Prodigy to Pariah: The Boeing 737 Max's Swift Fall from Grace

Between March 11 and March 13, Boeing’s fastest-selling jet ever, the 737 MAX, was grounded all over the world. The relatively new aircraft had been in two eerily similar crashes within the previous six months, resulting in a total of 346 deaths. Both crashes happened mere minutes after takeoff.

In the recently released preliminary report, the Ethiopian Civil Aviation Authority’s investigators found that erroneous angle-of-attack (AOA) information from a faulty sensor on the 737 MAX led the plane’s maneuvering characteristic augmentation system (MCAS) to override pilots attempts to right the jet’s trajectory, pitching it toward the ground in similar fashion to the Lion Air crash in October. Investigators say that pilots had been appropriately briefed on proper procedures put in place since the accident months earlier.

A lot of investigation remains before full answers are laid bare and all parties may never completely agree on fault, but Boeing is currently working on new training and a software update to the 737 MAX that it says will “add additional layers of protection and will prevent erroneous data from causing MCAS activation.”

Perhaps the biggest issue at this point is what Boeing can do to regain trust. Throughout the process and in the wake of both crashes, the company insisted that the plane was safe. Through the use of organization designation authorizations (ODA), Boeing did a lot of the certification work on the 737 MAX itself, which has brought up concerns about the FAA’s oversight and distance between the regulator and industry.

"The FAA decided to do safety on the cheap, which is neither cheap nor safe, and put the fox in charge of the hen-house," said Sen. Richard Blumenthal (D-Conn.), in a hearing on the 737 MAX late last month.

Acting FAA Administrator Dan Elwell, who was present at the hearing, said that the ODA model is common in the aviation world and used even more thoroughly in Europe than in the U.S., but that may not shake the skepticism that the recent tragedies have engendered. Elwell also said that the FAA will not grant the 737 MAX clearance to fly until “the FAA's analysis of the facts and technical data indicate that it is appropriate to do so.”

Elwell said that MCAS was not in the original version of the flight control manual and no training was required for it because it is “a sub-device to a system called the speed-trim system in the 737 NG” that “made the MAX feel exactly like the NG to fly,” so it would generally be invisible to pilots.

According to Peter Lemme, a former Boeing flight controls engineer who now works as an aviation writer and consultant, that’s not strictly incorrect, but Boeing and the FAA made a couple mistakes when it came to certifying the 737 MAX.

“The design decisions they’ve made are around intended function,” Lemme said “Its purpose is to make the airplane fly acceptably. Having [MCAS] in there means it flies the way you’d expect it to. You can argue in that way that there’s no reason to emphasize it, because it’s transparent. What is undervalued in that is, what about the malfunction of MCAS? What do we have to worry about [with] it, and that’s where the issue was; the pilots had no awareness of it.”

The manual did acknowledge that nomenclature for cutout switches changed between the NG and the MAX, according to Lemme, but not MCAS’s inclusion, which means someone must have determined that MCAS was “basically of no consequence. So, that’s troubling,” he said.

The other engineering mistake is that MCAS runs off inputs from only one angle of attack vane. Normally, MCAS triggers when a plane is pitching too far up during a turn — a possibility thanks to differently placed, larger engine nacelles in the MAX compared to the NG — and nudges the nose down to prevent a stall. However, if the AOA sensor malfunctions and reports that the plane is approaching a stall when it is at a level pitch, MCAS can trigger and attempt to pitch the plane forward.

“I can’t defend why they could have gone with a single AOA input sensor, because the situation is, the vane is a mechanical device,” Lemme said. “It protrudes out from the side and can be damaged.”

Lemme suggested that cross-checking the AOA reading against another sensor and opting not to engage MCAS if there’s a disagreement would be a safer option. If the plane is approaching a stall and an incorrect vane prevents MCAS’ activation, the pilot can always correct manually.

But manually correcting for an unwarranted activation of MCAS, however, isn’t so easy. If the pilot counters the forward pitch and redirects the plane, the faulty sensor will still be reporting its erroneous information and MCAS can just trigger again.

“That program retriggering was never an intended function,” Lemme said. “It was probably a shortcoming in the test program.”

In the case of the Lion Air crash, investigators found that the pilot countered MCAS inputs 21 times.

The solution, according to Boeing and Elwell, is to disengage MCAS, not simply try to fight it over and over. MCAS will disengage if pilots follow the runaway stabilizer procedure, Boeing says, which is the defense for not including it in any training — there’s no change in action on the part of pilots.

But Lemme said that’s misleading.

“If you go back and look at the checklist, the definition [for runaway stabilizer] is continuous motion — and MCAS doesn’t do continuous motion,” he said. “It moves for 10 seconds and then stops. But there’s another function called the speed-trim system which allows the stabilizer to move. When in manual flight, every time you take off, it moves as a function of the speed-trim system, so the pilot is desensitized to stabilizer motion, in increments, as a problem. So, MCAS is masked a little bit.”

If the pilot recognizes it as continuous motion and throws the cutoff switches, that will solve the problem, but that’s a hard diagnosis to make, Lemme said, especially if you don’t know the system exists, as in the case of Lion Air’s pilots.

Boeing’s stocks have taken short-term hits and it is expected to lose some money in 2019 due to the 737 MAX turbulence – it delivered only 11 of the planes in March, down significantly from the year’s first two months. Airlines have stopped ordering the MAX and the manufacturer recently slowed production, which had been ramping up, but its backlog is plenty large to buffer any ordering hiccups as long as the jet is cleared to fly again at some point.

The bigger hit may be to carriers who are currently dealing with cancelled and delayed flights as they scramble to account for unavailable sections of their fleet. Southwest, American Airlines and Air Canada — three of the biggest adopters of the 737 MAX — have all had their stocks downgraded and/or cut their revenue guidance in the first quarter because of the grounding. There’s certainly a lot of pressure and incentive to get the plane back in the air, but with certification questions still looming and public attentiveness at an all-time high, there’s plenty of pressure to keep fleets on the ground until every t is crossed and i is dotted.