it within two minutes of Fitch walking through the cockpit door.

4. They told the truth, fast.

Haynes got on the radio with Sioux City approach and told them, plainly: “We have almost no controllability.” Not “we have a problem.” Not “we’re declaring an emergency.” A specific, factual description that let the ground know exactly what was about to land on them and gave them 40 minutes to position every fire truck, ambulance, and Air National Guard medic in the county.

5. They kept their sense of humor.

This is the one that gets quoted most. When the approach controller cleared them to any runway, Haynes laughed and said, “You want to be particular and make it a runway, huh?” That isn’t gallows humor. That’s a crew whose stress was so far past the red line that the only way to keep working was to acknowledge it. Pilots call this winding the clock — doing something small and human to keep your nervous system below the threshold where it stops thinking.

This is the part the public never sees. The crew of 232 didn’t survive because they were braver. They survived because they had a system — and when the system ran out of procedures, they had each other.

“Could this happen on my flight today?”

Read more

You’re in 14A. Window seat. Somewhere over the Carolinas in July.

Outside, the cloud has been building for twenty minutes — first cottony, then bruised, then black. The cabin lights flicker once. Twice. There’s a flash, white and total, then a crack that doesn’t sound like anything you’ve heard before.

A kid two rows back yells. Your hand finds the armrest. The man across the aisle whispers “oh god” under his breath, and you realize you said it too.

You want someone, a calm voice, an adult voice to come over the PA and tell you everything is okay.

Up at 37,000 feet, we know that feeling. We just don’t have it.

Here’s what most people get wrong about lightning.

They think the bolt is the danger.

It isn’t. The bolt is a discharge. A photograph of something that already happened. By the time you see the flash through your window, the physics are finished — the airplane took the strike, the current ran around the aluminum skin to the trailing edge, and it left the airframe somewhere out behind us, probably without leaving so much as a scorch mark.

The danger isn’t the lightning. The danger is the cloud that produced it.

And the cloud that produced it is something we worked out how to handle forty miles ago, on the ground, before any of this started.

That’s the part no one tells passengers. They imagine pilots squinting through the windshield, white-knuckled, “trying to make it through the storm.” We’re not. We’re managing distance. We’re managing geometry. We’re managing the small set of decisions that turn lightning from a problem into a non-event.

Let me tell you about an actual one.

Atlanta to Newark. Evening flight. A line of thunderstorms had been forming all afternoon along the spine of the Appalachians — the kind of line you can see on the weather radar from 200 miles away, painted in cells of yellow, red, and the magenta we call the bad ones.

My first officer and I briefed the line on the ground, before we even started engines. We knew where the gaps were. We knew which cell we’d deviate around first. We had a fuel number for the diversion and a fuel number for the divert-to-Charlotte-instead.

We launched. Climbed through 18,000 feet. At cruise, we were 40 miles out from the first cell when ATC cleared us to deviate left of course. We did. We threaded the line.

And then, between two cells we had already decided were safe to fly between — crack.

A flash so bright it lit the cockpit like a stage light. A sound that doesn’t have a real name. The autopilot stayed engaged. The instruments stayed green. My first officer looked at me. I looked at him. He said, “Well, that was a strike.” I said, “Yep.”

We finished the flight. Ground crew looked the airplane over in Newark. They found a tiny exit burn near the right horizontal stabilizer. Nothing structural. Nothing the airplane wasn’t built to take.

The strike was a non-event. The decision that prevented it from being an event was made on the ground, 90 minutes earlier, with a coffee in our hands and a flight plan on the table.

That’s the principle. The flash isn’t the moment. The moment was always earlier.

A small confession before we get into the framework.

When we know the line ahead has lightning and we know we’re at our 20-mile distance, we don’t dread it. Most pilots love it.

At night, if the storms ahead are really firing, we’ll turn the cockpit lights all the way up. Counter-intuitive, you’d think dim is better but bright lights keep our eyes adapted to brightness, so when the next bolt lights up the sky, we don’t go temporarily blind from the flash.

Then we watch.

A thunderstorm at night, from the flight deck, with the right distance between us and it, is one of the most beautiful sights in this job. Cells lighting up from inside like paper lanterns. The whole horizon flashing white, then black, then white again.

We’re not white-knuckled up there. We’re often quietly grinning.

Here’s the framework — five steps. They map to the cockpit, but I’ve written each with a version you can use from 14A.

Step 1: Decide on the ground, not in the air

In the cockpit, we don’t make storm decisions while we’re flying through them. We make them on the ground, with charts and forecasts, hours before takeoff. By the time we’re airborne, the decision is already made — we’re just executing it.

You can use this immediately. If you’re a nervous flyer and you know you’re flying in summer, the moment you’re in the air with a flash outside your window is the worst possible time to start managing fear. Do that work the night before. Read the route forecast. Look at the radar from your hotel room. Decide, before the gate, that you’ve already accepted what you might see.

One practical move while you're still on the ground: if you don't love thunderstorms, book the early flight. Convective weather builds with the heat of the day — most thunderstorms in the US form between 2 and 6 p.m. local. A 7 a.m. departure usually beats the system entirely. It's the single cheapest fix in this article, and most passengers never use it.

Step 2: Read the radar, not the flash

Check the actual radar trend the night before, Windy is the simplest version of what we look at up front. Don't rely on the icon on your phone weather app. Storms in the southeastern US tend to form mid-afternoon and dissipate after sunset. A 9 a.m. departure into a 4 p.m. arrival window is a different conversation than a 4 p.m. departure into the same window.

Step 3: the 20-mile rule

The standard separation in commercial flying is 20 nautical miles upwind of a thunderstorm cell. Most carriers train to it. Some require more. The number isn’t arbitrary — it’s far enough out that we’re clear of the hail, the wind shear, and the strongest vertical currents.

Step 4: Trust the aluminum cage

Every commercial airliner is certified for lightning. The skin of the aircraft is a “Faraday cage” the current travels around the outside and exits at a trailing edge, usually through a wick designed exactly for that purpose.

Here’s the math passengers never see:

• Every commercial airliner is struck by lightning, on average, once a year.

• That works out to roughly “one strike per 1,000 flight hours.”

• Across the global commercial fleet, that’s “tens of thousands of strikes a year” almost none of which make the news, because almost none of them do anything.

The last passenger jet brought down by lightning in the United States was “Pan Am Flight 214 in December 1963”.

After it, the FAA rewrote the lightning protection standards. Every airliner certified since has been built to those rules. No commercial jet designed under them has ever been brought down by a strike.

Here’s what a strike actually looks like from seat 14A:

A flash. The cabin lights might flicker, they might not. If you’re at the window, you’ll see white for a half-second, like a camera flash close to your face.

Then a crack. Loud. Sometimes a deep boom, sometimes a sharp snap. It depends on where you’re sitting and where the strike exited the airframe.

Sometimes not always, a faint smell of ozone in the cabin a few minutes later. Same smell as after a thunderstorm on the ground.

That’s it.

The autopilot stays engaged. The screens stay green. The flight attendants keep walking down the aisle with the cart. The captain might come on the PA and say “you may have noticed we just took a lightning strike, everything’s normal.” Some captains don’t even mention it.

After landing, the ground crew walks the airplane with a checklist. They find an entry mark and an exit mark usually pinhead-sized, sometimes the size of a quarter. The airplane is back in service in 30 minutes.

That’s the entire event.

I have been struck. My colleagues have been struck. The airplanes were fine every time.

You can use this immediately. When the flash happens and at some point in your flying life it might — your body will tell you the airplane is broken. Your eyes will tell you the airplane is fine. The airplane is fine. Believe your eyes.

Step 5: Aviate—Navigate—Communicate

This is the oldest piece of pilot wisdom there is. When something happens in the cockpit, the order is non-negotiable. First we keep flying the airplane. Then we figure out where you’re going. Then and only then do you talk about it. But I’ll tell you we plan ahead, way ahead…

Pilots aren’t calmer than passengers because we’re braver. We’re calmer because we’ve already decided what we’re going to do, long before there’s anything to do.

Read more

Pilot Nick — 4 min read

Each edition: real questions from real passengers. Real answers from the cockpit.

Because knowledge beats fear every time.

And yes… we’ll go a little deeper for the avgeeks too.

Lessons From The Flight Deck ✈ is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

👇 This Edition’s Questions:

This month’s three questions share something in common — they’re all about the invisible layer of every flight you take. The conversations you can’t hear. The river of air you can’t see. The decisions being made before you’ve even buckled your seatbelt.

Let’s go.

💬 Question #1: “What do pilots actually talk about up there? Is it boring during cruise?”

✈️ You picture us up front, hours into a flight, watching the autopilot do its thing. So what’s actually happening behind that locked door?

The short answer: it depends entirely on the altitude.

Below 10,000 feet — the “sterile cockpit”

There’s a rule in aviation called the sterile cockpit rule. Below 10,000 feet — climb out and descent — no conversation is allowed that isn’t directly related to operating the aircraft. No chat about the weekend. No coffee orders. No “did you see the game last night.”

Why? Because those phases of flight are where 80% of incidents historically occur. Takeoff, climb, descent, approach, landing — that’s when we’re configuring the aircraft, talking to multiple ATC controllers, scanning for traffic, briefing approaches, and managing the highest workload of the entire flight.

A casual remark at the wrong moment can pull attention away from a critical task. So we don’t make them.

Inside the cockpit during those phases, you’d hear something close to a surgical theatre: checklists, callouts, instrument scans, ATC readbacks. Precise, calm, deliberate.

Above 10,000 feet — different rhythm

Once we’re established in cruise, the workload drops dramatically. The autopilot is flying, the FMS is navigating, the systems are monitoring themselves and reporting any issue instantly.

But “boring” isn’t the right word. It’s more like active monitoring.

We’re cross-checking fuel burn against the flight plan. Watching weather radar 100 miles ahead. Listening to ATC for traffic in our area. Reviewing the arrival and approach for our destination, often hours before we get there. Checking alternate airports in case something changes.

And yes — we also talk.

About the flight, about flying in general, about the industry, about our families, about whatever interesting thing one of us read last week. Cockpits are small spaces, and over the course of a 10-hour flight you learn a lot about the person beside you. Some of my best conversations in 25 years have happened at 38,000 feet over the Atlantic at 3 AM.

The pilot truth:

The locked cockpit door creates this idea that something mysterious is happening up front. It isn’t. It’s two highly trained professionals doing a job that alternates between intense concentration and quiet vigilance with the occasional good conversation in between.

The bottom line:

Below 10,000 feet, we’re surgeons. Above it, we’re navigators with a view. Either way, we’re never just “sitting there.”

💬 Question #2: “Why does the same flight take longer in one direction than the other?”

✈️ You fly New York to London in 6 hours. The return takes 7.5. Same aircraft, same route, same distance. What gives?

You’re flying through a river of air and which way it’s flowing changes everything.

Meet the jet stream

At cruise altitudes — roughly 30,000 to 40,000 feet — there are massive ribbons of fast-moving air circling the planet. The most famous is the North Atlantic jet stream, which generally flows from west to east at speeds that can exceed 250 mph.

That’s not wind in the way you experience it on the ground. That’s a moving conveyor belt of air the size of a small country.

Fly with it (eastbound) and your ground speed gets a huge boost. Fly against it (westbound) and you’re effectively swimming upstream.

A Boeing 777 cruising at Mach 0.84 might be doing 560 mph through the air — but with a 150 mph tailwind, it’s covering ground at 710 mph. Turn around and fly home, and that same aircraft is now making 410 mph over the ground. Same aircraft. Same engines. Same fuel burn. Two completely different flight times.

Read more

Pilot Nick · 8 min read

You’re in seat 24C, three hours into the flight, somewhere over the ocean.

The cabin lights are dim. The person next to you is asleep. You glance up at the little compartment above your head, the one you’ve never seen open and you think, just for a second:

what would it actually feel like if those masks dropped right now?

You’ve seen the safety video a hundred times. You know “put yours on before helping others.” You know it means breathe normally.

You also know, somewhere in the back of your mind, that the safety video doesn’t tell you what comes before the mask. Or after. Or what the pilots are doing in the 30 seconds you’d be fumbling with the elastic.

Up at 35,000 feet, we know that feeling too, not as passengers, but as the pilots who train for this scenario more than almost anything else in the simulator.

What most passengers get wrong about that yellow mask

Most people think the scary part of cabin pressure is the moment the mask falls from the ceiling.

I’ll tell you what’s actually scary if you’re a pilot: the version where the mask doesn’t fall because the cabin never gave anyone a warning loud enough to react to.

The cabin pressurization system is one of the most reliable systems on the aircraft. So reliable that most passengers fly thousands of hours over a lifetime and never give it a thought.

That reliability is also why, when something does go wrong, the second-most-feared cabin event for nervous flyers becomes the one almost nobody understands.

Here’s the truth your safety card doesn’t have room for: those yellow masks aren’t a parachute.

They’re a clock.

And once you understand the clock, you understand the entire procedure including why the pilots’ first job isn’t to comfort you.

It’s to dive.

Even if we fail, the airplane doesn’t

Most modern private jets and the Airbus A350 are equipped with a system called Automatic Emergency Descent — AED for short or ADM (Automatic Descent Mode)

If the cabin altitude crosses a critical threshold and the pilots don’t react within seconds — because they’re already hypoxic, incapacitated, or simply too slow — the autopilot and autothrottle take over. The airplane disconnects from its cruise route, banks roughly 90 degrees off the airway to clear traffic below, pulls the throttles to idle, deploys the speed brakes, and dives toward 10,000 feet on its own.

No pilot input required.

On every other airliner — which is still the majority of the fleet flying today — the pilots execute the exact same maneuver themselves. And that is precisely what we train, in a full-motion simulator, every six months.

It was engineered into the airplane for one reason: because hypoxia takes away the judgment to recognize hypoxia, the system can no longer assume a human will catch it in time. So the system catches itself.

This is the second clock you didn’t know was running. The first is the oxygen in the yellow mask. The second is the airplane itself already programmed to do what your body would be trying to do, if it could.

What we actually train for and what “emergency descent” really means

Every six months, I sit in a full-motion simulator for a recurrent training session. Cabin decompression is on the syllabus almost every single time — right alongside engine failure on takeoff, fire warning at altitude, and a rejected takeoff at decision speed. It is, statistically, one of the four scenarios airline pilots rehearse more than any other.

This is not a “we covered it once” kind of training. This is a “we run it until our hands move before our brain does” kind of training.

So when you hear the phrase emergency descent, here’s what’s actually happening in the cockpit:

Masks on, within two seconds. Both pilots reach for their quick-don oxygen masks the moment the cue is recognized. Mask first. Communicate second. The cockpit oxygen system is independent of the cabin’s — stored at high pressure, lasts far longer, and is the reason the pilots can keep flying the airplane while you breathe through your yellow one.

Autopilot stays engaged. Modern philosophy is to let the automation do the precision work while the humans manage the procedure. We don’t disconnect to “fly it manually” because we’re brave. We let the autopilot fly because it doesn’t get hypoxic.

90-degree turn off the airway. Other traffic is below us; we need to get out of their cruising level before we descend through it. The turn is automatic on aircraft equipped with ADM, manually flown on those that aren’t.

Throttles to idle. Speed brakes out. Nose down. The airplane is now in a high-speed descent at, or just below, its maximum operating speed (Vmo/Mmo) typically 4,000 to 6,000 feet per minute, roughly the descent rate of a fast express elevator.

Level off at 10,000 feet or the minimum safe altitude over terrain, whichever is higher. Below 10,000, the air outside is breathable on its own. The clock stops there.

The whole sequence, from chime to level-off, is usually complete in 3 to 5 minutes.

From the cabin, it feels like the plane is falling. From the cockpit, it feels like the airplane is running the same checklist we’ve run forty times in the simulator — because it is.

The quietest decompression is the deadliest

Pilots are trained for three kinds of cabin pressure loss, each with a different time signature:

The danger isn’t the pressure differential. It’s the hypoxia.

Hypoxia doesn’t feel like suffocation. It feels like being fine. Mild euphoria. Slightly slurred speech. A little tunnel vision. The judgment to recognize what’s happening is one of the first things hypoxia takes away.

The textbook example is Helios Airways Flight 522. August 2005. A Boeing 737-300 climbed out of Larnaca with its pressurization controller left in MANUAL after maintenance the night before. The cockpit warning sounded and the already-hypoxic crew misread it as a different alarm. The passenger masks dropped automatically. The system worked. The people didn’t.

The aircraft flew its programmed route alone for over two hours before fuel exhaustion. 121 souls lost. No mechanical failure only a missed switch, a confusing alarm, and a kind of decompression that doesn’t announce itself.

Helios is the reason almost every modern airliner and corporate jet manufactured since has been engineered with Automatic Descent Mode. The same chain of events on a 2026 aircraft ends with the autopilot saving everyone before hypoxia ever finishes its work.

You don’t gamble with the quiet kind and the engineers, after Helios, made sure the airplane wouldn’t either.

Read more