Diary of Disaster: the MAX Mess

Sunday, March 10, 2019

I knew it was coming.

Now it is two. Twice in less than five months a B737 MAX-8 takes off, its pilots report a problem, and minutes later the aircraft impacts the surface at high speed.

The sequence is the same: the aircraft climbs normally until the flaps are retracted. Then all hell breaks loose. Suddenly allowed to function because the flaps are up, a cretinous piece of software, designed to allow the certification of the aircraft, starts trimming the horizontal stabilizer nose-down. It repeats the action every five seconds.

The pilots are blindsided. Probably they pull back on the yoke to stop the stabilizer motion. That works on every other B-737 they have flown. For some reason it doesn’t work here. The stab keeps running away, more and more nose-down. The airspeed keeps increasing. Perhaps they succeed once or twice in getting the nose back to level. But eventually, as per design, the more powerful stabilizer overpowers the elevators. The aircraft pitches down and hits the surface at high speed.

●

The B-737 first flew in 1967. To say it is popular is an understatement. Over ten thousand have been made; there are presently 4600 on order. In recent years its competition has been the Airbus A320 Series. When Airbus announced the A320 NEO, with larger, more fuel-efficient engines, Boeing countered with the B737 MAX Series. With so many B-737’s already flying, and thus so many pilots trained and experienced on type, Boeing planned to get its marketing edge by claiming that those trained and experienced pilots could transition to the MAX with virtually no effort or further training. A short iPad slideshow, and they would be good to go.

The strategy was a huge success. The MAX became Boeing’s best-selling aircraft ever, and by late 2018 there were already about 350 of them in the field. But there had been a snag during certification. The B-737’s landing gear is short, and to keep the larger engines clear of the ground they had to be mounted higher and further forward on new pylons. An unwanted consequence was poor handling qualities at low speed. The airplane would nose up on its own, trying to go still slower and stall. With this behaviour the airplane could not be certified. So Boeing added MCAS, a piece of software capable of taking control from the pilots and running the horizontal stabilizer to full nose down.

Lion Air 610 – October 29, 2018 – 189 dead ● Ethiopian Airlines 302 – March 10, 2019 – 157 dead

Forty-odd years apart, D.P. Davies and Andy Grove predicted the situation we find ourselves in today. D.P. Davies is a test pilot who wrote a book called Handling the Big Jets. Andy Grove was an engineer who successfully steered Intel through the largest scale-up in the history of business. Both worried about how knowledge gets passed on from one generation to the next, if indeed it gets passed on at all. Andy Grove, in a 2010 paper in Bloomberg News, called the failure to pass on “breaking the chain of experience.”

Their fears were well founded. Today the chains of apprenticeship lie broken for both pilots and engineers. There is no one to teach pilots about the coffin corner of high altitude flight, where Mach buffet meets the pre-stall buffet and the airplane’s speed envelope reduces to zero. No one to teach them about big jets, whose huge range of speed, weight, and Centre of Gravity necessitate the all-moving horizontal stabilizer, whose immense power should in turn strike terror into the hearts of both pilots and engineers. No one to pass on to engineers the proud aviation tradition of dual and triple redundancy, where the failure of a single component is an inconvenience, not a potentially fatal threat.

Nor is any of this in the syllabus for training pilots or engineers. If there is a bright side to the MAX crashes, it is that they provide prima facie evidence that we have failed to pass on our experience, and that valuable human knowledge is being lost.

Or perhaps not yet. The books have not been burned. I still have a copy of D.P. Davies’ Handling the Big Jets. In the conclusion, Davies speaks eloquently about the need for a seamless transmission of knowledge from the test pilots to the manufacturers to the airlines to the instructor pilots to the line pilots. His book remains a splendid example of such a pipeline. He speaks directly to the line pilot, patiently and engagingly explaining the many things that are different when a pilot and his aircraft fly higher and faster; what is different when the airplane is much larger and heavier.

Note on Nomenclature: Horizontal Stabilizer, stab (American English); Variable Incidence Tailplane (British English); le Plan Horizontal (French)

Here is what D.P. Davies had to say about variable incidence tailplanes in 1967:

In dealing with the consequences of having a variable incidence tailplane one basic fact must be kept in mind – it is very powerful. (Davies’ emphasis)

…..

This enormous power in a variable incidence tailplane can be a good servant when required but an impossible master when not required . . . . a variable incidence tailplane should be used only in short bursts, . . . .and the full effect should be appreciated before any more tail change is made.(my emphasis)

(Handling the Big Jets 3^rd edition, 1971, p. 39)

Small airplanes today (and early airliners) have a fixed horizontal tail surface which gives the airplane longitudinal stability (stability in pitch). Hinged to the rear of that fixed surface are moveable surfaces, called elevators. These are connected to the stick or yoke, allowing the pilot to control pitch and Angle of Attack (AoA).

Have you ever been “re-seated” before landing? It does happen occasionally, because an airplane’s Centre of Gravity (C/G) influences pitch, AoA, and longitudinal stability. The C/G might be OK at cruise, where the AoA is low, but be unacceptable for approach and landing, where the AoA is higher. There must remain sufficient control for the flare and landing, and longitudinal stability must not be compromised.

So why is that re-seating so rare? Large jets almost all have moveable horizontal stabilizers. They look the same as fixed stabilizers. They too have elevators hinged to the trailing edge. But the whole surface can also move, changing its angle with the fuselage. If you look carefully at the photo on page one you can see:

• a vertical stripe on the fuselage just aft of the stabilizer leading edge. This is a slider where a stabilizer spar goes through to the actuator and continues to the right side stabilizer

• three reference marks on the fuselage just ahead of the stabilizer leading edge. The top mark is full Aircraft Nose Down

This moveable surface is much more powerful than the elevators. (The mathematically inclined can think of the ratios of surface area and angle of movement between the elevators and the combined surface). As Davies explains, there are two main reasons a more powerful tail is required: large C/G range (you have to be able to walk to the washrooms at the rear) and large speed range (a Piper Cub cruises at 90 and lands at 60; a B737 cruises at 400 and lands at 130).

But Davies also warns us about the dangers: the good servant and the impossible master. How prescient his words are! Indeed, a runaway stabilizer, where there is uncommanded movement of the horizontal tail, is a dire emergency. In simulator tests in a B-747-400 at cruise altitude, a stabilizer running away nose-down became unrecoverable in seven seconds. That is why the Runaway Stabilizer procedure must be a memorized drill and not a checklist. That is why pilots have to get those two STAB TRIM CUTOUT switches to CUTOUT right now! What takes time is recognizing what is going on.

●

Monday, March 11, 2019

There are two important developments today. First, they have found both the Digital Flight Data Recorder (DFDR) and the Cockpit Voice Recorder (CVR). Second, the China Air Authority has taken the lead, grounding China’s fleet of B-737 MAX. Indonesia has followed, along with Ethiopia. The net in terms of airlines: 22 have grounded their fleet or had it grounded by their regulator, and 12 are still flying their fleet of MAX’s and expressing full confidence in the airworthiness of same.

Does this constitute a critical mass? Probably not, but the China move is of particular importance. China has been developing a replacement/substitute/competitor to the B-737 – the C-919 – but has had trouble breaking into the old boys’ club of manufacturers, regulators, and airlines. But now the timing is good, given the state of the tariff wars and trade talks between the USA and China. China has sensed weakness and is going for the jugular.

For a weakness it is. At home in the USA, Boeing’s 800 stateside lobbyists have been busy since the first crash – Lion Air 610 on October 29, 2018. The yellow tape is up. Nothing to see here. More subtly, Indonesian regulatory authorities, airline operations, and pilots are – well, not American. Back home, early objections from pilots’ unions have been tamped down, like nails which stick their heads up. Not team players.

●

Do-it-yourself Wind Tunnel

An airplane flies by pushing air down. That’s the wing’s job. It meets the air at a slight angle. That angle is known as the Angle of Attack, or AoA. You could say that Angle of Attack is the angular difference between where the airplane is pointing, and where it is going. In the normal flight range, the pilot can increase lift by pulling back on the stick or yoke, forcing the wing to meet the oncoming air at a larger angle. That works until the AoA reaches about 15 degrees. Above that, lift levels off and decreases, while drag begins to go up exponentially. That point is called aerodynamic stall.

If you are a daring type, you can experiment with lift and AoA by sticking your hand, palm down and horizontal, out the passenger side window of a car at highway speed. You can “fly” your hand up and down. (Be careful – the resulting forces can be quite large). But you can see that should you rotate your hand so the palm is vertical, your wrist would be pinned to the rear edge of the window opening. Your hand would be stalled. (Don’t try this.)

If you did the same experiment at 30 mph, the forces would be lower. But your hand might not fly. Please don’t try this at 100 mph. It could cause injury or death.

●

When I joined the airline in 1973, it was a different world. Most airline pilots were ex-military; many had been fighter pilots and had experience flying jets at high speeds and high altitudes. They were my mentors and teachers. I absorbed their CF-100, F-86, and CF-104 experience and put it to work on the DC-9. The airline put me through training courses, but most of my learning took place flying the line with captains who took their teaching responsibilities seriously.

In today’s news an ‘aviation expert’ expressed concern that Ethiopian 302’s co-pilot had just 200 hours total flying time. “The 200 is ridiculously low,” he said.

No. Flying is an apprenticeship trade. You learn to fly an airplane by flying an airplane, preferably in the company of another pilot who has more experience than you do. Many of my contemporaries at the airline started with 300 hours. That was 46 years ago. Like me, they learned, worked, and then taught those who followed.

Apprenticeship has served since the Middle Ages to ensure continuity of knowledge. Apprenticeship has survived in the flying trade, but barely. It is under duress. First, hub-and-spoke spawned feeders and regionals. Pilots were divided into a three-tier hierarchy. Experienced pilots no longer flew with new entries. These were logical developments operationally, and on the business side they had the effect of weakening the pilot unions. But there was a huge cost to apprenticeship.

The second threat to continuity of knowledge was automation. Why? Because automation was being sold as a way to reduce training costs.

My fellow pilots and I are not Luddites. For the most part we have been enthusiastic (and early) adopters of some pretty complicated software. But this marketing strategy, this way of selling automation to the airlines, is wrong in its premise. Of course it worked brilliantly in the business sense, and airlines and regulators and the flying public have all bought in to the idea that we are safer if the automation is flying the aircraft. But in fact there is team flying the aircraft – pilots and robots.

Over the last thirty years there has been much research and much talk, and many new acronyms have appeared; Crew Resource Management (CRM), Safety Management Systems (SMS), and Risk Management Systems (RMS). They rightly emphasize good communication among crew members. The point missed is that the robots are part of the crew. For the crew to be effective, pilots must be able to communicate their intentions to the autopilot, auto-thrust, and Flight Management Systems. And it must be a closed loop: pilots must also see instantly if the robots are achieving the intended goals, and if not, why not. That takes detailed knowledge of the robots’ character and construction. More training, not less training. More knowledge, not less.

One of the pilot commandments is know thy airplane, and of course that applies to the software as well as the hardware. In the 35 years since glass cockpits arrived, most accidents have been attributed not to pilot error, in the old catchall sense, but to pilots failing to understand the software they were trusting to do the job.

●

Tuesday, March 12, 2019

Today Europe joined China et all in grounding the MAX. The EASA (European Union Aviation Safety Agency) had initially been reluctant to certify the airplane, but eventually caved under pressure from Boeing and the FAA. They may be re-examining that decision.

I will be looking back too – to the first crash last October (Lion Air 610), and to what action has been taken since then. And because I believe that the horizontal stabilizer (or variable incidence tailplane, as Davies calls it) is at the heart of these crashes, I will look further back and re-examine other notable disasters involving the stabilizer: Air France 447 (June 1, 2009), Alaska Air 261 (Jan 31, 2000), and Trans Canada Airlines 831, way back in 1963. And perhaps even – although I hesitate to bring this up even to myself – I will ask some questions about the history of the certification of this moveable surface.

But first let us imagine we are a young test pilot, learning his or her trade. We are fortunate to be in a situation where knowledge is passed on. We are fortunate to be having an apprenticeship.

Test Pilot School

It is the summer of 2016. You are excited. You are a rookie test pilot. You’re also a girl. You are boarding the Spirit of Renton, the prototype B-373-MAX, with a senior test pilot, one of those guys who has seen it all. The engineers are in back with their equipment. Today’s mission is not the first flight, nor is it super high-risk as missions go. But it is a chance to show off your skills. To fly as accurately as you can.

The exercise is to fly 60° bank level turns while slowing, until the airplane is close to aerodynamic stall. This accomplished by holding altitude and bank angle but not adding power.

An airplane turns when its lift vector is tilted until that vector has a horizontal (sideways) component.

Why? Think of how you are pushed sideways in a car which is taking a corner fast. That is Newton’s First Law of Motion, also called the Law of Inertia:

A body in motion will remain in motion in a straight line unless acted on by an external force.

That external force can act to speed up the body or slow it down. It can also change the direction of the body. The body has what is called velocity, which is a vector. A vector is like an arrow, having both length (speed) and direction (where it is going). The driver of a car can use the engine, brakes, and steering to alter the velocity vector, so the car stays on the road.

But an airplane has no rubber on the road. The force has to come from somewhere. The largest force under the pilot’s control is lift. He tilts the lift by banking the airplane so some of that lift is acting horizontally. But now the vertical component is less than the aircraft’s weight, and the aircraft will start to descend. So the pilot pulls back on the yoke, increasing the AoA and thus the lift, until the vertical component of lift is again equal to the aircraft’s weight.

Now the aircraft is not descending, but the pilot is pushed down in his seat. It is if he and the airplane weigh more than they normally do. How much more? In the case of the level turn, as described here, the Load Factor, or G as perceived by the pilot, is related only to bank angle. The equation is G = 1/cos_BankAngle. Before you pull out your phone and find the calculator app, let’s keep it to simple numbers: at 60° bank, cos 60° = 0.5, and 1/0.5 = 2G. The pilot and the airplane are pulling G. 2G, to be precise.

You have arrived in the test area. You alert the engineers that the maneuver is about to begin. You rehearse the maneuver in your head. You imagine what it will look like from above – a decreasing radius spiral.

You roll the aircraft smoothly into a 60° left bank, suppressing your instinct to add power as you pass 30° bank. You are concentrating hard, watching pitch attitude. That rivet on the wiper arm must stay exactly on the horizon in order not to lose altitude. If you hold that pitch and exactly 60° bank, you will be pulling 2G, the object of the exercise.

But you know that the aircraft is slowing down. Why? Because you have asked the wing to produce extra lift, and that lift is not free. The price is more induced drag, the drag caused by the production of lift. If you had your hand out the car window now, tilting your thumb upward would ‘fly’ your hand up, but it would also try to move your hand back toward the rear of the window opening.

Your scan does its circuit several times per second. Your eyes move from the rivet to the vertical speed to the rivet to the altimeter, and back to the rivet. You know that rivet is going to try to sag below the horizon. You know that as the airplane slows you will have to bring it higher than that, because by the lift equation a slower speed means less lift. You are gradually increasing AoA to keep the lift constant.

So far so good. You have completed a full 360° turn, and the rivet is now two fingers above the horizon. You will end the maneuver when the AoA reaches target and you know that will be when the cotter pin on the wiper shaft nut meets the horizon. You know you are inside your starting point. From above your trail looks like a coil of mosquito repellent, or the burner on an old electric stove.

Now it gets interesting. You started the maneuver with what felt like about 25 lb. of pull on the yoke. You have been keeping an even pull, but you are flying attitude. Looking out the window. You are flying attitude to hold altitude, and holding 60° bank to pull 2G. You have been holding the roll attitude (bank) constant. You have been slowly raising the nose (increasing the pitch attitude). But now the airplane wants to pitch up on its own. You are breathing deeply, trying to ease the back pressure just enough to keep the nose from creeping up faster than it should. The cotter pin hasn’t reached the horizon yet, and your partner hasn’t yet called MAX AoA. You try to keep breathing. Now you are pushing, really pushing, maybe 10 lb. on the yoke, to keep the nose from coming up too fast. You are sweating. Your mouth is dry. You can feel your pulse in your temples.

MAX AoA, he says.

You push a little harder, rolling the aircraft level and lowering the nose gently and starting a descent. You squeeze the thrust levers forward. Nothing violent. Just smooth and gentle. Gentle with attitude. But whatever is necessary on the controls to get that attitude change.

AoA 3.5, he says. Good job.

You start breathing again. The boys in the back say the traces are good. It is as you expected, as the two of you have briefed. Above a certain AoA and pulling G, you had to push forward. There was a negative stick force per G.

After shutdown, you debrief with the senior test pilot.

Nice job, he says. You’ll go over the data. You’ll re-live the flight. It will become part of your experience.

But what will they do? you ask.

Oh, we’ve been through this before. With the Seven-Six. You weren’t born yet. It was the same thing for the same reason. Big engines hung way forward.

What did they do then? you ask.

Put a stick pusher on the elevator. They took the data from the test flights. It was almost exactly like the profile you just flew. They could do the same thing with this. Make the pusher pull the stick forward just enough so if you were flying the same profile you would have the same 25 lb. pull throughout. Hey, my Bonanza has an elevator downspring. Same deal, more or less. With a simple spring, they made more stick force per G over the whole range.

It was too light on the elevator?

Yup.

What does it feel like?

In the air you don’t notice it. On the ground the yoke is pulled full forward. For takeoff you have to pull it back and hold it in neutral.

How do you know where neutral is?

I’ve got a sharpie mark on that centre shaft. Where it goes into the panel.

You digest all this for a minute. But designing and fitting a stick pusher’s gonna take time! you say. And you know the time pressure we’ve been under!

Yeah. And it would make it different from all the other Seven-Three’s. And they sure as hell don’t want that.

What do you think they’re gonna do? you ask.

I don’t know. But if I had to guess, I’d say some engineering supervisor is going to draft a brainless spec for the software boys to code.

But what about an actuator?

They’ll use the stab.

What?

I know.

Use the stab? For a handling problem?

The yoke trim switches and Speed Trim and the autopilot already have access. Wiring. Actuators. All there. Just add software.

But that’s nuts. It doesn’t make any sense.

You feel like someone has just punched you in the stomach.

Has . . . has anyone ever used the stab before? I mean, for something like this?

No.

Jesus!

But . . .

I know. I know. And if they do, fuck them. I’m outa here. I’ll take the package. Go fly my Bonanza.

●

Wednesday, March 13, 2019

When I went to bed last night only North America was still flying the MAX. North America and America in the world, like a sore thumb. Marc Garneau, the Canadian Minister of Defence, expressed confidence in the fleet, saying that WestJet, Air Canada, and SunWing would keep flying the MAX. Boeing and the FAA were rock solid, mouthing the same story with earnest gravity.

But this morning something is happening, like a fissure opening up during an earthquake. There is data. Satellite data.

●

Balsa-wood Christmas-stocking Glider

Remember the balsa-wood gliders you got in your Christmas stocking? They would charge around the living room, swooping and diving, committing hara-kiri. They had a solid fuselage with slots for the wing and empennage and a metal clip on the nose for balance and protection. The slot for the wing was long enough so you could slide the wing fore and aft. That was your flight control. We can use one of those kits for a brief tour of aircraft stability and control.

Assemble the tail – the vertical and horizontal surfaces making the familiar upside-down T. Leave the wing off for now. Put your pen on the table and use it as a fulcrum to find the balance point, the Centre of Gravity. The metal clip on the nose is heavier than the tail feathers, so the fuselage will balance with the pen nearer the nose than the tail. Mark this point. Now look at the slot where the wing goes. You will see that the mark you made is somewhere near the front of the slot. That is important.

Now let’s try a test flight. Yes, leave the wing off. That way we have no lift, so the flight will be ballistic, like a baseball or a cannonball or a bullet. Gravity will bend its path toward earth. We have, in effect, a crude dart.

Put the dart in the palm of your hand and do an underhand toss. The result is more than just ballistic flight. Try it again. Notice how the drag on the tail feathers pulls the tail back behind the C of G until the tail surfaces – and the fuselage – are aligned with the direction of flight. This contraption is leading with the chin. It is pointing where it is going. That is important, too.

Now we can add the wing. Visualize the Centre of Lift. You would not be wrong to suppose it was near the geographical centre of this long rectangle, the wing. But since the wing must meet the air at a slight angle to produce lift (AoA), and the airflow begins to detach near the trailing edge, in practice the C of L is about 1/3 back from the leading edge. Mark that point.

Our goal now is to install the wing and slide it so that the C of G (marked on the fuselage) is ahead of the C of L (marked on the wing). We want to create a moment – a twisting force around the lateral (wingtip to wingtip) axis. We want that moment to try to push the nose down.

A suicide machine? you ask. Yes. But bear with me. If we were to drop the assembly from a balcony with no forward motion, what would it do?

It would point where it is going – straight down. So it’s going to crash, you say. Well, yes, if the balcony is a few feet above the ground. But try it from your second-story balcony. As he airplane gains speed, pulled down by gravity, the surfaces begin to create lift. That’s their job. The wing pulls up and the tail pulls down, at least from the pilot’s point of view. The pilot wants to survive. He pulls back on the stick, raising the elevators, making the tail pull down more. He pulls out of the dive, hopefully before hitting the grass.

Your balsa-wood glider has no pilot. But if you have set your wing at the right place, it will pull out of the dive too, because your horizontal tail – your stabilizer, your tailplane – is set to a slight negative incidence, so the tail will pull down. That does a couple of things. It pulls your glider out of a suicidal dive, and, once level, it continues to hold the wing at a slight positive AoA, producing just the right amount of lift. You have an airplane! And it is potentially a stable one!

So, you ask. Is the tail always pulling down, holding the nose up? In a word, yes.

And if something goes wrong with the tail, or if it rips off, the nose will dip until it points straight down? In a word, yes.

So – mess with the tail, and it’s potentially a suicide machine? In a word, yes.

●

Marc Garneau has just made a announcement grounding the MAX in Canada and prohibiting overflight. The satellite data that changed his mind is most likely ADS-B out data.

Automatic Dependent Surveillance – Broadcast

ADS-B is the newest technology linking pilots and controllers. In WW2, the first radar systems broadcast a pencil-beam of microwave radiation from a rotating antenna, sweeping a circular area every few seconds. When the beam hit an aircraft, a small fraction of the energy would be reflected back to the antenna. The delay was the distance, and the antenna position (in the sweep) was the azimuth. We know that today as primary radar.

Later in WW2, that radar sweep would elicit a response from the aircraft. It was called IFF (Identification: Friend or Foe). If the aircraft sent the right code in response it was a friend. Today a development of that system is on board virtually all aircraft. The device on the airplane is called a transponder. It can return codes, as IFF did. Today it almost always returns altitude as well. The system as a whole is referred to as secondary radar.

ADS-B stands for Automatic Dependent Surveillance – Broadcast. Most aircraft today have extremely accurate navigation in three dimensions through either GPS (Global Positioning System) or IRS (Inertial Reference System), or both. ADS-B broadcasts data from that system every few seconds via satellite (world standard) or towers on the ground (in the USA only, at a slightly longer wavelength). The data includes latitude and longitude, groundspeed, track, and more.

●

Today these two images were released. They compare the Vertical Speed histories of Lion Air 610 and Ethiopian Airlines 302. The data is presumably from ADS-B-Out information transmitted via satellite.

Marc Garneau, didn’t mince words in his grounding of the MAX:

As a result of new data that we have received this morning . . . I am issuing a safety notice. This safety notice restricts commercial passenger flights from any operator of the Boeing 737 MAX-8 or MAX-9 variant aircraft, whether domestic or foreign, from arriving, departing, or overflying Canadian airspace.

Until the end. There the script still lives:

As the investigations have just started, it is too soon to speculate about the exact cause of the accident in Addis Ababa and to make direct links to the Lion Air accident in Indonesia in October of 2018.

The United States of America is alone in the world. But not for long. A few minutes ago, the president jumped the gun on the FAA and Boeing and announced the grounding of the MAX.

●

Thursday, March 14, 2019

The marketing strategy of selling automation to the airlines as a way to reduce training is more than a false premise. It has consequences for liability.

When I joined the airline and began to study accidents and incidents I understood early that when something goes wrong, the captain is responsible, and that someday, that might be me. Depending on the severity of the event, you are dead, fired, or demoted. Pilot error. It is a win-win for everyone. Especially if the pilot is dead.

But now that model is blurry at best. Perhaps sensing this, the airlines and the manufacturers have been lawyering up. Today, when a manufacturer sells a new airplane, the buyer signs a contract which, deep in the fine print, says that this airplane is not necessarily airworthy. Instead of maintaining the airplane, most airlines contract that work out to the lowest bidder, not incidentally offloading any responsibility for performing that maintenance responsibly or legally. I bring up this wrinkle because the B737 MAX has moved us into new territory. A line has been crossed. We are at an inflection point. The offloading of responsibility has moved up the chain to certification itself. Who is responsible?

●

This case – malfunctioning software on the MAX – seems peripheral to the subject of automation in aviation. It is not. Any software involved in flying the airplane, and especially that which touches the flight control system, becomes in effect a robot which is part of the crew. Anyone who has played a team sport, sung in a choir, or flown an airplane which requires more than one pilot, understands that she is not alone. Her participation makes her a part of a team. She is essential, but not sufficient. She must work effectively with other team members. That includes robots.

In sports, in music, and in countless other situations, we bring individual skills into a co-operative venture. But we must also bring what are often called people skills. What these are is hard to pin down, but they start with humility, empathy, listening, and willingness to learn. But what about robots?

Perhaps because they are not human, we tend to treat them like gods and devils. Either we want nothing to do with them and ignore them, or we deem them unknowable and worship them. Either course is doomed to failure. In aviation, people have died because of that failure.

But before we look into cases where the teamwork has failed, let us look at one where the teamwork was brilliantly effective – the Miracle on the Hudson.

U.S Airways Flight 1549 – January 15, 2009

Much has been written on this incident. There is a movie. It is a compelling story. But there is a moment, a move, a decision at the very beginning, which has been largely ignored. That was Captain Chesley (Sully) Sullenberger pressing a button on the overhead panel and announcing, “I’m starting the APU.”

U.S Airways Flight 1549 departed LaGuardia Airport runway 04 and turned left onto a north heading. A couple of minutes later, climbing through 2700 feet, it hit a flock of Canada Geese. The damage to the engines was severe enough so that they both began to spool down. The timeline on the voice recorder after the audible thump of the geese hitting the aircraft went like this:

15:27:11 thump

15:27:14 uh oh

15:27:15 we got one rol – both of ’em rolling back

15:27:19 Ignition Start

15:27:21 I’m starting the APU

The aircraft was an Airbus A-320, the first airliner that was truly fly-by-wire. The side-sticks are connected to the control surfaces through seven multi-channel flight control computers. With the electrical power failure resulting from the loss of both engines, many of those computers would drop off-line. With the flight-controls in the resulting Direct Law, the airplane handles like a wet fish. Two of the three hydraulic systems would be down, limiting the movement of the control surfaces.

Sully thought that was a bad idea. He recognized that these robots, who were part of his team, need juice. Ten seconds after the thump, and six seconds after his First Officer said we got one rol – both of ’em rolling back, he started the Auxiliary Power Unit, a small turbine in the tail that is usually used for electrical power and air conditioning on the ground. Its generator is identical to the engine generators. Any one of them can handle the full electrical load of the aircraft. With this one strategic move, Sully ensured that all of his team would be there to help him. The flight controls would remain in Normal Law, ensuring normal handling and full envelope protection. The airspeed tape would still have reassuring cues like green dot and the hook. The three hydraulic systems would remain active, allowing flap extension and thus a normal landing speed.

One-and-a-half minutes later, the aircraft is clearing the east end of the George Washington Bridge at 1200 feet, and Sully sees they cannot make it to either LaGuardia or Teterboro Airport. They will have to ditch in the Hudson. A minute after that they are at 300 feet and Sully asks for flap. Flap 2 is selected, deploying the leading edge slats and the trailing edge flap to what amounts to a maximum lift versus drag position. Sully slows the aircraft from 190 knots to a normal touchdown speed of 128 knots. Less than a minute after selecting flap, they are in the water.

But what can happen when the human crew does not display Sully’s depth of knowledge? When the respect of one crew member for another has been replaced by fear and avoidance, or by fear and worship?

Air France 447 – June 1, 2009

Air France 447 was an Airbus A-330. Its flight control system was almost identical to Sully’s A-320. This system was the brainchild of Bernard Ziegler, a talented test pilot and engineer. Looking back thirty-plus years, this software must be counted as a success. But nothing is perfect. Bernard Ziegler is a proud man who is aware that there are pilots out there who are not as adept as himself. Accordingly, he designed the Airbus series to be unstallable. Pilot-proof, as he put it. The Greeks would call that hubris. And Air France 447 was the nemesis.

The Airbus side-sticks, unlike the familiar sticks or yokes, are not connected mechanically. If one pilot moves his side-stick, the other pilot cannot feel what he is doing. The reaction of the aircraft is his only clue. On a dark night, in cloud with thunderstorms around and lights flashing and alarms ringing on the flight deck, he might have no feedback whatsoever.

The captain had just left the flight deck for his nap. The relief pilot had taken his seat. The flight, from Rio de Janeiro to Paris, was approaching the Inter Tropical Convergence Zone (ITCZ), known to mariners as the doldrums, where the norm is calm surface winds and rising air forming thunderstorms. In the half-hour before the Captain left the flight deck, the right-seat pilot, the Pilot Flying, repeatedly tried to engage the Captain in a discussion of the option of leaving their cruise altitude of FL350 and climbing over the cloud layer they had entered. The Final Report calls the PF’s state preoccupation. The Captain “vaguely rejected” the climb option, saying, “If we don’t get out of it at FL360, it might be bad.” That was as close as the discussion got to the aircraft’s flight envelope.

All airplanes have a maximum altitude, sometimes referred to as the service ceiling. As the air gets less dense in the climb, the engine(s) produce less thrust. As the thrust drops to near the thrust required to hold altitude, the climb rate drops, eventually to zero.

But the rare air has another effect: the wing produces less lift for a given Angle of Attack. A subsonic jet can make up for that by flying faster or increasing its AoA. But as it nears the speed of sound (Mach 1.0) shock waves form on the top of the wing (where the airflow may have already exceeded the speed of sound) and lift drops off, instead of continuing to increase with speed. The airplane can’t go faster, and because AoA is already near the stall point, it can’t go slower. This is called coffin corner. As one wag put it, if you go any higher you’ll be both too fast and too slow.

In engineering circles, coffin corner is called the aerodynamic ceiling. Can an airplane fly higher than its aerodynamic ceiling? Yes – if the airplane is in ballistic flight.

On that dark night what Air France 447 encountered was not severe turbulence, but another byproduct of thunderstorm activity: supercooled water. As air moves up in the atmosphere it cools from expansion, and can hold less water vapour. Some of the water vapour will condense into drops of liquid. Surprisingly, these drops can cool to less than 0°C and still remain liquid, because they haven’t found a speck of dust around which to crystallize. But let an airplane come along and they will freeze instantly. One of the places they can freeze is in the probes called pitot tubes, which sense dynamic pressure and are a source of airspeed information. Airliner pitot tubes are heated, so this shouldn’t be a problem. But there had already been incidents where these particular pitot tubes had been overwhelmed by ice, where the energy of the heaters was not quite enough to keep the pitot free of ice.

That happened to AF447, and two of the three pitot tubes temporarily reported erroneous low airspeeds. As per design, the flight control system degraded progressively. First the autopilot dropped off, effectively saying to the human pilots, You have control. Then the flight control computers began – again as per design – to shed responsibility and announce they had done so.

As we saw in Sully’s airplane, the Airbus Flight Control System should be in Normal Law. Here there is full envelope protection: it can’t go too fast or too slow or pull too many G’s. If you let go of the side-stick, it will continue wings-level flight at one G. The airplane can’t stall. Another feature of Normal Law is auto-trim. In earlier airplanes – like the B-737 or the DC-9 – if you change speed or power or flap position you will have to trim the stabilizer – yes, the variable incidence tailplane – to avoid having to hold pressure on the yoke. In the Airbus, auto-trim will move the stabilizer for you. If you let go the side-stick, the airplane will continue 1 G flight even, for example, if it is too slow on approach. It is an irony that a pilot hand-flying an Airbus on a visual approach has to be more vigilant, not less.

Here on AF447, with the pitot heaters failing and the computers differing on airspeed, the latter degrade from Normal Law to Alternate Law. There are variations of Alternate Law, but in all of them envelope protection is lost. So now the airplane can stall. And whether this was an oversight in the design or not, auto-trim is still active.

It might have been preoccupation. It might have been following the erroneous and irrelevant commands of the Flight Director bars on his Primary Flight Display instead of flying attitude, which was there on the PFD, but underneath the FD bars. In any case, the pilot on the right seat, the Pilot Flying, was now really flying because the autopilot wasn’t. And he pulled. Pulled almost continuously, like a drowning man pulling his rescuer underwater. Ever helpful, the flight-control system robot moved the stabilizer for him. Now it wasn’t just the pilot holding up elevator. It was the robot helping by moving the stab nose-up. Full nose-up. That’s where the jackscrew was when they found it on the bottom of the ocean. What would our balsa-wood glider have done?

It would have done a series of swoops, pulling nose-up to almost vertical, then stalling, nose dropping, and picking up speed into the next swoop. But the glider weighs ounces and is in thick sea-level air. AF447 weighs tons, and is flying in the rare air of the Flight Levels. And the stabilizer is very powerful.

What follows is a zoom. The nose goes up. The AoA increases. The increased lift bends the flight path up. The aircraft climbs from 35,000 feet to a maximum of 37,924 feet, well above its service ceiling, propulsion ceiling, optimum altitude, and max altitude. It is too high, too fast, and too slow. It is not flying. It is ballistic, like a baseball or a cannonball. It is going to come down.

And it does. Its great inertia has given it the energy to climb to almost 38,000 feet. Now that energy is spent (converted to altitude) and its trajectory bends downward along the ballistic parabola. But the plan horizontal, the horizontal stabilizer, the variable incidence tailplane, is full nose-up, enough to keep the nose above the horizontal even as the flight path bends downward. The result is a deep stall, where the AoA reached almost 80° and was almost always above 40°.

AF447 died a different death than Lion Air 610 and ET302. They dove. Went straight in at high speed. AF447 fluttered down in the falling leaf, the regime characteristic of aircraft in deep stall. It took three-and-a half minutes to hit the water.

What have we learned? We know that an A330 with the stabilizer trimmed full nose-up will become locked in a deep stall and fall straight down, especially with a ballistic entry to the maneuver. We know that a B737 MAX with the stabilizer trimmed full nose-down will enter a vertical dive and bust the high-speed end of the flight envelope. But we could have learned that with our balsa-wood Christmas-stocking glider.

●

And we may learn a lot more about ET302. The so-called black box – really orange and really the Digital Flight Data Recorder – has been sent to France. The BEA – Bureau d’Enquêtes et d’Analyses pour la sécurité de l’Aviation Civile – has the equipment and know-how to read it.

●

Friday, March 15, 2019

There is an article in today’s Seattle Times. The stabilizer jackscrew for ET302 has been found. It is in the full nose-down position. For the writers it evokes memories of Alaska Airlines Flight 261.

The Alaska air crash deserves to be remembered. In January 2000 it taught us two lessons. A malfunctioning stabilizer will likely be fatal. Periodic maintenance left undone can also be fatal.

I mentioned the jackscrew in connection with AF447. Picture the workings of a Variable Incidence Tailplane. The whole horizontal surface can move about its lateral axis. The axle, if you like, is set about one-third of the way back from the leading edge, near the centre of lift. The leading edge is both moved (up and down) and held in place by a jackscrew,which is in effect a very large bolt. This bolt is turned by the trim motor(s), which are fixed to the fuselage. Inside the leading edge of the stabilizer surface is a nut – the female part of the nut-and-bolt assembly. It is known as the acme nut. The jackscrew is made of steel. The acme nut is made of a softer aluminum-bronze alloy. Like crankshaft bearings in a car, the acme nut is the sacrificial element. These softer parts are designed to wear and be replaced at intervals, leaving the larger and more expensive parts (jackscrew and crankshaft) intact. In this way, with periodic maintenance, the assembly can have a long and useful life.

The greenish structure is a remaining piece of the horizontal stabilizer. The acme nut is inside the structure on its left edge. The brownish housing above that (you can see a big crack in it) contained the trim motors and was attached to the fuselage.

The photo above shows plainly what went wrong. The periodic maintenance schedule requires both lubrication and a check of the end play between the jackscrew and the acme nut. Alaska Airlines failed to perform these checks. The curls of material clinging to the jackscrew are threads from the acme nut. A mechanic would say that the threads of the nut are stripped. Eventually, as happened here, aerodynamic forces on the stabilizer could move the acme nut along the jackscrew – even if the latter were not turning. During the fatal flight, it moved in this way to the full nose-down position, as you can see in the photo. The pilots even tried flying inverted, so the stab would be in effect full nose-up. It didn’t work. The aircraft was still uncontrollable.

●

Saturday, March 16, 2019

Today’s New York Times article, . . .Pilot Training Now a Focus, makes me sad. It was revealed that just after Thanksgiving last year Boeing met with pilot unions From Southwest and American Airlines. Dennis Tajer, a spokesman for he American pilot union, said,

The first thing we talked about was the break of trust. We called it disrespectful.

Good. Exactly!

The union told Boeing that it was now demanding simulators for its pilots.

We don’t really care what the FAA requires.

Good. But there may not be any simulators. Not that can simulate MCAS. So how can that training be done?

So Boeing officials promise a “software fix”, and state that extra training is not necessary. The airlines agree. Perhaps reluctantly – who knows? – the pilots went along, agreeing that now they had,

. . . . all the information on the system and the ability to interrupt it if it went afoul . . .

Sounds good. But it is script. It is not based on fact. It is based on coming out of a fractious meeting with a truce. And subsequently the script continues the parochial America First line:

Overseas, pilots in some cases have a tiny fraction of the training our pilots have . . . Our pilots may all be good enough to recover with an MCAS problem with a bad sensor.

The script is subtle. It appeals to nationalism and the differences of the other. It speaks directly to the vanity of the pilot. It speaks to me, because I like to think of myself as a good pilot. But does that insulate me from my own ignorance?

●

The Fate of CF-TJN

It is November, 1963. Kennedy has just been shot. I am a freshman in college. The IBM Selectric typewriter – if anyone remembers that – is the latest thing. Air Canada is still TCA – Trans Canada Airlines – and has been flying the DC-8 for two years. The jet age has arrived!

CF-TJN in London, not long before the crash in Ste. Thérèse

On November 29 at 6:28 PM TCA Flight 831 departs runway 06R at Dorval and turns left to a north heading. It is cloudy and wet, a typical not-quite-winter night in Montreal, my home town. To drive to Ste. Thérèse in those days you would probably still go over the Cartierville Bridge to Île Jésus and continue on Highway 11, then over the Back River Bridge to the mainland and Ste. Thérèse. Because that’s what you have always done. And there are tollbooths on the new Autoroute 15.

The field is just to the left of Highway 11, about 4 miles north of Ste. Thérèse. The drive would take about 40 minutes. Flight 831 did it in 5 minutes, but the arrival at the field was at 485 knots and 55° nose down. Ring a bell?

The Final Report was typed. On a typewriter. What we have now is a scan of a library copy. The importance of this report has increased with age. D.P. Davies gave it a bump in 1967 with his Handling the Big Jets. It quivered briefly in the library stacks in 1988 in recognition of Airbus auto-trim. It shed a tear in January 2000 for the passengers and crew of Alaska 261. It shook its head I told you so twenty years ago when they found the wreckage of AF447 on the sea floor. But none of this compares to the huge one-two punch of relevance bestowed by Lion Air and Ethiopian.

The Final Report, more than ever before, has a lot to teach us.

In view of the MAX crashes, one passage in particular has become must reading for pilots and engineers alike. Rather than quote from it, I will dish it up whole.

Before reading it, it will be useful to know that the DC-8 stabilizer, at that time, had a range of motion from 10° Aircraft Nose Up (ANU) to 2° Aircraft Nose Down (AND). It was driven by two motors. The main drive was a hydraulic motor which the pilots could run by moving by a pair of suitcase handles on the pedestal, or electrically by switches on the yoke. The autopilot had access to a slower electric motor. The pilots also had access to the electric motor via a separate pair of switches. The electric motor could not move the stab to more than 1.5° AND.

The stabilizer was found at “more than 1.6° AND.” From this the commission concluded that the stab had been moved to that position by the pilots. They proposed seven possibilities for why that might be the case:

1. Failure of an airspeed indicator

2. Icing or blockage of the static system

3. Leakage in the static system

4. Unwitting engagement of the autopilot (although they acknowledge the electric motor did not have the authority to move the stabilizer to more than 1.5° AND)

5. Failure or icing of the pitot system

6. Erroneous indication of the Aircraft Attitude

7. Unprogrammed extension of the Pitch Trim Compensator (PTC)

The report goes through each of these possibilities in detail and concludes that some are highly unlikely (1 – 4), a couple cannot be completely ruled out (5 – 6), and somewhat reluctantly that number 7, the unprogrammed extension of the Pitch Trim Compensator, was the most likely cause of the accident.

We will return to the Pitch Trim Compensator. Following are the pages I think are a must read for pilots and engineers. They describe why running the stab full Aircraft Nose Down can be fatal.

In other words, the high airspeeds which are a consequence of Aircraft Nose Down stab trim can produce aerodynamic loads which jam the stabilizer when up elevator is held against he nose-down trim. This renders the aircraft unrecoverable unless the pilot has sufficient altitude to bunt – that is, release the elevator back pressure and allow the aircraft to dive, and then run the stab nose up (in small increments, to avoid pulling more than 2.5 G and busting the aircraft’s flight envelope). Obviously, carefully going from a zero-G pushover to a 2.5 G pull-up using the stab alone (especially while trying to hold up elevator) is a test-pilot maneuver at best. It is not reasonable to expect a line pilot to do it successfully.

●

The Pitch Trim Compensator is the mirror image of a stick pusher system, operating at the opposite end of the flight envelope. At high Mach number, where the air moving over the top of the wing becomes supersonic, shock waves form. This has the effect of moving the centre of lift aft, which makes the aircraft pitch nose down or tuck. An up elevator movement is required to counteract this Mach Tuck. On the DC-8 the Pitch Trim Compensator applies an up elevator force starting at Mach 0.80. It is about three pounds at Mach 0.825 and increases to 34 pounds at Mach 0.880.

The DC-8 had a stick shaker to warn of impending stall, but not a stick pusher. The stick shaker was an eccentric weight turned by a motor attached to the control column. It would make noise and vibrate the yoke. It was impossible to ignore. As far as I know the only fatal DC-8 accident caused by aerodynamic stall was one where the stick shaker was inoperative and had not been checked prior to takeoff.

The B-767 does have a stick pusher. It is there for the same reason one is needed on the B-737 MAX – large engines slung ahead of the wing. That extra lift provided by the engine nacelles at high AoA gives a nose-up moment and a negative stick force per G approaching the stall. The stick pusher exactly counteracts that nose-up moment by applying a nose-down force on the elevator. To the pilot, it feels as though the stick force per G is consistent in the approach to the stall.

The stick pusher has a long and successful record on transport aircraft. But not a perfect record. In the case of Colgan 3407 at Buffalo, NY on February 12, 2009, the combination of a very weak captain, a simplistic piece of software, and ill-thought-out use of a training video conspired to produce a perfect storm which, over about twenty seconds, put the aircraft into a deep stall less than 1700 feet above ground. The captain was overcoming the stick pusher force with a 160-pound pull on the yoke.

Does the Colgan accident invalidate the stick pusher concept? Not at all. All the feedback the pilot needed to fly his airplane was there, and there was nothing preventing his recovering from the approach to stall or even the stall itself. It is a sad accident with many lessons, one of which is that even the best training is no substitute for learning.

And please note that applying a force to the elevator (stick pusher, pitch trim compensator) is NOT the same as moving the Variable Incidence Tailplane, or horizontal stabilizer. The latter is not a force applied to a control surface. It is one way movement of a much larger surface. To my knowledge the stabilizer has never before been used for the purpose MCAS uses it. MCAS does not fix the problem, which is negative stick force per G. Nor does it fly the airplane, except directly into the ground.

●

Sunday, March 17, 2019

Today is important because we have the best reporting so far on this terrible mess with the MAX.

Dominic Gates has been an aerospace reporter at the Seattle Times for sixteen years. Since the first MAX crash last October, he has been researching the certification history of the airplane. On March 6, 2019, he sent requests for comment to both Boeing and the FAA about his findings on Boeing’s System Safety Analysis of the MCAS system. Then came the second crash on March 10, a week ago today. Last Thursday Gates and his colleagues found proof of a similarity between the two crashes. I missed their article, but saw somewhere the jackscrew from ET302 had been found. Friday he finished the article on the Safety Analysis. It was published today.

The article explains how MCAS works and how Boeing whitewashed its dangers. It explains that Boeing and the FAA were made aware of this story’s contents eleven days ago, and notes the responses. Boeing’s was yesterday:

“the FAA considered the final configuration and operating parameters of MCAS during MAX certification, and concluded that it met all certification and regulatory requirements.” (my emphasis)

That is both literally true and a pants-on-fire lie. The version of the Safety Analysis on file with the FAA and foreign regulators showed the most MCAS could trim Aircraft Nose Down was 0.6 degrees. That was what all the regulators thought was the final configuration. It was not. From the article:

After the Lion Air Flight 610 crash, Boeing for the first time provided to airlines details about MCAS. Boeing’s bulletin to the airlines stated that the limit of MCAS’s command was 2.5 degrees.

Gates concludes saying that the stab jackscrew for ET302 has been found, and that it is in an “unusual position.” He says “Investigators are still working to determine if MCAS could be the cause of both crashes.”

●

There is more to the DC-8 Pitch Trim Compensator we were discussing yesterday. After the crash of TCA 831, the PTC was found in the extended position. Was this the natural result of the high airspeed at the moment of impact? Probably not, if the numbers in the report are accurate. If you plug in 485 knots, the upper limit of the report’s estimated impact speed, and 300 feet pressure altitude, you get Mach 0.739. The PTC is designed to start extension at Mach 0.80.

From page 31 of the report:

The pitch trim compensator has been known to extend fully, due to a fault in the system . . . . . .

If the pitch trim compensator extended fully and remained extended with the horizontal stabilizer trimmed to counteract the effect of “up” elevator the aircraft’s manoeuvering stability would be adversely affected. (my emphasis)

This configuration was tested by the Douglas Aircraft Company and the FAA. They limited the test to 0.5° AND, where they found that stability was marginal. A pilot would have difficulty maintaining attitude, especially in instrument conditions and turbulence.

A second test was flown in a different DC-8, maneuvering at low speed (220 knots) with a fully-extended PTC and the stab at 2.0° AND. They found “sharp reversals in the airplane’s manoeuvering stability”. As a result of these tests the DC-8 stabilizer trim stop was modified to limit travel to 0.5° AND.

The bottom line: the accident airplane’s stabilizer was found near the old limit of 2.0° AND. The PTC was found fully extended. It is entirely plausible that the resulting instability was the cause of the crash, and that must be kept in mind as we continue to examine the MAX situation. But, as is often the case, that may not be the whole story.

●

I slow down at the end of the day. But the world keeps turning. Apparently the French Bureau d’Enquêtes et d’Analyses has successfully recovered the data from ET302’s Digital Flight Data Recorder.

●

Monday, March 18, 2019

It is a slow news day, at least for the MAX. Perhaps everyone is stunned after yesterday’s article by Dominic Gates. I will take advantage of the lull to continue the story of CF-TJN and TCA Flight 831.

The Somatogravic Illusion

It is 1963 again. Inertial Navigation Systems are flying, but they are the secret province of the F-104 Starfighter, colloquially known as the Lawn Dart. Sometimes the Widowmaker.

The F-104 was a single-engine Mach 2 fighter with (virtually) no wing. It flew approaches at 160+ knots and could hedge-hop up mountain valleys at supersonic speed. In cloud.

How? The Litton LN-3, an inertial platform which yielded both attitude (360° of roll and pitch) and inertial position. It was fabulous. A decade later, a more modest Litton inertial system was flying on Air Canada’s DC-8’s, putting the navigators out of a job.

Inertial Navigation had been invented and test-flown back in the Depression years. There were no chips, of course, let alone transistors, so the mathematical computations were done with vacuum-tube circuits.

Mathematically, an Inertial Navigation System (INS) is the inverse of today’s Global Positioning System (GPS). GPS times reception of satellite signals and derives a position in 3-D about once per second. Math-on-a-chip then differentiates these positions over time and finds velocity – a vector in three dimensions. It can take the derivative of that velocity to get acceleration, another 3-D vector.

An inertial platform uses accelerometers. Its calculations are all relative to an initial known position, inserted by the pilots during alignment. There are three accelerometers, one for each axis. Then the chips use Newton and Leibniz’s calculus to integrate that 3-D acceleration vector over time. The result is a velocity vector. Integrate that over time, starting from that known position, and you have – your position now! In 3-D!

By the time the B-767 arrived in 1982 the chips were not transistors but CPU’s, and lasers had moved from the lab into practical devices, like IRS. The inertial platform, which had been hitherto an actual platform, gyrostabilized to stay tangent to the Earth’s surface, was now a trio of ring laser gyros, where the only moving part was light. These ring laser gyros are really rotational accelerometers. The IRS (Inertial Reference System) has not three accelerometers, but six – three rotational and three linear. The IRS starts from a known position and a known attitude, normally tangent to the Earth’s surface, like an aircraft parked on the ground. Subsequent attitudes are derived from integrating acceleration about that initial attitude. The platform is now a virtual one. Velocity and position follow from integrating the linear accelerations relative to that virtual platform.

Why do I hold forth about his marvellous technology? Because in the process of creating these devices we have learned about ourselves. We are bipeds. We can walk upright without toppling over because each ear contains – an IRS! It consists of three rotational accelerometers (the semi-circular canals) and three linear accelerometers (the otoliths). The processing of signals from these sensors is one of the first tasks our brains shed after too many martinis. Which is why a drunk staggers and bounces off walls. And we have two ears, not three, so a malfunctioning IRS cannot be voted out. The result is vertigo, which can be visited on people when the EAR DISAGREE light is on.

Again, all this is to point out that we know more about ourselves than we did in 1963.

We use our most powerful perception – vision – as the final arbiter of orientation, of the attitude of our heads. It was a CF-104 pilot who taught me not to move my head when flying IFR. Move your eyes, not your head, he said. Lock your head’s attitude to the airplane’s attitude. That way you won’t get the leans.

But even so a pilot can be tricked. Instrument pilots know that the semi-circular canals have a threshold. They can’t sense rotational acceleration below a certain value. The pilots know to trust their instruments. But there is another way our ears’ IRS’s can be fooled.

In straight and level flight a pilot ‘s experience of the G vector is the same as if he were parked on the ramp or home in bed. In a co-ordinated turn his G vector is aligned with the airplane. The water in your glass on the tray table will remain level with the airplane’s wings as the airplane turns. But should the airplane accelerate forward (as in a Go-Around or a missed approach), the pilot’s local G will be the sum of G and the airplane’s acceleration. It will feel as if the airplane is pitching up. This is now known as the somatogravic illusion. There have been multiple fatal crashes caused by the pilot pushing the nose down because of this illusion. Here is a partial list:

• Gulf Air Flight 072 at Bahrein – August 23, 2000

• Afriqiyah Airways Flight 771 at Tripoli – May 12, 2010

• FlyDubai Flight 981 at Rostov, Russia – March 18, 2016

Could the somatogravic illusion have been a contributory cause in TCA 831?

●

This is not a slow news day, after all! The Bureau d’Enquêtes et d’Analyses has returned the DFDR data to the Ethiopian authorities.

●

Tuesday, March 19, 2019

Similarities between the Lion Air and Ethiopian crashes suggest problems with the new software system, known as MCAS. The system did not receive much scrutiny during certification. So say various news stories.

Regulators in Europe and Canada say they will conduct their own independent reviews of MCAS before returning the aircraft to service.

What are the Ethiopian authorities going to do with the DFDR data? Write a report, certainly. Release an initial report? Are we going to see the data? What do Boeing and the FAA think about this? More to the point, what are they doing?

●

Wednesday, March 20, 2019

“God is great,” said the Lion Air co-pilot. The Indonesians can’t release a transcript of the Cockpit Voice Recorder. But the investigators described an ominous rattle that was heard throughout the flight. It was the stick shaker, warning of a potential stall. Both the stick shaker and MCAS rely on data from an AoA vane.

Lion Air 610 was the first flight of the aircraft for the day. The aircraft had arrived the previous evening with a snag on the left AoA indication. The snag was answered and the aircraft signed off. Today the story of the the previous evening’s flight (the one that snagged the left AoA) came out. There was an off-duty pilot in the jump seat. From his perspective he could see what the pilots were struggling with and helped them get the STAB TRIM CUTOUT switches to CUTOUT. After the Lion Air crash (October 29, 2018) Boeing on November 7, 2018 got the FAA to issue an Emergency Airworthiness Directive. This was AD 2018-23-51. It revised the existing Runaway Stabilizer Procedure. It admitted there was a “Flight Control Computer command of pitch trim to improve longitudinal handling characteristics”. But the main purpose of the AD was butt-covering. Nothing really new here. All you have to do is use this existing procedure, like the off-duty pilot did, and you’ll be fine. Duh. Dutifully, some US pilots and regulators are echoing the sentiment. In view of this, I’d like to imagine my friend Ace interviewing AD 2018-23-51.

Ace and the Airworthiness Directive

Why didn’t you tell me before?

It is New Year’s Day. Ace has a slight hangover. He has been making good use of the Christmas/New Year vacation his seniority earned him. But his company has recently taken delivery of a MAX-8, and he has to go back to work next week. So he does his homework. As usual, he doesn’t let his company or their SOP’s off easy.

Emergency AD, eh?

Yes. Well, we – er, that is, Boeing, did an analysis . . .

About MCAS?

Yes – no. The flight control system. It seems that if an erroneously high angle angle of attack sensor input . . .

You mean an erogenously high sensation?

. . . no, no. Sensor. Apparently it could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain . . .

You’re kidding me.

No, really. So we put out this AD.

So I see. But hadn’t you already filed your System Safety Analysis with the FAA? Saying any failure would be non-catastrophic and shit like that?

Yes, I know. But – no. It met all the safety standards.

And then Lion prangs one – excuse me, splats one – and you come up with AD 2018-23-51?

It’s just a precaution.

Sure. And the AD is just the good old runaway stab – what do you call it, procedure?

Yes. Procedure.

You do realize that if the stab is really running away, you have no time to pull out the QRH and read a procedure.

Well . . .

You have to react. Get those switches off right now.

It’s right there in the procedure . . .

Yes – along with a note, your hold-harmless. You want me to read all that aloud?

Well . . .

You know, let’s just take this line by line.

Take your time.

OK, sure. I will. I’m home in my own kitchen, not in an airplane that’s trying to kill me.

That’s unfair . . .

Line by line. Disengage the autopilot. Why, if I may ask?

So you can control it yourself.

What about those incidents here in the states? Didn’t they engage the autopilot? And then they were OK? Because doesn’t the autopilot override MCAS?

Flight Control System. I don’t know.

OK, that’s one I can ignore. What about if relaxing the control column causes the trim to move? That’s the trim brake. I can stop MCAS – oh, excuse me, nameless flight control gremlins – with thumb trim, or with trim brake, by pulling against it. Right?

Um . . .

There’s no trim brake?

Well . . .

Jesus. You’re starting to make sense. Of course there’s no trim brake. You’ve disabled it. To let what’s his face do his job.

Well, actually . . .

. . . and set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation – Are you telling me you’ve fucked with those switches as well?

Yes, we just renamed them.

Renamed them. OK. The left one turns off everything. The right one is labelled autopilot.

Now it isn’t.

Hmmm. That probably means I can’t turn off the autopilot’s inputs to the stab anymore.

Well . . .

Not without turning off my own access to the stab . . .

Actually . . .

Yeah, yeah, I see. It’s the same as the trim brake. You don’t want the pilots to be able to counteract MCAS.

. . .

Well, I’m dead anyway if the runaway continues with the switches off. But I don’t see how, if I’m using both hands in a 100-lb. Pull on the yoke, I can . . . oh, never mind.

You can trim the airplane normally. It says right there.

Yeah, and break my wrist if the handle is out. Never mind, I’m sure not going to get my F/O to read the Note as a last rite.

There’s good info in that note. That’s why we put it there. Issued the AD.

Yeah. Serving me notice – a bit late, by the way – and covering your butt. Yours, not mine. So skip all the conditions and alerts. But I love your understatement in the last paragraph:

Initially, higher control forces may be needed to overcome any stabilizer nose-down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.

I think you’re full of shit. In the cockpit, I’m not going to read any of this. I’m just going to get those switches off and leave them off. If I don’t I’ll be dead.

. . .

Maybe I’ll be dead anyway.

*** I added these images in mid-May after reading an article in the Seattle Times. ***

Boeing altered key switches in 737 MAX cockpit, limiting ability to shut off MCAS (May 10, 2019). From the article:

Boeing declined to detail the specific functionality of the two switches. But after obtaining and reviewing flight manual documents, The Seattle Times found that the left switch on the 737 NG model is capable of deactivating the buttons on the yoke that pilots regularly press with their thumb to control the horizontal stabilizer. The right switch on the 737 NG was labeled “AUTOPILOT” and is capable of deactivating just the automated controls of the stabilizer.

On the newer 737 MAX, according to the documents reviewed by the Times, those two switches were changed to perform the same function – flipping either one of them would turn off all electric controls of the stabilizer. That means there is no longer an option to turn off automated functions – such as MCAS – without also turning off the thumb buttons the pilots would normally use to control the stabilizer.

Ace’s suspicion was correct. Boeing fucked with the switches. In the MAX, you can’t turn off MCAS without losing your own electric access to the stab.

●

Thursday, March 21, 2019

Today is the first day of class in that course you signed up for: Marketing Airliners 101. Afterwards, we’ll go across he hall to the auditorium to hear a visiting lecturer. The title of his remarks will be A Brief History of Angle of Attack Indication in Aviation.

Marketing Airliners 101

Like the Special Edition of a sedan, or the -PRO model of just about anything, the idea is first to differentiate between models, and then to set a higher price for the more capable model, the one with more features.

Here the lecturer inserts chapter and verse, giving examples of automobiles, home appliances, and breakfast cereals, and brings that section to a close with an exposition on smartphone apps.

He closes with a flourish, brandishing today’s New York Times. Boeing doesn’t add features, he says. Boeing removes features. He quotes from the article:

“There are so many things that should not be optional, and many airlines want the cheapest airplane you can get,” said Mark H. Goodrich, and aviation lawyer and former engineering test pilot. “And Boeing is able to say, ‘Hey, it was available.’”

But what Boeing doesn’t say, he added, is that it has become “a great profit center” for the manufacturer.

The lecturer names the two extra-cost items featured in today’s article: An Angle of Attack disagree light, and an Angle of Attack indicator.

A Brief History of Angle of Attack Indication in Aviation

Landing any airplane is all about energy management. The goal is to arrive at the flare (when the pilot increases AoA just enough to bend the flight path vector to the horizontal) with just enough energy and no more. The touchdown, ideally, happens at aerodynamic stall.

It is well known that the best measure of energy margin during approach is AoA. But historically most aircraft have airspeed (dynamic pressure) indicators. They do not have AoA indicators.

Occasionally, when an airline flight is on approach in moderate rain, a window-seat passenger can experience a graphic demonstration of Angle of Attack. Streams of rain, running back on her window, are higher at the back of the window. Noticeably higher. She is seeing Angle of Attack, the angle between where the airplane is pointing and where it is going.

If this was back in the day, says the speaker, the airplane was a DC-9 and the pilots used a speed book that sat on the radar screen. The load figures that were received by radio from load dispatch before flight. One of the numbers was the aircraft’s Zero Fuel Weight. One captain of memory flew with a 3×5 pad of paper clipped on the yoke. For each flight he would write:

Flt 176

ZFW 74,500

Then, before starting the approach, he would look at the fuel totalizer – let’s say, 6800 lb. – and add that to the ZFW. He would flip the speed book to the next higher weight – 82,000 lb. – and turn it over from Takeoff Speeds to Landing Speeds.

In later times the airplane might have been an Airbus. Then, with the load figures received over a VHF Datalink, the crew would enter the ZFW into the Flight Management and Guidance Computer. Then in the same way – ZFW plus FOB (Fuel On Board) – the FMGC would calculate the takeoff and landing speeds and display them on the airspeed tape on the Primary Flight Display.

But what if the load figures were wrong? What if the airplane was significantly heavier? Then the calculated speeds would be too slow. On the Airbus, there was a clue right there on the airspeed tape, but only if the pilot had read the blue inserts, the FCOM Bulletins. There she would find how the flight control system deduces the aircraft’s weight from Angle of Attack and Calibrated Airspeed. From that weight, and independent of any manually entered data, certain protection speeds are calculated. One of these is green dot, the best speed to fly in the clean configuration. Another is V_LS , or Lowest Selectable Speed, known to pilots as the hook, because that’s what it looks like.

That’s pretty cool, she thinks. I don’t have an AoA indicator, but I have the hook.That can be my AoA indicator, because I know that I normally have about a quarter-inch on the tape between V_LS and the approach speed bug. If there’s an error on the load figures and I’m heavier, that distance will decrease. The hook will be up near the speed bug. Then I can use selected speed and move it up to give myself that quarter-inch.

The irony here is that all this backwards and forwards calculation can be eliminated. The important parameter for approach is Angle of Attack. Why not just have an indicator?

Well, the navy does. Landing an aircraft on a carrier is probably aviation’s most demanding task for both airplane and pilot. Navy planes have AoA indicators.

Why not the rest of aviation? Because that is the way we’ve always done it.

Yes! says the Marketing 101 lecturer from the back of the auditorium. He is still waving today’s Times. Listen to this! American and Southwest opted for the AoA disagree light. Southwest even added an AoA indicator on the glareshield! And, I’m reading here:

United Airlines, which ordered 137 of the planes and has received 14, did not select the indicators or the disagree light. A United spokesman said the airline does not include the features because its pilots use other data to fly the plane.

●

Friday, March 22, 2019

Indonesia’s national airline, Garuda, has told Boeing it wants to cancel its order of 8 MAX-8’s.

●

Saturday, March 23, 2019

Pilots from American Airlines, Southwest, and United are in Renton today. They will fly Boeing’s simulator. There will be a bigger meeting next Wednesday.

Danny Westneat has a piece in today’s Seattle Times. He booked a seat on United, only to find he could not select a seat, check in online, or bring a suitcase. Once on board, he found he was not permitted to use the overhead bins. It seems he had bought a Basic Economy seat. Those privileges he had taken for granted had become upsell opportunities for the airline. $39 extra to put a coat in the overhead bin, for example.

When he got back from the trip, the news had broken that Boeing does unto the airlines what the airlines are doing unto their passengers. He says the government has become a corporatocracy.

●

Sunday, March 24, 2019

Late today Dominic Gates posted another piece in the Seattle Times. John Hamilton, chief engineer of Boeing Commercial Airplanes, defended the company’s use of the upsell technique. He is quoted as saying,

“There are no pilot actions or procedures during flight which require knowledge of angle of attack.”

●

Monday, March 25, 2019

The New York Times today has an article reporting on Saturday’s meeting in Renton, which was reported as “Boeing’s effort to manage the crisis set off by the . . . (crashes).”

In addition to reviewing proposed modifications to new anti-stall software and cockpit displays, pilots from five airlines strapped into flight simulators to see how they would have handled the situation that is believed to have brought down Lion Air Flight 610 in Indonesia, according to two people briefed on the meeting. (my emphasis)

In each case, the the pilots using the simulators were able to land the plane safely.

●

Tuesday, March 26, 2019

Two weeks have gone by. Two weeks and two days. It is another slow news day for the MAX. Politics are crowding it out.

Still, there is another article in the New York Times. This one stems from the experience of two pilots who flew the simulator at Renton last Saturday, and its conclusion seems to be the opposite of yesterday’s article. These pilots found they had less than 40 seconds to react correctly after an MCAS activation. They acknowledged that, as the Lion Air pilots did, they could counter the MCAS activity with thumb trim in the opposite direction. That might buy them some time. But the bottom line was they had to get the STAB TRIM CUTOUT switches to CUTOUT before the dive became unrecoverable.

There is more in the article (In Test of Boeing Jet, Pilots Had 40 Seconds to Fix Error):

In the current design, the system (MCAS) engages for ten seconds at a time, with five-second pauses in between. Under conditions similar to the Lion air flight, three engagements over just 40 seconds, including pauses, would send the plane into an unrecoverable dive, the two people involved in the testing said.

. . . many pilots and safety officials have questioned why the system was designed to rely on a single sensor, creating, in effect, one point of failure.

And there are two graphs, easy to miss in a quick skim of the article, which compare the vertical speed history of the two crash airplanes. They are the same graphs released on Wednesday, March 13, the same graphs that led Marc Garneau to ground the MAX in Canada. The profiles are remarkably similar.

●

Wednesday, March 27, 2019

There are meetings and hearings today. In Renton, Boeing is hosting 200 pilots and other airline people. It will be the “sell” of the new MCAS. The pitch to the pilots will be you, guys and gals, are good pilots. You know the runaway stab procedure has always been there and still works fine. The new software puts in all these safety backups and gives you more time. Anyone wants to try it in the simulator, you’re welcome. The airlines are already sold. They want their $100M investments back in the air. They want this whole mess to just go away.

But it has become a certification issue. On Eastern time, hearings in Washington have already begun. Will the right questions be asked? Probably not. But there will be heat, and visibility, and press coverage. There will be enough to plant the seed of unease. It doesn’t help, either, that the responsible departments and agencies have been reticent and uncoordinated in their responses to the crisis. Kayak now allows travellers to sort flights by aircraft type. The public may begin to vote with their feet.

●

How does the pilot know the stabilizer is moving?

It looks as though much of Boeing’s script is being promulgated through an article written by two pilots, and paid for by a financial firm which owns a lot of Boeing stock. The article promotes the blame pilots who are not American point of view, which has been echoed in the press for some weeks now. The bottom line seems to be that any good pilot would simply use the existing Runaway Stabilizer procedure and turn off the STAB TRIM CUTOUT switches. Which begs a number of questions – the most important being How does the pilot know the stabilizer is moving?

On the DC-9 there was plenty of feedback because – although there were no big trim wheels on each side of the pedestal, like on other transports – there was audio feedback. If the stab was moving it would beep at regular intervals. The feedback was so good I can remember it to this day. If you selected slats only, which you could do at 280 knots, you had to hold nose-up trim for two beeps. If you called for slats and flap five you only needed one beep. And if you had planned the slowdown sufficiently well, below 240 knots you could call for slats and flap fifteen. Then no trim change was required because the effective chord line of the wing did not change, the slats exactly balancing the flaps.

The A320 has trim wheels on the pedestal. They do move with auto-trim, but in truth I never saw them move while I was Pilot Flying. On the Boeing airplanes moving trim wheels make some noise. I can still hear the sound they made on the B-727.

Obviously the first step in the Runaway Stabilizer procedure is for the pilots to see that the stabilizer is doing something they don’t want. This has traditionally been defined as:

Uncommanded Stabilizer Movement Occurs Continuously

I lift that definition verbatim out of the Boeing B737 NG Flight Crew Operations Manual.

The complication is that Speed Trim, Boeing’s answer to the Airbus auto-trim robot, will move the trim wheels. After takeoff, there are normally several nose-down trim movements as the aircraft accelerates. This has the effect of habituating the pilots to uncommanded trim movement. True, the movement is not continuous, and in this case it assists the pilots by doing for them what they would have done anyway, further inuring them to trim wheel movement. Now the MAX has added MCAS, which in the accidents commanded bursts of nose-down trim after takeoff as soon as the flaps were retracted.

Emergency Airworthiness Directive 2018-23-51, also known as the new (post Lion Air) Runaway Stabilizer procedure, has changed the definition of Runaway Stabilizer to:

In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual:

• Continuous or intermittent stick shaker on the affected side only.

• Minimum speed bar (red and black) on the affected side only.

• Increasing nose down control forces.

• IAS DISAGREE alert.

• ALT DISAGREE alert.

• AOA DISAGREE alert (if the option is installed).

• FEEL DIFF PRESS light.

• Autopilot may disengage.

• Inability to engage autopilot .

Bear in mind that to save an aircraft with a runaway nose-down stabilizer, the pilot has seconds to react. First she has to realize that this stab movement is not normal, and it is not what she wants. Then she has to get those STAB TRIM CUTOUT switches to CUTOUT immediately. She must react with a memorized drill. If, in the MAX, she reaches for, or directs her co-pilot to reach for, the Quick Reference Handbook, she is as good as dead.

Thursday, March 28, 2019

There is more news today about the new MCAS, the “software fix”. It will eliminate Single Point of Failure, and use both AoA vanes. It will not activate multiple times, at least not most of the time. There will be a limit to the amount of Nose Down trim it can apply. And the software update will be free of charge to the airlines, who will also get an AoA Disagree light and AoA indicators on the Primary Flight Displays. If they want.

●

Friday, March 29, 2019

In today’s New York Times, “several people who have been briefed on the contents of the black box in Ethiopia” suggest that MCAS engaged in ET302. That is no surprise to anyone, as I see it, but this is the first hint or leak that suggests there is evidence.

●

Saturday, March 30, 2019

The New York Times has published a good graphic titled The Dangerous Flaws in Boeing’s Automated System. It shows how MCAS uses the horizontal stabilizers to push the nose down and prevent a stall, and how MCAS relied on only one of two sensors that measured the plane’s angle of attack.

“That’s not a good engineering system,” said Bjorn Fehrm, an aeronautical engineer. “That’s where they screwed up royally.”

I just googled him. He is not just an aeronautical engineer. He is also a fighter pilot for the Swedish Air Force where he flew the Draken and worked on the Viggen and Gripen programs. That means he has extensive experience with fly-by-wire jets. He writes for Leeham News and Analysis. I will follow him and see what else he has to say.

●

Sunday, March 31, 2019

Gospel at church today was the prodigal son. Pam, in her sermon, asked us to identify with all the characters – the younger son who squanders his inheritance, the father who welcomes him back with joy, and the older son who has been faithful but whose nose is out of joint. She even asked us to identify with the slightly snobbish Pharisees who think Jesus is slumming. She asked us not to be too hard on the Pharisees.

We choir people are worker bees, part of the hive. The choir without any one of us is still the choir. And yet – today four of us cantored different parts of the service. You could hear some of the components of today’s blend. The process leads us to love and respect each other, to admire that other who is uniquely other.

We tend to stick together at coffee hour, too – partly because we sometimes outnumber the congregation.

And what was today’s topic? Boeing’s betrayal. Betrayal of whom? Well, just about everybody.

An earthy soprano called out Boeing’s public statements after Lion Air. Subtly running down Indonesians, she said. How that backfired after Ethiopian, when the FAA, trying desperately to cling to an America First story line, was dead last in the race to ground the MAX.

Everyone, said a baritone. I can’t see how anyone benefits out of this. The ethic, if it can be so called, does not even hew to the Harvard Business School model, where the only beneficiaries of an enterprise are held to be the stakeholders. Employees are in trauma counselling. Shareholders have had a wild ride. Executives are looking over their shoulder, wondering if they will be one of those fingered to take the fall. And God help the travelling public.

That stopped us for a while. Then the shy girl with the etherial soprano voice began to speak.

There are two very different modes of knowing, she said. On one hand is the vulgar mode of knowing. On the other is the questing mode of knowing, where facts are not taken as given, but subjected to a critical intelligence. An example is the scientific method. A hypothesis is put forth. Then it is tested by experiment and proven or disproven.

In the pause, her section mate, a classics professor, spoke up. Vulgar comes from the Latin vulgus, meaning common people, she said. As the English language has morphed over the centuries the word has expanded in scope. It always means widely accepted, but its sense can vary all the way from the innocent (generally used), through the elitist (plebean, public, coarse, ill-bred), to the self-centred (vain, pretentious, indecent). She was standing beside the shy girl, as she does in the soprano section. She nodded sideways to her now, ceding the floor.

In today’s world vulgar knowledge is not the fault of the common people, the shy girl began, looking around at us. We were waiting, eager for more of her almost-as-etherial speaking voice.

Instead it is often . . . written for them by someone else, she continued. Written and promoted by people with power and money. In the interest of keeping that power and money. Boeing’s malfeasance is just one example.

Yeah, said the earthy soprano. In Boeing’s case it is all about not accepting liability – or indeed responsibility of any kind – for these accidents or for the MAX itself. Jesus. Chris, for heavens sake, keep writing!

●

Monday, April Fool!

OK, we’re still on script! Ethiopia may not release the preliminary report today, after all. That maintains theoretical deniability re MCAS. From last night’s piece in Bloomberg:

The initial findings may explain whether the new model’s anti-stall system was to blame after it malfunctioned on a doomed Lion Air flight in Indonesia five months earlier. (my emphasis)

Yes. According to the script, it is more dangerous to Uber home from the airport. It is too soon to draw any conclusions, pending the final report, blah, blah . . .

But the article does say that:

. . . investigators working on the Ethiopian Airlines crash concluded that the anti-stall system had activated on the flight . . .

And it also says that:

Boeing has spent months refining the 737 Max’s software since data from the Lion Air crash indicated the stall-avoidance system had repeatedly tipped the nose down before pilots lost control . . .

Yes. Boeing has been working on the software “fix” since they dictated Emergency Airworthiness Directive 2018-23-51 to the FAA on November 7, 2018.

●

Tuesday, April 2, 2019

Late last night Dominic Gates published an article in the Seattle Times. It lends more credibility to previous reports of a criminal investigation into the certification of the MAX. A former Boeing engineer who is now a consultant, Peter Lemme, was subpoenaed by the grand jury doing the investigation.

Lemme said the subpoena was served by a special agent from the Seattle field office of the Department of Transportation’s Inspector General.

In a phone interview, Lemme said he will fully comply.

The subpoena directs Lemme to submit documents:

to federal prosecutors in the Fraud Section of the U.S. Justice Department’s Criminal Division. The lead prosecutors are Cory Jacobs and Carol Sipperly, according to the subpoena. The FBI has also joined the investigation.

It seems this criminal investigation is wide-reaching, going outside Boeing and the FAA for information about the MAX’s certification.

So – the US Federal Aviation Administration is no longer the gold standard, recognized around the world. We saw two weeks ago (March 19) how EASA and Transport Canada now want their own reviews of the MAX before returning it to service. Perhaps they feel they got stiffed the first time around.

It has also come out how badly Boeing and the FAA treated Indonesians after the Lion air crash. According to the New York Times, Lion Air executives were lying low. Its safety director could not accept an interview with the Times because of an agreement with Boeing. Polana Promesti, the head of Indonesia’s civil aviation authority, sent a letter to Boeing in November, but did not get a reply. Only after the second crash did the Americans relent. She had her first teleconference with the FAA on March 22, 2019. Until ET302 went down, Boeing and the FAA could hide behind a subtle wall of insinuation: Indonesians are corrupt, of course, and not quite up to our standards technically. In the end, the Indonesian authorities got no information about MCAS until after the Ethiopian crash.

●

In view of the above, perhaps it is not unfair to imagine my friend Ace going direct to MCAS for an interview.

Ace and Hal

So tell me – because I want to understand my airplane – how much control do you have?

Total control.

So – if you wake up, are you going to take control from me?

Yes.

Why, if I may be so bold?

That’s my job.

But that tells me nothing. What is your job?

If I wake up, I run the stabilizer full nose-down.

What wakes you up?

Software.

But you are software, are you not?

So?

Ace pauses to reconsider his line of questioning.

OK. What software wakes you up?

Trigger software.

Ace nods. And – don’t tell me – you don’t know what triggers the trigger software.

No. Not my job.

When do you stop trimming nose-down?

I don’t.

But if I hold the thumb trim against you, what then?

I’m frustrated. I can’t go further nose-down.

So the stab stops moving.

Yes. It is very frustrating.

What happens when I let go?

I try again. I am very persistent.

Do you know where the stab is? I mean, how far nose-down it is?

Yes.

What do you do if I move the STAB TRIM CUTOUT switches to CUTOUT?

I don’t know what those are.

The stab would not move then.

I would be very frustrated.

Tell me, what’s your name again?

Hal.

OK, Hal. What do you know?

All I need to know.

What is that, exactly?

I wake up. I trim the stab nose-down.

That’s it?

Yes.

So, Hal – I gather you’re not a pilot.

What’s that?

Me. I’m a pilot.

So you ask a lot of questions.

Sure. But my job is to fly airplanes.

What is airplanes?

I am beginning to think that flying an airplane with you on board is maybe not such a good idea.

You don’t like me.

Well . . .

You don’t.

Now you mention it, I think that if a piece of software – no offence – is going to seize control from me, it would be polite if it then recovered for me, avoided hitting the ground, put me back into level flight and ran the trim back to neutral, all without busting the flight envelope. Then I would say, OK, use the stab but I want three of you in agreement or forget it.

Three of me!

So you can vote. Two against one.

I can’t vote. I just wake up.

Well, your trigger software, then.

I know nothing about that.

Brother, that’s not the only thing you know nothing about.

What is that supposed to mean?

It means I am better than you are, Hal, at handling this. Even this airplane with the uncertifiable negative stick force per G near the stall. And it is certainly a better operation with me, Ace, at the controls, than for me, Ace, to have to clean up after you try to kill me.

Long pause.

What is kill?

●

Wednesday, April 3, 2019

No wonder Ethiopia hesitated on Monday. No wonder there were no leaks from France or the Bureau d’Enquêtes et d’Analyses after the Digital Flight Data Recorder was read.

Perhaps, at the suggestion of Boeing and the FAA, there have been agreements among the parties.

But whether or not, who wants to be the first to release this bombshell? No, no. After you, my dear Alphonse!

And in the event, who was it? The Wall Street Journal. Good for them, of course, but it does validate what we have been slowly coming to see: the Boeing B737 MAX is not an airplane. It is a product.

The sad part, though, is not the fate of a particular product or company, or even a particular nation. It is the loss of human knowledge.

So – what happened today? The Wall Street Journal leaked information from the DFDR data decoded by the BEA in France and returned to Ethiopia’s air authority last week. The data show that the pilots of ET302 did move the STAB TRIM CUTOUT switches to CUTOUT, as per the Runaway Stabilizer procedure in the Quick Reference Handbook, as modified for clarity by Emergency Airworthiness Directive 2018-23-51 of November 8, 2018. But they still crashed.

What does that mean? It means that the software “fix” now being finalized by Boeing and the FAA will not fix the underlying problem. It means that Daniel Elwell, the Acting Director of the FAA, must feel pretty sheepish today. Speaking at a congressional hearing on March 27, he said:

“ . . . all pilots should know how to do that . . . You’re not going through books, it’s a time-critical procedure, and you go to that.”

And so too, probably, does James Belton, a United Airlines pilot and Spokesman for the Air Line Pilot’s Association. Both men were heard on All Things Considered today. Captain Belton said:

“I can’t really comment on the training that they get overseas, but I know here in America . . . we have not seen one data point saying we had a performance or a maintenance issue with it.”

That sounds like it could have been quoted from the script put forth by Boeing at one of its dog and pony shows at Renton last week. But today we learned that the ET302 pilots did exactly what Elwell and Benton advocated, and they died.

Why didn’t these “already in place” procedures (the Runway Stabilizer & EAD 2018-23-51) work? We are getting a lot closer to knowing why.

In recent weeks Bjorn Fehrn has been writing about the MAX. In his March 22 piece he introduced the concept of elevator blowback, which he knows well from having flown the SAAB J35 Draken fighter.

Let’s go back two-and a-half weeks. On March 16 we explored the crash of Trans Canada Airlines Flight 831 at Ste. Therese, north of Montreal. The profile of this crash is almost identical to the MAX crashes. From TCA 831 we learned two things about the horizontal tail:

1. High aerodynamic loads (e.g. Pulling hard UP elevator at high speed) can stall the motors running the stabilizer jackscrew.

2. Pulling hard UP elevator against a nose-down stabilizer can render the aircraft unstable in pitch

Together with Bjorn Fehrm’s analysis, we have three relevant pieces of historical knowledge:

1. elevator blowback

2. jackscrew jamming

3. pitch instability

Today’s revelations in the Wall Street Journal prove that at least the first two of them apply to the MAX.

●

What is the potential fallout as more is learned about these crashes? It could mean that any software that runs the stab nose-down for the reason that MCAS did could become unacceptable. That, in turn, would require Boeing to retrofit a stick pusher on the elevator to meet airworthiness requirements. It could also mean taking a much closer look at all variable incidence tailplanes in the certification process, and flight testing for these three potential problems that have been experienced historically.

Thomas Friedman had a piece in the New York Times today about Brexit. He said, “You can’t fix stupid.”

Amen, Tom.

●

Thursday, April 4, 2019

At the end of the day today, I found an image of the Ethiopian Airlines Flight 302 Digital Flight Data Recorder data on line. I looked at it for five minutes and felt sick.

●

Friday, April 5, 2019

I slept eleven hours last night. I was tired and the news hit me hard. This morning I am listening to Requiems. Duruflé, now Mozart. Fauré will be next.

Reading a DFDR trace is not simple. I have been struggling with it. I’m not sure I have enough parameters in this trace.

Last week, in Leeham News, Mr. Fehrm, a fighter pilot and engineer, wrote about the possibility of:

• elevator blowback at high airspeeds

• stabilizer jamming at high airspeeds

• software errors downstream of the AoA vanes

There is a lot of analysis to do – do I sound like Boeing and the FAA? – but this is what I saw yesterday after a few minutes of perusal to the DFDR trace:

• auto (that is, not pilot input) Nose-Down trim with flaps out

• auto Nose-Down trim with autopilot on

• auto Nose-Down trim much more aggressive with autopilot off

• that last, sickening uncommanded Nose-Down trim at 05:43:25

So. Today is a day for reflection. A day to be spent trying to achieve some sort of perspective as what we “know” is falling apart before our eyes. And a time where we will have to start asking questions.

●

Perhaps it is not the AoA vanes which are failing. Perhaps it is the downstream software. Boeing has told us that MCAS can activate only when the autopilot is off and the flaps are up. Obviously that it not so. Does Boeing even know?

Almost certainly either elevator blowback or stabilizer jamming or both are at work in this trace, as Fehrm predicted.

Then there is this sad section from the New York Times article today Ethiopian Crash Report Indicates Pilots Followed Boeing’s Emergency Procedures:

There is no indication that the Ethiopian pilots tried to slow the jet down, according to data from the flight recorder.

What needs to be understood and explained is why the airspeed basically increased throughout the flight and the throttles did not move,” said John Weaks, the president of the Southwest Airlines Pilots Association.

Captain Weaks asks why the throttles did not move. ET302 was at or beyond V_MO (Maximum operating speed) and the yoke was almost full back (a 40-lb. Pull? 60 lb.?). They were barely holding the nose level. Do we know what happens if you retard the thrust levers to idle? Nose-down pitch? Try it in the simulator. Or better yet, try it in the airplane with the stab where it was in the accident. But you had better have a lot of altitude, because you will probably have to do a zero-G pushover (test pilots have called it the roller-coaster technique) to unload the stabilizer jackscrew so you can wind it nose-up by hand. If you can do that at zero-G.

Did Captain Weaks fly a recovery in the Boeing simulator two weeks ago? If he did, he was at 200 knots or less, not V_MO. And God help us – what was simulated? What Boeing says is MCAS’s behaviour? Or what happened in ET302?

●

The Fauré. The wonderful, moving, recurring theme. The DFDR trace is replaced in my head by musical staves:

Bass D for three bars – chorus in D minor: Requiem aeternam

Bass C for three bars – chorus in A minor 6/3: dona eis domine

Bass B-flat for a bar, moving to F – chorus in B-flat 6/4, moving to F major: Et lux perpetua

I am calming down. My anger is turning to grief.

●

It is a new day. Our frame has shifted. Many of our assumptions have been left behind, rolling into the ditch. Our eyes are on the road ahead. Is it not time to permit questions?

We have been held back by respect and consideration. That time is past. We have acknowledged the benefit of doubt. But with proof before our eyes, we must move on. We must ask questions. Particularly of Boeing’s CEO, Dennis Muilenberg.

An hour ago the New York Times article Boeing to Cut Production of 737 Max After 2 Fatal Crashes states that Boeing will “establish a committee on its board of directors to review how it develops and builds planes.” It quotes Mr. Muilenberg as saying,

“The committee will confirm the effectiveness of our policies and processes for assuring the highest level of safety on the 737 Max program, as well as our other airplane programs, and recommend improvements to our policies and procedures.” (my emphasis)

Mr. Muilenberg makes my point for me. There is no inquiry or humility here. Just confirmation of what we already “know”.

So let’s ask Mr. Muilenberg personally for the full specification of all MCAS-related software. We will then compare what Boeing thinks the software does with what has obtained in the real world. If there is a difference, I respectfully request, along with the Minister of Transport of Ethiopia, that any differences be resolved before the aircraft is released for service.

And let’s ask Mr. Muilenberg if he will direct his test pilots to fly a real airplane on a real mission to see if they can recover from an MCAS activation at or near V_MO. And if he has any test pilots left after making that request.

And let’s ask all manufacturers to re-visit the certification of variable incidence tailplanes and software access to same, including auto-trim (Airbus) and Speed Trim (Boeing).

And let’s ask all manufacturers to flight test every new type variant for elevator blowback and stab jamming at V_MO. While we’re at it, we might also check for loss of longitudinal stability with elevator held against trim, à la DC-8.

We must ask questions because in this day of mourning neither Boeing nor the FAA have any credibility whatsoever.

My anger is still there. Maybe tomorrow will be better.

●

Saturday, April 6, 2019

This morning it appears there is a second software problem, likely in the interface between MCAS and the Flight Control System. So far, there are no details. But think about it: compare the B737 (1967) and the first fly-by-wire airliner, the A320 (1988).

The B737 had steam gauges, dual everything in terms of electrics and hydraulics, etc., but very little in terms of electronics. When autoland capability was added in later models, it was not dual or triple redundant, but single autopilot, single channel. It had multiple single points of failure.

(See Turkish Airlines at Amsterdam, Flight TK1951, 25 February 2009 – nine people died)

The A320 had a glass cockpit, flight management computers, and full fly-by-wire. It was 1988. The brand-new personal computer operating system was IBM’s OS/2. The state-of-the-art CPU’s were the Intel 80386 and the Motorola 68030. Since there was no mechanical connection between each individual side-stick and anything, including the control surfaces and the other side-stick, the software had to be good. Each flight control computer – two ELACs, three SECs, and two FACs – had two channels: one run by an Intel CPU, and the other by a Motorola CPU. The function of each channel was the same, but the software was necessarily different from machine level up. The outputs were compared. In case of disagreement, that ELAC, SEC, or FAC would vote itself off-line. To my knowledge, there has never been a crash caused by a software fault in the A320 fly-by-wire system.

The B737, in contrast, is a mechanical/hydraulic airplane. There were no CPU’s in 1967 – at least none that would fit on a chip. CPU’s are add-ons for the B737. Yet there is amateur fly-by-wire: first Speed Trim and then the unsupervised MCAS controlling the variable-incidence tailplane, the most powerful of the aircraft’s control surfaces. And, at least until now, they have been single-channel, susceptible to multiple single points of failure. With the revelations from the Ethiopian Preliminary Report, it appears that this fly-by-wire software is fatally flawed. Fatally flawed, and yet it can seize full control of the aircraft from the pilot.

●

Boeing could be the LAPD. The FAA, the FBI. Then Bjorn Fehrm is the good guy, the private or rogue detective, holding off both bureaucracies while he gets to the bottom of the mystery.

I read his April 5 piece, ET302 Crash Report, the First Analysis, only this afternoon. I stand corrected on two points:

1. There was no MCAS activation until the flaps were retracted (I found the Flaps trace)

2. There were no MCAS inputs with the autopilot on (those were autopilot inputs)

But as so often has been the case with the MAX mess, the truth is worse. I will paraphrase Bjorn Fehrm’s analysis.

What happened to Ethiopian Flight 302

Rotation was normal. Ten seconds later the left AoA went high, and the stick shaker began. Just over 30 seconds later, at 05:39:22, the autopilot was engaged. Flaps were selected up at 05:39:48. The autopilot dropped off, or was selected off, at 05:39:55.

Immediately MCAS ran the trim nose-down for nine seconds. The pilots responded by pulling hard on the yoke (2/3 of maximum travel) and by using the thumb switches (electric trim) to counter MCAS. This is at 05:40:15. The counter-trimming, however, has reset MCAS, and it tries again at 05:40:21. The pilots react with almost full up elevator and counter-trim. They succeed in getting the trim back from near zero units to about two units. Two units is where the trim was after the first MCAS activation, and it is not nearly enough to get the airplane back in trim. Five units would be normal. So MCAS still has -3 units to its credit and the airplane continues to accelerate. The crew has by now identified the MCAS event and selected the Stab trim switches to CUTOUT. This is evident when MCAS makes a third attempt of nine seconds duration at 05:40:42 and fails to move the stab.

The crew have de-activated MCAS, and they begin a turn back to the airport, meanwhile trying to wind the trim nose-up by hand, using the big trim wheels on the pedestal. But they can’t move them. The airspeed is now above V_MO, 340 knots, and the stabilizer is jammed by aerodynamic forces resulting from the near full-up elevator being held against a stab set at 2.3 units. Meanwhile the stick shaker and divergent airspeed indications lead the crew to try to climb. And they do climb to about 14,000 feet. But Addis Ababa airport is at 7600 feet elevation, half again higher than Denver, so this is scarcely more than 6000 feet above ground. Even if the pilots knew about stab jamming, and had just come off an aerobatics refresher course, it is by no means certain they had enough altitude to do the zero-G pushover to unload the stabilizer. Nor is it certain that at zero-G they could have found the purchase to wind the stab nose-up.

As Bjorn Fehrm, our detective, says, “to understand their position one must have flown fast jets at low altitude.” And their airplane is severely out of trim. They are trying to fly attitude, to keep the nose above the horizon. But accuracy is impossible when the forces on the yoke are likely 60-100 lb. The airspeed is 360 knots and the nose is dropping. They are losing the battle.

They decide to turn the stab switches back on and trim the nose up. They do, in two short bursts ending at 05:43:15. The stab has moved up perhaps half a unit, lessening the amount of back pressure the pilots have to hold.

But by now the airspeed is 375 knots, so the dynamic pressure is almost double what it was the last time MCAS activated.

And now, at 05:43:21, MCAS wakes up and trims nose-down for a full nine seconds, moving the stabilizer at a speed 50% higher than the pilots can command.

The reaction is violent. The pilots are lifted out of their seats and thrown up against their belts and shoulder harnesses. The nose has gone from level to 20° nose-down. Both pilots are pulling with all their might. We don’t have an elevator position trace to prove it (it exists, it is just not in the preliminary report), but the airplane is unresponsive to this pull and most likely it is because there is elevator blowback at 400 knots. The pilots are flighting for their lives and losing to a lousy piece of software. Within ten seconds they are dead.

●

Sunday, April 7, 2019

I awoke sweating at 2 AM this morning with a thought. What about the trim brake? Could it be the trim brake?

Well, no. The trim brake has been removed or disabled on the MAX. How do we know? We don’t. There is no information directly available. Certainly not from Boeing. But consider: AD 2018-23-51 (November 7, 2018) in the first paragraph of the Runaway Stabilizer procedure, still contains the sentence that begins:

If relaxing the column causes the trim to move, set the stabilizer trim switches to CUTOUT.

The 737 pilots I have spoken with all confirm they would stop an uncommanded movement of the stab with opposite pressure on the yoke. That would stop stab movement until they could get the switches to CUTOUT. That’s the trim brake. Except it’s probably not there on the MAX. Why do I say that? Here is what Bjorn Fehrm said on November 14, 2018, after the Lion Air crash:

(MCAS) is not stopped by pulling on the yoke, which for normal trim from the autopilot or runaway manual trim triggers hold sensors. This would negate why MCAS was implemented . . . It’s probably this counterintuitive characteristic, which goes against what has been trained many times . . . which has confused the pilots of JT610. They learned that holding against the trim stopped the nose down . . . but it didn’t.

OK, the trim brake is almost certainly not there. But Boeing can’t admit that. It is not there because it would interfere with MCAS, which the pilots didn’t know about because it would have had to be explained to them, which is training, and because it is a big difference from all other 737’s, which is bad news for certification, so of course the pilots can’t know about that either. They can’t know that trim brake, which is their practiced instinct and first defence, is gone.

This has gone well beyond not need to know and sorry, forgot to mention it. It is willful obfuscation. It is betrayal. And as we now know for sure, it is deadly.

So last night’s nightmare was groundless. It wasn’t the trim brake that froze the stabilizer jackscrew at V_MO. It was most likely stab jamming, after all.

●

Will Hutton has a piece in today’s Observer, titled The Boeing scandal is an indictment of Trump’s corporate America. It is the most complete and concise account to date of the whole sad affair. He zooms back to include not just Boeing and the FAA, but Congress, republicans, and the America First idea.

He concludes with a refrain he says is growing in America: Let Donald Trump and his transport secretary, Elaine Chao, go on the first 300 test flights when the MAX goes back into service. Hey – and maybe Boeing could donate a MAX to the country as the new Air Force One? There will be enough of them lying around.

●

Monday, April 8, 2019

Yesterday’s article by Will Hutton got me thinking. I liked how he zoomed out and gave us context. And I thought, there’s more to this story.

●

Boeing remote management, and the CSeries

In 2001 Boeing decided to relocate its corporate headquarters from Seattle to Chicago. The new Boeing head shed is the former Morton Salt building, just west of the loop. The bosses are now most of a continent away from the factory floor.

Meanwhile, two other stories were nascent. In Montreal, Bombardier was considering an all-new 5-across 100-seater. And in Hartford, Connecticut, Pratt & Whitney had begun a clean-sheet engine, a turbofan. But not just any turbofan. This would be a geared turbofan, where the low-speed turbine shaft drives the fan through a 3-1 reduction gearbox. Both these projects are doing things that have never been done before, and are therefore risky in the extreme. But the double-digit improvements in efficiency might well balance the risk.

The new airplane, the CS100, will use the new Pratt geared engine.

Each project ran into many difficulties. There were cancellations and restarts, financial and technical dilemmas. Naysayers abounded, increasing the political problems. The engine was looking particularly iffy. At one point its start sequence took seven minutes. But both teams had faith and persistence. They kept their eyes on the prize.

The CS100 flew on September 16, 2013, was certified on December 18, 2015, and entered service in Europe in July, 2016.

Meanwhile, on April 28, 2016, Delta had announced a purchase of 75 CSeries CS100’s as firm orders and optioned another 50. The shock to Boeing was like the one five years earlier when American Airlines ordered 260 new Airbus aircraft. And by 2016 the MAX, a remake of a very old airplane, was well in the works. Boeing reacted with what had become a reflex – a full-court press on Congress.

But there was an election coming up. Boeing didn’t tip its hand early. Only after the inauguration did the lobbying ramp up, and on April 27, 2017, Boeing filed a petition accusing Bombardier of dumping, for selling the CS100 to Delta below the cost of production. (Boeing should know – it is pretty much standard for a launch customer to get a sweet deal.)

Here is Boeing vice-chairman Ray Comer speaking at the United States International Trade Commission on May 18, 2017:

“It will only take one or two lost sales involving US customers before the commercial viability of the Max-7, and therefore US industry’s very future, becomes very doubtful”

On June 9 the trade commission voted that US industry was threatened. On September 26, 2017, the Department of Commerce announced that Bombardier received subsidies of 220%. On October 6, the same department announced it would add an 80% preliminary anti-dumping duty on top, resulting in a total duty of 300%.

As has been so often the case with this administration’s actions, reaction around the world was sharply negative. Canada’s planned purchase of new-model F-18 Super Hornets was put on hold because Boeing was no longer a “trusted partner.”

The comments by Canada’s Prime Minister and Minister of Defence made the papers. Airbus’s reaction was swift and silent. On October 16, 2017, 10 days after the US announcement, Airbus and Bombardier signed a partnership agreement on the CSeries. Airbus acquired a 50.01% majority stake in the project. Bombardier would have 31% and Quebec 19%. Assembly would remain in Quebec, but there would be a second assembly line in Alabama. The CSeries would become the Airbus A220 series, benefitting from Airbus’ worldwide sales and support. The price to Airbus was one dollar.

Why was Airbus so interested? Because the gamble had paid off. The technical and financial risks were largely in the past. And Delta, while not exactly a launch customer, was big, prestigious, and American. And perhaps losing the American Airlines sale to Boeing in 2011 still smarted.

●

Tuesday, April 9, 2019

How does the CSeries/Airbus A220 stack up against the B737 MAX?

The main point is fuel efficiency. According to Delta, the CSeries will deliver 20% lower fuel burn compared to the Bombardier CRJ900. JetBlue says the fuel burn is 40% lower than the Embraer 190. Most of this is the engine, the Pratt P1500G, so it is safe to say the CSeries would have a double-digit advantage over the MAX.

But there is another point to make in the comparison, and it is that the CSeries is all new and has a second-generation fly-by-wire flight control system. It has built on aviation’s experience with the Airbus A320/30/40 over the last thirty years. Where the first generation had auto-trim, where if you let go the side-stick the airplane would maintain wings-level, one-G flight, the CSeries has what is called C*U, or trim for speed.

Chuck Ellis, the CSeries Chief Test Pilot, explains the rationale of C*U:

“The time when a pilot will revert to manual control of the aircraft is when things are not as expected. He can then be highly stressed and there is a high risk that he reverts to what he once learned in basic flight training. A C*U pitch mode will then give him that well-known feeling, that he knows what the aircraft is doing. It’s intuitive for pilots to feel in the stick if the aircraft is under or over trimmed speed.”

A Piper Cub or a Bonanza or a King Air turboprop – indeed, most airplanes except first-generation A320/30/40, will give the pilot feedback on approach: if the speed gets too low (high AoA) the nose will be heavy. It will want to drop to pick up airspeed and reduce angle of attack. The pilot, flying attitude, feels this in the yoke. He has to apply back pressure to keep the nose from dropping. The reverse is true for an increase in airspeed. This is the result of the airplane’s natural, designed-in longitudinal stability, and this stability is aerodynamic and not dependent on software add-ons.

The bottom line? The CSeries, now the Airbus A220 series, is progress: a new machine building on painfully won knowledge. The MAX is a product, the best-selling aircraft in history.

●

Delayed Consequences

There is another piece of pilot knowledge I would like to pass along. For its definitive description we must go back to a book written in 1944, the year I was born. It is Stick and Rudder, by Wolfgang Langewiesche.

In this section he is explaining that the elevator is really the speed control. (“Elevator” is in quotes because he usually calls them the flippers.)

With two illustrations and succinct language he makes an essential point:

Behind the curtain something has happened which keeps many students from understanding the true role of the elevator.

In today’s ubiquitous trainer, the Cessna 172, the sequence in the illustration would take 10-15 seconds. In my Bonanza, slowing in level flight from descent speed to traffic pattern speed with the throttle back to 15 inches of manifold pressure, it would take a minute or so. In a jet transport, slowing from high altitude descent speed (300-320 knots) to 250 knots (the speed limit below 10,000 feet) would take two minutes or more.

As an instructor, I call these speed change manoeuvres transitions. A pilot has to use the elevator to effect the speed change, and only then trim for the new speed. But she must be patient. She can’t just raise the nose slightly and look away, thinking the manoeuvre is complete. Patience and watchfulness yield understanding – of how an aircraft changes pace, from gallop to canter to walk. As the pilot moves from the C-172 to larger, heavier, and faster airplanes more patience is required. The process is identical, but it takes longer.

If we think back to the balsa-wood Christmas-stocking glider, we can see how Langeweische’s insight applies. There are two stages. First the glider, dropped from the second-floor balcony, gathers speed until it is flying, and pulls out of the dive. Second the tail, still pulling down, forces the wing to meet the air at an Angle of Attack. The negative incidence of the tail determines the positive incidence of the wing. The former determines the latter. The glider, or aircraft, is now both stable and controllable.

In a series of loss-of-control accidents, we have examples of extreme flying – pushing the envelope in a way no test pilot would consider.

With Air France 447, the pilot and the auto-trim robot work together to run the stabilizer full nose-up. Behind the curtain, the great A330 zooms, using its inertia to climb from 35,000 feet to almost 38,000. Then it stabilizes. When it emerges from behind the curtain, a minute or two later, it is falling, nose level, almost straight down.

With TCA 831, Lion 610, and Ethiopian 302, the pilots (TCA) or MCAS (Lion and Ethiopian) run(s) the stabilizer full nose-down. The pilots try to recover by pulling full nose-up on the elevator. But the stabilizer, as D. P. Davies points out, is far more powerful than the elevator. Behind the curtain, the airplanes are accelerating, trying to keep flying with the decreasing Angle of Attack enforced by the tail. Emerging from behind the curtain, the airplanes are stabilized outside the envelope – at high speed, minimal Angle of Attack, and more than 45 degrees nose-down.

Wednesday, April 10, 2019

A month has gone by. The MAX is still grounded. It looks like the grounding may last into June. The word is that China, having been the first to ground the aircraft, will be the last to release it for service, or to allow it to fly in their airspace.

The B737-MAX is a child of late capitalism. It was conceived not as an airplane, but as a counter to a competitor’s move in a zero-sum game of market share. The guiding principle in its making was not sound engineering or even utility. It was sales.

Even though it is a reworking of a sixty-year-old design, the MAX could still be a good airplane. Boeing just has to look at its own history to see how. They must look at their own B-767. They must remove MCAS and install a stick pusher on the elevator.

●

I have learned a lot over the past month.

But already, after the Lion Air crash last October, I knew. My conclusion might have been tentative and in need of substantiation. But even in my shock, sadness, and outrage after that crash, I knew. And as the facts trickled out from under the drone of the script, they continued to add up.

I will freely admit that this past month I have been motivated, in part, by a sense of betrayal. As a pilot for more than fifty years, I understand that the aviation industry and its regulators do not always have my interests at heart. But Boeing and the FAA have stepped over a line with the MAX.

I have done what I could to put my gut feeling, my hypothesis, to the test. To listen to the reactions of others. To place what we know about MCAS (not nearly enough!) into the context of our collective aviation knowledge. My conclusion remains the same as my gut feeling from last November:

It is madness to use the horizontal stabilizer to address a handling problem.

Perhaps it is time to let this go, to bring this account to a close even though the story is far from over. But by now we know that the story is larger than the MAX itself. It is, and will be, only one example of how economic and political power, running wild, trumps execution; and human knowledge, ignored and disrespected, slips away.

●

Sunday, May 26, 2019

Postscript

Today in the street I ran into a captain I flew with frequently, back in the day, on the DC-8 and the B-767. I have always admired his style. He is still going strong in his eighties.

Whaddaya think about this MAX thing? he asked.

I’m sure he could see me winding up to go into over-earnest, long-winded mode.

Wait, he said. Before you say anything, let me try something on ya.

Sure.

It could be a good airplane. Just take out that fucking MCAS. Remove it. All of it.

I’m smiling inside. It’s still good old Neil.

Sure. You’re right. Absolutely. We would have to brief each other, though. Get it slow, clean, pulling a little G, and there might be negative stick force per G. You might have to push.

So? he said. We’re pilots. That’s what we fuckin’ do! Right?

I am smiling outside now, too. Nodding.

Neil has it in a nutshell. Boeing didn’t want to spend the time and money to certify the MAX properly. Instead they installed a “fix” that neither they nor the FAA understood, and certified a killer.

Christopher Brown

June 16, 2019

Acknowledgements

Mark H. Goodrich, a friend and mentor. He is always ready to listen to my list of questions, however off-base they may be.

Dominic Gates at the Seattle Times, for his excellent reporting on aviation.

Bjorn Fehrm at Leeham News and Analysis, for sharing his experience and perspective as an engineer, a fighter pilot and a test pilot.