Federal Aviation Administration

Solar radiation and aircraft electronics: is this a big issue?

David Learmount Uncategorized , , , , , , , , , , , , , , , , , ,

Much of the world’s fleet of about 11,000 Airbus A320 series aircraft – the most popular airliner in the world according to sales – are affected by a current emergency airworthiness directive from the European Union Aviation Safety Agency and the US Federal Aviation Administration requiring that operators modify their aircraft control software to make it more resistant to the effects of solar radiation.

This followed a sudden loss of height in the cruise involving a JetBlue A320 en route from Cancun, Mexico to Newark, USA on 30 October. Solar radiation is believed to have been responsible for corrupting the data in one of the aircraft’s flight control computers causing the sudden height loss – which injured several passengers. Recovery action by the pilots ensured the aircraft diverted safely to Tampa, Florida.

Most younger A320s need only a quick software patch to harden the microchip resistance in their flight control computers against particularly vigorous bursts of solar radiation, but nearly a thousand of the oldest aircraft may need to change the units.

Solar radiation is known to be able to interfere with GPS signals, radio communication, inertial navigation systems, autopilot, and full-authority digital engine controls (FADEC), although incidents are rare. A mysterious sudden pitch-down by a Qantas A330 in the cruise over Western Australia in October 2008 is now reckoned to have been caused by corrupted data from an air data inertial reference unit (ADIRU) that may have been subject to solar radiation damage.

All aircraft are more vulnerable than suface vehicles to solar radiation effects because, at high altitude, there is less atmospheric attenuation of the sun’s electromagnetic energy. Polar flights are particularly vulnerable because the earth’s magnetic field provides less shielding and the troposphere is at a lower altitude there.

A320 series aircraft have three three flight control primary computers (FCPC), two flight control secondary computers (FCSC), and a flight augmentation computer, all of which provide considerable systems redundancy, plus a cross-checking capability to detect and correct anomalous data.

The UK Civil Aviation Authority said today that there had been virtually no disruption to flight schedules because airlines were so quick to apply software fixes.

1 December 2025: a statement from Airbus on this date claimed that only about 100 A320 series aircraft remained to receive the softwear hardening required by EASA an the FAA.

AI 171: the system is beginning to leak under pressure

David Learmount Uncategorized , , , , , , , , , , , , , , , , , , ,

Air India flight 171 crashed immediately after take-off from Ahmedabad on 12 June, and today, two weeks later, with no news about causes, the system is beginning to leak.

This is what happens naturally when information which people know is available to the authorities is withheld from the media and the public.

It’s easy for authorities like the Indian Directorate General of Civil Aviation to believe they can justify withholding information on the grounds that it’s very complicated, and they intend to release it quite soon anyway. Unfortunately for the DGCA, today’s media environment does not have that kind of patience any longer, especially in a case like this.

This fatal accident, a first for the Boeing 787 of any marque, killed 241 people on board and many on the ground. Whatever the cause was, it was highly unusual – maybe unique. For that reason, the industry and its regulators are desperate to know if there might be an unknown latent failure in the 787, so they can stop it happening again.

This pressure is what causes the system to leak. The Air India 171 flight data recorder has been downloaded by the National Transportation Safety Board for the DGCA at the Air Accident Investigation Bureau in Delhi, so some outstanding data will already be clear, even if not fully analysed yet.

Meanwhile the NTSB is sworn to secrecy according to the International Civil Aviation Organisation protocol which states that the nation in which the accident occured is responsible for the investigation. So in this case, the NTSB provides all its data to the DGCA, but as an agency of the nation in which the accident aircraft was designed, built and certificated, the NTSB has a particular responsibility to ensure that all operators of Boeing 787s throughout the world – there are about 1,000 of the type flying today – learn as fast as possible what, if anything, they should do.

That NTSB responsibility is a heavy one, but at the same time they want, if possible, to stick to the protocols to ensure the investigation proceeds calmly.

The NTSB obviously has to tell Boeing any details that are emerging. Then Boeing has an urgent duty to provide advice to 787 operators, particularly if any system failure detected might possibly repeat. This information will be received at Boeing by many engineers and technicians who must act rapidly to frame a plan for inspections and corrective action, then communicate with the operators, where an even larger group of airline technicians must carry out the Boeing advisories, or any directives that the Federal Aviation Administration may see fit to issue.

The pressure on the DGCA is of a different kind, and arguably less urgent. It is, after all, a regulator, a bureaucracy, with the responsibility to oversee the investigation and ensure it is conducted properly and according to law. It does, however, face the reality that a lot of highly relevant information is being shared right now by hundreds of experts all over the world, and the media knows it. So if the DGCA delays release of established facts, it will face increasing censure, especially if it delays release beyond one calendar month from the date of the accident.

A month is now firmly established as the time it should take for an air accident investigator to establish the basic facts of the case, and release a “preliminary factual report”. The final report can take more than a year.

Meanwhile, what of all those FDR facts whizzing around the world between experts at the manufacturer, the investigator, the world’s civil aviation authorities, and all the airlines that operate 787s? Well, they leak, of course, because they are important and everyone knows it. But most of the time the precise source of emerging information isn’t obvious, because individuals discussing them do not want to be recognised, so responsible journalists have to be careful what we do with what we hear.

What happens, however, is that it gradually becomes clear, among the plethora of opinions and guesswork always out there, which facts are beginning to establish themselves.

Some are simple, almost obvious. For example, the one emergency radio call made by the AI 171 crew said they had lost power, and an observation of the flight path almost immediately after unstick corroborates that puzzling fact.

But double engine failure immediately after take-off is almost unheard of, so what caused it? That is less obvious.

The DGCA has issued a list of checks it required Indian 787 operators to carry out. Unfortunately it lists checks that – mostly – are routine and would be carried out anyway.

The exception to that is the requirement to test the Electronic Engine Control System. These are computers called Full-Authority Digital Engine Controls (FADEC) that monitor the engines’ performance and react to demands by the pilots via the power levers or the flight control panel (autopilot input). These are vital, but have been established since the 1980s as highly dependable devices, and more reliable by far than the old mechanical connections.

So if both FADECs failed that would be extraordinary. In fact it makes more sense that something else failed or malfunctioned and disabled both FADECs. There is a lot of credible information gathering that backs this up, but since its precise source is not certain, I will not run it here.

Suffice to say we will soon learn what the problem was, because the DGCA knows it would look very bad to sit on it beyond 12 July 2025.

Trump rides to the rescue of US ATC

David Learmount Uncategorized , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“The ancient infrastructure is buckling,” says the President of the USA, Donald J Trump.

His subject is the state of America’s air traffic control (ATC) services, but he does have a solution: “We’d like to give out one big, beautiful contract, where they are responsible for everything from digging ditches to the most-complicated stuff”.

Trump has casually tossed a simple solution to a serious national infrastructure problem into someone else’s in-tray. But is this even in his gift?

The political in-tray belongs to Transportation Secretary Sean Duffy, who agrees with Trump about the state of the air traffic management (ATM) system. Needing somebody to blame after the 29 January fatal mid-air collision between an army helicopter and a PSA Airlines Bombardier CRJ700 that was on final approach to land at Washington DC’s Reagan airport, Duffy attributed the crash to “our outdated, World War II-era air traffic control system”. Having delivered that verdict, he named his predecessor, President Joe Biden’s Transportation Secretary, Pete Buttigieg as the man responsible for the state of US ATM.

Meanwhile, taking Trump at his word when he said “We’d like to give out one big, beautiful contract…”, the chief executive of a major US electronics company is – surely – soon going to feel the thud of a massive Concept of Operations document landing in his in-tray. So will Chris Rocheleau, the Trump-appointed Acting Administrator of the Federal Aviation Administration. Rocheleau, an experienced FAA man, was given the job in January, but so far no actual Administrator has been appointed.

In the USA, the FAA is responsible for providing ATM. The Administration’s two main tasks are the safety oversight and regulation of the entirety of the USA’s aerospace and air transport industry, plus the provision of ATM and its operating infrastructure. Unusually, therefore, the FAA oversees the safety of its own ATM system.

Finance for the FAA comes from the Airport and Airways Trust Fund (AATF), financed in turn by the users of the system who are charged taxes on domestic passenger tickets, freight carriage charges, fuel, and international departures and arrivals. These proceeds, which fund nearly 90% of the FAA’s costs, don’t go direct to the FAA: congress annually appropriates funds from the AATF for the FAA – but in practice it quite often delays the appropriation, bringing aviation to a halt for a few days. The reality is that the FAA is a state-owned utility.

Returning again to Trump’s stated plan for “one big, beautiful contract” to upgrade America’s ATM and air navigation services, unless the President has the FAA in mind as contractor (unlikely), he must be referring to private industry.

So who are the industry candidates to take the lead in this “big, beautiful contract”? If Trump’s plan goes ahead, one company will lead, and the others will contribute. The line-up looks something like this: Raytheon, Thales, Adacel Technologies, L3 Harris, Honeywell, IBM, SpaceX (Starlink), and Verizon (telecomms). Trump’s “America First” policy might rule out Thales for being French, although it is huge, global, and has a big US division.

What will Duffy require of this agglomeration of US industrial expertise? Here are some extracts from public statements of intent he has made in the last few months about ATM modernisation: “Rebuilding some ATC towers, control centres and Terminal Radar Approach Control (TRACON) facilities; new telecom, new fibre… We are going to have brand new radios in our towers, new radar for the ground, and new sensors on our tarmacs; all the front-facing equipment for controllers, all the back-end systems for controllers – all brand new; all new hardware… All new software… A new flight management system that will support flights of future air taxies – the electric vertical take-off and vertical landing aircraft now under development by numerous firms.”

What is more, all of this will be accomplished within four years, says Duffy. A bill to approve funding to the tune of $12.5 billion is working its way through the House of Representatives.

The sheer size of the task of raising this system from its current state of repair can be gauged from a recent event. On 28 April, controllers at the Philadelphia TRACON “temporarily lost radar and communications with the aircraft under their control, unable to see, hear or talk to them”. That summary of the event was provided by the National Air Traffic Controllers Association (NATCA). Controllers at that facility are responsible for “separating and sequencing” jets flying to and from Newark airport, New Jersey, one of the three main airports serving New York city.

In the last few days the Philadelphia TRACON problems have recurred, according to Duffy, who resorts again to blaming Buttigieg. Meanwhile Newark airport is talking to airlines about reducing the flow-rate of traffic there for safety reasons. And the whole problem is exacerbated by a shortage of air traffic control officers (ATCO), which Duffy has acknowledged is nation-wide, and which the National Transportation Safety Board is examining as a possible contributory factor in the Washington DC collision.

Good luck to the FAA and its partner companies in this massive endeavour. They’ll need it!

Trump, Musk and the FAA

David Learmount Uncategorized , , , , , , , , , , , , , , ,

Just as President Donald Trump rushed to claim that the 29 January mid-air collision over the Potomac River was the result of air traffic control incompetence resulting from the Federal Aviation Administration’s application of DEI (diversity, equity and inclusion) policies in controller recruitment, so others have lined up to point out that there has been an unusual cluster of serious US fatal air accidents since his appointment as POTUS.

Anyone with a brain knows that neither claim has any causal connection with reality.

But I am serving notice today that this blog will examine any proposals that emerge from the Trump-appointed DOGE (Department of Government Efficiency) regarding the funding or reorganization of the FAA, and I invite senior executives and employees of the FAA, the airlines and general aviation bodies to report on substantive changes ordered by DOGE by responding to this blog.

Like others who care about maintaining and advancing aviation safety, I am wary of politically-inspired tinkering with an important oversight agency by leaders who have no expertise in the management of aviation safety. Trump’s first lieutenant Elon Musk, a man of many talents, has been entrusted with heading DOGE. He has a businessman’s appetite for risk-taking.

As Boeing acknowledges, business skills wielded by those for whom safety and quality control is an important concern, but whose primary objective has become shareholder returns, can get the balance wrong and damage both.

The USA has led the post-war world in advancing civil aviation safety, with the FAA being its general and the Flight Safety Foundation its standard-bearer. If the FAA’s ability to oversee industry safety performance and to manage the USA’s airspace is diminished in the name of “efficiency”, it affects global aviation, so the world will be watching with its own interests at heart. The FAA is an agency, a public service, it is not a business.

This appeal for reader feedback will have to be carefully managed, because at this stage the proposed Trump/Musk policies inspire apprehension without advancing any substance worthy of appraisal.

But soon actions will loom, and appraisal must begin.

UK aviation: caught in the crossfire

David Learmount Uncategorized , , , , , , , , , , , , , , , , , , , ,

With the destabilizing effects on global aviation of huge fuel price inflation and unprecedented Russian military aggression in Europe, worsened by post-pandemic staffing shortages, it’s amazing that international commercial air transport works at all right now.

International cooperation has never been more crucial. Yet in the UK, an example of how NOT to do aviation – especially right now – has just been highlighted.

UK-based eVTOL developer Vertical Aerospace will be certificated by the UK CAA according to EU rules despite having separated from EASA

The reason international aviation is still working despite global instability is because the world wants it to, and has set up robust systems to enable it. Like commercial shipping, commercial aviation is naturally a global industry.

That’s why both those industries have specific United Nations agencies devoted to overseeing globally agreed standards and operating practices (SARPs). These agencies are the International Maritime Organization and the International Civil Aviation Organization. Total regulatory unity doesn’t prevail worldwide, but a high degree of harmonization does.

The world’s two most influential national/regional aviation authorities responsible for turning ICAO SARPS into national law are the European Union Aviation Safety Organisation (EASA) and the US Federal Aviation Administration (FAA). These two have worked together for decades to improve the harmonization of their regulations, making them identical where possible. They still meet regularly. Most of the world’s national aviation authorities (NAAs) more or less copy the regulations of one or the other into their own NAA rules.

All the EU states have always had their own NAAs – and still do. But since the 1980s they have worked together on harmonizing their aviation regulations to make Europe’s aviation industry work better.

In the early 2000s, EASA was born out of its predecessor the European Joint Aviation Authorities, to unify Europe’s interpretation of all those ICAO SARPs.

Back in the early 1980s, believe it or not, Boeing had to build almost as many variants of its 737 series as there were countries in Europe, because some nations insisted on safety systems than the FAA did not require, and some of these specifications were unique to each country. For example, one of the UK’s additional requirements – then – was for a 737 stick-pusher.

Today the UK Civil Aviation Authority (CAA) is faced with the consequences of returning to the bad old days because of the UK’s departure from the European Union. Although Theresa May, the UK prime minister preceding Boris Johnson’s election, had instructed the CAA to remain an associate member of EASA following “Brexit”, when Johnson came in his government insisted on ideological purity, thus no CAA association with Europe’s multinational agency.

Meanwhile, right now the CAA has to prepare its reaction to the imminent arrival on the world stage of a new form of commercial air transport: eVTOL (electric vertical take-off and landing), also known as Urban Air Mobility. Expected to take the air taxi world by storm and make it sustainable, the UK plans to be involved in all aspects of this new industry, including manufacturing.

At a time like this, when the world has agreed to harmonize rules associated with another massive new aviation development – drone operation – it does not make sense for any nation to declare unilateral independence from the world rule-making processes.

The CAA, fully aware of its dilemma, has released a statement pledging that it will follow exactly the EASA rules on certification for eVTOL.  Of course, it has to duplicate the regulation in UK law, and any UK eVTOL products or services will be subject to scrutiny by EASA to ensure that it does just that. Hence the UK’s promising eVTOL manufacturer Vertical Aerospace is having to undergo identical parallel certification by two agencies: the CAA and EASA. You couldn’t make it up, could you?

Meanwhile the bureaucratic burden placed on the UK agency is evident from this script heading pages on the CAA’s website: “UK-EU Transition, and UK Civil Aviation Regulations: To access current UK civil aviation regulations, including AMC and GM, CAA regulatory documents, please use this link to UK regulation. Please note, if you use information and guidance under the Headings below, the references to EU regulations or EU websites in our guidance will not be an accurate description of your obligations under UK law. These pages are undergoing reviews and updates.”

What the Max story says about safety oversight today

David Learmount Uncategorized , , , , , ,

Yesterday the US Federal Aviation Administration joined most of the rest of the aviation world in grounding the Boeing 737 Max series of aircraft, the very latest version of the established 737 series. What took it so long?

Having entered service in May 2017, by early March this year the Max had suffered two fatal crashes within five months. This is extraordinary for a new commercial airliner today.

Evidence from the preliminary report on the earlier of the two accidents suggests a technical failure precipitated it. The first event, in October 2018, involved a nearly-new 737 Max 8 belonging to Indonesian carrier Lion Air. It crashed into the sea near Jakarta within about 10min of take-off. The second accident, on 10 March this year, involved an Ethiopian Airlines aircraft of the same type, and it plunged into the ground within six minutes of take-off from Addis Ababa. Pilots of both aircraft radioed that they were having trouble controlling the aircraft’s height, and this was evident on flight tracking systems.

The FAA issued its grounding order on 13 March. This was three days after the Ethiopian crash,  two days after China, Ethiopia and Singapore had banned Max operations, and a day later than the influential European Aviation Safety Agency – and many other states – had done the same.

Does this demonstrate that there are different safety standards – or safety philosophies – in different countries? Or does it suggest that the relationship – in this case – between the safety regulator and the manufacturer is too close?

On 12 March, resisting calls to ground the aircraft, the FAA said: “Thus far, our review shows no systemic performance issues and provides no basis to order grounding the aircraft.”

The next day it stated: “The FAA is ordering the temporary grounding of Boeing 737 MAX aircraft operated by U.S. airlines or in U.S. territory. The agency made this decision as a result of the data gathering process and new evidence collected at the site [of the Ethiopian crash] and analyzed today. This evidence, together with newly refined satellite data available to FAA this morning, led to this decision.”

The safety principle behind aircraft design, for more than half a century, has been that all systems should “fail safe”. This means that any one critical system or piece of equipment, if it fails, will not directly cause an accident. This is achieved either by multiplexing critical systems so there is backup if one of them fails, or by ensuring that the failure does not render the aircraft unflyable.

The preliminary report from the Indonesian accident investigator NTSC suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down. Finally, the crew seems not to have known how to counteract this nose-down control demand.

The implication of the NTSC report – not the final verdict – is that the MCAS was not designed according to fail safe principles: a single unit failed, causing a software-controlled automatic system to motor the powerful horizontal stabiliser to pitch the aircraft nose-down, and it kept on doing this until the crew could not overcome the pitch-down force with elevator.

At that point disaster could still have been prevented if the crew had been familiar with the MCAS, or with the drill for a runaway stabiliser trim. But the MCAS would not have been expected to trigger at climb speeds during departure. The result was that in this case the crew failed to act as the final backup safety system.

In the months immediately following the Indonesian crash some pilot associations in the USA whose members operate the Max publicly claimed that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also many assumed that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is quite different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out. There is more detail on the MCAS in the preceding item in this blog – “This shouldn’t happen these days”.

Somehow, therefore, many 737 Max pilots in Boeing’s home territory had found themselves un-briefed on a system that was unique to the Max. They claimed lack of detail in the flight crew operations manual (FCOM), which described the system’s function but did not give it a name. US pilots who converted to the Max were all 737 type-rated and had flown the NG marque, but their conversion course to the Max consisted of computer-based learning, with no simulator time.

This ignorance among US pilots was soon corrected because the issue got plenty of intra-industry publicity, so if a US carrier pilot suffered an MCAS malfunction the crews would have known to apply the runaway trim checklist, and select the STAB TRIM switches to CUT OUT. Was this confidence about US crew knowledge the reason the FAA was able to maintain its sang-froid over grounding for longer than the rest?

On the other hand it is not a good principle to use a pilot as the back-up for a system that is not fail-safe.

In the 1990s there were several serious fatal accidents to 737s caused by what became known as “rudder hard-over”. This was a sudden, uncommanded move of the rudder to one extreme or the other, rendering the aircraft out of control, and unrecoverable if it happened at low altitude. The problem was ultimately solved by redesigning the rudder power control unit, for which there was no backup, thus no fail-safe.

If a Boeing product has a fault the responsibility is Boeing’s, but it is equally the FAA’s. The FAA is the safety overseer, and should satisfy itself that all critical systems are fail-safe and that the manufacturer has proven this through testing.

If America has an image it is that of the can-do, the entrepreneurial risk-taker. Why would Boeing or the FAA be different? One of the FAA’s stated values is this: “Innovation is our signature. We foster creativity and vision to provide solutions beyond today’s boundaries.”

The world has benefited from the USA’s risk-taking culture which has driven some aviation advances faster than they would have occurred in other more risk-averse cultures like that of Western Europe. An example of this is the massive extension of ETOPs (extended range twin engine operation) with the arrival on the market of the Boeing 777, which ultimately drove the four-engined Airbus A340 out of the market and influenced the early close-down of the A380 line. Boeing and the FAA took the risk together, and together they got away with it.

Is the 737 Max going to prove to be the one Boeing didn’t get away with? Time will tell.

But is certain Boeing will find a fix that will get the Max back in the sky. And although this episode, if it runs the course it seems likely to follow, will damage Boeing, the damage will be far from terminal. The company has an unbreakable brand name by virtue of being so good for so long, but trust will have suffered.

In the world at large, the art and science of safety oversight is changing dramatically. Technology is advancing so fast that the traditional system of close oversight by the regulator cannot work without stifling innovation, so “Performance-Based Regulation” (PBR) is the new watchword. Basically this means that the regulator prescribes what performance and reliability objectives a system or piece of equipment should meet, and the manufacturer has to prove to the regulator that it meets them. This is fine, providing that the regulator insists on the testing and the proof, and has the expertise and resources to carry out the oversight.

Although lack of oversight resources in the FAA seems unlikely, it would be a global disaster if it occurred. The same would be true of other national aviation agencies (NAA) in countries where aviation manufacturing takes place.

That risk of under-resourcing NAAs is a serious worry for the future, because all the signs are that most countries consider it a very low political priority, especially at a time of budget austerity.