Check Flight Checkup

Excitement and adventure are not on the typical line pilot’s agenda. Standard-rate turns, smooth power and configuration changes, and staying comfortably within the “envelope” mark an airline pilot’s professionalism. Sometimes, however, pilots are called upon to take aircraft to their limits, to demonstrate that normal and emergency systems are working properly, or to determine if everything was put back together correctly after the airplane was taken apart during heavy maintenance.

There is a bewildering variety of names for the types of ad hoc nonrevenue flights that aircraft operators perform, which include postmaintenance, airworthiness, aircraft-acceptance and end-of-lease check flights. However, a recent fatal accident and a rash of serious incidents have made one thing clear: The risks involved in these flight activities are higher than in normal operations.

This red flag prompted the industry to ask Flight Safety Foundation (FSF) to organize an international meeting to discuss the risks and how they can be reduced. “While exploring the issue with industry safety specialists, we found that there are not as many answers as there are questions, not the least of which was how to define the topic,” said Jim Burin, FSF director of technical programs. “Test flights are not performed by operators but by manufacturers’ test pilots. We’re not talking about check flights, either, because check flights involve aircrew evaluation.”

Ultimately, the term functional check flight was adopted by consensus of a steering team formed by Burin of specialists from Airbus, Boeing, Bombardier and Embraer.

Pivotal Question

For the 275 aviation safety specialists who came from 41 countries to attend the FSF Functional Check Flight Symposium in Vancouver, Canada, Feb. 8–9, there were many other questions to ponder: Are the crews who conduct such flights qualified to do so? What are the necessary qualifications? How do you train crewmembers for functional check flights? Are simulators adequate for the task? Are operators getting the information they need from the manufacturers? Are they getting useful guidance from the regulators? Do we need more regulations?

Do we need to perform functional check flights at all?

The resounding answer to that question — from the attendees and the speakers who represented manufacturers, regulators and operators¹ — was that this question must be asked before launching any functional check flight.

“Flight checking of aircraft, particularly older aircraft, often is driven by the maintenance manual,” said keynote speaker David Morgan, chief pilot and general manager for Air New Zealand.

However, aircraft maintenance manuals (AMMs) often lack clarity, said Homero Montandon, a test pilot in the Airworthiness Branch of ANAC, the Brazilian national civil aviation agency. “AMMs should be more specific about the necessity to perform check flights after maintenance,” he said.

Andre Tousignant, director of the Air Safety Investigation Office at Bombardier Aerospace, noted that few, if any, functional check flights are required by the AMMs for modern aircraft that have on-board troubleshooting and fault-reporting systems. The AMM for the Q400 requires only a trim check after an aileron is replaced. The AMM for the CRJs requires either a flight check or a ground check after an air-driven generator is repaired or replaced. “If a flight check is not required by the AMM, we see no need for it,” he said.

Similarly, Joáo Carlos Braile and Fabrízio Sabioni Lourenço, who coordinate flight test activities at Embraer, noted that the AMM for the Embraer 145 requires a flight check for data acquisition, only. There are no requirements for check flights in the 170/190 AMMs, they said.

Unnecessary flight testing must be avoided, said Gary Meiser, chief pilot of production flight test at Boeing Commercial Airplanes. “We need to eliminate testing for testing’s sake,” he said. “We need to ask ourselves: Does it really need to be flown? Can it be done on the ground?”

Exemplifying one of the gray areas associated with this topic, the answers to Meiser’s questions might be maybe and maybe not, according to Sel Laughter, flight test manager for United Airlines. Noting that United checks backup systems during postmaintenance flights, Laughter said, “A lot of times, they’ll check OK in the hangar but not in the air.”

Hard Lessons

In his keynote address, David Morgan recounted lessons learned during Air New Zealand’s in-house investigation following the crash of an Airbus A320 in Perpignan, France, on Nov. 27, 2008. The accident occurred during an end-of-lease demonstration flight pending the return of the aircraft to Air New Zealand by XL Airways (ASW, 11/10, “Check Flight Goes Bad”).

The official investigation by the French Bureau d’Enquêtes et d’Analyses found that the flight crew was not aware that the angle-of-attack sensors were blocked by ice — they lost control of the A320 while performing low-speed checks at low altitude. Among the factors that contributed to the accident, which killed all seven people aboard the aircraft, was the flight crew’s lack of training and experience in performing functional check flights, and their inadequate coordination during the flight.

During its in-house investigation, Air New Zealand discovered that several other airlines were performing similar end-of-lease demonstration flights. “We found that the processes for these types of flights tend to be handed down from one chief test pilot to another,” Morgan said. “With some airlines, the responsibility for these flights sets with those with the most gray hair; with other airlines, it sets with those with the most education.”

Customer acceptance flight checklists, which usually are provided by manufacturers with the sale of a new aircraft, typically are adapted by operators for use in end-of-lease demonstration flights and other types of functional check flights. “Many operators are conducting functional check flights with checklists that are out of date,” Morgan said. “They might not apply to changes made per service bulletins, for example.” He called for more support from manufacturers in keeping checklists up-to-date.

The regulatory framework for functional check flights, too, is “less than optimal,” he said. “Regulatory intervention could be quite useful. We need a more effective and consistent regulatory framework with a clearly defined set of rules to cover all nonrevenue flights.”

Lessons from the Perpignan accident report and the airline’s in-house investigation prompted Air New Zealand to “take a policy decision not to expose our crews to what we consider unacceptable risk when conducting end-of-lease and other ad hoc flights,” Morgan said.

That policy subsequently was challenged by a set of end-of-lease demonstration procedures demanded by a leasing company. The airline found that some of the procedures posed unnecessary risk, but the leasing company contended that the procedures had served them well, so why change them? Although some compromises were reached, Air New Zealand refused to perform several systems checks that it believed could be performed adequately on the ground. “Aircraft systems or components should only be checked in the air if they cannot be checked on the ground,” Morgan said.

Although the airline adhered to its safety policy, the leasing company did not relent. “The checks we refused to carry out were subsequently imposed on the delivery crew from the next airline,” Morgan noted.

Simulator Infidelity

Morgan said that the in-house investigation also led Air New Zealand to question whether flight simulators realistically replicate the flight characteristics of an airplane flown close to or beyond the edge of its flight envelope.

According to Jean-Michel Roy, a test pilot for Airbus, they don’t. “Simulators do not replicate the forces, vibrations and sounds often experienced in test flights,” Roy said.

Simulator fidelity was found to be a factor in a functional check flight accident that occurred the night of Dec. 22, 1996. The crew of a Douglas DC-8 freighter, which had undergone major modifications and an extensive maintenance check, slowed the aircraft in clean configuration at 13,500 ft, just above a cloud deck, to record the airspeed at which the stick shaker, or stall-warning system, activated (Accident Prevention, 9/97). However, the system failed to activate, and the aircraft stalled at a slightly higher-than-expected airspeed, possibly because of ice accumulation and/or control misrigging, said the report by the U.S. National Transportation Safety Board (NTSB).

The pilot flying applied full aft control pressure when the DC-8 suddenly pitched nose-down. The aircraft then descended rapidly in a full stall and struck terrain near Narrows, Virginia, U.S., killing all three flight crewmembers and the three maintenance technicians who were aboard.

The NTSB report said that neither the pilot flying nor the pilot-in-command had experienced an actual stall in a DC-8, and the pilot flying’s inappropriate control inputs likely were influenced by his training experience in a simulator that “developed a stable, nose-high, wings-level descent, with no tendency to pitch down in a stall break.”

Beyond flight characteristics that might not be the same as those experienced in simulators, another factor to consider is that aircraft usually are substantially lighter than their normal operating weights during functional check flights, resulting in “handling qualities that may be different than what we are used to,” said Harry Nelson, an experimental test pilot for Airbus.

‘Hard Limits’

Several speakers emphasized the need for painstaking preparation for functional check flights. Among the factors to be considered are the time of day, weather conditions and the airspace in which the flight will be conducted.

Advance coordination with air traffic control (ATC) is important. “You must consider ATC as an integral part of a successful test flight,” said Steve Smith, manager of flight technical services for Cathay Pacific Airlines.

“Maintenance partnership is critical,” said Boeing’s Meiser. “There must be open and honest dialogue.”

Detailed briefings between flight crews and maintenance teams should be conducted before and after a functional check flight. Before flight, the crew should review the emergency procedures for each system and component that was involved in maintenance, said Bombardier’s Tousignant.

Noting the infrequency of functional check flights at Spanair, Emilio Ranz, the airline’s flight test department chief, said, “The lack of test flight proficiency is our biggest problem.” The department copes with this by “writing everything down so that it can be used to review and prepare for the next flight test,” he said. “We have to develop a checklist for each check because of the lack of proficiency.” The department also maintains a detailed flight test operations manual.

“Plan the flight and fly your plan” was a message delivered repeatedly during the symposium. Improvisation, which was a major factor in the Perpignan accident, is one of the greatest risks, said Walter Istchenko, chief of flight test for Transport Canada. “Crews may improvise and conduct maneuvers in inappropriate airspace and/or at an inappropriate time — for example, with high workload,” he said.

Be “failure-minded” and have an escape plan when something goes wrong, suggested Harry Nelson. “If things don’t look right, they probably aren’t, so stop,” he said.

Glenn Bradley, air operations check flight manager for easyJet, offered a good example involving an A320 postmaintenance check flight. The crew was performing a low-speed check when a pre-stall buffet occurred. “It was not working, so the pilot-in-command did the right thing: He stopped the test and got the aircraft on the ground,” Bradley said. A subsequent review of recorded flight data showed that the angle-of-attack values being displayed were “frozen”; the problem disappeared after the gauges were replaced.

The policy at Cathay Pacific is that “if any one of the crew is uncomfortable with what is going on, that crewmember can call for a temporary halt in the operation,” Smith said.

Nelson recommended that critical checks have “hard limits” labeled on the checklist as “DO NOT EXCEED.”

“Knock-it-off limits” was the term used by Boeing’s Meiser, who also stressed the importance of “stopping what you’re doing when it starts going wrong.”

Airbus School

Symposium attendees received a wealth of information on how to establish and staff a functional check flight organization. Choosing the right people is paramount, according to Harry Nelson. “I believe that you can have the best procedures, but if you have the wrong people, you will fail,” he said. “I know people with 25,000 hours who have been doing the same things, flying the same routes, for years. They may not be the people you’re looking for.”

Among personal traits to look for are good communication and teamwork skills, inquisitiveness and patience, Nelson said. Among traits to be avoided are egoism, indecisiveness and impatience.

Although many operators perform in-house training, some also are sending check crews to the Technical Flight Familiarization Course offered monthly at Airbus training centers. The course comprises two days in ground school, two days in a flight simulator and one day in flight. During a question-and-answer session, Claude Lelaie, special adviser to the president and CEO of Airbus, pointed out that the goal is not to train operators’ pilots to be “test pilots” but to train them to perform functional check flights safely. Since the course was begun in September 2009, 27 A320 crewmembers from six airlines have completed the training.

Standards vs. Regulations

Opinion was divided on whether the safety of functional check flights can be enhanced through increased regulation. While some participants said that well-founded and sensible regulation would help, others argued that the industry would benefit most by setting its own standards.

“We need to create some industry standards,” said Delvin Young, chief pilot for flight test at American Airlines. “We, as airline operators, have to manage ourselves, or somebody else will.”

Time is of the essence, said easyJet’s Glenn Bradley. “These problems exist now, and we have to solve these problems now,” he said. “We cannot wait for the regulators.”

Nevertheless, calling attention to the recent accidents and serious incidents involving functional check flights, Didier Nicolle, chairman of the European Aviation Safety Agency (EASA) Flight Test Group, said, “We have a problem, and there is a positive need to do something in regulation.”

Accordingly, EASA plans to take final action by the end of this year on a notice of proposed amendment (NPA) issued in August 2008 that seeks to define four categories of “flight testing,” establish qualifications for pilots and flight test engineers involved in specific types of flight testing, and require operators to have a flight test operations manual, Nicolle said.

The first three categories include experimental, engineering and production flight testing activities typically performed by the manufacturers. Functional check flights likely fall in the fourth category, which will not include special crew qualifications.

The NPA noted that between 1990 and 2005, 30 airplane accidents, with 53 fatalities, and 15 helicopter accidents, with nine fatalities, occurred during flight testing activities.

At press time, the Foundation learned that three more fatal accidents, with 13 fatalities, recently have occurred — an Antonov 148 in Russia, a CASA 212 in Indonesia and a de Havilland Twin Otter in the United States.

Jim Burin and the functional check flight steering team members are considering ways to build upon the groundwork laid in Vancouver.

Note

1. The symposium presentations are available in the Aviation Safety Seminars section of the FSF website here.

Download the PDF of this article.