Analysts, including former Boeing flight controls experts, are concerned that a new automated flight control system on Boeing's 737 MAX may be flawed and that the way it changed the jet's handling could have sown confusion on the flight deck of Lion Air Flight JT610.
The Federal Aviation Administration (FAA) said Wednesday it’s evaluating whether to require Boeing to fix a possible flaw in its design of a new automated flight control system introduced for the 737 MAX jet.
It’s also looking into whether the technical data and training provided to pilots transitioning to the new jet model was adequate. Flight control experts believe that lack of information about the new system likely confused the pilots flying the Lion Air jet that crashed Oct. 29 in Indonesia, killing all 189 people on board.
The air safety agency said Wednesday that “the FAA and Boeing continue to evaluate the need for software and/or other design changes to the aircraft, including operating procedures and training.”
The accident investigation has already established that false readings from a sensor that measures the plane’s angle of attack (AOA) — the angle between the wing and the oncoming air flow — could have triggered a flight control system new on the MAX that relentlessly pushed the nose of the aircraft downward.
FAA spokesman Greg Martin said “the angle of attack values used by several systems, including the air data, the fight controls, the stall warning, etcetera, the safety analysis for each of these systems are currently being reviewed.”
Flight control experts say the new system kicking in would have changed the feel of the plane’s control yoke from what the pilots had experienced training on simulators, possibly sowing confusion aboard Flight JT610.
Boeing insists the plane is safe to fly. Appearing Tuesday on the Fox Business Network, Chief Executive Dennis Muilenburg called the MAX “very safe” and said Boeing provides “all of the information that’s needed to safely fly our airplanes.”
Even the pilots at American Airlines and Southwest, who on Monday expressed concern that they had not been given prior information about the new flight control system, continue to fly the plane. They’ve been assured that a standard procedure Boeing highlighted after the Lion Air crash will turn off the system if it goes awry in the future and quickly return the jet to normal flight.
Still, even though it may be no more than one element in a string of events that led to the Lion Air catastrophe, the new MAX flight control system has become a subject of intense controversy.
Three former Boeing flight control experts were startled by the FAA’s description last week of the new MAX system. In an airworthiness directive, the FAA cited an analysis by Boeing that “if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands” that will swivel the plane’s horizontal tail to pitch the nose downward.
The fact that the plane’s nose could be automatically and repeatedly pushed down due to one false signal shocked Peter Lemme, a former Boeing flight controls engineer, who said it looks like a design flaw.
“To contemplate commanding the (horizontal tail to pitch the jet) nose down clearly is a major concern. For it to have been triggered by something as small as a sensor error is staggering,” Lemme said. “It means somebody didn’t do their job. There’s going to be hell to pay for that.”
Most Read Business Stories
Likewise, Dwight Schaeffer, a former Boeing electronics engineer and senior manager who oversaw development of systems, including the 737’s stall management computer, said the brief description in the FAA’s airworthiness directive “blows me away.”
“Usually you never have a single fault that can put you in danger,” said Schaeffer. “I’ve never seen any such system.”
A former Boeing vice president who started as an avionics engineer — who asked for anonymity, because as a former executive he said he worries about being sued by the company for public criticism — said he is also surprised at the suggestion in the FAA wording of “a single point of failure” that could bring down an aircraft.
But he added that he wouldn’t necessarily call it a design flaw in itself, provided flight crews have the ability to recognize what’s happening and have training to deal with it.
Yet this too is a point of controversy.
Boeing rushed out a bulletin last week to inform pilots all over the world about the new flight control system and exactly what to do to shut it down if it goes haywire. But the Lion Air crew didn’t have that information and may have been confused by a key handling difference that the system could have caused during the flight.
New flight controls
Bjorn Fehrm, a former jet-fighter pilot and an aeronautical engineer who is now an analyst with Leeham.net, said the technical description of the new 737 MAX flight control system — called MCAS (Maneuvering Characteristics Augmentation System) — that Boeing released to airlines last weekend makes clear that it is designed to kick in only in extreme situations, when the plane is doing steep turns that put high stress on the airframe or when it’s flying at speeds so low it’s about to stall.
Management at Southwest Airlines told its pilots that Boeing did not include any description of MCAS in the flight manual because a pilot “should never see the operation of MCAS” in normal flying.
But in the extreme circumstances where it does activate, when the angle of attack hits the range of 10 to 12 degrees, the system rotates the horizontal tail so as to pitch the nose down. And if the high angle of attack persists, the system repeats the command every 10 seconds.
Fehrm said Boeing must have added this system on the MAX because when the angle of attack is high this model is less stable compared to prior 737 variants. That’s because the MAX has bigger, heavier engines that are also cantilevered further forward on the wing to provide more ground clearance. That changes the center of gravity.
The scenario feared in the Lion Air case is that the AOA sensor sent false signals that fooled the computer into thinking the plane was in a dangerous stall position, and so MCAS was triggered.
What happened next is crucial.
Any pilot’s natural reaction when a plane’s nose begins to tilt down uncommanded is to pull back on the yoke and raise the nose. In normal flight mode, that would work, because pulling back on the yoke triggers breakout switches that stop any automatic tail movement tending to move the nose of the plane down.
But with the MCAS activated, said Fehrm, those breakout switches wouldn’t work. MCAS assumes the yoke is already aggressively pulled back and won’t allow further pullback to counter its action, which is to hold the nose down.
Fehrm’s analysis is confirmed in the instructions Boeing sent to pilots last weekend. The bulletin sent to American Airlines pilots emphasizes that pulling back the control column will not stop the action.
Fehrm said that the Lion Air pilots would have trained on 737 simulators and would have learned over many years of experience that pulling back on the yoke stops any automatic tail maneuvers pushing the nose down.
“It fits in your feel memory,” said Fehrm of this physical way of learning. But on the Lion Air flight, if MCAS was active because of a faulty sensor, the pilots would have pulled back and found the downward nose movement didn’t stop.
Fehrm is convinced this led to confusion in the cockpit that contributed to the loss of control. There is a standard procedure to shut off any automatic pitch control, but somehow the pilots didn’t recognize that’s what was happening.
“MCAS had the wrong information and they reacted to that.,” he said. “MCAS is to blame.”
However, he cautions that there’s not enough information yet to know that the single AOA sensor failure triggered everything that happened, and that the entire sequence of events that led to the disaster won’t be clear until the investigation is completed. “It may not be as simple as a single sensor,” he said.
Heartfelt at Boeing
In the meantime, Fehrm said that the worldwide notification to pilots about MCAS and the re-emphasizing of the procedure to follow if the nose trim goes wrong, means that the MAX is today perfectly safe to fly.
“Boeing is correct. If you follow this drill, you are fine,” he said. “Pilots will hit those cut-off switches faster than you can blink.”
In Seattle this week, about 400 aviation professionals from around the world gathered for the annual International Air Safety Summit organized by the Flight Safety Foundation (FSF).
When FSF board chairman John Hamilton, who is vice president of engineering at Boeing Commercial Airplanes and formerly chief project engineer for the 737, gave an opening address Monday, he recalled his own personal experience of deep dread over a plane accident and used it to emphasize how people at Boeing react.
Hamilton’s wife is an Alaska Airlines flight attendant who on Jan. 31, 2000, was flying out of Puerto Vallarta in Mexico. When Hamilton heard that Flight 261 out of that city and bound for Seattle had crashed, he feared she was among the 88 killed. He found out later she was on a different flight.
But after his personal relief, he said he saw how that accident reverberated through Seattle and the aviation community.
“What we do every day matters. The work we do touches so many lives,” said Hamilton. “Everybody at Boeing … is deeply saddened by the loss of Lion Air Flight 610.”
He recalled that when he headed engineering on the 737 program, “I was the one person ultimately responsible for the safety of that product,” he said. “Every decision I made, I had to think through carefully and deliberately, since so many lives are dependent on that outcome.”
He said that Boeing together with safety regulators will investigate the Lion Air crash minutely and “learn what we can do to make sure it never happens again.”
This story was originally published Nov. 14, 2018, and corrected the next day. The previous version of this story spelled Bjorn Fehrm’s last name incorrectly.