Analysts, including former Boeing flight controls experts, are concerned that a new automated flight control system on Boeing’s 737 MAX may be flawed and that the way it changed the jet’s handling could have sown confusion on the flight deck of Lion Air Flight JT610.
A former Boeing vice president who started as an avionics engineer — who asked for anonymity, because as a former executive he said he worries about being sued by the company for public criticism — said he is also surprised at the suggestion in the FAA wording of “a single point of failure” that could bring down an aircraft.
But he added that he wouldn’t necessarily call it a design flaw in itself, provided flight crews have the ability to recognize what’s happening and have training to deal with it.
Yet this too is a point of controversy.
Boeing rushed out a bulletin last week to inform pilots all over the world about the new flight control system and exactly what to do to shut it down if it goes haywire. But the Lion Air crew didn’t have that information and may have been confused by a key handling difference that the system could have caused during the flight.
New flight controls
Bjorn Fehrm, a former jet-fighter pilot and an aeronautical engineer who is now an analyst with Leeham.net, said the technical description of the new 737 MAX flight control system — called MCAS (Maneuvering Characteristics Augmentation System) — that Boeing released to airlines last weekend makes clear that it is designed to kick in only in extreme situations, when the plane is doing steep turns that put high stress on the airframe or when it’s flying at speeds so low it’s about to stall.
Management at Southwest Airlines told its pilots that Boeing did not include any description of MCAS in the flight manual because a pilot “should never see the operation of MCAS” in normal flying.
But in the extreme circumstances where it does activate, when the angle of attack hits the range of 10 to 12 degrees, the system rotates the horizontal tail so as to pitch the nose down. And if the high angle of attack persists, the system repeats the command every 10 seconds.
Fehrm said Boeing must have added this system on the MAX because when the angle of attack is high this model is less stable compared to prior 737 variants. That’s because the MAX has bigger, heavier engines that are also cantilevered further forward on the wing to provide more ground clearance. That changes the center of gravity.
The scenario feared in the Lion Air case is that the AOA sensor sent false signals that fooled the computer into thinking the plane was in a dangerous stall position, and so MCAS was triggered.
What happened next is crucial.
Any pilot’s natural reaction when a plane’s nose begins to tilt down uncommanded is to pull back on the yoke and raise the nose. In normal flight mode, that would work, because pulling back on the yoke triggers breakout switches that stop any automatic tail movement tending to move the nose of the plane down.
But with the MCAS activated, said Fehrm, those breakout switches wouldn’t work. MCAS assumes the yoke is already aggressively pulled back and won’t allow further pullback to counter its action, which is to hold the nose down.
Fehrm’s analysis is confirmed in the instructions Boeing sent to pilots last weekend. The bulletin sent to American Airlines pilots emphasizes that pulling back the control column will not stop the action.
Fehrm said that the Lion Air pilots would have trained on 737 simulators and would have learned over many years of experience that pulling back on the yoke stops any automatic tail maneuvers pushing the nose down.
“It fits in your feel memory,” said Fehrm of this physical way of learning. But on the Lion Air flight, if MCAS was active because of a faulty sensor, the pilots would have pulled back and found the downward nose movement didn’t stop.
Fehrm is convinced this led to confusion in the cockpit that contributed to the loss of control. There is a standard procedure to shut off any automatic pitch control, but somehow the pilots didn’t recognize that’s what was happening.
“MCAS had the wrong information and they reacted to that.,” he said. “MCAS is to blame.”
However, he cautions that there’s not enough information yet to know that the single AOA sensor failure triggered everything that happened, and that the entire sequence of events that led to the disaster won’t be clear until the investigation is completed. “It may not be as simple as a single sensor,” he said.
Heartfelt at Boeing
In the meantime, Fehrm said that the worldwide notification to pilots about MCAS and the re-emphasizing of the procedure to follow if the nose trim goes wrong, means that the MAX is today perfectly safe to fly.
“Boeing is correct. If you follow this drill, you are fine,” he said. “Pilots will hit those cut-off switches faster than you can blink.”
About 400 aviation professionals from around the world gathered for the annual International Air Safety Summit(Seattle) organized by the Flight Safety Foundation (FSF).
When FSF board chairman John Hamilton, who is vice president of engineering at Boeing Commercial Airplanes and formerly chief project engineer for the 737, gave an opening address, he recalled his own personal experience of deep dread over a plane accident and used it to emphasize how people at Boeing react.
He said he saw how that accident reverberated through Seattle and the aviation community.
“What we do every day matters. The work we do touches so many lives,” said Hamilton. “Everybody at Boeing … is deeply saddened by the loss of Lion Air Flight 610.”
He recalled that when he headed engineering on the 737 program, “I was the one person ultimately responsible for the safety of that product,” he said. “Every decision I made, I had to think through carefully and deliberately, since so many lives are dependent on that outcome.”
He said that Boeing together with safety regulators will investigate the Lion Air crash minutely and “learn what we can do to make sure it never happens again.”