In praise of the Empirical

There’s a lot of people busying themselves and tying themselves up in knots trying to work out how to ensure that new aviation developments fly safely. Making possible the safe introduction of new air vehicles into an already complex system occupies meeting after meeting across the globe.

Advanced Air Mobility (AAM)[1] will mean full time aviation activities in unfamiliar places. There’s a such a complex maelstrom of interacting bits and pieces that it’s not easy to see the light at the end of the tunnel. This is driving innovation and a fresh look at how the business of safety assessment and assurance is done.

Since the first days of my working in an engineering department, I’ve been a supporter of a systematic approach. Over the decades this has paid handsome dividends. I don’t think there would ever have been a civil fly-by-wire aircraft in service if it was not for systematic engineering.

This does require a great deal of characterising and parameterising of measurable items. This is to distinguish, down to a fine level, technical attributes that can be verified and validated. In fact, the concept of verification and validation (abbreviated as V&V[2]) is upheld with almost religious passion.

The emphasis coming from the advocates of AAM is often on flexibility, openness to latest ideas and speed of working. The emphasis coming from public authorities is on maintaining or enhancing existing levels of flight safety[3]. Both are right and bridging the gap is quite doable.

What is most dangerous is to see this equation as purely binary. That is to discard a systematic approach in favour of a more try it and see, empirical approach. Innovation isn’t about throwing away the past. It’s about building on the past. All aviation activities involve safety risk. There are 3 things that can be done with risk: eliminate it, mitigate it, or live with it. To do any of these 3 things it’s first necessary to understand it.

So, I’m putting my finger on the greatest difficulty and that’s anticipating the future. To understand AAM[4] risks requires an appreciation of the combinations and permutations of different interactions that can exist in an aviation system with fast vehicles in dense environments. This is where classical V&V has limitations. It because of the vast, and I mean vast number of different live scenarios that can exist. Afterall the flight operations of AAM are supposed to be wide-ranging and unconstrained.

Hence my title. Not only do we need empirical means of proving systems, but existing means need to be improved. Going off and doing a bit of flying just doesn’t cut it.


[2] These are critical components of a quality management system such as ISO 9000



The case for future media

In my last post, I advocated protected image recording in civil aviation. Its introduction has been long delayed despite a great number of safety recommendations that such recording be adopted. Delays occur but the world doesn’t stand still. Notwithstanding all the worldwide successes of achieving excellent safety performance, fatal aviation accidents continue to happen.

Emerging technologies arrive with faster introduction and adoption in every walk of life. For example, streaming media is growing at a pace far faster than past technological changes. There have been adventurous proposals that all civil aircraft should stream large amounts of data to a ground-based network for every moment of flight. The idea is not so wild. Conventional technology already allows manufactures, like Rolls-Royce to monitor the performance of their in-service aero engines across the globe[1]. The collection of data is paid for by the benifits gained in performance and understanding of the operational life of engines.

Could this be a replacement for dedicated on-board protected accident recording? My answer is: “no”.

Communication technofixes will help provide supporting information and be greatly valued. However, the benefits of protected on-board accident recording are in its incorruptibility and that it can preserve the last microseconds of an event. This is especially true when the event in question has unique attributes or is mysterious in some way.

Before the bombing of Pan Am Flight 103 over Lockerbie, Scotland[2], few had thought of using a Cockpit Area Microphone (CAM) for explosion detection. There were faint noises at the end of the accident recording that needed careful analysis.

The conventional technology we use is rapidly being superseded. Obsolescence is inevitable. Computational speed is increasing, as is memory capacity. So, on-board aircraft systems will be advancing in one way or another. That progress needs to include protected aircraft accident recording.

Telling the story of an accident must be authentic. The means to do it needs to be incorruptible.

Thus, it’s reasonable that a degree of conservatism will prevail. In other words, accident recording equipment should be based on reliable fully proven technology. Adoption of the state-of-the-art may be attractive but extensive proving should be undertaken first.

The need for progress is primarily to improve how lessons are learned. That’s the fundamental. Data recovered post-accident is turned into information that can be effectively used to improve safety. Shortening the time between aquiring data and taking safety action must be an aim.

The industry and the authorities could make a leap forward in protected image recording, in civil aviation by making those images 3-dimensional. Carefully placed cameras can provide a wraparound view of a cockpit in all conditions. Then 3D video recording on replay could provide a virtual reality experience.

Already available, this technical capability could then provide investigators with all the details of an event in 360-degree wraparound virtual reality detail. The post-accident learning possibilities are great. Study and investigation could become an immersive event. A well-constructed and selectively edited 3D views could be used as a training aids. This subject should be researched.



The case for video

Everyone recognises that accident investigation has played a big role in increasing aviation safety. Gathering evidence is a key part of that process. The continuous development of accident flight recorders has, from a basic capability in the 1960s, transformed what can be learnt from serious incidents and accidents. This is true worldwide.

In the days when accident flight recorders transitioned from tape-based recording to solid-state recording the opportunity to increase capability advanced further. Good quality audio, more aircraft parameters and better survivability have resulted.

In 1989, British Midland Airways Flight 092, Boeing 737-400[1], crashed onto the motorway embankment in the UK[2]. Post investigation the safety recommendations included a discussion of external image display[3]. The UK CAA fully accepted the recommendation.

I was part of the research effort that looked at the practicalities of introducing video image display in the cockpit. The ruggedised video cameras available at the time were bulky, expensive, and low resolution. British Airways fitted external cameras to a Boeing 747 classic aircraft as a trial. That system was flown and information gathered from normal operations.

This was an idea before its time. Today, external cameras are installed on several common aircraft types. These cameras make images available to the cockpit for an operational purpose, or to passengers as part of an in-flight entertainment system experience.

The Boeing 777-300 and -300ER can have external cameras fitted. One in the leading edge of each side of the tailplane facing the main gear and one belly-mounted, facing the nosewheel. The AIRBUS A340-600 and A340-500’s can have cameras. Pilots use them for taxying, observing cargo loading, refuelling, parking, and manoeuvring. The AIRBUS A380 has a camera on the tail looking forward.

Despite the acceptance of cameras and displays in numerous places on an aircraft there is no mandatory requirement to record the images that they present.

Internationally, aviation accident investigators are in favour of crash-protected image recording systems. The US NTSB did have a published list of “most-wanted” transportation safety improvements that included a call for the introduction of mandatory cockpit video recorders.

After the loss of Air France AF447 in 2009, the French aviation accident investigators recommended that ICAO require that aircraft undertaking public transport flights with passengers be equipped with an image recorder that makes it possible to observe the whole of the instrument panel.

Some arguments against installed cameras that made sense in an era before the iPhone mobile, iPad and GOPRO camera now seem insubstantial. Commercial off the shelf equipment can provide powerful image display and recoding capabilities. This is in the context of a world where passengers and crew regularly carry mobile devices with high quality cameras.

Today, the inclusion of a crash-protected cockpit image recording system on commercial aircraft is not a radical step.

One argument against installed cameras remains. Those who have been part of a fatal aircraft accident investigation know that the impact of seeing human remains is not to be underestimated. A legitimate concern is that a cockpit video recording, that continues throughout an accident scenario may record the injuries suffered by those covered by installed cameras. In such a case the protection of the accident recordings is a matter of extreme sensitivity.

Should such sensitive recordings be released into the public domain a great deal of harm may be done. Thus, a decision to mandate cockpit video recording must fully consider the special needs to protect the confidentiality of accident recordings. Whereas in the past the means to afford high levels of protection was at the limits of the available technology, now advancements make this possible.

There are both aviation safety and security aspect to cockpit video recording. Aviation accidents are not normally crime scenes. However, disruptive behaviour or hijacking by a passenger or a wilful malicious act by a crew member can be examples of aviation crimes[4][5][6].

There has been a strong objection to video recording in aviation but the arguments against are falling away. Protecting the confidentiality of downloaded accident recordings is vital but it can be done. The technical pros and cons have been explored in detail[7].

Frequent recommendations have already been made on this subject over a decade without significant progress having been made. Surely, it’s now time to act.



[3] 4.19 The CAA should expedite current research into methods of providing flight deck crews of public transport aircraft with visual information on the status of their aircraft by means of external and internal closed circuit television monitoring and the recording/recall of such monitoring, including that associated with flight deck presentations, with a view towards producing a requirement for all UK public transport aircraft to be so equipped (Made 30 March 1990).




[7] CAP 762. CAA Research Project. The Effectiveness of Image Recorder Systems in Accident Investigations.

Flight recorders are essential

Digital Flight Data Recorders (FDRs) and Cockpit Voice Recorders (CVRs) have become essential tools for accident investigation. With the Boeing 737-800, flight MU5735 having been in-service with China Eastern Airlines for less than 7 years there’s a good chance both recorders will help unravel the events leading to its fatal loss.

Accident flight recorders are dependent upon the aircraft digital and audio sources that are acquired when they are operating. Although the recorders are highly reliable in normal operation the sensors that feed them may not be so reliable[1]. For this reason, the authorities have chosen to highlight the importance of a maintenance program that includes the entire recording system[2]. It can be disruptive to an accident investigation if the information available from the recorders is insufficient, inaccurate, or of poor quality.

It’s rare for the recorders not to be found post-accident but it does happen in some remote locations. They can be recovered from enormous ocean depths and hostile terrain. In the sad story of Malaysia Airlines Flight MH370 in March 2014, neither the Boeing 777-200ER aircraft or flight recorders have been found.

In comparison with the successes of accident flight recording and replay the list of unrecovered and unusable recorders is short[3]. However, it does point to the need to constantly revisit the minimum approval standards, installation, and maintenance requirements for recorders.

Having dual independent combined recorders can increase the chances of success. This is making the recorder a more general-purpose equipment capable of taking video sources and data from the air traffic system as well as an aircraft.

Independent backup electrical power can help keep the recorders going beyond significant damage to an aircraft. This does help pick-up the last possible information from an accident timeline.

There’s a case for a longer duration audio recording and increasing the number of data parameter retained. This demand for more information is insatiable since there’s always a scenario that can be imagined where more data would help an investigation.

Video recording has long been talked about. It’s happening in a few situations but has not generally been adopted as a mandatory requirement for large aircraft operations. I think it is needed.


[2] EASA Safety Information Bulletin, SIB No.: 2009-28R1, Issued: 08 January 2015.


Past fatal accidents

What can cause an aircraft to plumet from high altitude in an uncontrollable way? A selection of accidents come to my mind.

One tragic accident was Indonesia AirAsia Flight 8501, Airbus A320-216[1] in December 2014. Here a malfunction in the rudder control system was reacted to by the crew in an inappropriate way. This fatal accident was put down to pilot error. That is mishandling after an aircraft system failure leading to a stall and plunge into the sea.

The loss of control and crash of Alaska Airlines Flight 261 McDonnell Douglas MD-83[2] in January 2000 is different from the recent Boeing 737 fatal accident but it warrants inspection[3]. For a start the MD-80 series has a high tail and rear engines. However, Flight 261 had a highly experienced crew, but the failure of a critical control component meant the aircraft became unrecoverable. Also, the MD-80 series of aircraft is of a similar generation to the Boeing 737. For both aircraft types, the control of the horizontal stabilizer is necessary to maintain safe flight. The MD-60 accident involved a catastrophic loss of pitch control.

Looking at the sequence of the fatal accident of SilkAir Flight 185, Boeing 737-300[4], in December 1997 it has some similarities. The lead investigators were unable to determine the cause, but suspicion fell on the aircraft rudder controls. This accident remains controversial. The accident flight recorders either stopped because wires broke or because their power was wilfully disconnected. We will never know which was the case.

Again, an accident with an inconclusive report is that of the uncontrolled descent and crash of United Airlines Flight 585. Boeing 737-200[5], March 1991. Anomalies were identified in the accident airplane’s rudder control system, but the accident was not attributed to these problems.

As can be seen from this small sample of accidents the interaction between aircraft and crew, when a control system failure occurs is a matter of great interest.






Flight recorders found

The tragic loss of all those on board China Eastern Airlines Flight MU 5735 continues in my thoughts and prayers. It’s good to hear announcements that progress is being made at the crash site.

It’s excellent news to see, from photographs published, that the aircraft accident recorder Crash Survivable Memory Units (CSMUs) are intact. Both the Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR) have been recovered.

The CVR records at least 2 hours of flight audio on a solid-state memory. Special procedures exit to recover the recordings from the recorder’s internal memory chips. This becomes difficult if the memory chips have suffered impact damage, like a crack for example. Investigators and the equipment manufacture are incredibly skilful extracting what data can be extracted.

The DFDR records at least 25 hours of flight data on a solid-state memory. There should be around 1000 parameters available for the analysis.

The technical specifications for these accident flight recorders were originally developed in the 1990s. At that time there was a transition from magnetic tape-based recordings to the use of solid-state memory. If the records are fully recoverable there should be a story of what happened in the critical moments before the aircraft started its fatal dive.

It’s possible to synchronise the recordings from the CVR and DFDR to reconstruct the actions of the crew. There are no video recordings. However, the audio and flight data can give a comprehensive picture of what happened during the accident.

Pilot commands and flight control system positions are recorded.

In parallel to the investigation of the material coming from the crash site, no doubt the authorities will be checking that no defect or deferred maintenance was reported in the technical log before departure of the aircraft.

By bringing all the evidence together a complete picture can be constructed. There are over 4,500 Boeing 737-800s now in service worldwide. This investigation will have a global impact.

What causes a dive?

It’s now been confirmed that the crash of the China Eastern Boeing 737-800 had no survivors. It’s with great sadness that the news was released. This is a devastating event that will echo down the years.

The Chinese authorities continue to press-on with a sense of urgency. So far, in the tests that have been done, no signs of explosives have been found at the accident site[1]. The rain-soaked hillside terrain continues to make the investigation difficult to conduct. They continue to look for the Flight Data Recorder (FDR) in the mud.

What is known is that the abrupt nosedive into a mountainous area occurred just before the crew would have started a descent to the airport in Guangzhou. If the FDR is recovered and replayed, it should give an indication as to the state of the aircraft as the dramatic upset initiated.

One thing with the Boeing 737 is that it is such a populous aircraft. It has a long history. As such, even given its excellent safety record there’s a large amount of information on previous serious incidents and accidents.

Since, amongst a large population of aircraft, one-off accidents are extremely rare it’s likely that some clues concerning these events are there in the current records. However, knowing where to look is not so easy. Some major events are written-up in detail while others remain only as scant records. A lot depends on the thoroughness of the investigating authorities.

In my previous article, for the purposes of elimination, I listed several common causes of catastrophic civil aircraft accidents. What is it that can cause an aircraft to abruptly nosedive without the opportunity to recover?

For the moment, I’ll put aside the notion that the aircraft crew had that opportunity to recover. There’s such a thing as the startle factor that can reduce a crew’s ability to take emergency actions, but we will not know anything of that factor until the accident recorders are replayed and the recordings well understood.

The two significant factors that are plausible are unrecoverable aircraft control failure and structural failure. It could be that both factors are linked in one way or another. They are certainly both hazardous but somewhat dependent upon degrees and the sequence of events.

A Boeing 737-800 has powered flying controls, as does all similar aircraft types, but it’s not a fly-by-wire aircraft. Therefore, it does not have the flight envelope protection that is available on a fly-by-wire aircraft type.

What can go wrong with those powered flying controls? Putting aside inappropriate crew action, there are both electronic systems and hydromechanical systems that can fail in a catastrophic way. In the event of electronic systems failing, they can be immediately disconnected but that’s not so simple with hydromechanical systems. 

Illustrative of what can go wrong is this serious incident to a Boeing 737-700 in January 2009[2]. This was a post-maintenance check flight and so the crew were prepared. This aircraft’s descent rate was notable, reaching a maximum of 20,000 ft/min.  It all ended well but just imagine the scenario occurring on a routine flight without expectation that anything was wrong. 



What are the likely scenarios?

When dealing with aircraft system safety, I often found it difficult to encourage design engineers to look at aircraft level effects. It was more common to address each set of systems as if they were the only ones that counted.

Safe continued flight and landing depends on a whole host of interactions. Picking up a technical specification, for say an autopilot, reading it and understanding it is one thing. It’s harder to appreciate how it interacts with every other part of an aircraft in flight.

Considering a large commercial aircraft there are only a few general conditions that can create a total catastrophe. I’m using a specific meaning of that well used word. In this case, catastrophe is a complete aircraft level failure situation that is non-recoverable. A chain of events that leads inevitably to fatalities and a total hull loss.

There are only a few general conditions because there are design commonalities between modern civil aircraft. For example, they all need surfaces that generate lift and surfaces that enable aircraft control. They all have propulsion systems that generate thrust. If they are for civil passenger transport, they all have environmental control systems that maintain a habitable environment within a pressurised area.

In flying, they all are subject to the effects of weather. That is any hostile situation that can exist in the atmosphere, from ground up.

With what is so far known about the crash of China Eastern flight MU5735, when thinking about potential aircraft level events, it’s not possible to rule out many scenarios.

However, it’s extremely difficult to conceive of a weather event on the day of occurrence that could have led to such a disastrous outcome. No great storm activity was reported. So, this is unlikely to have been an accident like Air France flight AF447 in 2009[1]. A high-altitude stall can be recovered if no other significant negative factors come into play.

Additionally, it’s extremely difficult to imagine this accident as a depressurising event. So, this is unlikely to have been an accident like Helios Airways flight 522 in 2005[2]. Unless there was a massive explosive decompression that caused structural and control damage. Japan Air Lines Flight 123 in 1985 had such a tragic fate[3].

Engines can fail in a spectacular way but that does not normally destroy a whole aircraft. A total loss of propulsion turns a large aircraft into a large glider. The trajectory of this aircraft suggests something happened that was far more devastating than the loss of one, or both engines.

Issues related to communication and navigation can put to one side given that the accident from start to finish was so rapid. No crew communication is reported to have taken place.

Following the deductions made above the remaining possibilities that warrant consideration are to do with either or both, structural failure, and unrecoverable aircraft control failure. The accident investigators working on-site will be looking at the deformations found in the recovered wreckage. They will be looking at collecting and putting together what remains of the aircraft control system. They will be saving every electronic circuit board they can find.

By far the remotest possibility is a wilful act of destruction. It’s better to first rule out more likely aircraft scenarios before posing questions that bringing into question those on-board.

Global commercial aviation has a tremendous safety record. China’s aviation safety record is a strong one. As has been said by commentators: planes don’t just drop out of the sky like that one. The urgency of the accident investigation is all too evident. The sooner there’s a plausible theory the sooner corrective action can be put in place.





Unsurprisingly, China Eastern Airlines has now grounded its fleet of Boeing 737-800s. This popular and well-used civil aircraft has a good safety reputation. Until more is known, the airline is taking a precautionary approach. 123 passengers and 9 crew members have been lost.

If the video evidence from a security camera is to be taken as reliable, then the dive of the Boeing 737 was uncontrolled and significant structural damage was evident. The on-line pictures show the aircraft at a relatively low altitude. So, it’s not possible to say at what point prior to these images that structural damage occurred. The speed of the dive could have either caused or contributed to the aircraft’s break-up. 

Whatever it was that suddenly led to a complete loss from 30,000ft remains mysterious. Looking at the aircraft transponder data, the indications are that the flight was normal up until a point where an unexpected event occurred that was immediate and devastating. Even if the flight crew did have some recognition of failure conditions on-board, it does seem that little time to intervene was available. One assumption in aviation is that crews are provided with training in respect of emergency and abnormal procedures and can act accordingly when failures occur.

A great deal hangs on the recovery and replay of the two accident flight recorders.

The accident flight recorders are separate and installed in the rear section of the aircraft. This is done to increase their chances of survival in most accident and serious incident scenarios. Each requires electrical power. Several means of providing power are available including the aircraft’s batteries. However, if the electrical power wiring to the recorders is severed then they will stop recording. This is true for wiring from their aircraft data sources too.

Let’s hope that there is a complete recoverable record.

Crash-protected flight recorders

The crash of China Eastern Airlines Flight MU 5735 is deeply saddening. My thoughts are for the families, friends, and loved ones of those who were on board that ill-fated flight.

Watching video that has been circulated in social media the signs are that the China Eastern Airlines Boeing 737-800 dived and hit the ground at very high speed. The aircraft appears to have plummeted more than 20,000 feet in about a minute.

The aircraft crash site is in a difficult to get to location[1]. Authorities in China are searching the hillside looking for evidence as to what happened and recovery of the aircraft accident flight recorders[2]. Given what is suspected to have been a high-speed impact, damage to the accident flight recorders can’t be ruled out. They are made to withstand high impacts but are not invulnerable.

It’s most likely that the flight recorders will be of the solid-state type. This is where memory devices are enclosed in a strong crash protected metal box. So, much of the flight recorder could have severe damage but the recordings inside should be preserved.

On this type of public transport civil aircraft, there are usually two accident flight recorders fitted. One Cockpit Voice Recorder (CVR) and one Flight Data Recorder (FDR). To ensure that they meet rigorous technical requirements accident flight recorders are approved by aviation authorities. The technical requirements for approval are called: Technical Standard Orders (TSO)[3][4].

In both the US and European systems, TSO 123 is applicable to CVRs, and TSO 124 is applicable to FDRs. These two TSOs call up the applicable industry standards of EUROCAE ED-112A, MOPS for Crash Protected Airborne Recorder Systems[5]. This comprehensive technical document defines the minimum specification to be met for all aircraft required to carry flight recorders which may record flight data or cockpit audio in a crash survivable recording medium to be used for aircraft accident investigation.

One of the tests described in this long-standing international standard requires manufactures to shoot a crash protected module into a target at high speed. This test is often done by loading up a large pneumatic cannon, charging it and firing a module at a specially made target. To pass the test the module must survive sufficiently well to replay a recorded record.

So, there is a good chance that the on-board crash-protected recorders of MU 5735 might have survived. Let’s hope so.