Did Boeing’s new 737 jet draw enough scrutiny from regulators?
Questions raised about safety certification process in Canada, U.S. in wake of deadly crashes
OTTAWA— As Canadian airlines prepared to launch service with the Boeing 737 Max jet in 2017, Transport Canada officials considered what pilots needed to know about the new jet.
After evaluation sessions with U.S. and European counterparts, they noted some key design differences from earlier versions of the popular twin jet, such as a new landing gear lever, cockpit displays, air conditioning and anti-ice systems, that should be flagged to pilots moving up from other 737 models.
They said training should place special emphasis on flap settings for aborted landings, automated landings and the functions of the flight management system, among other areas.
Yet some of these differences were actually compiled by Boeing and “validated” by Transport Canada. Nowhere is there any mention of the jet’s “manoeuvring characteristics augmentation system,” or MCAS.
The new system is meant to protect the latest 737 variant from dangerous excursions outside the normal flight envelope.
Now it’s suspected as the potential cause of two crashes — those of Lion Air Flight 610 last October, and Ethiopian Airlines Flight 302 this month — that together killed 346 people.
The 737 Max has been grounded and the race is on to pinpoint the cause and find a fix. There are questions about the certification process in both Canada and the U.S. about how a piece of software powerful enough to drive a jet into the ground seemingly missed the scrutiny of regulators.
The latest crash has prompted other questions, too, about the interaction of pilots and automation, and the experience levels of pilots. The Boeing 737 Max models are the latest designs of the world’s most popular commercial jet. With 41 of the jets already delivered to three Canadian airlines — Sunwing, WestJet and Air Canada — and almost 80 more on order, it’s poised to become a mainstay of their fleets for the coming years.
But in engineering the Max model, Boeing ran into a challenge. Its larger engines and their placement on the wings changed the pitch characteristics.
To compensate, Boeing installed the manoeuvring characteristics augmentation system to decrease the tendency of the plane to pitch up, which could risk an aerodynamic stall. That’s when the wings lose the airflow needed to lift the plane.
The system is not supposed to operate in normal flight; it would kick in only if the jet was being manually flown at a high angle of attack. Then it would automatically move the horizontal stabilizer, the smaller surfaces on either side of the tail, to pitch the nose down to avoid the possibility of a stall. The Seattle Times has reported that the U.S. Federal Aviation Administration (FAA) delegated the safety analysis of the system to Boeing. According to the newspaper, that analysis — which was shared with other regulators, including Transport Canada — understated the authority of the system to pitch the nose down. In fact, it could defy the efforts of pilots to level the plane from an unintended descent.
Because it’s built by U.S.-based Boeing, the FAA was responsible for certifying the aircraft as safe to fly. Under a bilateral agreement, Transport Canada accepted that certification.
Based on the evaluation of Transport Canada officials — who travelled to Miami and Seattle in 2017 to examine training for 737 Max pilots — it doesn’t appear the system was flagged as a significant difference from earlier designs. And there was no reason for the Canadian authorities to go looking for potential problems, according to one pilot familiar with the certification process.
“If the FAA certifies something, then Transport Canada accepts it. That’s the deal and vice versa,” said the pilot who was not authorized by his employer to speak publicly on the issue.
“It’s not a recertification of the aircraft. It’s a validation. They’re going based on the information that the FAA pro- vides, the information that Boeing provides,” he said.
“They’re going through a routine validation check … They’re not going into systems design, does it meet safety standards, all that kind of stuff. They’re already given the information that it does and they don’t go looking for problems,” he said.
When the pilots of Lion Air Flight 610, a nearly new Boeing 737 Max, lined up for takeoff at Jakarta airport on Oct. 29, little did they know they were about to become test pilots, struggling with an emergency in a system they apparently knew nothing about.
Immediately after takeoff, the pilots faced a tug-of-war as MCAS pushed the nose down and they tried to pull it back it up. The first officer told the air traffic controller they had a “flight control problem,” according to a preliminary report.
The system thought the plane was in stall. But it wasn’t. Instead, it’s believed that a faulty angle-of-attack sensor was feeding erroneous data to the MCAS that in turn triggered incorrect commands to pitch the nose down.
For the few minutes the plane was airborne, the pilots were locked in a back-and-forth struggle as they desperately tried to decipher what was wrong. They never did. The aircraft plunged into the Java Sea, killing all 189 people on board.
“Unfortunately, the pilot lost that fight with the software,” Canada’s Transport Minister Marc Garneau said of the crash.
In the wake of the Lion Air accident, the FAA issued an emergency directive that erroneous data could cause “repeated nose-down trim commands of the horizontal stabilizer.” It issued revised procedures to deal with the problem.
But Transport Canada, in consultation with the three airlines that fly the aircraft in Canada, went further. The department mandated changes in Novem- ber that required Canadian pilots to memorize the steps needed to disable the automated trim system, if required, rather than rely on a checklist.
“The reality is if this MCAS problem occurs … you have very little time to react. And so our procedures were put in place so that the pilots had to memorize the exact sequence of things,” Garneau told reporters.
However, the preliminary lessons of the Lion Air crash did not appear to be any help for the pilots of Ethiopian Airlines Flight 302. The brand-new 737 Max crashed soon after takeoff from Addis Ababa on March 10, killing 157 passengers and crew, including 18 Canadians.
Coming less than five months after the Lion Air accident, the crash rattled airlines, passengers and regulators who moved fast to ground the aircraft. Canada followed suit on March 13 after receiving satellite data that showed telltale similarities in the erratic flight paths between the two flights. “The airplane tends to oscillate in this conflict between the software and the pilot,” Garneau said.
There had been other close calls. The pilots of a Lion Air flight on the same aircraft the previous day had also experienced nose-down pitching but had been able to disable automated movement of the horizontal stabilizer. American pilots had filed several safety reports flagging unexplained nose-down incidents in the aircraft.
In one report, an American pilot said the flight manual was “inadequate and almost criminally insufficient” for not in- cluding any mention of the system.
“It is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models,” the pilot wrote to the U.S. aviation safety reporting system.
Barry Wiszniowski, an aviation safety expert and captain with a major Canadian airline, said the two crashes coming so close and involving a new design raise critical questions around aviation safety, much as the crashes of the British-designed Comet did at the start of the jet age. These include government oversight of aircraft manufacturers at a time when regulators are losing skilled personnel and the experience levels among new hires at foreign airlines.
The first officer on the Ethiopian Airlines flight reportedly had just several hundred hours of flying time. Air Canada and WestJet, by comparison, typically require new pilots to have a minimum of 2,000 hours to get hired.
A pilot with less flying experience usually depends more on automation and is less familiar with the intricacies of the jet. “If you have 300 hours, you’re still learning the aircraft … so your level of automation dependency may be higher because maybe the skills aren’t there yet,” Wiszniowski said.
“It takes a long time to learn an airplane,” he said.
The investigations into both accidents continue. There’s been no cause yet determined for either crash, nor even a definitive link established between the two.
In the meantime, Boeing says it expects to release changes in the coming weeks to the pilot displays, manuals, training and the MCAS software itself to limit the system’s authority to pitch the plane downwards.
“We’re taking actions to fully ensure the safety of the 737 Max,” Dennis Mullenburg, the chair, president and CEO of Boeing, wrote in the letter posted on the company’s website.
With a backlog of 4,636 orders for the Max 737, the economic stakes are huge for Boeing. It faces the daunting tasks of fixing the problem and restoring the confidence of the travelling public.
But the stakes are high, too, for the regulators, like Transport Canada and the FAA, as they reassess their relationships with manufacturers. The U.S. Department of Transportation has asked the agency’s watchdog to audit the FAA’s certification of the Max.
Sully Sullenberger, the airline captain who famously landed an Airbus jet in the Hudson River after it lost its engines in a bird strike, says the work of validating and approving aircraft certification has been “outsourced” to the manufacturers themselves, creating “inherent conflicts of interest.”
“There is too cosy a relationship between the industry and the regulators,” he wrote in a commentary.
In Canada, Garneau said his department is taking another look at its 2017 validation of the certification done by the FAA. “We’re doing this as, I think, a prudent measure to re-examine the entire certification,” he said.
He declined to say whether he was concerned that Boeing may have had undue influence on the process.
It’s not likely to be an easy or quick road back for the 737 Max. Air Canada expects the jets to be grounded until July.
“I think these aircraft are probably on the ground for while,” the veteran pilot told the Star. “I don’t think anybody in the industry … is going to be rushing to get back in the air without an abundance of caution.”
“There is too cosy a relationship between the industry and the regulators.” SULLY SULLENBERGER ‘HERO ON THE HUDSON’