QUESTIONS REMAIN OVER GROUNDED BOEING 737 MAX

Airliner still out of service one year after Indonesian crash

Several days after a Boeing 737 Max operated by Lion Air plunged into the sea off Java, Indonesia, family members of those killed scattered flowers on the water, their faces contorted in grief. Some wept quietly.

Five months later, mourners gathered in Addis Ababa, the Ethiopian capital, for a memorial service after a Boeing Max flown by Ethiopian Airlines slammed into the ground shortly after takeoff.

Relatives were offered small bags of scorched earth from the crash site to bury because the bodies of most victims were consumed in a fireball on impact.

The crashes on Oct 29 last year and March 10 killed a total of 346 passengers and crew members. Both incidents involved Boeing 737 Max single-aisle, medium-range, twin-engine planes. The aircraft is the manufacturer's top seller and is priced at about $135 million.

One year after the crash in Indonesia, the 737 Max remains grounded, and beyond the central questions of how and when the plane will be recertified to resume commercial flights, there is one other: Will passengers believe the Max is safe?

In a report released on Friday, Indonesia's National Transportation Safety Committee said the Boeing 737 Max's automated anti-stall system, the Maneuvering Characteristics Augmentation System, or MCAS, was the primary cause of the Lion Air crash, but a faulty sensor, poor maintenance, inadequate pilot training and failure to fully report problems from a previous flight using the same aircraft contributed to the tragedy. Had the problems been reported in accordance with procedure, the airline would have grounded the plane, the report said.

Much of the Indonesian report paralleled earlier criticism of Boeing and the United States Federal Aviation Administration, which certified the Max as safe. Indonesian investigators said Boeing failed to quickly detect and then correct a software problem that meant a key warning MCAS light did not work, a glitch overlooked in certification of the aircraft.

Boeing and the FAA failed to "adequately consider the likelihood of loss of control of the aircraft" if the anti-stall system malfunctioned. "A fail-safe design concept and redundant (backup) system should have been necessary for the MCAS," Indonesian investigators concluded.

In a statement, Boeing said it is addressing safety concerns raised by the investigators.

"Since the accident, the 737 Max and its software are undergoing an unprecedented level of global regulatory oversight, testing and analysis," Boeing said. "This includes hundreds of simulator sessions and test flights, regulatory analysis of thousands of documents, reviews by regulators and independent experts, and extensive certification requirements."

On Friday, Boeing also ran a full-page ad in major newspapers in the US, stating that a year had passed since the Lion Air crash and adding: "We continue to offer our deepest sympathies to the families and friends who lost loved ones. We will always remember them, as well as those on Ethiopian Airlines Flight 302. The memories of these tragedies will continue to drive us to do everything we can to make our airplanes safe".

Boeing said it has redesigned the aircraft's Angle of Attack, or AOA, sensors - the devices that determine the angle of the plane's nose in flight - and how the sensors work with the MCAS. Under the revised system, the MCAS will turn on only if both AOA sensors agree and will activate only once in response to erroneous data. The system can be overridden by the pilot's control column.

"These software changes will prevent the flight control conditions that occurred in this accident from ever happening again," the company said. "Boeing is updating crew manuals and pilot training, designed to ensure every pilot has all the information they need to fly the 737 Max safely."

Indonesian investigators said the airline's flight and maintenance crews bore some responsibility for the crash.

The day before the disaster, one of the plane's AOA sensors was replaced by a faulty, secondhand one that had been miscalibrated and fed incorrect information to the MCAS. The sensor probably was not tested before flight, but investigators are not certain because 31 pages of the maintenance log are missing. The plane, in service for two months, had experienced problems in its previous four flights, including the day before the accident.

Also on the day before the crash, another crew experienced the same problems with the MCAS as those encountered on the fatal flight. A third pilot in the cockpit, who "hitched" a ride and was not assigned to the flight, helped the crew cut off power to the tail to regain control of the plane.

Standard procedure calls for the crew to return to the airport and land immediately, but the plane continued to its destination. After landing, the captain failed to report the most serious problem encountered. Had he done so, the plane would have been grounded and inspected, Indonesian investigators said.

Next day, the plane took off, and shortly after, another pilot struggled to counteract the MCAS as it pointed the nose of the aircraft down, apparently due to faulty data from the AOA sensor. The pilot asked the copilot to check the Airspeed Unreliability Procedure that should have told the crew which of the plane's two AOA sensors was faulty. The copilot should have told the pilot to engage autopilot, which disables the MCAS and would have corrected the plane's downward angle.

Investigators said it took the copilot four minutes to find the checklist. During training, the copilot did not know standard procedures and his aircraft handling skills were poor.

After struggling with more than 20 nosedives, the pilot turned control of the plane over to the copilot, who soon lost control of the aircraft and it plunged into the sea 13 minutes after takeoff.

Muhammad Asdori, whose brother and nephew were killed in the Lion Air crash, told The Associated Press, "We are very angry (at Boeing) because their negligence has caused our loved ones to die."

A similar MCAS malfunction led to the crash in Ethiopia five months later.

Development of Max

Development of the 737 Max was announced in 2011, and the plane entered commercial service six years later. It had been flown safely worldwide, suggesting that early in the investigation the Lion Air and Ethiopian Airlines pilots may have borne some of the responsibility for the two crashes. But a key issue is how the FAA certified the aircraft.

Robert Mann, president of aviation consulting company R.W. Mann & Co in Port Washington, New York, said: "With any aviation accident, it's never just one thing. It's a series of faults that together create an unfortunate outcome. The Max is systemically fixable."

Boeing has about 4,600 Max orders pending. In April, it reduced production of the aircraft to 42 planes a month from 52, but expects to boost output to 57 a month by the end of next year.

American Airlines, one of Boeing's best customers for more than 10 years, said it was close to buying several hundred planes from Airbus, Boeing's chief competitor.

Boeing knew it had to act aggressively and quickly to preserve its market share, so it abandoned plans for an entirely new plane because design, testing and certification by the FAA and other regulators could take as long as 10 years. To remain competitive, Boeing updated an existing plane, the NG.

The new, fuel-efficient engines on the Max are larger and positioned farther forward on the wing and closer to the fuselage than those on the NG.

The extra weight changed the plane's handling characteristics, meaning that the Max performed differently to previous versions of the Boeing 737.

The nose of the new model could rise unexpectedly when flying at low speed or when cruising. If the nose rose too high, the plane could go into a midair stall.

To compensate, Boeing developed the MCAS.

Boeing sought to develop a plane that flew like previous versions of the 737 - and succeeded. Pilots familiar with the NG could easily fly the Max. But the company did not immediately inform pilots about the MCAS, its purpose, or how to override it in an emergency.

Investigators believe the MCAS may have erroneously pointed the nose of the planes involved in the crashes down and into fatal plunges.

Initially, Boeing did not include details of the MCAS in the manual for pilots, because it believed the software would work unobtrusively in the background.

The first Max fuselage was completed in 2015, while the first test flight was carried out without incident in January 2016. The FAA certified the plane for commercial service in March the following year.

Regulators worldwide followed the FAA's lead and quickly issued approvals. In May 2017, the first delivery was made to Malindo Air, a subsidiary of Lion Air, and the carrier's first commercial Max flight took off later that month. At the time of the crashes, there were about 300 737 Max jets in service around the world.

Certification questioned

The Lion Air and Ethiopian Airlines crashes changed everything. In April, the FAA asked regulators from nine countries, including China, to take part in the Joint Authorities Technical Review, or JATR, of the US regulator's oversight and approval of the Max's automated anti-stall device, the MCAS.

The JATR found that the FAA evaluated the device piecemeal without regard to its overall performance, making it difficult to determine if it complied with regulations.

In its 69-page report, the review stated, "MCAS was not evaluated as a complete integrated function in the certification documents submitted to the FAA. The lack of unified top-down development and evaluation of the system function and its safety analyses, combined with the extensive fragmented documentation, made it difficult to assess whether compliance was fully demonstrated."

James Hall, managing partner of Hall & Associates in Washington and former chairman of the US National Transportation Safety Board, has consistently criticized the self-certification procedure for giving too much authority to Boeing and, in effect, allowing the manufacturer to certify its own aircraft.

"I hope (the US) Congress will limit the delegation of responsibility without active oversight in future reviews," he said.

But Mann, from R.W. Mann& Co, said innovations in the aircraft industry often outpace the ability of regulators to evaluate them. It therefore made sense for Boeing to take part in the review. The key is balance and oversight.

"This is a shared issue between Boeing and the FAA," Mann added.

The JATR said that to assure safety, the FAA needs to reform its practice of delegating key parts of certification to industry engineers.

"With adequate FAA engagement and oversight, the extent of delegation does not in itself compromise safety," its report said. "However, in the Boeing 737 Max program, the FAA had inadequate awareness of the MCAS function which, coupled with limited involvement, resulted in an inability of the FAA to provide an independent assessment of the adequacy of the Boeing-proposed certification activities associated with MCAS."

FAA Administrator Steve Dickson said in a statement: "I will review every recommendation and take appropriate action. We welcome the unvarnished and independent review. We are confident that our openness to these efforts will further bolster aviation safety worldwide."

Return to service

Boeing believes the Max will return to service before the end of the year, but nevertheless has set aside $5 billion to cover costs arising from the plane being grounded. The three US airlines that fly Max jets have canceled flights using the plane through early January.

Pilots at Southwest Airlines, the largest operator of the plane in the US, with 34 Maxs, believe the aircraft will not return to service until February - a month later than major US airlines expect and as much as two months later than the manufacturer's target.

Oscar Munoz, United Airlines' CEO, told CNBC "no one knows" when the plane will fly again.

The European Union Aviation Safety Agency, or EASA, said it would do its own testing on the Max, rather than follow the FAA's lead. This almost certainly means further delay in recertifying the plane's return to service.

EASA's test flights will likely take place in December, after testing by the FAA. Results will be shared with EU member nations so that the Max can be cleared to enter the trading bloc's airspace.

The way in which these fixes are approved will determine how quickly the plane returns to service. If the Max is considered a derivative of previous 737 models, approval is straightforward and should be completed quickly.

It would take at least 45 days to prepare the planes for flight after recertification. But if regulators determine that the updated MCAS changes basic handling of the aircraft, it could require certification as a new plane. That is likely to be a lengthy and costly process, delaying a return, analysts said.

It is also unclear what additional training Max pilots will have to undergo. Some regulators may require only a course based on computers, but others may demand simulator training, further delaying the plane's return.

In 2016, an instant-message exchange between a Boeing test pilot and a colleague appeared to criticize the performance of modifications to the MCAS system. News of the exchange drove Boeing's stock down, but the discussion centered on the performance of the flight simulator - not the Max's anti-stall device.

Lawsuits filed

Lawsuits alleging wrongful death, negligence and product liability have been filed in Chicago, where Boeing is headquartered. The US legal system tends to be more generous in awarding damages than courts elsewhere in the world.

Floyd Wisner, founder of the Wisner law firm near Chicago, negotiated an out-of-court settlement for 11 families of those killed in the Lion Air crash. Boeing will pay about $1.2 million for each relative who died.

Wisner, who has been a lawyer for 42 years and has handled major aircraft crash cases for the past 20, said: "Airplane crashes are terrible and families never get over them. Family members think of what their loved ones went through in the final minutes before the crash.

"Unlike driving, where you can pull over if something's wrong, passengers at 30,000 feet (9,144 meters) have no control. This compounds the families' grief. There's a hole in their hearts."

He said most family members want to know what caused a crash, who was responsible and to ensure similar factors never kill passengers in the future. When satisfied about those points, the discussion turns to compensation. Many use the money to educate surviving children and to meet living expenses, especially if the primary earner died in the crash.

"It's compensation," Wisner said. "They're not making anything. That's why the settlement money isn't taxed in the US. It tries to make you whole, but those who have lost a loved one in a plane crash will never be whole again. I still get notes from people I represented years ago. Some say their child has completed college and enclose a photo."

Michael Stumo and his family, whose 24-year-old daughter, Samya, died in the Ethiopian Airlines crash, have sought to determine what happened and why. He told National Public Radio in the US: "We're traumatized. We don't want to be doing this, but we want to avoid a third crash."

Boeing has set aside $100 million to help families affected by the crashes. The company said in a statement: "Boeing extends our heartfelt condolences and sympathies to the families and loved ones aboard Lion Air Flight 610 and Ethiopian Airlines Flight 302."

Final moments

The US National Transportation Safety Board, an independent federal agency, is tasked with investigating the cause of airplane crashes.

In a preliminary report on the 737 Max disasters it said, "The pilot responses differed and did not match the assumption of pilot responses to unintended MCAS operation on which Boeing based its hazard classifications within the safety assessment that the FAA approved and used to ensure the design safely accommodated failures."

The aircraft flight recorders, or black boxes, recovered after the crashes showed that multiple alarms activated.

These included a device that vibrated the pilot's control column, audible warnings that the planes were too close to the ground, and a "clacker" to indicate they were flying too fast. There were also multiple warning lights, alerting the pilots to dangerous speed and altitude.

Both planes flew erratically with sharp fluctuations in altitude as the pilots attempted to regain control.

Five minutes after takeoff, Ethiopian Airlines' 737 Max plunged into the ground at about 885 kilometers per hour.

scottreeves@chinadailyusa.com

(China Daily Global 10/29/2019 page1)