MCAS

Will “coming home” do the trick for Boeing?

David Learmount Aircraft manufacture, Uncategorized , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

There are those who attribute Boeing’s ongoing quality control scandals to its decision to move its HQ out of its Seattle engineering base to Chicago in 2001. Others blame the 1997 merger with McDonnell Douglas for a dramatic change in company culture in favour of cost-cutting and upping shareholder pay-outs.

Kelly Ortberg, formerly of Rockwell Collins, is Boeing’s new CEO

Whatever the arguments, Boeing knows it has to get a grip, and part of the plan has been appointing a new CEO who started on August 8. Kelly Ortberg is a 64y-old engineer, and was recently CEO of avionics company Rockwell Collins, where he built a reputation for being a “man of the people” as well as a diligent executive with an eye for detail.

He says he is going to base his family in Seattle, and explains why: “Because what we do is complex, I firmly believe that we need to get closer to the production lines and development programs across the company. I plan to be based in Seattle so that I can be close to the commercial airplane programs. In fact, I’ll be on the factory floor in Renton today, talking with employees and learning about challenges we need to overcome, while also reviewing our safety and quality plans.”

It was only four months ago, on 16 April this year, that Boeing’s board blocked a shareholder proposal calling on the company to move its HQ back to Seattle. The question now is: will moving back to Boeing’s historic base and its main assembly plants be the silver bullet that will slay the company’s demons? Sceptics abound, but it seems the new CEO is not one of them.

The HQ move 23 years ago was a result of priority shifts driven by the merger with MDC, but it reinforced the culture change away from engineering prioritisation by locating the board 2,000 miles from the engineering front line. As if that wasn’t enough, in 2022 Boeing moved the HQ another 1,000 miles east to Arlington, Virginia, closer to Washington DC, lobbying opportunities, and the Pentagon.

So what? With today’s communications, distance should be no barrier to good management.

Well, that might be true for many big companies, but for an engineering-based manufacturer producing complex, high-tech machinery for a safety-critical industry, this move physically separated the engineering from the managers, accountants and policy-makers. The expression “safety-critical” – in the case of the airline industry – is not a piece of marketing-speak, it is a crucial selling point for the operators. In the early 2000s when fatal accidents happened significantly more often than they do now, airline reputations could be broken by a single crash, and they knew it.

Of course it’s not as simple as that. It never is. Much has happened to the commercial air transport and aerospace industries in the 27 years since the Boeing/MDC merger. The need for corporate adjustment to today’s business environment would have driven changes anyway.

To understand the forces at play around the turn of the 21st century, its helps to look back to the late 1970s, when the process of US domestic air travel deregulation – set in motion under the Carter and Reagan administrations – brought painful change to US airlines in the form of unfettered competition. At that time the US domestic airline industry alone represented 45% of the whole world’s air travel activity.

It took a couple of decades for the industry to adjust fully to deregulation, in the process waving goodbye to giants like Pan American and TWA, and ushering in a process of consolidation among the survivors that saw names like Eastern Airlines, Braniff, Continental, Northwest and multitudes of others swallowed up.

A little later, and more gradually, deregulation within the European Union single market began, and by the mid 1990s early examples of today’s ubiquitous low-cost carriers were spawned both sides of the Atlantic.

About the same time, aircraft manufacturing consolidation in Europe resulted in the creation of what would become a powerful multinational consortium, Airbus Industrie. Its gentle beginnings in the late 1960s led to the entry into service – with Air France in 1974 – of the world’s first twin-engined widebody, the A300. It was unique and very good, but conservatism among potential buyers meant it sold slowly. Nevertheless, its arrival signaled change, and its engineering standards would see the eventual demise of the confident US slogan “If it ain’t Boeing I ain’t going”. Gradually it became clear that the USA was no longer unchallenged as the world’s supplier of big jet aircraft.

Today, however, Boeing and all the other manufacturers should be laughing all the way to the bank. Air travel is doing well. By 2019, the year before the global covid pandemic hobbled air travel everywhere, the size of the global airline fleet and the volume of world demand for air travel had grown to be a multiple of the size of the 1990s market. Now, in 2024, covid is under control, the global demand for air travel is powerfully resurgent, and that demand shows no sign of being tempered by economic dark clouds nor environmental considerations.

If the industry and business environment are so different now, why the persistent calls for Boeing to get back to its roots? The manufacturer’s serious underlying problems became dramatically visible when, in 2018 and 2019, two of its new 737 Max aircraft crashed out of control, killing all on board. One crashed in Indonesia, one in Ethiopia. The cause of both accidents was a control software change developed by Boeing to modify – in a modest way – some of the new 737 marque’s handling characteristics.

External aerodynamic data input to the system – known as the Manoeuvring Characteristics Augmentation System (MCAS) – came from sensors near the aircraft’s nose that measured the aircraft’s angle of attack (a crucial measure of the wings’ lift-generating performance), and MCAS accordingly applied nose-down force – if required – by adjusting the horizontal stabilisers at the tail. But in both crashes, damage to the external sensors meant they sent incorrect signals to the MCAS, and it repeatedly pushed the nose down despite the pilots’ control inputs. The pilots did not know or understand what they could have done to counteract the nose-down force, and the aircraft dived to fatal impact.

The crux of the matter is that, in designing the MCAS and its associated sensor hardware, the manufacturer had ignored a basic maxim that aircraft designers are expected to adhere to, like the Hippocratic Oath for medical doctors: Boeing had not designed the MCAS to “fail safe”. That is, to work out what failures could occur, and ensure that if they did fail it would not lead to disaster. This could be done either by duplicating or triplicating the system and setting up a voting system to isolate a fault, or designing the system so the effects of failure can easily be overcome by other means. Boeing ignored this philosophy, and its only excuse at the time was that it did not see the MCAS as a safety-critical system.

The two official accident inquiries (Indonesian and Ethiopian) and the many parallel US institutional post-mortems uncovered shocking evidence about attitudes at Boeing – and at its overseer the Federal Aviation Administration. After the crashes it took about three years to discover that Boeing did not have a formal safety management system (SMS), a jaw-dropping fact that must have related to a belief within the company that although everyone else needed one, Boeing didn’t. It has one now.

For those who, like me, had watched Boeing for nearly 50 years as an aviator and professional aerospace journalist, this was breathtaking. It was not the Boeing we thought we knew.

That question again: would a move back to Seattle cure all the ills?

The Boeing Field, Renton and Everett locations around Seattle wield a powerful symbolic and historic influence, and a move there would signal a faith in the engineers, mechanics and Boeing traditional values. Ortberg clearly knows this. But what of the philosophy that drove the HQ relocation to Chicago, and eventually to Arlington? Does that need to die too?

At the time of the Boeing/MDC merger, Boeing’s Phil Condit remained the CEO of the merged company and MDC head Harry Stonecipher was appointed chief operating officer. Stonecipher, together with former MDC chair John McDonnell, owned a larger shareholding in the merged company than the senior Boeing men. The MDC influence on subsequent developments was dominant.

Soon after the HQ move to Chicago, Stonecipher confided to the Chicago Tribune: “When people say I changed the culture of Boeing, that was the intent, so it’s run like a business rather than a great engineering firm.” He was signalling the developing business philosophy of the new era: shareholders were king. Despite the banking crash of 2008, which should have imparted a message, that philosophy prevails today, along with CEO remuneration packages that launch company chiefs into a different galaxy from the one that their employees and customers inhabit.

Meanwhile Ortberg says he is moving his family to Seattle, with Boeing Commercial Airplanes, but the corporate HQ looks as if it is to remain in Arlington. How does that work? And will Ortberg, the “man of the people”, inhabit the same galaxy he does now?

Max to the skies again

David Learmount Uncategorized , , , , , , , ,

After nearly two years of grounding, Boeing’s 737 Max series has been cleared by the US Federal Aviation Administration to carry fare-paying passengers once again.

This is the first step in a redemption process for one of the world’s truly great engineering companies. Like a boxer who dropped his guard for just a second, Boeing has taken a punch that has knocked it to the canvas, and the referee had started counting.

Now, air traveller reaction is nervously awaited. Will the public believe claims by the FAA and Boeing that, together, they have confined to history the flaws that caused the 737 Max fatal crashes in 2018 and 2019?

The FAA – blamed along with the manufacturer for the lapses in design oversight that led to the two accidents – has declared the aircraft safe to operate in America. One by one, other national aviation authorities (NAA) are expected to follow suit.

Oversight of the type’s rehabilitation continues to be the FAA’s responsibility, but decisions on the systems and software changes applied to the Max have been made by multinational teams. Bodies formed to decide what changes were needed – and then to see them implemented – included the Joint Authorities Technical Review (JATR) representing nine nations plus the European Union Aviation Safety Agency (EASA) – and the Joint Operations Evaluation Board.

The relationship between the FAA and Boeing was much criticised in the accident investigations and the JATR review process . For that reason, the reaction of EASA to the Max’s clearance to fly is seen as critical.

Not only is EASA the agency that oversees safety in the region containing the largest group of aerospace industries outside America, but its contribution to the JATR recommendations made clear EASA was not happy with the FAA’s former piecemeal approach to certifying critical changes applied to the 737 Max.

Its opprobrium was directed particularly at the FAA’s approval of the flawed Manoeuvring Characteristics Augmentation System (MCAS), unique to the Max, and not used in earlier marques of 737. It recommended “a comprehensive integrated system-level analysis” of the MCAS, and of its integration into the total system-of-systems that constitutes a modern aircraft (for more detail, see “The Failures and the Fixes” section following this article).

So it was with heartfelt relief that Boeing heard EASA’s executive director, Patrick Ky, report on Max progress to the European Parliament Transport Committee on 29 October. Ky told them: “We are fully confident that, given all the work that has been performed, and the assessments which have been done, the aircraft can be returned safely to service.” Ky’s statement suggests EASA will re-certificate the 737 Max in Europe soon after the FAA’s announcement.

Meanwhile, out in the real world, Covid-19’s near-immobilisation of commercial air transport worldwide has rendered the Max’s long grounding almost invisible to the media and the public. Because of the far lower level of air travel activity, the airlines have been able to live without the 387 Maxes already delivered to them, and also without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then. The latter are all in storage, awaiting any updates not already incorporated, and ultimate delivery.

Although clearance to fly has now been delivered, even in the USA the airlines will not instantly be re-launching their already-owned 737 Max fleets. The status of all the proposed software and hardware modifications to the type will not have been confirmed until the moment the FAA signs it all off.

American Airlines has said it hopes to start getting its Max fleet airborne before the end of December.

REUTERS/Nick Oxford/File Photo

Once the FAA has done that, getting the Max fleet ready for the sky will be an aircraft-by-aircraft, crew-by-crew process. In many airframes, a knowledge of what changes were coming has enabled a great deal of the work to be done. But also, because of the hardware and software changes to the Max, the crews have to be trained to use the new systems.

Incidentally, while the Max series was grounded, the FAA decided to order some additional modifications – completely unrelated to the crashes – to bring the type fully in line with modern safety regulations. For example, one of these involves the re-routeing and separation of wiring looms that the 737 had previously been allowed to sidestep under “grandfather” rules.

The number of lessons for manufacturers and regulators to learn from this aerospace drama is legion.

The failures and the fixes

The failures

Just a reminder: the 737 Max series fleet was grounded in March last year as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March 2019.

The primary causal factor of the Lion Air Max crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s corrective efforts have mostly been directed.

In both the accidents, the aircraft’s AoA sensor that feeds data to the MCAS wrongly indicated a very high AoA soon after take-off. The system reacted by providing nose-down stabilizer rotation that took the pilots by surprise. They did not understand the reason it kicked in, and their efforts to reverse the strong nose-down pitch did not succeed. Both these events occurred soon after take-off, and because the MCAS kept repeating the nose-down stabilizer in response to the continued erroneous high AoA sensor signal, the loss of height quickly resulted in impact with the surface.

During the examination of all the issues arising from the accidents, the JOEB was aware there were solutions to the situation in which the crews found themselves. But the fact that two crews in different regions of the world were so confused by what the MCAS was doing that they lost control had totally eclipsed pilot failings as the main issue.

MCAS was designed to trigger only in a specific flight configuration that causes the Max’s centre of lift to move slightly further forward, delivering a slight nose-up moment that can be countered by flight controls. This configuration is a combination of relatively low airspeed, flaps up, with the aircraft being flown manually. In the case of the Lion Air and Ethiopian flights, the pilots decided to continue to fly the aircraft manually during the early climb, rather than engaging the autopilot, so this precise flight configuration was encountered as soon as the flaps were fully retracted.

With flaps up, and still at a fairly low airspeed, the aircraft would be at a high angle of attack, and not far above the stall. FAA regulations require that, in the proximity to the stall, one of the “feel” cues to the pilots is that there should be a linear increase in the required control column force versus elevator displacement response, but the Max’s aerodynamics in this configuration had negated this effect, and MCAS was designed to restore that pilot cue automatically.

The JATR decided that MCAS’ fatal design weakness, above all, was that it was triggered by a single AoA sensor with no backup in case the unit had a fault or suffered damage. It seems Boeing and the FAA had overlooked that possibility, and had not explored the potential effects of erroneous inputs. Their excuse at the time was that the system was not seen as a critical one, rather as a refinement.

The fixes

The 737 Max had always been fitted with two AoA vanes, but originally only one was wired up to MCAS, and there was no flight deck indication of a disparity between the two sensors if a difference developed, which could have warned the pilots of a potential vane fault.

The hardware fix agreed by the JATR was that both AoA sensors would now feed into the MCAS, there would be an automatic comparison between them, and if there was more than a small disparity the MCAS would be locked out completely, because the aircraft can be flown without it.

The software fix also ensures that – now – the MCAS only operates once per high AoA event, so the repeated nose-down pitch demand by the stabilizers that led to the two accidents would not occur. In addition, the two flight control computers (FCC) now continuously cross-monitor each other.

After the hardware and software changes, the final improvements – overseen by the multinational JOEB – are to pilot training and cockpit drills for the Max series.

Now, even if the pilots are coming to the Max from the very similar 737NG series, pilots must undergo a one-off training session in a Max full flight simulator. This involves recovery from a full stall, dealing with a runaway stabilizer,  practice manual trimming at high speeds (and therefore high trim loads), and crew cooperation on all these exercises.

Non-normal checklists have now been compeletely revised, and contain updated procedures that concentrate particularly on the operation of the horizontal stabilisers and trim controls, both in normal operation and in the case of all potential faults.  The drills deal with runaway stabilizer, speed-trim failure, stabilizer out of trim, stabilizer trim inoperative, airspeed unreliable, altitude disagree, and AoA disagree.

Computer based training (CBT), containing video of crew exercises using the real controls, teaches drills for the following: airspeed unreliable, runaway stabilizer, the speed trim system, trim controls, and differences between the autopilot flight director system (AFDS) in the NG series and the Max series.

Testing the changes

Boeing and the FAA say they have put in 391,000 engineering and test hours developing the solutions, which have then been tried for 1,847 hours in simulators and for 3,000 airborne hours in the real aircraft.

Muilenburg: Returning Max to service ‘will be an international decision’

David Learmount Uncategorized , , , , , , , , , , , ,

Boeing CEO Dennis Muilenburg says the successful return to service of the company’s 737 Max series depends on international consensus among the many national aviation authorities (NAA) that will see the aircraft operating in their countries.

Not just the US FAA.

As a reminder, the 737 Max series fleet was grounded in March as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March this year.

Speaking this week at Boeing’s Seattle Delivery Centre, Muilenburg declined to predict a return-to-service date, explaining: “Dates are uncertain because we are going for a global recertification.” That means unanimity – near or absolute – has to be achieved.

Boeing aircraft being prepared for delivery at Boeing Field, Seattle

He emphasised the point: “If we do not coordinate this [return to service] we may see some disaggregation, and I don’t think that’s a future any of us wants to see.”

Muilenburg is confident the combined hardware and software changes Boeing has developed for the Max will satisfy the FAA and the multinational Joint Operations Evaluation Board (JOEB).

The primary causal factor of the Lion Air crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s efforts have been directed.

More on MCAS later.

Boeing test pilot and VP Operations Craig Bomben, who flew the 737 Max first flight and has coordinated development activity on the type since the accidents, described the essential difference between the original MCAS and Boeing’s proposed replacement: “We’ve moved from a very simple system to an intelligent system.”

In both the accidents MCAS – triggered by a faulty or damaged AoA sensor which wrongly indicated a high AoA – reacted by providing nose-down stabiliser rotation that took the pilots by surprise. They did not understand the reason it kicked in. Their efforts to reverse the strong nose-down pitch did not succeed, and because both these events occurred just after take-off, the loss of height quickly resulted in impact with the surface.

Bomben said the new “intelligent” system has two AoA sensors instead of one, and if their readings differ by 5.5deg or more, MCAS is not triggered at all.

But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.

But why is MCAS – which is unique to the Max – required at all? Boeing insists it was not fitted as an anti-stall system, because the aircraft already has stall warnings and stick-shakers.

The purpose of fitting MCAS, Bomben explained, was to compensate for a slight change in the low-airspeed aerodynamics of the 737 Max compared with the NG.

MCAS was only designed to trigger in an unlikely (but obviously possible) combination of circumstances that can cause the aircraft’s centre of lift to move slightly further forward, altering the weight-balance equation. It only happens when the Max is at low airspeed with the flaps up, and is being flown manually.

At low airspeed (200kt or thereabouts) – and flapless – the aircraft would be at a high angle of attack and close to the stall. FAA regulations require that one of the cues to the pilot of the approaching stall is that there should be a linear increase in the required column force versus displacement response.

In the Max, however, at a certain point in this sequence the centre of lift shifts forward a little, providing a slight nose-up pitch force, therefore the stick force does not continue to increase, so MCAS is designed to kick in with some nose-down trim to restore the linear increase.

If MCAS doesn’t kick in, the aircraft is still easily controlled without it, but the required progressive stick-force cueing is lost.

In technical and regulatory terms, MCAS seems to be a lot of fuss for very little purpose, but the painful fact is that the original MCAS played its part in bringing down two aeroplanes and killing 346 people.

Muilenburg’s confidence in the fix is, so far, based on more than 100,000 hours of development work on the new solution, plus 1,850 flight hours using the new software, 1,200 hours of refining the results in the simulator, and 240 hours of regulatory scrutiny in the simulator.

Meanwhile, if Muilenburg cannot predict when the world will approve the 737 Max’s return to the air, what is happening to its production at present? The aircraft had won more than 5,000 orders, and fewer than 400 have been delivered.

The Max series, despite the grounding, continues to roll off the production line at Boeing’s Renton plant near Seattle, at a rate of 42 per month. The factory is capable of turning out 57 a month, but Boeing is keeping the rate lower for now. Despite this, Renton has seen no staff layoffs, says Boeing.

The completed aircraft, however, go into storage at Moses Lake or San Antonio desert sites, because the manufacturer’s own sites at Renton, Everett and Boeing Field are full.

Muilenburg said every 737 Max grounded or in store awaiting modification will have an individual entry into service programme, and that in the meantime the engines, systems and cabin of all the aircraft are regularly being run and maintained.

But will they still have that “new plane smell” when the airlines take delivery?

A Max in production at the Renton plant, its unique split winglet close to the camera

 

The Max crux

David Learmount Uncategorized , , , , , , , ,

Boeing, the FAA, and national aviation authorities (NAAs) from several other countries, met in Dallas on 23 May to consider the future of the 737 Max series of aircraft.

It is impossible to overstate how important this meeting is. The way civil aircraft manufacturing does business, not just in America, but all over the world, is under scrutiny.

Detail gradually emerging from Boeing and the FAA following the two 737 Max fatal crashes has upset such basic assumptions about the way modern aviation works that industry veterans – whose initial reaction was that this was just a case of finding a fix and getting the Max airborne again – are , only now, fully realising it’s not.

Like the Looney Tunes cartoon characters who ran over a cliff they didn’t know was there, we didn’t begin to fall until we looked down.

Let’s examine the proposal that all airliners nowadays are massively computerized, so adding some digital controls to the good old 737 to make it a Max is just bringing the 737 marque up to date.

After all, digital controls work on other types like Airbuses and Boeing’s own 777 and 787, and they are safe, so why not on the 737?

Back to basics.

All modern commercial airliners are supposed to be designed, in the first place, so they fly easily and intuitively, and have a natural aerodynamic stability within their flight envelope. That should hold true with or without computer control.

Designing an aircraft to be fly-by-wire, rather than conventionally controlled, can provide additional safeguards, but the airframe itself should still fly naturally.

Applying a digital solution to an airframe-related flight characteristic that is undesirable is a different matter entirely; but that is what Boeing chose to do when it installed the Manoeuvring Characteristics Augmentation System (MCAS) in the new Max.

The fact – revealed by the fatal accidents – that the MCAS could be triggered when it was not needed, and what consequences might follow its triggering, appears not to have been examined in any depth by Boeing or the FAA.

The fundamental questions for the FAA – and the foreign NAAs- are these: is the Max, as a simple airframe without digital corrections, sufficiently stable within its flight envelope to satisfy the regulators it is worthy of certification?

If not, is a digital fix sufficient to cover the undesirable flight characteristics lurking in a corner of its flight envelope? How reliable does the fix have to be to win approval?…and how can its reliability be proven?

For three decades the aviation world has agreed to operate a regime whereby the NAAs in countries where aircraft are manufactured all use the same standards when they certificate a new aircraft. So when the FAA certificated the 737 Max, the rest of the world accepted the FAA’s judgement and did not insist – as in the bad old days of the 1970s and before – on re-certificating it country by country.

What if, in this case, the FAA re-certificates the MCAS-modified Max, but foreign NAAs do not? The European Cockpit Association today has called on the European Union Aviation Safety Agency to scrutinize any FAA approvals, and EASA has pledged to do so. Is this “back to the bad old days”?

At the end of the Dallas meeting Boeing had this to say: “We appreciate the FAA’s leadership…in bringing global regulators together to share information and discuss the safe return to service of the 737 MAX….Once we have addressed the information requests from the FAA, we will be ready to schedule a certification test flight and submit final certification documentation.”

Industry speculation as to when the FAA will be ready to approve return to service varies massively, from a week to many months. These seers also seem to be preparing themselves for disagreement between the FAA and foreign NAAs.

This is the point at which you dare not look down.

 

This shouldn’t happen these days

David Learmount Uncategorized , , , , , , ,

In the last five years, statistics for fatal accidents to commercial passenger jets were so low they looked set to prove that a permanent zero fatal accident target was achievable.

Technology is accepted to be the main contributor to these remarkable safety performance improvements. The superb engineering and smart systems in the latest jets made them as different from their predecessors as today’s generation of automobiles is from cars of the 1970s.

But, on 29 October 2018, Lion Air flight JT610 crashed only about 12min after take-off from Jakarta, Indonesia. The aircraft was a Boeing 737 Max 8 that was delivered by the manufacturer to the airline less than three months before, one of 11 of this new marque in its fleet.

That was a shock, but when on 10 March this year another almost new 737 Max 8 also crashed within a few minutes of take-off from Addis Ababa, Ethiopia under circumstances that appear similar, a chill went through the entire aviation community.

Ethiopian Airlines has grounded its 737 Max fleet, Singapore has banned Max operations in its airspace, and the Chinese aviation authority CAAC has grounded all Maxes registered there – almost sixty of them. And on 12 March Australia, Ireland, France, Germany and the UK added themselves to the rapidly growing list of those who had banned operation of the type. Late on 12 March the biggest blow fell: European Union body the European Aviation Safety Agency has banned all 737 Max 8s and 9s from its skies except to fly, empty, to maintenance bases. The agency argued that it cannot be ruled out that the Ethiopian accident was caused by the same failure as that which appears to have caused the Lion Air crash. And, shortly before midnight, India had joined the doubters.

Now Latin America has begun a wave of groundings and, as a result, by the end of the Western European day on 12 March more than a third of all Maxes in service around the world had been affected by effective groundings. There has never been an event like this, where the original certificating authority has declared an aircraft airworthy but much of the rest of the world has decided it is not so confident.

Back to the accident issues. The two take-off airports couldn’t have been more different, one at sea level, the other at an elevation of more than 7,000ft, but in both cases it was daylight and the weather conditions were benign.

Both aircraft were seen to dive to impact.

The Indonesian investigator (NTSC) issued a preliminary factual report that doesn’t pretend to provide a verdict on the cause of the Lion Air crash, but suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down.  The crew seems not to have known how to counteract this nose-down control demand.

The NTSC did, however, provide fine detail about malfunctions on same airframe on the previous day (28 October), when almost exactly the same sequence of events occurred, including the signal from the faulty AoA sensor to the MCAS. But on that occasion the captain stopped the nose-down stabiliser trim rotation by selecting the STAB TRIM switches to CUT OUT, and then proceeded safely to the scheduled destination.

Some pilot associations in the USA whose members operate the Max have professed publicly that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also among them was an assumption that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out.

The MCAS was developed for the Max because its more powerful engines are heavier and fitted further forward than those on earlier marques, affecting the aircraft’s centre of gravity and thus its behaviour at low speeds approaching the stall, so the manufacturer wanted to boost stall protection. It looks as if Boeing had either not foreseen the potential effect of a false high AoA indicator input to the MCAS, or it had failed to warn pilots clearly what that effect could be and how to react. The FAA also, it appears, had not anticipated this.

After the Lion Air crash the FAA put out an emergency airworthiness directive requiring operators of the Max to make clear to pilots the procedures for dealing with a runaway stabiliser trim. Boeing maintained that information was already available.

Pilots converting from earlier 737 marques to the Max are not required to undergo a new full type rating course or simulator sessions, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the Max are required only to undergo a brief academic “differences course”. For example Southwest Airlines pilots had done their differences course entirely online, and American Airlines the same.

On 11 March, a day after the Ethiopian crash, the FAA revealed it has required Boeing to solve the software problem – and if applicable the hardware – that at present means that a false AoA input can trigger the MCAS stall protection when it is not needed, effectively causing a stabiliser pitch trim runaway. Meanwhile it has declared that the 737 Max series is airworthy.

But if it were to be found that there is a common cause of these two Max crashes – whatever that cause is determined to be – the implications for the manufacturer and the airlines are significant, given the massive size of the order book for 737 Max series aircraft.