The late Ed Heinemann was a designer at Douglas Aircraft. He was responsible for the A-4 Skyhawk, a single-seater with an empty weight of less than 10,000 pounds that served for a long time as the smallest carrier-based attack aircraft in the Navy’s arsenal. It embodied the now-famous design philosophy emblazoned on Heinemann’s office wall: “Simplicate and Add Lightness.”
While the meaning of Heinemann’s motto seems clear enough, there is a subtlety to it. When designing a device like an airplane whose dimensions are a function of its weight, one finds that changes reverberate throughout the design. They earn compound interest. Take, for example, the A-4’s wing. With a span of only 27 feet it may at first have seemed too small to achieve the required approach speed for carrier landings. But making it small eliminated the need to fold it for hangar-deck storage. It also removed the weight of hinges and actuators and the complexity of controls, monitoring systems and backups; this in turn made it possible to pare a little material from the wing spars, landing gear and so on. In the end so much weight was saved that the target approach speed was possible after all.
That was a case of adding lightness by reducing size. Simplication works similarly: removing a system often allows you to remove other systems as well, because many services on an airplane require subsystems for verifying the behavior of the principal system, protecting against inadvertent operation and providing backup in case of failure.
At the same time, you have to guard against taking away too much or not quite enough, as I was reminded last week while installing the panel controls for the retractable landing gear in my homebuilt.
First, a quick flashback. In the mid-1970s I stopped in Newton, Kansas, to visit the factory where Jim Bede was getting ready to turn out BD-5 kits. I was in my old homebuilt, Melmoth, which I had first flown in 1973 and had been modifying and improving ever since. Somehow or other my nosewheel doors had gotten tangled up with the gear strut-I’ve forgotten how this happened-and in the course of removing the damaged doors I had had to pry them open by hand. My visit having ended, I climbed into the airplane, fired up the engine, and started to taxi, only to have the right main gear collapse. Bede very generously-especially considering that he knew that I was not among his most zealous admirers-let me use his shop and equipment to make temporary repairs. I returned to Los Angeles late that night without functioning flaps or a door on the right main.
What had happened? I’d shot myself in the foot. When I pried the nosewheel doors open, trapped hydraulic fluid in the gear circuit had to go somewhere, and it went to the right main actuating cylinder, unlocking the overcenter knuckle on the retracting link. As soon as I put an inward side load on the strut, it caved in. But where in the design was the fault? After all, manually pulling the nosewheel doors open was not something I had ever anticipated doing. The fault, I think, was in the very complexity of the system, which prevented my foreseeing the consequences of my action.
When I designed Melmoth‘s replacement in the early ’80s, I decided to simplicate in a big way. I got rid of the three hydraulic cylinders, one at each gear leg, and replaced them with a single actuator located in the wing centersection, inches from the hydraulic pump and the up/down control valve. The three gear struts were mechanically linked, and the position of components of the system passing through the cabin indicated whether the gear was up or down; no lights, with their attendant microswitches and wires, were needed. There was hardly any plumbing at all. In place of several electrically powered valves, I provided a cable circuit, traveling through bicycle brake cable housings from the gear handle on the panel to the valve under the seat.
So last week I was hooking up that cable circuit when I had one of those sensations that my friend Russ Hardwick calls a “klong.” He defines this word as a “rush of s–t to the heart.” What I realized was that my seemingly simple system had an unexpected failure mode.
The cable connecting the handle on the panel to the valve beneath the seat wraps halfway around a grooved disc, like a pulley, at each end; these discs are fastened to the panel handle and the valve’s stem. To keep the cable from slipping on the disc, a barrel-shaped thing about the size of a .22 short, secured to the cable with a set screw, rests in a notch in the perimeter of the disc.
Now, here’s the rub: if the set screw were to back out and the cable were to slip on the disc, the valve could conceivably be left in the “gear up” position while the control handle would return to center, as it is supposed to do when not in use. If this happened on the ground, then as soon as I operated the flaps or speed brake, both of which are hydraulic, all three gears would retract.
Any retractable landing gear poses a risk of inadvertent retraction. My first airplane had no protection; I simply kept my hand away from the gear switch (which was electric) while on the ground. Of course, I never dreamed that I would be so silly as to unlock the gear by pulling on the nosewheel doors, but none of the usual kinds of protection would have helped in that case anyway.
Many airplanes with retractable gear have some sort of system that disables the gear actuator while on the ground. For example, there might be a pressure switch in the pitot line that allows the gear to retract only when the airplane is at flying speed, or a “squat switch” on an oleopneumatic gear strut might sense when the strut is compressed and turn off power to the gear actuating system.
A problem with all such systems is that the protection itself can fail. It can either not prevent retraction on the ground or not permit it in the air. In the latter case, multiengine airplanes whose ability to climb on a single engine depends on cleaning up gear and flaps need a way to bypass the squat switch. And so the complexity, and the number of potential points of failure, mounts.
Once I recognized the vulnerability of Melmoth 2‘s gear system, I felt that I had to find a way to protect it. My first thought was naturally the conventional squat switch, which has the virtue of preventing both commanded and uncommanded retraction on the ground. I posed the question to a pilot friend who saw it mainly in terms of information-I needed to know the true status of the hydraulic valves at all times. He first proposed that I put three lights on the panel to indicate that the three valves were or were not in a safe-that is, closed-position.
The trouble with that idea is that three lights mean three microswitches, plus a fuse or circuit breaker-complication, not simplication. For that matter, you might not notice the light at a critical moment. He later proposed that the microswitch energizing the hydraulic pump be located at the valve, not at the lever, so that you would learn of a disconnect because the pump would keep running even after you centered the handle. This made sense, and I considered some variations on the theme. For example, there could be a single microswitch on the gear valve, but that switch would supply power to the flap and airbrake controls so that they would not operate unless the gear valve were in the off position. Both arrangements would hold the flaps and airbrake hostages to the integrity of a single microswitch circuit-perhaps an acceptable risk, since electrical circuits and environmentally sealed microswitches are quite reliable.
Then I began to consider whether the same cable failure that I was contemplating in connection with the landing gear might not also occur in one of the other systems, so that, for example, raising the gear on a go-around, or lowering it for landing, would also unintentionally retract the flaps or deploy the airbrake. Any of these uncommanded actions could, under some circumstances, be unwelcome and even hazardous.
The more I thought about the question the more baffling it became, like one of those logic problems (the Englishman smokes Old Gold, the man in the yellow house drinks tea, etc, etc) that oblige you to ferret out the hidden implications of a few seemingly unrelated clues. Each solution that I thought of seemed to introduce a new hazard or demand a further backup. The compound interest from simplication was going to my creditor, not to me.
Eventually I saw the obvious-that the root of the entire problem was the cable circuit between the instrument panel and the hydraulic valves. The placement of the valves in the wing was a consequence of an early decision to keep hydraulic lines out of the cabin. If I abandoned that policy and put the valves themselves behind the panel, so that I would be operating them directly, the positions of the gear, flap and airbrake levers would absolutely coincide with the condition of their respective valves and all the difficulties would disappear. What I would lose would be freedom from hydraulic spills, seeps or drips in the cabin-minor irritants, I now realized, compared with retracting the gear on the ground.
No system is so simple as to be immune to malfunction. My father was once approaching the airport at Sedona, Arizona, in a Fournier RF-4, an airplane with a retractable monowheel landing gear operated directly by a lever beside the pilot’s right thigh and below the throttle. He was wearing a Bogartian trench coat with loops at the cuffs. It was turbulent, and just as he flared he hit a bump strong enough to make his right hand drop from the throttle and then fly up again. The loop in his cuff caught the handle and lifted it, unlocking the gear, which retracted just as the airplane settled onto the runway.
So much for absolute simplication. But the most direct method of getting something done, with the fewest and most robust components, continues to be the best. Mechanical systems allowing direct visual status checks are desirable not only because they are easily inspected and maintained, but also because their operation can be intuitively imagined by the user. Airplanes are no place for Rube Goldberg contraptions. And one other thing-don’t ever fly in a trench coat.
