The Boeing 737 MAX Fiasco

Following the worldwide grounding of all Boeing 737 MAX aircraft, this article attempts to expose the reasons for that grounding and to find out what are the underlying problems with that aircraft or its manufacturer.

At the time of this writing, the official final investigation reports for the two crashes that led to this grounding have not yet been released and the elements or opinions exposed here are the results of my professional experience, reading of various press article or even blog posts on forums like PPrune, the Professional Pilot Rumor Network

Inevitably, there will be some speculation and what you will find here cannot be taken for 100% correct.

Facts

  • The Boeing 737 MAX which is the 4th iteration of the 1967 aircraft, one of the most successful airliner in the world, was developed by Boeing in reponse to the announcement by Airbus of their new, more fuel efficient, version of the A320 family, the A320 NEO
  • The B737 MAX first flew in commercial operations on May 22, 2017
  • On October 29, 2018, Lion Air Flight 610, a Boeing 737 MAX 8, crashed into the Java Sea a few minutes after takeoff from Jakarta, Indonesia
  • In November 2018, Boeing issued a FCOM Bulletin (a document that adds information to the existing pilot manual) describing some system behaviour that could happen in case of the failure of an angle of attack sensor – without naming the involved system which was not documented in 737 pilot manuals – and “reminding” pilots that an existing procedure, the “Runaway Stabilizer” non-normal checklist is applicable
  • On March 11, 2019, Ethiopian flight 302, a Boeing 737 MAX 8, crashed a few minutes after takeof from Addis-Ababa, Ethiopia
  • Shortly after, the stabilizer trim jackscrew was found in the wreckage of the Etiopian 737, indicating that the stabilizer was at, or close to, full nose down position. This very strongly suggested that both accidents had the same origin and that there could be a serious flaw with the aircraft.
  • Immediately after that, most national authorities, starting with the Chinese one, forbade operations of the B737 MAX over their territories. The US Federal Aviation Administration was one of the very last to do so 3 days later.
  • A total of 346 people died as the result of both accidents

About myself

I cannot proceed any further in this discussion without presenting myself, allowing the reader to judge for her/himself if the opinions expressed here are of any value.

I started my pilot career in 1983 as a Boeing 737-200 first officer. I then flew successively as a F/O on the Boeing 747 (-100 & -300), captain on the British Aerospace BAe146, captain on Boeing 737 “Classic” (-300 & -400) and captain on the Boeing 777F (the freighter version). The last year, after a major express freight company (color purple) took over the company I was working for (color orange) and, in the process, took our 777’s for themselves, I had to go back flying on the 737 which was almost exclusively a night operation. This took a high toll on my health and after a long sickness leave including some heart surgery, I had to retire which I did in early 2019.

My flying career was interrupted between 1994 and 2004 when I was assessed as medically unfit to fly. However, I remained the whole period in the aviation industry, my main occupation in those 10 years was as a flight simulator instructor on the Boeing 737 Classic and if I can’t tell for sure, because I never logged those hours as a trainer, I definitely must have done a few thousands of them. Of course, being declared unfit to fly and being allowed to fly again 10 years later is quite exceptional but I benefited from the new European rules, the “JAR-FCL 3”, a document containing many details about what medical conditions are acceptable or not. Way better than being left at the appreciation of an 85 year old general who studied medicine before World War II.

Later, with my last employer, I also held for about 4 years the position of training manager, the exact EASA name is “Postholder Crew Training”. That is a key position that any airline in Europe has to designate as the person responsible for all matters pertaining to crew training in the company.

Coverage of these events by the general press

Many press articles have been published about these two accidents, most of them by journalists who understand very little about aviation and aeronautics in general. It is very rare that these texts do not contain one or more gross mistakes about the accidents.

Among the most frequent errors, the Maneuvering Characteristics Augmentation System (MCAS), the system that most likely was at the origin of both crashes, is called an “anti stall” system. It is not, or at least, not exactly.

Another common error is about the meaning of “stall”. It is sometimes – correctly – defined as a loss of lift by the wings of the airplane but is associated with a steep climb. That is not correct: a stall can occur in any phase of flight, including descent.

A very frequent misunderstanding is to state that the 737 MAX is not well balanced, because heavier engines placed more forward would create a nose heavy situation. This is nonsense. Just look at all the different variants of the 737. Some have longer fuselages than others. It would have been very easy for Boeing to just reduce the size of the fuselage forward of the wing and increase its size aft of the wing to compensate. Besides, the only goal of Boeing was to have an aircraft that could compete with the A320 NEO and do whatever it could to reduce fuel consumption. A nose heavy aircraft is a sure way to increase fuel consumption.

So, I will give a short explanation of what stall is as well as give a few words about the trim sytem. This is necessary if we want to understand how and why MCAS had to be installed on the B737 MAX.

A few definitions

Stall

In order to provide lift, the wing of an aircaft has to maintain a certain angle with the airstream, an angle that is called Angle of Attack, sometimes abbreviated as AOA. For most of the normal flight conditions, the greater this angle, the more lift is provided for a given air speed. It has to be noted that most of the lift is provided by the underpressure on top of the wing. Or in other words, a wing is much more aspirated from the top than pushed by the overpressure at the bottom of the wing.

But when we increase this angle, there is a point where the airstream cannot follow anymore the curvature on top of our wing. At this angle, the airstream on the upper side becomes very turbulent and most of the underpressure disappears with a sudden loss of the major part of the lift provided by the wing. Drag, the resistance to advancement, also suddenly increases dramatically.

Stall is somehow correlated to airspeed with too low an airspeed giving the conditions for stall. But in reality, stall would occur at any airspeed if the angle of attack becomes too important.

To warn the pilots about an impending stall which can be a dangerous situation, specially close to the ground, a device called a “stick shaker” has been installed since the very first model of the B737 in 1967.

The stick shaker

On each control column in front of each pilot, an electric motor is installed. This motor has an eccentric mass on its shaft and when rotating, gives a strong feeling of vibrations in the control wheel. It also makes quite a lot of noise and this noise may have played an important role in both accidents.

The signal to activate this motor is provided by a “stall vane” or AOA sensor. Two of them are installed, located in the airstream just under the side cockpit window of each pilot. This vane will align with the airstream and detect when the angle between the aircraft and the airstream becomes too important.

The stabilizer trim

Pilots control the pitch of the aircraft, that is pointing the nose of the aircraft more nose up or more nose down, by moving the control wheel aft and forward. If you pull on the control wheel, a control surface called the elevator at the rear of the horizontal stabiliser (the small “wings” at the back of the aircraft) will raise. This will create a negative lift on the stabilizer, pushing the tail down and thus raising the nose.

When you’re flying manually, you want to be, most of the time, exercising no pressure at all on the control wheel, only doing it when small corrections are needed.

But when airspeed is changing, or if passengers are moving in the aircraft, or with reducing fuel quantity during flight and definitely when high lift devices are extended or retracted (these are the surfaces forward and aft of the wings which are used for takeoff and landing), this neutral force position changes. To be able to adapt to the new situation, the whole horizontal stabilizer is rotated by means of an electric motor. Additionally, cables run the whole length of the aircraft to the cockpit where two big black wheels rotate together with the movement of the horizontal stabilizer.

Should this electric motor fail, manually rotating the wheels allows to position the stabilizer. There is even a handle on the wheel that can be extended to facilitate this.

During normal operations, in manual flight, the stabilizer trim is positioned by moving two side by side switches located on the control wheel that you can move very easily forward or aft with your thumb to activate the motor. Pilots do this frequently and while flying, it is a kind of automatic action just like when you’re driving a manual gear box car, you change gears without even thinking about it.

When the autopilot is engaged, the autopilot will move the trim too. Whenever you or the autopilot move the trim electrically, the cables will rotate the wheels. A white stripe is painted on them to help you visualize that rotation and it also makes a distinctive noise. We’ll discuss that later on.

It must be understood that moving the stabilizer over its full range has far more authority in pitch control than moving the control wheel from full forward to full aft.

To be complete, I should mention that another system – the Speed Trim System (STS) – can activate in some flight conditions, and while flying manually, usually after take off with a light aircraft. This sytem, existing since the 737 Classic, manifests itself by short movements of the stabilizer trim wheels and probably played no role in the accidents except that activation of MCAS may have been initially confused with STS action.

The evolution of the B737

The Boeing 737 was designed in the early sixties and started operation in 1967. The first variant, the B737-100 was only delivered to Lufthansa, the German national airline.

Pre-existing designs and technical solutions from the B707 and the B727 were used heavily. And for example, the stabilizer trim system was almost an exact copy of the one used on the B707, whose prototype, the “Dash 80” had first flown in 1954. The B737 MAX’s stabilizer trim system is still very close to that original design.

Very soon after, Boeing designed an extended version of the 737: the B737-200. This aircraft was a huge success and many of them were produced.

Like all other jet airliners of the day (B707, B727, DC8, DC9, etc.), it was a “narrow body” aircraft with the fuselage sitting close to the ground on shorter landing gear as compared to today’s standard. This was possible because the jet engines – the Pratt & Whitney JT8D – were comparatively of a smaller diameter than today and the equipment of airports of that time (stairs, baggage loading equipment) were sized accordingly.

Around 1986, Boeing came up with a new design: the B737-300. Today, that class of 737 (-300, -400 & -500) is called the Boeing 737 “Classic”. The main improvement was the use of a more fuel efficient engine, the CFM56. However, this engine had a larger diameter than the original JT8D, and to make it fit, the lower part of the engine was flattened. Of course, the rotating parts were still round but it was made possible by relocating engine accessories (starter, electrical generator, hydraulic pump, etc.). This aircraft was a huge success too, many of them are still flying today.

From 1988, Boeing was in a direct competition with Airbus who made a very new narrow body medium range aircraft, the Airbus A320.

Around 1997, Boeing produced the 737 NewGen or “NG” (-600, -700, -800, -900). Today, this variant is called Boeing 737 Next Generation. That aircraft had improved aerodynamics, a more recent version of the CFM56 and new cockpit instrumentation. Noticeably, its range was increased and it had better fuel economy than the previous version. Again, it was a huge success. Today, thousands of them are flying daily everywhere in the world.

In the meantime, Boeing had created other successful designs: 747, 757, 767, 777 (a brilliant aircraft!) and the B787 “Dreamliner”. This last one, using some breakthrough technology – mainly a mostly composite structure and replacing hydraulic systems by electric systems – was plagued by issues and delays during development. It also had serious problems with its lithium batteries, some catching fire in flight. This already caused a grounding of all 787’s for a few months.

In 2010, Airbus announced its new Airbus A320 NEO (New Engine Option), promising a 15% reduction in fuel consumption. The new Airbus was designed around the new LEAP-1A engine. This much more fuel efficient jet engine had a larger diameter than the CFM56 but this was no problem for Airbus whose aircraft had, since its inception, a longer landing gear than the B737 and was sitting higher on the ground, leaving more room for the larger engine.

If better engines require a larger diameter, it is because in order to improve their fuel efficiency, you have to increase the bypass ratio, a concept I will not explain here.

This announcement caught Boeing by surprise. They probably had a new medium haul design under way but it is likely that this design was delayed by the 787 issues. They had to react promptly, and in order to have a competing aircraft quickly, they elected to improve the old 737 and do this in the shortest time possible. So, they very soon announced the 737 MAX.

The Boeing 737 MAX

Boeing had to reduce the fuel consumption of the existing 737 NG by at least 15%. In order to achieve this, they took various measures like slight improvements in the aerodynamics of the aircaft. But there was no way around installing a better jet engine. The LEAP-1A having too large a diameter, the LEAP-1B, a slightly smaller version was used. But this engine was considerably larger than the CFM56 used on the NG and the only way to install it was to position it higher and, to be able to do that, they also had to put it more forward.

The nose landing gear was slightly extended but there was no way to significantly increase the size of the main landing gear: the main landing gear retracts inwards in flight and there is just no room for a larger one unless you completely re-design the plane.

Another major design goal was that the new aircraft could be considered sufficiently close to the previous one such that no additional pilot training was required except maybe a short self-briefing by the pilot on a tablet computer.

Pilot training in a simulator costs money. Typically, renting a flight simulator for an hour costs around 500 € (most smaller airlines do not own flight simulators, a very expensive device). A training session usually lasts 4 hours. Additionally, you have to pay the instructor, and the pilots when they are in the simulator are not flying in line operation. If you train them in the sim, you probably need an aditional check session to verify their performance. This of course had to be avoided at all cost by Boeing because it would not be competitive, the A320 NEO requiring no additional training.

Aerodynamic issues

When the MAX was designed, it was soon discovered that the larger engines had an unforeseen aerodynamic effect. At high angles of attacks, lift caused by the engine cowling or maybe aerodynamic interaction between the cowling and the wing, created an upward force located in front of the wing and this was causing a pitch-up tendency at those high angles of attack.

Aerodynamic solutions could possibly be found like adding “vortex generators” or “chines” but not only do these increase drag and fuel consumption, they are also time-consuming and expensive to implement. And the whole design process was apparently under a very high time pressure.

So the solution was to artificially modify the aerodynamic characteristics by moving the horizontal stabilizer under software control: MCAS, the Maneuvering Characteristics Augmentation System, was born.

What I have been told – again, I cannot certify that this is entirely correct – was that initially, the problem was at higher speed and higher load factors. And initially, MCAS had inputs from one AOA sensor (stall vane) but also from an accelerometer measuring the load factor, both being required for MCAS to activate. MCAS response was limited to move the stabilizer by a maximum of 0.65 units. I will discuss later on what these stabilizer movements represents in aircraft behaviour.

However, later in the development (during flight testing ?), it was found that the problem was not only at high speed but also when approaching high angles of attacks at lower speed. And at lower speed, aerodynamic control surfaces are less effective and must be moved to a greater angle. Also, at lower speeds, you can stall the aircraft at lower load factors. So MCAS was modified to only take the AOA sensor as input and its effectiveness was increased to 2.5 units, a single trimming action of 9.5 seconds. And even more, after this, it would pause for 5 seconds and trim again for 2.5 units if the AOA condition is still present.

Now, was MCAS installed because the MAX had a high risk of stalling? Most probably not. In fact, it was created to satisfy a certification requirement and maybe also to demonstrate that the handling characteristics of the MAX were the same as the NG.

If you are doing a level flight, maintaining altitude, and you reduce the thrust – the power – of the engines, the aircaft will deccelerate. To maintain the altitude while the speed decreases, the only solution is to increase the angle of attack and to do that you pull more and more on the control wheel. This will work until you reach the stalling angle of attack. But to satisfy the certification requirements, you must demonstrate that the pulling force required on the control wheel increases with increasing angle of attack. Apparently, this is where the aerodynamic behaviour of the MAX was not OK.

MCAS is probably just additional lines of software code, a modification of the existing Speed Trim System, a software running inside the Flight Control Computers (there are two of them).

There is one very serious issue with the implementation of MCAS: remember, MCAS has to trim the aircraft nose down while the pilot is pulling on the yoke. To understand why this is important, we need to discuss a failure called “Runaway Stabilizer”

Runaway Stabilizer

The huge pitch authority of the stabilizer trim system makes this system potentially dangerous. Should the electric trim activate inadvertently, this could lead to a very difficult situation.

This system, remember, was derived from the Boeing 707 and its prototype of 1954.

Over the decades, with each new aircraft or aircraft variant, protections were added to this system.

On the 707, there was a big brake handle that allowed to physically stop the movements of the trim wheels. And there was a quite complicated, and thus time consuming, procedure to selectively extend part of the flaps and part of the spoilers to compensate.

On the 737-100/200, two switches, the “stab trim cutout switches” were added to electrically disconnect the electric trim motor. On the MAX, those switches are labelled a bit differently than on previous variants and the electrical wiring of the switches is slightly different, but moving both switches has the same net effect.

Starting from the 737 Classic (well, if I remember well: I just don’t remember the existence of this feature on the -200, but the last time I flew on one was 33 years ago…), there is an additional protection: if the stabilizer trim was moving intempestively and you oppose it by moving the control wheel in the opposite direction, the electric motor is disabled. This opposing motion of the control wheel is a totally natural and instinctive reaction from the pilot.

It must be understood that this last protection had to be bypassed by MCAS as MCAS must be able to trim nose down while the pilot pulls on the control wheel. So, for MCAS logic of activation, this essential protection was disabled.

And there is a non normal checklist, the “runaway stabilizer” checklist that deals with this failure. This is one of the few checklists containing “memory items”. For most non normal checklists, you perform the actions, time permitting, when the aircraft is out of a critical phase of flight. You take the so called “QRH” – the Quick Reference Handbook – containing the checklists, and you perform the actions each time by reading the action then performing it. But some failures like this one or an engine fire for example, command a much quicker corrective action and those actions are perfomed by recall.

For the runaway stabilizer, it goes roughly like this: hold the control wheel firmly, disengage autopilot and autothrottle if they are engaged, if the runaway does not stop, put the two “stab trim cutout switches” to the “cutout” position, effectively removing all electric power to the stab trim motor. And should the runaway continue (it is beyond the scope of this discussion but there is something else than the electric motor that could cause the stabilizer trim to move), one of the pilots puts his hands on the wheel to physically stop it. If this last action is required, believe me, you better do it in a very fast and deliberate manner, those big wheels are quite intimidating when they are turning fast and if you do it hesitantly, you’re going to smell burned skin…

After this you keep the motor disconnected and Boeing tells you to trim manually, moving the wheel with your hands as required.

And if you go for more information to another manual called “FCTM” (Flight Crew Training Manual), you can only read some advice, not very precise intructions. The text in that book is a bit disconcerting. Many years ago, in the -200 manual, it used to be a lot clearer as to what kind of actions you might have to perform after the non normal checklist was completed. We’ll come to this later as well.

Although the stabilizer trim system has a potential to severely de-stabilize the flight in case of malfunction, even, as was shown in the two MAX accidents, to the point of reaching an uncontrollable situation, in reality, until the MAX came into service, it has proven extremely reliable.

I can’t recall of any single accident of a 737 directly caused by a runaway stabilizer. There have been some accidents where the stabilizer trim played a direct role but it was in fact working correctly and these accidents had other causes or were due to pilot errors. Examples of this are Turkish Airlines flight 1951 in Amsterdam or Flydubai flight 981 in Rostov.

To my knowledge, there is only one accident involving a Boeing aircaft that can be directly attributed to a runaway stabilizer. It was the February 1961 (!) accident of Sabena flight 548, a Boeing 707, which occurred near Brussel Airport, Belgium. The common view today is that the cause was a stabilizer runaway bringing the stabilizer in the full nose up position. This accident in which all of the US figure ice skating team disappeared, was the very first accident of a Boeing commercial jet carrying passengers. There had been a few other 707 accidents before but they all happened during training flights killing only the pilots on board. I did a lot of Sabena 548 flights – New York JFK to Brussels – but that was 25 years later on the 747.

If the stabilizer trim has not been a cause of accident during all that time, it was maybe because the protections added over time to the design of the 737 were effective.

The accidents

Both Lion Air 610 and Ethiopian 302 flights seem to follow a similar pattern: immediately after takeoff, the stick shaker activates, at some altitude the flaps are retracted and from that point on the vertical path of both aircraft seem to become erratic, like if the pilots are battling to control the pitch. And in both cases the flight ends in a very high speed, very steep dive toward the ground.

Only the final investigation reports will bring the full light on the exact sequence of events leading to the crash.

However, we can already try to understand what happened in both cases.

The fact that the stick shaker was activated and the subsequent events seem to indicate that in both cases, some wrong output from at least one of the stall vanes took place. This can be caused by a bird hitting the stall vane, jamming the vane in a position not aligned with the airstream. In the case of Lion Air, this may have happened on a previous flight as the flight just before the accident had a similar abnormal activation of MCAS. On the other hand, a stall vane had been replaced a couple of flights before which seem to indicate that the original cause may have been different for Lion Air.

What is not clear to me was if there was any airspeed difference between the captain and first officer airspeed indicators in both accidents. If there was, memory items for “Airspeed Unreliable” should have been performed, one of them commanding to manually position the thrust levers to a lower thrust setting. Whether these actions have been performed or not is unclear but it doesn’t seem so. The engines were kept at a high power setting until the very end. And this too is difficult to understand. Why, when the airspeed became very high, was there nobody to pull back on those thrust levers to reduce the thrust?

And questions are raised by pilots as to why were the memory items for the runaway stabilizer not performed? Although in the case of Ethiopian, at some point, but maybe too late, they were somehow done but reverted later.

There was on PPrune an lot of comments about these accidents and although this is supposed to be a professional pilot forum, many posts are from people who are not pilots or who are pilots without relevant experience or knowledge. There appeared to be a view by many that such accidents would never occur to an american or european crew.

I absolutely do not share this view and I will try to explain why.

Let’s first consider the stick shaker activating on takeoff.

I once experienced, a long time ago, a similar event, with the stick shaker activating a short while after takeoff while flying the BAe146. This is a very serious warning, even more so at very low altitude. I guarantee that my heart rate immediately jumped to more than 200 BPM.

Of course, you immediately lower the nose slightly – but not too much because you are close to the ground – and you immediately verify the basic parameters: pitch attitude, speed, vertical speed, flap setting, engine setting. We rapidly came to the conclusion that it must have been a false warning but you have to be careful because there could be some not so obvious reasons for such a warning. What if some spoilers deployed or you had a structural damage affecting the aerodynamics of the plane? Anyway after a while and a full assessment of the situation, we continued the flight after disabling the false warning. But the feeling of “uneasyness” about the event took quite a few minutes to dissipate.

This was a purely isolated warning. There was no other malfunction happening simultaneously.

Now, let’s put us back in the seat of the Lion Air or Ethiopian pilot. After they retracted the flaps (whether it was a good decision to do so or not), and they were probably already in a high stress situation, MCAS kicked in, starting to trim the nose down. If you are a qualified B737 pilot, you may think: “Hey, if the stabilizer trim acts weirdly, I will for sure perform the runaway stabilizer memory items!”. But was it so obvious? In my quite long experience as a 737 simulator instructor, I many times simulated a runaway stabilizer. And the very first clue you have that a runaway stabilizer is taking place is the noise of those wheels turning: “joom, joom, joom…”. This immediately attracts your attention to the trim wheels confirming visually that there is a runaway. This will trigger your memory items. But what if the noise of the wheels is covered by the noise of the stick shaker? I can’t tell for sure. I don’t remember having ever trained a runaway simultaneously with a stick shaker false warning (I’m sure many people did it in 737 simulators since the accidents and I’m curious to know their opinion about it).

You may think: “yes, but if you can’t hear it, then you must see it!” Remember the white stripe on the wheels? This surely must attract your attention! In fact when you are in the pilot seat, looking at your flight instruments, the trim wheels are at the far edge of your peripheral vision. I am not sure at all that you will notice it. Here, we have a very interesting information: it has been said that when MCAS activated on the flight just prior to the Lion Air accident, it was a pilot, not part of the crew, who suggested to put the cutout switches on cutout. Was it because he was smarter than the flying crew? Or because with the noise of the stick shaker, he was the only one to notice the trim wheel rotation? The person on the jumpseat is sitting in a middle position between the 2 pilots but quite behind them (the jumpseat is right against the cockpit door). And he could not miss the trim wheel rotation as they are in the middle of his field of vision.

Okay. Then you must think “if you don’t see it, then you must feel it!”

Is it really so? And here, we must see that MCAS activation does not react at all like the “classical” runaway stabilizer malfunction that all 737 pilots have been trained for. When MCAS activates, any short use of the stab trim switches on the control wheel will pause MCAS for 5 seconds. This is entirely different from the “normal” trim runaway. As said before, pilot use of those switches is completely instinctive when you feel a “mistrim” condition. I wouldn’t be surprised if it took those pilots, already in a demanding situation, quite some time before they realized there was something wrong with the stabilizer trim. By the time they realized it, they were already at a very high speed. Then we reach the really horrendous part of the problem. The problem that will be exposed here affects not just the MAX, but every single Boeing 737, of any variant, in use today.

Trimming the 737 manually

If you have to trim the horizontal stabilizer manually, really, it is not difficult at all. It is just very slightly more workload compared to using the usual electrical trim. Instead of using the thumb switches, you roll the wheel with your hand, using the foldable handle if required for larger movements. But this is true only if you are not too far from the “in-trim” position.

If, because of a runaway that you did not stop quickly enough, you find yourself with a very out of trim condition, it will become a lot more difficult. If there is a severe out of trim condition, just to be able to keep the aircraft under control, you will have to oppose the very large pitching up or pitching down tendency with very large actions on the control wheel, pulling or pushing it by a large amount. This will cause a large deflection of the elevator, the control surface at the rear of the horizontal stabilizer. And the aerodynamic force caused by this deflection will make it much, much harder to move the trim wheel manually. If you are at low speed, this is not likely to be a problem but at very high speed, it can become impossible to move the trim.

This is aknowledged by Boeing. Remember when I said that, in the FCTM, Boeing instructions were a bit disconcerting? Boeing says this:

Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming

Effort by both pilots? What is the physical strenght required? Would an all female crew be able to do it? An all female crew is not an uncommon sight today. Don’t mis-interpret what I just said: most – and I would tend to say all – female pilots with whom I flew in my career were extremely competent pilots.

Aerodynamically releave the airloads? And how exactly are you supposed to do that? Boeing does not say.

When I was flying the 737-200, 35 years ago, there was a written procedure. It has been dubbed the “roller coaster” procedure: in case of a severe mis-trim nose down, pull as much as you can on the control wheel, attempting to bring the nose of the aircraft above the horizon. Then release all force on the control wheel and, while the aircraft will then rapidly pitch nose down again, turn the trim wheels during that time. Then block the wheel with the hands and start again. You will need to do that a few times in case of a severe mis-trim condition.

Now, this procedure is not very far from aerobatic flight. Was it the reason why Boeing removed it from the manuals of subsequent 737 versions? And what about doing this when you are just 1000′ above ground?

Again, it must be reminded that until the MAX was put into service, that situation may never have happened or at least no accidents were caused by it.

To give an idea of the severity of the problem, let’s consider the stabilizer trim range: when you are flying manually and you use the trim switches on the control wheel with your thumb, you can trim a 737 MAX 8 with flaps retracted from 3.95 units to 14.5 units, the lower value being the nose down trim limit.  This normal stabilizer trim range should allow you to fly in-trim over the whole range of normal speeds of the aircraft up to the maximum speed called Vmo. Flaps were retracted in both accidents. In fact, MCAS can only activate when the flaps are retracted.

But the autopilot – and apparently MCAS – are able to trim to a limit of 0.05 unit. That is a considerably more nose down trim position. Once at that position, you cannot prevent the plane from diving, and when it is diving, airspeed will increase even with minimum engine thrust and there is nothing you can do about it unless you raise the nose of the aircraft. And this is now impossible to do by pulling on the control wheel. This is a catch 22 situation. Both flights ended in a steep dive with airspeeds well above Vmo. Once they were in a dive at very high speed, absolutely nothing could be done to avoid the crash.

It is not difficult to understand that the situation may have quickly developed to a point where the pilots were overwhelmed. And, even if some of their actions may be criticised, once you are overwhelmed, it is very difficult to take cool-headed, rational decisions.

This was even acknowledged by Captain Sullenberger (Cpt Sullenberger’s role was played by Tom Hanks in Clint Eastwood’s 2016 movie “Sully”). Sully experienced in a 737 simulator the same failures that led to the accidents and confirmed that the startle effect and the overwhelming factor was huge. And Sully has demonstrated in the past that he is a hell of a cool-headed pilot.

The design of MCAS

So, MCAS was designed as a software solution to the unacceptable behaviour of the MAX at high angles of attacks. There are various inputs taken into account by MCAS to trigger the stabilizer trim actuation, but apparently, only one stall vane input is used and this is quite surprising.

Remember when I said that I once had a stick shaker shortly after takeoff on the BAe146. On that aircraft, like most T-tail airplanes (the horizontal stablizer positioned on top of the vertical fin), a fully developed stall is a very dangerous situation because the stabilizer will be in the turbulent airstream behind the stalled wing. The stabilizer can be so ineffective in this case that you can never get out of the stall condition.

So the British Aerospace engineers added a protection called a “stick pusher” and this is a true anti-stall device. Should you approach stall, a pneumatic system will push the control column forward to make the aircraft pitch down and leave this dangerous situation before it fully develops.

When the BAe engineers designed that aircraft some 40 years ago, they had the common sense to make it activate only when both stall vanes detected an impending stall. Furthermore, if required, you could very easily overpower the system by manually opposing that pushing motion of the control wheel.

Now, why didn’t Boeing use a similar system and ended with a much more dangerous solution? There are probably various reasons. First, as said before, the problem was not so much a high risk of stall, but the fact that they needed to make the feeling in the control wheel similar to the previous version of the 737 and they had to comply with certification. Second, a stick pusher would have required additional simulator training. Boeing desperately wanted to avoid that even to the point of hiding the existence of MCAS to pilots .

In the case of Ethiopian, the preliminary investigation report states that shortly after takeoff, the left stall vane indicated 74.5 degrees (a totally unrealistic value) and the right one 15.3 degrees, a much more logical indication.

I have seen a Boeing document listing the conditions for MCAS activation. One of the conditions is that the difference between left and right stall vanes indications does not exceed 5.5 degrees, a condition obviously not met in the case of the Ethiopian MCAS activation.

But that text has a revision bar on the side of it, indicating that it was modified in the last revision of the document. And the date of this revision is 15 May 2019, only two months after the Ethiopian crash. Does that mean that, at the time of the Ethiopian accident, all MAX aircraft were being modified to include this additional condition? Couldn’t they implement this modification sooner? Or maybe ground all 737 MAX until that modification was installed?

And how could Boeing create such a system with only one sensor input? A system bypassing the protection that detects an opposing control column movement? A system that can bring the stabilizer trim very close to the full nose down trim position, an almost guaranteed loss of control position? Do they really understand their aircraft and the risk factors involved? Did they consider the possibility of a wrong input? Or was their view only limited to the very remote case when the aircraft actually encountered the conditions for its activation? Were they thinking that in case of wrong input the pilots would correct the situation by applying the runaway stabilizer memory items? Experience has shown that this was an unreasonable assumption. And if they expected the pilots to correct a wrong MCAS activation, pilots who had never heard that this system existed, did they verify in a realistic simulation, stick shaker and all, that a lambda pilot would effectively handle the situation correctly. I would guess they most probably didn’t do it.

I don’t know if MCAS was developed internally by Boeing or subcontracted to another company, possibly in another part of the world. There is nothing wrong with subcontracting parts of the design. Some parts of the aircraft or equipment (engines, navigation equipment and many other subsystems) have never been manufactured or designed by Boeing itself, but when you subcontract the design of a critical system, you must submit a very strict set of requirements and during “integration tests” verify that the system actually performs as expected. If they subcontracted MCAS software development to a company specialized in software, they couldn’t expect them to understand all the subtleties of the 737 pitch control.

After decades of no event due to stabilizer trim malfunction, were younger engineers at Boeing still aware of the potential for extreme loss of control of the horizontal stabilizer? Or, as I have read somewhere, were they led to believe that Boeing aircraft are a “mature” design for which no surprise can be expected and that testing, including flight tests, can be reduced to a minimum?

Then we have the most disturbing question: if such a terribly designed system was added to the MAX, are there other new systems, or re-designed existing systems, that are just accidents waiting to happen?

Boeing’s handling of the crisis

I will not discuss the many statements made by Boeing management since the beginning of this crisis. Statements of the kind “Safety is our utmost priority” or “We are working very hard to make the B737 MAX, a safe airplane, a safer one”. This is management jargon, empty words used in an attempt to salvage what is left of Boeing’s crumbling reputation.

Instead, let’s have a closer look at the FCOM Bulletin Boeing issued a few days after the crash of Lion Air flight 610.

The words used: “…call attention…”, “…directs flight crews to existing procedures…”, “…pilots are reminded…” seem to suggest that the Lion Air accident occured because the pilots did not follow procedures they were supposed to follow. That the Runaway Stabilizer non normal checklist had to be performed because uncommanded nose down stabilizer trim was present.

However, they tell you that you can use the thumb switches on the control wheel to neutralize the pitch forces already present before putting the stab trim cutout switches to cutout. This is absolutely not part of the existing Runaway Stabilizer checklist. If this is considered an action you should take in this case, then it’s not a Bulletin Boeing should have issued. They should have published a revised Runaway Stabilizer checklist, or even a new checklist even if it’s only a temporary one. But the problem here is that many national authorities could have then required supplementary simulator training. Ooch.

Note that they never mentioned MCAS or even explain why this uncommended nose down trim could happen.

And here is one of the strangest things of all this mess:

How can Boeing create a system, a “protection”, which, when activated, is designed to trim repetitively for durations of 10″ and at the same time consider that the crew normal reaction is to disable it by performing the Runaway Stabilizer checklist?

So even if you were in the situation where MCAS has been designed to activate – remember, pilots had never heard of that system, they could not know that this was a normal reaction of MCAS – pilots must de-activate the protection. This is complete nonsense.

Is that not a implicit recognition of the fact that the current implementation of MCAS was severely flawed? And in that case, weren’t drastic measures like grounding the MAX fleet a logical move after the first accident? 157 persons would still be alive.

I remember, not long after the Ethiopian crash, a short sequence in the local (Belgian) TV evening news where it was shown that the crew only had to move 2 switches to save the day. For the average spectator, this meant that those pilots must have been dumb or completly ignorant.

Certification of the 737 MAX

A lot has been written about how the Federal Aviation Administration delegates power to Boeing for self-certifying parts of its aircraft.

I don’t think I am in position to judge whether this is ok or not. It seems clear that considering the complexity of modern airplanes, if the certifying authority had to scrutinize all details of how it is made, it would require an engineering staff of the same size as the manufacturer and all its subcontractors. It is obviously not the case.

It should be noted as well that the certification process is a very costly one. Manufacturers try to minimize that cost by using grandfather rights. The whole idea is that if a system was certified in the past, it remains so. It is not something unreasonable. After all, if a system has proven reliable, why change something that works? Except that you cannot know if there was not a part of luck in the fact that the system seems so reliable.

This blocks innovation and it is no surprise that old technology, e.g. slow micro-processors can be found in very recent aircraft. This also explains why a 1954 stabilizer trim design is part of an aircraft which made its first flight in 2017, more than 60 years later.

It can reasonably be assumed that without grandfather rights, a brand new B737 MAX, if presented for certification as a brand new design, would never be accepted.

I don’t know if what I have read is true: that MCAS version 1 (maximum trim action of 0.65 unit) was well known and approved by the FAA but that MCAS version 2 (maximum action of 2.5 unit) was never submitted to them. If that is true, then it is not just a design error, it is a criminal violation.

The future

At the time of this writing, Boeing claims that their best estimate for return to service is early in the fourth quarter of 2019. Many 737 MAX operators don’t share this optimistic view, many of them delaying their expected return to service to the beginning of 2020. But all this is only valid if the “software patch” proposed by Boeing is accepted “as is”.

Some authorities like the european EASA raise annoying questions: how does Boeing address the difficulty of manually trimming at high speed and severe out of trim conditions? I just can’t see how a software update could solve this. Not to mention the fact that all existing 737, not just the MAX, might need modifications.

Only time will tell.

Boeing has been facing various serious problems in the last 15 years. Design issues: this is obviously the case with the 737 MAX but it looks like there are still many remaining issues with the 787. There are also production issues, like the discovery by the US Air Force of “garbage and tools in closed compartments” in the last deliveries of the KC-46, the in-flight refueler aircraft derived from the 767. It seems that these closed compartments are the fuel tanks. Garbage in the fuel tanks? What about the risk of fuel contamination and subsequent risk of engine failure?

The underlying problem may just not be a design error by some engineer but a serious degradation of the corporate culture at Boeing. This will take a long time to get back on track and the responsibility lies with the top management.

I feel deeply saddened and even angered by all this. Most of my professional life was linked to Boeing aircraft and a good deal of it directly with the 737. What did they do to this venerable, prestigious brand?

Philippe Vico

Hamme-Mille, 7 September 2019.

Leave a Comment

Your email address will not be published. Required fields are marked *