The 737 runs out of runway
No patch can fix the flaws that caused this plane to crash. It should never fly again
The Paris Air Show next week is the most important sales event of the year for the world’s aircraft makers. But the talk won’t be dominated, as usual, by who’s selling the most planes.
Industry officials gathered in Paris will instead speculate on wrenching changes to global aviation made necessary by Boeing Co.’s ill-conceived 737 Max, and the questionable decisions of regulators and airlines in believing it was safe to fly.
The global fleet of 737 Max, numbering 393 aircraft, has been grounded since March, after the second of two fatal crashes, of the new aircraft within two years of its first entering commercial service.
The two crashes claimed the lives of all aboard each aircraft – a total of 346 fatalities, including 18 Canadians.
One crash of a new flagship airliner in commercial service is rare. Two crashes are unimaginable.
Boeing and its chief regulator, the U.S. Federal Aviation Administration, are under investigation on Capitol Hill. U.S. legislators want to know why Boeing built a faulty plane, and why the FAA certified the 737 Max as safe to fly.
Boeing denies allegations of improper conduct, and says its culture of safety is among the best in the world. And “when the Max returns to the skies,” Boeing CEO Dennis Muilenberg said in April, it will be “as safe as any airplane ever to fly.”
But the accident investigations — at the crash sites, in legislative testimony, and at the 737 Max assembly plant near Seattle — have revealed grievous faults in global aviation.
What the faults amount to is that the global industry and the passengers it serves have become overly reliant on the duopoly of Boeing and Airbus SE in the supply of large commercial airliners; on an industry-friendly regulator (FAA); and on one aircraft type, the aging 737 family, of which the Max is the fourth generation.
To see why that is so requires a brief review of events.
In 2011, Boeing chose to modify a then 44-year-old 737 over the costlier and more time-consuming option of designing a new “clean-sheet” aircraft from scratch.
“We all rolled our eyes, the idea that ‘Here we go, the 737 again,’” Rick Ludtke, a former Boeing engineer who worked on the 737 Max’s cockpit design, told the New York Times in April.
“Nobody was quite perhaps willing to say it was unsafe, but we really felt like the limits were being bumped up against.”
Boeing was bumping up against the fundamental aerodynamics of the 737. It gave the Max larger engines, to provide greater fuel efficiency and longer range. But Boeing insisted on retaining the 737’s low-slung profile, popular with airline buyers because it made the plane easy to unload and resupply.
That meant, however, that the Max’s larger engines would have to mounted further forward on the wings to achieve ground clearance. And that, in turn, gave the Max a tendency to fly with its nose too high in the air, risking an irrecoverable stall, in which the plane crashes.
Boeing engineers conceived a software patch that automatically corrected for the nose-up tendency, called MCAS (Manoeuvring Characteristics Augmentation System).
But in the two crashes, in October and March, the MCAS system failed. Acting on erroneous data fed to it by a malfunctioning angle-of-attack sensor (AOA), which monitors the plane’s angle of climb or descent, the MCAS mistakenly believed the planes’ noses were too high.
The MCAS repeatedly forced the planes’ noses down soon after takeoff, just when they needed to instead to climb to gain altitude.
The pilots in the two crashes had not been trained on the MCAS and did not even know it existed. And so, they were unable to wrest control of their aircraft from an MCAS that had gone “haywire.”
As Marc Garneau, the Canadian transport minister and former astronaut, later said of the March 10 crash of Ethiopian Airlines Flight 302: “The pilots lost their battle with the technology.”
Boeing has since developed a software fix for the MCAS – a patch on a patch, as it were – to take data from two, rather than just one, angle-of-attack sensor.
A question for investigators is why Boeing designed the original MCAS to rely on just one sensor, and why the FAA approved that. Sensors and other externally mounted devices are vulnerable to bird strikes, scrapes with equipment at airport terminals, and other damage.
An FAA that is under investigation for why it certified the original Max is dragging its heels in certifying Boeing’s re-engineered MCAS software fix.
At Boeing’s annual meeting in April, Muilenburg declared, “We do not make safety features optional.”
But Boeing has more than one definition of safety, and so do regulators and airlines.
Some safety features are deemed essential. Others are “noncritical.”
Air Canada, the only North American carrier with its own flight simulator, bought two optional safety features for its 24 Max planes, deeming them essential. Calgary’s WestJet Airlines Ltd. was of the same mind, buying an optional safety feature it believes to be mission-critical.
But most cost-obsessed airlines bought none of the optional safety features, including operators of the fatal Lion Air and Ethiopian Airlines flights.
The standard equipment on previous 737s included an “AOA Alert” that warns pilots that one or more AOA sensors are malfunctioning. But on the 737 Max, that feature was ornamental, activated only with the purchase of an optional display.
The crash investigations are still underway, but have already concluded that a malfunctioning AOA sensor, feeding faulty data to the MCAS, caused the two planes to crash. There was no optional AOA Alert on those aircraft to warn of a malfunction.
The FAA tests new airplanes, but it did not test the MCAS. For the past decade, the U.S. agency has been outsourcing an ever-larger portion of its inspection work to the aircraft makers, which mostly means Boeing. U.S. lawmakers accuse the FAA of simply taking Boeing’s word on safety and quality issues.
The European Union’s aviation regulator overcame initial reservations it had about the 737 Max and effectively rubber-stamped the FAA’s certification. So did Transport Canada.
As to the airlines, which so far in this crisis have been spared criticism, they were enticed by Boeing’s promised cost savings with the 737 Max.
For instance, flight-simulator training, which can cost tens of millions of dollars over the life of an airplane, would not be required for Max pilots, Boeing said.
Such training wasn’t necessary, Boeing said, for pilots already experienced in flying the 737 family, since the Max flew the same way as previous generations of 737s did.
But at best, that was a shading of the truth, since previous 737s didn’t have a MCAS that could go haywire.
Most airlines chose not to inform their 737 Max pilots of the MCAS. Doing so might have triggered pilot demands for costly simulator training. And Boeing made only passing reference to MCAS in manuals. “MCAS should have been more thoroughly explained (to pilots),” Daniel Elwell, acting head of the FAA, testified to the U.S. Congress in May. But Elwell’s agency made no such requirement of Boeing and airlines in certifying the plane.
That chain of disastrous decision-making — at Boeing, the regulators and the airlines — suggests that profit has inordinate influence on aviation practices. So, what to do? Antitrust action to split up the Airbus-Boeing duopoly would mark an end to airlines having only the Max and the Airbus A320neo to choose from in the big market for narrow-body medium-haul flights. The FAA is compromised by its dual roles as an industryfriendly promoter of air travel and as an industry watchdog. The latter function could be handed to the U.S. National Transportation Safety Board (NTSB), with its superb record of global air-accident investigations and enhanced-safety recommendations.
Finally, the 737 family is due for retirement. In its basic design, the Max is unchanged from the original 737 that first went into service 52 years ago.
The 737, based on 1960s technology, is the only major aircraft type still using “fly-bycable” controls, an archaic system of wheels, pulleys, pneumatics and cables that requires pilots to perform multiple, manual functions.
Most of the world’s large jet airliners, including those made by Boeing, use “fly-by-wire,” the fully electronic system by which Chesley Sullenberger was able to land his Airbus in the Hudson River with an absolute minimum of instruction to his plane.
There is urgency here. The already crowded skies will soon become much more so. Global air travel is forecast to roughly double in 20 years, from a current 4.3 billion travellers, according to the International Air Transport Association.
And the accelerating pace of climate change promises challenging new flying conditions, for which aircraft makers, regulators and airlines appear unprepared. It’s difficult to think otherwise, given their dubious assessment of a known quantity like the latest variant of the 737, which has been in commercial service since Expo 67.