737 Max de­sign had a late change, fa­tal flaws


The fa­tal flaws with Boe­ing’s 737 Max can be traced to a break­down late in the plane’s de­vel­op­ment, when test pi­lots, engi­neers and reg­u­la­tors were left in the dark about a fun­da­men­tal over­haul to an au­to­mated sys­tem that would ul­ti­mately play a role in two deadly crashes.

A year be­fore the plane was fin­ished, Boe­ing made the sys­tem more ag­gres­sive and riskier. While the orig­i­nal ver­sion re­lied on data from at least two types of sen­sors, the ul­ti­mate used just one, leav­ing the sys­tem with­out a crit­i­cal safe­guard. In both doomed flights, pi­lots strug­gled as a sin­gle dam­aged sen­sor sent the planes into ir­recov­er­able nose-dives within min­utes.

But many peo­ple in­volved in build­ing, test­ing and ap­prov­ing the sys­tem, known as MCAS, said they hadn’t fully un­der­stood the changes. Cur­rent and for­mer em­ploy­ees at Boe­ing and the Fed­eral Avi­a­tion Ad­min­is­tra­tion who spoke with The New York Times said they had as­sumed the sys­tem re­lied on more sen­sors and would rarely, if ever, ac­ti­vate. Based on those mis­guided as­sump­tions, many made crit­i­cal de­ci­sions, af­fect­ing de­sign, cer­ti­fi­ca­tion and train­ing.

“It doesn’t make any sense,” said a for­mer test pi­lot who worked on the Max. “I wish I had the full story.”

While pros­e­cu­tors and law­mak­ers try to piece to­gether what went wrong, the cur­rent and for­mer em­ploy­ees point to the sin­gle, fate­ful de­ci­sion to change the sys­tem, which led to a se­ries of de­sign mis­takes and reg­u­la­tory over­sights. As Boe­ing rushed to get the plane done, many of the em­ploy­ees de­scribed a com­part­men­tal­ized ap­proach, each fo­cus­ing on a small part of the plane. The process left them with­out a com­plete view of a crit­i­cal and ul­ti­mately dan­ger­ous sys­tem.

The com­pany also played down the scope of the sys­tem to reg­u­la­tors. Boe­ing never dis­closed the re­vamp of MCAS to FAA of­fi­cials in­volved in de­ter­min­ing pi­lot train­ing needs, ac­cord­ing to three agency of­fi­cials. As a re­sult, most Max pi­lots did not know about the soft­ware un­til af­ter the first crash, in Oc­to­ber.

“Boe­ing has no higher pri­or­ity than the safety of the fly­ing pub­lic,” a com­pany spokesman, Gor­don John­droe, said in a state­ment. “The FAA con­sid­ered the fi­nal con­fig­u­ra­tion and op­er­at­ing pa­ram­e­ters of MCAS dur­ing Max cer­ti­fi­ca­tion, and con­cluded that it met all cer­ti­fi­ca­tion and reg­u­la­tory re­quire­ments.”

At first, MCAS – Ma­neu­ver­ing Char­ac­ter­is­tics Aug­men­ta­tion Sys­tem – wasn’t a very risky piece of soft­ware. The sys­tem would trig­ger only in rare con­di­tions, nudg­ing down the nose of the plane to make the Max han­dle more smoothly dur­ing high­speed moves. And it re­lied on data from mul­ti­ple sen­sors mea­sur­ing the plane’s ac­cel­er­a­tion and its an­gle to the wind, help­ing to en­sure that the soft­ware didn’t ac­ti­vate er­ro­neously.

Then Boe­ing engi­neers recon­ceived the sys­tem, ex­pand­ing its role to avoid stalls in all types of sit­u­a­tions. They al­lowed the soft­ware to op­er­ate through­out much more of the flight. They en­abled it to ag­gres­sively push down the nose of the plane. And they used only data about the plane’s an­gle, re­mov­ing some of the safe­guards.

A test pi­lot who orig­i­nally ad­vo­cated for the ex­pan­sion of the sys­tem didn’t un­der­stand how the changes af­fected its safety. Safety an­a­lysts said they would have acted dif­fer­ently if they had known it used just one sen­sor. Reg­u­la­tors didn’t con­duct a for­mal safety as­sess­ment of the new ver­sion of MCAS.

The cur­rent and for­mer em­ploy­ees, many of whom spoke on the con­di­tion of anonymity, said that af­ter the first crash, they were stunned to dis­cover MCAS re­lied on a sin­gle sen­sor.

“It seems like some­body didn’t un­der­stand what they were do­ing,” said an en­gi­neer who as­sessed the sys­tem’s sen­sors.


In 2012, the chief test pi­lot for the Max had a prob­lem. Dur­ing the early de­vel­op­ment of the 737 Max, Ray Craig, a re­tired Navy air­man, was try­ing out high-speed sit­u­a­tions on a flight sim­u­la­tor.

But the plane wasn’t fly­ing smoothly, partly be­cause of the Max’s big­ger en­gines. To fix the is­sue, Boe­ing de­cided to use a piece of soft­ware. The sys­tem was meant to work in the back­ground, so pi­lots ef­fec­tively wouldn’t know it was there.

To en­sure it didn’t mis­fire, engi­neers ini­tially de­signed MCAS to trig­ger when the plane ex­ceeded at least two sep­a­rate thresh­olds, ac­cord­ing to three peo­ple who worked on the 737 Max. One in­volved the plane’s an­gle to the wind, and the other in­volved G-force, or the force on the plane that typ­i­cally comes from ac­cel­er­at­ing.

The Max would need to hit an ex­ceed­ingly high G-force that pas­sen­ger planes would prob­a­bly never ex­pe­ri­ence. For the jet’s an­gle, the sys­tem took data from the an­gleof-at­tack sen­sor. The sen­sor, sev­eral inches long, is es­sen­tially a small wind vane af­fixed to the jet’s fuse­lage.


In late Jan­uary 2016, the first Max lifted off for its maiden test flight.

“The 737 Max just felt right in flight, giv­ing us com­plete con­fi­dence that this airplane will meet our cus­tomers’ ex­pec­ta­tions,” Ed Wil­son, the new chief test pi­lot for the Max, said in a news re­lease at the time. Wil­son had re­placed Craig the pre­vi­ous year.

But a few weeks later, Wil­son and his co-pi­lot be­gan notic­ing that some­thing was off, ac­cord­ing to a per­son with direct knowl­edge of the flights. The Max wasn’t han­dling well when near­ing stalls at low speeds.

Wil­son told engi­neers that the is­sue would need to be fixed. He and his co-pi­lot pro­posed MCAS, the per­son said.

The change didn’t elicit much de­bate. It was con­sid­ered “a run-of-the-mill ad­just­ment,” ac­cord­ing to the per­son.

The change proved piv­otal. Ex­pand­ing the use of MCAS to lower-speed sit­u­a­tions re­quired re­mov­ing the G-force thresh­old. MCAS now needed to work at low speeds so G-force didn’t ap­ply.

The change meant that a sin­gle an­gle-of-at­tack sen­sor was the lone guard against a mis­fire. Al­though mod­ern 737 jets have two an­gle-of-at­tack sen­sors, the fi­nal ver­sion of MCAS took data from just one.

Us­ing MCAS at lower speeds also re­quired in­creas­ing the power of the sys­tem.

The FAA had al­ready ap­proved the pre­vi­ous ver­sion of MCAS. And the agency’s rules didn’t re­quire it to take a sec­ond look be­cause the changes didn’t af­fect how the plane op­er­ated in ex­treme sit­u­a­tions.

On March 30, 2016, Mark Forkner, the Max’s chief tech­ni­cal pi­lot, sent an email to se­nior FAA of­fi­cials with a seem­ingly in­nocu­ous re­quest: Would it be OK to re­move MCAS from the pi­lot’s man­ual?

The of­fi­cials, who helped deter­mine pi­lot train­ing needs, had been briefed on the orig­i­nal ver­sion of MCAS months ear­lier. Forkner and Boe­ing never men­tioned to them that MCAS was in the midst of an over­haul, ac­cord­ing to the three FAA of­fi­cials.

Un­der the im­pres­sion that the sys­tem was rel­a­tively be­nign and rarely used, the FAA ap­proved Forkner’s re­quest, the three of­fi­cials said.


Boe­ing’s 737 Max 8 planes are worked on Wed­nes­day in Ren­ton, Wash. More de­tails of a de­sign change sus­pected in the Max 8’s prob­lems are emerg­ing.

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.