Much of the world’s fleet of about 11,000 Airbus A320 series aircraft – the most popular airliner in the world according to sales – are affected by a current emergency airworthiness directive from the European Union Aviation Safety Agency and the US Federal Aviation Administration requiring that operators modify their aircraft control software to make it more resistant to the effects of solar radiation.
This followed a sudden loss of height in the cruise involving a JetBlue A320 en route from Cancun, Mexico to Newark, USA on 30 October. Solar radiation is believed to have been responsible for corrupting the data in one of the aircraft’s flight control computers causing the sudden height loss – which injured several passengers. Recovery action by the pilots ensured the aircraft diverted safely to Tampa, Florida.
Most younger A320s need only a quick software patch to harden the microchip resistance in their flight control computers against particularly vigorous bursts of solar radiation, but nearly a thousand of the oldest aircraft may need to change the units.
Solar radiation is known to be able to interfere with GPS signals, radio communication, inertial navigation systems, autopilot, and full-authority digital engine controls (FADEC), although incidents are rare. A mysterious sudden pitch-down by a Qantas A330 in the cruise over Western Australia in October 2008 is now reckoned to have been caused by corrupted data from an air data inertial reference unit (ADIRU) that may have been subject to solar radiation damage.
All aircraft are more vulnerable than suface vehicles to solar radiation effects because, at high altitude, there is less atmospheric attenuation of the sun’s electromagnetic energy. Polar flights are particularly vulnerable because the earth’s magnetic field provides less shielding and the troposphere is at a lower altitude there.
A320 series aircraft have three three flight control primary computers (FCPC), two flight control secondary computers (FCSC), and a flight augmentation computer, all of which provide considerable systems redundancy, plus a cross-checking capability to detect and correct anomalous data.
The UK Civil Aviation Authority said today that there had been virtually no disruption to flight schedules because airlines were so quick to apply software fixes.
1 December 2025: a statement from Airbus on this date claimed that only about 100 A320 series aircraft remained to receive the softwear hardening required by EASA an the FAA.
“The ancient infrastructure is buckling,” says the President of the USA, Donald J Trump.
His subject is the state of America’s air traffic control (ATC) services, but he does have a solution: “We’d like to give out one big, beautiful contract, where they are responsible for everything from digging ditches to the most-complicated stuff”.
Trump has casually tossed a simple solution to a serious national infrastructure problem into someone else’s in-tray. But is this even in his gift?
The political in-tray belongs to Transportation Secretary Sean Duffy, who agrees with Trump about the state of the air traffic management (ATM) system. Needing somebody to blame after the 29 January fatal mid-air collision between an army helicopter and a PSA Airlines Bombardier CRJ700 that was on final approach to land at Washington DC’s Reagan airport, Duffy attributed the crash to “our outdated, World War II-era air traffic control system”. Having delivered that verdict, he named his predecessor, President Joe Biden’s Transportation Secretary, Pete Buttigieg as the man responsible for the state of US ATM.
Meanwhile, taking Trump at his word when he said “We’d like to give out one big, beautiful contract…”, the chief executive of a major US electronics company is – surely – soon going to feel the thud of a massive Concept of Operations document landing in his in-tray. So will Chris Rocheleau, the Trump-appointed Acting Administrator of the Federal Aviation Administration. Rocheleau, an experienced FAA man, was given the job in January, but so far no actual Administrator has been appointed.
In the USA, the FAA is responsible for providing ATM. The Administration’s two main tasks are the safety oversight and regulation of the entirety of the USA’s aerospace and air transport industry, plus the provision of ATM and its operating infrastructure. Unusually, therefore, the FAA oversees the safety of its own ATM system.
Finance for the FAA comes from the Airport and Airways Trust Fund (AATF), financed in turn by the users of the system who are charged taxes on domestic passenger tickets, freight carriage charges, fuel, and international departures and arrivals. These proceeds, which fund nearly 90% of the FAA’s costs, don’t go direct to the FAA: congress annually appropriates funds from the AATF for the FAA – but in practice it quite often delays the appropriation, bringing aviation to a halt for a few days. The reality is that the FAA is a state-owned utility.
Returning again to Trump’s stated plan for “one big, beautiful contract” to upgrade America’s ATM and air navigation services, unless the President has the FAA in mind as contractor (unlikely), he must be referring to private industry.
So who are the industry candidates to take the lead in this “big, beautiful contract”? If Trump’s plan goes ahead, one company will lead, and the others will contribute. The line-up looks something like this: Raytheon, Thales, Adacel Technologies, L3 Harris, Honeywell, IBM, SpaceX (Starlink), and Verizon (telecomms). Trump’s “America First” policy might rule out Thales for being French, although it is huge, global, and has a big US division.
What will Duffy require of this agglomeration of US industrial expertise? Here are some extracts from public statements of intent he has made in the last few months about ATM modernisation: “Rebuilding some ATC towers, control centres and Terminal Radar Approach Control (TRACON) facilities; new telecom, new fibre… We are going to have brand new radios in our towers, new radar for the ground, and new sensors on our tarmacs; all the front-facing equipment for controllers, all the back-end systems for controllers – all brand new; all new hardware… All new software… A new flight management system that will support flights of future air taxies – the electric vertical take-off and vertical landing aircraft now under development by numerous firms.”
What is more, all of this will be accomplished within four years, says Duffy. A bill to approve funding to the tune of $12.5 billion is working its way through the House of Representatives.
The sheer size of the task of raising this system from its current state of repair can be gauged from a recent event. On 28 April, controllers at the Philadelphia TRACON “temporarily lost radar and communications with the aircraft under their control, unable to see, hear or talk to them”. That summary of the event was provided by the National Air Traffic Controllers Association (NATCA). Controllers at that facility are responsible for “separating and sequencing” jets flying to and from Newark airport, New Jersey, one of the three main airports serving New York city.
In the last few days the Philadelphia TRACON problems have recurred, according to Duffy, who resorts again to blaming Buttigieg. Meanwhile Newark airport is talking to airlines about reducing the flow-rate of traffic there for safety reasons. And the whole problem is exacerbated by a shortage of air traffic control officers (ATCO), which Duffy has acknowledged is nation-wide, and which the National Transportation Safety Board is examining as a possible contributory factor in the Washington DC collision.
Good luck to the FAA and its partner companies in this massive endeavour. They’ll need it!
Activity in Washington DC’s urban airspace is now being constrained – just a little – by the Federal Aviation Administration following its discovery that the risk of collisions at or near airports across the whole USA is higher than the Agency had appreciated.
This fact emerged during the inquiry by the National Transportation Safety Board (NTSB) and FAA into the 29 January fatal mid-air collision between an army helicopter and regional jet airliner over the Potomac River near Washington Reagan airport.
This decision to reduce traffic, however, is likely to be challenged, and probably quite soon.
The appetite for instantly accessible air transport among DC denizens is insatiable because – they would tell you – of the febrile environment in which many of them conduct their political, lobbying, military or security business in the District. There is always high demand for flights to and from DC’s compact downtown airport close to the heart of the city, and it operates near capacity all the time. Reagan airport is right next to the west bank of the Potomac River, and the other side of the river directly opposite the airfield there is a confluence of urban helicopter routes (see chart below, helicopter routes marked in blue). In addition to that complexity, less than a mile to Reagan’s north west is the Pentagon, with its own heliport.
On the night of the collision the PSA Airlines Bombardier CRJ was approaching Reagan from the south, tracking northward above the Potomac River, intent upon intercepting the instrument landing system (ILS) for runway 01 to land. Meanwhile the army Black Hawk was to the north of Reagan, tracking south along helicopter Route 1 to join Route 4.
Reagan tower asked the CRJ crew if they could accept a late runway change to land on 33, and because the crew could see the lights of both runways they accepted the change, broke off from the runway 01 ILS while still at about 1,700ft, and made a slight right turn to head north to intercept runway 33 ILS. Approaching ILS intercept, the CRJ turned onto final approach at about 500ft. As the CRJ descended through 300ft toward the runway the two aircraft collided.
The circumstances of the collision are not surprising given that these operations were carried out under night visual flight rules (VFR), and the visibility at the time was such that visual identification and separation was practical, if not actually wise. Asked by Reagan tower if they had the CRJ in sight, the Black Hawk crew said they did, although the fact of the collision makes it clear that they had misidentified the regional jet. The lights of the city and airport crowd around on all sides, making misidentification easy.
It has since transpired that the army helicopter was not operating its ADS-B-Out to enable identification by ATC, which it was supposed to do. Right now there is a behind-closed-doors argument going on between the army and the FAA about the military use of ADS-B-Out. The army doesn’t like its aircraft to be trackable, and the FAA insists they must be identifiable in environments like DC airspace. There was, however, no special security classification that demanded stealth for this particular helicopter flight, which was carrying out crew training.
Chair of the NTSB Jennifer Homendy remarked upon the failure of the FAA to respond to the fact that the exact point at which the two aircraft collided had long been identified as a “high risk location”. This failure, she said, was “more than an oversight.” When it was published in early March, the NTSB’s preliminary report on the accident revealed that, between October 2021 and December 2024, there had been more than 15,000 “close proximity events” between helicopters and commercial aircraft near Reagan.
It may be a useful exercise to gather statistics like that to back an argument, but anyone who operates the skies near Reagan knows how busy it has always been, and knows that such a level of traffic density involves considerable risk, especially at night or in poor visibility. The operational requirements for a helicopter heading south on Route 4 are that, when passing Reagan, it is supposed to be at 200ft or lower, so that any aircraft on approach to runway 33 should pass over the helicopter at a height between 300ft and 400ft. The margins for error are tiny, both for vertical separation between the two aircraft, and for obstacle clearance between the low-flying helicopter and ground obstructions, especially risky at night.
The FAA has now decided to close Route 4 whenever runway 33 is in operation. But what if, like the day of the accident, the tower decides at short notice to change a landing from runway 01 to 33? Can sufficient notice be given to helicopter crews using Route 4? The agency plans to allow some limited helicopter traffic on Route 4, but only for “urgent missions, such as lifesaving medical, priority law enforcement or presidential transport”. Unfortunately such flights over this city are common, and there is a question as to who should authorize them. Meanwhile ATC will be expected to prohibit fixed-wing aircraft from simultaneously using Reagan airport’s secondary runways – 15/33 and 04/22. That combination of responsibilities is quite an ask for controllers as busy as those at Reagan.
The FAA’s administrator Chris Rocheleau, at a Congressional Hearing on 27 March, obviously bidding for the Understatement of the Year Oscar, said: “Clearly, something was missed.” The NTSB’s Homendy pointed out that the DC airspace incident data is there to be easily gathered, in the form of voluntary safety reports of near-accidents of all kinds, but admits there is a lot of it. Rocheleau says the Agency is now looking into using artificial intelligence to sort through “tens of millions” of such reports to identify – and flag up – specific risks and trends.
Urban aviation activity like that in Washington DC’s airspace would not be permitted in similar European airspace. Instrument flight rules (IFR) would apply, even if visual separation was used as a backup in VMC. That is not to say Europe is right and America is wrong. Each State has a right to decide what level of risk it finds acceptable, and to determine ways of ensuring that its agreed standards are met, in the knowledge that the authorities will take the rap if they get it wrong.
That is the question Washington DC must answer: how much risk do its denizens want to take, and should they be allowed to take risks at that level? In the 29 January collision all the people on both aircraft died, but the machinery fell harmlessly into the river. In a future collision, that might not be so.
In DC, my money is on a win for the risk-takers who are not prepared to slow down.
Just as President Donald Trump rushed to claim that the 29 January mid-air collision over the Potomac River was the result of air traffic control incompetence resulting from the Federal Aviation Administration’s application of DEI (diversity, equity and inclusion) policies in controller recruitment, so others have lined up to point out that there has been an unusual cluster of serious US fatal air accidents since his appointment as POTUS.
Anyone with a brain knows that neither claim has any causal connection with reality.
But I am serving notice today that this blog will examine any proposals that emerge from the Trump-appointed DOGE (Department of Government Efficiency) regarding the funding or reorganization of the FAA, and I invite senior executives and employees of the FAA, the airlines and general aviation bodies to report on substantive changes ordered by DOGE by responding to this blog.
Like others who care about maintaining and advancing aviation safety, I am wary of politically-inspired tinkering with an important oversight agency by leaders who have no expertise in the management of aviation safety. Trump’s first lieutenant Elon Musk, a man of many talents, has been entrusted with heading DOGE. He has a businessman’s appetite for risk-taking.
As Boeing acknowledges, business skills wielded by those for whom safety and quality control is an important concern, but whose primary objective has become shareholder returns, can get the balance wrong and damage both.
The USA has led the post-war world in advancing civil aviation safety, with the FAA being its general and the Flight Safety Foundation its standard-bearer. If the FAA’s ability to oversee industry safety performance and to manage the USA’s airspace is diminished in the name of “efficiency”, it affects global aviation, so the world will be watching with its own interests at heart. The FAA is an agency, a public service, it is not a business.
This appeal for reader feedback will have to be carefully managed, because at this stage the proposed Trump/Musk policies inspire apprehension without advancing any substance worthy of appraisal.
But soon actions will loom, and appraisal must begin.
With the destabilizing effects on global aviation of huge fuel price inflation and unprecedented Russian military aggression in Europe, worsened by post-pandemic staffing shortages, it’s amazing that international commercial air transport works at all right now.
International cooperation has never been more crucial. Yet in the UK, an example of how NOT to do aviation – especially right now – has just been highlighted.
UK-based eVTOL developer Vertical Aerospace will be certificated by the UK CAA according to EU rules despite having separated from EASA
The reason international aviation is still working despite global instability is because the world wants it to, and has set up robust systems to enable it. Like commercial shipping, commercial aviation is naturally a global industry.
That’s why both those industries have specific United Nations agencies devoted to overseeing globally agreed standards and operating practices (SARPs). These agencies are the International Maritime Organization and the International Civil Aviation Organization. Total regulatory unity doesn’t prevail worldwide, but a high degree of harmonization does.
The world’s two most influential national/regional aviation authorities responsible for turning ICAO SARPS into national law are the European Union Aviation Safety Organisation (EASA) and the US Federal Aviation Administration (FAA). These two have worked together for decades to improve the harmonization of their regulations, making them identical where possible. They still meet regularly. Most of the world’s national aviation authorities (NAAs) more or less copy the regulations of one or the other into their own NAA rules.
All the EU states have always had their own NAAs – and still do. But since the 1980s they have worked together on harmonizing their aviation regulations to make Europe’s aviation industry work better.
In the early 2000s, EASA was born out of its predecessor the European Joint Aviation Authorities, to unify Europe’s interpretation of all those ICAO SARPs.
Back in the early 1980s, believe it or not, Boeing had to build almost as many variants of its 737 series as there were countries in Europe, because some nations insisted on safety systems than the FAA did not require, and some of these specifications were unique to each country. For example, one of the UK’s additional requirements – then – was for a 737 stick-pusher.
Today the UK Civil Aviation Authority (CAA) is faced with the consequences of returning to the bad old days because of the UK’s departure from the European Union. Although Theresa May, the UK prime minister preceding Boris Johnson’s election, had instructed the CAA to remain an associate member of EASA following “Brexit”, when Johnson came in his government insisted on ideological purity, thus no CAA association with Europe’s multinational agency.
Meanwhile, right now the CAA has to prepare its reaction to the imminent arrival on the world stage of a new form of commercial air transport: eVTOL (electric vertical take-off and landing), also known as Urban Air Mobility. Expected to take the air taxi world by storm and make it sustainable, the UK plans to be involved in all aspects of this new industry, including manufacturing.
At a time like this, when the world has agreed to harmonize rules associated with another massive new aviation development – drone operation – it does not make sense for any nation to declare unilateral independence from the world rule-making processes.
The CAA, fully aware of its dilemma, has released a statement pledging that it will follow exactly the EASA rules on certification for eVTOL. Of course, it has to duplicate the regulation in UK law, and any UK eVTOL products or services will be subject to scrutiny by EASA to ensure that it does just that. Hence the UK’s promising eVTOL manufacturer Vertical Aerospace is having to undergo identical parallel certification by two agencies: the CAA and EASA. You couldn’t make it up, could you?
Meanwhile the bureaucratic burden placed on the UK agency is evident from this script heading pages on the CAA’s website: “UK-EU Transition, and UK Civil Aviation Regulations:To access current UK civil aviation regulations, including AMC and GM, CAA regulatory documents, please use this link to UK regulation. Please note, if you use information and guidance under the Headings below, the references to EU regulations or EU websites in our guidance will not be an accurate description of your obligations under UK law. These pages are undergoing reviews and updates.”
The Covid-19 pandemic’s dramatic effect on air travel has accelerated aircraft retirements, particularly older long-haul types. This, of course, includes the undisputed Queen of the Skies, the Boeing 747, the withdrawal of which has been the cause of many misty-eyed moments among aviation romantics.
British Airways’ last 747-400, in retro BOAC livery, on its way to retirement
The “other jumbo”, the Airbus A380 was already suffering a crisis of its own before Covid’s arrival, and the pandemic motivated the manufacturer to put the trickling production line out of its misery.
The A380 – technically an excellent, if over-engineered aircraft – was the victim of a miscalculation by Airbus way back in the late 1980s-early 1990s about the shape of future global air transport. The A380 was to replace the 747, but the belief that a replacement would be needed at all was based on an assumption that the industry would continue to develop much as it had in the previous three decades.
Emirates, by far the A380’s biggest user, will certainly be able to continue flying many of them
That didn’t look like a bad decision at the time, but Boeing’s predictions turned out to be far more accurate. The US manufacturer foresaw the diminution of the importance of hub-and-spoke networks feeding the world’s major airports where they sit astride the globe’s air travel arteries – the traditional trunk routes. The A380 was ideal for serving these.
But the American manufacturer’s crystal ball showed smaller widebody twins taking over from thirsty quads, and carrying passengers who wanted it straight past the massive hubs directly to the secondary cities. The 767 was already showing the way in the 1990s, with American carriers on transatlantic routes, but the 777 and 787 extended the possibilities. Darwin had smiled on Boeing.
Although Airbus was also ready for many of these long-haul twin opportunities with its flexible A330 twin series (and now the A350), in the mid-1990s the four-engine A340 had initially become much more popular than Airbus had predicted. Europe, culturally less of a risk-taker than the USA, was not yet ready to fly twins over extended oceanic routes, or over endless Arctic and Siberian wildernesses. In a quad, an engine failure raises the crew’s blood pressure a bit, but they can elect to continue to destination. In a twin, it means an instant diversion.
Meanwhile, across the Atlantic, in July 1995, Boeing and the Federal Aviation Administration were ready to gamble on bringing a brand-new big twin, the 777, into service with pre-cleared permission to fly over oceanic or wilderness regions where the nearest diversion airport could be up to three hours away at single-engine flying speed. That extension from the previous 2h meant there were hardly any routes a twin couldn’t fly. Boeing and its FAA partner went for it; and what’s more they got away with it. A single early-days disaster would have put paid to that policy, but it didn’t happen, and now everyone takes 180min ETOPS (extended twin engine operations) for granted. Darwin had smiled on Boeing once more.
Today, in the pandemic, the Airbus A340 is suffering a fate similar to the 747’s, but there will be fewer tears simply because it could not have achieved the iconic status the 747 had won through its status as the world’s first jumbo jet, its sheer longevity, and its unique shape.
Among today’s widebodies, Darwin will continue to smile on the newer big twins, and the few remaining tri-jets and the older big twins will be parked or converted to freighters before their time would normally be up. Meanwhile, the marketplace that the new big twins have had to themselves for some time is to be invaded by what may turn out to be a particularly timely product: Airbus’ single-aisle venture into long-haul, the A321XLR.
Another anomaly brought by the pandemic is that air cargo has been the saviour of many airlines during the pandemic, because unlike passenger traffic, cargo has hardly been affected. For example, Taiwan’s China Airlines has just announced an operating profit for 2020 on the back of cargo, and recently took delivery of a new 777F.
Short-haul – and thus the single-aisle fleet – has not been hit as hard as long-haul simply because domestic air travel is free of the border restrictions that nation states impose on travellers when they fear the spread of infection from abroad. But as in their long-haul fleets, airlines are still disposing of the earlier versions of their 737s, A320s and regional aircraft.
Exceptionally on a global scale, the US domestic carriers are forecasting break-even levels of passenger business by June, with strong demand from the leisure travel market, although there is slightly less confidence in a business travel rebound. Domestic carriers elsewhere, in less geographically large countries – particularly those with mature high speed rail networks – will take longer to recover than the likes of American, Delta, United and Southwest, and may not have had the government injection of survival cash the US airlines have had – plus the boost from the fact that the USA has successfully accelerated its Covid vaccination programme. Is that Darwin smiling on America again, or just on big, prosperous nations? He may well be smiling on China too.
No-one can be sure of the post-Covid shape of the world’s commercial air transport industry. Truisms, abound, like the contention that the strongest carriers will survive, and that the pandemic’s result will be further consolidation and fewer airlines. One of the unknowns is whether people’s travelling priorities will have changed, especially in the light of growing concern about climate change. Will long-haul, in particular, be a victim of such a concern?
But at present, whenever there is a hint that lockdown may be eased, people are rushing to book holiday travel. Air travel will indeed survive, the question is: what will it look like?
The European Union Aviation Safety Agency (EASA) has published a Proposed Airworthiness Directive (PAD) , signalling its intention to approve the Boeing 737 MAX’s return to Europe’s skies “within a matter of weeks” – probably about mid-January.
But Europe is specifying a few requirements that the US Federal Aviation Administration (FAA) has not demanded.
It was on 20 November that the FAA approved the aircraft’s return to America’s skies, but US carriers have many preparations to complete before resuming commercial services with the Max. American Airlines reckons it will be ready by the end of December.
EASA, however, wants to see the application of some operational measures that the FAA does not require. It insists, nevertheless, that the Max airframes in America and in Europe will be the same. The agency explains: “The [PAD] requires the same changes to the aircraft as the FAA, meaning that there will be no software or technical differences between the aircraft operated by the United States operators and by the EASA member states operators.”
The EASA PAD is a consultation document, and all responses have to be received by 22 December. EASA executive director Patrick Ky is at pains to point out that the agency, while cooperating with the FAA on correcting the anomalies in the Max’s manoeuvring characteristics augmentation system (MCAS) (see immediately preceding blog entry), insisted on looking independently at the whole issue.
Ky explained: “EASA’s review of the 737 MAX began with the MCAS but went far beyond. We took a decision early on to review the entire flight control system and gradually broadened our assessment to include all aspects of design which could influence how the flight controls operated. This led, for example, to a deeper study of the wiring installation, which resulted in a change that is now also mandated in the [PAD].” That, basically, is a requirement to bring the venerable 737’s design up to date, and is a signal that the days of “grandfather rights” – a dispensation to build the 737 Max as earlier versions of the 737 were constructed rather than as new aircraft have to be designed – are numbered.
The Max airframe design came through all the handling tests satisfactorily, as Ky explained: “We also pushed the aircraft to its limits during flight tests, assessed the behaviour of the aircraft in failure scenarios, and could confirm that the aircraft is stable and has no tendency to pitch-up even without the MCAS.”
Two principle differences between the FAA and EASA requirements are explained as follows: “EASA explicitly allows flight crews to intervene to stop a stick-shaker from continuing to vibrate once it has been erroneously activated by the system, to prevent this distracting the crew. EASA also, for the time being, mandates that the aircraft’s autopilot should not be used for certain types of high-precision landings [and approaches such as RNP-AR]. The latter is expected to be a short-term restriction.”
The crew intervention mentioned would allow the pilots to pull the stick-shaker circuit breaker. The stick-shaker – a system designed to alert pilots to an approaching stall – was one of the distractions that faced the Lion Air and Ethiopian Airlines crews before they lost control of their aircraft, despite the fact that the shaker was triggered by a false warning.
The FAA doesn’t see the need for this intervention, because the modifications have ensured that a single sensor failure will not trigger the stick-shaker any more.
Boeing and EASA say they have agreed to continue tests to see if they can further strengthen the aircraft’s systems’ resilience to angle of attack (AoA) sensor failures – the causal trigger for the two fatal Max accidents, and Boeing has also made this promise: “Boeing will also conduct a complementary Human Factor assessment of its crew alerting systems within the next 12 months, with the aim of potentially upgrading these to a more modern design approach.”
After nearly two years of grounding, Boeing’s 737 Max series has been cleared by the US Federal Aviation Administration to carry fare-paying passengers once again.
This is the first step in a redemption process for one of the world’s truly great engineering companies. Like a boxer who dropped his guard for just a second, Boeing has taken a punch that has knocked it to the canvas, and the referee had started counting.
Now, air traveller reaction is nervously awaited. Will the public believe claims by the FAA and Boeing that, together, they have confined to history the flaws that caused the 737 Max fatal crashes in 2018 and 2019?
The FAA – blamed along with the manufacturer for the lapses in design oversight that led to the two accidents – has declared the aircraft safe to operate in America. One by one, other national aviation authorities (NAA) are expected to follow suit.
Oversight of the type’s rehabilitation continues to be the FAA’s responsibility, but decisions on the systems and software changes applied to the Max have been made by multinational teams. Bodies formed to decide what changes were needed – and then to see them implemented – included the Joint Authorities Technical Review (JATR) representing nine nations plus the European Union Aviation Safety Agency (EASA) – and the Joint Operations Evaluation Board.
The relationship between the FAA and Boeing was much criticised in the accident investigations and the JATR review process . For that reason, the reaction of EASA to the Max’s clearance to fly is seen as critical.
Not only is EASA the agency that oversees safety in the region containing the largest group of aerospace industries outside America, but its contribution to the JATR recommendations made clear EASA was not happy with the FAA’s former piecemeal approach to certifying critical changes applied to the 737 Max.
Its opprobrium was directed particularly at the FAA’s approval of the flawed Manoeuvring Characteristics Augmentation System (MCAS), unique to the Max, and not used in earlier marques of 737. It recommended “a comprehensive integrated system-level analysis” of the MCAS, and of its integration into the total system-of-systems that constitutes a modern aircraft (for more detail, see “The Failures and the Fixes”section following this article).
So it was with heartfelt relief that Boeing heard EASA’s executive director, Patrick Ky, report on Max progress to the European Parliament Transport Committee on 29 October. Ky told them: “We are fully confident that, given all the work that has been performed, and the assessments which have been done, the aircraft can be returned safely to service.” Ky’s statement suggests EASA will re-certificate the 737 Max in Europe soon after the FAA’s announcement.
Meanwhile, out in the real world, Covid-19’s near-immobilisation of commercial air transport worldwide has rendered the Max’s long grounding almost invisible to the media and the public. Because of the far lower level of air travel activity, the airlines have been able to live without the 387 Maxes already delivered to them, and also without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then. The latter are all in storage, awaiting any updates not already incorporated, and ultimate delivery.
Although clearance to fly has now been delivered, even in the USA the airlines will not instantly be re-launching their already-owned 737 Max fleets. The status of all the proposed software and hardware modifications to the type will not have been confirmed until the moment the FAA signs it all off.
American Airlines has said it hopes to start getting its Max fleet airborne before the end of December.
REUTERS/Nick Oxford/File Photo
Once the FAA has done that, getting the Max fleet ready for the sky will be an aircraft-by-aircraft, crew-by-crew process. In many airframes, a knowledge of what changes were coming has enabled a great deal of the work to be done. But also, because of the hardware and software changes to the Max, the crews have to be trained to use the new systems.
Incidentally, while the Max series was grounded, the FAA decided to order some additional modifications – completely unrelated to the crashes – to bring the type fully in line with modern safety regulations. For example, one of these involves the re-routeing and separation of wiring looms that the 737 had previously been allowed to sidestep under “grandfather” rules.
The number of lessons for manufacturers and regulators to learn from this aerospace drama is legion.
The failures and the fixes
The failures
Just a reminder: the 737 Max series fleet was grounded in March last year as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March 2019.
The primary causal factor of the Lion Air Max crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s corrective efforts have mostly been directed.
In both the accidents, the aircraft’s AoA sensor that feeds data to the MCAS wrongly indicated a very high AoA soon after take-off. The system reacted by providing nose-down stabilizer rotation that took the pilots by surprise. They did not understand the reason it kicked in, and their efforts to reverse the strong nose-down pitch did not succeed. Both these events occurred soon after take-off, and because the MCAS kept repeating the nose-down stabilizer in response to the continued erroneous high AoA sensor signal, the loss of height quickly resulted in impact with the surface.
During the examination of all the issues arising from the accidents, the JOEB was aware there were solutions to the situation in which the crews found themselves. But the fact that two crews in different regions of the world were so confused by what the MCAS was doing that they lost control had totally eclipsed pilot failings as the main issue.
MCAS was designed to trigger only in a specific flight configuration that causes the Max’s centre of lift to move slightly further forward, delivering a slight nose-up moment that can be countered by flight controls. This configuration is a combination of relatively low airspeed, flaps up, with the aircraft being flown manually. In the case of the Lion Air and Ethiopian flights, the pilots decided to continue to fly the aircraft manually during the early climb, rather than engaging the autopilot, so this precise flight configuration was encountered as soon as the flaps were fully retracted.
With flaps up, and still at a fairly low airspeed, the aircraft would be at a high angle of attack, and not far above the stall. FAA regulations require that, in the proximity to the stall, one of the “feel” cues to the pilots is that there should be a linear increase in the required control column force versus elevator displacement response, but the Max’s aerodynamics in this configuration had negated this effect, and MCAS was designed to restore that pilot cue automatically.
The JATR decided that MCAS’ fatal design weakness, above all, was that it was triggered by a single AoA sensor with no backup in case the unit had a fault or suffered damage. It seems Boeing and the FAA had overlooked that possibility, and had not explored the potential effects of erroneous inputs. Their excuse at the time was that the system was not seen as a critical one, rather as a refinement.
The fixes
The 737 Max had always been fitted with two AoA vanes, but originally only one was wired up to MCAS, and there was no flight deck indication of a disparity between the two sensors if a difference developed, which could have warned the pilots of a potential vane fault.
The hardware fix agreed by the JATR was that both AoA sensors would now feed into the MCAS, there would be an automatic comparison between them, and if there was more than a small disparity the MCAS would be locked out completely, because the aircraft can be flown without it.
The software fix also ensures that – now – the MCAS only operates once per high AoA event, so the repeated nose-down pitch demand by the stabilizers that led to the two accidents would not occur. In addition, the two flight control computers (FCC) now continuously cross-monitor each other.
After the hardware and software changes, the final improvements – overseen by the multinational JOEB – are to pilot training and cockpit drills for the Max series.
Now, even if the pilots are coming to the Max from the very similar 737NG series, pilots must undergo a one-off training session in a Max full flight simulator. This involves recovery from a full stall, dealing with a runaway stabilizer, practice manual trimming at high speeds (and therefore high trim loads), and crew cooperation on all these exercises.
Non-normal checklists have now been compeletely revised, and contain updated procedures that concentrate particularly on the operation of the horizontal stabilisers and trim controls, both in normal operation and in the case of all potential faults. The drills deal with runaway stabilizer, speed-trim failure, stabilizer out of trim, stabilizer trim inoperative, airspeed unreliable, altitude disagree, and AoA disagree.
Computer based training (CBT), containing video of crew exercises using the real controls, teaches drills for the following: airspeed unreliable, runaway stabilizer, the speed trim system, trim controls, and differences between the autopilot flight director system (AFDS) in the NG series and the Max series.
Testing the changes
Boeing and the FAA say they have put in 391,000 engineering and test hours developing the solutions, which have then been tried for 1,847 hours in simulators and for 3,000 airborne hours in the real aircraft.
Very soon – perhaps this week – the US Federal Aviation Administration is expected to declare Boeing’s 737 Max safe to fly again in America’s skies, lifting nearly two years of compulsory grounding.
Such an event would normally be a subject of press fanfare, but Covid-19’s near-immobilisation of commercial air transport activity worldwide has rendered the Max’s long grounding almost invisible to the non-specialist media and the public.
The airlines have been able to work not only without the 387 Maxes already delivered, but without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then – only to be delivered straight into desert storage.
The changes being applied – at the FAA’s behest – to this latest version of the highly successful 737 series are partly to correct design flaws that allowed two notorious fatal crashes to occur, but some additional modifications will bring the type fully in line with modern safety regulations that this marque had previously been permitted to avoid under “grandfather rights”.
Once the Max fleet had been grounded, it made sense to incorporate not only the changes required to make it safe, but also improvements that would prolong the marque’s commercial desirability for as long as possible. That is essential because Boeing’s next product in this market sector will be entirely new, and will not be launched for some years.
The truth is that the 737 line has reached the end of its viable development life, but given the fact that it has been in continuous production since 1966 through four iterations, that should not be too surprising.
Basically, the Max marque was intended as a stop-gap while Boeing came up with a “new mid-market airplane”, but when the Max hit the marketplace it was astoundingly successful. Its price was right, its economics excellent, its delivery guaranteed, and it was a known and trusted quantity. And all this despite the fact that it is an old fashioned, mechanically controlled machine surrounded by digitally controlled competition.
This relaunch of the Max into an airline world decimated by Covid-19 is going to be watched with bated breath, not just by Boeing, but by the whole industry.
Public perception of the aircraft is key. Will they see it as safe? Will it be safe?
As soon as the FAA announces the detail of its decision, the answers will be here.
Boeing CEO Dennis Muilenburg says the successful return to service of the company’s 737 Max series depends on international consensus among the many national aviation authorities (NAA) that will see the aircraft operating in their countries.
Not just the US FAA.
As a reminder, the 737 Max series fleet was grounded in March as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March this year.
Speaking this week at Boeing’s Seattle Delivery Centre, Muilenburg declined to predict a return-to-service date, explaining: “Dates are uncertain because we are going for a global recertification.” That means unanimity – near or absolute – has to be achieved.
Boeing aircraft being prepared for delivery at Boeing Field, Seattle
He emphasised the point: “If we do not coordinate this [return to service] we may see some disaggregation, and I don’t think that’s a future any of us wants to see.”
Muilenburg is confident the combined hardware and software changes Boeing has developed for the Max will satisfy the FAA and the multinational Joint Operations Evaluation Board (JOEB).
The primary causal factor of the Lion Air crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s efforts have been directed.
More on MCAS later.
Boeing test pilot and VP Operations Craig Bomben, who flew the 737 Max first flight and has coordinated development activity on the type since the accidents, described the essential difference between the original MCAS and Boeing’s proposed replacement: “We’ve moved from a very simple system to an intelligent system.”
In both the accidents MCAS – triggered by a faulty or damaged AoA sensor which wrongly indicated a high AoA – reacted by providing nose-down stabiliser rotation that took the pilots by surprise. They did not understand the reason it kicked in. Their efforts to reverse the strong nose-down pitch did not succeed, and because both these events occurred just after take-off, the loss of height quickly resulted in impact with the surface.
Bomben said the new “intelligent” system has two AoA sensors instead of one, and if their readings differ by 5.5deg or more, MCAS is not triggered at all.
But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.
But why is MCAS – which is unique to the Max – required at all? Boeing insists it was not fitted as an anti-stall system, because the aircraft already has stall warnings and stick-shakers.
The purpose of fitting MCAS, Bomben explained, was to compensate for a slight change in the low-airspeed aerodynamics of the 737 Max compared with the NG.
MCAS was only designed to trigger in an unlikely (but obviously possible) combination of circumstances that can cause the aircraft’s centre of lift to move slightly further forward, altering the weight-balance equation. It only happens when the Max is at low airspeed with the flaps up, and is being flown manually.
At low airspeed (200kt or thereabouts) – and flapless – the aircraft would be at a high angle of attack and close to the stall. FAA regulations require that one of the cues to the pilot of the approaching stall is that there should be a linear increase in the required column force versus displacement response.
In the Max, however, at a certain point in this sequence the centre of lift shifts forward a little, providing a slight nose-up pitch force, therefore the stick force does not continue to increase, so MCAS is designed to kick in with some nose-down trim to restore the linear increase.
If MCAS doesn’t kick in, the aircraft is still easily controlled without it, but the required progressive stick-force cueing is lost.
In technical and regulatory terms, MCAS seems to be a lot of fuss for very little purpose, but the painful fact is that the original MCAS played its part in bringing down two aeroplanes and killing 346 people.
Muilenburg’s confidence in the fix is, so far, based on more than 100,000 hours of development work on the new solution, plus 1,850 flight hours using the new software, 1,200 hours of refining the results in the simulator, and 240 hours of regulatory scrutiny in the simulator.
Meanwhile, if Muilenburg cannot predict when the world will approve the 737 Max’s return to the air, what is happening to its production at present? The aircraft had won more than 5,000 orders, and fewer than 400 have been delivered.
The Max series, despite the grounding, continues to roll off the production line at Boeing’s Renton plant near Seattle, at a rate of 42 per month. The factory is capable of turning out 57 a month, but Boeing is keeping the rate lower for now. Despite this, Renton has seen no staff layoffs, says Boeing.
The completed aircraft, however, go into storage at Moses Lake or San Antonio desert sites, because the manufacturer’s own sites at Renton, Everett and Boeing Field are full.
Muilenburg said every 737 Max grounded or in store awaiting modification will have an individual entry into service programme, and that in the meantime the engines, systems and cabin of all the aircraft are regularly being run and maintained.
But will they still have that “new plane smell” when the airlines take delivery?
A Max in production at the Renton plant, its unique split winglet close to the camera
Learmount.com 