The aviation world is reeling after the second 737 MAX 8 crash in just a matter of months. It is unprecedented for two of the same brand new aircraft to have catastrophic, fatal crashes just mere months after their introduction. I’ve been deeply saddened by the crash of Ethiopian flight 302 on Sunday, and left looking for answers. I cannot deny that I am rattled for the first time in regard to the safety of any commercial aircraft (SEE: Two fatal crashes, too many questions. I’ll be avoiding the 737 MAX 8 for now).
Boeing just announced that they will be updating the software of their 737 MAX aircraft in the wake of these disasters. This follows on the heels on an FAA decision to not ground the aircraft in the United States, but also an announcement that the FAA has been working with Boeing on said software enhancement for the Maneuvering Characteristics Augmentation System (MCAS) since its implication as one of the causes of the Lion Air crash. This is expected to be put in place no later than April. For now, the FAA has not mandated the grounding of any 737 MAX 8 aircraft in the U.S., even though numerous countries, including China and all the countries within the European Union, not to mention many airlines, have grounded the aircraft.
I am admittedly not an aircraft expert or aviation engineer. However, I am an engineer, or at least educated as one (been on a different track since university) and have doing everything I can to understand and digest what I’ve been researching about Boeing’s newest aircraft. And this software update as the fix to the 737 MAX problem of the new plane is troubling. Here’s why:
The 737 MAX doesn’t fly quite like the old 737NG series
I’ve been doing some digging since the crash of Ethiopian flight 302, and what I am finding is that the new 737 MAX 8 and MAX 9 aircraft don’t fly quite like the old 737 Next Generation (737NG) series. Where the old planes were very stable in flight, the new 737 MAX is less so. This is the result of the placement of the new LEAP 1-B engines, which required an adjustment to the design of the plane to accommodate their increased physical size.
Simply put, the LEAP 1-B engines are larger, and they could not be simply swapped with the existing 737 engines. Boeing engineers had to move the point at which the engines attach to the wing, and this changes everything.
Moving the engine from its current position destabilizes the aircraft at in pitch (essentially the up and down movement of the nose). When the aircraft is in normal flight with a low pitch / angle of attack, it should fly basically just like the old 737s. However, when the pitch is increased, the engines themselves provide extra lift. The force of this lift is now applied forward of the center of gravity of the aircraft, due to the change in position of the engine, which in turn can cause the nose of the plane to pitch upward even more. This could cause the aircraft to swing into too high of an angle of attack and subsequently stall.
So it would appear that the 737 MAX 8 flies just fine in normal flight, but it is less stable in when flown at a high angle of attack, which is not good. This is a marked difference from its predecessor 737s.
The angle of attack (AOA) sensor and MCAS system in the 737 MAX is what Boeing designed to guard against a stall, kicking in an automatic “trim” if the aircraft begins to approach too high an AOA. But what if this sensor is faulty? This sensor failure is what contributed to the Lion Air crash back in October. Oddly, Boeing placed two sensors on the aircraft, one on each side of the nose, but the MCAS system only ever receives input from one at a time. If the one sensor fails, the whole system is in jeopardy.
Is Boeing using software to correct a flawed design?
This is my biggest worry. As I mentioned, the old 737NG design is very stable, and the aircraft has proved to be incredibly safe over many, many years of operation and an insane number of operating cycles. It is no wonder that it is the most popular commercial jet aircraft ever manufactured.
But the new design isn’t as stable as the old design, with the previously mentioned change in the engine placement. My worry is that Boeing chose to bank on this design and a potential inherent flaw, providing a patch using a new software system rather than going back and changing the actual design of the aircraft itself. Banking on a software system that is unfamiliar to pilots (who are going to expect the new 737 flies just like the old one) was a very poor choice in my opinion. To top it off, the new MCAS system was not properly explained to pilots, and they received no training on it. Boeing provided little to no documentation on MCAS.
Taking a step back, I find that “fixing” an aircraft stability problem through the use of software is a dubious decision at best. As someone who has done some software development, you can encounter any number of unexpected issues along the way, even after testing, and especially when you put the software in front of someone who does not understand it the way that you do. This may not be entirely the same situation or a truly fair comparison, but it cannot be denied that Boeing put a new software system in place and also changed the fundamental way that pilots expect to deal with a problem with this software. With the NG planes, if the trim system is not acting properly, the pilot pulls back on the yoke. With the MAX and MCAS, pulling back on the yoke does nothing. Boeing has completely changed the way pilots deal with a malfunctioning trim system.
One former Boeing flight controls engineer calls the MCAS system a design flaw. He states that “commanding the nose down clearly is a major concern” especially if it can be “triggered by something as small as a sensor error.” He goes even further to state that “somebody didn’t do their job” and “there is going to be hell to pay for that.” Boeing now has a procedure in place for pilots to deal with a faulty AOA sensor that triggers the MCAS system, but the fact remains that you have a computer with the ability to tell the nose of the aircraft to pitch down when it doesn’t need to. And that is not good.
Software or sensor failure mixed with unexpected human interaction has lead to some fatal incidents in the past. The one that comes to mind is Air France 447, which crashed into the South Atlantic after after the pilots incorrect reactions after the airspeed indicator failure resulted in them putting the plane in an aerodynamic stall and the death of all aboard.
Adding more software just adds complexity to an aircraft. Some people may be willing to put more trust in an automated software system than a pilot. I am not. I am much happier putting myself in the hands of a highly skilled and well trained professional who knows what he is doing and wants to get home to his wife and kids. Captain Sullenberger’s familiarity with the Airbus A320 cannot be overstated in the “Miracle on the Hudson” incident. I don’t think I’d trust a computer to land me on a river in the event of a dual engine failure.
No matter the software update, I’m still not all that confident in the 737 MAX. I am not surprised that Boeing stock has tanked 11% since Sunday. We’ll see whether that will rebound, or continue to fall further, but market and consumer confidence in the aerospace giant has been rattled. It is my hope that Boeing will do everything they can to ensure that their aircraft are completely airworthy and safe, even if it means grounding them and providing additional modifications and fixes besides the software update to the MCAS. I’m not a fan of fixing a hardware problem with software and would like to see something else done to ensure that their 737 MAX series is equally as safe, if not more so, than their old tried and true aircraft.
737 MAX image courtesy of Aka the Beav via Flickr under CC 2.0 license.