Da copia di flight international in mio possesso
Boeing’s updates to its troubled 737 Max have largely addressed concerns about the aircraft’s flight-control system, but broader risks involving pilot training and aircraft maintenance remain unresolved, say aviation safety specialists and commercial pilots.
Sources interviewed by Flight International over several months say these significant operational risks were highlighted by the 737 Max accidents, but overshadowed by intense scrutiny of Boeing and its faults.
“There is a pilot training issue to the point that now the base foundation of pilot training is getting flawed,” says Chinar Shah, a 737 Max captain and training captain at Jet Airways, which stopped operations this year amid financial problems.
“[Airlines] are churning out pilots because of the [crew] shortage. The training footprints are becoming shorter and shorter,” says Shah.
Indeed, two former US National Transportation Safety Board (NTSB) experts think Indonesia’s report into the crash of Lion Air flight 610 glosses over critical facts about the carrier’s operation, driving an incomplete narrative.
“I think they have selectively filtered a lot of the information that should be in here,” says former NTSB senior air safety investigator Greg Feith on his Flight Safety Detectives podcast, which he hosts with former NTSB member John Goglia.
“Maintenance… is where this whole accident sequence starts, two days before the accident,” Feith says.
Many pilots declined to talk on the record about the two 737 Max crashes due to the sensitive nature of the tragedies and ongoing investigations.
But, without downplaying Boeing’s responsibility, some say proper training should have prepared flightcrews to address errant activation of the Max’s Maneuvering Characteristics Augmentation System (MCAS), which contributed to both accidents.
Others disagree, saying the crash scenarios would challenge any aviator. Pilots should not be expected to face the confusing circumstances that faulty MCAS activation can create. Accident investigators in Indonesia and the NTSB have faulted Boeing’s MCAS design and the US Federal Aviation Administration’s oversight. Investigators have also called for more study of pilot-automation interaction.
“If the automation fails, and we know that it sometimes does, pilots must have the experience, training, and technical ability to instantly take over and safely fly the aircraft” Chinar Shah, 737 Max captain
Boeing equipped the Max with MCAS to comply with regulations requiring opposing column force to increase linearly as pilots pull back on the column. The Max’s CFM International Leap-1B engines can make it pitch nose-up in certain high angle-of-attack scenarios, translating into relatively less column force. MCAS solves that problem by pitching the nose down when needed.
Triggered by faulty angle-of-attack data, MCAS put the Lion Air and Ethiopian Airlines aircraft, both 737 Max 8s, into dives from which the pilots did not recover. Lion Air flight 610 crashed in October 2018 and Ethiopian flight 302 crashed in March 2019, killing a combined 346 people.
“While I firmly believe both accident aircraft were recoverable without loss of life, it was the very design of the Max’s MCAS system that unnecessarily put passenger and crew lives at risk,” says Michael Gerzanics, a 737 Max captain with a US airline, former US Air Force test pilot and Flight International test pilot.
Boeing took criticism for not initially telling pilots more about MCAS, a decision it defended on the grounds that MCAS failures appear like a runaway stabiliser, which pilots should address via the runaway stabiliser checklist.
Shah thinks an introductory MCAS course would have been useful. But she understands Boeing’s logic, calling knowledge of MCAS “good to know”, not “need to know”.
“The action required by the flightcrew is the same as for the runaway stabiliser, which is taught to us from day one,” Shah says. “You would still do the same memory items… you follow the checklist.”
The Lion Air crash report, released in October by Indonesia’s National Transportation Safety Committee (NTSC), pins significant responsibility on Boeing.
It faults Boeing’s MCAS design, including reliance on a single angle-of-attack sensor, its assumptions about pilot responses and its lack of guidance to pilots. The NTSC urges the FAA to review certification processes, and it concludes that Florida company Xtra Aerospace improperly calibrated the sensor that triggered MCAS.
It cites Lion Air maintenance concerns and crew co-ordination and cockpit management issues, which it attributes partly to cockpit warnings and other distractions.
Additionally, the report says the pilots of the flight prior to flight 610 filed an incomplete maintenance report following a similar inadvertent MCAS activation.
Goglia thinks the NTSC’s conclusions paint an incomplete picture – one partly at odds with facts within the report.
“If you look at the factual data, it doesn’t line up with what the conclusions are,” he tells Flight International; Goglia has previously described the conclusions as “grossly favourable” to Lion Air.
The 737 Max in the Lion Air crash had air data system problems as far back as 9 October, several weeks before the 29 October crash, according to the NTSC.
It then had repeated speed and altitude indication problems from 26 October until the crash, which engineers at various stations took steps to fix.
On 27 October, an engineer in Manado, Indonesia, worked to address the speed and altitude indication problems. The next morning, the engineer met with the crew who were to fly the aircraft to Denpasar, Indonesia, that day. The crew “requested more be done to rectify the problem”, which they said occurred several times. The engineer suggested the problem might be better addressed in Denpasar.
On 28 October, in Denpasar, an engineer with Lion subsidiary Batam Aero Technic replaced the Max’s left angle-of-attack sensor. That sensor, which had a 21° error, trigged MCAS on two flights, the last being flight 610.
The NTSC says the engineer told it he had tested the sensor after installation, and that it passed. But proof does not exist because, contrary to Batam procedures, the engineer did not record test values, the report says.
The engineer gave investigators photographs to prove the test was completed. But investigators rejected the photos after determining they did not show the accident aircraft or were taken before the replacement sensor arrived.
Following the sensor replacement, Lion Air dispatched the Max on a flight from Denpasar to Jakarta, during which those pilots experienced numerous caution lights and MCAS activation. They eventually switched off MCAS using the runaway stabiliser procedure, and continued to Jakarta, the report says.
Upon arriving, the captain reported airspeed and altitude warnings in a maintenance log, but did not mention the stick shaker, the runaway stabiliser procedure, or having to manually trim the aircraft, the report says. The incompleteness of the maintenance log violated requirements intended to ensure proper maintenance, says the NTSC.
The aircraft “never should have been in the air”, says Goglia. It simply had too many problems and Lion Air should have grounded it days before the crash, he says.
“I’m not letting Boeing off the hook, because they have dirty hands too,” Goglia adds.
“There was a continuing, cascading effect of problems with the airplane,” Feith says. He describes engineers as “trying to milk this airplane to one of their larger maintenance bases”.
“It’s crazy that this airplane would… be returned to service like this,” Feith states.
Lion Air flight 610 lifted off from Jakarta on 29 October, bound for the Indonesian city of Pangkal Pinang, with the captain at the controls. The crew immediately received indicated airspeed disagree and altitude disagree warnings. The stick shaker activated.
Before MCAS even activated, the captain told the first officer to complete memory items for unreliable airspeed. Those steps are in the “non-normal checklist” in the pilots’ quick-reference handbook, according to the NTSC. Memory items should be performed as soon as possible, even before pilots consult the actual checklist.
The first officer did not respond to the captain’s initial request. The captain again asked the first officer to complete “memory item”.
The first officer, who had 5,175h of flight time, said he “was unable to locate the airspeed unreliable checklist”. About a minute later he found the checklist, but never completed it.
The airspeed unreliable checklist would not itself have addressed an MCAS activation, but the first officer’s difficultly shows he was “not familiar” with the non-normal checklist, concludes the NTSC. “The unfinished [checklist] made it difficult for the flightcrew… to understand the aircraft problem and how to mitigate the problem.”
The report shows the first officer struggled with checklists during training. On one occasion he “missed identifying the non-normal checklist”. Other training notes cite “lack of situational awareness or judgement” and issues with workload management and focus, the report says.
“The reappearance of difficulty in aircraft handling, identified during training in the accident flight, indicated that the Lion Air training rehearsal was not effective,” the NTSC concludes.
Goglia says the crew demonstrated significant “knowledge and discipline” problems. Qualified pilots should be able to complete memory items quickly he says; such deficiencies, left uncorrected, would disqualify pilots in the USA.
Several minutes after take-off, flight 610’s MCAS started activating. “This report actually shows that MCAS didn’t get involved in the accident sequence until late in the flight,” Feith says in his podcast.
For more than 5min the captain successfully countered MCAS by commanding nose-up trim with switches on the column. Neither pilot completed the runaway stabiliser checklist.
About 1min before the crash the captain passed control to the first officer. But in the hand-off the captain did not mention his use of nose-up trim.
“The captain did not verbalise to the [first officer] the difficulty in controlling the aircraft and the need for repeated aircraft nose-up trim,” the report notes.
After taking control, the first officer trimmed up several times, but not enough to counteract MCAS. Flight 610 crashed in the Java Sea, killing 189 people.
“As an industry, we have all become overly dependent on automation and technology,” says training captain Shah, who remains employed with Jet Airways and works for Washington DC aviation training and consulting company GHS Aviation Group.
“The prevalent perception is that the flightdeck automation is there to do the job for you, rather than to assist,” she says. “If the automation fails, and we know that it sometimes does, pilots must have the experience, training, and technical ability to instantly take over and safely fly the aircraft.”
Jet Airways was expanding before its shutdown. The carrier’s 737 fleet increased from about 50 to 80 aircraft between 2010 and early 2019, when it began winding down. The fleet included several 737 Max aircraft, and it had orders for roughly 130 additional Max jets.
Amid that expansion, the training time allocated to the carrier’s pilots for the purpose of meeting government-set minimum performance standards was “notably reduced”, Shah says.
Newly hired pilots, depending on proficiency, were given 11 or 12 simulator sessions, down from about 14 previously, she says. Meanwhile, pilot wash-out rates “significantly declined”. Shah says other Asian carriers face identical pressure to train more pilots as fleets expand – conditions highlighting a global pilot shortage.
A 2019 Boeing report projects that by 2038 airlines will need 645,000 new pilots, including 244,000 in the Asia-Pacific, almost double any other region. Pilots and experts fear less training and more automation have left many pilots lacking adequate hand-flying skills and unprepared for failures.
Some quelli have concerns about ICAO’s low-hour multi-crew pilot licence (MPL). The MPL requires no minimum flight time, but holders need a private licence and 240h of time in either an aircraft or simulator.
By comparison, US regulations require transport pilots to have 1,500h of flight time, with exceptions. Those regulations have proved controversial, with US regional airlines saying they worsened a pilot shortage without improving pilot qualifications.
MPLs allow pilots with a few hundred hours of time to sit in the right seat of a large jet. Critics warn that may be insufficient to prepare pilots for real world situations.
Ethiopian is among airlines to embrace the MPL, according to its flight school’s website.
The preliminary report into the 10 March crash of Ethiopian flight 302 says the first officer had 361h of “flight experience”, including 207h on 737s.
It does not specify the licence the first officer held, and the airline has not responded to requests for additional information.
“I am not convinced 361h in aircraft and simulators combined is enough to develop a level of airmanship needed to deal with unscripted emergency situations,” says Gerzanics.
The accident report into Ethiopian flight 302 is yet to be finalised, but the preliminary findings reveal a similar scenario involving incorrect angle-of-attack values and MCAS activation shortly after take-off. The aircraft crashed outside Addis Ababa, killing 157 people.
Those pilots disengaged MCAS using the runaway stabiliser procedure, then switched electric trim back on after struggling with manual trim.
They left the throttles at 94% thrust throughout the flight. Overspeed warnings sounded and the aircraft crashed at high speed – one airspeed indicator recorded 458kt (848km/h), while the other showed 500kt.
Observers suspect the pilots turned the electric trim back on because they could no longer manually trim the aircraft, likely due to the tremendous forces exerted on the jet by its high speed and resulting aerodynamic pressure on the control surfaces.
Without detracting from the role played by MCAS, pilots and safety experts say the aircraft should never have been allowed to reach such speed.
Goglia thinks both accidents display a “failure to fly the airplane” when automated systems fail, and he is not alone.
In October, the USA and several other countries urged ICAO to review pilot training, warning that flying skills may be degrading amid an increased reliance on automation.
“While I firmly believe both accident aircraft were recoverable without loss of life, it was the very design of the Max’s MCAS system that unnecessarily put passenger and crew lives at risk” Michael Gerzanics, 737 Max captain and Flight International test pilot
ICAO’s member states and its technical commission “roundly endorsed” forming a panel to complete the review, ICAO says. Early this year, ICAO’s Air Navigation Commission, its main technical body, intends to review the panel’s “objectives and composition”. ICAO does not say when it expects the pilot training review will be complete.
Training concerns aside, Boeing has made updates to the Max that experts believe solve the aircraft’s problems.
“Boeing nailed the fixes on the Max,” says Goglia, who attended Max simulator demonstrations at the airframer’s facility in early December. He paid his own expenses and does not work in any capacity for Boeing. “If there is any [angle-of-attack] disagreement, in less than a second it will shut down the MCAS.”
The flight-control system now compares data from both Max angle-of-attack sensors and prevents MCAS from activating if readings differ by more than 5.5°, according to Boeing. Previously, MCAS took data from only one sensor.
MCAS will additionally only operate once per “each elevated angle-of-attack event”, meaning it will not provide multiple nose-down inputs, as occurred during the accident flights. And MCAS no longer commands more nose-down trim than pilots can counteract by pulling the column, Boeing says.
Boeing also gave the computer “mid-value select”, which generates a third angle-of-attack input for the purpose of identifying angle-of-attack faults. The computer disables nose-down trim upon determining one sensor is faulty, Matt Kiefer, a member of an FAA-convened technical advisory board, told Congress in December 2019.
Additionally, new “software monitors” cross-check trim commands, and the computer will disable commands upon finding differences, Kiefer adds.
“We were able to experience the accident scenarios and able to observe the aircraft behaviour with MCAS operating properly, as well as how the aircraft handles with MCAS disabled,” Kiefer said.
The technical advisory board, an independent panel formed by the FAA to evaluate Boeing’s MCAS fix, still has work outstanding. But Kiefer says the “team feels that the changes made to the flight control system of the 737 Max should vastly approve the safety of the aircraft”.
The FAA has set no timeline for clearing the Max, beyond 2020.
Before the jet is cleared, a joint operations evaluation board must complete a pilot training analysis, the FAA must review its findings, and the FAA and technical advisory board will review final documents, FAA administrator Steve Dickson told Congress in December 2019.
Inviato dal mio ANE-LX1 utilizzando Tapatalk