Imagine yourself flying a B-17 when a German ME-109 runs into you, nearly slicing off your tail. Will the airplane keep together as you configure and slow for landing? (On 1 February 1943 it did.) Now what does this have to do with flying today?
You may need to borrow a page from military aviation: the controllability check.
There isn't a lot written on the subject. When I was in Air Force pilot training, it was a subject from day one because the aircraft were not as reliable as they could have been and we did a lot of formation flying where the chance of a midair collision was always considered. So we talked about how to do controllability checks and every now and then we did them. My only experience with doing controllability checks was while doing Functional Check Flights, and that is a good place to consider the how. But let's first consider the why.
Everything here is from the references shown below, with a few comments in an alternate color.
On 1 February 1943, the 414th Bombardment Squadron (Heavy) was on a mission to attack the port of Tunis. A single-engine Messerschmidt 109G fighter collided with "All American III," a Boeing B-17F-5-BO Flying Fortress, 41-24406. The fighter cut diagonally through the bomber’s fuselage, carried away the left horizontal stabilizer and elevator, and damaged the flight control cables. The B-17 made it to its home base (Biskra, Algeria) after flying for another 90 minutes. None of the ten crewmembers were injured.
The aircraft was repaired and returned to service. It flew until the end of the war, at which point it was dismantled for salvage.
The odds were stacked against this crew, no doubt about it. They didn't have all the information they needed and may have felt a sense of urgency to get the airplane on the ground. But the airplane was flyable. A controllability check would have helped them understand the new flight characteristics of their two-engine Boeing 747 while providing the time needed to reduce their gross weight.
Drawing: El Al 1862 estimated damage to RH wing leading edge, from Nederlands AAR 92-11, figure 4.
This cargo Boeing 747 took off performance limited (they were as heavy as they could have been under the conditions) and had the number three engine take out the number four engine. That cost them some of their flight controls and they definitely had their hands full. And yet they were able to fly for eight minutes, maintaining altitude and heading when they wanted. They began fuel dumping almost immediately. But as they slowed the increasing angle of attack overwhelmed the thrust available and they ended up behind the power curve and outside their roll capability. The Nederlands accident report says, "Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible."
That might be true. But there are a few things we can take away from this:
For more about this accident, see: El Al 1862.
The pilots of Alaska Airlines 261 were given an airplane set up to fail and were heroic in their efforts to save it once it did fail. The stabilizer trim system failed and would have made for a challenging landing. The crew, in consultation with experts on the ground, tried several methods to free the stabilizer which ultimately caused it to break free of its structural mounts, making the airplane truly unflyable. The crew did nothing wrong; it was the mindset of the time to fix what is broken, not to accept the degraded flying condition of the aircraft. But had they ceased their troubleshooting and attempted a controllability check, they may have realized the airplane could have been safely landed.
Figure: The recovered acme screw, from NTSB Report, Figure 12c.
First a few facts: The MD-80 was designed without a fail safe mechanism on the horizontal stabilizer. Alaska Airlines extended lubrication, inspection, and replacement intervals on the horizontal stabilizer on this particular aircraft. A lead mechanic at Alaska Airlines' Oakland maintenance facility reported maintenance short comings to the FAA fifteen months prior to the crash, and was placed on paid leave. As it turns out, over two years prior, he had ordered the horizontal stabilizer jack screw on this aircraft be replaced. His recommendation was overruled by the next shift. The aircraft was put back into service, its next overhaul would be in two and a half years.
On 31 January 2000, the pilots flying this airplane at first experienced a jammed stabilizer. They accomplished the appropriate checklists and ended up with an airplane that was barely controllable. The horizontal stabilizer jack screw was bare of any lubrication and the threads had been ground off. The stabilizer would not budge. There were no procedures on what to do next and the pilots thought a successful landing was in doubt. They elected to use primary and secondary motors to free the stabilizer. This moved the stabilizer free and dislodged a retaining nut on the stabilizer. The stabilizer moved violently enough to completely dislocate the jack screw. The airplane entered an uncontrollable dive and all were killed.
Given all that, the pilots did what they could and in accordance with their training. But what if, after they had gone through all of the trouble shooting procedures had they decided to attempt to land the aircraft with the stabilizer frozen? A controllability check could have given them the confidence to attempt the landing and not risk repeatedly activating the trim motors in an attempt to free the stabilizer.
For more about this accident, see: Alaska Airlines 261.
Not all flight control problems are mechanical, especially if you are flying an Airbus. Captain Kevin Sullivan was flying an Airbus A330 that came out of the factory with a computer design flaw that would only occur in a very rare set of circumstances, but those circumstances meant he no longer had any control of the aircraft until the computers decided they had messed things up. He brought the airplane in for a safe emergency landing after flying a controllability check. Knowing the aircraft could be configured from a safe altitude gave him the confidence to attempt the landing off a controlled, 3-degree glide path, fully configured.
The Airbus A330 was designed to give priority to the computers over the pilots when it comes to deciding what to do with the flight controls, with the aim of preventing pilot error. It works pretty well, except for when it doesn't. In the case of Qantas Flight 72 on October 7, 2008, the errant computers nearly dropped a perfectly flyable airplane into the Indian Ocean. A level headed captain with experience as a U.S. Naval aviator saved the day. Among the many tools in his arsenal was a controllability check.
I asked Captain Sullivan about the controllability check and he was unequivocal about its importance that day. "For the QF72 accident, our electronic flight controls were operating at an unknown level and I had serious concerns as to their veracity and my level of control, especially close to the ground. Two uncommanded pitch downs with no amplifying information from ECAM meant we were in unchartered territory, so the control check confirmed flap operation and appropriate control stick response, at altitude, prior to landing."
For more about this, see: Qantas 72.
It seems to me that there is almost never anything to lose by doing a controllability check unless you are on fire, running out of fuel, or perhaps the weather coming down or there is some other time constraint. There are times where doing a controllability check can be a life saver.
You should probably consider doing a controllability check if:
There are times when doing the controllability check is vastly preferable to "ad hoc" troubleshooting.
[B737 NG Flight Crew Training Manual, §8.2] Troubleshooting beyond checklist directed actions is rarely helpful and has caused further loss of system function or failure. In some cases, accidents and incidents have resulted. The crew should consider additional actions beyond the checklist only when completion of the published checklist steps clearly results in an unacceptable situation. In the case of airplane controllability problems when a safe landing is considered unlikely, airplane handling evaluations with gear, flaps or speedbrakes extended may be appropriate. In the case of jammed flight controls, do not attempt troubleshooting beyond the actions directed in the NNC [Non-Normal Checklist] unless the airplane cannot be safely landed with the existing condition. Always comply with NNC actions to the extent possible.
There isn't a lot written about how to do a controllability check, but we can take clues from our objectives and a few other sources.
What are we trying to accomplish? We are trying to get the airplane back on the ground in one piece and in order to do that we need to:
(Some aircraft land better gear up than with some combinations of main and nose gear. Finding out early may give you a chance to try alternate methods of gear retraction or, if that fails, retracting the gear to a more favorable combination.)
(If the flaps move, will they move symmetrically? Finding out early may steer you to another runway or affect the way you fly the approach.)
(If the aircraft starts to misbehave while decelerating to normal approach speeds, you may want to limit your speeds when making your actual approach to landing.)
[B737 NG Flight Crew Training Manual, p. 8.36
What used to be "tribal knowledge" eventually became procedure in the Big Airplane Air Force and perhaps the best example of that is with the C-17 controllability check procedure.
[T.O. 1C-17A-1, ¶3-440] A controllability check is conducted to determine the effect of structural damage, in-flight control malfunctions, airspeed differences, or fuel imbalance, on control of the aircraft. Conduct the check at 5,000 to 10,000 feet AGL, if possible.
WARNING: If control authority degrades rapidly or required control input approaches the limits of authority about any axis, with configuration change and/or airspeed variation, immediately return to a configuration and speed at which adequate control authority is known to exist.
WARNING: The speed must never be decreased to the point at which full control deflection is required about any axis since there may be no recovery capability beyond this point. This can occur with no unusual stick or rudder positions since EFCS is applying controls with no feedback to the pilots.
This has always been my favorite warning in any Air Force manual over the years. I once — and only once — found myself at full control deflection in flight and this warning was the first thing that popped into my head when that happened. I think it may have saved me that day.
Looking at a Functional Check Flight manual can show the care and diligence needed during a controllability check. Most business jet manufacturers are reluctant to release these manuals to their customers. The USAF insisted and the C-37 (GV/550) manual offers a few good pointers.
Note that things are done slowly, methodically, and with limits in mind. The biggest mistake I saw with new and inexperienced functional check pilots was the desire to rush things, especially when validating low speed flying characteristics. The Air Force manuals during my time doing these things were written to require decelerations no faster than 2 knots per second. This updated manual lowers that to 1 knot per second. I like that better. The critical point for these maneuvers is you are not trying to duplicate a simulator stall event or demonstrate exceptional pilot skills. Your aim is to demonstrate the airplane can fly at the charted stall warning speed. In the context of a controllability check, you only want to demonstrate that the airplane can be controlled for landing. There is no point going any slower than the speed you expect for that landing.
Please note I offer the following not as a narrative on how to do a controllability check, but to demonstrate the deliberate nature of a functional check flight. Everything is done methodically with the eye that if something doesn't go right, the subsequent steps may have to be aborted.
[USAF C-37 Functional Check Flight Manual, pp. 34-37]
For the purposes of a controllabilty check, if you have damage to the wings or suspect you may have problems with the spoiler system, you should consider whether you need the spoilers for the landing. If not, you might be better off not testing them and leaving them stowed.
[USAF C-37 Functional Check Flight Manual, pp. 34-37]
Depending on why the controllability check is needed, you might consider leaving the gear down once it is extended. If you suspect damage to the wing, you may also want to consider limiting flap extension to only as needed for the landing.
250 KCAS – Flaps 10°
225 KCAS – Landing Gear DOWN
225 KCAS – Landing Gear UP
220 KCAS – Flaps 20°
170 KCAS – Flaps 39°
Landing Gear Warning – No Silence
Extend & Retract Speedbrakes – Aircraft Configuration and Speed Brake Extended messages illuminate
170 KCAS – Flaps 39°
220 KCAS – Flaps 10°
250 KCAS – Flaps UP
I offer the following only to show the pacing of the functional check flight process, especially the rate at which speed is reduced. For the FCF, the aircraft is taken to the point at which stall warning is activated. You should not do this for a controllabiity check. I would go no slower than approach speed and would even consider adding 10 knots to that if landing distance permits.
Clean and landing flap configurations. Note ALT ________ if not at 10,000 feet.
I would not exercise the rudder during a controllability check other than to verify it isn't frozen in one position.
WARNING: Avoid abrupt return of the rudder from full deflection to neutral or past neutral.
Of course the aircraft and the situation will dictate the procedure, but it may help to think this through ahead of time. This is my approach to a controllability check, in a generic situation and aircraft. I've used my experiences as a functional check pilot and the lessons learned from the case studies discussed earlier.
You can check these against your GPS, the altimeter will generally be within a few hundred feet and the indicated (or calibrated) speed should be about 20 or 30 knots higher than the ground speed corrected for wind. You can use this exercise to identify faulty instrumentation.
Start at neutral and look for any looseness.
Using smooth and small inputs, exercise the control and look for any binding and other signs of abnormality.
Look for symmetrical deployment and decelerate to what should be close to a no flap maneuvering speed
The speed brakes should stow symmetrically without any sign of floating
Adjust the thrust to allow the speed to decay about 1 or 2 knots per second, no higher
If at any point the aircraft begins to roll or buffet, discontinue the maneuver, taking note of the speed and configuration
You should use the data obtained from the controllability check to learn which flight control components can be trusted and which will require an adjustment to normal approach and landing procedures. If a higher than normal approach speed is dictated by adverse flying characteristics, be mindful of the aircraft's touchdown attitude (to prevent a nose first landing), and stopping distances.
Keep in mind that you should never find yourself on approach at an airspeed lower than already demonstrated during the controllability check and that you should never find yourself needing full control deflection in any axis. If either event occurs, you need to speed up.
If you've never had a handful of airplane that wasn't behaving as the manufacturer had intended, this might seem to be much ado about nothing. Over the years I've found myself in a part of the flight envelope never discussed during training and certainly not in any of the manuals. When this happens, I assure you, you will be overcome with doubt and will be tempted to second guess every decision you make. The best way to cure yourself of that is to know ahead of time how to do a controllability check.
By now, some of these ought to be obvious. But there is at least one more benefit you may not have considered.
Boeing 737 NG Flight Crew Training Manual, Revision 12, June 30, 2013
Gulfstream Functional Check Flight Manual for the USAF C-37A Aircraft, Revision 3, Dec 30/15
Nederlands Aviation Safety Board Aircraft Accident Report 92-11, El Al Flight 1862, Boeing 747-258F 4X-AXG, Bijlmermeer, Amsterdam, October 4, 1992.
NTSB Aircraft Accident Report, AAR-02/01, Loss of Control and Impact with Pacific Ocean Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, About 2.7 Miles North of Anacap Island, California, January 31, 2000
Technical Order 1C-17A-1, C-17 Flight Manual, USAF Series, 15 March 2006
Copyright 2019. Code 7700 LLC. All Rights Reserved.