The feature in question, the Maneuvering Characteristics Augmentation System (MCAS), was designed to prevent stalling after Boeing moved the engines on the wings of the latest model of its 737 to compete with more fuel-efficient Airbus planes. Investigators say the MCAS system instead contributed to crashes in Indonesia and Ethiopia that killed 346 people.
Flawed information from a single external sensor fed into the system, causing it to repeatedly push down the planes’ noses as pilots struggled to keep the jets in the air before both crashes, investigators said.
DeFazio said it was “inexplicable” that the feature — critical for passenger safety — was vulnerable to a “single point of failure,” something that is unacceptable in the aviation industry. He said Boeing’s answer, in a meeting following the first crash in Indonesia on Oct. 29, was that the pilots were the backup system. But pilots did not know MCAS existed, he added.
The corporate and government decisions that led to that disconnect are central to ongoing investigations into the Max crashes, and the origins of those decisions rest in the critical minutia of engineering and certification.
DeFazio said an early version of the MCAS system was “relatively mild.”
It would only automatically adjust part of the plane’s horizontal stabilizer by 0.6 degrees, he said, and it would not repeatedly override a pilot’s commands. That version of MCAS was in Boeing’s flight manual, DeFazio said.
But then Boeing engineers dramatically increased that maximum movement to 2.5 degrees, DeFazio said. That gave MCAS much more potency to correct for a stall, but also more power to overtake pilots in the case of an errant sensor reading, as happened as part of both crashes. The Seattle Times reported the change in maximum power days after the Ethiopian Airlines crash.
Then, Boeing asked the FAA about removing MCAS from the manual, DeFazio said.
“So how could the FAA agree to that? Did they understand what it did? Did anybody understand what this would do?” DeFazio said. “I don’t think the implications were fully known.”
The FAA said in a statement that it would not have expected to see MCAS “specifically addressed” in the manual because it is software code that runs “in the background as part of the flight control system.” Although they often do, manufacturers are not required to consult with the FAA on what goes into their flight manuals, the FAA statement said.
And the FAA determined that if something went wrong with MCAS, and it mistakenly started forcing the plane’s nose downward, pilots would recognize that as a general “runaway stabilizer trim” issue.
That’s a reference to the horizontal stabilizer on the plane’s tail, which can be adjusted to make the aircraft climb or descend. The FAA said the existing “emergency procedure for which pilots are trained will stop the action of MCAS.”
But pilots who testified before the House aviation subcommittee on Wednesday said the terror and tumult of such a moment would defeat many of the world’s best-trained pilots.
“I think that it’s unlikely that other crews would have had very different experiences or performed very differently than these crews did on their accident flights,” said Capt. Chesley B. “Sully” Sullenberger III. “I can tell you firsthand that the startle factor is real, and huge.”
Sullenberger, who prevented disaster in 2009 by crash landing his flight in the Hudson River, said the Indonesian and Ethiopian pilots were confronted with “sudden loud, and in some cases, false warnings, creating major distractions masking the cause.”
During a recent 737 Max simulator recreation he experienced, “even knowing what was going to happen, I can see how crews could have run out of time before they could have solved the problems,” Sullenberger said. Pilots should go through similar, immersive simulator training before Max jets fly again, he said. The FAA has yet to decide what training will be required.
Boeing said it increased the power of the MCAS feature to apply the anti-stalling benefits to lower speed portions of flights, such as during take off, the FAA said.
“At lower speeds, greater control movements are often necessary,” the FAA said. “The change to MCAS didn’t trigger an additional safety assessment because it did not affect the most critical phase of flight, considered to be higher cruise speeds.”
Boeing did not answer questions about its decision-making on the MCAS feature or flight manual, or what information it provided to regulators in making its case.
“The FAA considered the final configuration and operating parameters of MCAS during MAX certification, and concluded that it met all certification and regulatory requirements,” Boeing said in a statement. The company is “working closely with our industry partners to learn from these tragedies, answer their questions, and take steps to re-earn people’s trust and ensure accidents like these never happen again.”