Europe adds to FAA’s Max advice

The European Union Aviation Safety Agency (EASA) has published a Proposed Airworthiness Directive (PAD) , signalling its intention to approve the Boeing 737 MAX’s return to Europe’s skies “within a matter of weeks” – probably about mid-January.

But Europe is specifying a few requirements that the US Federal Aviation Administration (FAA) has not demanded.

It was on 20 November that the FAA approved the aircraft’s return to America’s skies, but US carriers have many preparations to complete before resuming commercial services with the Max. American Airlines reckons it will be ready by the end of December.

EASA, however, wants to see the application of some operational measures that the FAA does not require. It insists, nevertheless, that the Max airframes in America and in Europe will be the same. The agency explains: “The [PAD] requires the same changes to the aircraft as the FAA, meaning that there will be no software or technical differences between the aircraft operated by the United States operators and by the EASA member states operators.”

The EASA PAD is a consultation document, and all responses have to be received by 22 December. EASA executive director Patrick Ky is at pains to point out that the agency, while cooperating with the FAA on correcting the anomalies in the Max’s manoeuvring characteristics augmentation system (MCAS) (see immediately preceding blog entry), insisted on looking independently at the whole issue.

Ky explained: “EASA’s review of the 737 MAX began with the MCAS but went far beyond. We took a decision early on to review the entire flight control system and gradually broadened our assessment to include all aspects of design which could influence how the flight controls operated. This led, for example, to a deeper study of the wiring installation, which resulted in a change that is now also mandated in the [PAD].” That, basically, is a requirement to bring the venerable 737’s design up to date, and is a signal that the days of “grandfather rights” – a dispensation to build the 737 Max as earlier versions of the 737 were constructed rather than as new aircraft have to be designed – are numbered.

The Max airframe design came through all the handling tests satisfactorily, as Ky explained: “We also pushed the aircraft to its limits during flight tests, assessed the behaviour of the aircraft in failure scenarios, and could confirm that the aircraft is stable and has no tendency to pitch-up even without the MCAS.”

Two principle differences between the FAA and EASA requirements are explained as follows: “EASA explicitly allows flight crews to intervene to stop a stick-shaker from continuing to vibrate once it has been erroneously activated by the system, to prevent this distracting the crew. EASA also, for the time being, mandates that the aircraft’s autopilot should not be used for certain types of high-precision landings [and approaches such as RNP-AR]. The latter is expected to be a short-term restriction.”

The crew intervention mentioned would allow the pilots to pull the stick-shaker circuit breaker. The stick-shaker – a system designed to alert pilots to an approaching stall – was one of the distractions that faced the Lion Air and Ethiopian Airlines crews before they lost control of their aircraft, despite the fact that the shaker was triggered by a false warning.

The FAA doesn’t see the need for this intervention, because the modifications have ensured that a single sensor failure will not trigger the stick-shaker any more.

Boeing and EASA say they have agreed to continue tests to see if they can further strengthen the aircraft’s systems’ resilience to angle of attack (AoA) sensor failures – the causal trigger for the two fatal Max accidents, and Boeing has also made this promise: “Boeing will also conduct a complementary Human Factor assessment of its crew alerting systems within the next 12 months, with the aim of potentially upgrading these to a more modern design approach.”

Max to the skies again

After nearly two years of grounding, Boeing’s 737 Max series has been cleared by the US Federal Aviation Administration to carry fare-paying passengers once again.

This is the first step in a redemption process for one of the world’s truly great engineering companies. Like a boxer who dropped his guard for just a second, Boeing has taken a punch that has knocked it to the canvas, and the referee had started counting.

Now, air traveller reaction is nervously awaited. Will the public believe claims by the FAA and Boeing that, together, they have confined to history the flaws that caused the 737 Max fatal crashes in 2018 and 2019?

The FAA – blamed along with the manufacturer for the lapses in design oversight that led to the two accidents – has declared the aircraft safe to operate in America. One by one, other national aviation authorities (NAA) are expected to follow suit.

Oversight of the type’s rehabilitation continues to be the FAA’s responsibility, but decisions on the systems and software changes applied to the Max have been made by multinational teams. Bodies formed to decide what changes were needed – and then to see them implemented – included the Joint Authorities Technical Review (JATR) representing nine nations plus the European Union Aviation Safety Agency (EASA) – and the Joint Operations Evaluation Board.

The relationship between the FAA and Boeing was much criticised in the accident investigations and the JATR review process . For that reason, the reaction of EASA to the Max’s clearance to fly is seen as critical.

Not only is EASA the agency that oversees safety in the region containing the largest group of aerospace industries outside America, but its contribution to the JATR recommendations made clear EASA was not happy with the FAA’s former piecemeal approach to certifying critical changes applied to the 737 Max.

Its opprobrium was directed particularly at the FAA’s approval of the flawed Manoeuvring Characteristics Augmentation System (MCAS), unique to the Max, and not used in earlier marques of 737. It recommended “a comprehensive integrated system-level analysis” of the MCAS, and of its integration into the total system-of-systems that constitutes a modern aircraft (for more detail, see “The Failures and the Fixes” section following this article).

So it was with heartfelt relief that Boeing heard EASA’s executive director, Patrick Ky, report on Max progress to the European Parliament Transport Committee on 29 October. Ky told them: “We are fully confident that, given all the work that has been performed, and the assessments which have been done, the aircraft can be returned safely to service.” Ky’s statement suggests EASA will re-certificate the 737 Max in Europe soon after the FAA’s announcement.

Meanwhile, out in the real world, Covid-19’s near-immobilisation of commercial air transport worldwide has rendered the Max’s long grounding almost invisible to the media and the public. Because of the far lower level of air travel activity, the airlines have been able to live without the 387 Maxes already delivered to them, and also without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then. The latter are all in storage, awaiting any updates not already incorporated, and ultimate delivery.

Although clearance to fly has now been delivered, even in the USA the airlines will not instantly be re-launching their already-owned 737 Max fleets. The status of all the proposed software and hardware modifications to the type will not have been confirmed until the moment the FAA signs it all off.

American Airlines has said it hopes to start getting its Max fleet airborne before the end of December.

REUTERS/Nick Oxford/File Photo

Once the FAA has done that, getting the Max fleet ready for the sky will be an aircraft-by-aircraft, crew-by-crew process. In many airframes, a knowledge of what changes were coming has enabled a great deal of the work to be done. But also, because of the hardware and software changes to the Max, the crews have to be trained to use the new systems.

Incidentally, while the Max series was grounded, the FAA decided to order some additional modifications – completely unrelated to the crashes – to bring the type fully in line with modern safety regulations. For example, one of these involves the re-routeing and separation of wiring looms that the 737 had previously been allowed to sidestep under “grandfather” rules.

The number of lessons for manufacturers and regulators to learn from this aerospace drama is legion.

The failures and the fixes

The failures

Just a reminder: the 737 Max series fleet was grounded in March last year as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March 2019.

The primary causal factor of the Lion Air Max crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s corrective efforts have mostly been directed.

In both the accidents, the aircraft’s AoA sensor that feeds data to the MCAS wrongly indicated a very high AoA soon after take-off. The system reacted by providing nose-down stabilizer rotation that took the pilots by surprise. They did not understand the reason it kicked in, and their efforts to reverse the strong nose-down pitch did not succeed. Both these events occurred soon after take-off, and because the MCAS kept repeating the nose-down stabilizer in response to the continued erroneous high AoA sensor signal, the loss of height quickly resulted in impact with the surface.

During the examination of all the issues arising from the accidents, the JOEB was aware there were solutions to the situation in which the crews found themselves. But the fact that two crews in different regions of the world were so confused by what the MCAS was doing that they lost control had totally eclipsed pilot failings as the main issue.

MCAS was designed to trigger only in a specific flight configuration that causes the Max’s centre of lift to move slightly further forward, delivering a slight nose-up moment that can be countered by flight controls. This configuration is a combination of relatively low airspeed, flaps up, with the aircraft being flown manually. In the case of the Lion Air and Ethiopian flights, the pilots decided to continue to fly the aircraft manually during the early climb, rather than engaging the autopilot, so this precise flight configuration was encountered as soon as the flaps were fully retracted.

With flaps up, and still at a fairly low airspeed, the aircraft would be at a high angle of attack, and not far above the stall. FAA regulations require that, in the proximity to the stall, one of the “feel” cues to the pilots is that there should be a linear increase in the required control column force versus elevator displacement response, but the Max’s aerodynamics in this configuration had negated this effect, and MCAS was designed to restore that pilot cue automatically.

The JATR decided that MCAS’ fatal design weakness, above all, was that it was triggered by a single AoA sensor with no backup in case the unit had a fault or suffered damage. It seems Boeing and the FAA had overlooked that possibility, and had not explored the potential effects of erroneous inputs. Their excuse at the time was that the system was not seen as a critical one, rather as a refinement.

The fixes

The 737 Max had always been fitted with two AoA vanes, but originally only one was wired up to MCAS, and there was no flight deck indication of a disparity between the two sensors if a difference developed, which could have warned the pilots of a potential vane fault.

The hardware fix agreed by the JATR was that both AoA sensors would now feed into the MCAS, there would be an automatic comparison between them, and if there was more than a small disparity the MCAS would be locked out completely, because the aircraft can be flown without it.

The software fix also ensures that – now – the MCAS only operates once per high AoA event, so the repeated nose-down pitch demand by the stabilizers that led to the two accidents would not occur. In addition, the two flight control computers (FCC) now continuously cross-monitor each other.

After the hardware and software changes, the final improvements – overseen by the multinational JOEB – are to pilot training and cockpit drills for the Max series.

Now, even if the pilots are coming to the Max from the very similar 737NG series, pilots must undergo a one-off training session in a Max full flight simulator. This involves recovery from a full stall, dealing with a runaway stabilizer,  practice manual trimming at high speeds (and therefore high trim loads), and crew cooperation on all these exercises.

Non-normal checklists have now been compeletely revised, and contain updated procedures that concentrate particularly on the operation of the horizontal stabilisers and trim controls, both in normal operation and in the case of all potential faults.  The drills deal with runaway stabilizer, speed-trim failure, stabilizer out of trim, stabilizer trim inoperative, airspeed unreliable, altitude disagree, and AoA disagree.

Computer based training (CBT), containing video of crew exercises using the real controls, teaches drills for the following: airspeed unreliable, runaway stabilizer, the speed trim system, trim controls, and differences between the autopilot flight director system (AFDS) in the NG series and the Max series.

Testing the changes

Boeing and the FAA say they have put in 391,000 engineering and test hours developing the solutions, which have then been tried for 1,847 hours in simulators and for 3,000 airborne hours in the real aircraft.

Max – poised for relaunch?

Very soon – perhaps this week – the US Federal Aviation Administration is expected to declare Boeing’s 737 Max safe to fly again in America’s skies, lifting nearly two years of compulsory grounding.

Such an event would normally be a subject of press fanfare, but Covid-19’s near-immobilisation of commercial air transport activity worldwide has rendered the Max’s long grounding almost invisible to the non-specialist media and the public.

The airlines have been able to work not only without the 387 Maxes already delivered, but without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then – only to be delivered straight into desert storage.

The changes being applied – at the FAA’s behest – to this latest version of the highly successful 737 series are partly to correct design flaws that allowed two notorious fatal crashes to occur, but some additional modifications will bring the type fully in line with modern safety regulations that this marque had previously been permitted to avoid under “grandfather rights”.

Once the Max fleet had been grounded, it made sense to incorporate not only the changes required to make it safe, but also improvements that would prolong the marque’s commercial desirability for as long as possible. That is essential because Boeing’s next product in this market sector will be entirely new, and will not be launched for some years.

The truth is that the 737 line has reached the end of its viable development life, but given the fact that it has been in continuous production since 1966 through four iterations, that should not be too surprising.

Basically, the Max marque was intended as a stop-gap while Boeing came up with a “new mid-market airplane”, but when the Max hit the marketplace it was astoundingly successful. Its price was right, its economics excellent, its delivery guaranteed, and it was a known and trusted quantity. And all this despite the fact that it is an old fashioned, mechanically controlled machine surrounded by digitally controlled competition.

This relaunch of the Max into an airline world decimated by Covid-19 is going to be watched with bated breath, not just by Boeing, but by the whole industry.

Public perception of the aircraft is key. Will they see it as safe? Will it be safe?

As soon as the FAA announces the detail of its decision, the answers will be here.

Out of the ordinary

Major Leonard Learmount DSO, MC, RFC, Squadron Commander of No 22 Squadron January 1917-March 1918, and one of his mounts, a FE2b “Fee”

This man did not die for his country. He just came within a whisker of doing so countless times between June 1915 and March 1918 when he was flying over the hellish battle lines of the Western Front in the Great War.

Leonard Learmount is not listed as an ace, but he was an RFC pilot and squadron commander. When I, as his grandson, began researching his military life, I discovered a man who had been a businessman in the Far East before the war, and returned to the same business after it in 1919. He kept no records of his military flying and never talked of it, but clearly retained a love of flying, because he founded flying clubs that still exist in Kuala Lumpur and Singapore.

As this entry in the RAF Museum’s blog points out, his dogged persistence as a multi-role aviator for nearly three years over the front line, facing high risk every mission and being wounded in action twice, is as much a representation of the spirit of the RFC and RAF as the stories of the aces.

His story, and that of his squadron – No 22 – are told in more detail in the Summer 2020 edition of Cross & Cockade International, the quarterly journal of the First World War Aviation Historical Society. For anyone interested in the history of aviation – indeed the origins of aviation – and history of the Great War, I cannot recommend the Society highly enough. Membership doesn’t break the bank.

Having researched the detail of a specific low-altitude photo-reconnaissance sortie Learmount flew over the Hindenburg Line on 10 May 1917, I commissioned aviation artist Tim O’Brien to paint the scene of the preparation for departure. The return from the mission was more messy, because the aeroplane had been shot-up and Learmount wounded. To get clear photographs of the enemy lines the pilot had to fly the aircraft so low it was within easy range of small-arms fire, let alone “archie” – anti-aircraft fire. And the flying had to be steady, making the aeroplane a sitting duck. But they got the photos back to base, and their quality was high, rendering vital information about enemy readiness states.

 

How to infuriate a traditional Boeing pilot

Today I was replying to a message from a good friend in Maryland, and found that I’d written to him what I have wanted to put up here for a while.

He had picked up on something I wrote in FlightGlobal/Flight International a month or so ago about Boeing CEO Dave Calhoun’s thoughts on the kind of control interface that would be best for pilots flying Boeing’s next clean-sheet-of-paper aeroplane in tomorrow’s skies.

This is what I suggested to him:

“I don’t actually know what Boeing will do with the pilot’s “joystick” or yoke equivalent in its next-generation aircraft. My observation that you picked up on was based entirely on the musings of Boeing’s new boss Dave Calhoun when he suggested they might need to have to do a complete re-think of how to tomorrow’s pilots should interface with tomorrow’s aeroplanes.

The thing about the airline piloting job now is that it has drastically changed. Even aircraft originally designed in the 1960s, like the 737 series, in their latest versions put just as many computers between the pilots and the flying control surfaces as Airbus does with its FBW fleet. So any remaining efforts to fool the pilots into believing that the control feedback they feel is the real thing is just artifice. And like any part of the system, the artificial feedback can fail and thus mislead.

The only aeroplanes in which Bob-Hoover type stick-and-rudder skills were ever really needed is manually controlled aerobatic machines flown in perfect VMC during a display. Modern combat aircraft, built for aerodynamic instability so as to be manoeuvrable, have had FBW sidesticks for decades, and the pilot’s main task is to direct the mission and its defence, not to use finely-honed skills to keep it flying. The stick is just a device for pointing such an aircraft where you want it to go.

In an airliner you were never supposed to handle it as if you were Bob Hoover flying a display. Nowadays, if you have to fly it manually at all – and 99% of the time you are told not to – your job is ABSOLUTELY NOT to fly it by the seat of your pants, it’s to select the attitude/power combination you need to get you elegantly from where you are to where your passengers wish to go. I can tell you from experience, a spring-loaded sidestick is an easier device than a yoke for selecting an attitude, and as for selecting power, throttle levers do the same everywhere, back-driven or not.

So I’d guess Boeing probably will go down that track. Pilots who still need to be flattered by being presented with controls that look like the old fashioned ones but do not work like them are no longer in the right job!”

No pilot/aeroplane interface is perfect. But choosing the best one for the next Boeing is going to be an interesting job for Calhoun.

ATC is 100

The world’s first civil aerodrome control tower was opened 100 years ago this month at London’s Croydon airport

Early in 1920 the UK Air Ministry decided that, with an average of 12 air movements a day, the air traffic at London’s main airport – Croydon – needed organising.

The ministry had no template for such a task, but issued a specification for a building they believed would do the job. It was to be called an aerodrome control tower, and the working part of it was to be “15ft above ground level, with large windows to be placed on all four walls”.

Radio communication was already in use, but even primitive radar would not be developed for another 20 years.

CATOs in radio communication with aircraft. Picture taken 1927

Radio direction-finding, however, provided the Civil Aviation Traffic Officers (CATOs) with the bearing from the airport of any aircraft transmitting a radio message, thus they could provide the crew with a course to fly to arrive overhead the aerodrome. They could also provide the pilots with weather information, including visibility, wind speed and direction, but also the approximate position of other traffic in the area so the crew could keep their eyes out for it.

Airline travel in 1920. An Airco de Havilland DH-4 plied the London Croydon – Paris Le Bourget route

Navigation was primitive in aviation’s early years. Clearly identifying the destination aerodrome so the crew landed at the right one was important. The pilots were helped to find the aerodrome by a bright, strobing “lighthouse” beam – green alternating with white – which was located on a high point. When control towers came in, the light was above the tower.

Croydon airport from above, 1925

Positive airfield identification was provided by very large lettering spelling out the airport name, either on the ground, or on the roof of a large hangar.

Separation between aircraft, if there was more than one near the aerodrome at any time, was assured visually by pilots looking out for other aeroplanes, with advice from the tower if necessary as to the position of potentially conflicting traffic.

Protocols about which of any two aircraft has the right to hold course and which should give way are set in the rules of the air, similar to the rules which mariners follow on the sea, and a disciplined circuit pattern over an aerodrome was a system with which pilots were familiar.

Permission to land or take off could be signalled by radio, or by a CATO shining a green aldis lamp toward the aircraft cockpit. Similarly, a red lamp would refuse permission. Firing off a green or red Verey flare from the tower was an alternative.

The UK’s principal air traffic management provider NATS is somewhat more sophisticated today! But its daily traffic tally is nearly 9,000 movements across the country, so it rather has to be.

P.S. Thanks to NATS for providing the colourised old photographs and historical detail from their archives.

 

 

 

Surely Shoreham can rise again

Gloster Gladiator at Shoreham Air Show in 2014

This summer it will be five years since the tragedy of that Hawker Hunter crash at the Shoreham Air Show. I think it’s time to start thinking about resurrecting the show once more.

This blog has seen extensive debate about what happened and why.

In fact the Shoreham crash and its investigation has been the most-discussed aviation subject by far since I started Learmount.com in early 2015. You can scroll back and find it all, if you’d like to, so I won’t go over it again.

Over the last four and a half years, on these pages I have set out the details of the Air Accident Investigation Branch inquiry, which was very thorough, and was highly critical of air show management at Shoreham in particular, but also in the UK as a whole. Things have changed since then.

Things did need to change. Even those icons representing the pinnacle of British aviation excellence – the Red Arrows and the Farnborough Air Show – changed the way they do things following the Shoreham inquiry.

Shoreham’s aerodrome is historic, one of the oldest in Britain, and perhaps the most beautiful. The airfield, and its air show, are part of this nation’s heritage.

The people of Shoreham and the Council have seen to it that those who died in the 2015 tragedy have a fitting memorial near the airfield on the River Adur

It’s right, and safe, to have another go.

Mitchell WW2 bomber taxiing, Shoreham Air Show 2014

Atlas Air crash should spark an overdue debate about piloting

Recent releases from the US National Transportation Safety Board’s investigation of the Atlas Air Boeing 767-300F fatal crash in February 2019 contain a vital message to the industry about loss of control in flight (LOC-I).

Unfortunately, the message could be overlooked, or not taken seriously, as it has been many times before.

The Atlas Air crash, however, finally negates a common reason for unconsciously dismissing the seriousness of a LOC-I accident.  This unconscious dismissal, among “Western” observers at least, is caused by the mindset that says: ‘It happened to a non-Western carrier’; the implication being ‘What would you expect?’.

Such pilot reactions to the Lion Air and Ethiopian 737 Max accidents flooded the web, particularly in the USA, and are still out there. The latter two accidents, however, involved an aggravated version of LOC-I, precipitated by a confusing technical distraction.

Right now, in the Atlas Air investigation, the NTSB is testing evidence that suggests pilot disorientation by somatogravic illusion might be pivotal in what happened. During descent toward its destination airport the aircraft finally dived steeply and at high speed into the surface .

A synopsis of the basic accident details can be found on the Aviation Safety Network.

A common example of somatogravic illusion – which is an acceleration-induced illusion – is the feeling that airline passengers get when their aircraft begins to accelerate along the runway; they perceive the cabin to be tilted upward, but a glance out the side window shows the aircraft is level, the nosewheel still on the ground.

Visual input, if available, is the dominant human sensory input, and it will correct the illusions caused by the reaction of the body’s balance organs to a linear acceleration.

The Atlas Air 767 freighter was inbound to Houston Intercontinental airport from Miami, and the flight phase in which things began to go wrong was a routine descent, the crew receiving vectors to avoid weather. As the aircraft was descending, in cloud, through about 10,000ft, cleared to 3,000ft, the crew were flying a vector heading of 270deg, and were told to expect a turn north on a base leg to final approach for runway 26L. All pretty normal.

There was a pilot call for “flaps 1”, the aircraft leveled briefly at 6,200ft, climbed very slightly, and its airspeed stabilised at 230kt. But shortly after that the engine power increased to maximum, and the aircraft pitched about 4deg nose up.

It is at this point that somatogravic illusion appears to have kicked in powerfully with the pilots. They had no external visual horizon because the aircraft was in cloud.

According to the NTSB, almost immediately the aircraft began a dramatic pitch down to -49deg, driven by elevator deflection. The airspeed ultimately increased to 430kt, and although the pitch-down angle was eventually reduced to -20deg, impact was inevitable.

The factor the NTSB is examining now is what triggered the sudden – apparently unwarranted – massive power increase. The cockpit voice recorder has captured a sound that may indicate the activation of the go-around button on the power levers. But neither of the pilots mentioned a need for go-around power.

About ten seconds after the power increase, caution alarms began to sound. The inquiry says the control column remained forward for ten seconds. According to FlightGlobal.com: “The aircraft transitioned from a shallow climb to a steep descent. Five seconds after the alarm commenced, one of the pilots exclaimed, ‘Whoa’, and shortly afterwards, in an elevated voice: ‘Where’s my speed, my speed’. Three seconds later, a voice loudly declares: ‘We’re stalling.’”

The flight data recorder gives the lie to the pilot’s stalling perception, because the angle of attack at that moment was safely below the stalling level.

During these remarks the thrust levers were brought to idle for about 2s, then were advanced again to their high power setting. During the transition from nose slightly up to nose steeply down, there were negative g-forces for nearly 11s.

Puzzling unknowns still lurk: like why a pilot exclaimed “where’s my speed?” when the indicated airspeed was rapidly increasing. Was it a fault of instrumentation, or of pilot instrument scan or perception at a moment of confusion?

The simple fact is that, every time a big engine-power increase takes place in flight, forward acceleration combined with a pitch-up moment caused by the underslung engines, is inevitable.

Just as inevitable – if this happens at night or in cloud – is somatogravic illusion in the pilots. “For this reason,” says the NTSB, “it is important that pilots develop an effective instrument scan.”

Develop? It’s a bit too late to develop a scan!

Recognising that acceleration brings with it the risk of disorientation, pilot conditioning should be to ignore all other sensory inputs except the visual, and with no external horizon that means concentrating totally on flight instruments, believing them, and controlling aircraft attitude and power accordingly.

Recurrent training must keep pilots alive to this risk, and to its remedy, but it clearly does not do this at present. Not for Asian, African nor for American pilots.

LOC-I has, since the late 1990s, been the biggest killer accident category for airlines. LOC-I linked to somatogravic illusion has frequently occurred, two of the most dramatic recent examples being the March 2016 FlyDubai Boeing 737-800 crash at Rostov-on-Don, and the August 2000 Gulf Air Airbus A320 crash at Bahrain International airport. Both occurred at night; both involved a go-around.

The FlyDubai pilot reaction to somatogravic illusion was a dramatic push-forward into a steep dive, like Atlas Air, and the aircraft smashed steeply into the runway.

The Gulf Air manoeuvre was an abandoned night visual approach from which the captain elected to climb and turn into a 3,000ft downwind leg to make a second approach. In the latter case, the changes in attitude and power were less dramatic, but as the captain advanced the power and began the climbing turn to the left over the night sea, he would have lost the airfield and town lights and should have transitioned fully to flight instruments. He didn’t. The aircraft described a shallow spiral into the dark water.

Somatogravic illusion makes instrument flying essential, but more difficult because of the need to reject the balance organs’ misleading input. A clear natural horizon in daylight completely overcomes those misleading feelings, and although the flight instrument panel – especially in modern flight-decks – provides an intuitive visual display, it is artificial and still not as compelling as the real thing.

But there is a long list of LOC-I accidents in the last two decades that involved more subtle sensory inputs resulting in pilot disorientation, and everybody died just the same.

Think of the old expressions associated with instrument flying skills.

First, there is its antithesis: “Flying by the seat of your pants.” Anybody who believes that is possible in IMC or on a moonless night is fated to die.

Then there is the original name for the skill: “Blind flying”; that was in the days before the artificial horizon was invented, when the airspeed indicator, altimeter and turn-and-slip indicator sufficed for accurate flying, possibly assisted by a vertical speed indicator.

Further clues as to the fascination – even mystery – surrounding early blind flying skills are the descriptions of what it feels like when things are going wrong: “The Leans” described the situation in which your perception of what the aircraft is doing is not what the instruments tell you. Finally there is the extreme example of “The Leans”: Americans used to call it “vertigo”, Europeans “disorientation”. That is when your senses are screaming at you that the situation is not what your flight instruments say – you don’t even know which way up you are.

Nothing has changed just because aircraft now have LCD displays.

It is time to go back to basics, to re-discover pride in precision manual instrument flying, and regain that skill which no pilot truly believes s/he has lost, but which automated flying has stolen away silently, like a thief in the night.

PS: Good blind flying is not a stick-and-rudder skill, it’s a cognitive skill.

 

 

 

 

 

Muilenburg: Returning Max to service ‘will be an international decision’

Boeing CEO Dennis Muilenburg says the successful return to service of the company’s 737 Max series depends on international consensus among the many national aviation authorities (NAA) that will see the aircraft operating in their countries.

Not just the US FAA.

As a reminder, the 737 Max series fleet was grounded in March as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March this year.

Speaking this week at Boeing’s Seattle Delivery Centre, Muilenburg declined to predict a return-to-service date, explaining: “Dates are uncertain because we are going for a global recertification.” That means unanimity – near or absolute – has to be achieved.

Boeing aircraft being prepared for delivery at Boeing Field, Seattle

He emphasised the point: “If we do not coordinate this [return to service] we may see some disaggregation, and I don’t think that’s a future any of us wants to see.”

Muilenburg is confident the combined hardware and software changes Boeing has developed for the Max will satisfy the FAA and the multinational Joint Operations Evaluation Board (JOEB).

The primary causal factor of the Lion Air crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s efforts have been directed.

More on MCAS later.

Boeing test pilot and VP Operations Craig Bomben, who flew the 737 Max first flight and has coordinated development activity on the type since the accidents, described the essential difference between the original MCAS and Boeing’s proposed replacement: “We’ve moved from a very simple system to an intelligent system.”

In both the accidents MCAS – triggered by a faulty or damaged AoA sensor which wrongly indicated a high AoA – reacted by providing nose-down stabiliser rotation that took the pilots by surprise. They did not understand the reason it kicked in. Their efforts to reverse the strong nose-down pitch did not succeed, and because both these events occurred just after take-off, the loss of height quickly resulted in impact with the surface.

Bomben said the new “intelligent” system has two AoA sensors instead of one, and if their readings differ by 5.5deg or more, MCAS is not triggered at all.

But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.

But why is MCAS – which is unique to the Max – required at all? Boeing insists it was not fitted as an anti-stall system, because the aircraft already has stall warnings and stick-shakers.

The purpose of fitting MCAS, Bomben explained, was to compensate for a slight change in the low-airspeed aerodynamics of the 737 Max compared with the NG.

MCAS was only designed to trigger in an unlikely (but obviously possible) combination of circumstances that can cause the aircraft’s centre of lift to move slightly further forward, altering the weight-balance equation. It only happens when the Max is at low airspeed with the flaps up, and is being flown manually.

At low airspeed (200kt or thereabouts) – and flapless – the aircraft would be at a high angle of attack and close to the stall. FAA regulations require that one of the cues to the pilot of the approaching stall is that there should be a linear increase in the required column force versus displacement response.

In the Max, however, at a certain point in this sequence the centre of lift shifts forward a little, providing a slight nose-up pitch force, therefore the stick force does not continue to increase, so MCAS is designed to kick in with some nose-down trim to restore the linear increase.

If MCAS doesn’t kick in, the aircraft is still easily controlled without it, but the required progressive stick-force cueing is lost.

In technical and regulatory terms, MCAS seems to be a lot of fuss for very little purpose, but the painful fact is that the original MCAS played its part in bringing down two aeroplanes and killing 346 people.

Muilenburg’s confidence in the fix is, so far, based on more than 100,000 hours of development work on the new solution, plus 1,850 flight hours using the new software, 1,200 hours of refining the results in the simulator, and 240 hours of regulatory scrutiny in the simulator.

Meanwhile, if Muilenburg cannot predict when the world will approve the 737 Max’s return to the air, what is happening to its production at present? The aircraft had won more than 5,000 orders, and fewer than 400 have been delivered.

The Max series, despite the grounding, continues to roll off the production line at Boeing’s Renton plant near Seattle, at a rate of 42 per month. The factory is capable of turning out 57 a month, but Boeing is keeping the rate lower for now. Despite this, Renton has seen no staff layoffs, says Boeing.

The completed aircraft, however, go into storage at Moses Lake or San Antonio desert sites, because the manufacturer’s own sites at Renton, Everett and Boeing Field are full.

Muilenburg said every 737 Max grounded or in store awaiting modification will have an individual entry into service programme, and that in the meantime the engines, systems and cabin of all the aircraft are regularly being run and maintained.

But will they still have that “new plane smell” when the airlines take delivery?

A Max in production at the Renton plant, its unique split winglet close to the camera

 

The Max crux

Boeing, the FAA, and national aviation authorities (NAAs) from several other countries, met in Dallas on 23 May to consider the future of the 737 Max series of aircraft.

It is impossible to overstate how important this meeting is. The way civil aircraft manufacturing does business, not just in America, but all over the world, is under scrutiny.

Detail gradually emerging from Boeing and the FAA following the two 737 Max fatal crashes has upset such basic assumptions about the way modern aviation works that industry veterans – whose initial reaction was that this was just a case of finding a fix and getting the Max airborne again – are , only now, fully realising it’s not.

Like the Looney Tunes cartoon characters who ran over a cliff they didn’t know was there, we didn’t begin to fall until we looked down.

Let’s examine the proposal that all airliners nowadays are massively computerized, so adding some digital controls to the good old 737 to make it a Max is just bringing the 737 marque up to date.

After all, digital controls work on other types like Airbuses and Boeing’s own 777 and 787, and they are safe, so why not on the 737?

Back to basics.

All modern commercial airliners are supposed to be designed, in the first place, so they fly easily and intuitively, and have a natural aerodynamic stability within their flight envelope. That should hold true with or without computer control.

Designing an aircraft to be fly-by-wire, rather than conventionally controlled, can provide additional safeguards, but the airframe itself should still fly naturally.

Applying a digital solution to an airframe-related flight characteristic that is undesirable is a different matter entirely; but that is what Boeing chose to do when it installed the Manoeuvring Characteristics Augmentation System (MCAS) in the new Max.

The fact – revealed by the fatal accidents – that the MCAS could be triggered when it was not needed, and what consequences might follow its triggering, appears not to have been examined in any depth by Boeing or the FAA.

The fundamental questions for the FAA – and the foreign NAAs- are these: is the Max, as a simple airframe without digital corrections, sufficiently stable within its flight envelope to satisfy the regulators it is worthy of certification?

If not, is a digital fix sufficient to cover the undesirable flight characteristics lurking in a corner of its flight envelope? How reliable does the fix have to be to win approval?…and how can its reliability be proven?

For three decades the aviation world has agreed to operate a regime whereby the NAAs in countries where aircraft are manufactured all use the same standards when they certificate a new aircraft. So when the FAA certificated the 737 Max, the rest of the world accepted the FAA’s judgement and did not insist – as in the bad old days of the 1970s and before – on re-certificating it country by country.

What if, in this case, the FAA re-certificates the MCAS-modified Max, but foreign NAAs do not? The European Cockpit Association today has called on the European Union Aviation Safety Agency to scrutinize any FAA approvals, and EASA has pledged to do so. Is this “back to the bad old days”?

At the end of the Dallas meeting Boeing had this to say: “We appreciate the FAA’s leadership…in bringing global regulators together to share information and discuss the safe return to service of the 737 MAX….Once we have addressed the information requests from the FAA, we will be ready to schedule a certification test flight and submit final certification documentation.”

Industry speculation as to when the FAA will be ready to approve return to service varies massively, from a week to many months. These seers also seem to be preparing themselves for disagreement between the FAA and foreign NAAs.

This is the point at which you dare not look down.