In an otherwise unremarkable first six months, concerns prompted by the Ethiopian Airlines Boeing 737 Max 8 fatal crash in early March 2019 have dominated the airline safety debate. That accident has generated industry-wide soul searching, with calls for a re-examination of the way in which today’s new aircraft designs are approved.
The Ethiopian fatal accident was the second of two unnervingly similar crashes within five months involving the same aircraft marque (see accident list). Both crash sequences were precipitated when a new automated control system operated in an unforeseen manner, according to the initial reports of the respective accident investigators. That this should happen twice in quick succession to new, latest-generation airliners has called into question the efficacy of long-established aircraft certification systems, at the very least as practised in Boeing’s home country.
The doubts sparked by the Ethiopian and Lion Air crashes eventually led to the worldwide grounding of the type. The suspension of operations will continue until a technical fix and a crew training regime for the Max’s aberrant Maneuvering Characteristics Augmentation System (MCAS) has been approved.
The predicted date for the type’s earliest return to service is now October, but the US Federal Aviation Administration (FAA) has stated that this is not a certainty. The agency says it does not have a deadline, just an objective, which is to make the 737 Max series safe.
IATA director general Alexandre de Juniac voiced the industry’s concern at the organisation’s annual general meeting in June: “If you are in the shoes of the passengers or the general public, it is difficult to understand why there [was] a progressive grounding – why you have some authorities grounding [the 737 Max] immediately and others are waiting to make the same decision. This type of misalignment – and lack of collaboration and co-operation among regulators – I think it is probably the biggest threat on our safety/certification system.”
Certainly, there is a threat to its credibility, especially when the Max’s lead certification authority – the FAA – was the last national agency to ground the aircraft it had certificated.
Meanwhile, life goes on, and although the number of fatal airline accidents in January-June this year has increased compared with same period in the two previous years, a caveat in last year’s review also applies now: “This appearance of dramatic change is misleading, however. [Although] the number of fatal accidents only increased from six to eight [2017 and 2018 respectively], these totals are the two lowest in modern air transport history.”
Ethiopian Airlines Max 9 aftermath
Mulugeta Ayene/AP/Shutterstock
CONTINUING TREND
This year’s total number of fatal airline accidents is 11, but that has still not reversed a gentle downward trend for the previous decade as a whole. And the number of fatalities for the two six-month periods has reduced from 323 in 2018 to 243 this year, mainly because the majority of the 2019 accidents so far have involved small commuter aircraft, or freighters with only the crew on board.
In some recent years there have been no fatal crashes involving jet airliners, but this year so far there have been four: the Ethiopian 737 Max, the Aeroflot Superjet 100, a Saha Air 707 (operating a cargo charter for the Iran air force) and an Amazon Prime 767 freighter. The remainder were turboprop- or piston-powered regional or short-haul types. Six of the fatal accidents involved passenger operations; the other five were cargo or other non-passenger services.
Among the non-fatal accidents, as usual the largest single event category was runway excursion, mostly on landing.
Every year there are a couple of crashes that, for lack of information, are really difficult to understand, even when a preliminary factual report has been released by the investigators who continue to probe the event. This year, the particularly puzzling accidents involved the Aeroflot SSJ100 in Russia and an Amazon Prime 767 freighter in the USA.
In the case of the SSJ100, it clearly suffered a lightning strike, but the crew did not seem – at first – to have any problems dealing with the symptoms, which manifested as partial electrical failure. This affected various components, but not any primary controls.
But as the aircraft returned to land, the crew seemed gradually to have less and less control over the aircraft, because their handling of the final approach was clumsy and the eventual landing was so hard that the aircraft caught fire. Only a thorough investigation of the aircraft’s behaviour will reveal the nature of its apparent vulnerability to lightning damage – if indeed that is the whole story. The flightcrew survived the accident and their story of the experience will be important in determining what happened and why.
SSJ 100, Moscow
Maxim Shipenkov/EPA-EFE/Shutterstock
The Amazon Prime 767 freighter began a normal descent towards Houston, the only problem for the crew being the avoidance of storm clouds, but air traffic control was helping them by providing vectors around these.
Although cleared to descend to 3,000ft the aircraft, without any explanation, levelled at 6,000ft and even climbed slightly. Shortly thereafter, it was lost to radar. The freighter’s power was advanced to maximum, it pitched up a little, but then began a significant nose-down pitching movement – directed by elevator deflection – until it reached 49˚ nose-down with wings level. Shortly before a high-speed impact with the ground the nose-down pitch was reduced to 20˚.
The National Transportation Safety Board says there was neither a stall warning nor stick-shaker in operation and no communication during the final part of the descent. The event has an ominous feel about it.
Last year, one of the mystery accidents involved a Boeing 737-200 operating for Cubana that was observed to lose control completely soon after take-off from Havana and plunge rapidly into the ground. Cuban investigators have since determined that inaccurate weight and balance information led to the aircraft taking off with the a centre of gravity way outside limits, rendering it uncontrollable in flight.
MAX CONSISTENCY
Amid to the industry debate generated by the Max accidents and referring to aircraft and equipment certification – especially in the light of the existing system of mutual recognition between manufacturing states – de Juniac wants to see consistency worldwide: “We have to be clear on what we think is needed, from the airline point of view, to manage safely the re-entry into service of the aircraft. What we say is we need strong collaboration between regulators, full transparency of the process and total alignment between regulators.”
That sounds like a call for unification of certification regulation worldwide, which de Juniac must know will not happen in a world where Trumpian and Brexit nationalism is the new mood. He added: “If we are heading into a system where you have one certification process per country, that for us would be the worst possible outcome.”
The FAA meets regularly with the other major certificating agency, the European Union Aviation Safety Agency (EASA) and the two work hard – with a fair degree of success – to achieve “harmonisation” of their rules and practices, but harmonisation is not the same as unification. The best de Juniac is likely to see is an opening up of the agencies to scrutiny by each other and ICAO.
What would they find if a cross-auditing practice became regularised? The FAA, as a part of its examination of the MCAS issues with the 737 Max, found another problem beyond the obvious factors seen to be at play in the Lion Air and Ethiopian accidents.
The discovered problem, believed to be a potential microprocessor failure revealed during simulator tests in late June, provided what the FAA described as “a potential source of uncommanded stabiliser motion”. This would cause the stabiliser to pitch the aircraft nose down and recovery action by the pilots would take “seconds”, observed the agency. The FAA was clearly signalling that a matter of seconds is too long, especially because the problem could occur close to the ground.
To understand the dilemmas the industry and its regulators face, it is important to record that Boeing is not uniquely vulnerable to faulty sensor data. FlightGlobal air transport editor David Kaminski-Morrow recently wrote a detailed study of cases affecting Airbus types when spurious air data, or faulty angle-of-attack vanes caused serious incidents. In the case of one post-maintenance test flight near Perpigan, France in 2008 – spurious angle-of-attack data was a causal factor in a fatal crash.
Kaminski-Morrow’s study begins: “Airbus has not been immune to the consequences of spurious air data, and unexpected incidents illustrate the difficulties designers and regulators face in predicting and avoiding unintended aircraft behaviour… Airbus types have experienced serious issues which appear superficially similar to those affecting the Max. But some crucial considerations, centred on the Airbus design and time in service, have resulted in far less disruptive regulatory intervention.”
There are differences from the Max case: for example, the simple fact that the Airbus systems took their angle-of-attack data from three vanes instead of one or two and they had a “voting” system. Since no system is perfect, occasionally two faulty vanes gave the same wrong reading and outvoted the correct one. Mathematically, however, the chances of a faulty angle-of-attack vane compromising safety were considerably lower, and the small number of such cases over such a long in-service period testifies to that.
DIFFERENT STANCE
Airbus’s airworthiness authority, EASA, has not been idle in the face of these occurrences, and perhaps the FAA, at a time like this, could usefully study its approach regarding sensors. Kaminski-Morrow wrote: “EASA describes the high-incidence protection system on the A320 and A330 families as ‘robust’, noting the inclusion of three angle-of-attack sensors, compared with two on the 737 Max, normally enabling voting logic to eliminate a single erroneous reading. [EASA] adds that the Airbus [now] has ‘enhanced’ monitoring and surveillance of the sensors.”
Reflecting on the many potential lessons from the Max accidents, the UK Flight Safety Committee had these observations to make in a recent issue of its Focus magazine, particularly considering how far the 737 series has been developed since its entry into service in 1967: “Is it right that an aircraft with a new fuselage, new wings and different engines is treated as if it is simply an upgrade of the original platform?
“Compared with earlier versions, the stall characteristics that required installation of MCAS on the 737 Max will have been affected by changes in the planform and positioning of the engines. When do such changes become sufficiently significant to require certification to start from scratch? How much stretch or increase in wing area or increase in power is too much where grandfather rights are concerned? And how far can you reduce seat pitch before the evacuation demonstration carried out years before on a different size of aircraft becomes invalid?”
The article aims the same questions at crew instruction, specifically the “differences training” that enables a pilot type rated on, say, the 737NG series, to qualify for the Max series with zero simulator time, and just 4h of computer-based training on a tablet. And the practice of truncating type rating training within a series, or even within a manufacturer’s entire fleet, is not limited to the 737 series.
It is a good thing that the FAA has not set itself a specific deadline for returning the 737 Max to service, because it has important decisions to make. And the world – not just the USA – will be watching closely.
Source: Flight International
