Boeing’s 737 Max updates have largely addressed concern about the aircraft’s flight control system, but broader risks involving pilot training and aircraft maintenance remain unresolved, say aviation safety specialists and commercial pilots.
Sources interviewed by FlightGlobal over several months say these significant operational risks were highlighted by the 737 Max accidents, but overshadowed by intense scrutiny of Boeing and its faults.
“There is a pilot training issue to the point that now the base foundation of pilot training is getting flawed,” says Chinar Shah, a 737 Max commander and training captain at Jet Airways, which stopped operations this year amid financial strain.
“[Airlines] are churning out pilots because of the shortage. The training footprints are becoming shorter and shorter,” says Shah.
Two former US National Transportation Safety Board experts think Indonesia’s Lion Air flight 610 crash report glosses over critical facts about Lion’s operation, driving an incomplete narrative.
“I think they have selectively filtered a lot of the information that should be in here,” former NTSB senior air safety investigator Greg Feith said during a 27 November podcast of Flight Safety Detectives, which he hosts with former NTSB member John Goglia.
“Maintenance… is where this whole accident sequence starts, two days before the accident,” Feith says.
Many pilots declined to talk on the record about the two 737 Max crashes due to the sensitive nature of the tragedies and ongoing investigations.
But, without downplaying Boeing’s responsibility, some say proper training should prepare pilots to address errant activation of the Max’s Maneuvering Characteristics Augmentation System (MCAS), which contributed to both accidents.
Others disagree, saying the crash scenarios would challenge any pilot. Pilots should not be expected to face the confusing circumstances that faulty MCAS activation can create. Accident investigators in Indonesia and the NTSB have faulted Boeing’s MCAS design and the US FAA oversight. Investigators have also called for more study of pilot-automation interaction.
MCAS
Boeing equipped the Max with MCAS to comply with regulations requiring opposing column force increase linearly as pilots pull back the column. The Max’s CFM International Leap-1B engines can make it pitch nose-up in certain high angle-of-attack scenarios, translating into relatively less column force. MCAS solves that problem by pitching the nose down when needed.
Triggered by faulty angle-of-attack data, MCAS put the Lion Air and Ethiopian Airlines aircraft, both 737 Max 8s, into dives from which the pilots did not recover. Lion Air flight 610 crashed in October 2018 and Ethiopian flight 302 crashed in March 2019, killing a combined 346 people.
The aircraft has since been grounded.
“While I firmly believe both accident aircraft were recoverable without loss of life, it was the very design of the Max’s MCAS system that unnecessarily put passenger and crew lives at risk,” says Michael Gerzanics, a 737 Max captain with a US airline, former US Air Force test pilot and FlightGlobal contributor.
Boeing took heat for not initially telling pilots more about MCAS, a decision it defended on grounds that MCAS failures appear like a runaway stabiliser, which pilots should address via the runaway stabiliser checklist.
Jet Airways captain Shah thinks an introductory MCAS course would have been useful. But she understands Boeing’s logic, calling knowledge of MCAS “good to know”, not “need to know”.
“The action required by the flight crew is the same as for the runaway stabiliser, which is taught to us from day one,” Shah says. “You would still do the same memory items… you follow the checklist.”
LION CRASH REPORT
The Lion Air crash report, released in October by Indonesia’s National Transportation Safety Committee (NTSC), pins significant responsibility on Boeing.
It faults Boeing’s MCAS design, including reliance on one angle-of-attack sensor, its assumptions about pilot responses and its lack of guidance to pilots. The NTSC urges the FAA to review certification processes, and it concludes Florida company Xtra Aerospace improperly calibrated the sensor that triggered MCAS.
It cites Lion Air maintenance concerns and crew co-ordination and cockpit management issues, which it attributes partly to cockpit warnings and other distractions.
Additionally, the report says the pilots of the flight prior to flight 610 filed an incomplete maintenance report. Those pilots also experienced MCAS activation.
Goglia thinks the NTSC’s conclusions paint an incomplete picture – one partly at odds with facts within the report.
“If you look at the factual data, it doesn’t line up with what the conclusions are,” he tells FlightGlobal. The conclusions are “grossly favourable” to Lion Air, he claimed during a 5 December podcast.
MAINTENANCE
The crashed Lion Air 737 Max had air data system problems as far back as 9 October, several weeks before the 29 October crash, according to the NTSC.
It then had repeated speed and altitude indication problems from 26 October until the crash, which engineers at various stations took steps to fix.
On 27 October, an engineer in Manado, Indonesia worked to address the speed and altitude indication problems. The next morning, the engineer met with the crew who were to take the aircraft to Denpasar, Indonesia that day. The crew “requested more be done to rectify the problem”, which they said occurred several times. The engineer suggested the problem might be better addressed in Denpasar.
On 28 October, in Denpasar, an engineer with Lion subsidiary Batam Aero Technic replaced the Max’s left angle-of-attack sensor. That sensor, which had a 21° error, trigged MCAS on two flights, the last being flight 610.
The NTSC says the engineer told them he had tested the sensor after installation, and that it passed. But proof does not exist because, contrary to Batam procedures, the engineer did not record test values, the report says.
The engineer gave investigators photographs to prove the test was completed. But investigators tossed the photos after determining they did not show the accident aircraft or were taken before the replacement sensor arrived.
Following the sensor replacement, Lion Air dispatched the Max on a flight from Denpasar to Jakarta, during which those pilots experienced numerous caution lights and MCAS activation. They eventually switched off MCAS using the runaway stabiliser procedure, and continued to Jakarta, the report says.
Upon arriving, the captain reported airspeed and altitude warnings in a maintenance log, but did not mention the stick shaker, the runaway stabiliser procedure or having to manually trim the aircraft, the report says. The incompleteness of the maintenance log violated requirements intended to ensure proper maintenance, says the NTSC.
The aircraft “never should have been in the air”, says Goglia. It simply had too many problems and Lion Air should have grounded it days before the crash, he says.
“I’m not letting Boeing off the hook, because they have dirty hands too,” Goglia adds.
“There was a continuing, cascading effect of problems with the airplane,” Feith says in his 27 November podcast. He describes engineers as “trying to milk this airplane to one of their larger maintenance bases”.
“It’s crazy that this airplane would… be returned to service like this,” Feith states.
LION FLIGHT 610
Lion Air 610 lifted off from Jakarta on 29 October, bound for the Indonesian city of Pangkal Pinang, the captain at the controls. The crew immediately received indicated airspeed disagree and altitude disagree warnings. The stick shaker activated.
Before MCAS even activated, the captain told the first officer to complete memory items for airspeed unreliable. Those steps are in the airspeed unreliable “non-normal checklist” in the pilots’ quick-reference handbook, according to the NTSC. Memory items should be performed as soon as possible, even before pilots consult the actual checklist.
The first officer did not respond to the captain’s initial request. The captain again asked the first officer to complete “memory item”.
The first officer, who had 5,175h of flight time, said he “was unable to locate the airspeed unreliable checklist”. About a minute later he found the checklist, but never completed it.
The airspeed unreliable checklist would not itself have addressed an MCAS activation, but the first officer’s difficultly shows he was “not familiar” with the non-normal checklist, concludes the NTSC. “The unfinished [checklist] made it difficult for the flight crew… to understand the aircraft problem and how to mitigate the problem.”
The report shows the first officer struggled with checklists during training. On one occasion he “missed identifying the non-normal checklist”. Other training notes cite “lack of situational awareness or judgement” and issues with workload management and focus, the report says.
“The reappearance of difficulty in aircraft handling, identified during training in the accident flight, indicated that the Lion Air training rehearsal was not effective,” the NTSC concludes.
Goglia says the crew demonstrated significant “knowledge and discipline” problems. Qualified pilots should be able to complete memory items quickly he says, adding such deficiencies, left uncorrected, would disqualify pilots in the USA.
Several minutes after take-off, when the flaps came up, flight 610’s MCAS started activating.
“This report actually shows that MCAS didn’t get involved in the accident sequence until late in the flight,” Feith says in his 27 November podcast.
For more than 5min the captain successfully countered MCAS by commanding nose-up trim with switches on the column. Neither pilot completed the runaway stabiliser checklist.
About 1min before the crash the captain passed control to the first officer. But in the hand-off the captain did not mention his use of nose-up trim.
“The captain did not verbalise to the [first officer] the difficulty in controlling the aircraft and the need for repeated aircraft nose-up trim,” the report notes.
After taking control, the first officer trimmed up several times, but not enough to counteract MCAS. Flight 610 crashed in the Java Sea, killing 189 people.
TRAINING, EXPERIENCE, AIRMANSHIP
“As an industry, we have all become overly dependent on automation and technology,” says training captain Shah, who remains employed with Jet Airways and works for Washington DC aviation training and consulting company GHS Aviation Group.
“The prevalent perception is that the flightdeck automation is there to do the job for you, rather than to assist,” she says. “If the automation fails, and we know that it sometimes does, pilots must have the experience, training, and technical ability to instantly take over and safely fly the aircraft.”
Jet Airways was expanding before its shutdown. The carrier’s 737 fleet increased from about 50 to 80 aircraft between 2010 and early 2019, when it began winding down. The fleet included several 737 Max aircraft, and Jet Airways had orders for roughly 130 additional Max jets, Cirium fleet data shows.
Amid that expansion, the training time allocated to the carrier’s pilots for the purpose of meeting government-set minimum performance standards was “notably reduced”, Shah says.
Newly hired pilots, depending on proficiency, were given 11 or 12 simulator sessions, down from about 14 previously, she says. Meanwhile, pilot wash-out rates “significantly declined”. Shah says other Asian carriers face identical pressure to train more pilots as fleets expand – conditions highlighting a global pilot shortage.
A 2019 Boeing report projects that by 2038 airlines will need 645,000 new pilots, including 244,000 in the Asia-Pacific region, almost double any other region. Pilots and experts fear less training and more automation have left many pilots lacking adequate hand-flying skills and unprepared for failures.
MINIMUM PILOT EXPERIENCE
Some insiders have concerns about ICAO’s low-hour multi-crew pilot licence. The MPL requires no minimum flight time, but holders need a private licence and 240h of time in either an aircraft or simulator.
By comparison, US regulations require transport pilots have 1,500h of flight time, with exceptions. Those regulations have proved controversial, with the US regional airlines saying they worsened a pilot shortage without improving pilot qualifications.
MPLs allow pilots with a few hundred hours of time to sit in the right seat of a large jet. Critics warn that may be insufficient to prepare pilots for real world situations.
Ethiopian is among airlines to embrace the MPL, according to its flight school website.
The preliminary report into the 10 March crash of Ethiopian 302 says the first officer had 361h of “flight experience”, including 207h on 737s.
It does not specify the licence the first officer held, and the airline has not responded to requests for information from FlightGlobal.
“I am not convinced 361h in aircraft and simulators combined is enough to develop a level of airmanship needed to deal with unscripted emergency situations,” says captain Gerzanics.
The Ethiopian 302 accident report is yet to be finalised, but the preliminary findings reveal a similar scenario involving incorrect angle-of-attack values and MCAS activation shortly after take-off. The aircraft crashed outside Addis Ababa, killing 157 people.
Those pilots disengaged MCAS using the runaway stabiliser procedure, then switched electric trim back on after struggling with manual trim.
They left the throttles at 94% thrust throughout the flight. Overspeed warnings sounded and the aircraft crashed at high speed – 458kt (848km/h), said one airspeed indicator, 500kt said the other.
Observers suspect the pilots turned electric trim back on because they could not manually trim. They probably could not trim owing to tremendous force, caused by the high speed and resulting aerodynamic pressure on the control surfaces.
Without detracting from the role played by MCAS, pilots and safety experts say the aircraft should never have been allowed to reach such speed.
Goglia thinks both accidents display a “failure to fly the airplane” when automated systems fail, and he is not alone.
In October, the USA and several countries urged ICAO to review pilot training, warning pilot skills may be degrading amid increased reliance on automation.
ICAO’s member states and its technical commission “roundly endorsed” forming a panel to complete the review, ICAO says. Next spring, ICAO’s Air Navigation Commission, its main technical body, intends to review the panel’s “objectives and composition”. ICAO does not say when it expects the pilot training review will be complete.
BOEING ‘NAILED’ MAX FIXES
Training concerns aside, Boeing has made updates to the Max that experts believe solve the aircraft’s problems.
“Boeing nailed the fixes on the Max,” says Goglia, who attended Max simulator demonstrations at Boeing’s facility in early December. He paid his own expenses and does not work in any capacity for Boeing. “If there is any [angle-of-attack] disagreement, in less than a second it will shut down the MCAS.”
The flight control system now compares data from both Max angle-of-attack sensors and prevents MCAS from firing if readings differ more than 5.5°, according to Boeing. Previously, only one sensor fed MCAS at a time.
MCAS will additionally only operate once per “each elevated angle-of-attack event”, meaning it will not provide multiple nose-down inputs, as occurred during accident flights. And MCAS no longer commands more nose-down trim than pilots can counteract by pulling the column, Boeing has said.
Boeing also gave the computer “mid-value select”, which generates a third angle-of-attack input for the purpose of identifying angle-of-attack faults. The computer disables nose-down trim upon determining one sensor is faulty, Matt Kiefer, a member of an FAA-convened technical advisory board, told Congress in December 2019.
Additionally, new “software monitors” cross-check trim commands, and the computer will disable commands upon finding differences, Kiefer adds.
“We were able to experience the accident scenarios and able to observe the aircraft behavior with MCAS operating properly, as well as how the aircraft handles with MCAS disabled,” Kiefer said.
The technical advisory board, an independent panel formed by the FAA to evaluate Boeing’s MCAS fix, still has work outstanding. But Kiefer says the “team feels that the changes made to the flight control system of the 737 Max should vastly approve the safety of the aircraft”.
The FAA has set no timeline for clearing the Max, although certification in early 2020 has been indicated by Boeing.
Before the jet is cleared, a joint operations evaluation board must complete a pilot training analysis, the FAA must review its findings, and the FAA and technical advisory board will review final documents, FAA administrator Steve Dickson told Congress in December 2019.
