+65 6956-6170 [email protected]
The B737-Max Saga – A Technical or a Management Failure ? – Part 3

The B737-Max Saga – A Technical or a Management Failure ? – Part 3

Summary – In previous articles we discussed automated flight systems in general. In this article we examine in detail a nominal systemic ‘tweek’ in the flight automation by Boeing of their dominant 737-series regional airliner which has developed into a major scandal. Boeing is as synonymous with commercial aviation as Bell is to helicopters. They invented the quality systems on which ISO-9000 is based. So, how is it that they appear to have lost the plot in this regard? It is a long story, so we have done it in three parts. The first was a brief history of how the Boeing Aircraft Company achieved total market dominance: the second analysed how this hegemony has been successfully challenged by Airbus. This final article is an analysis of how the useful MCAS concept became a killer.

Part-III:  A Technical Fudge (Sales wags Engineering)

In the first two parts of this article we saw how the Boeing Aircraft Company changed its core value from engineering excellence to optimised financial management, supressing technical innovation and excellence to favour of the bottom line to become a Wall Street darling. This allowed their rival Airbus in the last 10 years to assume the lead both technically and commercially. While just holding their own in the wide-body market, in the larger narrow body sector, Boeing are getting trounced. Having neither the time nor the money to bring a new game-changer design into play, they opted instead to seek to match the competition by re-engining the venerable 737 design with a new, fuel-efficient, by-pass engine type. However, by its very ‘by-pass’ nature, the new engine was significantly larger than its direct-flow predecessor powerplant and thus no longer fitted in the space under the wing. As described in the second part of this series, it was therefore moved forward and raised on a structural pylon. This changed the aerodynamics of the aircraft, risking a stall condition at high power settings. This negative and potentially dangerous impact was overcome using technical trickery, MCAS – Manoeuvring Characteristic Augmentation System – a simple but clever automated device to overcome this negative aerodynamic norm at an insipient stage. The new powerplant, combined with a unique winglet design to maintain laminar airflow on the wings, increased the efficiency of this new 737 iteration by some 20%. However, while looking much the same as its 737-900 predecessor, it was arguably, a new aircraft type.  But to minimize the requirements relating to the associated certification and subsequent conversion-to-type for the client airlines, the Sales department was allowed to obfuscate and minimise the engineering issues. The result was bumper sales – a commercial triumph – and an latent disaster.

Airbus & Boeing - head to head adversaries

Airbus & Boeing – head to head adversaries

The latter demon soon woke. Within a few months of entry into service, a Lion Air Max crashed into the sea shortly after take-off from Jakarta on a mild day with light breezes. With the Captain being a foreign national and the co-pilot relatively inexperienced, it suited both operator and manufacturer alike to initially blame it on Pilot error. While the detailed accident investigation followed it’s protracted course, that was the generally accepted view in the aviation industry. But then, just five months later, a very similar accident occurred in Ethiopian Airlines, also just after take-off and also in fair weather. Now, while Lion Air is an LCC in a poorly regulated developing nation, the national airline of Ethiopia is highly respected internationally, being run to very high standards by a bunch of experienced expats from the developed world. So the event was not so easily fobbed-off. As a result, led by the Chinese, more and more developed nations grounded the Max. The last to do so was the USA and then only after the Pilot’s Union wrote an open letter to the President of the USA resulting in it being grounded, not by the FAA, but by a Presidential Decree !

The root cause in each case was eventually found to be a failure of an angle of attack (AoA) indicator. This is a simple mechanical pendulum device allowing the easy measurement of aircraft flight angle relative to the horizontal, hence the aerodynamic Angle of Attack – (AoA).  In the Ethiopian accident the sensor was found to have been broken by a bird strike: in Indonesia, with the unfortunate aircraft having plunged into the sea at very high speed, no definitive prognosis could be made, but it was considered a reasonable assumption. Bird strikes are common hazard in aviation, so the two events could be considered appalling bad luck. But, as the investigations proceeded and multiple other casual factors came to light, it started to become abundantly clear that appalling management at the OEM was equally to blame – and herein lies the scandal. This has been exposed in an excellent Netflix documentary – Downfall – by Rory Kennedy (yes, of ‘that’ family) issued late in 2021 and on which much of this thesis is based. The failures cover almost every aspect of management within Boeing!  Let’s start with the technical.

In fully automated systems, everything must be duplex: if safety critical, then it’s triplex. The AoA indication, being the fundamental driver of MCAS, is surely in the latter category. Yet it was simplex! There are actually two such AoA sensors (to left / right of the nose) but no software provision was made to cover one or both failing except for a computing anomaly indication – thus effectively making this safety critical element simplex. At the time of writing, one can offer no logic for such a fundamental error: maybe it was a just factor of the sensor’s simplicity in that, being little more than a plumb line, it is was considered that there was nothing there to fail……. That said, with man-in-loop (an earlier article – PFT-2 – on Flight Automation refers), it would not in itself have been a big deal as the MCAS element could just be switched off and the aircraft flown manually.  

It is here that the second root cause, of commercial sales wagging the technical dog, came into play. There were two main issues. Management wanted a speedy certification process to get the aircraft into service as quickly as possible so as to better compete with the A320-Neo family; and the Sales strategy was to minimise the conversion to type for B737-800/900 pilots (again emulating said 320-family) to be little more than a in-house computerised aircraft differences training, with a standard line check by an authorised airline Training Captain on completion. This was to avoid the training typical for new aircraft types requiring pilots to fly to the USA for a couple of weeks conversion Training with the OEM and the need to build specific simulators to accommodate the emergency aspects of that training.  If conversion to the new type could be accommodated within the existing infrastructure, then time-lines and costs bringing the new type into service would be dramatically reduced for both the OEM and end-user Operators.  

So the OEM management decision was to ‘hide’ the MCAS within the existing auto-pilot as an auto-stabilization element (which, in effect, it indeed was).  As a result, it was not documented in any detail anywhere – not in the Pilots’ Ops. Manual, not in Technical Manuals, nor even in cockpit checklists. This technical subterfuge was so complete that the only mention of MCAS in all of the technical and operational documentation was in the Glossary of Terms at the very beginning of every Manual. (Typically Glossaries, being common to all the various Manuals pertaining to any aircraft type, are kept as a separate computer file).  As such, with all reference to MCAS removed in all other Manuals and Checklists, it appears to have been left in the Glossary by oversight – effectively a “typo”.  Such is indicative that, decisions with regard to the technical strategy of eliminating all reference to MCAS in both technical and operational Manuals and cockpit check-lists, was taken at the highest levels within the company.  In fairness, there is a logic in this regard, in that the automated elements were really very simple and, as long as there was no failure, the system inputs were so deeply embedded in the aircraft’s operating system, as to be unnoticeable. So MCAS was presented as a software ‘tweek’ to make this Max ‘feel’ like its 737-800/900 predecessors, which indeed, was essentially the case. The Wall Street Journal subsequent investigation as to its lack of elevation, advises of a Boeing statement being made to the effect that it was company policy “not to overload Pilots with too much information”!  As a result of this Sales ploy, no mention was made of two simple switches labelled ‘auto-stab.’, that would turn off the MCAS in the event of a software problem.

Rory Kennedy’s Downfall documentary includes footage in a simulator showing what happens when the AoA indicator fails. The effect of the broken mechanical sensor meant that, in maintaining a mechanical vertical, the  pendulum fed an apparent high nose-up input into the FMS computer: such is indicative of a stall. This causes various panel lights to start flashing, the (joy) stick shaker activates, a voice screams “stall, stall !” and the computer brutally shoves the nose down. The flying pilot, seeing that the aircraft was in a normal flight condition, pulls the nose back up manually and the cycle restarts again getting more brutal each time as aircraft speed increases. The non-flying pilot frantically searches through checklists for information – there is none – thus  leaving the crew trying to understand what heck was going on as they loose control of the aircraft in a cacophony of cockpit noise, no doubt further exacerbating matters, resulting in other mistakes. Such is the stuff of nightmares but, as a reality, there was no waking-up in a cold sweat, just a mercifully short screaming panic and oblivion…………  

Actually all that needed to be done was to close the aforementioned couple of normal looking switches labelled ‘auto-stab’ and the MCAS would have been disconnected and the aircraft flown normally. But not only were these switches not documented, they were also tucked away at the back of the center console and so not readily visible. This was stated nowhere in the cockpit checklists. In the USA the information as to the use and location of these switches had passed by word of mouth between crews, and was likely seen as a teething problem with auto-stabilization in a new aircraft type that would soon be sorted out, with the check-lists being amended accordingly at the next update and as such, no big deal. Crews further afield overseas were less well advised. Actually, the pilot that few the Lion aircraft the day before the crash, also had the MCAS problem but, with friends in the US, he was in-the-loop and knew what to do, switched-off the Autostab. and conducted the rest of the 90 minute flight ‘manually’.  On arrival in Jakarta, it is understood that, as is normal, he entered the auto-stab. unserviceability in the Technical Logbook. The engineers no doubt ground tested the system but, with the aircraft being horizontal on the ground, it of course worked normally. That being the case, they would have entered “tested and assessed serviceable” in that aircraft’s Technical Logbook (also a normal, and frequently used, procedure).  So, the unfortunate Indian Captain assigned to the aircraft the next day, inevitably suffered the same problem again but, being out of the US Pilots’ gossip-loop, was not so lucky and nor were his 180-odd passengers and crew!  The recovered Cockpit Voice Recorders shows similar confusion and panic in the final moments Ethiopian Airlines Max some five months later.

Conclusion

In the 18 months enforced down time since these accidents, the B737-Max has been virtually completely recertified by the FAA and the MCAS issue in particular is now fully resolved and properly documented, with pilots being properly trained in its use. The pendulum AoA sensor, through additional software, has now effectively been made duplex. So one may be confident there will be no repeat in future global Max operations of this sorry tale. The same cannot be said for the Boeing company. Their quality management issues in manufacture are still on-going causing 10s of billions of lost revenue, fines, law suites and capital expenditure. In such circumstances, one cannot imagine where they will find funds to develop a new mid-range aircraft design (the NMA – New Mid-range Aircraft) which they so desperately need to compete with Airbus. Indeed the Boeing CEO, David Calhoun, has indicated in an October interview that, for him, NMA has come to mean ‘No More Aircraft’ – at least until there are new engines types capable of offering some 20% in fuel savings.

Such engines are likely be similar to the new open-fan types currently being tested by Airbus on an A380 (see photo.). As such, there is a logic to this decision in that its location on the aircraft may likely be other than under the wing. However, since such power plants will only be available towards the end of this decade, the delay will mean that Boeing will have come up with no fresh design for more than quarter of a century. For much of this century, Boeing and Airbus have split the market between them approximately 50:50. Since the Max-saga, it has dropped to less than 40:60 in Airbus’s favour. For Boeing to not produce a new aircraft type for a full human generation will increase the negative impact on this balance, which will be further exacerbated by the fact that a whole generation of Boeing engineers will have had no experience in the field of commercial new aircraft development. 

This is while Airbus are busily developing new generations of airliners with hybrid-electric or hydrogen power plants. So 10 years hence a 30:70 split is not unimaginable. The June announcement of the intention to move of the Boeing corporate HQ from Chicago to Washington DC, is indicative of a Boeing acceptance of this and a shift of company focus to government military/space projects.

But, notwithstanding one’s harsh review of this recent scandalous history, the author of this piece, where possible, will always choose to fly in a Boeing over an Airbus. Why? Because, as stated in a former flight control essay (PFT-2 in Sepetmber’22), with the exception of the B-787, Boeing aircraft are flown by Pilots, while the more advanced (Fly-by-Wire) Airbus types are flown by a computer. Before one is sued for the publication of such an opinion, let it be said this is a subjective choice is based on no (accepted) objective evidence and hence, is solely a function of this Author’s personal lack of digital empathy – a peccadillo for sure, but one that is shared by many other analogue folk!  

The B737-Max Saga – A Technical or a Management Failure ? – Part 3

The B737-Max Saga – A Technical or a Management Failure ? – Part 2

Summary – In previous articles we discussed automated flight systems in general. In this series of three articles we examine in detail a nominal systemic ‘tweek’ in the flight automation by Boeing of their dominant 737-series regional airliner which developed into a major scandal. Boeing is as synonymous with commercial aviation as Bell is to helicopters. They invented the quality systems on which ISO-9000 is based. So, how is it that they appear to have lost the plot in this regard? It is a long story. In the first part we gave a brief history of the first 100 years of the Boeing Flight Company, its designs and how it achieved total dominance in the commercial Airliner market. In this part we examine how, by failing to compete with Airbus technical innovation, Boeing lost their market hegemony.

Part-II:  The King has no Clothes – Tail wags Dog

In Part-1 of this history we saw how over a couple of generations, aviation in general, and the Boeing Company as a leading protagonist, evolved from the excitement of technical advancement into an investor driven industry. (In passing it is interesting to observe the parallel in today’s nascent Space industry).  So it was that, post-merger with McDonald-Douglas, the bean counters of MD assumed control over the joint venture with Wall Street accolades being prioritized over technical innovation. In fairness, from a purely financial perspective, with the merged Boeing Company having total market dominance in latter half of the Century, there seemed no good reason for the company to make the additional investment to match the technical innovation focused in a new European start-up, Airbus Industries. Having successfully castrated the Anglo-French Concorde, a technical last-gasp, this subsequent flabby political response with a gargantuan bureaucracy, formed in an attempt to halt the European brain drain of fading aviation expertise into the dynamic and now dominant US market, was seen as no threat. However this Newco, with no technical ‘baggage’ and deep governmental investor pockets, allowed the managing technicians to deploy state-of-the-art technologies in their new Airliner designs. For a score of years, as the new company felt it’s way and its first design, the A300 wide-body jumped the hurdles of certification, this had no impact on commercial aviation and so remained no threat to Boeing as the dominant airline market controller.

But, at the turn of the century, when the state-of-the-art and highly efficient A320 family entered service and soon dominated, the now rapidly growing narrow-body market, this swiftly changed. Suddenly faced with these cost-effective regional designs and the A330 to 380 impacting the long haul market, Boeing found itself competing against them with 1960/1970s designs – the B737-series and B767-series respectively. Neither was a match for the state-of-the-art Airbus competition as the table below of wide-body performance demonstrates.

In parallel, within the Boeing corporation, the gulf between engineering and management was similarly growing, exacerbated by the latter moving out of Seattle into new offices in Chicago in 2001. Whereas before in the Boeing family, management and marketing spent as much time chatting on the factory floor as in the office, after the move, the process was rare and more formalized.  Over the years, production targets were consistently increased as were expected sales margins by decreasing production costs. This latter was, in large part, focused on manpower reductions, certification limitation strategies, reduced quality control (QC) and minimizing pilot conversions.  One measure of this parsimonious attitude was clearly evidenced in the QC process whereby the number of inspectors on the factory floor, according to a documentary by Rory Kennedy (Downfall – the case against  Boeing – 2021), was reduced from a score to just one per shift.  

A/c Type

LOA (ft)

Max. Range (km)

Max. Pax     (1 Class)

Total Sales

Boeing 767-400ER

201’

10,415

375

1346

Airbus A330-series

238’

13,450

440

1759

Clearly knocking out more aircraft each week (up to a dozen) with less of everything, instilled an atmosphere of stress in the culture and practices on the factory floor and this is now evidenced in virtually every major Boeing program. In addition to the 737-Max saga, poor program management is evidenced in the 777-X being years behind schedule, 787 production having been on temporary hold due to QC standards and certification issues, the USAF new generation (B767-based) KC-46 aerial Tanker’s experiencing a very messy and delayed acceptance into service and, in space, the Starliner spaceship’s hugely delayed first launch. The common cause would appear to be corporate penny-pinching, and this is a probable root cause of the most recent B737-Max outrage as Part-III will show.

By any standard, the B-737 series is a very successful mid-market aircraft with more than 10,000 units thus far built over its 50-year life-span. During this time-frame, by incremental hull stretches and engine growth, the 737-series range and payload have been cost-effectively more than doubled. In the widebody sector, the B747 Jumbo Boeing dominated the trans-oceanic routes. Overland, the only serious competition to its B767 wide-bodies were other US iterations such as the MD DC-10 and Lockheed Tristar. As stated, the Airbus was a European political response to this US market hegemony which it was only able to chip at in incremental steps, initially in Europe and later in Asia until finally winning over a US major, American Airlines, now with the world’s largest A320 fleet of more than 450 units.

So it was that, atypically, over a score of years this political feature of market interference proved prescient as, with easy access to cheap government loans (all of which have since been fully repaid with interest), the bold Airbus designs and technical innovations successfully challenged Boeing dominance and particularly in the narrow-body market. The core of this challenge lay in the operating cost-efficiency of Airbus designs which was realised, in the main, through just two main elements. Foremost was the wing design and later the engines. The rest of the aircraft that the wings lift and engines power, has little impact on the cost-efficiency of its performance, until most recently, the hull weight reduction through the recent use of composites thus increasing payload. But since Boeing and Airbus use the same engines to power their designs, the secret of Airbus’s success lay in its aircrafts’ profiled wings.  

An aerofoil (wing) at a positive angle of attack (a) to an airflow, creates a pressure differential between the upper and lower surfaces and hence, a lift force (L). The greater the airflow (ie. aircraft speed) the greater the lift. When equal to an object weight (W), it flies. With the Lift force being at 90° to the aerofoil axis, the positive a generates a reverse force, Induced Drag (ID – in orange in the diagram). Inevitably, the larger the a, the higher the ID. Airbus benefited from billions of design dollars of British wing profiling (based on those of gliding sea-birds) minimising that ID. The less the ID, the less the fuel burn. A measure of the success of this design was demonstrated by an A330 wide-body which, on loosing both engines at 40,000’ over the Atlantic, glided some 650 miles to land safely in the Canaries.

This advantage is further accentuated by a new generation of highly fuel efficient, by-pass engines.  Before the Max., the B-737 had neither. This was a factor of the very low ground-clearance of the 737 wing imposing severe engineering challenges to accommodate the significantly larger by-pass engine designs. As a result the then current generation Boeings (737-800/900) were no match for the competing Airbus types (A320NG and A321)

As can be seen from the table on the right, the bypass engines on the A320/321-neos increased the former incremental advantage of the Airbus over its Boeing equivalents (B737-8/9) into a substantial one.  Until this point, in terms of market impact, Airbus had largely been playing catch-up: because of these technical advantages, around 2015, the roles were reversed (see below).

A/c Type

LOA (ft)

Max. Range (Nm)

Max. Pax     (1 Class)

Seat Pitch/Width

In-Service Date

Boeing 737-800

138’

2950

211

28” / 16”

1997

Airbus A321

146’

4000

244

30” / 18”

2000

Boeing

737-Max.8

138’

3550

220

29” / 17”

2017

This called for a completely new Boeing design and such was proposed by engineering (staffed mostly by Boeing folk) shortly after the turn of the century. However, the multi-billion dollar proposal was deferred by corporate (now staffed mostly by MD folk) which opted instead for the multi-$100 million upgrading process. In large part this was due to the parallel need to prioritise a wide-body replacement for the B767 which was the B787 Dreamliner. This was the first Boeing aircraft to match the low drag profiled wings and computerised Fly-by-Wire (FBW) technology of their Airbus nemesis. While in production some 4 years ahead of its main Airbus rival (the A350) it was nonetheless years behind schedule and billions of dollars over budget (and ultimately outmatched by the later Airbus).  

So there was, and remains, no money available to deign, build and certify a new mid-market aircraft type, so Boeing were forced to opt for yet another upgrade of the 50 year-old 737 base-line design. In the short-term this proved a commercially astute decision with Boeing holding its own in the numbers game and being a lot more profitable overall than its rival. But the technical gulf between the Boeing and Airbus types was growing until, some 10 years ago, the bypass engines of the A320-Neo and 321-XLR series made it almost overwhelming.  So a way had to be found to fit the modern, and very much larger, by-pass engine to this old design. The problem was that the older engine types already only had a 19” ground clearance. So, as shown below, rather than locating the new engine under the wing as in the original classic designs, the bypass engine had to be moved forward of the wing so that it could be lifted higher off the ground.

Fig.2 – Cause and Effect – Boeing vs. Airbus narrow-body sales

              B737 power plants  –  Classic series.                New generation series with 19” ground clearance.         Max-series, way forward of the wing

But moving the power plant forward impacted the Centre of Lift such that, at high power settings (typical when taking-off), would push the nose of the aircraft up with risk of stalling. That would require use of the elevators in the tail empennage to push it back down again which among other things, creates additional drag thus decreasing fuel efficiency (thus obviating the whole point of the exercise!).  The answer was to put a small tab on the elevator and to automate the process so as to catch and correct the nose-up movement at an insipient stage – that was the main function of MCAS (Manoeuvring Characteristic Augmentation System). The idea was to also make the aircraft fly and respond like the older 737-800s which had been sold in very large numbers: this the MCAS also successfully did.

So the Max sold like hot cakes with some 5000 orders before the first unit had even entered service in Indonesia with Lion Air (which was also the launch customer for the former B.900-ER and also one of the largest operators in the World of that series). With Lion also diversifying into Airbus A320 options, this was a major coup for Boeing.  But, the Sales department efforts to make the Max appear as an upgrade to the -800 series (so that pilots could more readily convert), rather than the new aircraft type it really was (requiring full certification and more onerous training), lay the seeds to the subsequent Max accidents. In Part-III, the germination of these fatal seeds will be followed in detailed slow motion.

 

The B737-Max Saga – A Technical or a Management Failure ? – Part 3

The B737-Max Saga – A Technical or a Management Failure ? – Part 1

Summary – In the previous article we discussed automated flight systems in general. In this article we examine in detail a nominal systemic ‘tweek’ in the flight automation by Boeing of their dominant 737-series regional airliner which has developed into a major scandal. Boeing is as synonymous with commercial aviation as Bell is to helicopters. They invented the quality systems on which ISO-9000 is based. So, how is it that they appear to have lost the plot in this regard? It is a long story, so we shall do it in three parts, starting with the historical background leading to the Boeing Max-series development.

Part-I:  Boeing Aviation Company – from Child to Man

To understand the tragic 737-Max saga, it is fruitful to go back a Century to the very beginning of Boeing Company to get a truer perspective on the recent events.  So this article starts with a brief history leading up to the Max’s production before analysing the elements of the scandal itself. The Boeing company’s origins in Seattle were not in aviation but in lumber and cabinet manufacture, as a family firm owned by William E. Boeing.  

As a hobby Bill Boeing learned to fly and owned his own single seater trainer. Then, with a navy buddy, Lt. Conrad Westervelt, in 1916 they built a two-seater ‘B&W’ Seaplane to fly off Lake Union nearby. Through Conrad’s connections, the US Navy showed interest in it, so a second improved unit was built and the Boeing Aviation Co. was formed to manage it. The prototype was named Bluebell and the second one Mallard. However the Navy sale was not consummated and, ultimately, both units were procured by a flying school in New Zealand which was training pilots for the Great War. Post-war the aircraft were hired by the Royal Mail in NZ for express deliveries during which time the aircraft achieved an altitude record of 6500 feet.

Such suggests that the B&W Seaplane was a solid design, as reflected subsequently in the technical excellence and enthusiasm that became the DNA of Bill Boeing’s Company. Early in the 1929 Depression the company merged with a half dozen other aviation companies, including Pratt & Whitney, to form the United Aircraft & Transport Corp. A few years later, this was dissolved by government decree into three elements – United Airlines (operations), United Technologies (Technology development) and Boeing (Aircraft manufacture), all of which continue to this day. 

Replica of ‘Bluebell’ the first Boeing aircraft – the B&W Seaplane –

at the Museum of Flight in Seattle

Until WW-II, it was typically Europe that provided the lead in aircraft development with the USA generally optimising those designs and their manufacture. The French built the first production mono-plane (the Nieuport Fighter), the Brits developed the first jet engine (the Whittle in 1933) and the Germans with the first jet aircraft (Heinkle-178 in 1939) as well as rocketry (V-I in 1944). The first mass-production jet was the British Meteor bomber (March 1943): the first US jet was the Bell XP.59-A (1942) powered by Whittle engines built under license by GE.   

Similarly, it was the 1930s British Avro, Vickers and Handley Page medium-heavy bomber designs, which evolved into the Wellington / Lancaster bombers and more importantly, across the pond, formed the basis of the Boeing B-17 ‘Flying Fortress’ heavy bomber – actually an early Boeing technical disaster. Rather than through any incompetence, this was a factor of their technical enthusiasm for stretching the norms of aviation technology. The B-17 was the largest, the fastest, the highest flying and with the biggest payload in this class – all far exceeding all the parameters of the military RFP (Request for Proposals) as issued by the US Army Air Corps (the predecessor to the USAF) in the late ‘30s and to which the B-17 was the Boeing Company response. As such it was also technically, significantly more complicated. So it was that, during a display to the client, the prototype crashed due to elements of the start-up checks having been overlooked, killing the Boeing Chief Test Pilot and an Airforce General – the head of the procurement committee – flying as a passenger in the Co-pilot’s seat. Not surprisingly, the first contract for 200 units was thus awarded to Douglas (the predecessor to MD), at that time, Boeing’s main rival. The enduring result of that crash was the birth of the aircraft check-list. Not surprisingly, subsequent contracts went to Boeing and ultimately, more than 12,000 B-17 units were built.

The growth in aviation sophistication and capability engendered by the needs of global warfare led to the first jet Airliner (the British Comet-1952) which, after a series of fatal accidents due to metal fatigue, in 1954 was grounded. In the years it took to find the root cause (square windows) and to change to the current oval design, the following Boeing Jet Airliner (the iconic B.707-1957) was able to catch up and subsequently dominate the market. Bill Boeing, unfortunately, passed away shortly before its maiden flight, so he did not witness the fruits of a lifetime of innovation. But the Boeing Company never looked back, dominating world aviation for the next two generations – although again, by stretching aviation limits, the very large B-747 ‘Jumbo-Jet’ (1969) did come within a whisker of bankrupting them.

Beauty and the Beast – an unhappy ending

A most significant event in Boeing’s subsequent history was the 1996 merger with it’s former rival Douglas – now McDonald-Douglas (MD). This was a function of a so-called ‘Last Supper’ in Reagan’s White House, where it was decreed that the dozen US aircraft manufactures should be reduced by half. Due to the MD widebody iteration, the DC-10, being significantly less successful than the Jumbo, MD was financially the weaker partner in this merger. Accordingly, Boeing was the lead with the merged entity assuming its name.

Having begun as a hobby-venture, even as it grew, Boeing it never fully lost that ethos. It was a family firm with  technological excellence in its DNA – there, the engineers were king. The MD culture, however, was one of corporate bean-counters with shareholder value rather than engineering excellence being the foremost core-value. So, not surprisingly, within a couple of years, the junior partner had assumed control. This led to cultural changes within Boeing which are the likely root cause of its current technical problems

Flight Automation – what you really don’t want to know

Flight Automation – what you really don’t want to know

Summary – as this technology advances and nominally improves, even where man remains  ‘in-the-loop’, he is less and less in control.

It’s no good winging about it.  In all forms of transportation, natural intelligence (manual skills) will soon be ‘out’ and artificial intelligence (nerdie skills) with full automation will be ‘in’. There is no question of ‘if’ – just when (the Author’s guess, in 10-15 years). How often in a day does one feel frustration and stress at the failure of digital systems that impact our lives? Now lift them 15 km into the air and the impact is exponentially greater. This is an opinionated review on the need for concern in this regard (Note – the views are personal to the author alone).

Actually, in aviation (and astronautics) automation is a very mature technology. The author first flew in a fully automated helicopter some 50 years ago. Space ships have always been almost fully automated – Yuri Gagarin in the Sputnik in 1959, did not have any controls to touch !  In a general context there are three levels of automation.

The simplest are Pilot-Assist technologies, otherwise referred to as auto-pilots. All commercial aircraft have this aid. It has been around for longer than the biblical three score years and ten. The automation is limited to the maintenance of height, heading and speed, and more recently, aircraft attitude. In addition, the engine responses to Pilot power demands are now also fully automated. But, on airliners (sic Fixed Wing) thus fitted, using hydraulic assisted controls (power steering if you will) the pilot remains in full control of the aircraft and can over-ride the automated elements at the flick of a switch and fly it manually. For Helicopters (sic Rotary Wing), the same is essentially true but limited to the aircraft’s guidance – it’s stabilization (whereby any control movement in one dimension impacts control in the other two) is a more complicated issue as discussed in the previous feature under the heading of ‘Safe but not Sure’. This latter can be switched-off but few of the current generation of pilots have flown unstabilized aircraft and would find themselves juggling to maintain level flight, so it is generally left on. (The author’s generation learned their trade on unassisted aircraft and so instinctively had to develop the necessary coordination and so have no problem in this regard).

Cockpit automation – ‘archaic’ Computer Assisted  vs. cutting-edge Computer Controlled

Then there are automatic flight control systems (afcs) with man-in-loop. These aircraft are flown by computers with pilot inputs. There are separate programs for take-off, climb, cruise, descent and landing – in truth to fly from A to B, highly paid pilots need do nothing more than enter a flash-drive with the flight plan into a computer port in the cockpit and select the 5 buttons that run these programs. All these aircraft use Fly-by-Wire (FBW) control input technologies – and here is the scary part. The so-called ‘joy-stick’ that pilots have traditionally used to fly aircraft, is replaced in FBW aircraft with a dinky side-arm controller (see right-hand photo). This is actually not a control at all – it is a computer mouse. As such, any control movement (say to turn left or right) is no more than a mouse telling the computer what the pilot wants the aircraft to do. Unlike with the above hydraulic control systems (left-hand photo), he has no direct access to the control surfaces. Indeed, neither does the aircraft computer. It just sends a digital signal to an analogue sub-system at each control surface which then drives an electric motor to move it as required. So, a pilot may be ‘in-the-loop’ but he is no longer ‘in control’ and can do no more than monitor the computer performance.  Were it to fail, there is nothing he can do except to scream “Mayday, Mayday” on the radio and into the aircraft intercom to “brace-brace-brace”!  He cannot switch off the afcs and fly it himself (as in the above autopilot) because he has no access to the control surfaces.  (Incidentally, as an amusing digression, why scream “Mayday”?  It’s those frogs again who just will not accept that international speak is now in English. In the 1920s when aviation was maturing, the language of international diplomacy was still French. It took the late arrival of the Yanks in two World Wars, for it to be changed to English, so that they would better understand what was going on…..! But with international civil aviation being based in Montreal (a francophone town) that linguistic aberration lingered on: hence m’aidez, m’aidez – help me!!  (Zat accen’ has always been a challenge for we anglophones…………).

The one exception to this is the modern airship (known as a Hybrid Air Vehicle – HAVs) which, using a combination of gas-lift and aerodynamic lift, are very large (some 100m in length and almost 20 stories high). They also use the same afcs principal except using fibre-optics (fly-by-light – FBL) instead of electrical wiring (FBW). Essentially they are very similar but FBL allows some 10 times the data rate. Because of its huge size, in the HAV there is the space (and lift) to put in a duplicate system allowing the pilot mouse (side-arm controller) to directly access the analogue actuator and messily get the gargantuan balloon back to base in the event of complete afcs computer failure.  Airliners instead have duplex critical sub-systems, triplex safety-critical systems and five computers. It is thus very unlikely to go wrong, but that is not to say it ‘never’ fails.  It has so on several, but not frequent, occasions and each time everyone died. However with a frequency of such event being very small (less than the regulatory standard of 0.002%), it is correctly perceived as an acceptable hazard – after all, every day folk use their cars where there is almost a 0.1% chance of a major incident.

Nonetheless, the thought that the so-called man-in-loop cannot actually assume direct control when computers cease to properly compute, is scary. A nice anecdote demonstrates this lack of pilot  control. In a demonstration to client airlines of a new type of FBW airliner by a senior test pilot (ie a guy with vast experience), he decided to end the demo with a very low, high speed pass (as one does on such occasions). It was impressive not least because he over-cooked it and realised he was going to have a problem clearing the trees at the airport perimeter. So he slammed the power controls fully forward and heaved up the nose – except the aircraft responded to neither. His dinky side-arm controller could only tell the computer what he was seeking to do to not hit the trees at the end of the runway but the computer (which could not ‘see’ the looming disaster) knew better. Realising that to fulfil the (Chief) pilot’s demand would overstress (and damage) the engine and airframe, the compute opted instead to increase engine power and use control movements that would stress neither. The result was that the aircraft clipped the tree-tops, filling the engines with scrub (thus writing them off) and seriously damaging leading edges of the wings to say nothing of the hull the paintwork. Fortunately the only casualty was a bruised pilot ego and a few millions of dollars of repairs (which the subsequent sale of many aircraft to the very impressed client airlines, fully compensated!!).

From this it can be seen that the next step, to fully automated passenger aircraft with no man-in-loop (ie unmanned aircraft), technically speaking, is incremental – the main issue preventing this change is not one of technologies but simply a matter of perception. Even if pilots can do very little to control a FBW aircraft, not having one (indeed two) up-front would not be good for ticket sales. In the military, the remote piloting of long range killer drones all over the world controlled from a hangar in California is now well established. Airliners may eventually follow, ultimately with a single pilot sitting at an airline HQ, from where he could control multiple aircraft. After all, in the cruise, automated vigilance will suffice – only for brief periods at take-off and landing will dedicated pilot surveillance be required. What will he do if something goes badly awry? Probably exactly the same as those today in any FBW aircraft cockpit – issue a mayday and politely invite the unfortunate passengers to brace themselves for the final curtain – then, no doubt, go to a bar to console himself.!

The driving force for this change will be the new generation of E-Vtol Tupperware, so-called, air taxis (in the AMS view a technology bubble which will burst in a year or two and about which we will also write soon). Notwithstanding their small size and limited Pax. payloads, their automated flight profiles are similar to any airliner, but in a much more challenging flight environment. Bubble or not, these platforms will be required to achieve the same level of certification as a 400-seat airliner (called ‘Transport Category’).  Once they have done this, the door will be opened to the full automation of the airliners themselves. Hence our guess that such is not more than some 15 years away……

Space ships have almost always been thus full automated – although the Apollo-series of moon landing fame maintained a man-in-loop capability (which was lucky as, on the big day in 1966, it soon became apparent that NASA has got it wrong and Neil Armstrong had to land the Eagle module manually, which he miraculously did with just some 10 seconds of available fuel remaining !!). Today we watch in awe as space ships do increasingly amazing things both in earth orbit and to the very edges of the solar system. But the fact is that, being subject only to the simple principals of Newtonian laws of motion established some 400 years ago, space ships are far easier to control than aircraft operating in the unpredictable atmospheric conditions on Planet earth. In space, there are just two main forces – one generated by man-made power plants and the other gravitational pull. These can be calculated to the micro-Newton and never change thus making precision control, almost literally, childs’ play.  (Helicopters, as you may have seen in the last dissertation, are anything but……!).

Conclusion – based on media prognostication, full automation is typically presented as a futuristic projection, but in aviation (rather than the automotive milieu) it has effectively been there for a generation or more.  The technologies are fully understood as is the reliability of computers – we each have our own experience in that regard !!  But, as stated in earlier essays, notwithstanding all the negatives highlighted above, the chances of a flight accident are minimal. Travel on roads is significantly more dangerous. So take a deep breath, double your beverage of choice and sit back, (try to) relax and enjoy your automated flight………!!

Helicopter Flight – safe but not sure

Helicopter Flight – safe but not sure

fulfilling a unique and invaluable niche in remote area logistics, helicopter flight defies gravity and mechanical practicality and yet are surprisingly safe. This is how they work

Helicopter Flight – safe but not sure

Helicopter Flight – safe but not sure

Travelling through any medium, an aerofoil with a positive angle of attack ‘α’ with respect to the horizontal, will cause a medium deceleration below the aerofoil (thus increasing pressure) and an acceleration above it (thus decreasing pressure). The pressure differential generates a lift force. The amount of lift generated  depends on the size of the aerofoil, its speed through the medium and the density of that medium. When the lift generated by the aerofoil is greater than that of the body to which it is attached, that body will rise. Let us start by looking at each of these elements impacting lift generation.

Medium Density vs Aerofoil Size – the baseline properties of solids, liquids and gasses are very similar. Almost every substance has the three states. The change in state is a simple function of atomic vibration. The level of vibration is a dynamic of energy.  Available energy is a factor of temperature.  At Absolute Zero (-278°C), atomic vibration ceases altogether so (typically) everything is in a solid state. As the temperature rises, energy levels increase and with it atomic vibration, causing a decrease in substance density and the associated changes in state (solid > liquid > gas). In higher densities, aerofoils are more efficient. So in liquids it only requires a small aerofoil (of a couple of meters) to lift a 300 tonne hydrofoil out of the water while, in the lower density of air, to lift an equivalent aircraft, it requires an aerofoil (wing span) of more than 50 meters. Air density similarly varies with temperature. So, in cold climates aerofoils are more efficient than in tropical climates, which has a fundamental impact on aircraft operation.

As one would expect, the way aerofoils work on aeroplanes and helicopters is exactly the same: what differs is the way the causal airflow is generated. Aeroplanes have fixed wings and so need a very long straight road (runway) to get these very large and heavy trucks up to a speed of some 200 km/hr where the lift generated by its aerofoil equals its weight and it flies. Helicopters are more subtle, generating the airflow to realise the required lift by simply rotating the aerofoil blades at some 2-300 rpm. The larger (heavier) the helicopter, the larger the size and number of its aerofoils (blades). The biggest chopper in the world is the Russian Mi-26 with roughly 100 tonnes of Lift provided by 7 huge blades – and that must be somewhere near the limit of what is possible.

So, returning now to the impact of temperatures on aircraft operation. Increasing temperature increases atomic vibration thus reducing air density and decreasing the lift generated by aerofoils at any given airspeed.  The operational impact of this is significantly different for fixed and rotary wing types. For aircraft with fixed aerofoils (wings) increasing temperature is of little consequence as all one needs to do is go faster to generate the required lift, thus requiring a longer runway to achieve lift-off.  For rotary wing this is not always an option: where a runway is available they can mitigate the reduced lift with increasing temperature in the same way as aircraft with fixed aerofoils by doing a running take-off. But in the absence of a runway – operating from helipads – they have no option other than to reduce the aircraft weight to get it off the ground, typically by carrying less passengers and cargo (rule of thumb – a reduction of 100kg for every 10°C increase). Hence, in Fixed Wing operations, weight calculations tend to be more casual while for aircraft using rotary wings, every kilogram including fluids, fuel and even pilot bulk is accounted for to the point of paranoia!

And then there is the mechanics relating to the aerofoil types. By definition, aircraft with fixed wings are simple with aerofoil length and lift being (essentially) linear: not so for the rotary types.  For α start, airspeed at the inner end of a rotating aerofoil is very much less than at the tips, so the generated lift is anything but linear. This is complicated further by the fact that as a rotary wing aircraft moves forward, the advancing blade will generate a great deal more lift than the retreating blade. This is to the point that above some 60 km/hr, the difference is enough to flip the aircraft over. The only way to compensate this is to reduce the ‘α’ of the former and increase it on the latter. Given aerofoil (blade) weights of some 200kg and rotations of some 300 rpm this makes for complex and robust mechanics and explains why it took more than 50 years after the first fixed wing aircraft staggered off the ground, for an equivalent brief flight to be realized using rotating aerofoils.

Then there is the need to compensate the inconveniences engendered by Newton’s Laws and particularly that whereby action and reaction are equal and opposite. So significant is this that one ton of rotating aerofoil at 300 rpm will cause the 4-ton aircraft to which it is attached to rotate at some 75 rpm in the opposite direction – while good for training astronauts, such is unacceptable for normal folk. Hence the small fan put at arms length at the back of the aircraft (the tail rotor) to counter that effect. This all results in the need for multiple sets of complex mechanical devices on rotary wing aircraft which, although Safety Critical, are a simplex installation (typically a ‘no-no’ in electro-mechanics) – any failure is thus always catastrophic and fatal. Such risk is not further mitigated by the need to combine the nominal opposites of robust reliability with lightness of structure.  It is a very real measure of man’s ingenuity that this ‘mechanical oxymoron’ has, in the main, been achieved.

No sweat – with thanks to Captain Ed Cooke

No sweat – with thanks to Captain Ed Cooke

And pity the pilot…… Due to said Newtonian Laws, a change in any one rotary wing parameter – airspeed, ‘α’, direction or power – and all the others have to be corrected to maintain the stability in flight. Simply stated, while airplanes with fixed wings naturally want to fly, those with rotating wings are defying nature and do not. As such, any disturbance in the delicate balance of mechanical forces in the latter and it will cease flying, immediately and disastrously! So, while pilots in fixed aerofoil aircraft, once airborne, can relax, those in rotary types are typically brooding anticipators of impending doom.

So, does this mean helicopters are essentially unsafe ?  Certainly they are less forgiving. Users must take nothing for granted, be disciplined in following procedures and respect nature. While fixed wing aeroplanes can usually ‘punch through’ bad weather and get above it, Helicopters, in the main, have to live within it.  And with the complexity of its mechanics, there is so much more to go wrong in an helicopter, so they tend to be less reliable. A measure of this is that for every hour of flight of a helicopter, there needs to be some 12 technician man-hours on the ground, while typically this is only three for fixed wing. But that said, as a function of its fixed wings, an aeroplane needs to travel very fast to maintain controlled flight so, when things go badly wrong to the point that control of flight is no longer possible, they return to terra firma at fast and furious speeds leading to considerable destruction and high fatalities. Helicopters on the other hand, in the event of complete power loss will experience a slow and undramatic return to earth such that, where the terra is firma and not liquid, passengers may even be unaware that there has been a failure except for the fact that the arrival point is not that desired.

In short, while aircraft using rotating aerofoils are inherently less reliable than those with fixed aerofoils, bottom-line, they are inherently no less benign and even safer.

Back