737 Max software was updated; pilots weren't

New York

IN THE brutally competitive jetliner business, the announcement in late 2010 that Airbus would introduce a more fuel-efficient version of its best-selling A320 amounted to a frontal assault on its archrival Boeing's workhorse 737.

Boeing scrambled to counterpunch. Within months, it came up with a plan for an upgrade of its own, the 737 Max, featuring engines that would yield similar fuel savings. And in the years that followed, Boeing pushed not just to design and build the new plane, but to convince its airline customers and, crucially, the US Federal Aviation Administration (FAA), that the new model would fly safely and handle enough like the existing model that 737 pilots would not have to undergo costly retraining.

Boeing's strategy set off a cascading series of engineering, business and regulatory decisions that years later would leave the company facing difficult questions about the crash in October of a Lion Air 737 Max off Indonesia. The causes of the crash, which killed 189 people, are still under investigation.

But the tragedy has become a focus of intense interest and debate in aviation circles because of another factor: the determination by Boeing and the FAA that pilots did not need to be informed about a change introduced to the 737's flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.

That judgment by Boeing and its regulator was at least in part a result of the company's drive to minimise the costs of pilot retraining. And it appears to have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash.

Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides. Those decisions ultimately prompted the company, regulators and airlines to conclude that training or briefing pilots on the change to the flight control system was unnecessary for carrying out well-established emergency procedures.

The crash has raised questions about whether Boeing played down or overlooked, largely for cost and competitive reasons, the potential dangers of keeping pilots uninformed about changes to a critical element of the plane's software. And it has put a new focus on whether the FAA has been aggressive enough in monitoring Boeing.

Boeing has taken the position that the pilots of the Lion Air flight should have known how to handle the emergency despite not knowing about the modification. The company has maintained that properly following established emergency procedures long familiar to pilots from its earlier 737s should have allowed the crew to handle a malfunction of the maneuvering characteristics augmentation system, known as MCAS, whether they knew it was on the plane or not.

The FAA declined to comment about the crash but acknowledged that its own role was being examined. "The FAA's review of the 737 Max's certification is a part of an ongoing investigation with the NTSB and Indonesian civil aviation authorities," the agency said, referring to the National Transportation Safety Board. "We cannot provide details of that review until the investigation is complete."

Boeing's position has left many pilots angry and concerned. "Any time a new system is introduced into an airplane, we are the people responsible for that airplane," said Jon Weaks, president of the Southwest Airlines Pilots Association.

In designing the 737 Max, Boeing was selling airlines on the aircraft's fuel savings, operating cost reductions and other improvements.

But at the same time, it was trying to avoid wholesale aerodynamic and handling changes that would spur the FAA to determine that 737 pilots would need substantial new and time-consuming training.

Internally, a primary requirement for the Max was that no design change could cause the FAA to conclude that pilots must be trained on the system differences between the then-current version of the plane, the 737 NG, and the Max using simulators, said Rick Ludtke, a flight crew operations engineering analyst involved in devising some of the other new safety features on the 737 Max.

By limiting the differences between the models, Boeing would save airlines time and money by not putting their 737 pilots in simulators for hours to train on the new aircraft, making a switch to the Max more appealing. "Part of what we wanted to accomplish was seamless training and introduction for our customers, so we purposely designed the airplane to behave in the same way," Dennis A Muilenburg, Boeing's chief executive, said on CNBC in December. "So even though it's a different airplane design, the control laws that fly the airplane are designed to make the airplane behave the same way in the hands of the pilot."

But Boeing's engineers had a problem. Because the Max's engines are larger than those on the older version, they needed to be mounted higher and farther forward on the wings to provide adequate ground clearance. Early analysis revealed that the engines would have a destabilising effect on the airplane, Mr Ludtke said.

The concern was that an increased risk of the nose being pushed up at low airspeeds could cause the plane to get closer to the angle at which it stalls, or loses lift, Mr Ludtke said.

After weighing many possibilities, Mr Ludtke added, Boeing decided to add a programme to the aircraft's flight control system to counter the destabilising pitching forces from the new engines.

That programme was MCAS.

MCAS, according to an engineer familiar with the matter, was written into the umbrella operating system that, among other things, keeps the plane in "trim", or ensures that the nose is at the proper angle for the plane's speed and trajectory.

In effect, the system would automatically push the nose down if it sensed that the plane's angle was creating the risk of a stall.

Ultimately, the FAA determined that there were not enough differences between the 737 Max and the prior iteration to require pilots to go through simulator training. While the agency did require pilots to be given less onerous training or information on a variety of other changes between the two versions of the plane, MCAS was not among those items.

The bottom line was that there was no regulatory requirement for Boeing or its customers to flag the changes in the flight control system for its pilots - and Boeing contended that there was no need, since, in its view, the established emergency procedures would cover any problem regardless of whether it stemmed from the original system or the modification. At least as far as pilots knew, MCAS did not exist, even though it would play a key role in controlling the plane under certain circumstances.

Boeing did not hide the modified system. It was documented in maintenance manuals for the plane, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737. NYTIMES