The Max crux

Boeing, the FAA, and national aviation authorities (NAAs) from several other countries, met in Dallas on 23 May to consider the future of the 737 Max series of aircraft.

It is impossible to overstate how important this meeting is. The way civil aircraft manufacturing does business, not just in America, but all over the world, is under scrutiny.

Detail gradually emerging from Boeing and the FAA following the two 737 Max fatal crashes has upset such basic assumptions about the way modern aviation works that industry veterans – whose initial reaction was that this was just a case of finding a fix and getting the Max airborne again – are , only now, fully realising it’s not.

Like the Looney Tunes cartoon characters who ran over a cliff they didn’t know was there, we didn’t begin to fall until we looked down.

Let’s examine the proposal that all airliners nowadays are massively computerized, so adding some digital controls to the good old 737 to make it a Max is just bringing the 737 marque up to date.

After all, digital controls work on other types like Airbuses and Boeing’s own 777 and 787, and they are safe, so why not on the 737?

Back to basics.

All modern commercial airliners are supposed to be designed, in the first place, so they fly easily and intuitively, and have a natural aerodynamic stability within their flight envelope. That should hold true with or without computer control.

Designing an aircraft to be fly-by-wire, rather than conventionally controlled, can provide additional safeguards, but the airframe itself should still fly naturally.

Applying a digital solution to an airframe-related flight characteristic that is undesirable is a different matter entirely; but that is what Boeing chose to do when it installed the Manoeuvring Characteristics Augmentation System (MCAS) in the new Max.

The fact – revealed by the fatal accidents – that the MCAS could be triggered when it was not needed, and what consequences might follow its triggering, appears not to have been examined in any depth by Boeing or the FAA.

The fundamental questions for the FAA – and the foreign NAAs- are these: is the Max, as a simple airframe without digital corrections, sufficiently stable within its flight envelope to satisfy the regulators it is worthy of certification?

If not, is a digital fix sufficient to cover the undesirable flight characteristics lurking in a corner of its flight envelope? How reliable does the fix have to be to win approval?…and how can its reliability be proven?

For three decades the aviation world has agreed to operate a regime whereby the NAAs in countries where aircraft are manufactured all use the same standards when they certificate a new aircraft. So when the FAA certificated the 737 Max, the rest of the world accepted the FAA’s judgement and did not insist – as in the bad old days of the 1970s and before – on re-certificating it country by country.

What if, in this case, the FAA re-certificates the MCAS-modified Max, but foreign NAAs do not? The European Cockpit Association today has called on the European Union Aviation Safety Agency to scrutinize any FAA approvals, and EASA has pledged to do so. Is this “back to the bad old days”?

At the end of the Dallas meeting Boeing had this to say: “We appreciate the FAA’s leadership…in bringing global regulators together to share information and discuss the safe return to service of the 737 MAX….Once we have addressed the information requests from the FAA, we will be ready to schedule a certification test flight and submit final certification documentation.”

Industry speculation as to when the FAA will be ready to approve return to service varies massively, from a week to many months. These seers also seem to be preparing themselves for disagreement between the FAA and foreign NAAs.

This is the point at which you dare not look down.

 

This shouldn’t happen these days

In the last five years, statistics for fatal accidents to commercial passenger jets were so low they looked set to prove that a permanent zero fatal accident target was achievable.

Technology is accepted to be the main contributor to these remarkable safety performance improvements. The superb engineering and smart systems in the latest jets made them as different from their predecessors as today’s generation of automobiles is from cars of the 1970s.

But, on 29 October 2018, Lion Air flight JT610 crashed only about 12min after take-off from Jakarta, Indonesia. The aircraft was a Boeing 737 Max 8 that was delivered by the manufacturer to the airline less than three months before, one of 11 of this new marque in its fleet.

That was a shock, but when on 10 March this year another almost new 737 Max 8 also crashed within a few minutes of take-off from Addis Ababa, Ethiopia under circumstances that appear similar, a chill went through the entire aviation community.

Ethiopian Airlines has grounded its 737 Max fleet, Singapore has banned Max operations in its airspace, and the Chinese aviation authority CAAC has grounded all Maxes registered there – almost sixty of them. And on 12 March Australia, Ireland, France, Germany and the UK added themselves to the rapidly growing list of those who had banned operation of the type. Late on 12 March the biggest blow fell: European Union body the European Aviation Safety Agency has banned all 737 Max 8s and 9s from its skies except to fly, empty, to maintenance bases. The agency argued that it cannot be ruled out that the Ethiopian accident was caused by the same failure as that which appears to have caused the Lion Air crash. And, shortly before midnight, India had joined the doubters.

Now Latin America has begun a wave of groundings and, as a result, by the end of the Western European day on 12 March more than a third of all Maxes in service around the world had been affected by effective groundings. There has never been an event like this, where the original certificating authority has declared an aircraft airworthy but much of the rest of the world has decided it is not so confident.

Back to the accident issues. The two take-off airports couldn’t have been more different, one at sea level, the other at an elevation of more than 7,000ft, but in both cases it was daylight and the weather conditions were benign.

Both aircraft were seen to dive to impact.

The Indonesian investigator (NTSC) issued a preliminary factual report that doesn’t pretend to provide a verdict on the cause of the Lion Air crash, but suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down.  The crew seems not to have known how to counteract this nose-down control demand.

The NTSC did, however, provide fine detail about malfunctions on same airframe on the previous day (28 October), when almost exactly the same sequence of events occurred, including the signal from the faulty AoA sensor to the MCAS. But on that occasion the captain stopped the nose-down stabiliser trim rotation by selecting the STAB TRIM switches to CUT OUT, and then proceeded safely to the scheduled destination.

Some pilot associations in the USA whose members operate the Max have professed publicly that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also among them was an assumption that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out.

The MCAS was developed for the Max because its more powerful engines are heavier and fitted further forward than those on earlier marques, affecting the aircraft’s centre of gravity and thus its behaviour at low speeds approaching the stall, so the manufacturer wanted to boost stall protection. It looks as if Boeing had either not foreseen the potential effect of a false high AoA indicator input to the MCAS, or it had failed to warn pilots clearly what that effect could be and how to react. The FAA also, it appears, had not anticipated this.

After the Lion Air crash the FAA put out an emergency airworthiness directive requiring operators of the Max to make clear to pilots the procedures for dealing with a runaway stabiliser trim. Boeing maintained that information was already available.

Pilots converting from earlier 737 marques to the Max are not required to undergo a new full type rating course or simulator sessions, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the Max are required only to undergo a brief academic “differences course”. For example Southwest Airlines pilots had done their differences course entirely online, and American Airlines the same.

On 11 March, a day after the Ethiopian crash, the FAA revealed it has required Boeing to solve the software problem – and if applicable the hardware – that at present means that a false AoA input can trigger the MCAS stall protection when it is not needed, effectively causing a stabiliser pitch trim runaway. Meanwhile it has declared that the 737 Max series is airworthy.

But if it were to be found that there is a common cause of these two Max crashes – whatever that cause is determined to be – the implications for the manufacturer and the airlines are significant, given the massive size of the order book for 737 Max series aircraft.