A retired BA Boeing 747 captain and experienced B737 pilot analyses the probable cause of the Lion Air and Ethiopian Airlines accidents, and the implications for aircraft certification | Words: Bob Grimstead

For fifty years the 737 has been Boeing’s cash cow. Despite poor initial sales (and indeed Boeing actually considered ceasing production after only shifting 22 in 1972) the type has since become the world’s most popular airliner.

With more than 10,500 sold, 737s are by far the best-selling jetliners ever, representing one quarter of the world’s airlines’ fleets. Boeing 737s have carried more than twelve billion passengers over 74 billion miles, and Boeing currently churns them out at the rate of almost two per day. One takes off or lands somewhere in the world every two seconds!

There were nearly 5,000 MAXes on order at the time of the Ethiopian crash. Whether that changes in the aftermath remains to be seen.

The 737 was originally a low-cost, low-risk, low-development-investment project, a simple and cheap 100-seat airliner produced at the same time as this huge corporation had bet its future existence on building not only the revolutionary new, giant, long-range 747 but the enormous production facilities needed to assemble it.

To keep things as simple as possible, the 737 design team used the Boeing 707’s and 727’s nose and fuselage cross-section mated to a small wing with minimal, 25-degree sweepback and efficient high-lift devices. For power they chose the 727’s proven but low (0.96 to 1) bypass ratio, 14,500 lb thrust P&W JT8D-1 engines with their small, 49-inch diameter fans.

However, instead of hanging those slim engines in pods below and ahead of the wing, as they did on the 707, they fitted them tightly underneath, so that they could give the aeroplane a short undercarriage, thus allowing easy engine maintenance access and enabling baggage to be loaded and unloaded by hand from the ground.

The 737 did have the sophistication of Cat II capability, but only with dual autopilots. They incorporated hydraulic flying controls, using dual systems with manual reversion. Thus they retained 707-style small elevators, coupled with a much bigger horizontal ‘stabilizer’ (tailplane) driven by a powerful electrical motor with low-geared manual handwheel backups either side of the centre console. The vital thing to understand here is that, because of this, it is physically impossible to overcome the stabilizer’s effect with the elevators (and doubly so with unserviceable hydraulics).

The 737-100 first flew in 1967 and was followed the next year by the 737-200ADV, with more power, more fuel and less drag. Boeing salesmen marketed their small short-haul airliner to developing countries as an aeroplane easily capable of being operated by local pilots.

In the eighties Boeing fitted the higher-bypass CFM56-3B-1 engine, but with cropped fans plus quasi-triangular ovoid nacelles to retain the original ground clearance. For the same reason these engines were raised and moved much further forward, to ahead of the leading edges. As time passed the 737 gained longer and longer fuselages to carry more passengers and the CFM56-4 gave improved range.

In the early nineties, spurred by developments in the Airbus A320 family, Boeing introduced the 737NG (new generation) with a wing of increased span and chord (therefore more fuel capacity), an improved aerofoil and comparatively huge eight-foot blended winglets. This, plus the quieter and more economical CFM56-7B engines, now gave it a 3,000-mile intercontinental range. Increased power required bigger fins, and the cockpit got six-screen LCD EFIS instrumentation.

In 2004 improved field performance and the CFM56-7B’s 61-inch fan resulted in the Performance Improvement Package’s ‘Evolution’ nacelle.

MAX family introduced

In 2011 Boeing launched its fourth (and final) iteration of the 737, using the CFM Leap-1B engine with its wide-diameter 69.4-inch fan to become the 737 MAX family. These have distinctive dual ‘Advanced Technology’ winglets, nose-legs lengthened by up to a foot to improve engine ground clearance, 43-inch-longer pointed tail cones, four fifteen-inch landscape EFIS screens (instead of the six smaller previous ones), fly-by-wire spoilers and a large number of detail differences. The most important change is to even higher, further-forward nacelles with distinctive zig-zag bypass duct outlets. And these are the source of its current problems.

There are nearly 400 737 MAXes in service. Pilots generally prefer flying them to their predecessor the 737NG, at least in part because of the lighter stick forces. In those earlier versions a ten-pound pull on the yoke resulted in a ten-degree pitch change, whereas MAXes give a fifteen degree pitch change for the same pull and respond more quickly. These are both indicators of ‘relaxed’ pitch stability but definitely make an airliner nicer to fly.

As far as I know, since the 100/200 the 737 family continues to be regarded as one type, certified to the same 1960s requirements as the early ones, despite that long list of piecemeal changes over the years. The advantage to Boeing and its customers of course is that pilots don’t have to undergo lengthy and costly re-training for a new Type Rating, merely undergoing brief ‘differences instruction’.

And do not expect that training to have been comprehensive. Boeing is famous for the bland and innocuous statements in its manuals. Both the Flap Asymmetry and Reverser Unlocked In Flight checklists say something along the lines of ‘a residual out of trim condition may exist’ when they actually mean ‘you are going to need to full aileron and quite a lot of rudder just to stop your aeroplane from rolling inverted’, as we know from that fatal Lauda Air 767 crash (caused by a thrust reverser becoming unlocked in flight – Ed).

Scandalously, I hear that in the case of the 737 MAX?with its new engines, limitations, screens and systems?that differences training could be as little as a one-hour iPad session for some American pilots. A British 737 pilot I know said his iPad training took three hours, but there was no mention of the now infamous MCAS (Maneuvring Characteristics Augmentation System).

I have been told that many overseas pilots weren’t required even to watch that. Certainly 737 pilots in general were critical of the lack of information originally available to them, and it seems very likely that neither those 29 October 2018 Lion Air pilots nor their 10 March 2019 Ethiopian brethren even knew of the MCAS’s existence, let alone details of its operation.

The New York Times reported that United Airlines actually provided its pilots with a handbook containing no fewer than thirteen pages of differences between the 737 MAX and its NG predecessor, but even this didn’t mention anything about the MCAS. The newspaper also says that, despite the FAA having required no simulator differences training, one sim maker has since received forty orders, although there is currently only a single 737 MAX simulator in the USA.

Stability problems

During more than half a century of development the 737’s maximum weight has increased from fifty to 88 tonnes, while passenger load, range and thrust have all more than doubled from the original 100 to 230, 1,540 to 3,850nm and 14,000 to 29,300 lbf respectively. Okay, Supermarine did precisely this with the Spitfire, but that ended up with pitch stability problems. Surprise, surprise, so did the 737 MAX.

Those wide nacelles placed so far ahead of its wings have increased the 737’s forward horizontal keel area, reducing pitch stability when the flaps are retracted. (Obviously when flaps are extended aft of the wing they restore the balance, so there is no problem.) Worse, those big nacelles actually produce positive lift at high angles of attack. And of course at high powers, as with all podded engines, they produce a significant pitch-up. These things are all cumulative.

This may have been predicted in Boeing’s computer simulations and wind tunnel analysis, but it certainly showed up during test flying, when they found that, approaching an accelerated (turning) clean stall, the rearward stick force required no longer continued to increase with speed reduction, but reduced.

Once the bank had been applied and a steep turn started, it was necessary to push forward on the yoke to prevent the turn tightening and the G-force increasing, after which the aeroplane would then pitch up into the stall unless the pilots input a lot of forward control column movement. These characteristics are clearly not acceptable in a civil airliner, although both Spitfires and P-51 Mustangs plus several types of homebuilt kits exhibit them.

Now, the proper solution to an aerodynamic problem like this is to increase horizontal tail volume. Extending the rear fuselage would not be an option although it would give the tail more leverage, because it would move the centre of gravity aft, which also reduces pitch stability. A tailplane with increased span is the best answer, but of course this would require major structural calculation and strengthening plus re-certification including a lot of test flying. Also it would increase the drag.

Supermarine and North American partially solved their pitch stability problems with bob-weights in the elevator circuits. This might be a viable and inexpensive 737 MAX solution. We also know that Whitcomb winglets and Spillman sails increase a wing’s effective span with little or no effect on structure weight, plus a useful decrease in drag. Maybe fitting these to the 737 MAX’s stabilizer would be a simple and cost-effective aerodynamic solution (they are used to good effect on light aircraft like the Diamond DA42?Ed).

Several previous, primarily British-registered, Boeing aeroplanes have had stick ‘nudgers’ or ‘pushers’ — the distinction depends on their ferocity. Later 707 Intercontinentals with their full-span leading-edge flaps suffered from the same ‘relaxed pitch stability’ approaching the stall, as did early 747s and the 767.

Boeing’s solution was slightly different in each model. Some incorporated a feed to the autopilot’s low-speed stabilizer trimmer to lower the aeroplane’s nose as the airspeed decreased. The early Jumbo’s was activated by the Angle of Attack (AoA) sensors via the stick shaker, so that the shake and push happened simultaneously. Similarly, the 767’s leading edge slats run to fully extended when the stick shakers fire and some 767s have stick nudgers.

To counter the 737 MAX’s pitch instability, Boeing’s designers apparently eschewed a proper aerodynamic or mechanical solution, electing instead to fit an electronic input to the powerful electric stabilizer trim motor, so that it runs for up to ten seconds and pitches the nose down when a pre-determined AoA is reached.

(The 737’s stabilizer trim is normally only used in short bursts of one or two seconds.) The magnitude of this stabilizer input is lower at high Mach number and greater at low Mach numbers. This is Boeing’s ‘Maneuvring Characteristics Augmentation System’ (MCAS), subsequently dubbed with black humour on Facebook ‘Mass Casualty Accident System’.

The 737 MAX has a bunch of other odd ‘fixes’, including the Landing Attitude Modifier, which slightly raises the flight spoilers to increase drag and thus thrust above idle if the thrust is near idle with the flaps set between 15° and 30°. With the flaps set to 30° or 40°, the flight spoilers again rise to reduce lift, necessitating a higher AoA and hence nose attitude to give an ‘acceptable nose gear contact margin’.

Its Elevator Jam Landing Assist allows limited changes to the vertical flight path from the spoilers when the flaps are extended to assist the approach and landing if the normal elevator system jams. When in use, the spoilers rise to a pre-set position; they then extend or retract as the control column is pushed or pulled to increase or decrease the rate of descent. Emergency Descent Speedbrakes increase flight spoiler deflection when the speedbrakes are extended above FL300 and the Cabin Altitude Warning is activated.

All 737s have additional stabilizer trim functions, including Mach Trim, which runs the stabilizer to pitch the aeroplane’s nose upwards when the Mach number exceeds 0.615M. They also have Speed Trim which runs the stabilizer automatically at low speed, low weight, aft C of G and high thrust, and provides pilots with positive speed stability characteristics.

The speed trim system adjusts stick force so pilots must provide a significant pull force to reduce airspeed or a significant push force to increase airspeed. There is also an Elevator Feel Shift system, which increases hydraulic pressure to the elevator feel and centring unit to approximately double stick forces in high AoA flight.

To me, these all seem like electronic fudges to address handling shortcomings – sticking plasters to mend broken limbs if you will. Microswitches must proliferate around this airframe.

US pilot concerns

In recent months several Air Safety Reports have been filed by concerned American pilots about problems with, or misunderstanding of, the 737 MAX’s multiple stabilizer trim functions. One pilot said: “I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models.

The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone?even if the pilots aren’t sure what those systems are, what redundancies are in place, and failure modes.

“I am left to wonder: what else don’t I know? The Flight Manual is inadequate and almost criminally insufficient. All airlines that operate the MAX must insist that Boeing incorporate all systems in

their manuals.”

What flabbergasts me is that the 737 MAX’s MCAS runs that powerful main electric stablizer motor at full speed and for almost ten seconds at a time, but is activated by only one of its two AoA sensors (whichever is supplying the active Flying Control Computer), leaving it wide open to spurious operation.

Bear in mind that AoA sensors are notoriously unreliable, being floating vanes out in the airflow and subject to salt and chemical corrosion, plus bearing stickiness. Also they are electric, and electrics are the most unreliable of all aircraft systems, being prone to the breaking of wires through vibration or impact, corrosion, abrasion of insulation and plenty of other age-related failure modes.

Boeing offers a third AoA vane with an AoA disagree caption, but only as an option. Southwest Airlines stated that they amended their AoA system after the first, Lion Air, 737 MAX crash, so they may have bought and implemented this option.

But on a standard aeroplane, if the selected AoA sensor reads erroneously, the stabilizer trim will keep pushing the aeroplane’s nose down in ten-second increments with five-second pauses until the stabilizer reaches its limit. American journalists have now discovered that ten seconds of stabilizer trim is more than half its total movement, so that if MCAS operates twice, the stabilizer will then be at full travel.

Control law conflict

The Lion Air 737’s Flight Data and Cockpit Voice Recorders showed that MCAS operated, and was countered, no fewer than 21 times by the captain before he handed control to his first officer. Both seemed to be working on the understandable assumption that the normal control laws would be in effect so that moving the control column in opposition to stabilizer trim would immediately apply the stabilizer trim brake to stop it from running.

Nobody had told them that this wasn’t the case with MCAS. The first officer only used the trim switches a couple of times and in short bursts, as one would normally do, before relinquishing control back to the captain. But by then it was too late. After a full twelve minutes of struggling with their aeroplane it was far too out of trim to be recovered.

It is now clear that much the same happened, but this time for only six minutes, with the Ethiopian 737 MAX a full 133 days later. One hundred and thirty three days during which Boeing said that they were going to do something about the 737 MAX’s MCAS, but in reality had achieved nothing.

MCAS only works when the flaps are up, so if the selected AoA vane has a latent fault this will only manifest itself once the flaps have been retracted during climb-out. This will of course be at fairly low altitude. At this stage the aeroplane will be accelerating and the handling pilot will already be trimming forwards, so MCAS operation might not immediately be apparent, even if the pilots knew the system existed. And it seems that many, or even most, did not.

Further, you cannot engage the autopilot if the AoA vane senses high alpha or there is any out-of-trim force, plus the EICAS will start throwing up warnings like ‘IAS disagree’ and/or ‘ALT disagree’ and ‘AoA

disagree’ and the ‘Feel Diff Press’ light will be illuminated. These trigger memory drills that require both the nose to be pitched down and the thrust to be reduced (which pitches down the nose). Can you see a trend developing here?

On the handling pilot’s side only of the new, unfamiliar, four-screen EFIS the amber line and red and black, minimum airspeed (1.3g buffet boundary and stall warning) bars will be displayed as encroaching on actual airspeed, while the monitoring pilot’s screen will show nothing amiss. At this stage, the monitoring pilot will likely be reaching for the Quick Reference Handbook (QRH?the emergency checklist) while the handling pilot is trying to raise the increasingly heavy nose.

At the moment it is still possible to oppose MCAS by trimming the stabilizer nose-up using the dual thumb-operated pickle switches on either yoke. However, as soon as the handling pilot stops trimming nose up, the MCAS will give further ten-second bursts of nose-down trim. And believe me, ten seconds of stabilizer trim is an awful lot of trim, even if it only happens once, let alone multiple times.

Stabilizer trim runaway has always been a serious potential problem (big stabilizer, small elevator, remember), in all current Boeings, so the basic design ensures that simple movement of either control column in an opposing direction to the trim’s movement will apply the trim brake immediately. All 737 pilots will be used to this, but it is not the case with MCAS because it’s partly there to stop pilots from stalling the aeroplane.

So now, in our hypothetical flight deck, if the pilots are not already mentally overloaded or fixated on the rapidly expanding terrain ahead, somebody should call ‘runaway stabilizer!’ and there’s another memory checklist for that, which requires the guarded electric trim cut-out switches on the rear right of the centre console to be selected to cut-out.

From now on you have to re-trim the aeroplane using the low-geared manual trim wheels on either side of the pedestal, and for that you need to look in and down, find that big handle, press the button on its end to flip it out by ninety degrees and then wind like mad, after relaxing your pull force.

Well, that’s okay if the stabilizer is in a neutral position. But what if it has already run a long way leading-edge-up (aeroplane nose-down)? I quote from a Boeing manual: ‘If a small out-of-trim condition exists, the trim wheels may be turned manually if the elevator force is first relaxed momentarily.’

What they don’t say (remember Boeing always understates a problem) is that aerodynamic loads on the stabilizer will just not allow it to be moved manually, even if you apply all the force you can muster, until you relax that up elevator input. Try doing that with the ground rushing up at you!

Meanwhile the cockpit will likely be a cacophony of noise. If the AoA sensor is not working properly its stick-shaker will be hammering away (probably since main gear lift-off). The GPWS might be shouting “terrain, terrain”, “too low gear” or “too low flap” and “sink rate, sink rate”. In the later stages it will be shouting “whoop whoop, pull up, pull up”. These warnings are all very loud, seriously hampering inter-pilot communication, even if their first language is English.

There will also likely be radio altimeter callouts and possibly an audio altitude alert or two. There will inevitably be sounds of distress from outside the cockpit as the increasing positive and negative G-forces throw the passengers and cabin crew up and down between their seats and belts. Just imagine how terribly overwhelming that would all be if the pilots didn’t know about MCAS?and it seems probable that they didn’t.

Oh and of course, now without MCAS, you are a test pilot, flying an airliner that is unstable in pitch. Good luck with that.

Improper response?

Some of my colleagues say, and both Boeing and the FAA imply, that the two MAX 8 accidents were caused by improper or slow pilot response to a runaway stabilizer. This may or may not be true, but the fact is that, despite one pilot having fairly low hours, they were all dedicated professionals who had been properly trained and not one of them will have wanted to die prematurely, especially like that.

A 737 expert says that most current 737 pilots are unaware of Boeing’s former recommended manual trimming technique: to pull up the nose positively before relaxing the backpressure to allow the trim wheel to be moved, and then wind like mad. That was accepted technique when I flew 707s and 737s but was apparently removed from later editions of the manuals. Known as the ‘yo-yo’ or ‘roller coaster’ technique, it was part of Boeing lore in my day. My 12,000-hour 737NG/MAX pilot friend admitted he had never heard of it.

We must accept that financial incentives frequently mean the really experienced pilots will tend to be operating the biggest, longest-range aeroplanes for the biggest airlines. Boeing 737s are often (admittedly not always) flown by less experienced pilots, and so should be easier to fly, with fewer hidden pitfalls, particularly given the anticipated influx of new pilots in coming decades.

The DH Comet 1 accidents killed 78 people and the fleet was grounded, never to fly again. A single Concorde accident killed 113 people and the fleet was grounded. But after two Boeing 737 MAX 8s killed a massive 346 people in four months, both Boeing and?even more reprehensibly?the FAA were disgustingly slow to react.

In my opinion, and in view of the immediate obvious similarities between the Lion Air and Ethiopian accidents, not to mention that basically shoddy MCAS system, the 737 MAX fleet should have been grounded immediately, pending a proper, aerodynamic solution to its unacceptable pitch-up characteristics in clean steep turns and turning stalls.

Discussing this with friends and former colleagues, we were astonished that the FAA didn’t move sooner. I knew their remit historically included the task of encouraging as well as regulating aviation in the USA, and that’s what Wikipedia still says, although I’ve been told it is no longer the case. Certainly for many years that was an obvious conflict of interest, and possibly still influences the mindset of FAA employees.

Certification delegated

Probably more relevant is the fact that in 2005 the FAA delegated much of the certification of safety issues to the manufacturers themselves. Read that again. The FAA no longer provides all of that vital, objective, impartial assessment of safety but allows manufacturers to self-certify. So, no corporate financial or marketing pressure there, then!

And this is precisely what happened with the 737 MAX. It has become apparent that, in its early design stages, the FAA was told that maximum stabilizer travel under the influence of MCAS would only be 0.6 of a degree. Understandably, the FAA accepted that. This was later increased by more than four times to 2.5 degrees, or half of the total tailplane travel, but it seems that, for whatever reason, this message never got from Boeing to the FAA.

In view of this, I am not the slightest bit surprised that the Ethiopian authorities have asked France’s BEA rather than USA’s NTSB to decode the flight data and cockpit voice recorders.

After the Lion Air accident, Boeing announced it was making software changes, ‘including updates to the MCAS flight control law, pilot displays, operation manuals and crew training. The enhanced flight control law incorporates angle of attack (AoA) inputs, limits stabilizer trim commands in response to an erroneous angle of attack reading, and provides a limit to the stabilizer command in order to retain elevator authority.’

Catastrophically, although Boeing promised these changes by the end of 2018, they still have not been implemented. The company now says it hopes to do so by the end of April.

In my opinion, all the above should have been incorporated right from the very beginning of the MCAS design if anybody at Boeing had ever bothered to think ‘what if…’ Also, I don’t think that merely tweaking the MCAS software is going to solve the underlying problem, although it might reduce the number of fatalities. It will merely be yet another sticking plaster on a pre-existing sticking plaster. Boeing refers to this as a software ‘patch’. A patch is precisely that: a temporary, get-you-home expedient, not a proper repair.

According to the FAA, Boeing now plans to change the MCAS software to accept input from both AoA sensors. I think the third sensor should be mandatory and incorporated. Boeing will also limit the horizontal stabilizer’s movement in response to an erroneous MCAS signal. And, when activated, MCAS will kick in only once rather than multiple times. Boeing also plans to update pilot training requirements and flight crew manuals to include MCAS (my italics).

This whole issue is tawdry, and completely atypical of the Boeing Company that I have respected for fifty years and more.

On 13 March it was discovered both that the Ethiopian 737 MAX 8’s flightpath was almost identical to that of the Lion Air accident (just as we all suspected) and that its stabilizer jack screw was found in the position of the aeroplane being trimmed fully nose-heavy, and thus identical to the Lion Air’s.

Two ‘never’ events

So now we know that the first?Lion Air?Boeing 737 MAX accident should never, ever have happened.

That the second, Ethiopian, one should have occurred is utterly disgraceful.

If Boeing refuses to implement a proper aerodynamic solution to this handling inadequacy, then my conscience might be prepared to accept software change to MCAS and training revisions, thus:

1) Redesign MCAS so that it receives inputs from three AoA sensors, so that two can out-vote an errant sensor.

2) Give all potential 737 MAX pilots full information on the many little corrective systems that now abound within this aeroplane.

3) Ensure that all 737 MAX pilots undergo a comprehensive classroom ‘Differences Course’ plus simulator sessions including all its handling differences and both normal and abnormal operation of all these subsidiary systems.

4) Ensure that every current and future pilot on the 737 MAX fleet worldwide encounters an MCAS runaway after flap retraction in the simulator at least once in every six months, so that they are primed to counteract it.

Of course the long-term solution will be the introduction of the composite New Small Aircraft (NSA) that will become the Boeing 797, expected to be announced at the Paris Air Show in June. Let’s hope it is aerodynamically sound.

Image(s) provided by:

NA