The Boeing 737 Max MCAS Bug

For decades, Airbus and Boeing have been rivals in the single aisle passenger jet market. Thousands of Airbus 320 and Boeing 737 planes have been sold to airlines around the world. In 2010, Airbus announced an upgrade to its 320 - the Airbus 320 NEO. The plane would now have a larger engine that was promised to be 15% more fuel efficient ("NEO" stood for "new engine option").

In 2011, Boeing announced its response, the 737 Max. Boeing needed four years to roll out the first Max from its Washington factory. Like the Airbus 320, the 737 Max had a larger, more efficient, engine. But the engine was too large to fit under the wing in the way it had in prior 737 models. Boeing had to move the engine up and forward and to make some other modifications. They went to this trouble because they did not want to otherwise change the body of the plane, which would have been very expensive to do.

In testing, Boeing learned that the new engine could cause unexpected lift in certain unusual high-speed conditions. With excessive lift, an airplane can stall out, an obviously intolerable problem. Boeing's fix was called the "maneuver characteristics augmentation system" - MCAS. In MCAS, two sensors that look like small weather vanes are positioned in the front of the plane. The sensors monitor the plane's movement relative to the air - its "angle of attack" (AOA). If the nose points up too much, the sensors send a signal to the flight control computer, which tells the large horizontal wing (the "stabilizer") in the back of the plane to swivel a small number of degrees. This changes air flow over the stabilizer, causing the tail to go up, and the nose to go down, thus preventing a stall. This "trim" fix worked very well in testing in the problematic high-speed situations. But later in testing, Boeing learned that the AOA problem could also occur in certain slow speed situations (such as when taking off), but the likelihood of these situations was deemed even lower than that of the high-speed situations. In fact, in the end Boeing engineers decided to have MCAS rely on input from only one sensor, not two. This lack of redundancy is allowed by the Federal Aviation Agency (FAA) when the chance of a problem occurring is very low. In March 2017, the FAA certified the plane and its documentation.

With a new plane, or one that has been extensively re-designed, the FAA requires pilots to undergo simulation training. Boeing told potential customers that the 737 Max was merely a continuation of the 737 series and that pilots could transition after watching an hour-long video. I.e., Boeing marketers assured potential customers they could avoid the cost of expensive simulation training. Deliveries to customers started in May 2017. Two hundred 737 Max's were delivered in the next 18 months, with many hundreds more on order. Boeing appeared to have re-established itself in the single aisle passenger aircraft business.

On October 29, 2018, a 737 Max owned by Indonesia's Lion Air crashed into the ocean on takeoff from Jakarta. All 189 people on board died. In the ensuing investigation, an MCAS malfunction was suspected, possibly caused by a bird striking the sensor, causing the plane to plummet into the ocean

American Airlines also flies the 737 Max. Its pilot union said that MCAS is not described in the plane's documentation and that the documentation does not tell how to override the system if a pilot suspects a malfunction: "This is the first description you, as 737 pilots, have seen. It is not in the AA 737 Flight Manual, nor is there a description in the Boeing FCOM (flight crew operations manual). Awareness is the key with all safety issues."

On November 6, 2019, the FAA issued an Emergency Airworthiness Directive. Regarding the 737 Max the FAA said "This emergency AD was prompted by analysis performed by the manufacturer showing that if an erroneously high angle of attack sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer [wing]. This condition, if not addressed, could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain". Boeing released instructions for addressing the fault.

On March 10, 2019, a 737 Max owned by Ethiopian Airlines crashed on takeoff in Ethiopia. All 157 people on board died. Investigation revealed that the MCAS lowered the plane's nose on takeoff, even though the plane was climbing properly. The pilots tried to disable MCAS. But MCAS kicked in again, lowering the nose further. The pilots reacted. This cycle happened twelve times before the plane crashed.

On March 12th and 13th, international agencies, including the FAA, grounded the 737 Max. Boeing promised an MCAS software fix by April 2019, but this has been delayed. At the time of this writing, Boeing says they plan to have the plane back in the air by December 2019.

There are now reports that Boeing increased the angle of the rear wing stabilizer deflection, in order to deal with AOA problems at slow speeds, but that Boeing chose not to tell the FAA about that change. In addition, it is unclear if Boeing told the FAA that MCAS could fire repeatedly and that the cumulative nose-down effects would hasten "impact with the terrain" (as the FAA Directive had put it). This was apparently a factor in the Ethiopian crash.

Boeing's fix will presumably use the inputs from both MCAS sensors. If one sensor sees a problem, the other will be checked. There are reports that Boeing is having trouble implementing this redundancy, because the added code causes the flight control chip to become overloaded, and unresponsive to pilot commands. The chip handles eleven in-flight processes, along with MCAS. The European Union Aviation Safety Agency now says that problems with this chip (among other problems) must be fixed before the 737 Max can fly again in Europe.

Boeing has been sued by the families of those who died in the two crashes. The U.S. Department of Justice has also sued Boeing. Recently, the Saudi airline Flyadeal cancelled a $5.9 billion 737 Max order, opting instead to buy Airbus 320 NEO's. More such cancellations are likely. The financial impact of lawsuits and cancellations will be enormous.

Questions:

1. This module lays out these standards for safety critical systems: "The process of building software for safety critical systems takes much longer and is much more expensive than for [other] high quality systems [because]: (1) it requires highly trained and experienced professionals who work closely with safety and systems engineers to ensure that the entire system operates in a safe manner; (2) extreme measures must be taken to identify and remove software defects starting at the earliest stages of software development; and (3) a great deal of effort must be spent identifying what can go wrong, the likelihood and consequences of such occurrences, and identifying how these risks can be a averted, mitigated, or detected so users can be warned. Two key issues software developers face when developing safety-critical systems are (1) how to weigh cost and ease of use issues versus safety and product appeal, and (2) how to decide when sufficient software testing has been done." Do you think Boeing observed these standards in the case of the 737 Max?
2. What do you think Boeing's defense will be in the various lawsuits it faces and in the court of public opinion? What should its defense be?
3. This module points out that striving for ethical decision making is just good business. An old proverb goes like this: "For want of a nail the shoe was lost. For want of a shoe the horse was lost. For want of a horse the rider was lost. For want of a rider the message was lost. For want of a message the battle was lost. For want of a battle the kingdom was lost". Can Boeing's decision making be called unethical? Could it possibly result in the loss of their kingdom?

Include citations and references.

References

Bedell, P. (2019, August 1). Opinion: Lessons from the 737 max debacle. AOPA. https://www.aopa.org/news-and-media/all-news/2019/august/flight-training-magazine/opinion-lessons-from-the-737-max-debacle.

Beech, H., Tabuchi, H., Glanz, J., & Wichter, Z. (2018, November 13). New questions swirl over boeing on updated 737 model that crashed. The New York Times. https://www.nytimes.com/2018/11/13/world/asia/boeing-737-indonesia-crash.html.

Gates, D., & Baker, M. (2019, June 24). The inside story Of MCAS: How Boeing's 737 max system gained power and lost safeguards. The Seattle Times. https://www.seattletimes.com/seattle-news/times-watchdog/the-inside-story-of-mcas-how-boeings-737-max-system-gained-power-and-lost-safeguards/.

Lazo, L. (2019, March 21). More families sue Boeing over Lion Air crash, citing defective design and 'inadequate safety warnings'. The Washington Post. https://www.washingtonpost.com/local/trafficandcommuting/more-families-sue-boeing-over-lion-air-crash-citing-defective-design-and-inadequate-safety-warnings/2019/03/21/ebd2c9f4-4bfb-11e9-9663-00ac73f49662_story.html.

Moon of Alabama. (2019. March 12). Boeing, the FAA, and why two 737 max planes crashed. Moon of Alabama. https://www.moonofalabama.org/2019/03/boeing-the-faa-and-why-two-737-max-planes-crashed.html.

Moon of Alabama (2019, July 6). EASA tells Boeing to fix 5 major 737 max issues. Moon of Alabama. https://www.moonofalabama.org/2019/07/european-regulator-says-boeing-has-to-fix-these-5-major-737-max-issues-.html.

Perez, E., & Prokupecz, S. (2019, March 21). Justice department issues subpoenas in criminal investigation of Boeing | CNN BUSINESS. CNN. https://www.cnn.com/2019/03/20/business/boeing-justice-department-subpoenas/index.html.

Travis, G. (2019, April 18). How the Boeing 737 max disaster looks to a software developer. IEEE Spectrum. https://spectrum.ieee.org/aerospace/aviation/how-the-boeing-737-max-disaster-looks-to-a-software-developer.