Boeing engineers and test pilots considered before two fatal 737 MAX crashes whether an anti-stall system should be redesigned after discussing how flawed data from a single sensor could trigger it repeatedly, U.S. investigators have found.
The so-called MCAS system, which relied on one sensor, has been linked in part to crashes of 737 MAX jets flown by Lion Air and Ethiopian Airlines, which triggered a worldwide grounding and a corporate crisis at the world’s largest planemaker.
The potential redesign discussed during 737 MAX development was ultimately ruled out, based in part on the assumption pilots would react in time to any malfunction, according to a National Transportation Safety Board report to Indonesian investigators.
Although not formally part of the required analysis, the Boeing staff discussed the scenario of repeated activation of MCAS due to erroneously high Angle-of-Attack data and considered whether a redesign was necessary, the NTSB report said, citing a 2019 presentation by Boeing to the agency.
“As part of this discussion they discussed the combined flight deck effects … but determined that no redesign was necessary,” the NTSB said of the Boeing discussion, referring to alerts that could be potentially distracting to pilots.
Later, in a review after the Lion Air 737 MAX crash last October which killed all 189 people on board, Boeing also found that presenting the scenario to regulators would not have led it to classify the anti-stall system as a bigger hazard at the time.
Boeing has redesigned the system to rely on more than one sensor and help reduce pilot workload as it strives to return the model to the air.
The fresh details of the design of the MCAS system from the NTSB are included in a final report by Indonesian officials into the Lion Air crash. The NTSB has been supporting the Indonesian-led probe.
Reuters obtained a copy of the overall report, due to be released publicly later on Friday or on Saturday.
In a statement on Friday, Boeing said it had redesigned the system so MCAS would in future compare information from both Angle-of-Attack sensors before activating and would be easier for pilots to over-ride.
“These software changes will prevent the flight control conditions that occurred in this accident from ever happening again,” it said, declining further comment.
RELATIVELY SIMPLE
Boeing had assumed pilots would recognize the plane’s uncommanded nose-down movement within the three seconds required by regulators, making it relatively simple to restore the aircraft to a normal position, according to the final report.
The manufacturer did not consider what would happen if a pilot reacted more slowly, leaving MCAS able to move the nose down by the system’s maximum allowable amount. In the Lion Air crash, it took the pilot 11 seconds to respond to the first movement, during which the system reached the maximum authority.
Indonesian authorities recommended Boeing make more allowance in the design of its jets for the reactions of normal pilots, rather than its exceptionally skilled test pilots.
Boeing, which did not describe the MCAS system in pilot manuals, thought pilots would quickly perform a checklist to deal with a problem called “runaway stabilizer”, for which they were already trained and which resembled the impact of MCAS.
However, the report found that MCAS did not behave in the same manner as a typical runaway, as the movement was not continuous and pilots were able to counter it multiple times by pulling back on their control columns.
At the same time as the aircraft was moving nose-down, making it difficult to control, the pilots were faced with a cascade of alerts as they tried to diagnose the situation.
“The flight crew were running out of time to find a solution before the repetitive MCAS activations placed the aircraft in an extreme nose-down attitude that they were unable to recover from,” the report said.