We look at the lessons learned from the Boeing 737 MAX 8 disasters By Joji Waites, BALPA Flight Safety Specialist READ MORE A better future One 737 pilots opinion As the MAX variants return to service edges ever closer, it would be fair to say that discussion of the grounded airliner still remains taboo. Like an elephant in the room, its arrival in conversation splits opinion among pilots and cabin crew alike. Whether its my husband/wife doesnt want me flying it, or itll be the safest plane in the sky, the tragedies behind the aircrafts grounding are at the forefront of most crews minds. Some feel like guinea pigs, awaiting their turn to trial the aircrafts suitability to return to service (after all, the MAX was tested sufficiently to achieve certification in the first place). The few among us who had the pleasure of flying the MAX before its grounding largely speak in its favour; fuel efficiency light years ahead of the NG, and its clear displays improving situational awareness hugely. To them, its grounding was a hindrance. All its mod-cons were gone and they were back to flying the older NG. Alas, for the crews and passengers of ET302 and JT610, the undeniably flawed airliner sealed their fate. The now infamous MCAS system that played a key part in the tragic loss of life was an oversight in Boeings differences training an oversight that will now have to be addressed and corrected if it is to gain the trust of its crews, let alone the fee-paying passengers. onday, 29th October 2018 and Sunday, 10th March 2019 are indelible dates in the history of civil aviation safety, as they denote the tragic loss of 346 lives in accidents involving almost new Boeing 737 MAX 8 aircraft, operated as Lion Air Flight 610 and Ethiopian Airlines Flight ET302. Like the earlier DC-10 and Comet accidents, they will probably be viewed as landmark events from which a step-change improvement in how safety is conducted should arise. This article examines whether the global aviation system is up to the task. The final investigation report for Flight 610 has been published while, at the time of writing, the investigation into Flight ET302 is ongoing (although an interim report has been released). It became apparent soon after the second accident that the investigative focus was on a specific system, unique to the MAX, called the manoeuvring characteristics augmentation system, or MCAS. Given that MCAS appeared to be a common factor in both accidents, the decision was taken by aviation authorities to suspend all operations of the MAX, and it has not flown commercially since 13th March 2019. The key issues MCAS was designed to demonstrate compliance with a certification rule. However, its design and implementation were both flawed. The full scope of MCASs functionality was not clearly disclosed by the aircraft manufacturer to the US Federal Aviation Administration (FAA), airlines and, crucially, pilots1 to avoid additional, more expensive, certification demands and simulator training, which would put the MAX at a disadvantage to its Airbus rival. Consequently, the aircraft received a lower level of regulatory rigour than the significance of the design changes arguably warranted. This situation was exacerbated by flaws in the execution and oversight of the certification process that allowed certain tasks to be delegated by the FAA to the manufacturer a classic case of regulatory capture.2 Among the various design flaws, the key shortcoming was that MCAS activation was reliant on the input from just one of the aircrafts two angle of attack (AOA) sensors. If the selected sensor is reading incorrectly for example, because of damage or miscalibration, as was the case with Flight 601 then MCAS can trigger erroneously. This problem was further exacerbated by a system glitch that meant an alert (the AOA disagree) on the aircrafts primary flight display, which was intended to notify pilots of discrepancies in AOA readings, did not function correctly. A software error meant the AOA disagree function was only enabled if the customer had specified the optional AOA indicator for their aircraft. Other key issues included flawed assumptions about how pilots would respond to a spurious MCAS activation, particularly considering the multiple flight-deck alerts that would be triggered in parallel, and inadequacies in training to equip pilots with the skills and confidence to handle such scenarios. The system logic that could result in multiple consecutive MCAS activations with a resultant grossly out-of-trim aircraft was also felt to be unsatisfactory. READ MORE MCAS: a quick recap What has been done? There has been considerable activity in the process of returning the MAX to service, including: proposed aircraft design changes; certification test flights; the Joint Operational Evaluation Board (JOEB) process, involving civil aviation authorities from the US, Canada, Brazil, and the European Union Aviation Safety Agency (EASA); and publication of regulatory documents, such as the FAA draft airworthiness directive (AD) and Flight Standardization Board report, which details the new training requirements arising from the JOEB process. BALPA contributed comments as part of the FAA public consultation for both documents. The proposed design changes include: new flight control computer software with revised control laws that require input from both AOA sensors to activate MCAS; comparison of AOA sensor inputs to detect a potentially failed sensor (which would then disable the speed trim system, including MCAS); a maximum of one MCAS activation for every high AOA event; and a limit on the magnitude of any MCAS command, such that the flight crew would still be able to control the aircraft pitch solely by using the control column. The AOA disagree alert will also be enabled correctly on all aircraft. Other improvements include revised checklists and a requirement for operators to conduct an AOA sensor system test and an operational readiness flight before returning each aircraft to service. There will be additional ground and flight training, covering the revised checklists, MCAS functionality, and demonstration of MCAS activation and associated failure modes. BALPA wants a review of the triggering of cockpit warnings on the MAX The 737 Max 8 was grounded in March 2019 There are systemic issues with pilot training, certification and regulation still to be resolved EASA has performed an independent design review of the flight-control system design and associated functions/systems, including the displays, alerting system, autopilot, and air-data system. One of its significant observations was a preference for a third AOA sensor to be installed. However, this is likely to be a requirement for MAX 10 certification rather than a prerequisite for the MAX 8s return to service. Similarly, Transport Canadas requirement for a means to cancel a spurious stick-shaker activation will probably be implemented on the MAX 10. Still much to be achieved READ MORE Viewpoint While the proposed airworthiness and training-related changes go a significant way to addressing the specific shortcomings of the MAX, there are still fundamental systemic issues associated with aircraft certification, pilot training and regulation to be resolved. The MAX accidents have triggered several high-level reviews, in addition to the formal accident investigations for example, the Joint Authorities Technical Review Panel and the US House Committee on Transportation & Infrastructure on the Boeing 737 MAX most of which have made recommendations. It will be interesting to see how the FAA and Boeing respond to these recommendations, and the effect they will have on safety regulation. BALPA feels strongly that future substantial aircraft design changes should result in certification as a new type, with a commensurate level of training for pilots. This training should equip pilots with the operational knowledge and skills to transition from one aircraft type/variant to another, and to handle all emergency scenarios comprehensively and with confidence. It is also felt that fundamental aircraft flying or handling quality deficiencies should not be masked by flight-control augmentation systems, but, instead, should require aerodynamic redesign from the outset, wherever possible. Above all, the piloting community needs to be able to trust regulatory authorities to act independently and thoroughly, and to enforce their regulations robustly so that commercially driven decisions cannot adversely impact safety again. As part of its safety strategy for 2021, BALPA will use its Most Wanted Flight Safety Improvements to lobby aviation authorities to: Require that fundamental aircraft flying or handling quality deficiencies are designed out and not masked by flight-control system augmentation Require that substantial aircraft design changes result in certification as a new type, with a commensurate level of pilot training (through a review of the changed product rule and associated guidance material, for example) Require that no aircraft system be reliant on just a single input of a critical data source (such as a single AOA sensor) Require at least three AOA sensors to be fitted to transport-category aircraft Review the logic for triggering and cascade of cockpit warnings/alerts in the event of a single faulty sensor to avoid overloading flight crew with multiple actions Review the assumptions made about the efficacy of pilot interventions as a mitigation for system failures, particularly in terms of timeliness and consistency of response Review training requirements to improve pilots ability to diagnose and manage complex technical failures Review the efficacy of type rating training, to suitably equip pilots with the operational knowledge and skills to transition from one aircraft type/variant to another, and to handle all emergency scenarios comprehensively and with confidence Require that descriptions of aircraft technical systems, such as MCAS, are included in aircraft operational documentation such as the FCOM (and not hidden from flight crew) Review the level of validation work required to accept the certification decision of another regulatory authority (based on the significance of the certification task) Review the effectiveness of oversight arrangements for design organisation approvals, particularly where organisation designation authorisation arrangements are in place, and ensure resilience against regulatory capture Review the in-service operational data requirements necessary to validate aircraft design and pilot performance assumptions Ensure that original equipment manufacturers cannot charge extra for aircraft equipment that demonstrably increases flight safety and arguably should be standard fit. References: 1 The crew of flight 601 had no idea of the existence of MCAS on their aircraft 2 The tendency of regulators to identify with the interest of the industry they are supposed to regulate. This occurs when a public authority charged with regulating an industry in the public interest comes to identify the public interest with the interests of producers in the industry, rather than the interests of its customers, or the general public. Oxford Reference. Flying or handling quality deficiencies should require aerodynamic redesign from the outset READ MORE MCAS: A QUICK RECAP To be competitive with the Airbus A320 NEO, the new Boeing 737 variant required larger, more powerful engines. However, because of its relatively short undercarriage, the engines had to be installed further forward and higher than ideal. This meant that, at low weight and aft centre of gravity, the engine nacelles would produce lift that pitched the aircrafts nose up slightly. This translated to the pilots as a reduction in back pressure on the yoke on approaching the stall such behaviour is contrary to the requirements of 14CFR/CS 25.203(a) Stall characteristics. So, the MCAS system was designed to give an automatic nose-down stabiliser input during elevated angles of attack when flaps are retracted, thereby ensuring positive longitudinal control force up to and throughout the stall. Grounded Boeing 737 MAX 8 aircraft fleet of Southwest Airlines, in storage at Victorville, CA