Sunday, October 20, 2019

Chemtrails: A Little Truth Goes a Long Way



chemtrails
Proof of chemtrail's existence [Source: the internet]


Running a modest (~3600 follower) aviation themed Facebook page for the past four years has been quite an education in human online behavior. I have a following of fellow professional aviators, air traffic controllers, aviation industry employees and general lovers of aviation. Most everyone abides by the unwritten laws of "netiquette" but there are of course always a few of the usual characters who don't play well with others.

Pedants will pick out a minor mistake or unimportant nuance to trumpet superiority. Last worders must always finish any argument, and reading comprehension aficionados will repeat your point back to you as if it was their idea. Sometimes just not responding to a provocative comment will make the person doing the commenting explode. I don't use the ban hammer often but rather try to talk excitable respondents down off the ledge. But occasionally I get a live conspiracy theorist to happen by. These guys are the most fun of all.

Pick Your Conspiracy


There are many flavors of conspiracies out there from 9/11 "truthers" to flat Earthers to the ur-conspiracy surrounding the Kennedy assassination. Rather than the dissipation of pockets of unknowing as you might expect now that we have the sum total of human science and discovery in our phones, access to the internet only seems to have injected steroids into many conspiracy theories. Confirmation bias kicks into overdrive as whole communities spring up around crazy ideas.

Joseph Pierre, a psychiatrist writing in Psychology Today, makes the point that conspiracy believers venture from a healthy scientific skepticism into nihilistic denialism. Any and all facts are subject to question regardless of any evidence, no matter how convincing, as a matter of principle. I suppose there's an attraction to walking around believing that you have secret knowledge to which few others are privy.

Chemtrails


In aviation circles, the conspiracy of choice is known as the "chemtrail" conspiracy. A portmanteau of chemical and contrails, itself a combination of "condensation trails", the chemtrail conspiracy posits that the lines in the sky which originate behind high flying aircraft are not condensation from the moisture in aircraft exhaust, but actually a chemical spray of nefarious origin designed for a sinister end.

These chemicals can be either psychotropic substances which are designed to keep a restive population compliant, or a melange of metallic particles which are used to control the weather or "geoengineer" the planetary climate by blocking solar radiation. This particular conspiracy dates back to the late 90s and appears to have been sparked by a military research paper speculating about a future method of warfare that might include chemical dispersion from aircraft.

A Kernel of Truth


The use of aircraft to spray chemicals, usually fertilizers and pesticides, has a history dating back to the 1920s. The first aerial application of agricultural chemicals took place in 1921 from McCook Field in Dayton, Ohio. More recently, the US military undertook a large scale defoliation effort from 1962 to 1971 during the Vietnam conflict. Dubbed Operation Ranch Hand, Air Force C-123 Provider aircraft dispensed an estimated total of 20 million gallons of herbicides over Vietnam jungles.

Given this history, it isn't too great of a jump for the conspiracy minded to believe that the government has just upped their game and is now using commercial aircraft to poison the population or control the climate. Adherents will often conflate high altitude contrails which are a product of jet exhaust with low altitude wing top mist generation which is a result of the generation of lift in high humidity environments. Entire websites complete with well produced video content exist to promulgate chemtrail theories.

My Very Own Conspiracist


As I'd had thoughts about addressing this subject for awhile, I had the good fortune to have a true believer find his way onto my page. Let's call him Rob (name changed). Rob started out sending me private messages asking how it was that an attitude indicator (artificial horizon) could stay erect to the horizon if an aircraft is actually travelling over a globe.

It's actually a fair question and a real issue. He was unknowingly describing an actual phenomenon called "Earth rate" or "Earth transport" precession. An uncorrected gyro actually would slowly become inaccurate if it stayed true to its starting location as an aircraft travelled the globe. Both of these effects are accounted and corrected for in modern flight management computers. 

This explanation was answered by an angry response that he'd taken an attitude indicator apart and saw no such correction mechanism. This was probably true in that general aviation aircraft don't need such mechanisms due to their high cost and short range. A link to a Wikipedia article was met with a scoff. I didn't really expect him to believe in anything from Wikipedia, did I? How stupid did I think he was after all?

The conversation continued in this fashion. He'd ask why an aircraft travelling in a straight line over a globe wouldn't simply leave the atmosphere as if on a tangent line. The reply that aircraft don't fly in straight lines but use barometric pressure to maintain altitude in the atmosphere which is curved over the planet was also scoffed at. I hadn't "proved" anything.

It then occurred to me that he was a flat Earth believer. Rather than chase him off, I asked how he had come to his views. He mentioned that a ride in a helicopter some years past had provided him with his epiphany. He never did say exactly how that ride convinced him of the flatness of the Earth though. 

I then asked for some reference material. A trove of internet memes and links to videos followed. These memes would show things like graphic representations of an aircraft flying off into space on a straight line course, or a picture of drain or fuel dump vents on airliners as proof of the conspiracy.

Concerning chemtrails, he eventually conceded that rather than a conscious conspiracy of many thousands of commercial pilots and aircraft mechanics, the chemtrail chemicals might actually be added into the fuel directly, thereby limiting the conspiracy to fuel handlers and refiners.

The Pendulum


Looking for a simple way to demonstrate the Earth was not flat which would not rely on technology which he mistrusted, I recalled seeing a heavy four story pendulum hung in a stairwell in the Franklin Institute science museum in Philadelphia. Every morning employees would set up a circle of chess pieces under the pendulum and set it swinging. The pendulum would  knock down the chess pieces as the day progressed thereby demonstrating the rotation of the Earth. There was no way to ignore that!

The answer came back that Franklin was a Freemason and, well, nothing that he touched could be trusted. Interestingly, that was followed by several videos showing Masonic iconography which depicts the sun the same size as the moon with a flat horizon in the background, so it was difficult to know whether the Masons were with him or against him. What was clear was that a thread of mystical religiosity informed his world view and he was not going to let anyone pop the bubble.

What was also clear was that he wasn't going to attempt to address any incongruities that I raised such as how I could video call my wife from China where it was clearly dark at noon. This was just fascinating to me. I clearly didn't want to know the "truth" of his "research" which consisted of internet memes and videos posted by like-minded conspiracists.

Is It Harmless?


By all accounts my interlocutor seemed like a nice guy who got on well enough in society to hold a job and function normally. He mentioned that his job involved some sort of mechanical proficiency, and he did spend quite a bit of time on Facebook, so he wasn't obviously a technophobe. I even admired his inquisitiveness about the world. 

He was thinking about things that many people never consider, but at some point he wouldn't make the leap to the rational conclusion. Many of his positions started with a bit of truth which was then extrapolated to fantasy. The Psychology Today article referenced above noted that a confusion of the notions of  "believe in" versus "believe that" might be part of the cause of these belief systems.

I can't say that walking around believing in a flat Earth or chemtrails is an unalloyed tragedy. If it works for him, then great. In the words of that great 20th century philosopher, John Lennon: "Whatever gets you through the night is alright."

In Conclusion


One of the attributes which is emblematic of all conspiracies is that they're unfalsifiable. Any time an explanation is offered, there will be a counter-explanation which can't be verified. One of the best depictions of this was the scene from the first Terminator movie where Michael Biehn tries to explain to an incredulous prison doctor how robots from the future are coming to kill Sarah Connor.

Of course the joke here is that there actually were robots coming from the future to commit mayhem. But then, it was only a movie. Or was it?






Sunday, October 13, 2019

Did Bad Grammar Doom the Max?

emergency checklist to be used for a runaway stabilizer trim malfunction

As of this writing, the 737 MAX remains grounded with projected return dates now stretching into the first quarter of 2020. Boeing has not as of yet submitted the software fix for the controversial MCAS system to the FAA for evaluation. The European Aviation Safety Agency (EASA) recently indicated that they will seek their own additional testing of the software fix possibly resulting in a staggered return of the aircraft to service.

The post-mortem examinations of what went wrong at Boeing and the assumptions that were made concerning the flawed MCAS software continue. At issue is one assumption made early on that any malfunction in the MCAS system would be immediately recognized by average pilots as a malfunction known as "runaway stabilizer" for which a checklist already exists.

The stabilizer trim system is used by the pilots or the autopilot to keep the horizontal stabilizer in "trim" which means keeping the stabilizer aligned with the slipstream of air. It does this by actually moving the entire stabilizer a through a range of angles which change with airspeed. An "out of trim" stabilizer means the stabilizer is not perfectly aligned with the passing wind. This results in the need to hold force on the control column to maintain altitude. Letting go of the controls in such a condition would result in an undesired climb or descent. A well trimmed aircraft will stay where you put it.

In the 737, the stabilizer trim is normally controlled electrically through a motor, but can also be adjusted manually through a wheel and handle on the center stand. This system has a failure mode known as "runaway trim" wherein the motor runs after the control column electric trim switch has been released most likely due to a sticky or failed switch. This malfunction can result in an unflyable condition if not quickly corrected. It is this failure mode which is addressed by the "runaway stabilizer" checklist reproduced above.

Continuously or Continually?


Boeing engineers were also counting on pilots using this same runaway stabilizer checklist in the event that the MCAS system, which also uses the stabilizer trim, malfunctioned. The problem with this assumption is that the two malfunctions can appear to be very different things. During a classic stuck switch runaway trim, the trim wheel in the cockpit starts spinning and does not stop. That's the definition of "continuously" and is correctly annotated as one of the conditions on the top of the checklist.

An MCAS malfunction, however, presented quite differently. During that malfunction, the MCAS system would spin the trim wheel forward for a specified amount and then stop. If the pilot then used the trim switches to adjust the trim in a nose up direction, a malfunctioning MCAS would wait five seconds and trim forward again after each input by the pilot. This "very often; at regular or frequent intervals"  behavior of the MCAS system is the definition of "continually", not "continuously". 

This is exactly what happened to Lion 610. After reversing the MCAS inputs multiple times, the captain passed control of the aircraft to his first officer who was apparently unaware of the inputs the captain had been making. He never countered the next MCAS input which doomed them.

From Dictionary [dot] com:

In formal contexts, continually should be used to mean “very often; at regular or frequent intervals,” and continuously to mean “unceasingly; constantly; without interruption.”

Is this a minor and pedantic point? Perhaps, but perhaps not. English is the international language of aviation, and all pilots are expected to be proficient in English to be qualified to fly in international airspace. The pilots of both Lion 610 and Ethiopian 302 were likely not native English speakers and were highly unlikely to be aware of such a nuance as the difference in meaning of these two words.

They were, however trained in the various failure modes of their aircraft, and were not likely to be expecting the intermittent behavior of the failed MCAS system. The pilots of Lion 610 had no knowledge of the existence of the MCAS system as it was not included in their flight manuals. The pilots of Ethiopian 302 did have the Emergency Airworthiness Directive (EAD) published by Boeing describing the MCAS system, but were still slow to recognize that their problem originated from a bad MCAS system until too late.

In Conclusion


Aircraft flight manuals should contain all the information needed by pilots to safely operate their aircraft. This information should include accurate descriptions of possible failures, the recognizance of such failures, and best practices on how to solve or mitigate problems that arise. The omission of the existence and description of MCAS from the MAX airplane flight manual only compounded the problems faced by the two mishap aircrews. Faced with a fusillade of warnings and distractions which served to conceal the real nature of their problem, they were defenseless against a poorly designed and undocumented but deadly adversary.






Sunday, May 12, 2019

737 MAX Update




https://creativecommons.org/licenses/by/2.0/deed.en


I haven't written about the saga of the MAX lately because there hasn't been much change in the situation concerning the grounded airliner. Progress is being made in fixing the MCAS system implicated in the two 737 MAX crashes, and estimates for the ungrounding of the aircraft range into the July-August timeframe.

The FAA recently convened a multi-agency Technical Advisory Board to review Boeing's proposed software fix for the MCAS system. The results of that review will be needed prior to FAA approval of the design changes.

That said, there have been a number of stories brought to light as to how the MCAS system came to be designed, and some more disturbing revelations about Boeing failing to disclose an inoperative warning feature to its customer airlines.

MCAS: What It Is and What It Is Not


The Maneuvering Characteristics Augmentation System (MCAS) has been routinely described in popular media stories as a stall prevention or mitigation device. It is really neither, but rather is a system designed to make the MAX "handle" just like the older Boeing NG series aircraft it replaces.

During flight testing of the MAX, test pilots and engineers noticed that in a very small corner of the flight envelope: lightweight, aft center of gravity (CG) and approaching a stall, the forces on the stick varied from the NG version of the aircraft. MCAS was introduced in order to counter this divergence in longitudinal stability between the two models to make them "feel" the same. The genesis for the difference in handling is due to the MAX having larger, heavier engines which are set further forward on the wing for ground clearance.

The need for identical handling between the two aircraft was to maintain a common "type rating" on both aircraft thereby allowing pilots qualified on earlier versions of the 737 to fly the new aircraft without extensive training. Airline pilots, unlike, say, flight attendants, cannot fly separate types of aircraft but are generally only qualified on one "type" of aircraft (at a time).

The word "type" has a very specific technical definition in that the FAA designates which aircraft fall under the specific "type rating". For instance, being "type rated" in the 737 allows pilots to operate all the various sub-models of that series (-200, -300, -400, etc) without an extensive course of study for each sub-model. The Boeing 757 and 767 were also given a shared type rating as those aircraft were considered similar enough that pilots could fly both of them under a single "type rating". These ratings are annotated on all pilots' licenses. The same is true for the Airbus A320 series of aircraft.

As we now know, the MCAS system was flawed in its design due to being able to be triggered by a single angle of attack (AOA) indicator, and also by the ability of the system to reset itself and re-engage multiple times without limit. The question of how and why this design flaw happened is the subject of multiple investigations into the certification process.

Inoperative Angle of Attack Warnings


The WSJ has done some excellent investigative reporting on the MAX story and revealed recently that not only did the MAX aircraft not have a specific AOA warning indication which had been included on the earlier NG, models but that Boeing engineers were unaware that the warning on the MAX was inoperative. Furthermore, Boeing delayed notifying their customer airlines of the situation for nearly a year.

Angle of attack cockpit indicators are not known as what are "primary flight instruments" such as airspeed, altitude, and attitude. Pilots use primary flight instruments to directly fly the aircraft. An angle of attack indicator, however, is not required to safely operate most aircraft and is usually not included in cockpit displays. 

An analogy might be to a tachometer in your car. Nice to have but not needed. Much outrage has been vented over Boeing's not including this cockpit indicator as standard equipment, but I don't see it that way. AOA cockpit indicators are simply not needed for safe flight.

Angle of attack sensors, small vanes on the exterior of the aircraft, are traditionally used to send AOA information to an airliner's flight control computers and are used to provide "stick shaker" stall warnings. There are two installed on the 737 and the cockpit warning "AOA Disagree" would display should the two indicators return different readings, indicating a malfunction in one or both.

It was this "AOA Disagree" warning which was inadvertently deactivated on the MAX aircraft. Had the AOA only served its previous function of activating stall warning, this would be no big deal. But because the MCAS system was triggered by a single AOA sensor, not having this warning quickly became a very big deal. 

A single malfunctioning AOA indicator has been implicated as a possible cause for the inadvertent activation of the MCAS system on both the Lion and Ethiopian crashes. Having this alert enabled might have aided the pilots of those aircraft to figure out what was going wrong.

Pinto, Tylenol, MAX?


It is becoming apparent that the MAX will be back flying at some point, but the question now arises as to how well Boeing will weather the ongoing tsunami of negative PR. Even President Trump weighed in on this question recommending that Boeing rebrand the aircraft.

If you recall, the Ford Pinto never rose above safety concerns after several accident caused fires and the model was eventually terminated. The response to the Tylenol poisonings, however, is now considered a textbook example of how to manage a public relations crisis. One thing learned is that transparency and being forthcoming in light of a tragedy is essential. Boeing has only made matters worse by their perceived lack of candor.

My guess is that once the MAX is back in the air, the crisis will be quickly forgotten. My reasoning is that the public has a notoriously short memory for these sorts of things. Other aircraft have had spotty beginnings and went on to become successful. The MAX, which is still a 737 at heart, has a long and enviable safety record. As the parable states, the dogs may bark, but the caravan moves on.


Sunday, March 31, 2019

Flight Data Results from Ethiopia 302 and the MCAS System - Smoking Gun or False Lead?



737 MAX throttle quadrant showing trim wheel and stab trim cutout switches (lower right).



The Wall Street Journal is reporting that, after preliminary analysis of flight data from the downed Ethiopian 737 (ET302), investigators now believe the controversial Maneuvering Characteristics Augmentation System (MCAS) activated and may have played a part in the accident.  This finding is significant because the MCAS system has now been implicated in both this crash and the Lion Air crash which occurred last year.

MCAS - What is It?


To recap, the MCAS system was installed on the 737 Max aircraft to mitigate some unique handling characteristics of the new model which differed from older 737s. Boeing originally chose not to document this new system in the aircraft flight manual, but has since briefed all Max operators on the existence and function of the system in the aftermath of the Lion Air crash.

Among the reasons Boeing engineers may have had for not including the system in the flight manual are that the system was only supposed to ever activate during aerodynamic stall conditions in manually controlled flight, which in normal operations would never be seen. Entire careers are flown without ever seeing an actual stall, so this rationale might have been thought sound.

The problem for the MCAS system wasn't necessarily its intended operation, which was to be rarely if ever seen, but rather any potential failure modes. Unintended activation of the system due to a mechanical fault has now been suggested as a factor in both Max crashes. Flight data from the Lion Air crash show the pilots repeatedly fighting the inputs from a misfiring MCAS system, and according to latest reports, the MCAS system also activated on the mishap Ethiopian airliner.

Adding to the controversy of the existence of an undocumented system is the revelation that the system can be activated by a single angle of attack (AOA) sensor. Angle of attack sensors measure the angle of the relative wind over the wings. Too great of an angle between the wing and the airflow over it will result in an aerodynamic stall wherein the wing stops producing lift.

The questions being asked involve the engineering decision to use the input of a single AOA sensor to trigger the MCAS system to operate. There are two (or more) AOA sensors installed on all airliners which among other things are used to provide "stick shaker" stall warning to pilots if they get too slow or approach a stall. Again, a stall is something that most airline pilots will never see outside of a training simulator where stall recovery is practiced routinely.

What Did the ET302 Pilots Know about the MCAS System?


Lion Air JT-610 crashed on October 29, 2018. The investigation of that crash first brought the MCAS system and a malfunctioning AOA sensor to light. On November 7th, Boeing released an Operations Manual Bulletin (OMB) to all 737 Max operators. This bulletin mentioned that erroneous AOA signals can cause the trim to run uncommanded by the pilot. The directed remedy is to apply the runaway stabilizer trim checklist which directs the use of the center pedestal mounted stabilizer trim cutout switches. The text of the bulletin is as follows:

The Indonesian National Transportation Safety Committee has indicated that Lion Air flight 610 experienced erroneous AOA data. Boeing would like to call attention to an AOA failure condition that can occur during manual flight only.

This bulletin directs flight crews to existing procedures to address this condition. In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.
Additionally, pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:

- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- Inability to engage autopilot.
- Automatic disengagement of autopilot.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the AOA indicator option is installed)
- FEEL DIFF PRESS light.

In the event an uncommanded nose down stabilizer trim is experienced on the 737 - 8 / - 9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.

A subsequent Emergency Airworthiness Directive (EAD) directed this information to be included in the flight manual of all Max aircraft within three days.

In my view, it is reasonable to assume that the ET302 pilots were well aware of the MCAS system, its possible failure mode due to an erroneous AOA sensor, and the steps to be taken to remedy the malfunction.

Why Didn't They Just Turn it Off?


The investigation of the Lion Air crash has revealed that on the flight immediately preceding the mishap flight, an off-duty 737 qualified pilot was occupying the jumpseat. That aircraft also suffered the same malfunction of the AOA sensor resulting in uncommanded nose down trim. On that flight, however, the guest pilot recommended that the operating pilots use the stabilizer trim cutout switches, which they did. That flight landed uneventfully.

The pilots on the subsequent Lion Air flight fought against the nose down trim commands continually, but never did deactivate the electric stabilizer trim with the cutout switches. The errant automated trim commands eventually trimmed the aircraft into an unflyable condition.

It would seem easy to Monday morning QB the actions of the Lion Air mishap pilots, but it must be remembered that there were many other things happening at the same time. One important thing to note is that the stick shaker activated right at liftoff and continued for the entire flight. The stick shaker is a device that literally vibrates the control yoke when an aircraft approaches an actual stall. It is loud and disconcerting when activated. The pilots were no doubt startled and distracted.

Another point to note is that the MCAS inputs would not "present" like a traditional runaway trim situation. Typically, a runaway trim malfunction in a simulator would simulate a stuck switch where the trim wheel would run continuously in one direction. During the mishap Lion flight, the flight data recorder showed the pilot actively trimming back against the MCAS inputs followed by a few seconds delay when the MCAS system would reactivate and start trimming forward again.

Another system called "speed trim" installed on earlier and subsequent 737 models can also run the electric trim with the autopilot disengaged, so it is not completely unusual to see the trim wheel spinning by itself with the autopilot off. This "negative training" may have contributed to the pilots not focusing on the uncommanded movement of the trim wheel even though speed trim only functions with flaps extended while the MCAS system only functions with the flaps retracted.

What Happened Then on ET302?


The flight data recorder and cockpit voice recorders from ET302 have been recovered and sent to France where they were downloaded and decoded by the BEA, the French equivalent of the NTSB. The data from the recorders have not been released to the public, however investigators have an "emerging consensus" that the MCAS system activated and contributed to the accident. The story also noted that this preliminary finding is subject to revision.

The pilots of ET302, however, had something that the Lion pilots did not, and that is a detailed description and knowledge of the MCAS system and the procedure to disable it by throwing two easily reached switches. Without more information from the accident investigation, it is simply too early to reach any definitive conclusions about the fate of that airliner.



Thursday, March 14, 2019

What's Next for the Max?






As an aviation blogger, the past few days have been simultaneously hope inspiring and depressing. Hope inspiring as many people understand, or make a good faith attempt to understand, the underlying issues surrounding the 737 Max. But also depressing as random fanbois, trolls, and low information, yet self proclaimed experts, happen by my comments section to disgorge their dubious wisdom on things about which they know little or nothing.

Mencken was Right: No One Ever went Broke Underestimating the Intelligence of the Public


One commenter offered, based on no information other than two 737s had crashed, that all of them should be grounded. I pointed out that by that logic, it would be even more beneficial to ground all airplanes everywhere as it would be safer still. The response was "I didn't say all airplanes should be grounded" displaying an ironclad grip on logical fallacies.

When I noted that the MCAS system could be completely deactivated using two switches mounted on the center console, a commenter replied that well, "maybe the switches reconnected themselves". Other than the testing of those switches being a mandatory preflight item, this commenter has obviously confused the Boeing 737 with the SkyNet model T-1000 Terminator which can rewire itself automatically.

Lastly, when one commenter [Hi Scott!] boldly opined that the 737 was the worst airplane he'd ever flown on, I replied that my passenger experience is usually more dependent upon the particular airline and class of service rather than the aircraft type. This big brained person assured me, however, that no, none of that mattered. He apparently would rather sit in a non reclining 28 inch pitch economy seat on a Spirit A320 than a first class seat on a JAL 737.  [Sigh]

Public Relations and Marketing Wins


So the FAA bowed to international and media pressure and grounded all Max aircraft, which is proving to be a minor inconvenience to most operators of the aircraft. I was personally walking out to a Max to fly to Phoenix when the announcement came. Someone somewhere had done some preparations and an -800 was towed to the gate by maintenance about 10 minutes later for a slightly delayed departure.

We of course are now treated to the circular logic of all the "I told you so" stories. The process starts as media sensationalism whips up a gullible and credulous public followed by outraged calls for the aircraft to be grounded. After weather-vaning politicians cave into public pressure, preening media talking heads then get to state that something must have been really been wrong. And so it goes.

Make no mistake: this grounding has more to do with public relations and marketing than safety. As of yet, there is very little evidence that the two Max crashes are in any way related other than the most superficial of circumstances. But the tsunami of media scare stories and sensationalism showed no signs of abatement, so this was the correct decision. 

The FAA cited "newly" discovered satellite data which finally swayed their decision.They are referring to the ADS-B tracking system which relays flight parameters to air traffic control through satellite. This information, however, was publicly available shortly after the crash and it does show some minor altitude excursions, though nothing is conclusive.

The cockpit voice recorder and flight data recorder from the Ethiopian crash have been recovered and sent to France for analysis. Again, prescient commenters noted that this was a good thing because, of course, had they been sent to the US, American investigators would falsify any result finding the US producer of the aircraft at fault. I actually agree with this decision in spite of the slander against the integrity of the NTSB and other US investigators. Having French investigators analyze the data will deflect the inevitable cries of bias should the investigation find fault in anything except the aircraft itself.

What Next?


What happens next is we wait for the data from ET302 to be downloaded and released. When that happens and a likely cause of the accident can be discerned, the Max will be cleared to fly. Notice that I didn't say that this clearance will in any way be dependent on the outcome of the investigation. The aircraft will be flying again in a matter of weeks regardless of the findings.

Why you ask? Should the MCAS system be implicated in this crash (unlikely in my opinion), there will be software fixes and training updates offered. As I've noted many times, the system can be deactivated completely through the use of two center console mounted switches. Even then, the system should only activate in the case of gross pilot negligence resulting in an aerodynamic stall or, as in the case of the Lion crash, an errant sensor input due to a mechanical malfunction. 

The software fixes will preclude the activation of the system due to the failure of a single sensor. The training updates will reemphasize to all operators that undesirable electric trim inputs can be inhibited through the use of the center console mounted stab cutout switches. 

Should the MCAS system not be implicated in the ET302 crash, the Max will be back in the air that much sooner. Make no mistake, all airline crashes are tragedies of the highest order for everyone involved. The object of any investigation is to find out what happened and to take measures to prevent any future recurrence. Commercial aviation is one of the safest, if not the safest means of transportation available. 

What will be left is a mopping up by the lawyers.


Captain Rob Graves is a veteran airline pilot and retired Air Force officer. He currently flies a Boeing 737 for a major American airline where he has over 25 years of experience. His Air Force career included instructing future USAF pilots in the T-37 primary jet trainer, aerial refueling in the KC-135 Stratotanker, and conducting worldwide logistics in the C-5 Galaxy cargo aircraft. He is the author of This is Your Captain Speaking, an aviation blog. It can be found at robertgraves.com. He also writes for Avgeekery.com. 








Tuesday, March 12, 2019

Is the Boeing 737 Max 8 Safe?





737 Max 8


This past Sunday, an Ethiopian Boeing 737 Max 8 aircraft crashed shortly after takeoff from Addis Ababa to Nairobi with 157 passengers and crew. There were no survivors. This is the second crash of a Max 8 variant of the 737 in five months after the crash of a Lion Air Max 8 last October.

An undocumented system was brought under scrutiny in the Lion Air crash and now questions are being raised as to whether this same system, known as maneuvering characteristics augmentation system (MCAS), might have played a roll in this latest crash. If that is found to be the case, the safety of the aircraft itself will be called into question.

What We Know


At the current time, the cause of both accidents is unknown as the accident investigation is still underway on the Lion Air crash and the Ethiopian Air crash investigation is just getting under way. The flight data recorders and cockpit voice recorders have been recovered from both accidents and are being analyzed.

The flight recorder data from the Lion Air crash suggests that the pilots were having control difficulty due to erroneous inputs from the aircraft's MCAS system which itself received faulty inputs from a malfunctioning angle of attack (AOA) sensor. It is this errant sensor and its maintenance history that investigators are focusing on.

Initial reports from the Ethiopian Air crash suggest that the aircraft experienced control difficulties shortly after takeoff. Data from a flight tracking and reporting system known as ADS-B show highly unstable vertical velocity and airspeed readouts which were similar to the airspeed and altitude excursions of the Lion Air mishap aircraft.

Unconfirmed reports from listeners on the frequency reported that the Ethiopian pilots stated that they had unreliable airspeed indications and were declaring an emergency.

And right now, that's it. There are similarities, but no confirmation that the same system brought down both aircraft.

Is It Safe?


Given that we know little about the cause of the first accident and nothing about the cause of the second, a grounding of this model aircraft is premature. I am qualified and current in this model aircraft and am confident that it is as safe as any aircraft flying. Airplanes sometimes crash. It is always a tragedy when they do, but barring a definitive indictment of the design, there is no reason to overreact.

Even should the MCAS system be found primarily at fault, the system can be completely deactivated by two easily reached switches on the center console of the cockpit. Why the Lion Air pilots didn't take this action is unknown, but the investigation should eventually reveal the cause. A similar malfunction occurred on a previous flight of the mishap aircraft, and those pilots took the correct action and landed uneventfully. Questions as to why the aircraft flew again without being properly repaired should be asked.

In the event of unreliable airspeed, which can happen to any aircraft independent of model, routine practice of this malfunction in the simulator should make it a non-event. I recently underwent this training myself, but the basics of pitch and power date back to Wilbur and Orville. Recognition is the toughest part, but after that, known pitch and power settings will keep the aircraft from stalling and in control.

I don't mention these questions to cast blame, but rather to answer critics who don't understand aviation or engage in magical thinking. The Max is still a 737 at heart and flies nearly identically to the other four models of the aircraft that I have flown. So yes, it is safe, and I'd gladly put my family on one and fly it myself with no reservations.


Captain Rob Graves is a veteran airline pilot and retired Air Force officer. He currently flies a Boeing 737 for a major American airline where he has over 25 years of experience. His Air Force career included instructing future USAF pilots in the T-37 primary jet trainer, aerial refueling in the KC-135 Stratotanker, and conducting worldwide logistics in the C-5 Galaxy cargo aircraft. He is the author of This is Your Captain Speaking, an aviation blog. It can be found at robertgraves.com. He also writes for Avgeekery.com. 

Saturday, February 16, 2019

It Shouldn't Have Flown






By Steven W. Freimuth, former Captain, USAF

PROLOGUE


The following is my recollection of the events that occurred during a takeoff and flight on a September day in 1973 while flying out of U-Tapao Royal Thai Navy Airfield (UT) in Thailand.  This was after the war was over.  But we were still flying missions to maintain the peace.  While these events happened over forty-five years ago, most of them were so etched in my mind, that I can still recall them as if it were yesterday.

I am finally following up on my years of “intentions” and reducing this to paper as a result attending two Arc Light / Young Tiger reunions. It was there I met Tommy Towery and acquired the many “We Were Crew Dogs” books which he edited.  He wondered why a KC-135 pilot would be interested in reading these short stories mostly about B-52 crew experiences.  Well, I learned a lot more of the bigger picture in SEA (Southeast Asia) and stateside.  Often we were so busy  in our own activities, and in accordance with SAC’s (Strategic Air Command) “need to know” policies, that we (I) didn’t know much about the details of the roles of my fellow airmen.  And our shared suffering.  But more of that in another article.

I have chosen to use “full width” paragraphs to write the sequence of events as they occurred and what my thoughts were at that moment.  I have included “indented sections” to further explain various aircraft and performance details.  This is to assist the reader who isn’t as familiar with them to gain a better understanding of both what was going through my mind and happening to the aircraft.  Thus, read just the expanded text to get a blow by blow description.


The Aircraft:  I was going to write about the KC-135A aircraft so the reader would have a better understanding of some of its quirks and limitations.  However, I came across the following written by Robert Graves who flew them in the 1980’s.  His description included everything I wanted to say and written better.  He wrote:

The First All Jet Tanker

The KC-135 Stratotanker, produced between the years of 1956 and 1965, was a derivative of Boeing's test bed aircraft, the 367-80. From this early test aircraft, both the KC-135 and 707 were derived which is why the KC-135 has a strong resemblance to the 707, though the tanker was smaller and lighter. Still, the tanker could carry 135,000 lbs of fuel and weighed in at just under 300,000 lbs fully loaded.

Part of the impetus for the Air Force to acquire this aircraft was the cold war. The nuclear arms race was in full swing in the late '50s and the Air Force wanted to have a tanker which could refuel its new intercontinental bomber, the B-52, to allow it to reach Russia. The old KC-97, a derivative of the WWII era B-29, just wasn't up to the task.

In fact, because the angst of quickly fielding a nuclear deterrent was so high during that time, several compromises and shortcuts were made in the design of the KC-135 to get it operational faster. These were compromises which I came to despise acutely nearly thirty years later.

The first compromise was the engines. Engine manufacturer Pratt and Whitney was working on a new engine design at the time known as the bypass fan engine. This new engine was to become the basis for all modern engines and was eventually used on the 707, but it just wasn't going to be ready in time for the tanker. So the KC-135 was outfitted with older engines which incorporated a technology known as water injection to produce enough thrust. Yes, you heard that right...they pumped water into the engine.

Without getting too detailed, high pressure pumps injected water into the engines during takeoff which increased thrust by means of an increased mass flow rate. Still, the airplane was grossly underpowered. While the airplane did usually get airborne, it would take most of the runway to do so when heavy. I have seen the departure end of the runway coming under the nose during rotation more times than I care to remember.
To give you an idea of how puny the engines were, the CFM-56 engines fitted on a 737 today produce about 34,000 lbs of thrust while the tanker's original P&W J-57s produced a mere 12,000 lbs. Due to its underpowered nature, the aircraft gathered unflattering monikers such as "The Silver Sow" or "The Steam Jet". My personal favorite was "Strato-Bladder" for the bladder type fuel cells in the body tanks. 

The KC-135A was eventually re-engined in the 1980s with those same CFM engines and was redesignated the KC-135R. The new "R" models are quite sporty now and even hold some time to climb records for transport category aircraft.

This first compromise of using water injected engines led to the compromise which I came to hate the most. To feed the water injection system, a water tank was needed. Since most of the body of the aircraft where cargo bins are on a normal plane were taken up with fuel tanks, a decision was made to remove one of the two air conditioning units, or packs. This meant that the airplane was hot, and I don't mean hot as in cool, but rather hot as in fetid.

I was stationed in Okinawa, remember, which is in a subtropical climate zone. This means warm and damp winters followed by hot and damp summers. The lack of A/C on the aircraft was most pronounced when flying hour after hour of "transition" training, or touch and go practice. It wasn't uncommon to get off the airplane soaking wet. Boeing didn't even have the courtesy to install an air vent to blow on the pilots' faces. The air outlets were under the seat where what little cool air that did emanate did no one any good at all.

Old Technology

As I flew the airplane in the early 80s, it had undergone a number of technology updates to its original systems but many vestiges of older technology were still on board. We still had a navigator assigned to the crew, but he had at his disposal an inertial navigation system, or INS which made his job more or less obsolete. Airliners were crossing oceans then with similar systems which had their accuracy measured in yards while GPS was still on the design table.

The aircraft also had, however, a sextant and an overhead port with which to view the stars. Celestial navigation dates back to the time of Magellan and was the reason the navigators were still on board. Remember, this aircraft was designed to fight a nuclear war and at the time it was thought that a nuclear detonation might render all electronics useless. Therefore, the navigator was trained to use the ancient technology of celestial navigation with a sextant to determine our course while flying to nuclear armageddon. My one regret is never having had our nav teach me how to shoot the stars with the sextant.

Over-water communications were also rather dated. While we had a high frequency or HF radio which could bounce signals long distances, ours was an old tube-type radio requiring a warmup and without a squelch control. This meant maintaining a "listening watch" on air traffic control frequencies which were always full of static, whistles and pops. Of course this was a copilot duty. When the air traffic frequencies became too unusable, I might have inadvertently tuned the radio to an awesome rock station beamed out of Saipan.

The standard for overseas communications is through the use of satellites today.

Flying the Beast

As I mentioned above, the airplane was underpowered. This meant that it had to be flown very smoothly and deliberately when it was heavy, which was most of the time. There were restrictions on the angle of bank that one could use after takeoff for instance, and multiple warnings concerning what to do or not do should an engine fail on takeoff.
There were so many red warnings on the engine failure pages that I think most of us flying the beast were convinced that an engine failure was pretty much game over. Thankfully I never got the opportunity to test out that proposition. …”

 Another former crew member has described the takeoff in the following manner: “I realize that this was a long time ago but when I was stationed at Robins AFB back in the mid-1960s our KC-135A s would use between 11000 and 12000 on T/O.  It was closer to the latter on hot days.  Sometimes they would return after their missions and still have some pine needles in the intakes from the tops of trees at the end of the runway. Of course these were fully loaded airplanes.  If anyone here ever witnessed a fully loaded “water wagon” they were truly something to behold.”

 And, as an additional piece of information for the B-52 crew members reading this, I have gleaned, your maximum takeoff weight was about 488,000 lbs.  From what I have read in “We Were Crew Dogs” the maximum weight at UT was about 454,000 lbs. (with twice the engines and water).  Half of that weight would be 227,000 lbs.  My takeoff weight in the follow story was about 262,000 lbs. The base weight of a 135 was between 105,000 and 107,000.

 As a final comment before I start my tale, there was a saying in SAC: “If someone could construct a runway that would actually encircle the entire earth, SAC would could come up with a mission plan that would use every inch of it”.

AND MY STORY BEGINS


This was to be our second flight of the day.  We were assigned to fly a KC-135A, tail number 59-1475, using a water takeoff with a max fuel load of 156,000 pounds on runway 18.

THE RUNWAY:  Runway 18 is a 11,500-foot runway that ends with the overrun (or approach portion (when landing to the north on 36) followed by a sandy beach and the Gulf of Thailand.  Normal departure after takeoff is to the north.

WATER TAKEOFF AND JET ENGINES:  The KC-135A aircraft had four J-57 jet engines.  These engines were not turbofan jets In order to provide more thrust for takeoff, a 670 gallon tank of water was installed in the belly of the plane.  Electrically driven pumps furnished approximately 80 gallons per minute to each engine.  Accordingly, we normally had about two minutes of water before run out.  This increased the mass flow through the engines providing substantially more thrust.  Each engine (dry) should be able to provide a maximum of about 12,845 lbs. of thrust within a temperature range of -65 to 5 degrees.  The dry thrust would diminish substantially as the temperature rose above 5 degrees.  Water (wet takeoff) should be able to provide a maximum of about 12,925 lbs. within the 20 to 100 degree range.  

GENERATOR LOADS:  Three of the engines had generators to provide electricity while no. 4 had a cartridge start system in its place.  All the normal aircraft electrical loads could be met from the output of only one generator.  According to the charts, it would use about 94% of the rated capacity of a one generator during the highest usage period of a mission - except a wet takeoff.  The water injection pumps, that were needed for the critical two minute period, consumed about 100% of the capacity of a generator.  Thus, during a wet takeoff, about 175% of the available output of one generator was consumed with three available.  Safety and redundancy had been built in.

MAX FUEL LOAD:  According to the charts, the maximum fuel load (capacity) is 202,800 lbs. for aircraft with an upper deck aft fuel tank installed.  However, I recall that at UT, the max load was 156,000.  This lower load was the maximum that we could get airborne given the runway length and warm temperatures.

The Form 781 maintenance log indicated that this was the first flight for this aircraft after going through “corrosion control”.  I didn’t know what that was and believe the crew chief said something about “taking the aircraft apart, looking for corrosion, and then putting it back together”.  I thought about a FSAGA (first sortie after ground alert).

I also need to insert at some point that at a safety briefing, probably within the prior week or so, there was a 135 out of Grand Forks or Minot that kept popping circuit breakers during a flight.  The crew continued resetting them several times and they continued to trip.  The crew found an electrical fire.
The preflight proceeded normally until we got to the Control and Trim Check.  With the control wheel rotated to the left, Ground reported “Left ailerons up, tabs down, left spoilers 40 degrees, right spoilers down, right ailerons down, tabs up”.  (A correct call and indications.)  When I then rotated the yoke to the right I got something like “Left ailerons down, tabs up, left spoilers up, right spoilers 40 degrees, right ailerons up, tabs down”.  Something in the all so familiar call given in a standard cadence seemed wrong.  “Aah Ground, would you repeat that call.”  It was repeated the same and Ground, this time, seemed to realize that something was wrong.  After a short conversation, I believe Ground said something like “Sir, we must have a stuck actuator, let me get a ladder and a hammer to fix it.”

As we waited on maintenance, I believe at some point we may have decided to continue to complete a few of the items left in the Interior Inspection checklist that we could do without Ground i.e. altimeters check, etc.  And we waited on the ramp in the afternoon sun (usually between 84 and 88 degrees).  Think of sitting in an auto in this position with two windows open while wearing a Nomex (a non-breathing plastic bag that provided fire protection) flight suit.  Because of this, we delayed putting on the SAC required inflatable life jackets that were to be worn on all overwater takeoffs.

Maintenance must have had problems finding the appropriate SAC specified hammer as start engine time (30 minutes before scheduled takeoff time?) came and went.  I believe it was between ten and fifteen minutes before takeoff time that maintenance finished “fixing” the problem.
At this point I should point out to those unfamiliar with this fact that takeoff times are important in SAC, almost sacred.  My recollection is that the scheduled time plus up to five minutes was okay.   I never knew if it went all the way up to those under CINCSAC but at least I had been told that everyone at UT got a black mark after their name when there was a late takeoff.  And, as was the custom, one “awe sh*t” wipes out 10,000 at-a-boys.

As a SAC trained professional - and a person whose Mother taught him to “do the right thing”- my crew and I finished the Interior Inspection checklist, and began the Starting Engines and Before Taxiing checklist, and Before Takeoff checklist in record time.  While switches were being thrown and settings made, clearance was requested for taxiing.

I started to taxi as soon as clearance was given.  My co-pilot started the Before Takeoff checklist while we were taxiing.  We continued to run the checklists, throw switches, verify systems, and adjust settings.  Now there is a saying in SAC that there is only one thing worse than having a taxiing accident, that is living through it.  While well aware of that, I must admit that I made a “high speed” taxi.  In fact, a very high-speed taxi.  I think it was about four times faster than I had ever taxied before or since for scheduled flights.  Probably twice as fast as an alert taxi exercise.  I thought we might skid around the corners as we headed to the runway.  But I was going to make an on-time take off if at all possible.

As we approached the hammer head we called and received takeoff clearance.  No stopping before taking the active.  As we turned to the runway heading of 18, I brought the throttles back and my Co started the water injection.  I believe my Nav called that we crossed the threshold between four and five minutes after our scheduled takeoff time.  My crew had saved the day!

As I advance the throttles, water kicked in and we were off.  Air speed slowly increased as we rumbled down the runway.  S1 was called as our takeoff continued.

S1 is a calculated speed (V1 to the rest of the world) where if you encounter a major problem prior to reaching, you can abort and stop within the remaining runway length.

Then, just at the start of rotation, the aircraft became very quiet.  At least very quiet for a KC-135A making a water takeoff.

Water takeoff’s noise was about 126 decibels.  

“The KC-135R is a dramatically quiet aircraft in comparison to the KC-135A, which is one of the worst noise offenders in the USAF inventory. … The noise footprint has been reduced from the "A" model by 95%”

Within a fraction of second later, the boom was out of his seat and standing between the pilot’s and co-pilot’s seats with his hands on each of our head rests.  “Generators!”  I looked up and saw all three had tripped off line.  Later, I found the Nav had attempted to make a similar call but he had crushed his mic switch attached to his flight suit with an alligator clip.

It is a crew duty for the Nav and Boom to monitor the generators on takeoff as the panel is overhead between the pilots.

At this moment in my life, everything slowed and every sense was at its keenest.

My first thought was that there was no way this aircraft would fly.  I thought the loss of water was about the same as losing one and a half engines while making a heavy weight takeoff.  Next, did we have a fire on board that caused the loss of electrical?  At that moment, I caught a glimpse of my Mae West life jacket on the floor next to the center control column out of the corner of my eye.  In the rush to complete the checklists following the maintenance delay, I hadn’t put mine on for the very first time.  I will accept that glimpse as Divine intervention.  Here I was about to crash a 263,000 pound aircraft into the Gulf of Thailand and I didn’t have my life jacket on.  We’re going to fly!!
How to do that? Throttles, I reached over and firewalled them.

Normal takeoff procedures required the pilot to keep his left hand on the nose gear steering wheel (until about 90 KIAS), advance the throttles with his right hand to about takeoff EPR (engine pressure ratio) and then return his right hand to the yoke.  The co-pilot would follow the advance of the throttles with his left hand and fine tune them to about 2.85 EPR.  Takeoff thrust was determined by the EPR setting.  This was normally reached with a 94-98% RPM.  According to the Dash 1, the overspeed limit of 102% RPM should not be exceeded at any time.  If an engine overspeeds between 102-104% consideration should be given to operating on reduced power and shutting down the engine as soon as safety of crew and airplane permits.  If an overspeed exceeding 104% occurs, the danger of complete engine failure is more imminent.   The normal runway distance from the start of rotation to unstick is about 1,000 feet.

I then tapped my Co’s hand that was on the throttles. No electrical, no intercom!  He knew to check the RPM and pull them back if we were over 102%.  We were mushing through the air, over the overrun, sandy beach and then the water.  To this day, I believe it was the ground effect that kept us in the air.

Next, gear!  Normally the flying pilot calls over the intercom for the other pilot to raise the gear.  No intercom.  I immediately reached for the gear handle.  It wouldn’t come up!  We must have a hanging truck.  If I raise the gear using emergency override procedures, the gear will come up.  I will most likely lose all hydraulics as the gear will rip out all the hydraulic lines that are routed through the wheel wells for maintenance purposes.  The gear will be jammed in the wheel wells and may not come down. I can worry about landing later, I need to fly now.  I pulled the emergency override trigger.  The handle and the gear went up.  No loud crunching sounds.

The KC-135 has two main landing gear and a nose gear.  Each main gear has four tires, two forward and two aft.  These four tires are mounted in an assembly called a truck.  Each truck has actuators that level each truck after becoming airborne.  If a truck is not level, it is referred to as a hanging truck.  Raising the gear with a hanging truck using the 3,025 psi hydraulic pressure will cause the gear to be retracted.  Wheel well damage may result from emergency retraction if the main gear trucks are not level, the oleos are not sufficiently extended, or the nose gear is not centered.

According to a chart I just reviewed, the takeoff four engine maximum climb rate at sea level was 1,290 fpm and the three engine rate was 580 fpm.  The emergency procedures section of the Dash 1 states that gear drag lowers the rate of climb approximately 300 fpm at takeoff with flaps down.  An engine failure decreases the rate of climb approximately an additional 900 fpm.  The opening of the gear doors reduces the rate of climb even more while the gear is being raised.  According to this, 300 fpm plus 900 fpm equals 1,200 fpm reduction without considering the door effect.  A chart amount of 90 fpm does not provide a lot of flight cushion. Paper calculations have never provided an iota of actual lift or thrust.  And we had lost water, even worse in my mind than an engine.

The later modifications to the KC-135R designation provided a maximum climb rate of 5,000 fpm even after considering the allowable increase in aircraft and fuel weights.

While doing these procedures, I was looking out my window.  (No flight director system – no electrical power.)  I saw a Thai fishing boat.  It was a small boat with a tiny cabin leading below deck.  As we were about to fly over it, I saw the captain coming up from below deck with a white bucket full of something. He looked into my eyes and I saw the whites of his.  (Maybe you B-52 types are used to this low-level flying, this was a first for me.)  His bucket went up as he dove back down below deck.

Flaps! With the gear up we were beginning to gain airspeed. I reached over and raised the flaps.  On one of the two gauges that monitored the inboard and out board flap position (one gauge and for the inboards, a second gauge for the out boards), both needles went from about the three o’clock position to the twelve o’clock position.  On the other gauge, one needle went to twelve, the other to nine o’clock.  Asymmetrical flaps! Brace for the rolling motion!  No roll detected, bad gauge?

Asymmetrical flaps is a condition where the flaps do not retract or extend at the same rate.  This difference has the same effect as imputing a “turn” using the ailerons via the yoke.  This is extremely dangerous when at very low altitudes.  A bank angle of 30 degrees at climbout speed with flaps down could reduce climb capability by as much as 400 fpm.  As speed decreases, the effect becomes more severe, particularly in the clean configuration.

Assess your flight condition.  Gear up, flaps up, somewhere between 1,000 and 2,000 feet AGL and accelerating to over 200 KIAS.  Okay, now what.

Declare an emergency.  Battery switch emergency.  Listen to the UHF radio “click” as it cycles and tries to lock on the preset frequency.  Not enough power in the battery to lock on a frequency.  Go to “guard” position on the radio.  Still not enough power to lock on.  Dead battery.

The UHF radios had preset frequencies for items like ground control, tower, command post, etc.  To change from one preset to another you would rotate a dial with numbers, similar to an old-fashioned TV dial.  Guard was an emergency frequency that could be both monitored and transmitted on.

Shout at the Co to try and get some generators on line.  He successfully gets number 1 and 2 on line and mated to the bus.  Number 3 is toast.  This provides power to all the equipment. Get a TACAN DME (distance measuring equipment) lock at about 12 miles.  That is a long way to swim! (Even for a Minnesotan used to 10,000 lakes).  “This is _____ declaring an emergency in a left turn to 360 at 2,000 feet”.

So here we are rolling out on a 360 heading and describing to the Command Post the nature of our emergency.  About this point I told the Boom and Nav to go back in the plane and see if we had a fire, etc.  They reported no issues.  When we got back even with the base and are down wind, the Command Post asks me what is our current condition.  “Gear up, flaps up, two generators on line”.  “Roger”, is the response, “that is a go condition”.  I didn’t tell them my legs were shaking on the rudder pedals.  I don’t think that would have changed their opinion.  I was thinking “land, go to bar”.
We are now north of the base climbing through 8,000.  My number two engine oil pressure gauge starts to fluctuate and soon goes to zero.

Because more engines in the 135 were apparently shut down because of faulty oil gauges than actual loss of oil pressure, the fleet was in the process of being modified with a second low pressure sensor and indicator, a red warning light.  This aircraft had been modified.


And the number two oil light was illuminated.  Time to shut down number two engine.  Must have blown an engine seal after going to increase thrust.

“Command Post, this is _____, declaring an emergency.”  A short pause.  “Roger ____, didn’t you just terminate your emergency?”  “That’s a roger but now we are declaring a new one.”  And in addition to shutting down the engine, it caused us to lose a good generator.  We were down to one generator.  We are given clearance to dump fuel and return to land.

But, as I earlier mentioned, my Mother taught me to do the right thing.  Two things would have been wrong if we just hit the dump switch.  First, the JP-4 fuel we would dump, about 60,000 pounds (or about 9,230 gallons) to get down to maximum landing weight for braking limit purposes, would not evaporate prior to returning to earth.  There would be a whole lot of rice paddies covered with a film (or more) of JP-4.  Second, if we dump fuel with the boom up and in trail, fuel gets into the tail assembly and it needs to be cleaned somehow.

So I requested clearance to 21,000 feet.  After being granted, we start the slow, wallowing struggle to climb to that altitude.  It takes quite a while to get there but we finally make it.  “Boom, go back and lower the boom so we can dump”.  I soon get a call back over the intercom. “Pilot, I am having control problems with the boom.  One of the ruddervators isn’t working.  We may have to land with the boom in trail”. 

About this point in the flight, I am beginning to have doubts as to the air worthiness of this plane.  And more specifically, what’s next.  Systems just don’t seem to be functioning as designed.  But we successfully dump the fuel and the Boom is able to get it up and locked.

We now begin our decent.  We lower the gear handle and the gear comes down.  Again, I send the Nav and Boom back to check the visual down and locked stripes that can be seen from inside the cargo area.  I speculated that the gear wouldn’t come up, not because of a hanging truck, but rather to the fact that we must have lost electrical power while we still had the “weight on wheels” (WOW) safety interlock switch in the “on ground” position.  That prevents the gear handle from being raised using normal procedures.

Next, the flaps are lowered.  They extend without an issue. It was a faulty gauge.  This is followed by a successful three engine landing.

Because of the previous events, we are were met by the squadron or wing commander after taxiing in and shutting down.  He was kind enough to present our crew with a six pack of beer for doing a good job.  (Or for saving his promotion?)

We then had to endure a longer than usual maintenance debriefing.  I can’t recall if any of the above qualified for a “red X” in the 781.  But we did make a few entries. Someone brought to our attention that maintenance was aware of a circuit board defect that could cause a generator to trip offline. If this board experienced a vibration equivalent to that of slamming a fist on a table, it could trip a generator.  Because of the location of this board, they were replacing them only when an engine was required to be replaced.  I believe all further recollections of comments made would be censored.

EPILOGUE


For the next week or so, every evening after a flight we would be in our trailer and my co-pilot would go into the performance charts and say “it shouldn’t have flown!”.

This was very unsettling to my five-month pregnant wife, Melanie, who I had brought over for about six weeks.  She was staying at the Swan Lake Hotel but came to our trailer during the day time.  She found more to do on base as she waited for us to return from flights.  Since the war was over, I wanted to share with her some adventures in Thailand that I had on my prior two TDY’s.  This was NOT one of them I planned on sharing with her.  She did gain a greater appreciation for the risks any airman encounters when they “slip the surly bonds”.

My Co did buy me a nice lobster dinner at Camp Samae San (the Thai Marine Corps Base with US Army units adjacent to UT) with a deep-water port.  I believe the fuel and weapons for the UT aircraft came through this unit.  It was my first and only trip to their O Club, but what a club!  Real linen table cloths and napkins, real (non-plastic) silverware including salad and desert forks, real glass glasses, candle lamps on the tables, waiters, etc.  It was as good or better than any restaurant in Bangkok.  And twelve lobster tails.  Okay, they were one ounce each but tasted wonderful.  And all paid for by my co-pilot because -  even though I didn’t follow SAC policy for over water takeoffs; and whether through luck, skill or Divine intervention - I was at the controls and now we were able to eat the lobsters rather than them eating us.

Shortly after my return to Ellsworth, I put in my paperwork for a January separation.  The war was over, I heard rumors of a RIF (reduction in force), and recalled the two to three weeks of pulling Alert (with the possibility of only one to a max of three flights) a month that seem to happen whenever I was back stateside.  I don’t believe I was notified of the above citation that appeared in the December 1973 issue of SAC Combat Crew magazine until it was sent to me by my former squadron commander several months after my separation.







“YOU NEVER LIVED, UNTIL YOU ALMOST DIED.  FOR THOSE WHO FIGHT FOR IT, LIFE HAS A FLAVOR THE PROTECTED WILL NEVER KNOW.”  Vietnam 1959-1975

Thursday, January 31, 2019

What Do You Want from an Airline Career as a Pilot?






I'm getting to the end of my airline career. Oh, I'm not quite there yet, but I am close to the final turn and the PAPIs will soon be in sight. The FAA mandated retirement age is currently 65, and I'll be turning 60 next year. The retirement age was adjusted from 60 to 65 in 2007 and there are rumors that as the pilot shortage worsens, industry lobbyists will push to have the age adjusted to something like 67. Either way, I don't see myself schlepping my rollaboard through the southside 'hood to the crash pad into my dotage. 65 will be it for me assuming I pass a medical until then.

People often ask why I don't retire now. These are usually pilots junior to me, but it's a fair question. The reason I give is that the airline is a great part-time job. I generally fly only three days a week and rarely pick up flying. And if I wasn't flying, I'd probably just find a local cigar bar or doctor's waiting room to spend time chatting up other retirees on how good the old days were or how the darn kids are screwing everything up.

So with (much) more of my flying career behind rather than in front of me, I am able to look back and assess how things have turned out, and perhaps to give some perspective or advice to those who might be just starting out.

Without a doubt, I have had a blessed and charmed flying career. Starting in 1982 as a second lieutenant in the Air Force, and having never touched an airplane, I've spent every year since then at the controls of a jet aircraft. Hired by my airline at age 30, I found myself in the left seat of a 737 four years to the month of being hired. I now find myself close to the top ten in the seniority list in my domicile. With about 600 captains below me, this means I usually get the schedule I want assuming the company publishes it and Charlie C. doesn't take the line I want. C'mon Charlie, retire already!

There are some things, though, that I won't get to do. I won't ever be a widebody captain because my airline doesn't fly them. That means that I won't get to enjoy the over-water widebody lifestyle of 30 hour layovers touring in some exotic foreign locale or on a white sand beach. I also won't get the downside of back side of the clock flying nor the several day recovery period adjusting back to local time. (I did spend over a decade flying jumbos for Uncle Sam so I have that t-shirt.) Tradeoff? That depends on what you're looking for.

Which is the Best Airline to Work For?


This question gets asked quite often, and I've always maintained that the best airline is the one that hires you. But beyond that pithy answer, the best airline will be the one that gives you the things you value the most; the things you want out of a flying career. That answer will necessarily be different for just about everyone.

Do you want to upgrade to captain quickly? At all? Is widebody flying on your list? Where will you make the most money? Does money matter, or is job security more important? If your spouse is a surgeon or other professional, maybe job security isn't as much of a concern. If you are the sole breadwinner, perhaps it's higher on the list. Where do you want to live? Does your chosen airline have a domicile there or are you willing to commute? Do you want to be home when your kids are awake? How about being able to bid vacation when they're on summer break?

All these are questions that you have to ask yourself, and many times you may not get a choice, but end up taking what is offered. If another offer comes along you'll then have a choice. Leaving an airline that hired you for another is a tough call, but it only gets tougher as you gain seniority. I've flown with profoundly unhappy pilots who wish that they'd jumped early on in their career but are not willing to give up the seniority they have to start again. This is a bit of the "sunk costs" fallacy, but you are only issued one life and have to make the most of it.

Keep Your Priorities in Order


I also flew with a young pilot some years ago who, at the end of our month together, announced that he was quitting to go to another carrier. He was a senior first officer looking at a captain class in a few months. He didn't dislike where he was, but rather was entranced by the thought of flying widebodies for another airline. In fact, he said that the toughest part about leaving was he really did like the people where he was.

That was in the spring of 2001. After 9/11 he was quickly furloughed by his new airline and probably spent years getting back into a cockpit. Was it worth it for him? We lost contact, so I don't know. Perhaps. Will there be another lost decade like the one that followed 9/11? Which airlines are best positioned to weather another storm like that?

A Perspective


I started looking for an airline job after leaving the active duty Air Force with just north of 2500 total hours, all of it in jet aircraft. I applied to all the major passenger and cargo airlines and a few of the minor ones. I got a job offer from only one, a minor regional airline, and the one with which I'm still employed nearly 30 years later.

Shortly after being hired in the early 90s, there was a mideast war and a bit of a recession. Most of the airlines with which I'd interviewed quickly started furloughing pilots, including many pilots I knew. Taking a job with a guard or reserve unit was considered furlough insurance so that's what I did as well. I never had to use that insurance policy, but knew many who did.

The quickest way to gain seniority is to find an airline with either lots of upcoming retirements, or lots of growth. My airline had virtually none of the former but lots of the latter. This allowed for a very fast four year upgrade to captain. It was, though, the last formal schoolhouse course I would take.

Even though my pay rate was not quite as good at times as some other major airlines, the time value of making that money for longer more than made up the gap. As a general rule, widebody first officer pay is roughly equivalent to narrow body captain pay, so when comparing airlines, look at your time to either widebody first officer or narrow body captain.

Consider also in your choice schedule flexibility and the ability to pick up flying. This varies greatly between airlines, but can significantly enhance your quality of life and pay. I don't pick up much flying, but we have some enterprising pilots who can routinely top 150 hours of monthly pay by working their schedules and taking advantage of premium pay rules.

The Lost Decade


It is difficult to convey the disaster in the commercial aviation community in the years following 9/11, unless, of course, you lived through it. Then you know all too well of the furloughs, bankruptcies, career stagnations and reversals that were emblematic of that dark time. It was also the time when mainline contract loopholes were exploited allowing an explosion of regional jet flying with pay so low that some pilots qualified for food stamp programs.

My airline was relatively unscathed by the carnage of that time, so while job security wasn't a huge concern, there were no significant raises coming either. A comparison with my wife's career is instructive here. She took a job with a major airline shortly after I got hired at my airline.

A Career Comparison


For a short while prior to 9/11, she outearned me in the right seat of a 75/767 by a significant amount. That didn't last. A few short years later, while she was in the right seat of a 747, I outearned not only her, but also the captains with which she was flying. Her line guarantee had also been slashed to the low 60s after the bankruptcy while my guarantee was at 85 hours, but my line flying was almost always above that number.

The tear in the fabric of universe has mostly healed since then, and our pay is roughly equivalent again with her holding down a senior 777 F/O seat. She'll lap me in pay once she takes a widebody left seat which is almost attainable for her, but it will be back to working weekends and holidays for awhile albeit for a lot more money. It will be her first left seat job after 25+ years of commercial flying.

Who won? That's a tough call. I'm jealous of her 30 hr HKG layovers and license with type ratings of all the Boeings save for the 717 and 787. We sure were thankful, though, to not have to worry about a furlough or bankruptcy after 9/11. I've also never flown a redeye from SFO to EWR for an eight hour layover, or any redeye for that matter. Twenty five years in the left seat of a Boeing has to count for something as well. Judging by the 401s (she lost her pension with the bankruptcy of her airline) the money will probably end up being close to equal.

In Conclusion


As I mentioned at the start of this essay, I've had a charmed aviation career. I'd like to say I was smart about it all, but plain dumb luck probably played a larger part than I'd like to admit. That said, if you're just starting out, take a few moments of serious reflection to decide what is most important to you, and then make your decision of how to structure your career. Good luck! I'm here for you.




Tuesday, December 04, 2018

The Lion Air Crash: What You Need to Know



PK-REN from Jakarta, Indonesia [CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0)], via Wikimedia Commons
Lion Air B737 MAX 8 (Wikimedia Commons)



On October 29 of this year, Lion Air Flight 610 crashed into the Java Sea 11 minutes after departing Jakarta for Pangkal Pinang with the loss of all 189 souls on board. What first called special attention to this accident was that the mishap aircraft was a brand new MAX 8 version of the venerable Boeing 737, and had been delivered to the airline less than a year earlier.


Also of note has been the revelation in the wake of the ongoing accident investigation that a new safety system designed to prevent stalls had been installed on the aircraft, but had not been publicized nor documented in the flight manuals used by flight crews. The flight data recorder (FDR) from the mishap aircraft has been recovered and data from that recorder shows that an errant sensor on the aircraft may have provided bad data to this new system possibly implicating it in the accident. 

The investigation is ongoing and it is inappropriate to assign blame to any system or persons until the completion of the accident review, but as there is much misunderstanding concerning what information is already known, we can take a closer look at the circumstances surrounding this tragedy.

An Undocumented System


The new safety system installed on the MAX version of the 737 known as the Maneuvering Characteristics Augmentation System or MCAS, was designed to provide a nose-down trim input during manual flight as the aircraft approached a stall. What this means in simple terms is that if a pilot is flying the aircraft without the autopilot, and is for whatever reason flying the aircraft well below a safe speed, the aircraft will automatically run the stabilizer trim forward which will have the effect of making the controls heavier to hold.

In addition, once full power is eventually applied to recover from the stall, the forward trim assists the pilot in keeping the more powerful engines on the MAX from overpowering the recovery by exceeding elevator authority. The nose tends to want to rise during a stall recovery and forward trim lessens that effect.

Here is an excerpt from the multi-user message sent by Boeing on November 10 to all 737 MAX operators:

A pitch augmentation system function called 'Maneuvering Characteristics Augmentation System’ (MCAS) is implemented on the 737-8, -9 (MAX) to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aisle stand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using Input data from sensors and other airplane systems.

It is also important to note that any pilot finding him or herself in this position has real problems and has already disregarded the "stick shaker" stall warning system which vibrates the control column well before reaching stall speed. The reason the system was installed on the newest MAX 8 versions of the 737 and not earlier models is apparently the discovery during flight testing of some unfavorable stall characteristics on the new aircraft that did not exist on earlier models.

Angle of Attack


Ok, so far so good. A new safety system was installed. Who can argue with a safety system? The problem that the Lion Air flight encountered, however, was some sort of malfunction in information coming from a sensor being fed to the new system. This sensor is known as the "angle of attack" or AOA sensor. The angle of attack of a wing is the angle between the chord line of a wing and the relative wind moving across that wing. A chord line is an imaginary line which runs from the leading edge to the trailing edge of a cross section of a wing. 

A wing which exceeds the critical angle of attack stalls, which is where boundary layer separation occurs and the wing stops producing lift. If you've ever stuck your hand out the window of a moving car and made a wing with it, you've experienced how changing the angle of attack changes lift. For more on AOA, see here.

The angle of attack sensor is essentially a very small wing on a hinge mounted on the fuselage which measures direction of the relative wind passing the aircraft. You can see them installed near the pitot tubes on most airliners and there are usually at least two installed for redundancy. AOA data is used by a number of systems on an airliner, but happened to be one of the primary inputs to the MCAS system on the MAX 8 aircraft. It is here where problems occurred.

Faulty Input Means Faulty Output (GIGO)


Analysis of the flight data recorder from the Lion Air flight revealed that the data from the two AOA sensors installed on the aircraft did not match. The left AOA sensor was recorded as giving erroneous information during the entire flight. An erroneous AOA information feed or some other malfunction is suspected to have caused the activation of the MCAS system resulting in the system trimming the aircraft in a nose down direction. During the entire flight the pilots trimmed in a nose up direction to keep the aircraft flyable, but at some point stopped trimming and allowed the MCAS system to trim the aircraft nose down to an unflyable condition.

The reason for this is unknown and may be determined when the cockpit voice recorder (CVR) is recovered. Also unknown is why the pilots never used the two stabilizer cutout switches located on the center stand just behind the throttles. These switches remove all electric power from the stabilizer trim motor and would thereby deactivate the MCAS trim inputs.

In fact, on the previous flight of the mishap aircraft, a failure of a similar nature also resulted in uncommanded nose down trim inputs and required the pilots of that flight to use the cutout switches to deactivate the electric trim system. The 737 has a large manual trim control wheel mounted on the center stand that can be turned to adjust the stabilizer trim. It is normally not touched but spins as the electric trim motor is engaged. The pilots on that previous flight used the manual trim wheel to adjust the trim to safely land.

The aircraft did have maintenance performed on various airspeed, AOA and other systems in the days leading up to the mishap flight in response to several defects being written up on previous flights. The exact nature of the malfunctions and degraded systems on the mishap aircraft has yet to be determined as the investigation proceeds, but an AOA sensor had been replaced in response to writeups on the previous flight. A closer look at the flight data from both the mishap flight and the previous flight can be found here.

Protecting Pilots From Themselves


There is an ongoing debate in the aviation community about the benefits and liabilities of cockpit automation. This debate has centered on the effect that highly automated cockpits have tended to make pilots rusty in their "stick and rudder" or basic flying skills. Make no mistake, automation has been a boon to both aviation economics and safety, but it is now being realized that it is not an unmitigated benefit.

At question is the design philosophy incorporated into automation. Years ago, the two main commercial airframe manufacturers, Boeing and Airbus, diverged in their approach to flight control automation. While Boeing aircraft have always incorporated the ability to disconnect all automation, Airbus on the other hand was a pioneer in designing "fly by wire" flight controls into their aircraft. This meant that pilot inputs were sent to a computer and the computer controlled the aircraft. There was no ability to completely bypass the computer and control the aircraft directly.

The revelation that a safety system designed to prevent an inattentive pilot from stalling the aircraft was surreptitiously installed will raise questions as to whether Boeing has decided to follow Airbus down the road of incorporating behind the scenes automation to prevent pilots from doing stupid things. Remember, the original anti-stall device was always the pilot. Warning systems could signal that the airplane was getting slow, but the pilot was always the backstop. Given that the MCAS system can be disabled by the trim cutout switches makes the above scenario less likely.

The alternate explanation to the installation of the MCAS system is that it is simply designed for the mitigation of unfavorable stall characteristics as mentioned above. This raises the question, though, of why the system would not be documented in the aircraft flight manual. Surely pilots would want to know of these unfavorable characteristics and also of the existence a system designed to compensate for those effects. Since the system was undocumented, the pilots of the mishap flight likely had no idea why their trim kept running forward nor were they expecting such behavior.

What's It Doing Now?


It is imperative, then, that pilots are well versed in not only the normal operation of their aircraft, but also in any possible failure mode and are ready and able to assume complete command at any time that the automation is not performing as expected.

Several high profile accidents such as Air France 447 and Asiana 214 serve to highlight the potential pitfalls of flying highly automated aircraft. Part of the problem confronting pilots of these aircraft is the danger of becoming confused about what the aircraft automation is doing. Known as "mode confusion", pilots can make the mistake of assuming that the automation will perform in a certain manner and become confused if it doesn't.

This was one of the findings in the accident review of Asiana 214 which crashed into the seawall at San Francisco. The pilots realized too late that the mode that had been selected would not do what they were expecting. They were then unable to prevent the aircraft from crashing short of the runway.

Now extrapolate mode confusion to a malfunctioning system which the pilots were unaware was even installed, and you can see the difficult situation they faced.

In Conclusion


The cause(s) for the crash of Lion Air 610 are currently unknown and will remain so until the investigation is complete. In the interim, new knowledge of the existence of an undocumented safety system installed on the 737 MAX should serve to further the debate on the appropriate role of cockpit automation.