Boeing 737 MAX safety not yet reassuring
Boeing remains to be in hot waters. After an unprecedented presentation by European Union Airline Safety Agency (EASA), the head of this organization Patrick Ky expressed skepticism of Boeing/FAA safety standards and pledged a tougher stance on ungrounding the deadly Boeing 737 MAX,
FlyersRight.org was granted an exclusive interview.
FlyersRights: With MCAS (Maneuvering Characteristics Augmentation System), Boeing has apparently added a form of envelope protection to the 737 MAX. We believe that MCAS is implemented in the Rockwell-Collins EDFCS-730 autopilot/flight control computer(s) (FCC). The architecture of the 737 MAX FCC appears to be considerably more primitive and limited when compared to the architecture of the A320neo envelope protection system. Particularly in the areas of sensor redundancy, self-diagnosis and software heterogeneity (we believe the software is single-sourced).
Additionally, the automation philosophy between the 737 and the A320neo appears to differ in that the A320neo system incrementally gives more control to the pilots, through flight control law progression, in response to system fault and/or failure. The MCAS system does not appear to operate on the same principle.
What, if any, effects on EASA’s certification process might the above have?
EASA: An aircraft is certified based on the demonstration that its design complies with all relevant airworthiness requirements and all features are safe. Our airworthiness requirements are not prescriptive. Depending on the technology and system architecture used, aeroplanes can meet the safety objectives differently. Therefore, we would not compare aircraft to each other, rather assess how they comply with the requirements.
We believe that the master minimum equipment list for the A320 series does not allow flight if any of the heaters for the three angle of attack sensors are inoperative. The master minimum equipment list for the 737 MAX appears to allow flight if either or both of the two angle of attack sensor heaters is inoperative.
FR: The nature of the 737 MAX’s airframe stability with MCAS disabled is unknown. If EASA determines that the 737 MAX airframe is unacceptably unstable with MCAS disabled what effect could that have on pilot training requirements? In particular, could a MCAS failure in-flight constitute an emergency situation?
What, if any, effects on EASA’s certification process might the above have?
EASA: Aircraft longitudinal stability is subject to airworthiness requirements. Boeing has to demonstrate compliance of the 737 MAX airframe with these requirements. Consequences of failures of systems affecting potentially the aircraft stability need to be assessed using acceptable safety analysis methodology also subject to airworthiness requirements. Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint.
We believe that Boeing largely or entirely self-certified the 737 MAX airframe, including the flight control computer software, under the FAA’s Organization Designation Authorization (ODA) program.
FR: What is EASA’s position on self-certification? Going forward, will EASA view the airworthiness of US aircraft certified under the ODA system as equivalent to aircraft certified by the FAA, using its own personnel?
EASA: Some investigations are ongoing on the certification process followed by the FAA in the case of the B737 MAX. EASA do not wish to comment on the presumable “self-certification” or on the level of delegation to Boeing that the FAA has granted.
FR: Boeing and a US Advisory panel have taken the position that software-only changes are needed. Specifically, that no hardware changes, no aircraft redesign and no pilot retraining on full-motion MAX simulators are necessary to unground the aircraft. Does EASA agree?
EASA: Our design review is not completed yet and we have not reached a conclusion yet on that matter.
FR: We understand that MCAS and flight automation are not just used in emergency situations but routinely engaged to fly the plane and mask inherent instability in the design. It is unclear if these systems are disabled or turned off. How difficult it will be for pilots to fly the MAX manually without these systems?
Will EASA be flight-testing the MAX using its test pilots with MCAS and flight automation disabled, or rely on Boeing and FAA testing?
EASA: EASA has set requirements for flight and simulator evaluation with 70 test points to be evaluated, covering both normal and abnormal operations. The simulator evaluation was performed in June and July.
Among the next milestones are flight tests performed by EASA on a modified Boeing 737 MAX that will last a full week.
Google News, Bing News, Yahoo News, 200+ publications
FR: At a June 19th US Congressional House Aviation Subcommittee hearing on the 737 MAX, Captains Sullenberger, American Airline chief pilot and union head Dan Carey and Randy Babbitt, a former FAA head and experienced pilot, all testified that much more pilot simulator training was needed, that the FAA and airlines have cut back on pilot simulator training, that pilots needed to master about 100 emergency conditions and the manual instructions often had pilots performing tasks that are unrealistic.
What is the EASA position on pilot simulator training for Emergency conditions?
EASA: Our review of pilot training requirements is not completed yet and we have not reached a conclusion yet on that matter.
FR: The MAX is not rated to use high altitude airports in hot weather, but was allowed to take off at such an airport in Ethiopia using a long runway at a very high speed that made the plane impossible to manually control the March 10 crash.
What is EASA position, if any, on restrictions of planes in hot weather especially at high altitude airports?
EASA: Investigation of the accident is on-going and we do not wish to comment on this. Airplanes are certified with an operational envelope and with limitations on the weather conditions and airfield altitude for take-off.
FR: There are very few full-motion MAX simulators, but many Regular 737 simulators. It is unclear whether the regular 737 simulators can be modified to mimic the MAX.
Do EASA or Mr. Ky have an opinion on this? If not, what does EASA plan to do to ensure that all MAX pilots have required and necessary simulator training?
EASA: Flight crew training does not systematically require training sessions on flight simulators specific to the aircraft model. It is not unusual that, depending on the differences between two models, flight crews are trained on a flight simulator not specific to the model (in this case it would be a B737 NG flight simulator) and then a computer-based difference training is provided in addition. This has been shown to be acceptable and effective in a number of cases. In the case of the B737 max, our review of pilot training requirements is not completed yet and we have not reached a conclusion yet on that matter.
Just as the FAA is considering Boeing’s proposed software fixes for the 737 MAX – the EU has other plans.
Europe’s Aviation Safety Agency (EASA) has criticized the FAA for what it describes as a lack of clarity and transparency for allowed Boeing to assess the safety of certain flight-control features.
Not Reassuring The Flying Public
Americans mostly trust airlines have done their due diligence to accommodate safe travel. But, little do they realize the FAA delegates safety standards, and “self-certification”, which allowed Boeing to self-regulate critical functions such as the software behind both fatal 737 MAX crashes.
During the summer, most experts could not have imagined rolling into the fall season without any resolution or sense of when it will be fixed. Many airlines have pushed back their MAX schedules to January 2020.