Controllability Check

Imagine yourself flying a business or commercial jet when an Airbus A380 crosses your path just 1,000 feet above you and it takes every bit of airmanship and physical strength in you to return the airplane to straight and level flight. You suspect the aircraft may be bent. Well you don't have to imagine that, it happened to the crew of Challenger 604 D-AMSC on January 8, 2017.

Or, what if your autopilot tells you, while happily crossing the pond, that the aileron is having problems keeping the wings level and when you disengage the autopilot the airplane snaps into a roll? (This happened to Challenger 604 C-GKTO on November 18, 2017 while flying from Europe to Canada. They suspect a water leak forward of aileron trim cables from those cables.)

Or, what about a lightning strike? Aircraft icing? Assymetric flaps? Hail damage? Bird strike? Debris from another aircraft on the runway?

Or, . . . you get the idea. Now you have doubts about how airworthy your aircraft actually is.

You may need to borrow a page from military aviation: the controllability check.

There isn't a lot written on the subject. When I was in Air Force pilot training, it was a subject from day one because the aircraft were not as reliable as they could have been and we did a lot of formation flying where the chance of a midair collision was always considered. So we talked about how to do controllability checks and every now and then we did them. My only experience with doing controllability checks was while doing Functional Check Flights, and that is a good place to consider the how. But let's first consider the why.

On 1 February 1943, the 414th Bombardment Squadron (Heavy) was on a mission to attack the port of Tunis. A single-engine Messerschmidt 109G fighter collided with "All American III," a Boeing B-17F-5-BO Flying Fortress, 41-24406. The fighter cut diagonally through the bomber’s fuselage, carried away the left horizontal stabilizer and elevator, and damaged the flight control cables. The B-17 made it to its home base (Biskra, Algeria) after flying for another 90 minutes. None of the ten crewmembers were injured.

The aircraft was repaired and returned to service. It flew until the end of the war, at which point it was dismantled for salvage.

1 — Case study: Elal 1862

2 — Case study: Alaska Airlines 261

3 — Case study: Qantas 72

4 — Why do a controllability check?

5 — How to do a controllability check

6 — C-17A controllability check

7 — Functional Check Flight (FCF) example

8 — A generic procedure

9 — The benefits of a controllability check

The odds were stacked against this crew, no doubt about it. They didn't have all the information they needed and may have felt a sense of urgency to get the airplane on the ground. But the airplane was flyable. A controllability check would have helped them understand the new flight characteristics of their two-engine Boeing 747 while providing the time needed to reduce their gross weight.

This cargo Boeing 747 took off performance limited (they were as heavy as they could have been under the conditions) and had the number three engine take out the number four engine. That cost them some of their flight controls and they definitely had their hands full. And yet they were able to fly for eight minutes, maintaining altitude and heading when they wanted. They began fuel dumping almost immediately. But as they slowed the increasing angle of attack overwhelmed the thrust available and they ended up behind the power curve and outside their roll capability. The Nederlands accident report says, "Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible."

That might be true. But there are a few things we can take away from this:

• If the airplane is flying but continued flight is questionable, try to reduce gross weight before reducing airspeed or increasing drag.
• If faced with a loss of thrust on one side, attempt to make turns into the good engine(s) to improve roll out capability.
• If you don't have to land immediately and controllability is in question, look for a remote area where you can do a controllability check. (Attempt to slow the aircraft to approach speed and configure for landing at altitude; doing so with enough altitude to recover if things go wrong.) This gives you a better idea of how fully you can configure and how slowly you can fly.

For more about this accident, see: El Al 1862.

The pilots of Alaska Airlines 261 were given an airplane set up to fail and were heroic in their efforts to save it once it did fail. The stabilizer trim system failed and would have made for a challenging landing. The crew, in consultation with experts on the ground, tried several methods to free the stabilizer which ultimately caused it to break free of its structural mounts, making the airplane truly unflyable. The crew did nothing wrong; it was the mindset of the time to fix what is broken, not to accept the degraded flying condition of the aircraft. But had they ceased their troubleshooting and attempted a controllability check, they may have realized the airplane could have been safely landed.

First a few facts: The MD-80 was designed without a fail safe mechanism on the horizontal stabilizer. Alaska Airlines extended lubrication, inspection, and replacement intervals on the horizontal stabilizer on this particular aircraft. A lead mechanic at Alaska Airlines' Oakland maintenance facility reported maintenance short comings to the FAA fifteen months prior to the crash, and was placed on paid leave. As it turns out, over two years prior, he had ordered the horizontal stabilizer jack screw on this aircraft be replaced. His recommendation was overruled by the next shift. The aircraft was put back into service, its next overhaul would be in two and a half years.

On 31 January 2000, the pilots flying this airplane at first experienced a jammed stabilizer. They accomplished the appropriate checklists and ended up with an airplane that was barely controllable. The horizontal stabilizer jack screw was bare of any lubrication and the threads had been ground off. The stabilizer would not budge. There were no procedures on what to do next and the pilots thought a successful landing was in doubt. They elected to use primary and secondary motors to free the stabilizer. This moved the stabilizer free and dislodged a retaining nut on the stabilizer. The stabilizer moved violently enough to completely dislocate the jack screw. The airplane entered an uncontrollable dive and all were killed.

Given all that, the pilots did what they could and in accordance with their training. But what if, after they had gone through all of the trouble shooting procedures had they decided to attempt to land the aircraft with the stabilizer frozen? A controllability check could have given them the confidence to attempt the landing and not risk repeatedly activating the trim motors in an attempt to free the stabilizer.

For more about this accident, see: Alaska Airlines 261.

Not all flight control problems are mechanical, especially if you are flying an Airbus. Captain Kevin Sullivan was flying an Airbus A330 that came out of the factory with a computer design flaw that would only occur in a very rare set of circumstances, but those circumstances meant he no longer had any control of the aircraft until the computers decided they had messed things up. He brought the airplane in for a safe emergency landing after flying a controllability check. Knowing the aircraft could be configured from a safe altitude gave him the confidence to attempt the landing off a controlled, 3-degree glide path, fully configured.

The Airbus A330 was designed to give priority to the computers over the pilots when it comes to deciding what to do with the flight controls, with the aim of preventing pilot error. It works pretty well, except for when it doesn't. In the case of Qantas Flight 72 on October 7, 2008, the errant computers nearly dropped a perfectly flyable airplane into the Indian Ocean. A level headed captain with experience as a U.S. Naval aviator saved the day. Among the many tools in his arsenal was a controllability check.

I asked Captain Sullivan about the controllability check and he was unequivocal about its importance that day. "For the QF72 accident, our electronic flight controls were operating at an unknown level and I had serious concerns as to their veracity and my level of control, especially close to the ground. Two uncommanded pitch downs with no amplifying information from ECAM meant we were in unchartered territory, so the control check confirmed flap operation and appropriate control stick response, at altitude, prior to landing."

For more about this, see: Qantas 72.

It seems to me that there is almost never anything to lose by doing a controllability check unless you are on fire, running out of fuel, or perhaps the weather coming down or there is some other time constraint. There are times where doing a controllability check can be a life saver.

You should probably consider doing a controllability check if:

• An element of your flight control system has been damaged or appears to be restricted.
• The aircraft's aerodynamics appear to be compromised.
• The aircraft's lateral or vertical balance appears to be shifted outside of design limits.
• The aircraft has sustained damage due to hail, icing, or other weather affects.

There are times when doing the controllability check is vastly preferable to "ad hoc" troubleshooting.

There isn't a lot written about how to do a controllability check, but we can take clues from our objectives and a few other sources.

The objectives of a controllability check

What are we trying to accomplish? We are trying to get the airplane back on the ground in one piece and in order to do that we need to:

• Get the airplane configured: will the landing gear come down in a landable condition?

(Some aircraft land better gear up than with some combinations of main and nose gear. Finding out early may give you a chance to try alternate methods of gear retraction or, if that fails, retracting the gear to a more favorable combination.)

• Get the airplane configured: will the flaps extend fully, and if not, how far will they extend?

(If the flaps move, will they move symmetrically? Finding out early may steer you to another runway or affect the way you fly the approach.)

• Get the airplane slowed: will you be able to fly normal approach and landing speeds?

(If the aircraft starts to misbehave while decelerating to normal approach speeds, you may want to limit your speeds when making your actual approach to landing.)

Manufacturer Recommendations

Boeing

What used to be "tribal knowledge" eventually became procedure in the Big Airplane Air Force and perhaps the best example of that is with the C-17 controllability check procedure.

This has always been my favorite warning in any Air Force manual over the years. I once — and only once — found myself at full control deflection in flight and this warning was the first thing that popped into my head when that happened. I think it may have saved me that day.

Looking at a Functional Check Flight manual can show the care and diligence needed during a controllability check. Most business jet manufacturers are reluctant to release these manuals to their customers. The USAF insisted and the C-37 (GV/550) manual offers a few good pointers.

Note that things are done slowly, methodically, and with limits in mind. The biggest mistake I saw with new and inexperienced functional check pilots was the desire to rush things, especially when validating low speed flying characteristics. The Air Force manuals during my time doing these things were written to require decelerations no faster than 2 knots per second. This updated manual lowers that to 1 knot per second. I like that better. The critical point for these maneuvers is you are not trying to duplicate a simulator stall event or demonstrate exceptional pilot skills. Your aim is to demonstrate the airplane can fly at the charted stall warning speed. In the context of a controllability check, you only want to demonstrate that the airplane can be controlled for landing. There is no point going any slower than the speed you expect for that landing.

Please note I offer the following not as a narrative on how to do a controllability check, but to demonstrate the deliberate nature of a functional check flight. Everything is done methodically with the eye that if something doesn't go right, the subsequent steps may have to be aborted.

For the purposes of a controllability check, if you have damage to the wings or suspect you may have problems with the spoiler system, you should consider whether you need the spoilers for the landing. If not, you might be better off not testing them and leaving them stowed.

Depending on why the controllability check is needed, you might consider leaving the gear down once it is extended. If you suspect damage to the wing, you may also want to consider limiting flap extension to only as needed for the landing.

I offer the following only to show the pacing of the functional check flight process, especially the rate at which speed is reduced. For the FCF, the aircraft is taken to the point at which stall warning is activated. You should not do this for a controllability check. I would go no slower than approach speed and would even consider adding 10 knots to that if landing distance permits.

I would not exercise the rudder during a controllability check other than to verify it isn't frozen in one position.

Of course the aircraft and the situation will dictate the procedure, but it may help to think this through ahead of time. This is my approach to a controllability check, in a generic situation and aircraft. I've used my experiences as a functional check pilot and the lessons learned from the case studies discussed earlier.

Brief crew duties, expectations, safe attitude/AOAs, and "knock it off" criteria

1. One pilot flies the aircraft while the other monitors aircraft status and makes note of performance. While pilots can exchange duties (i.e., each pilot exercises the flight controls), one pilot must always be designated as the pilot flying.
2. The expectation for each step of the process must be verbalized prior to the step. For example, "We will now extend the speed brakes slowly and smoothly; we don't want to see the aircraft roll on extension or retraction and we want to see the retraction completed to a clean wing."
3. Both pilots should have in mind where the aircraft pitch, roll, and yaw should be for the maneuver to be attempted. If the aircraft is equipped with a flyable Angle of Attack instrument, pilots should have in mind where the AOA should be. With or without an AOA indicator, pilots should have knowledge of where the pitch should be. For example, "We do not expect to see the nose pitch up or down during speed brake extension. The AOA should remain steady." For more about this, see: Angle of Attack.
4. Both pilots should agree on results that will cause an abort of the maneuver, the so-called "knock it off" call. Since you are conducting a test, you should have in mind what constitutes a failed test and how to extract yourself from that situation safely. For example, "If the aircraft rolls or exhibits a pitch change of more than five degrees during our slow extension of the speed brakes, we will stop the extension, evaluate, and retract the speed brakes." Examples of adverse behavior which might be worthy of aborting a procedure:
• Unexpected aircraft roll, or a roll at a rate or direction unexpected with intentional movement of the ailerons.
• Unexpected pitch changes.
• Adverse yaw (not produced by rudder inputs).
• Aircraft vibration or shuddering.
• Flutter (a resonant vibration of a control surface or its surrounding area).
• Control jamming or sudden roughness to the controls.

Validate primary flight controls and pitot-static system

1. Descend to 15,000 feet (desired)
2. Slow to 250 KCAS
3. Validate all airspeed indicators and altimeters are in agreement.

You can check these against your GPS, the altimeter will generally be within a few hundred feet and the indicated (or calibrated) speed should be about 20 or 30 knots higher than the ground speed corrected for wind. You can use this exercise to identify faulty instrumentation.

4. Select flight control synoptic pages.
5. Each pilot should, in turn, exercise one axis at a time

Start at neutral and look for any looseness.

Using smooth and small inputs, exercise the control and look for any binding and other signs of abnormality.

Validate speed brakes, flaps, landing gear, and low speed flying characteristics

1. Look up approach speeds for each possible flap setting, given the current weight and altitude
2. Descend to 10,000 feet (desired)
3. Slow to 250 KCAS
4. Extend the speed brakes

Look for symmetrical deployment and decelerate to what should be close to a no flap maneuvering speed

5. Stow the speed brakes

The speed brakes should stow symmetrically without any sign of floating

6. Adjust the thrust to start a 500 fpm descent while holding your no flap maneuvering speed
7. Extend each notch of flaps as the target speed permits, allowing the aircraft to decelerate with the increased drag

Adjust the thrust to allow the speed to decay about 1 or 2 knots per second, no higher

If at any point the aircraft begins to roll or buffet, discontinue the maneuver, taking note of the speed and configuration

Plan your approach and landing

You should use the data obtained from the controllability check to learn which flight control components can be trusted and which will require an adjustment to normal approach and landing procedures. If a higher than normal approach speed is dictated by adverse flying characteristics, be mindful of the aircraft's touchdown attitude (to prevent a nose first landing), and stopping distances.

Keep in mind that you should never find yourself on approach at an airspeed lower than already demonstrated during the controllability check and that you should never find yourself needing full control deflection in any axis. If either event occurs, you need to speed up.

If you've never had a handful of airplane that wasn't behaving as the manufacturer had intended, this might seem to be much ado about nothing. Over the years I've found myself in a part of the flight envelope never discussed during training and certainly not in any of the manuals. When this happens, I assure you, you will be overcome with doubt and will be tempted to second guess every decision you make. The best way to cure yourself of that is to know ahead of time how to do a controllability check.

By now, some of these ought to be obvious. But there is at least one more benefit you may not have considered.

1. You are able to confirm that the gear, speed brakes, and flaps work as intended — or — you are forewarned where problems may exist.
2. You are able to confirm at which speed the aircraft can approach and land.
3. If the aircraft will not operate as designed during approach and landing, you will find out before hand with an altitude pad to recover.
4. The time required to fly the controllability check will force you to slow down and be more deliberate about the steps to follow.

Boeing 737 NG Flight Crew Training Manual, Revision 12, June 30, 2013

Gulfstream Functional Check Flight Manual for the USAF C-37A Aircraft, Revision 3, Dec 30/15

Nederlands Aviation Safety Board Aircraft Accident Report 92-11, El Al Flight 1862, Boeing 747-258F 4X-AXG, Bijlmermeer, Amsterdam, October 4, 1992.

NTSB Aircraft Accident Report, AAR-02/01, Loss of Control and Impact with Pacific Ocean Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, About 2.7 Miles North of Anacap Island, California, January 31, 2000

Technical Order 1C-17A-1, C-17 Flight Manual, USAF Series, 15 March 2006

Please note: Gulfstream Aerospace Corporation has no affiliation or connection whatsoever with this website, and Gulfstream does not review, endorse, or approve any of the content included on the site. As a result, Gulfstream is not responsible or liable for your use of any materials or information obtained from this site.