Boeing CEO Dennis Muilenburg, ramping up the company's defense of the 737 MAX, insists that the grounded aircraft was designed and certified to the company's standards, and suggested that too much faith may have been put on pilots' ability to recognize failure modes tied to the aircraft's maneuvering characteristics augmentation system (MCAS) that is the focus of two fatal 737-8 accidents.
"We've gone back and looked at both accidents," Muilenburg told reporters following Boeing's annual shareholders meeting in Chicago April 29. "We've done deep assessments of the airplane and the design and we've confirmed that the MCAS system as originally designed did meet our design and safety analysis criteria and our certification criteria."
MCAS's operation during the October 29, 2018 Lion Air Flight 610 accident and March 10, 2019 Ethiopian Airlines Flight 302 accidents is a focus of both investigations. In each case, a single source of faulty angle-of-attack (AOA) data activated the flight-control law, which provides nose-down inputs in certain flight profiles.
In both accidents, the pilots needed the aircraft to climb, but MCAS—triggered by AOA data that said the aircraft's nose was too high—pushed the nose down by moving the horizontal stabilizer. Neither crew was able to override MCAS and maintain altitude, and both aircraft eventually dove to impact. All 346 people onboard both flights were killed.
While Boeing is updating MCAS to eliminate the system's inadvertent activation and ensure pilots can always override it with control-column input, the company continues to suggest that pilots' failure to identify and react to MCAS's inputs contributed to the accident.
"When we design a system, understand that these airplanes are flown in the hands of pilots, and in some cases, our systems safety analysis includes not only the engineering design but also the actions that pilots would take," Muilenburg said.
Boeing's safety analysis determined an MCAS failure would be recognized as runaway stabilizer, and the applicable checklist, which includes a step for de-powering the automatic stabilizer trim motor, would be followed. But neither the Lion Air nor Ethiopian crews followed the checklist step-by-step. The Ethiopian crew followed some of the steps, including de-powering automatic trim, but then re-activated it.
"If you look through that checklist, it calls out actions that would be taken around power management and pitch management of the airplane" he said. "It also refers to the cutout switches that, after an [MCAS] activation that was not pilot induced, that you would hit. In some cases, those procedures were not completely followed."
MCAS's inclusion in the MAX flight control logic was not communicated to pilots until after the Lion Air accident. Boeing assumed the system would stay in the background, and its failure would be quickly recognized as a runaway stabilizer, leading pilots to de-activate the system. But the two accident sequences suggest this assumption was wrong.
Changing MCAS lessens the likelihood that pilots will face an MCAS-related system failure, Muilenburg said.
"There are factors that we can control in the design, and in this case that common link is related to the MCAS system and its activation," he said. "We're going to break that link and this will prevent accidents like this from happening again."
Muilenburg also downplayed the significance of not making an flight-deck AOA data error warning indicator standard on the MAX, as it was on previous versions of the 737.
"It's not something that drives pilot action," he said. "It's not something that we designed in as a primary flight display in the flight deck of a commercial airplane. What pilots care about are things like altitude airspeed, heading, pitch and roll. That's what they fly. Those indicators are in the flight deck today. Airspeed and altitude in particular are the relevant items around these two cases."
Neither the Lion Air nor Ethiopian aircraft had an upgraded package that includes the AOA disagree warning. The package will become standard on the MAX, and be retrofitted for airlines that want it.
The Wall Street Journal reported that the AOA disagree warning's removal as a standard item was not made clear to 737 operators adding the MAX. Southwest Airlines did not have accurate information in its manuals for a year, the report said. FAA and several Congressional committees are investigating the MAX's certification, as well as FAA's overall approach to approving new aircraft.
Muilenburg did not offer an update on the MCAS software modification timeline. All 370 MAXs have been grounded since mid-March, following the Ethiopian crash. Most airlines have removed the aircraft from their schedules until into August while Boeing develops MCAS modifications and new training.
Getting the aircraft back into service could require up to a month from the time regulators removed their operations bans. FAA could remove its ban by early June, but at least some other regulators are expected to conduct prolonged assessments of the MAX changes and related training.