Bringing Back the Max

The JATR comprised 28 members, including from the FAA, NASA and nine other civil aviation authorities: those of Australia, Brazil, Canada, China, the European Union, Indonesia, Japan, Singapore and the United Arab Emirates. These are all states that will be crucial to the future of commercial aviation, and include most airliner-producing nations, with the exception of Russia.

Meeting in person three times between May and September 2019, the JATR was headed by Christopher Hart, a former chair of the US National Transportation Safety Board, the US crash investigation body independent of, and often critical of, the FAA.

The JATR report — available online in PDF format; search for “FAA JATR report” — made twelve multi-part recommendations across four topics: the certification process, the integrated approach to development and certification, the impact of design changes on operations and training, and post-certification activities.

These are complicated and in-depth recommendations, and they are explained in detail in the JATR report, which was highly critical of the FAA and the way it conducted its certification work.

Ultimately, Boeing must satisfy all these safety regulation authorities, and others — as well as other parties including its airline customers, unions for crew in the flight deck and cabin, government stakeholders, and of course the travelling public — that it has properly identified what went wrong with the MAX, and has a plan to fix it.

It will be a brave regulator that takes the first action to sign off on the MAX

THE PROSPECTS AND TIMESCALES FOR RECERTIFICATION REMAIN SLOW

In its most recent update on the MAX, Boeing cited five key milestones it must achieve before the MAX returns to service:
1. FAA eCab Simulator Certification Session: A multi-day eCab simulator evaluation with the FAA to ensure the overall software system performs its intended function, both normally and in the presence of system failures.

2. FAA Line Pilots Crew Workload Evaluation: A separate, multi-day simulator session with airline pilots to assess human factors and crew workload under various test conditions.
3. FAA Certification Flight Test: FAA pilots will conduct a certification flight(s) of the final updated software.

4. Boeing Final Submittal to the FAA: After completion of the FAA certification flight, Boeing will submit the final certification deliverables and artifacts to the FAA to support software certification.

5. Joint Operational Evaluation Board (JOEB) Simulator Training Evaluation: The Joint Operational Evaluation Board (JOEB), a multi-regulatory body, conducts a multi-day simulator session with global regulatory pilots to validate training requirements. Following the simulator session, the Flight Standardization Board will release a report for a public comment period, followed by final approval of the training.

Boeing says that it completed the eCab simulator session in early November, but the remaining line items remain to be completed.

Crucially, this work has to be done over the busiest time of the year in the United States, with the late November Thanksgiving break taking people away from the office, as well as the December festive holidays and the lead-up into New Year’s celebrations, with southern hemisphere summer travel also to consider.

While people in the United States generally do not take the same amount of holiday time as in other developed countries, clocks have been ticking, and of course regulators around the world must also scrutinise and decide on the results. By the time this magazine publishes it will be clear whether or not Boeing has been successful in its aims to have the aircraft back in the air in 2020.

Further, once Boeing completes its work the process has, to a very real extent, only just begin. Regulators, airlines, pilots, maintenance engineers and many others need to review the changes, understand them, challenge them and potentially go back to Boeing to discuss any further changes that they desire. These must then be harmonised with the rest of the industry — no small feat in and of itself.

BOEING IS UPDATING MCAS, LARGELY TO FIX THE AOA
DISAGREE ISSUE

The primary work required for the MAX concerns MCAS, the Maneuvering Characteristics Augmentation System, both in terms of how the system works, how pilots interact with it, how information is provided to them while in the flight deck, and how they are trained to use it.

A somewhat uncomfortable truth about the two crashes of the 737 MAX is that the MCAS software largely operated as designed. The fundamental problem was in its design, primarily that the angle-of-attack (AOA) information triggering its activation, both initially and repeatedly, was incorrect. If the right information isn’t fed to the software, it won’t calculate the right course of action to take.

As a result, Boeing is changing MCAS to require further redundancy.

“Boeing has developed an MCAS software update to provide additional layers of protection if the AOA sensors provide erroneous data,” the company explains. “The software was put through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration (FAA) representatives on board as observers.”

Delving more deeply, these layers of protection are primarily threefold. Firstly, says Boeing, the “flight control system will now compare inputs from both AOA sensors. If the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate. An indicator on the flight deck display will alert the pilots.”

Further, “if MCAS is activated in non-normal conditions, it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs.”

Lastly, says Boeing, “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column. The pilots will continue to always have the ability to override MCAS and manually control the airplane.”

But the work to fix MCAS seems to be incomplete and snowballing somewhat, to the extent that at least one regulator is asking whether MCAS can be removed entirely from the MAX, which would require the issues that required it to be addressed in another way.

In a late November email entitled “737MAX – Better off Without MCAS”, first reported by the New York Times, Jim Marko — Transport Canada Civil Aviation’s Manager, Aircraft Integration & Safety Assessment — writes that he has “been troubled by the continuance of open issues, and new issues constantly appearing, on our favorite topic”, presumably the MAX in the email’s subject.

Damningly, Marko worries that, “judging from the number and degree of open issues that we have, I am feeling that final decisions on acceptance will not be technically based”.

Marko highlights concerns about the robustness and completeness of oversight: “are we all smart enough to think that we have wrapped a net around anything that can go wrong from hereon in?”

Indeed, there is some logic in rethinking the system, and not just in pure safety terms. It would behove Boeing to make the MCAS name in favour of something less already problematic, regardless of what happens to the actual system itself. It would certainly be a strange move to continue to use the MCAS name on other aircraft in the future.

The work to fix MCAS seems to be incomplete and snowballing somewhat…

RETURNING TO SERVICE ISN’T JUST ABOUT RECERTIFICATION: IT’S ABOUT GETTING ALL THE MAXES BACK IN THE SKY

Once the aircraft itself is recertified as safe, that is only the start. Boeing acknowledges that it needs to develop “comprehensive proposed training with global regulators”, while also assuring the wide variety of interested parties that its plans to train crew on the changes to MCAS — indeed, on MCAS at all — are robust enough to assure the safety of passengers, crew and people on the ground.

But hundreds of 737 MAX aircraft, both those already delivered to airlines and lessors and those parked prior to delivery, are stored across the world and have been since the aircraft was grounded March 2019. These aircraft must be inspected and necessary maintenance actions performed before they can return to service, and capacity in maintenance, repair and overhaul (MRO) facilities is constrained.

Indeed, as the FAA said in a recent letter to Boeing, the “large number of new 737 MAX airplanes currently in storage presents a number of challenges for airworthiness certification, production, and delivery which significantly exceed any that the Boeing system has previously experienced”. It will thus, it says, be taking a greater role in recertification of aircraft.

In any case, it will take months upon months for even the already-delivered MAXes to return to the sky. Boeing’s discussions with airlines and lessors will be fraught, and some assessment of the initial direct costs will start to become clear.

Every individual airline operator will want to be assured beyond the shadow of a doubt, not only that the MAX as a whole is safe, but that all of their particular MAX aircraft are fully up to code in every conceivable way. Negotiations with labour unions, particularly in the United States where the Southwest Airlines pilots’ union has been highly critical of Boeing, will also take time.

No pilot, and no airline executive, wants to be in charge of the first 737 MAX to suffer a serious technical issue, and with the amount of aircraft already produced it seems statistically unlikely that all sailing will be smooth.

It is almost assured that the first MAX to divert as the result of what would in any other aircraft be an unremarkable technical issue will be the subject of live reports, online tracking, helicopter overheads and instant speculation from the world’s media. As much as one might prefer that not to be the case, aviation must deal with that reality.

Once the aircraft itself is recertified as safe, that is only the start…

WILL PASSENGERS EVER AGAIN TRUST THE MAX?

Flying has always been an emotional experience for passengers. We see this in any number of ways: the fear of flying, or the heightened emotions seen at airports that one rarely sees at a train station, or the levels of disruption that exceed those on other forms of transportation.

Modern aviation has no parallel to inform us of passengers’ reactions to being told, probably in a matter of months, that they will be flying on a 737 MAX. The nearest parallel is the Douglas DC-10 forty years ago, but the decades between have led to a world almost unrecognisable in its approach to nearly everything.

In an era where people have been maliciously persuaded that childhood disease vaccinations are unsafe, when genocides spread via social media, when information flows can be easily manipulated, is aviation truly ready to take into account an entirely new type of human factor?

Viral videos of weeping and wailing passengers at airports decrying airline agents for making them get on the “death plane” are by no means beyond the realms of imagination. Threads of customer service refusals to accommodate passengers will be a terrible look for an industry that has, let us not forget, proven itself unable properly to ensure the MAX was safe the first time round.

Wise airlines will quietly allow change fee waivers for passengers scheduled on the MAX, or who find themselves rescheduled onto the aircraft. It would not be hugely surprising if, under political pressure, some regulators required that for a certain amount of time.

Some airlines may avoid telling passengers at all, removing the MAX name from passenger-facing display and leaving it perhaps with a “Boeing 737” or even “Boeing jet”.

It seems more than likely that Boeing will change the brand name of the MAX, and if it doesn’t then expect its airline customers to do so: goodbye 737 MAX 8, hello 737-8.

This customer-side renaming has already started. IAG, the airline group that owns British Airways, Iberia, Aer Lingus, Vueling and Level (and now Air Europa), ordered 200 aircraft at what must have been an unprecedented discount at the 2019 Paris Air Show at Le Bourget. “The mix of 737-8 and 737-10 aircraft would be delivered between 2023 and 2027 and would be powered by CFM LEAP engines,” read the IAG statement at the time.

Ryanair, too, saw some of its 737 MAX 8 200 aircraft, the “200” denoting a special high-density version with supplementary emergency exit capacity, sporting 737-8200 nose titles instead of the 737 MAX titles seen previously as they headed off to storage in Washington.

Some industry insiders pointed out that the 737-8200 (and indeed 737-8 and 737-10) model numbers are not entirely new. This is correct: Boeing has used them as internal model specifiers in the same way that McDonnell Douglas’ MD-80 series was actually the DC-9 Series 80. But with the visible changes, and indeed the amount of money spent on the MAX brand by Boeing and airlines, it would be absurd to claim that this was not indeed a renaming.

This sort of more-knowledgeable-than-thou rules-lawyering, while perhaps tempting from some points of view of those of us in the industry, must be avoided in dealing with the public. So must any derision or dismissiveness of passengers who refuse to fly the MAX once it does return to service.

It is not unreasonable for passengers to be afraid of flying an aircraft that regulators said was safe but was then so tragically proven not to be. It is not unreasonable for passengers not to trust that its manufacturer and its regulators have got it right the second time around.

And it is not unreasonable for people to expect that airlines will take these concerns into account.

RESTORING FAITH IN THE FAA
The JATR recommendations, in summary, suggest that the FAA:

– work with other regulators to review the notionally (but clearly flawed) harmonised way changed aircraft, as opposed to new aircraft, are certified

– take a top-down approach to these rules around changed aircraft, where each proposed change to the aircraft should be considered as part of the whole rather than separately

– develop new criteria to ascertain when “core attributes” of an older design make it unable to meet modern safety requirements, and therefore require either changes to the design or a wholly new type certificate

– update out-of-date certification procedures, regulations and guidance

– review whether the 737 MAX complies with several parts of the regulations around flight guidance systems, general flight and stall demonstration, and ensure that its guidance is being applied consistently

– update the guidance around type certification process, with the goal of ensuring the FAA understands the aircraft design, the design assumptions behind it, and the implications of any changes in the design where “changed product” rules are being used

– add “feedback paths” to make sure that the key areas of compliance, flight safety, and flight deck/human factors are taken into consideration throughout the development and certification of the aircraft

– review the Boeing Aviation Safety Oversight Office, particularly ensuring that there are enough engineer staff “to adequately perform certification and oversight duties, commensurate with the extent of work being performed by Boeing”

– ensure that staffing levels are enough so that “decisions to retain responsibility for finding compliance are not constrained by a lack of experienced engineers”

– review the Boeing Organisation Designation Authorisation in order to make sure that the members of its engineering unit are not unduly pressurised when taking delegated decisions on the FAA’s behalf, including adding communication lines to FAA engineers responsible for certification that do not open up Boeing employees to punitive action, process violations or the fear of the same

– promote a culture of safety that “drives a primary focus on the creation of safe products, which in turn comply with certification requirements”

– assess aircraft functions as a whole, considering the entire aircraft, rather than in what the JATR called “an incremental and fragmented manner”

– integrate the process of safety analysis, particularly ensuring that manufacturers put in place safety systems separate to their design functions

– emphasise and highlight both human factors and human system integration within the process of certification, review the policies and guidance of these topics, and dedicate extra resources to doing so

– ensure that manufacturers are applying best practices from across the industry when it comes to development assurance, particularly for requirements management, assumptions visibility, process assurance and configuration management

– promote these best practices across the industry, especially around development assurance and the integration of aircraft functions and systems

– require that operational and certification functions be integrated during the process of certification, and mandate that it be provided with details of the way that systems of related aircraft differ, in order that it can properly scrutinise operational impact, systems integration and human performance

– mandate a documented process when ascertaining which information should be included in manuals, including the Airplane Flight Manual, the Flight Crew Operating Manual, and the Flight Crew Training Manual

– review training processes and programs to make sure that pilots can handle mis-trim events in particular

– conduct a study to scrutinise whether the policy, guidance and assumptions used for maintenance and ground handling training are adequate

– review policies around how it analyses safety risk and issues interim airworthiness directives in the wake of fatal transport aircraft accidents, including that it “ensure that it shares post-accident safety information with the international community to the maximum extent possible”.