It’s becoming more evident that the 737 MAX Lion Air and Ethiopian Airlines crashes implicate airplane design, flight testing, and certification. And regardless of how crew performance in these events is eventually adjudged, there’s a growing consensus that airline pilot training is an important issue that needs addressing.
Questions yet to be answered are how the 737 MAX 8 with such different handling characteristics got certified as just another 737 model and, whether during design, testing and certification, all failure modes were fully explored. Also why after more than two years in airline service didn’t the MCAS draw deep scrutiny because of its unusual malfunction pitching characteristics? How often did pilots resort to runaway stabilizer procedures to address such conditions? Hard to believe that, after all this time, a multitude of similar events wasn’t written up as post-flight discrepancies and flagged back to Boeing for a remedy.
The latest information is that the 737 MAX 8’s MCAS malfunctions cause much more pronounced pitch disruptions than the standard flight simulator runaway stabilizer scenarios. Yet, according to media reports, pilots on the previous flight before the Lion Air crash experienced irregular stabilizer activity and, after switching the stabilizer trim system off, trimmed manually and continued to destination.
But if the stabilizer was allowed to get very far out of trim, which is what appears to have occurred in the Ethiopian crash when stabilizer trim switches were re-engaged, air loads on the stabilizer might have been enough to prevent manual trimming. Old timer 707 and 727 pilots knew that in runaway stabilizer situations, hand cranking the stabilizer would be impossible if too much opposite force was simultaneously applied to the control wheel. The wheel had to be relaxed to unjam the stabilizer jackscrew. Findings are still preliminary.
First, a discussion about pilot training, which transcends even the last two 737 MAX accidents, then we’ll discuss airplane design. With airlines expanding around the world, staffing airline cockpits is a mounting challenge particularly in less developed countries. Airbus forecasts the need for more than a half million new airline pilots to accommodate airline growth and pilot retirements in the next 20 years. In a recent Aviation Week & Space Technology article, Airbus’s head of training, Michel Bigarre, expressed concern that the level of training and standards around the world needs to be reckoned with. According to the article, Airbus safety experts see “strange things in poor countries where air transport is growing fast and there’s suspiciously quick pilot qualification and fraudulent flight hour accounting.”
According to press reports, the Lion Air captain had about 5000 hours and the copilot had 6000. The Ethiopian Air Lines captain, according to the preliminary report, had 8122 and the copilot 361. That’s right, 361! But, hours in the seat are at best only a component of competence. Mastering flying basics academically and in the cockpit and building on that in more complex aircraft in a structured syllabus should be the minimum common denominator of every airline pilot. Hopefully, final accident reports will define how the crews performed and to what degree their experience weighed on events.
Airbus, to its credit, is the first major airliner manufacturer to acknowledge that new pilots coming to airlines, particularly in less developed areas of the world, do not necessarily have the basic competencies to operate their planes and that the burden to provide the training shouldn’t fall entirely on airlines. Accordingly, they’ve started affiliated ab-initio pilot training schools with about an 18-month ground school and flight syllabus focused on key pilot technical and behavioral skills. The first opened in Mexico last December; another is planned to open in May at the Airbus Flight Academy in France.
Military flight training programs use this approach, starting with a rigorous pre-admission exam and flight physical before entering the program. More than a half century ago when I went through naval flight training, the washout rate was about 30% for all reasons. It’s intense, compressed and demanding – and turns out young aviators with about 250 hours in 18 or so months who feel as comfortable flying upside down as right side up and can safely land a jet on an aircraft carrier.
As to how flight control design might have contributed to the two 737 MAX accidents, the conflicting philosophies of Boeing and Airbus are worth a discussion. Both manufacturers incorporate fly-by-wire (FBW) flight controls on their newest planes. The 737 MAX, a derivative of earlier 737s dating back more than 50 years, is the exception. It has the same basic analog direct control arrangement as earlier 737s except for the MCAS.
Boeing’s philosophy affords pilots full unrestricted control authority. There is a difference in control feel on Boeing FBW planes when limits are reached, but one has only to tug or push harder to go beyond those limits. Boeing acknowledges that pilots may not perform perfectly in those times when perfection is required. For example, on FBW planes like the 777, automation assists in engine failure emergencies with a thrust asymmetry compensation (TAC) system to automatically trim out yaw. Such a system would have prevented the 747SP high dive incident that will be discussed shortly.
But overall, Boeing’s logic is that engineers can’t anticipate all possible inflight irregularities and pilots need unrestricted ability to do what needs to be done, even if it exceeds basic transport certification design limits of -1g to +2.5g. A Boeing pilot could, if he or she wanted to, roll their plane 360 degrees. Done properly, it’s a perfectly safe 1g maneuver.
That’s exactly what happened at Seattle’s Boeing Field 64 years ago in front of Boeing’s chairman, Bill Allen, and a group of airline executives gathered to watch a fly by of the four-engine Dash 80 (precursor to the Boeing 707). To Allen’s horror, chief test pilot “Tex” Johnson came in low and fast pulling up into a shallow climb while gracefully rolling the Dash 80 360 degrees. Airline executives were impressed and awed at the Dash 80’s performance and maneuverability. The story passed down among airline executives is that Allen called Tex into his office and demanded to know: “What the hell were you doing up there?” Tex responded: “Selling planes!”
A more serious event occurred in 1985 which according to Boeing validates its design philosophy. A China Airlines 747SP en route from Taipei to Los Angeles cruising at FL410 had a number 4 engine failure accompanied by the autopilot disconnecting. The surprised crew failed to correct with left rudder and the plane rolled right, entering a steep dive. After descending over 30,000 feet in a steep rolling dive, the captain was able to recover control at 9500 feet.
During the high g recovery, horizontal stabilizer and elevator parts separated but enough of the stabilizer and elevators remained to permit the plane to divert and land safely at San Francisco Airport. Maximum vertical g’s were +4.8 at FL305 and +5.1 at FL 190! The NTSB concluded that the captain’s over-reliance on the autopilot following loss of the number 4 engine, and failure to monitor flight instruments, caused the loss of control and subsequent dive. Had the controls been flight envelope g-restricted, recovery wouldn’t have been possible.
Airbus takes an opposite view on flight control design, constraining maneuverability to structural (g) limits and aerodynamic stall limits. Lots of redundant flight control computers (FCC) do all the thinking and protect the plane’s normal flight envelope. For example, A330s and A340s have three primary flight control computers and two secondary computers, all dual channel, making a total of 10. They limit pitch to +30 and – 15 degrees and bank to 67 degrees (which equates to +2.5 g in level flight).
Single or multi computer failures are “voted out” by the remaining primary and secondary flight control computers. Computers control airplane response as a function of side stick direction, rate, g loading, and range of side stick movement. Airbus’s FBW FCC pitch and roll responses are uniform throughout the Airbus fleet from the A320 to the A380. There’s no need for something like the 737 MAX’s MCAS because flight control laws make pitch and roll response the same from model to model.
An A380 or A340 number 4 engine failure in cruise flight like the 1985 China Airlines 747SP event wouldn’t have progressed to a yaw-coupled rolling dive even if the pilots sat on their hands and watched. Thrust would have increased to maximum climb in an attempt to hold cruise speed while rudder trim automatically zeroed out yaw. If the plane was above its three-engine ceiling, speed would bleed off while the plane flew straight ahead in trim. If the pilots continued to sit on their hands rather than declaring an emergency and descending to a three-engine cruising level, speed would decrease to a minimum angle of attack value called Alpha Prot, at which point the autopilot would disconnect and the plane would descend at Alpha Prot angle of attack speed until reaching its three-engine service ceiling. Then, if pilots still didn’t react, it would level off and slowly climb as fuel burned off.
In an emergency requiring immediate and aggressive control response, such as avoiding a collision with an aircraft, or inadvertently flying toward rising terrain, maximum control deflection would yield a maximum airplane response up to the plane’s 2.5 g design maneuvering limit, without stalling. A pilot flying a non-envelope protected plane in similar circumstances would have to rely on experience to instantly decide how much control input was needed. Being unfamiliar with high g airliner maneuvering, he/she might not use all the plane’s available energy and control authority… or use too much and stall.
Just such an extreme event occurred December 20, 1995, when an American Airlines Boeing 757-200 en route from Miami to Cali, Colombia, struck a mountain while descending for landing. Multiple factors, from lack of ATC radar coverage to FMS navigational data irregularities, contributed to the plane being off course. Twelve seconds before impact, the plane’s ground proximity warning system activated. The crew responded immediately, pulling up steeply – intermittently activating the stick shaker – but forgot to retract the speed brakes. Impact occurred about 110 feet below the mountain top. Had the plane’s maximum energy been tapped and the speed brakes retracted, investigators believe the plane would have cleared the summit. With full back side stick, the Airbus FBW envelope protected system would have automatically retracted the speed brakes and pitched to maximum climb using the plane’s available energy.
But deficiencies in basic airmanship, over-reliance on automation, and just plain forgetting can flummox even the most creative FBW envelope protection systems. The June 1, 2009, Air France A330 crash into the Atlantic is an example. The Rio to Paris flight was cruising at FL 370 when it encountered icing in clouds that caused pitot tube icing which in turn resulted in erroneous airspeed indications and automatic disconnection of the autopilot. The captain was out of the cockpit, leaving two copilots in control.
With the autopilot off, flight control computers reverted to what Airbus calls “alternate law” with pitch control computers providing neutral stability and the plane trimmed for 1 g level flight. Roll control is direct, meaning it’s just like an analog plane responding to side stick commands. In alternate law, the plane can be stalled.
Had the pilots been familiar with the plane’s cruise pitch attitude and thrust settings correlated with the plane flying level, they likely would have let well enough alone and pressed on flying manually. Instead, seeing high airspeed from the erroneous pitot system, the pilot pulled back hard on the side stick, pitching the plane up at 1.7 g until it stalled. It then descended quickly at about 15000 ft/min at low airspeed with engines spooled up at 100 % until impact.
In another case, on June 26, 1988, at Mulhouse-Habsheim Airport, France, a then-brand new A320 with an Air France captain at the controls crashed on a low level publicity flight demonstration. The plane had just been introduced to the public about a month earlier and this was a chance to show the plane to thousands of onlookers gathered at the airport. It came in low over the runway with thrust at idle and airspeed decreasing with the plane’s FBW system keeping the plane just above a stall.
What the captain apparently forgot was that the plane’s FBW low speed thrust protection cut out below 100 feet radio altitude in order to allow the plane to flare and make a normal idle thrust landing. As the end of the runway approached, the captain attempted to spool up the engines but they couldn’t accelerate fast enough. The plane continued ahead with engines accelerating through the 70% range and the FBW system keeping the A320 just above a stall, when, as a former test pilot put it, “The first bird strike occurred… but the bird was in its nest.” The A320 plowed straight ahead, wings level through the trees and crashed in flames.
Airbus’s FBW arrangement, artful as it is, has its quirks. For example, Airbus pilots can “help out” with “subtle assistance” on the side stick controls by giving a little nudge while the other pilot is flying but side sticks are not coupled! They move independently and if moved simultaneously their motions are algebraically summed. In such circumstances, a cockpit speaker loudly asserts “ DUAL INPUT” accompanied by illumination of glare shield lights. Such an action would be like differing parents simultaneously disciplining a child with the result that neither approach succeeds exactly as desired. Of course, it’s contrary to the way airliners are flown with strict protocols requiring pilots to announce who has the controls. But, on an Airbus, it’s important to know because a nudge on the controls by another pilot can be counter-productive.
Whether one control philosophy is better than the other is pretty much a wash in normal operations because cockpits are so highly automated and pilots do so little hand flying. My impression is that Boeing is moving more in the direction of Airbus to intervene with automation in emergencies, and that’s a good thing. It’s an ironic tragedy that the company advocating most for pilots being in ultimate control should have two loss-of-control accidents because an add-on automatic stall prevention system caused pilots to lose control.
The reality is that less experienced pilots are staffing cockpits today, especially in less developed countries, and well-designed automation to ameliorate inadequate or inconsistent pilot performance should make flying safer for everyone. The challenge for airline pilots is to keep hands-on flying skills sharp and not be dulled by automation. For airlines, it’s providing the ground school and simulator training so that pilots have the skills and a full understanding of their aircraft to safely fly the line. For manufacturers, it’s doing what needs to be done at every step of design, testing, and manufacturing so that passengers don’t have to anxiously ask what kind of plane they’re on. And also not nickel and diming airlines on cockpit warning systems.
Updated 4/10/19 to clarify the 747 incident.