A Pilot’s Inside View Of Boeing’s MAX Response

“We were a little slow to take responsibility,” said Dennis Muilenburg, President and CEO for Boeing, at a two-day meetup between Boeing’s executives and a handful of industry influencers from across the globe I attended last week in Seattle.

Aircraft crashes rarely create mass panic. As rare as they have become, we still understand that accidents happen. The Boeing 737 MAX crashes were different. Members of the industry and the public instinctively understood something was awry—same operational phase, same aircraft, same pre-accident path, and same outcome.

To make matters worse, initial accident data revealed the treacherous role of a feature that was unknown to most before the first crash and barely explained before the second—MCAS, for Maneuvering Characteristics Augmentation System. Yet, Boeing and some authorities kept insisting that the aircraft was safe and should continue to fly until they got more data about what went wrong.

Can you imagine the authorities waiting for additional data before grounding more than 4000 aircraft after the second airplane crashed into the New York World Trade Center on Sept. 11, 2001?

Boeing and anyone else claiming “no problem” came across as out-of-touch with reality, deceitful and unconcerned with safety. The result is deep distrust.

Cheng Chi, a 737 pilot for XiamenAir who traveled from China to attend, mentioned that 70 to 80 percent of new Chinese pilots would prefer to fly an Airbus, if given a choice. Henry Harteveldt, principal at the Atmosphere Research Group, said that his group conducted research showing that less than 20 percent of airline passengers would definitely fly on the aircraft within six months of its return to service.

Boeing is aware and eager to tell its side of the MAX story but finds it hard to be heard after it lost much of its credibility. That is why its executives decided to reach out to us. Updating us on their efforts to improve the 737 MAX, return it to service, enhance its customer-care, reinvigorate its safety and quality culture, and regain public and industry’s trust seemed less their goal during the event than listening to what we had to say and ask.

As Muilenburg spoke, it became apparent that Boeing, as an organization, has a poignant sense of loss. When recalling his conversations with the family members of the deceased, he became visibly emotional, a far departure from his steely, stiff-upper-lip TV persona. “We take full responsibility,” he repeated several times. “We are sorry.”

Putting actions to words, Boeing has spent the last nine months examining what went wrong at multiple levels and taken steps to address it. It recently created a new Product and Services Safety organization tasked to unify safety-related responsibilities currently managed by teams across several Boeing business and operating units.

Furthermore, it is planning to expose its worldwide network of new and existing employees to the Everett-based Safety Promotion Center it set up a few years ago to foster a deep sense of awareness and responsibility among them. On the manufacturing side, employees have taken advantage of the reduced manufacturing workload to restructure and streamline the manufacturing processes.

So here we are, at the nine-month mark since the global grounding of the 737 MAX fleet. Snow is beginning to fall on the newly manufactured aircraft sitting in Moses Lake, Washington. As I write this, the MAX e-cab simulator equipped with the revised MCAS software and new cockpit warnings is humming with pilot workload CS25.1302 evaluations required for certification.

Recently revealed exchanges between officials suggested “no MCAS” as a way to return the aircraft to flight. That is not going to happen. Without MCAS, the 737 MAX cannot comply with Part 25 Certification Standards. More critically, without MCAS, the MAX is easier to stall inadvertently when the autopilot is off.

Initially, Boeing test pilots noticed that the need for back pressure to increase the pitch lessened—or the pitching rate increased despite incremental back pressure input—when hand flying approaches to accelerated stalls with the flaps up, especially with aft CG loading. Upon further testing, they noticed that the aircraft displayed similar, although less prominent, tendencies during approaches to unaccelerated stalls.

While this peculiar behavior observable on the pitch rate recording graph of the Boeing e-cab simulator points to a deteriorating lift-weight moment when approaching stalls, the aircraft continues to display positive longitudinal stability according to Craig Bomben, Boeing’s chief pilot, and will not pitch up on its own. It simply becomes less resistant to pitching up when nearing the stall angle of attack in specific aircraft configurations.

Part 25 regulations, not a need for feel similarity with the 737 NG, require a linear displacement for a given control force input to maintain handling predictability. For example, 10 pounds of back pressure yields 1 degree per minute of pitch change and 20 pounds yields 2. Thirty pounds for 3.5 or 30 pounds for 2.5 would disrupt the expectation and become unacceptable.

The role of MCAS is to adjust the stabilator as needed to restore the missing control resistance. The amount of trim applied varied between 0 and 2.5 originally and will continue to do so in the revised version as it stands today.

MCAS does serve a safety purpose. It helps pilots avoid over-controlling the aircraft into a full stall. That is why MCAS is here to stay and why flying the aircraft as it is currently built without MCAS would not be wise.

For the accident aircraft though, MCAS became a liability. The maximum trim down option (2.5 or half scale) was supposed to apply only when the aircraft was nearing a stall at extremely high angle of attack and low speed. However, the accident aircraft were flying at normal speed for the phase of flight when MCAS activated due to faulty sensor readings rendering the MCAS trim correction aerodynamically significant. The ensuing MCAS corrections meant to address the potential for secondary stalls aggravated the initial event.

Somehow, it seems that Boeing failed to consider this scenario in the original MCAS design—and nobody else caught it during the certification process. Most of the changes in the updated software version address the potential for erroneous MCAS triggers.

The new MCAS software will compare the data from both sensors, a feature that would have prevented the Lion Air crash. It will ignore sudden and near instantaneous dramatic increases in angle-of-attack values, a feature that would have prevented the Ethiopian Airlines crash. It will serve only one correction per excessive angle-of-attack trigger event, a feature that would have allowed both crews more time to troubleshoot while flying level instead of being repeatedly challenged by additional erroneous MCAS corrections.

Never fly the airplane with the trim. I am sure that every pilot remembers this basic pilot training mantra. Previous 737 design assumed that pilots would react to an unexpected pitch down moment the way they always had. They would pull back on the control column. Thus, all 737s, except for the 737 MAX, have a trim stop switch that interrupts a runaway trim event when pilots pull back the control column. MAX pilots should instead use electric trim to counter an undesired trim movement before shutting down the electric trim functionality with the Stab Trim Cutout, when appropriate. 

It should come as no surprise, then, that the Ethiopian Airlines crew choose to reestablish electrical trim functionality when they realized that they were unable to trim manually after shutting down the electric trim system as instructed in the Boeing procedure published after the Lion Air crash.

“We do not blame the pilots,” said Muilenburg. Nobody should. Given the scope of changes to the software, cockpit indications and training developed by Boeing in the aftermath, it is clear that erroneous MCAS activation was a confusing, treacherous and serious challenge to be met with a unique, precise and timely set of actions to avoid excessive tail loading and related control issues.

Proper knowledge and prior exposure in simulators equipped with MCAS functionality—something no commercial B737 Max simulators had at the time of the accidents—were essential to give 737 MAX pilots the tools they needed to handle erroneous MCAS activation. The accident crews did not have it.

Boeing appears committed to provide extensive levels of information and support to its customers and the public prior to return to service.

A fleet of Max simulators will be available. In addition, Boeing is aiming to adapt 737 NG simulators to simulate the MAX for airlines who already own 737 NG simulators and who are operating both types of aircraft. 

Back in March, I was halfway through my training to become an independent Air Canada 737 MAX instructor. I did complete all the ground-training modules, including the module about MCAS added after the Lion Air crash. The thoroughness and quality of the proposed MCAS training module Boeing allowed us to see this week is certainly far superior to the hurried and succinct details released in response to the first crash that left us with more questions than answers.

During the initial certification process, Boeing and the certification authorities overlooked potential scenarios. Murphy ’s Law applied. It is highly unlikely to happen the second time around. If the 737 MAX receives certification to fly again, it will be a sound aircraft and will come equipped with pilots trained to manage its caveats safely.

Mireille Goyer is a passionate aviation enthusiast, an airline transport pilot, a training expert, an author and an award-winning diversity and inclusion advocate. She has been an active member of the global pilot community since 1990.