By Dominic Gates
Seattle Times aerospace reporter
After months of intense scrutiny, even some of the harshest critics of the 737 MAX’s flight-control system believe Boeing’s software fix will prevent a recurrence of the scenarios that killed 346 people in the crashes in Indonesia and Ethiopia.
Boeing has redesigned the MAX’s new automated Maneuvering Characteristics Augmentation System (MCAS) that relentlessly pushed down the noses of the two aircraft on both crash flights. Though serious questions linger about the overall safety culture at Boeing that waved through MCAS’s original development and certification, U.S. airline pilots are almost ready to fly the updated jet.
“The hazard is designed out of it,” Capt. John DeLeeuw, chairman of the safety committee of the Allied Pilots Association (APA), the union for American Airlines pilots, declared to colleagues a week after trying the flight-control fix in a Boeing simulator in Miami in late September.
Related
Two tragic flights, 12 problems on the Boeing 737 MAX
Bjorn Fehrm, an aerospace engineer and former fighter pilot in the Swedish Air Force, now a France-based aviation analyst with Leeham.net, has said Boeing’s original MCAS design was “criminally badly done … unforgivable,” and compared the system’s aggressiveness to a tiger. He too believes the redesign now makes the airplane as safe as the previous 737 model.
“There’s no part of any airplane out there that’s been as thoroughly vetted,” said Fehrm. “MCAS is no longer a tiger, but a house cat.”
The final pieces of that vetting are now imminent.
Boeing expects the Federal Aviation Administration (FAA) to formally unground the jet next month and to pin down all the pilot training requirements in January.
That’s pending a formal certification flight and a final evaluation of the software fix for the jet’s flight controls. And the FAA insisted Friday that it will take its time and won’t be swayed by pressure from Boeing.
After the FAA clears the plane to fly and issues the pilot training regimen, Boeing and the U.S. airlines will need 30 to 40 days to complete the enormous logistical challenge of getting their airplanes ready to fly after the better part of a year in storage.
Boeing will install the final software fix, refresh all the fluids and lubricants, do ground tests on the engines and flight controls, then conduct a checkout flight. The FAA will inspect every plane.
The worldwide fleet of MAXs previously delivered to airlines was 385, including 72 jets at U.S. airlines. With all the airplanes Boeing has built since, the total of parked MAXs is now just over 700.
American, Southwest and United have all already pushed out the MAX’s return to early March and have said it will rejoin their schedules in a phased approach over several months.
Boeing will also begin delivery of MAXs to carriers like Alaska, whose finished jets the manufacturer has parked and stored pending the ungrounding of the fleet.
Boeing’s fix
On the two crash flights, the pilots struggled to counter MCAS after it was triggered by a single sensor that fed the system an erroneously high value for the jet’s angle of attack — the angle between the wing and the oncoming air flow.
MCAS activated for up to 10 seconds, swiveling the horizontal tail, known as the stabilizer, so as to aggressively pitch the nose of each aircraft down. When countered by the pilots, the system stopped, then kicked in again with a new activation five seconds later. After a vain struggle against these repeated nose-down movements, each short flight — the first 12 minutes, the second just six minutes — ended in a high-speed nose-dive to earth.
Boeing’s fix for MCAS entails three changes to the system design:
It will take input from the jet’s two angle of attack sensors instead of just one.
If they disagree by more than a nominal amount, the system assumes a false signal and will not activate.
If both angle of attack sensors somehow get stuck at the same wrong high value — perhaps if they got frozen in the wrong position — again MCAS won’t activate because the upgrade is designed to do so only when the angle moves suddenly from below the threshold to a new high value.
If both sensors together register a sudden movement to a high angle of attack, the system will activate once only — not repeatedly, as in the accident flights.
The capability of the system to move the horizontal stabilizer so as to pitch the jet nose-down will be limited. The pilot will always be able to counter it by pulling back on the control column.
In addition, Boeing has revised the overall architecture of the MAX’s flight-control computer system, so that on every flight the MAX takes separate inputs from the jet’s two flight-control computers, rather than just one as previously.
These two computers, each processing air data readings from the various sensors on both sides of the airplane, will cross-check and compare values. Again, if they disagree, automated systems including MCAS will be shut down.
This change should catch any computer error as opposed to a sensor fault.
A person briefed on the details said such a shutdown would come in less than one-third of a second, so even if the pilots are distracted and fail to notice the airplane moving as it shouldn’t, the automation won’t be allowed to continue.
This addresses a problem identified in both accident investigations: that pilots took much longer to recognize and react to an MCAS fault than Boeing had assumed. By stopping any erroneous uncommanded movements automatically, the redesign takes the response out of the pilots’ hands altogether.
“We’re not letting the system run while the pilots are inattentive,” said the person, who required anonymity because parties to the ongoing accident investigations are not allowed to speak publicly.
Peter Lemme, a former Boeing flight-controls engineer and avionics expert who has been very critical of the original MCAS design, said Boeing has addressed all his concerns.
Once the FAA approves the fixes, said Lemme, he’ll fly on a MAX with “no misgivings.”
To get the flying public equally comfortable with the MAX, Boeing needs also to counter a recurring theme on social media: the idea that software shouldn’t have been needed in the first place and that the plane’s large engines throw its aerodynamic balance out of whack and make it “inherently unstable.”
Boeing says MCAS is needed not for stability but only to make the MAX feel the same to a pilot as the previous 737 model. The airplane will fly safely with or without MCAS, Boeing insists.
To prove that, Boeing has flown near-stall maneuvers in flight tests this summer with MCAS turned off. Safety regulators plan to do the same during upcoming recertification flights.
Pilot checklists and manuals
Pilots from American and Southwest, as well as Air Canada and some overseas carriers, in late September got hands-on experience with the new MAX flight controls in Boeing’s full-motion, full-flight simulator in Miami.
At a pilot-union conference a week later, Greg Bowen, training and standards committee chairman at the Southwest Airlines Pilots Association union, echoed APA’s DeLeeuw in declaring MCAS no longer a problem.
“In terms of handling characteristics … those anomalies have been designed out of the airplane,” said Bowen.
He said all that remains to be resolved is the training required for pilots, with new attention to how flight crews handle the confusion of a cockpit inundated with multiple alarms. The training and instructions need to be calibrated for pilots with lesser training and experience, he said.
The FAA will issue a report recommending the pilot training regimen, with a period for public comment likely in January. It’s expected that pilots already qualified to fly the older 737 model will be required to take only a two-hour computer course to highlight the differences on the MAX and the changes with the new software.
Bowen said the FAA is also considering significant changes to clarify the procedures in six pilot checklists that cover abnormal flight conditions, including the Runaway Stabilizer checklist that Boeing says the crews on both crash flights could have used to recover the airplanes.
Moving the tail manually
The Runaway Stabilizer checklist is a focus because the Ethiopian flight crew partially followed it: They cut off electric power to the horizontal tail, stopping MCAS from activating.
However, at that point the nose was still pitched downward and when they tried to move it back up manually by turning a wheel connected by cable to the stabilizer, they couldn’t budge it.
The problem was that as they coped with the emergency, the pilots allowed the plane to accelerate to 45 mph beyond the jet’s maximum design speed, causing high opposing forces on the tail that rendered the control surfaces immovable.
Even if the revised MCAS cannot act up again as it did on the crash flights, MAX pilots will still want to be comfortable with manual control of the stabilizer.
A 737 captain on a U.S. airline, who asked for anonymity to speak without permission from his employer, described his own extensive experience as a former test pilot of moving the tail manually.
He said that with the 737 tail at full nose-down position and at maximum design speed, it is “nigh impossible for a normal human to move the manual trim wheel in the nose up direction. The forces are too strong.”
Dennis Tajer, an American Airlines captain and APA spokesman, recently replicated that flight situation in a simulator, deliberately inducing an MCAS-style nose-down pitch at high speed, though still within the normal flight range.
He was able to move the wheel only “a couple of inches, but not enough.”
Tajer said that if the MAX is pitched down toward the ground, it gathers speed all too easily.
“The 737 is a slippery airplane,” said Tajer. “When you put the nose down, it wants to accelerate very quickly.”
He and his co-pilot in the simulator were able to recover control by using an old piloting skill called the roller-coaster technique that’s no longer in the manuals: letting go of the control column to ease the forces, then cranking the wheel, and repeatedly easing and cranking.
“Before we can be fully confident in the MCAS fixes we have to know more about the accompanying pilot training, emergency checklist changes, the extraordinary effort required to recover the aircraft with the manual trim wheel,” Tajer said.
While the FAA is likely to mandate hands-on Runaway Stabilizer training built into every airline pilot’s yearly recurrent training sessions in a simulator, some foreign regulators may make that a requirement for their pilots before they permit the MAX to return to service.
In a recent interview with trade magazine Aviation Week, Patrick Ky, executive director of the European Union Aviation Safety Agency (EASA), indicated that his agency will likely go along with the FAA in not making that a requirement.
Ky said that while some nations may demand simulator training for “purely political or public relations-driven” reasons, it would be “a complete disaster” if the FAA and EASA diverged. “We need to be fully harmonized,” he said.
That suggests the world’s two major aviation regulators are now aligned, though EASA’s schedule lags slightly the FAA’s. Ky said he expects an EASA decision on returning the MAX to the air “sometime in January.”
In the 737’s largest global market, China, the return of the MAX could be delayed by political factors around trade talks and U.S./China tensions.
For U.S. air travelers, though, the MAX could soon be airborne again.
END