Boeing 737 MAX is the fourth generation of 737, one of the most successful transport airplane family.

The first types 737-100 and 737-200 began to fly in 1967-1968. The type 737-200 is still flying, 17 units being in active service in Canada, although their manufacturing ended back in 1988. They are very reliable airplanes, with a unique capability to take-off without risks on gravel runways with sand contamination, being specially equipped for this type of operation. Many airports in Northern Canada do not justify investment in paved runways, which would be costly to maintain, given the temperatures. The isolated towns in the area have no alternative means of transport, and the 737-200 represents their only quick and comfortable link to the rest of the world. The life of this airplane will be extended many years into the future by the Canadian airlines, with support from the national aviation authority. The initial airplane was equipped with classic flight instruments, but the recently re-certified airplanes enjoy modern glass cockpit avionics. I mentioned this example on purpose, due to the debates on age of aircraft in the media and criticism to the air operators who operate older aircraft. The most powerful man on this planet, the president of the US should be very worried. He flies 30 years old airplanes.  On the contrary, the recent 737 MAX accidents remind us that in fact a new technology is prone to greater risks than a mature, established technology, which aircraft with many years in service rely on. Each major innovation had its share of human sacrifice, if we think about De Havilland Comet in the 1950s, or Airbus A320 in the 1990s.

The childhood problems did not avoid the first Boeing 737-200s. A few of them ended badly, the rate of accident being 1,75 per million flights. This has gradually lowered in the following generations, being 0.54 for Classic and 0.27 for NG. Maturing of a technology brings obvious safety benefits. On the other hand, what we witness now with the MAX series is completely out of expectations. In two years, the 200 MAX airplanes in service did not accumulate more than a quarter of million flights, and the 2 accidents raise the rate at approximately 8 per million. This will decrease with each year of course, because I trust that MAX will get a software update and its technical problems will disappear.

The second generation of 737 got the name of Classic (-300 the normal series, with an extended -400 and a shortened -500 variants). They were manufactured between 1981 and 2000. Almost 2000 units have been successfully used on all continents. Lufthansa used the -300 type as a workhorse since 1986 for 30 years, until 2016, when the last -300 has been withdrawn. Tarom and Blue Air are still using this very reliable aircraft series.

Both the first and the Classic generations had some problems with the rudder control initially. A black accident series was caused by hydraulic rudder actuators malfunction. In very rare situations, in turbulent atmosphere, not commanded and total rudder deflections have been experienced, which did not leave much maneuver margin to save the aircraft.

Another example of technical problem with the Classic generation did not harm anyone, but illustrates how complex technical problems could be and how hard is it for the engineers to find a solution. The autopilot electronics was manufactured by Boeing on the same architecture with the Boeing 747 types, to reduce costs. The airplane being much smaller (the 737 wind span is lower that the 747 horizontal stabilizer), certain analogue inputs in the autopilot were neutralized with filters, which included capacitors. With time, the capacitors dried and were losing capacity, and consequently the roll reference started to drift away from zero. When the Autopilot was engaged, the pilots noticed that the airplane flies slightly banked on one side. At the beginning, the angles were small, but at some point one aircraft from the Lufthansa fleet was flying with a constant bank angle of 8°! Of course, the pilots disengaged the A/P and flew manually, until the engineers succeeded in finding a cure to this weird problem. Since the first Lufthansa pilot report about the bank angle and until the technical solution implementation, approximately one whole year passed.

The Next Generation of 737 (NG, -600, -700, -800 and -900, on the length of the body, from the shortest to the longest) meant a redesign of the aircraft with electronic flight instruments. In the same time, the aircraft stability was improved by increasing the surface of the vertical stabilizer and redesigning the rudder control system, with the lessons learned from the previous generations.

Ryanair (which, by the way, started with BAC One-Eleven aircraft wet leased from Tarom) established the mono-type fleet standard with the type Boeing 737-800. Southwest Airlines in the US also relied exclusively on types -700 and -800. Tarom and Blue Air have these types in their fleet too.

Without being a Fly-by-Wire such as Airbus A320, Boeing 737 NG are glass cockpit aircraft, strongly computerized. There are like 7000 such airplanes in service or on order, and they will be withdrawn from manufacturing as the new MAX generation will take their place. The safety of the 737 NG aircraft has been impeccable, with only 15 accidents or 0.27 per million flights, and these accidents have not been caused by technical problems, in principle. Two of the accidents with B737-800 have had stronger visibility in the media: Turkish Airlines at Amsterdam and Ethiopian at Beirut. In both cases, the accidents were due to poor airmanship.

To understand how safe are the Boeing 737 aircraft, we need to mention the Concorde case. The French-British supersonic which flew since 1976, had its first and only accident barely in the year 2000 (Gonesse). One single accident in 24 years. Up to that, the airplane enjoyed an aura of legendary safety. Someone however did make a simple calculation. In its entire service history, Concorde flew as much as Boeing 737 flies during one week. Thus, one accident in 24 years for Concorde would be equivalent to a weekly accident at 737. The aura of legendary safety is in fact deserved by 737, even with these recent disasters!

The new series MAX has been announced by Boeing in 2011, mirroring the Airbus re-engineering of the new Neo series. The new models have entered service since a couple of years. At barely two years from the first flight and with an order log of 5000 units, MAX is worrying. In October 2018 and March 2019, two accidents occurring at short time after take-off look similar. Whereas about the recent accident in Ethiopia we do not know much, the Lion Air accident in Indonesia has been already explained.

Essentially 737 MAX comes with a new system of augmentation in the automated flight control, which in theory intervenes just in unusual attitudes situations and deflects the horizontal stabilizer independently from the pilot commands. Such a system is typical to Fly-by-Wire aircraft, such as Airbus family, but it is somehow strange for the pilots trained at the Boeing school. The system name is Maneuvering Characteristics Augmentation System (MCAS). In the Lion Air 610 accident, this system reacted erroneously, based on a faulty Angle-of-Attack sensor. Consequently, the horizontal stabilizer was deflected at a negative angle, and this led to the crash of the aircraft, in spite of the struggle of the pilots to oppose the pitch down effect by elevator commands. The elevator surface is much smaller than the stabilizer surface, limiting its authority and thus compromising the pilots’ efforts to save the aircraft.

After the Lion Air accident, Boeing issued a technical note requesting the pilots to cut off the MCAS (by the STAB TRIM CUTOUT command) in case of uncommanded negative pitch, and promised an updated version of the software, to address this type of problems. Unfortunately, until the date of the accident in Addis Ababba, this new software has not yet been provided. Although the newest accident in Ethiopia has not been decrypted yet, another MCAS functioning error is hard to exclude. The trajectory of the aircraft immediately after take-off and unusual vertical speed variations received by ADS/B may be explained by uncommanded and wrong deflection of the stabilizer, as in the Lion Air case. Therefore, the grounding of the new airplane in China[1] makes sense. One key question is if the Ethiopian pilots did cut out the MCAS by STAB TRIM CUTOUT at the first signs of uncommanded negative pitch, and if they did not, why? Witnesses who listened to the distress call made by the Ethiopian pilots by radio disclosed two types of problems:  unreliable speed indications  and difficulties to control the aircraft.

The MCAS system did not exist at the previous 737 generations. It came out at MAX as a necessity, due to a change in engine geometry and the way the engines are attached to the wing. Some fuel efficiency has been gained, but the behaviour of the aircraft in unusual attitudes has worsened. Being a low wing airplane with engines under the wing, the thrust vector induces a significant pitch torque. If the thrust levers are pushed to the maximum, the nose of the aircraft has the tendency of an uncommanded rise. This tendency could be dangerous at high Angles of Attack, when the airspeed is close to the stall speed. A way out of such a situation is to push the thrust levers to the maximum to increase engine thrust and in the same time to push the column, to reduce the pitch angle. The first such action at a 737 MAX without MCAS would compromise the latter maneuver. MCAS does not play a role in normal flight, only in those very rare situations, when the airplane ends in a very large Angle-of-Attack attitude.

It is worth mentioning that Airbus has a similar system since 1988, when the first transport Fly-by-Wire airplane was flown – Airbus A320. The Airbus system uses two AOA sensors, places on both sides of the fuselage. If the two sensors disagree, no automated control deflection is generated. In the case of Lion Air 610, the Boeing system seems to have taken a control decision when the two sensors strongly disagreed, just one of the two being faulty. The A320 Perpignan accident (2008) illustrates how the automated flight control system of Airbus may take wrong decisions when both sensors are in error, but not disagreeing. The respective airplane had been washed under pressure, contrary to the technical rules, which forbade such a car-style method of washing. The water infiltrated in the gap of both AOA sensors froze simultaneously when the climbing aircraft went above the 0° isothermal, and the automated system was fed with two Angle-of-Attack values, both wrong, but not in disagreement. Consequently, the Automated Flight Control System commanded a pitch up without any chance of the pilots to react in order to save themselves. A similar thing happened to a Lufthansa Airbus A321 at Bilbao (2014), luckily the pilots managed to regain control by decoupling one Air Data Computer unit. The current software version of MCAS of the Boeing 737 MAX gets its information from a single sensor, and the disagreement between the two sensors is only alerted to the crew provided a certain optional software is fitted.

An aircraft design relies on two principles, the functional redundancy and dissimilarity. No single fault of one equipment should lead to an accident. All units of equipment are doubled, tripled or quadrupled, and their suppliers are different, as if one unit has a software or hardware error, that will not affect other units providing the same function, these running concurrently on other types of microprocessors, with a software written by someone else on the same specs. The AOA sensor is doubled, but the way it is integrated in the MCAS architecture does not necessarily comply to the redundancy principle. As a matter of principle, the functioning of one single sensor should not determine the fate of a flight.

On 12 March 2019, Boeing issued the following release with respect to MCAS, Lion Air Flight 610 and Ethiopian flight 302:

“For the past several months and in the aftermath of Lion Air Flight 610, Boeing has been developing a flight control software enhancement for the 737 MAX, designed to make an already safe aircraft even safer. This includes updates to the Maneuvering Characteristics Augmentation System (MCAS) flight control law, pilot displays, operation manuals and crew training. The enhanced flight control law incorporates angle of attack (AOA) inputs, limits stabilizer trim commands in response to an erroneous angle of attack reading, and provides a limit to the stabilizer command in order to retain elevator authority.”

The key to resolve the situation lays precisely in this promise made by Boeing. If MCAS limits its automated action on the stabilizer at a value for which the elevator still holds enough authority, that means that an airplane in the situation of Lion Air 610 or allegedly Ethiopian 302, would remain manually controllable and the pilots would be able to compensate such inadvertently induced nose drops by the MCAS, due to bad sensors. That would be definitely a return to the tradition of the Boeing pilot-centred philosophy. It does not exclude the STAB TRIM CUTOUT solution, of course, which would remove MCAS action altogether.

There is also a persistent question: why new sensors fail so frequently and so easily?

Another useful lesson would be reconsidering the Angle-of-Attack (AOA) display. In the years 2000s, engineers gradually gave up displaying this essential flight parameter in the cockpit of transport airplanes. Both Boeing and Airbus came to this situation. After the indicated airspeed, the angle of attack is the second most important flight parameter for sustaining the flight. However, it was considered that most of the flight is under automated control anyway, and the pitch angle is more important to the pilots, and two angles both on the longitudinal channel might confuse the pilots. It was the Air France 447 accident with an Airbus A330 (2009), which triggered the come back of the AOA in the cockpit display, as a recommendation from the French Bureau of Investigations (BEA). In the Lion Air 610 accident, the display of the AOA in the cockpit could have helped the pilots to understand what is going on with their aircraft, visualizing the inconsistent indication from the faulty sensor.

Boeing are and will remain very safe airplanes. What happened in Indonesia and Ethiopia mark a teething trouble with a new MAX technology. The technical innovations come with this heavy toll, of human life. In aviation though, no accident or incident is left purposeless. The aviation system will learn from these mistakes. I trust that MAX will recover the momentarily lost grounds on safety, and we will fly it with unprecedented safety performance, many years from now.

Octavian Thor Pleter

[1] Up to the go to press moment of this article, EASA, British CAA and other national authorities joined the Chinese in grounding the 737 MAX aircraft