Aware that this column will have new developments by the time it goes to print, I hesitated to write about the subject. But I felt passionate enough that it would be a disservice to readers if this particular airline guy didn’t weigh in, especially for someone that spent an entire jet career flying Boeing products.
As a recap, Indonesia’s Lion Air Flight 610 and Ethiopian Airlines Flight 302, both operating the new-generation Boeing 737 Max 8, crashed within five months of each other under similar circumstances involving what appears to be an erroneous activation of an automated system called MCAS (maneuvering characteristics augmentation system). What is MCAS exactly? Some background information helps with the explanation.
The Max is another stretched version of the 1960’s designed 737 fuselage but with efficient, bigger and more powerful engines. Because the larger engine cowls had the potential to scrape the runway on landing or takeoff, they were mounted farther forward and higher on the wing. Underslung engines already have the tendency to increase pitch when power is added, especially at lower speeds, and the Max’s CFM Leap-1B powerplants further amplified the nose-up characteristic.
To compensate, Boeing designed the MCAS system, which automatically reduces the angle of attack by lowering the nose. The MCAS will only activate while pilots are hand-flying the airplane with the flaps in the retracted position. By theory, the system is unnecessary when the autopilot is engaged because the automation will not allow flight parameters to be exceeded. In other words, the autopilot won’t allow the airplane to enter a stall.
A sensor within the angle of attack vane on either side of the fuselage sends a signal to the MCAS, which in turn automatically moves the horizontal stabilizer to pitch the nose down. But it only takes one angle of attack sensor to activate MCAS. And apparently with both Lion Air and Ethiopian Airlines, an erroneous signal activated the system. This is the first area where Boeing stepped precipitously out of its comfort zone. What do I mean?
My colleagues and I spent our careers in an elusive attempt at reaching a complete Einstein level of systems knowledge, but even the best of us knew it was impossible. Boeing systems are complex because the design of its systems in the event of failures oftentimes includes triple and quadruple redundancy. So why would the preeminent, mega-aviation manufacturer cut corners by designing a system that had no backup for a fault? And why would it break with its philosophy of having the airplane work in harmony with pilots as opposed to the airplane protecting itself from pilots?
The other area where Boeing departed its comfort zone was when it decided not to detail the operation of MCAS in the pilot’s operating handbook. Apparently, it was thought to be unnecessary since the system would operate invisibly. That’s disturbing to me, and quite frankly, indefensible. How can pilots expect to respond correctly to an emergency if they don’t understand the problem and don’t know the checklist to reference?
Considering the two tragic accidents, it would seem that Boeing hadn’t fully considered the potential consequences of a single faulty angle of attack sensor great enough for their risk calculations, or more disturbing, that the MCAS system wasn’t completely understood. The latest report indicates that the angle of attack stall vane became detached from the airplane.
The checklist solution, offered after preliminary analysis of the Lion Air crash in October, was a procedure dating back to the days of the 707 called “Runaway Stabilizer Trim.” In addition to this checklist, disabling MCAS was another step.
First, pilots must recognize the problem and react quickly, a challenging task low to the ground during a takeoff/climb regime. Recognition must have been difficult because the stick shaker activated with Ethiopian Airlines, erroneously indicating an approaching stall. In addition, numerous audible and visual warnings were counterintuitively invading the crew’s psyche through cockpit display annunciations. Normal reaction is to fight the airplane for control by counteracting the nose movement with opposite control force, which is supposed to “brake” the uncontrollable trim by design.
But apparently the normal pilot response doesn’t function with MCAS. So the runaway-stabilizer-trim checklist is an absolute requirement, which involves repositioning two cut-out switches in the center console accessible by both pilots to the off position. But the procedure still isn’t complete. Pilots have to use the manual trim wheels. And counteracting the force on the horizontal stabilizer can be problematic.
A balancing act of releasing back pressure on the control yoke even if the nose is trying to point at the ground and then trimming manually to relieve aerodynamic forces becomes a dramatic and dangerous rodeo that requires the strength of both pilots. And let’s not forget that the other part of the checklist procedure that Boeing recommended was to disable MCAS. How does the crew disable a system with which he or she is unfamiliar while trying to prevent the airplane from aiming at the ground?
What’s concerning is an aspect I considered early in the field investigation before the cockpit voice recorder and digital flight data recorder had been analyzed. It now appears through the preliminary report that the Ethiopian crew complied with Boeing’s procedures but couldn’t manually trim the airplane because of the extreme forces as a result of takeoff power never being reduced. So they reengaged the electric trim switches, apparently thinking that it would be better than muscle power. But the reengagement also reactivated MCAS, and thus more nose-down stabilizer was added to an already badly trimmed airplane.
Accidents typically have more than one factor contributing to their probable cause. Despite the focus on the MCAS design, the investigation will uncover other factors, some involving the actions of the pilots. But another factor that may not be stated as part of the probable cause is the systemic mutual trust that the Federal Aviation Administration and Boeing consummated over years of presenting a new variance of a previous design as just another stretched version of the same airplane. If our policies allow an airplane manufacturer the opportunity to police itself, it may be time to restructure that policy.
Perhaps Boeing should consider that the 737 has been stretched beyond safe limits. The road ahead will be a tough one for the manufacturer regardless. Litigation stemming from the accidents will continue for years to come. And the fallout from canceled orders and slower production schedules will have a ripple effect on the airlines and the U.S. economy. Even when the airplane is fixed, it will be an uphill battle to regain trust from pilots and passengers alike.
Despite all the negative press, Boeing has always built a quality product. I don’t understand the latest departure from their comfort zone. The axiom “If it’s not Boeing, I’m not going” may become only a whisper for quite a while.
