Sunday, April 5, 2015

Economical & Safe Aircraft Up — Nuts & Hijackers Down

Economical Safe Aircraft Up 


Nuts & Hijackers Down 

Ethics and economics of accidents waiting to happen.
Disaster bait
Flying cradles and flying targets 
Trust me; I'm here to protect you…
The economics of ineffectuality.
Major objectives 
Initial thoughts on passenger aircraft: breaking moulds
Flight Modules
Ramblings on possible flight module designs
Payload Modules 
Ramblings on possible payload module designs 
Accessory Modules 
Attachment and deployment
Implications in context


Propose to an Englishman any principle, or any instrument, however admirable, and you will observe that the whole effort of the English mind is directed to find a difficulty, a defect, or an impossibility in it. If you speak to him of a machine for peeling a potato, he will pronounce it impossible; if you peel a potato with it before his eyes, he will declare it useless, because it will not slice a pineapple.
                                                   Charles Babbage

Large commercial aircraft in particular, could be redesigned with their various functions of power, control, and load bearing assigned to separate modules that are connected from the time of takeoff to landing. After landing the modules would once more separated for logistical reasons. Apart from impressive operational advantages, such designs could greatly improve the safety of commercial aircraft for the passengers, cargoes, staff, and for persons and property on the ground below. Hijacking, terrorism and psychopathic attacks directed at commercial air transport should practically vanish. Costs, logistics, and insurance should all improve greatly.

Ethics and economics of accidents waiting to happen.

Management by objective works if you know the objectives. Ninety percent of the time you don't
                                                      Peter Drucker

Passengers in a modern airliner are hostage to the fate of the plane. In crashes and hijacks their best strategy is to be lucky very lucky.  Yet redesign of passenger aircraft could give even unlucky passengers a high chance of survival in emergencies, improve air fleet economy and efficiency, and reduce the stresses of travel.  In particular, hijacking for whatever purpose, whether for pleasure, profit, or terrorism, would become a historical footnote, and preventive maintenance and equipment inspections would be easier and cheaper to act upon. Even destruction of an aircraft by smuggling a bomb on board would become very difficult.

Practically by logical necessity all security is an overhead and a curse; complete security against rational technological risks is out of the question; natural forces and random events such as death from shock when a black box or a meteorite falls on one's foot cannot be eliminated. The closer one gets to perfect elimination of risks, the exponentially greater the costs and nuisance of the precautions. It follows that to make an aircraft disaster-proof would be a pipe-dream at best, and to replace the current concept of a commercial airliner with something less disaster-prone should be a beneficial project.

Importantly, the more complex the system to be protected, the more likely that some weak point can fail, causing total disaster. However, if it is possible to isolate components of the system, then the consequences of any isolated failure are likely to be less severe and possibly even controllable when something does go wrong. Even if complete rescue of the system proves impossible, removal of the unharmed components from the effects of the failure may contain the ill effects.

Eggs in independent baskets...

Disaster bait

Furthermore the more intensive and extensive the precautions one takes, the greater the risks of disaster from those very security precautions when something does go wrong — one could for example be smothered by accidental triggering of a fire extinguisher system in a building from which the occupants cannot escape fast enough. (This is an actual hazard, not my own invention!) And one may rely futilely on a security measure that one's staff have surreptitiously disabled because of justified fear of its effects (such as the dangerous fire extinguisher) or because of its nuisance value (such as access control that keeps getting in the way of pizza deliveries also not my own invention!) New designs to reduce the probability of that sort of disaster in air transport also would be a praiseworthy objective.

And of course security itself is a continuous and futile expense and inconvenience; it even is a hazard when absolutely nothing goes "wrong".

All that was the Good News. Disasters caused by either systematic risks or random events may be reduced drastically by systematic precautions, but an increasingly egregious class of threats stems from global social parasitism and terrorism; your human enemy, though less ingenious than the Perversity of the Inanimate, is persistent and assiduous at researching weaknesses in security systems. By concentrating all our vulnerability in a single unit that depends on the totality of our defences being consistently successful, we not only ensure that if anything goes wrong the whole baby, cradle and all come tumbling down, we also offer the enemy lunatic or criminal a consistent and concentrated target. 

Some might point with pride at the tremendously complex system of airport security to sift passengers, baggage and cargo, but such a system is hardly better than an implicit admission of defeat. The direct costs not only are enormous, they are humiliating, and I suspect that indirect costs to countries, companies and passengers are worse than the direct costs. And to add insult to injury, we still have not reduced the problem to acceptable levels, neither in terms of terrorism nor accident, nor malicious sabotage and murder.

Don't take my word for it; ask your news channels.

Flying cradles and flying targets

Target systems typically are specified by previous generations' (smugly out-of-date) engineers and management, designed by the current generation's  (smugly green) new brooms and interns, and imposed and documented by any generation's (smugly incompetent) red tape brigades and Jacks in office. Witness the hijacking of a US military drone by Iranian staff who landed it in their own territory under their own control.

At least that humiliation was cheap and cost no lives — not immediately anyway; however, how much the US learned from the experience, I am unprepared to bet. One way or another, it should be profitable to decrease disaster resulting from terrorism, corruption and incompetence.

In the context of commercial flight, the plain fact is that to put all your passengers into one basket, together with everything it takes to fly them, power them, pilot them, land them, and protect them from terrorists and turbulence, creates a responsibility that in the current and foreseeable situation is impossible to commit to in good faith. Firstly, to honour it would demand that every part of the system must be proof against every possible eventuality. That not only is expensive, but flies in the face of god: rationally you know that sooner or later something must happen to some part of the system that has nothing to do with all the others.

Except that fail one, fail all.

The pilot goes insane or otherwise incompetent?
       The passengers and the aircrew are doomed.

Some idiot put a consignment of fireworks or LPG in the cargo?
       One spark or spontaneous reaction, and the passengers and the aircrew are doomed.

The control system develops delusions of immunity to ice?
No prizes for guessing...
Nor for extending the list indefinitely.

But the systems are progressively increasing in reliability and versatility, surely?

Very possibly true. But tell them that on say: 
  •       Air France Flight 447, 1 June 2009,·        
  •       Malaysia Airlines Flight 370, 8 March 2014,·        
  •       Indonesia AirAsia Flight 8501,·        
  •       Germanwings Flight 9525, 24 March 2015,·        
 or on 2001 September 11 alone:

  •             American Airlines Flight 11,
  •             American Airlines Flight 77,
  •             United Airlines Flight 93,
  •             United Airlines Flight 175.
It would be simple to extend that list, but the operative point is that all of them were reasonable to expect under current circumstances, whereas in a regime of rational aircraft design all would have been avoidable, all unnecessary, and all should have been avoided or at least mitigated, with the saving of something like 1500 lives on the aircraft alone and a good deal more on the ground.

And those are just a sample that included examples of pathological psychology, terrorism, accidents, and technological vulnerabilities; from the past forty years alone it would be simple to add hundreds of accidents, thousands of lives, and scores of hijackings to the list. 

Trust me; I'm here to protect you… 

And irrespective of the order of magnitude of the costs in lives, property, risks and morale, the entire system flouts an ethical principle that should be a fundamental imperative, but is flatly ignored in practice:

If you offer a facility that wrests the power of self-determination, of self-protection, from the hands of your clients, then your own protection of the clients should be so robust that any substantial residual risk generally could be left to the clients in good conscience instead of letting them die in horror and helpless indignity as part of the cost of doing business — your business, never mind theirs.

A lot of this style of thinking in the lift business is illustrative, even if on a less significant scale. (Oh, all right; "Lift or elevator"!)  Have you ever been stuck in a crowded lift for an hour or several? Or a day or two? Don't bother to tell me how reliable lift support and maintenance is; it isn't! Especially it isn’t when there is a major power outage with lifts stuck all over a large city. I have seen people trapped for nearly an hour in fully maintained lifts of a top brand in a modern building in a first-world city during the business day. Unbelievably, in that event the alarm had failed (it had been checked, but turned out only to have been working properly on the ground floor!) and if one passenger hadn't happened to have a working cell phone on him, they might have been there all day —  or longer. 

Such events (and worse!) could be avoided by redesign of lift systems, but that is another and different topic; all I remark here is that the airliner business is in no position to sneer. 

Notice that the lift industry can argue with some justice that such events are very unusual and that it is even more unusual for anyone to die in lift-related accidents than in aircraft.

Certainly. Granted: but that is the very opposite of the point at issue.

The fact is that when such errors, accidents, or terrorism do occur, the passengers not only are at the mercy of staff whim and incompetence, or earthquake or power outage, but are advised not to even to attempt to escape on their own initiative whenever the lift authorities have dropped the ball and abjectly failed to meet their responsibilities. 

And let's not even discuss cruise ships and ferries; sometimes one might compare the ethics of such companies to those of the illegal immigrant business. Just one look at the Wikipedia list of maritime disasters shows that dozens of fatal ferry disasters have happened in just the first dozen years of the 21st century alone (not the 20th or the 12th) costing thousands of lives and endangering many more thousands that had been betrayed by services that failed to give passengers choices in their time of need.

A lot more of that sort of responsibility is intrinsic to the current style of the commercial air transport business:
Take all control out of the passengers' hands and tell them to relax and enjoy the trip.
Nothing can go wrong. Trust us!

I of course don't trust those blighters any further than I must.

But sometimes I must indeed.

And I don't like it. Apart from the insecurity of my precious carcass, the sheer unnecessary incompetence of the whole business offends me.

The economics of ineffectuality.

History shows that where ethics and economics come in conflict, victory is always with economics. Vested interests have never been known to have willingly divested themselves unless there was sufficient force to compel them.
                                 Bhimrao Ramji Ambedkar

The current transport aircraft industry has had a long time to develop technology and design of impressive effectiveness, so much so that it is one of the world's largest energy users, and practically all the clients have little alternative but to fly and to send valuable goods by air. Furthermore the system's efficiency has increased gratifyingly compared to even half a century ago, what with the improvements in high bypass turbofan engines.

At the same time, to diverge even slightly from existing design concepts in producing a new model of large aircraft is so horrendously expensive that the only basis for doing so is to chase an already committed market. To develop and produce the Airbus A380 amounted to a multi-state government initiative. 

As a result certain classes of aircraft design have practically petrified.

One consequence is that logistically, the way our aircraft work, they lag behind the flexibility of our trains, ships, and even our larger trucks. Six decades ago, if you wanted to load a ship you waited till it had docked at the right dock, and till the cargo was available in the same place. Then you opened up the holds and began to load it piecemeal, much as had been done for perhaps 6000 years. Much the same is true of trucks, though of course with a much shorter history, depending on whether you count horse-drawn transport or not. Railways of course began differently, so much so that the term "railway train" was already in use 200 years ago. The bulk of mechanically powered railway transport always has been by trains, connected strings of units instead of single powered units.

With certain special exceptions large road transport trucks tend to take the form of tractor units with trailers.  And except for bulk carriers, containerised vessels now dominate sea transport.

But transport aircraft? Apart from a bit of swapping of interior fittings, or possibly bolting a shuttle to the outside of the plane, everywhere the engines lead, or fail to lead, the whole plane is sure to go, costs, overhead, preparations, delays, risks, the works.

  • Problem with the engine?
               Cargo and passengers must wait (ask someone who has suffered, such as yours truly!)
  • Problem with the cargo? 
               The horrendously expensive airframe and engines sit idle if the whole caboodle doesn't 
               crash or blow up.
  • Problem with a missing registered passenger who has not embarked, or with a bomb threat? 
               No problem, just wait till everything is settled and the fuss dies down. 
               The engines and airframe don't mind, though the carrier executives are 
               tearing their hair as they watch their profits seeping out of their idle investments!
  • Problem with landing, cruise or take-off? 
               One crash, all crash.
  • Problem with loading or embarkation? 
Never mind, you have the idea by now...
Anyway, I must be equally blameworthy, as I have no better suggestion...

Or do I? 

Not as things stand, certainly, but must things be thus forever? Can't we break the mould?

Major objectives

The more moral the people are in their business dealings, the less paperwork you need, the more handshakes you can have, the more the wheels of capitalism work better because there's trust in the marketplace. Business ethics is not a joke. And, in fact, I think most businesses that I've dealt with encourage exactly that type of behavior
                                                   Rick Santorum

The basic idea is to replace our current concept of an airliner or cargo carrier with an aerial equivalent of an articulated truck: a power module plus detachable cargo or passenger modules. The latter we might generically call payload modules.

This could be done in any of several fundamentally different modes, not all of which I discuss here; for example I am deeply suspicious of the practicality of having the flight module tow the payload module by some means of articulation —  so deeply suspicious that, though I cannot logically exclude its practicality, I do not discuss the idea to any extent in this essay. Possibly I am prejudiced by the memory that the Germans had disastrous experiences with their Troikaschlepp in WWII (details at 

I must admit that their Heinkel 111Z Zwilling  had a lot more merit, so perhaps I am dismissing the concept too easily; but one idiocy at a time...

(described at

Given more practical means of attachment, the principle of an aircraft comprising a power module plus detachable cargo or passenger modules has immediate attractions in promising more efficient air transport logistics, maintenance and utilisation. It should easily justify the concept on that basis alone.

One non-negotiable feature would be that while the aircraft is in flight there would be no means of access by which either passengers, parcels, or crew could get from any one module to any other module of the assembly.

None. Not in emergencies nor in pranks nor in visiting the pilots to see the wheels go round. Electronic communication would be possible, but no more than that; if you want to get there from here, you land first; in flight you cannot even climb out and force your way in.

However, even if any such modular design of aircraft were costly in itself, there is another more powerful justification for the idea. The nature of air travel as it has developed so far presents a standing invitation to any terrorist who can get on board; once in charge he can hold the entire system to ransom and thereby control it.

If instead the pilots in their flight module and the staff, or even passengers, in the payload modules, independently of each other, could reasonably safely override any other parties' decisions and jettison the payload module from the power module, then the temptation for terrorists to strike at passenger aircraft by holding passengers to ransom would become greatly constrained in choice and limited in options.

For example, think of what would have become of the options for the 9/11 attacks if the hijackers had had to hijack the fuelled and flight-ready flight module while the aircraft was still on the ground. And think how much more limited the damage would have been if (miraculously) they had succeeded. Only a fraction of the momentum would been available for destruction, and hundreds of lives fewer in jeopardy.  

And suppose that instead the terrorists had hijacked the passenger module? Being unable either to reach the aircraft controls or anyone controlling the aircraft, how could they persuade the pilots to fly into buildings?

If the design were such that in the event of an in-flight emergency the payload module could be jettisoned in such a manner that it could be left to settle in a survivable mode, either on land or water, then most classes of impending emergency could be prevented, aborted or mitigated.

  • Relieved of its burden, the flight module should be able to deal with many situations that would have been unmanageable with a full load. Whether the flight module could or should be capable of parachuting as well, is an open question. Conceivably flight modules that in the event of catastrophic failure could descend by parachute, could save many lives on the ground.
  • Parachuted passenger modules (and maybe cargo modules) should be able to  land without loss of life, or at least with grossly decreased risk of adverse effect on either passengers, property or pedestrians below. 
  • Parachuted fuel modules might not be a practical option, but if successfully applied, they should speed refuelling, might improve range flexibility of large commercial aircraft, and should reduce dangers to the flight module in a crash landing. Detached from the flight module, they could have mitigated the 9/11 disaster so effectively that the World Trade Center might still have been in use.
Fire for example has proven practically uncontrollable in major crashes, even in experiments with less volatile, more viscous fuel formulations than avgas, but fire would become almost irrelevant to unfuelled passenger modules, and possibly flight modules with detachable fuel modules. (Cargo or luggage modules might carry fire or even bomb risks, but that is another matter.)

Initial thoughts on passenger aircraft: breaking moulds

The world is full of magic things, patiently waiting for our senses to grow sharper.
                                                          W. B. Yeats

Broadly speaking an airliner can be regarded as a unit that serves the functions proper to transport and to servicing of the payload. This is not a matter of whim; there are compelling reasons for this. Aircraft have to be designed that way. Aircraft have to fly and they have to carry payloads, animate or otherwise.

They always have been designed that way.

And that proves it. Any alternative design would be ludicrous, exorbitant, and technically unpractical as well as showing disrespect to aviation history and to our passengers.

So that is that then. There is nothing to discuss; the following remarks are pure fantasy, so you should not take them any more seriously than anyone else does, nor need you even bother to read them. To prove this, let me begin by pointing out that what I suggest is containerisation in commercial aviation.

Which is absurd.

By this I do not suggest the form of shipping containers currently standard in freight transport, but a drastic redesign of large commercial aircraft. (Blueprints not included!)

The fundamental principle is to separate a transport aircraft into:

  • A flight module for power, control, and navigation and
  • One or more modules to carry payload such as passengers,
    luggage and cargo
    and possibly fuel.
Further separation certainly would be possible, possibly desirable too, but to begin with consider mainly those two items.

The modules would be united only at take-off, and would be separately maintained, prepared, scheduled, loaded and discharged. Each would be designed for its own particular functions and none would be burdened with irrelevant requirements proper to the other type of module.

Flight Modules

The courage to imagine the otherwise is our greatest resource, adding color and suspense to all our life.
                                                                         Daniel J. Boorstin

The flight module would support the flight crew, power units, fuel stores, control surfaces and so on.

The flight module should be based on well-understood aircraft design practice. It should have sufficient power, control, fuel capacity and so on to carry airliner-scale payload modules economically under conditions of commercial practice. It would be designed for full flying capability and landing whether loaded or not, though designs that require power assistance for loaded take-off might well be considered for reasons of efficiency and safety.

The flight module should have no particular payload capacity for internal cargo or passengers beyond those required for the needs of the flight crew. It presumably would have wings, fuel tanks (or possibly connections for fuel modules) and engines designed with such needs in mind.

Ramblings on possible flight module designs

To accommodate the attached payload modules flight modules might have:
  • a fuselage with a flat- or hollow-channel upper surface, or
  • a twin-boom design, or
  • payload module mounts on multiple vertical stabilisers, either a single unit, or several in parallel. In such a design each vertical stabiliser would bear its own independent elevator for trim, including the massive trim necessary when disengaging from a major load in flight. For convenience I assume that the stabilisers would be well aft, but probably it would be better if the centre of mass would be close to above the centre of mass of the flight module, and in flight the centres of mass, drag, thrust, and so on must necessarily be properly balanced and trimmed.

  • It seems likely that the design of the flight module could benefit from large canards or even a tandem pair of front wings to adjust for the addition or jettisoning of payload modules  behind the centre of mass of the flight module. For ease of trim it even might prove preferable to mount the load-carrying stabilisers on a central pair of wings rather than aft. Details, details...
The range of conceivable practical designs is too huge to be worth discussing here; those I mention are strictly as a basis for discussion, but design objectives would include such things as fuel and operational efficiency and versatility. Fortunately many existing, well-understood mechanisms are available that should meet any of the various requirements of such applications.

In any event the flight module would need exceptional facilities for adjusting trim to compensate for flight with or without payload modules, whether from take-off, or in cruise flight or emergency jettisoning. It is likely that computer-controlled fly-by-wire technology would be necessary for the necessary control during transition phases of flight during jettisoning, but fortunately such technology already is routine in modern airliner design.

The trim units would need to be fuel-efficient as well as powerful. Whether the trim mechanism would take the form of any combination of large elevators, canards, or all-moving "flying tailplanes", or the ability to change the angle of thrust of the engines, is another question irrelevant at this point in the discussion. Flying tailplanes would have attractions if a flight module were to carry multiple payload modules on projections in the form of vertical stabilisers.

Whatever the design, the flight module would be designed to be fuelled, crewed, flown, and maintained independently of any of the passenger or cargo modules that it carried. As a rule flight without an attached payload module would only be for ferrying or similar purposes, just as the power unit of an articulated truck does not generally drive around without any payload modules attached, if only because every trip without a payload would be an expense.

However, with everything ready for a load-bearing flight, the payload modules would be mounted on a flight module and attached for take-off.

In this text I make the assumption that the flight module would mount its payload-bearing modules on its upper surface. In actuality that need not be the case and the eventual choice of configuration does not affect the overall thesis. All the same, back-packing strikes me as the simplest, most efficient, and most flexible option and I therefore adopt it as the basis for discussion. Without affecting the fundamental points, any eventual design would very likely depart radically from suggestions in this essay.

How best to manipulate a full payload module on the ground, given that eventual designs might weigh hundreds of tonnes, is a matter for engineers to determine, but it certainly is not a forbidding challenge; there are several options, of which the simplest might be to load the modules in cradles below which the flight modules could be moved by ground crew for coupling. Alternatively the modules might be mounted on ground vehicles designed to move them from the loading cradles to the flight module, and to retrieve them from the newly-landed flights. Such design options will not get much attention in this essay because they do not greatly affect the thread of the argument.

By whatever means selected, ground equipment would separate the payload modules for independent processing as soon as practical after any flight lands, perhaps before the engines stop. The flight module would proceed to where it variously could be refuelled, maintained, or have payload and fuel modules mounted for immediate take-off. Cargo modules could be dispatched immediately for unloading or loading procedures, and passenger modules for disembarking.

There would be no need for the flight modules and cargo or passenger modules to have any association except during the actual flight. As soon as a module is loaded it would become eligible for attachment to whichever flight module happened to be scheduled, much as any of our current cargo containers might be loaded onto a ship or truck or aircraft wherever and whenever appropriate.

Payload Modules

Greed, accident, or malice may have harmful results, but, barring something truly apocalyptic, a resilient system can absorb such results without its overall health being threatened.
                                                     Jamais Cascio

Payload modules would be as simple and economical as possible, consonant with their safe and satisfactory function. Note that in this connection, "economical" does not mean "cheap". We are not contemplating a tomato box stapled to the back of the flight module, but a durable, functionally and aerodynamically efficient and effective unit, though one that as far as practical abandons all non-specialist functions to the flight module.

Any payload module is designed to be handled, loaded, inspected and maintained on the ground, and dedicated ground equipment will supply, mount, and dismount it, and generally expedite its functions while it is not allocated, let alone attached, to any flight module. Its design would permit far faster, more convenient, economical and comfortable maintenance, loading and unloading, embarkation and disembarkation, than any present airliner.

In preparation for flight the payload module or modules would be attached to the flight module and would remain attached in a fail-soft manner that requires active attachment at all times. Apart from any active command to detach, any failure of power or control in either flight module or payload module would cause immediate jettisoning of the module, whether it contains passengers or goods.

In the event of threatening disaster, the payload module would be jettisoned to parachute down in comparative safety, which admittedly would be a minor disaster in its own right, because it would be an expensive disruption and there would inevitably be expensive or even tragic damage. In the worst case however, the damage would not be expected to rival the disasters to be expected from current aircraft, and in general damage would be trivial in the scale of such concerns. In concept it would resemble the "communication cord" that used to be customary in railway systems: "To stop the train pull down the chain (Penalty for improper use five pounds)".

Changing circumstances have reduced the role of the passenger-operated emergency brake, but in aircraft there might be room for something along those lines.

Ramblings on possible payload module designs

The form of the payload module probably would be roughly cylindrical, like most airliner fuselages at present, but it might well be flatter, especially on the ventral surface, which would mate to the upper surface of the flight module.

One reason for the flatter shape is that it would be designed as a lifting body capable of gliding without wings as long as its airspeed is adequate.  Its shape would in fact contribute to lift in flight as well, but less for flight efficiency, than because of the functionality required in case of a need to jettison the module in an emergency.

Only if unavoidable, stabilisers, elevators or canards might be included on payload modules for:

  • Contributing to the trim of the total aircraft as calculated at the time of loading and embarking
  • Supplying part of the disengagement force to separate the modules in emergencies that require jettisoning of payload modules
  • Achieving the proper attitude of the jettisoned load or passenger modules during independent descent. 
Such external elaborations however, should be avoided if at all possible:

  • Trim should be left to the flight module if practical
  • Aerodynamic forces on the payload module should be adequate for disengagement
  • Drogues and air brakes should be adequate for establishing the modules' attitude on being jettisoned.
Entrance and exit should be at either end of the payload module instead of side doors. At each end there should be full-cross-section flap-up conical doors, providing far faster, more flexible, and more convenient access than current airliner and most cargo liner designs.

The interiors of the cones that act as end doors should contain the equipment that never gets accessed except in an actual emergency or for maintenance. How many passenger levels or rows the module would provide would be matters of detail. To deal with circumstances in emergency landings in which either of the exit doors cannot be opened, there should be explosive or sprung releases to detach the doors completely and afford sufficient egress to the occupants.

Similarly, there might be means to breach the outer bulkheads in strategic regions to create exits should this be necessary in exceptional circumstances, such as if the cones cannot be shifted because of obstacles or because the module is resting upside down.

Several forms of such single-use escape hatches could be cheap, effective and reliable, for example sodium azide charges could break integral external skin panels outwards, panels that could not open at all without force greater than could be applied manually.

The explosion in turn would release covers to permit manual removal of gaskets to free inner panels that could not open outwards, and possibly inflate escape chutes. People inside the module then could use the hatch within less than a minute. This example is strictly for discussion, to demonstrate feasibility; the actual design in practice might be greatly different, but the point is that staff and occupants should be able to get out without needing to wait for external help. 

Compare this with say, Saudia Flight 163 19 August 1980, in which over 300 people died in a fire, not having been separated from cargo and luggage where the fire had started, with ground crew unable enter in time, and  occupants unable to break out.

The number of optional design features is indefinite. The length, width, and shape of payload modules could be varied beyond any limits worth discussion here. The same is true of options for their combination into passenger, luggage, and cargo modules

The passenger module must have its own internal power supply, but it would be minimal; its primary function would be for emergency requirements such as running the black box and for attachment to the flight module. There also would need to be enough power for passenger services such as lighting, passenger and crew service, passenger comforts, and long-range communications during times when the module was not attached to the flight module. 

Note that independent communications that cannot be overruled by anyone outside the payload module would be an important facility. Wherever the module goes, it should be able to emit distress and location signals as well as black box data, probably via satellite in most cases. These should feed information to the staff and interested passengers so that they could tell when there are untoward circumstances or behaviour. They should enable them to inform or query ground control independently of anyone else. The very possibility of any repetition of Malaysia Airlines Flight
370, 8 March 2014 should be eliminated. The facilities need not be elaborate by current standards, but should be capable of operating from battery power for days at least, from anywhere above the planet surface.

No doubt all of the power for routine operations within the payload module while it is attached to the flight module, and for maintaining battery charges for emergencies in flight, would be supplied via electrical or possibly pneumatic connections to the flight module. There would be several advantages to avoiding carrying fuel and internal combustion engines on payload modules.

Usually I would  prefer that aircraft seats should face backwards, which often would be a life-saving feature, but for reasons I mention later, in some designs considered here I suspect that it might be better to have them facing forward.

I suggest that the passenger module should be windowless, though I expect that to be an unpopular choice. Omitting windows would however simplify the choice of the direction in which the seats would face; by suitable interior d├ęcor, passengers could be made to feel as though they were facing forward except on take-off.

Either way, instead of physical windows, bearing in mind that nowadays passenger movie monitors are pretty nearly standard issue even in cattle class seats, transparent windows with their weight, expense, limited field of view, hazard, and structural costs could be replaced by a selection of screen views or even virtual reality glasses for outside viewing, so that a curious or claustrophobic passenger could look out in any direction. Possibly he might be permitted to substitute his own laptop for the screen so that he could capture any shots that he finds attractive at any point in the trip. Given the sanity-threatening boredom of modern flights, such facilities should be hugely attractive, certainly when compared to the windows of modern jet liners. Internally reflective surfaces and similar architectural and interior decoration techniques in the passenger cabin could be employed to reduce the claustrophobic effect even further.

In case it seems to you that I am irrational in my criticism of airliner windows, read the history of the De Havilland Comet. Passengers died of big, rectangular windows, and the windows we have inherited in their place are hardly worth living for. Much, much better would be glasses that give passengers not only the movies they want, but information, about time, position, ETA, mealtimes etc, reassuring views of the pilots' cabin, views outside at any desired angle around the aircraft, views of their own laptops etc with facilities for image capture.  

And such glasses would be cheaper to supply than windows, as well as safer and more entertaining.

Accessory Modules

The most anxious time was during launch, just because that is so dramatic.
                                                    Sally Ride

Another class of power module might be commercially valuable in some circumstances: a take-off assistance power module. This would be a hugely powerful short-range module to assist cruise-optimised, long-range flight modules to get into the air with loads too great to permit a fuel-efficient flight module to reach a safe cruising speed and altitude, especially with a full load of fuel. Afterwards the take-off module would disengage and land again, say ten minutes later, and assist the next flight in line.  With such assistance, take-off could become an assembly-line affair.

Such a device would very likely be unpractical in current circumstances, but the notion could become a lot more attractive in the context of the following discussion.

Attachment and deployment

Creativity requires the courage to let go of certainties
                                 Erich Fromm

Of all the topics in this essay, this is necessarily the vaguest, partly because there has been very little research (read: none that I know of) on the physical practicality of anything of the type, and it is certain that any viable system will demand considerable development work.

To simplify discussion I do make certain assumptions; conceivable engineering alternatives are endless and it would be pointless to discuss their details before there are any prospects for development work. So for example I assume that the flight module will carry any payload modules on its back or on attachments configured as vertical stabilisers.

I also assume that the flight module will be designed specially for these purposes, and not as a minor  modification of an existing aircraft.

As already remarked, the means of attachment of the payload module will be such that whether this is desirable or not, the decision to jettison could be made by either the flight or payload module staff independently, preferably with, but if necessary without warning. I propose mechanisms that could work in principle, but I do not insist that a real life version must be of the proposed types. Similar principles apply throughout the essay.

The payload module, like the flight module, would need detailed engineering design beyond the scope of this essay. The following remarks are mainly a demonstration of the kinds of consideration that might be relevant to the desired function, not so much a proposed design as a sketch of some of the design concepts that might serve as a basis for initial discussion.
  • If it should prove necessary to prevent disaster, the intention is that it should be possible to jettison the payload module in flight. How much of the module is intended to be salvageable after jettisoning would be a secondary consideration. The unit would not be cheap by any means, but should be only a fraction of the cost of an entire modern aircraft of comparable capacity, and probably only a fraction of the cost of the flight module       
  • It seems likely that an economical design would assume that a jettisoned payload module would seldom be recoverable except as scrap, though its contents should be expected to be recoverable with generally minimal harm.     
  • In any case, salvageability would be incidental at most; the primary concern would be survivability and prospects for rescue of the crew and passengers. Given that passenger survival and flight security would be the main objectives, it would follow that the salvageability of the cargo should be high, if human survival in good health would be at all to be expected; most cargo should be able to survive any impact calculated to prevent  human casualties. In practice this is important, because the cargo as a rule would be much more valuable than the module bearing it, so to ensure security of a typical cargo would reduce costs of insurance and related concerns, thereby favourably affecting the commercial viability of the entire concept.
  • Accordingly, although this is not essential to the current discussion, it should be possible to design deliberately disposable, or at least semi-disposable, payload modules specifically for air-drops, usually in emergencies where landings are not practical and where more is needed than just dropped or parachuted crates. This could be of value either in military or civilian operations in circumstances where only a proportion of the payload modules could be expected to be recovered economically if at all.
  • Whatever means might be applied to permit the module to touch down with sufficient gentleness to preserve the lives and cargo of those aboard a payload module, those same means would be consistent with decreased risk to the safety or property of anyone on the ground. To put it mildly, any person or structure beneath such a descending mass obviously would be gravely at risk no matter what the acceleration, but there could be no comparison between the effects of an aircraft with fuel and engines crashing at high speed, and a payload module passively descending at a speed at which passengers are calculated to survive impact.
  • At a first approximation, it should be acceptable for passengers strapped into their seats and encountering the acceleration from behind or below, to experience about 20g for say one second or so. What actual acceleration would be practical to design for, is not a topic for this essay, but anything much worse than that would be unacceptable. 
  • The payload module should have a surface (presumably the lower surface, though there are possible alternatives) that mates with the flight module. The entire assembly must be designed for aerodynamic efficiency when mounted. And when they are unoccupied, the flight module's attachments should be aerodynamically safe and economical.
  • The payload module should have electromagnetic means of locking the payload module into place during flight, most likely using mated solenoids with little net external field. In either case there should be no external moving parts and the design should permit load balancing on the ground before take-off, with sufficient precision to permit the flight module to correct deviations in flight by adjusting trim in the usual manner.
  • In this design (many others are possible) the intention is that attachment of the payload modules to the flight module should be maintained only by active force, not by mechanical locking. On loss of attachment power, whether initiated from the payload module or the flight module, whether by command or by failure of power in either module, the attachment should fail immediately and passively. The jettisoning procedure then should commence irrevocably and should take seconds at most. Neither the flight nor the payload module, either by manoeuvre or command, could veto the detachment. It is possible that a further option to detach might be exercised by ground control if it is seen that an aircraft is behaving in a manner that suggests either bad faith or loss of control or competence on the part of the crew, passengers or any other parties. This however should be protected by cryptographically strong communication protocols, to prevent sabotage or denial-of-service attacks.
  • On loss of attachment the payload module should shed its forward momentum. How it does this is not yet established and there are many options. At this stage all suggestions are purely bases for discussion.
  • In one approach the module might first lift out of its attachment by a combination of tilting nose-up to disengage and climbing passively till it stalls, preferably in a very steep climb. It should stall in such a manner that it begins to fall tail first. Whether it does this with the aid of canards, or lifting off on release by its own aerodynamic shape and trim or passive air brakes, is not for discussion here. If this idea is used, passenger seats might best face forward.
  • Alternatively, air brakes, drogues and the like could drag the module off its attachment and establish it in a suitable attitude for descent, probably more or less horizontal and slightly nose-up, say at an angle of five to twenty degrees from the horizontal. In this braking configuration it would be better for passengers to face towards the rear.
  • In either design the payload module then should deploy its main parachutes from the nose and tail cones and descend at an acceptable rate, and in a desirable attitude.  Except in extreme conditions such mechanisms should work even on the final landing approach within metres of the ground. And if the module simply went skidding off harmfully, but at least got separated from the flight module with its load of fuel, that alone could save many lives, particularly in the event of fire. Details of the parachute design should depend on the relevant engineering requirements.
  • It seems necessary that the mode of attachment of the payload module to the flight module should be such that whatever else happens, the nose of the module should passively lift out of its cradle, no matter what the orientation of the aircraft at the time. For example, if the craft is banking, the module should correct itself, and if it happens to be inverted, it should continue its upward loop till it achieves a nose-up stall. Recovery of the necessary attitude might be at its simplest and most versatile if it depended on drogues or perhaps air brakes, but again, such decisions are matters of design.
  • The nose- and tail-door cones that get raised for access to the interior for embarkation and loading, also should contain emergency facilities such as batteries, parachutes, floats, black boxes, rescue attachment hooks for lifting, towing and the like.  These resources are not to be confused with passengers' resources such as cushion floats; they are only for getting the structure down safely while the passengers remain strapped into their seats.
  • The desired posture for getting the craft down safely is open to discussion. If the luggage and freight compartments are in the stern, then a near-perpendicular attitude might seem attractive, with the rear compartments acting as crushable impact absorption zones. However it might be possible to achieve a slower rate of descent and a softer impact in a nearly horizontal posture. Such decisions also might be affected by the question of whether the descent is over deep or shallow water or swamp or rock for example. These are not decisions that I envisage as being practical to take in the typical emergency, but I do not exclude every such possibility.
  • For descent onto any surface into which the module could sink or get stuck, a horizontal descent should be preferable, otherwise descent into water might easily take the module deep enough to crush part of the hull. Or the module might get stuck deeply enough into mud for water to enter the ruptured hull and drown some of the occupants. It would not as a rule be desirable for the design of payload modules to be specialised for descent onto particular types of substrate.
  • Having descended, the intention typically would be for the hull to end up horizontal and deck down. In water the module would be intended to float indefinitely while automatic distress signals should be sent via satellite communications at least. As fire should not be any problem for detached passenger modules, emergency evacuation would justify no panic or rush. One or more ceiling hatches should suffice for evacuation from water by rescue craft, or sodium azide charges could detach the nose and tail cones after descent onto land, permitting rapid exit. That option also might be used if the module is starting to sink in deep water or is shipping water unacceptably fast. Unlike jettisoning, such an emergency exit should be enabled only by active intervention of a crew member if it were to become clear that the situation on board were untenable, and not as part of any automated procedure.
  • During and after descent, automatic emergency location equipment should be emitting emergency and location assistance signals by whatever channels might be practical and appropriate. It would seem reasonable whenever a module gets jettisoned, that disposable and individually identifiable visual, sonic, radar and radio beacons be released to assist in locating the module, wherever it might come down, preferably by satellite communications. 
  • If it should prove necessary to the functional design, there might be trim tabs or canards on the payload module, both front and rear. Their functions should be twofold and their mechanism should be as simple as possible, preferably without moving parts; I envisage them as flat plates warped as required by piezoelectric controls. The two functions should be in-flight trim, controlled wirelessly from the flight module, and controlled stall in the event of emergency jettisoning (automatically controlled from within the equipment in the nose and tail pods of the payload module as required).       

Implications in context

You accept failure as a possible outcome of some of the experiments.
If you don't get failures, you're not pushing hard enough on the objectives
                                                                        John Poindexter

The first and most obvious objective is the increased logistic flexibility and efficiency of modular transport. I suspect that in themselves such considerations could justify a new approach to aerial transport. Otherwise the sheer costs of the new infrastructure might seem forbidding

For the most part routine human error and failure of equipment have been the two largest causes of loss of life and property in air transport; various forms of sabotage and hijacking or weather conditions collectively rank third. Statistically all these causes could be mitigated, some of them to negligibility, by suitable containerisation along the lines discussed in this essay.

If there is sufficient warning, perhaps a minute or so, of any of these forms of failure, then emergency jettisoning of the payload modules could save all or nearly all lives on board. Often such an option actually could prevent what would otherwise have been a fatal crash of the flight module because the flight module would be grossly lightened. Or even if the flight module could not regain control then only the flight crew would be at risk instead of possibly hundreds of passengers.   

Consider some scenarios:

If an aircraft stalls, whether as a result of unavoidable circumstances, or as a result of pilot or maintenance error, as happened in Indonesia AirAsia Flight 8501 on 28 December 2014, then prompt jettisoning could save probably all passenger lives, and possibly correct the stall as well. The same would apply for icing or lightning strike.

Mid air collision, missile strike, bird strike, structural failure, or similar disastrous damage usually would cause power failure and thereby automatic jettisoning of all modules, and any modules that had not largely been destroyed on impact could be expected to survive together with their contents, instead of there being effectively a 100% loss of life and assets, as in Malaysia Airlines Flight 17 on 17 July 2014. Any reasonably intact module that did not jettison in time because of loss of power, could be detached by crew or passenger action and land, probably safely instead of crashing fatally.

Any attempt on the part of crew members to destroy the craft, as in Malaysia Airlines Flight 370, 8 March 2014 or Germanwings Flight 9525, 24 March 2015, would have to be either very sudden or very surreptitious, as anyone in any module who became suspicious could disengage within seconds. No one in the flight module could lock any colleague out of any controls, so that there would have to be collusion between cooperating suicides, or the culprits would have to overpower their fellow crew members.  The same would apply if any hijackers somehow managed to get aboard the flight module and commandeer it.

Physically no terrorist or hijacker embarking as a passenger would be able to reach the flight module for any purpose. Any alarm would cause jettisoning of the  module, after which it could not be taken anywhere by any means and mass escape would be possible under most circumstances.  


Simplicity is about subtracting the obvious and adding the meaningful
                         John Maeda, The Laws of Simplicity

For some eighty years the problem of aircraft vulnerability to all forms of disaster has been approached on the general principle of "If it still don't work, I gets a bigger 'ammer." Much progress has been made along that line, and it is unclear whether, if the problem had been left to solve itself, we would have anything like a viable air transport industry at all.

All the same, we are left with various intractable and ridiculously expensive problems. Collectively, though various, most of those problems stem from the approach of stubbornly concentrating all resources and all vulnerability into united monolithic constructions.  In a sort of mutual veto, their components collectively increase each other's vulnerability and hinder each other's maintenance, deployment, utilisation, and protection.

It is high time to think again.

It has been high time for perhaps fifty years.