Boeing CEO Dennis Muilenburg issued an astonishing mea culpa on behalf of his company after a report by Ethiopian air crash investigators added to the pressure on Boeing to prove that they have truly understood and fixed flaws in the flight control system of their new 737 MAX series of jets.
On the heels of a previously anonymous company statement, Muilenburg said, “The history of our industry shows most accidents are caused by a chain of events. This again is the case here, and we know we can break one of those chain links in these two accidents. As pilots have told us, erroneous activation of the MCAS function can add to what is already a high workload environment. It’s our responsibility to eliminate this risk. We own it and we know how to do it.”
In a preliminary report on the crash of Ethiopian Airlines flight 302 on March 10 that killed 157 people, the investigators said that the pilots had followed recommended emergency procedures, but their efforts were overpowered by Boeing’s rogue Maneuvering Characteristics Augmentation System (MCAS) that repeatedly forced down the airplane’s nose.
ADVERTISEMENT
The report leaves no doubt that the Ethiopian flight was doomed by the MCAS system in exactly the same way that Lion Air Flight 610 was brought down last October over Indonesia. The Lion Air pilots, like the Ethiopian pilots, desperately tried to regain manual control of the airplane during the early ascent but the MCAS system repeatedly countered their efforts.
The two crashes have taken a total of 346 lives. There is no precedent in recent aviation history for a new model jet to have two catastrophic crashes within five months apparently caused by the same flaw.
After Lion Air, Boeing presented the problem as one of training the pilots: If the pilots were trained to respond to a problem with the controls, they could deal with it. Boeing did not concede that the primary problem was technical, a faulty sensor reacting with the MCAS, and not human error.
If they had acknowledged that the problem lay with the airplane, not the pilots, the entire fleet would probably have been grounded, as it eventually was. Instead, Boeing implied–amazingly–that even with the problem left unfixed, the airplane remained safe to fly.
This complacency was shattered when the Ethiopian pilots followed Boeing’s procedure and still the airplane nosedived to oblivion.
The comments from the Ethiopian authorities underline the failure of both Boeing and safety regulators to understand and respond to the seriousness of what the Lion Air crash had disclosed: That a faulty sensor feeding data to the MCAS system had switched control of the most powerful control surface on the airplane, the horizontal stabilizer, from the pilots to the computers.
The timeline of how Boeing and Federal Aviation Administration (FAA) safety inspectors responded to the Lion Air crash now looks increasingly damning.
On February 7, some three months after the crash, Boeing presented a bunch of proposed changes to the MCAS system to the European Aviation Safety Agency. Under bilateral arrangements between the FAA and EASA, all safety certification steps are normally taken together.
And on March 7–three days before the Ethiopian crash–Boeing took what they believed would be the final step, issuing for approval new pilot training procedures for the MAX-8 that would include an understanding of the MCAS system and corresponding details of that system that were to be included in flight manuals. One of the most startling revelations that followed the Lion Air crash was that pilots had never been briefed on or trained for dealing with the MCAS system that was, essentially, contained in a few lines of new software.
At that point neither Boeing nor any safety regular had entertained the idea that the world fleet of MAX-8s, approximately 370 airplanes, should be grounded.
That all changed within two days of the Ethiopian crash. China, the largest operator of the MAX-8, unilaterally grounded its fleet. Soon after, the rest of Asia, then Europe and Canada, followed.
That was in stark contrast to the FAA’s first response on the day after the Ethiopian crash when they announced, “Our review shows no systemic performance issues and provides no basis to order the grounding of the aircraft.”
Boeing echoed that statement.
And that makes it even more remarkable that this week the FAA stated that the grounding would be unexpectedly prolonged because Boeing’s latest proposed fixes had not satisfied a panel of safety inspectors and needed “additional work.”
In a separate statement Boeing said, “We are working to demonstrate that we have identified and appropriately addressed all certification requirements and will be submitting for FAA review once completed in the coming weeks.”
One feature of the proposed fixes that is already known focuses on the sensors that measure the airplane’s angle of attack–the angle at which the airplane pitches up or down from its level flightpath.
These sensors are a comparatively simple instrument–they protrude like short tubes from the nose of the airplane. This position makes them vulnerable to both accidental impacts while lining up with an airport gate or from bird strikes. That is one reason why regular maintenance checks should be made of them.
But Boeing’s fix for preventing a sensor from triggering the MCAS system via false data readings–in other words, indicating the approach of a dangerously high angle of attack and prompting it to correct it by pitching down the nose–is to equip every MAX-8 with a second sensor.
If one sensor is flawed, a “disagree” light in the cockpit would warn pilots of the problem.
However Airbus equips its rival to the 737, the Airbus A320, with three sensors and even that did not prevent a fatal crash.
In November 2008 a seven-man crew was flight testing an A320 owned by Air New Zealand over southwestern France. During a landing approach over water the Airbus went into a slow-speed aerodynamic stall. The nose pitched up by 57 degrees and it plunged into the Mediterranean, killing all on board.
An investigation found that the sensors had been damaged before the flight when the airplane was washed with powerful water jets. One sensor had provided the pilots with correct data and the other two were feeding false data. The flight control computers accepted the majority false readings and rejected the correct one.
