Pundits, politicians and the general press continue to jab fingers into Boeing and the FAA over design and certification shortcomings associated with the Boeing 737 MAX. The aircraft’s maneuvering characteristics augmentation system (MCAS) is implicated in the Lion Air Flight 610 and Ethiopian Airlines Flight 302 accidents that, combined, killed 346 people, as though government airworthiness regulators and the Chicago-based jetliner manufacturer were solely to blame for the tragedies.
In his April 2019 news release, Boeing CEO Dennis Muilenburg acknowledged that a malfunctioning MCAS was involved. But he also noted, “The history of our industry shows most accidents are caused by a chain of events. This again is the case here, and we know we can break one of those chain links in these two accidents. As pilots have told us, erroneous activation of the MCAS function can add to what is already a high workload environment.”
While MCAS is unique to the MAX, all in aviation can derive important safety lessons for their own operations — regardless of aircraft make or type — from the tragedies.

Credit: Fred George/BCA


The two accidents most assuredly involved multiple factors, including 737 MAX flight control computer software design shortcomings, but in addition there was a lack of information provided to airlines about how and why MCAS works, along with crew training deficiencies, startle factor, distraction and disorientation, along with a failure of cockpit resource management and basic airmanship, among others.
MCAS is a new flight control computer law that was added to the MAX because the latest 737’s new Leap 1B turbofans are considerably larger than their predecessors, mounted higher and farther ahead of the wing for ground clearance and produce considerable vortex lift at high angles of attack (AOA). The extra lift shifts forward the center of pressure, thus reducing the aircraft’s longitudinal stability as it approaches aerodynamic stall. This is not problematic, except when slats and flaps are retracted, and at extremely light operating weights and at full aft CG. In this extreme corner of the flight envelope, the margin between the center of pressure and CG gets too thin at high AOA, so the MAX cannot meet certification requirements for positive pitch stability. Increasing G, or load factor, just aggravates the instability at high AOA.
MCAS is a stability augmentation function, embedded in the flight control computer software, that commands up to 2.5 deg. of nose-down stabilizer trim at high AOA, depending upon the starting position of the horizontal stabilizer and aircraft Mach number, to increase nose-down pitching moment sufficiently to augment pitch stability enough to meet airworthiness standards. Despite numerous news reports to the contrary, MCAS is not an “anti-stall” or “stall prevention” system. It’s there to make the MAX behave like a Boeing approaching the stall, at full stall and during stall recovery.

Credit: Fred George/BCA

Notably, flight tests have shown that MCAS is not needed to meet the certification standards at normal operating weights with typical minimum fuel reserves and passengers aboard. There is a fat spread between center of pressure and CG, so the forward shift in the former caused by nacelle vortex lift doesn’t significantly degrade pitch stability.
One pilot, who has flown and evaluated both the 737NG and MAX models, recounted his experience flying a full aerodynamic stall with MCAS inoperative in the latter’s engineering cab simulator: “We reduced thrust at 5,000 ft. and slowed the aircraft at about 1 kt. per second. We were at a mid-range CG with gear, slats and flats up. We trimmed until we reached 30% above stall speed and then just continued to ease back on the control wheel. Pitch feel was natural, progressively increasing as airspeed decayed. Somewhere between the audible low airspeed warning and stick shaker, I felt the slightest lightening on control pressure in my fingertips. Quite candidly, if I hadn’t been watching for it, I don’t think I would have noticed any difference between the MAX and the NG. I kept pulling back through stick shaker, then buffet, then elevator feel shift [a function that doubles the artificial control feel forces near stall] and finally until the yoke was buried in my lap. The nose just flopped down gently at the stall and I initiated recovery as I would in most other airplanes I’ve flown.”
Boeing added two more vortilons to each wing leading edge, for a total of six per side, and also lengthened and raised the inboard, leading edge stall strips to assure the MAX’s stall behavior would be as docile as that of the NG in most parts of the flight envelope. However, the pilot commented that he’d previously not flown any slower than stall warning stick shaker during MAX or NG sim sessions.
Multiple Factors in Accident Chains
As originally implemented, MCAS had at least five potentially serious flaws.
First, it appears Boeing didn’t tell operators, pilot unions or flight crews about the MCAS function being added to the MAX, let alone teach all stakeholders about normal and abnormal operating modes. So, apparently, the first time MCAS activated, it would come as a surprise to pilots. The rationale? Boeing officials seemed to believe that MCAS would be triggered so rarely that there was virtually no need to burden operators with its technical minutia.
Second, the original version of MCAS used a single α vane sensor. AOA probes and vane sensors have proven so reliable that their failure was deemed to be an ultra-rare event. But if a single AOA sensor did malfunction — evidently the case in the Lion Air and Ethiopian crashes — MCAS could be erroneously triggered.
Third, 737 pilots long have been taught that pushing or pulling the yoke against the stick forces activates the control column force trim cutout switches that interrupt electrical power to the trim system. This temporarily freezes uncommanded stab trim, thereby affording time for the crew to turn off both manual and autopilot cutoff switches on the center console, halting stab trim runaway.
But that’s not the case with MCAS. Once it’s triggered and it starts commanding nose-down stab trim, pulling back on the yoke won’t deactivate the electric stab trim system. The rationale? If pilots could disable MCAS with yoke pressure, it would have defeated the design intent of MCAS commanding nose-down trim to increase longitudinal stability.
Fourth, pilots weren’t told that if they made pitch trim inputs, using the thumb switches on the control wheels while MCAS was operating, after a 5-sec. delay, it would trigger another nose-down trim command if the high AOA condition persisted. Repeated MCAS nose-down trim commands could drive the elevator to full travel, causing the horizontal stab to overpower the elevator’s pitch control authority. Pilots of the 737 say the stab at full travel always “wins” over elevators. Pilots usually lose the pitch control battle with the stab and the aircraft goes out of control.
Fifth, an MCAS horizontal stab trim runaway most likely would be preceded by an impressively distracting and disorienting IAS disagree/ALT disagree/stall warning stick shaker/runaway stall margin red “zipper” on the airspeed scale. The air data computers use AOA inputs to correct pitot and static position source errors for variations in relative wind angle. If an α sensor erroneously goes to full up travel on takeoff rotation, as it did in the Lion Air and Ethiopian crashes, it can cause significant airspeed and altitude indication variations between the left- and right-side PFDs. One pilot, who flew MCAS failure scenarios in Boeing’s 737 MAX engineering simulator, explains the resulting confusion and potential for loss of situational awareness.
“We began a normal takeoff, but at rotation, the left AOA pegged at the top of the scale. This was like nothing we’ve seen before during initial or recurrent sim training. The [stall warning] stick shaker fires continuously, using loud sound and control wheel vibration to focus your attention on the critically high AOA indication. But I didn’t appreciate the effect that erroneous AOA also has on creating such large-scale indicated airspeed and altitude errors on the PFD. It was both distracting and disorienting because I’d not seen it before in sim training. I initially got tunnel vision and blinded as to what might next happen.”
Large errors in AOA can cause 20-40-kt. errors in indicated airspeed and 200-400-ft. errors in indicated altitude, according to the pilot we interviewed. This is accompanied by IAS disagree (indicated airspeed disparity between left and right PFDs) and ALT disagree (indicated altitude disparity between left and right PFDs) warning annunciators that illuminate on both PFDs. Boeing also is upgrading the MAX with optional AOA dial indicator displays and standard AOA disagree warning annunciators on the PFDs.
“We followed the checklist for ‘airspeed unreliable,’ assuring that autopilot, autothrottles and flight directors were turned off. We pulled back power to 80% N1 [fan speed], set 10-deg. nose-up pitch attitude and climbed to 1,000 ft. AGL. We then lowered the nose, started accelerating and began retracting slats and flaps at 210 KIAS.”
When the slats and flaps were fully retracted, MCAS kicked in because of the erroneous high AOA reading.
“It’s a good thing we knew what to expect. Otherwise tunnel vision from the “airspeed unreliable” event could have blinded us to the subsequent MCAS nose-down trim input. When I noticed the frisbees [manual trim wheels] racing, I grabbed the left wheel. It was easy to stop the trim with hand pressure, but I knew in advance what was happening. We followed the checklist for runaway stabilizer, checking again for autopilot off and autothrottle off. We turned off both trim cutout switches and cranked the frisbees to relieve control pressures. We used manual trim for the remainder of the flight to landing touchdown and rollout. That was quite an eye-opener, as I had never been exposed to that during sim training, let alone actually experienced it.”
The pilot said it’s critical to follow the checklist memory items, pull back thrust to 75% after retracting slats and flaps and peg nose attitude at 4-deg. nose up. Let speed build up beyond 220 to 250 kt. and controllability becomes increasingly difficult, if not impossible, because air loads create so much friction in the elevator jackscrew that the stab cannot be moved using the manual trim wheels.
Train-to-Cost Versus Train-to-Proficiency
In the wake of the Indonesian and African 737 MAX crashes, some airline pilots feel betrayed by others in the aviation industry. They say they’ve never been taught about how gross AOA sensing errors can cause substantial deviations in air data indications between the left and right PFDs, let alone runaway stall warning tapes and constant stickers. They’ve never been exposed to non-normal systems scenarios during initial or recurrent simulator training sessions, such as the ones already described.

Credit: Fred George/BCA

Boeing 737 pilots, flying for three U.S. air carriers, told us they’ve never had to fly the simulator from the point of a runaway stab emergency all the way back to landing at a divert field using the “frisbee” manual trim wheels. In contrast, one retired airline captain who flew for the former Air Berlin, told us that, years ago, flying the sim to touchdown with manual trim was a regular part of his recurrent training. Such rigorous sim training no longer is routine in the airline industry.
“We’re just checking boxes for the FAA,” says one Seattle-based 737 airline pilot. This aviator, in his mid-30s, has logged more than 17,000 hr. total flight time in the 737s, CRJs, tow planes, sailplanes, sky dive aircraft and his own Cessna 185, plus a DC-3 and a P-40 Warhawk, among dozens of other models. But he’s the exception, rather than the norm among professional pilots in his age group. He expects a higher level of training to assure airline pilots are proficient.
But finding a sufficient number of new pilots to fill slots in a rapidly growing industry is tough. And allocating enough time and resources for comprehensive training of new hires is challenging.
“Airlines worldwide face a pilot shortage created by the tandem forces of pilot retirements and escalating air traffic. Thus far, the focus has been on the quantitative challenge. New academies and career programs are targeted at increasing the output of pilots but are up against issues such as instructor capacity and financing,” wrote Thierry Dubois, Aviation Week & Space Technology’s Lyon, France, bureau chief for that sister publication, this past March. “The pilot shortage is both quantitative and qualitative.”
“A looming pilot shortage is coupled with variation in the level of training worldwide,” Jean-Michel Bigarre, head of global flight training for Airbus, told Dubois.
There isn’t much consistency in pilot training or proficiency around the world. “[We] see strange things in poor countries where air transport is growing very fast — suspiciously quick pilot qualification and fraudulent flight hour accounting,” Bigarre added.
But as the U.S. pilot said after flying the MAX engineering cab simulator, the emergencies he experienced in runaway AOA scenarios, including the need to fly the aircraft all the way to touchdown using manual trim, were like nothing he’d experienced during NG or MAX sim training sessions. His comments were echoed by other airline pilots with whom we spoke. That doesn’t speak well of First World training standards. So, can we expect flight training to be better in poorer countries than it is in the west?
Boeing’s new flight control computer P12.1 software load provides triple-redundant AOA validity checks to prevent false triggering of MCAS. It also limits the system’s nose-down stab trim authority. And if the MCAS nose-down stab trim command ever exceeds 2.5 deg., the system is disabled. Those changes should assure there will be no more MCAS runaways.
However, Boeing’s upgrade addresses only one problem affecting one airplane model. It doesn’t look at those controllability issues as being more symptomatic of numerous larger problems, including training, airmanship and preparation for the unexpected. Chief among these is the current train-to-cost, rather than train-to-proficiency, pilot instruction model.
“Human error may explain the ‘what,’ but not the ‘why.’ We wouldn’t do this if it were computer error. We’d find why the computer made the error. We’d fix it,” says Capt. Shem Malmquist, a former Air Line Pilots Association aircraft technical and engineering chairman for his company and now visiting professor at the Florida Institute of Technology. “If we want to eliminate accidents, we need to train pilots to do the one thing that computers cannot. That is to innovate, to come up with novel solutions that are outside of anything that designers could imagine on the ground. We expect pilots to manage any unexpected events they might encounter in a flight.”
Malmquist also authored Angle of Attack, a book that examines the Air France Flight 447 accident, among others, as it relates to the abilities of pilots to handle the unexpected.
“But how do they gain these skills? And are we providing new pilots with that opportunity?” he asks. “As training becomes more regimented, pilots are exposed less and less to unusual events and more and more to well-defined scenarios. Pilots are getting very good at handling expected problems, but they are losing their ability to handle the unexpected.”
The “why” of human error involves pilot experience, the quality of knowledge-based training and the frequency and depth of learning during simulator sessions. Critics point to the scant 200 hr. of flight time logged by the copilot of Ethiopian Flight 302.
“There’s no way they can claim they had a qualified crew on that flight,” says Mike Boyd, an Evergreen, Colorado-based aviation industry analyst in a Washington Post report. Many current and former U.S. airline pilots, including Capt. Chesley “Sully” Sullenberger, are strong advocates of retaining the 1,500-hr. minimum flight time rule for airline pilot new hires.
But U.S. and other military pilots typically fly no more than 250-275 hr. before earning their wings. And then they’re fully qualified to fly Mach 2 fighters and land them aboard aircraft carriers or pilot attack helicopters into combat, attesting to the quality of military undergraduate pilot training.
Military pilots are taught innovation and creativity when dealing with airborne emergencies, including evaluating aircraft performance capabilities after battle damage. Simulator sessions often involve compound emergencies, ones that start with seemingly minor malfunctions that progress into major emergencies. Air Facts Journal’s Arnold Reiner partially attributes the services’ high level of proficiency to sifting out potentially weak performers during rigorous pilot candidate screening and comprehensive physical exams that candidates undergo as a condition of being accepted for flight training.
Years ago, Robinson Helicopter Co. instituted a flight instructor training program that emphasizes lessons learned from R22 light helicopter accidents. The goal was to eliminate maintenance and pilot errors that cause such mishaps. It succeeded in slashing the fatal accident rate of both certified flight instructors and students. The training program became a model for the rotary-wing community. Southwest, among other U.S. airlines, also wraps lessons learned from accidents into its risk resource management training programs.
Yet, too many online, classroom and simulator training sessions still emphasize conventional emergencies. For instance, turbofan pilots learn to how handle engine failure or fire before and after the V1 takeoff decision speed. They do not address “black swan” events, such as catastrophic engine failure or gross AOA sensing errors. But such events do occur, as evidenced by the uncontained, high-energy engine rotor burst that occurred aboard Qantas Flight 32, an Airbus A380 that departed Singapore for Sydney in November 2010.
Capt. Richard de Crespigny and crew had to struggle with controllability issues, erroneous or missing ECAM alerts, partial or total failure of several systems and massive fuel leaks that could have left the crippled jet engulfed in flames after landing rollout. De Crespigny, a 35-year pilot at the time of the incident, told us that he gleaned critical knowledge about the aircraft and its systems by studying the A380 flight crew operations manual and several other technical documents for 2 hr. every day. While determining what was wrong with the aircraft, he never lost his focus on first flying it and then sorting out the malfunctions.
Similarly, an AOA sensor that suddenly springs to full upscale on takeoff rotation may seem as though it’s just as unlikely as an explosive engine failure. But it seems that very malfunction did indeed occur aboard Lion Air Flight 610 and Ethiopian Flight 302. And it startled the flight crews, perhaps leading to a loss of situational awareness, including failure to recognize the subsequent runaway stab trim.
The three 737 pilots, flying for U.S. air carriers, with whom we spoke for this report told us they’ve never seen anything like that during recurrent simulator training sessions. They haven’t been taught that AOA inputs are used by the air data computers to correct for pitot and static position source errors to provide calibrated airspeed and altitude readouts on the PFDs. Thus, they’d never been taught in the classroom about the distraction and disorientation that can be caused by catastrophic AOA sensor failure on takeoff, let alone experienced it during sim training.
They’ve been taught some of the nuances of the 737 speed trim and Mach trim functions, but never MCAS stab trim. And none of the three said they had been required to use manual trim to fly the simulator from the point of an electric pitch trim malfunction all the way to landing.
A preliminary analysis of the MCAS-related crashes in Indonesia and North Africa thus reveals a complex chain of events to which Boeing’s Muilenburg alluded. The responsibilities of civil aviation regulatory officials go far beyond just assuring that airplanes are safe to fly when delivered by the manufacturers. There needs to be much closer monitoring of maintenance, line service disciplines and crew training.
What caused the apparent AOA sensor failures aboard the two doomed jetliners may never be determined. However, a thorough investigation into ground handling protocols, along with a review of all maintenance procedures, quality control checks and records, is a must. Regulators need to determine how such sensors might have been damaged on the ground or misrepaired during shop visits to prevent future sensor malfunctions.
It’s time for international agreement by governments, manufacturers, airlines and pilots to raise the bar on all these levels to restore public confidence in the safety and security of air travel. And using Boeing or the FAA as the sole scapegoats won’t cut it.

Return to service of Boeing 737 Max could depend on pilot training
Aircraft manufacturer faces costly delays if regulators demand crew practice on simulators


American Airlines 737 Max jets parked in Oklahoma, US. The Boeing aircraft has been grounded worldwide since March, leaving 400 planes idled © Reuters

What kind of training pilots receive could determine whether Boeing's grounded 737 Max aircraft is back in the air by the end of the northern hemisphere summer, or only much later, according to airlines, pilots unions and aviation industry experts.

Whether pilots should be retrained in a few hours on iPads, or on costly and scarce 737 Max flight simulators, has emerged as one of the biggest unanswered questions surrounding the return to service of the aircraft, after 33 global regulators met in Texas on Thursday last week.

The US regulator's safety review of the Max goes well beyond how to fix the anti-stall system, which played a role in two crashes in five months that killed 346 people. The US Federal Aviation Administration (FAA) is reviewing an emergency procedure used by all 737 pilots in circumstances similar to the two crashes, in which the nose of the plane is forced down erroneously.

Pilots traditionally learn a procedure to deal with what is known as "runaway stabiliser", which could also affect earlier generations of the 737, a plane which has been flying since the 1960s. Changing that procedure could have implications for the 737 NG, the predecessor of the Max.

But the focus is the 737 Max, which has been grounded worldwide since March 13, leaving 400 planes idled. Any further delays could seriously exacerbate the crisis faced by Boeing, the world's largest commercial aircraft manufacturer, in the wake of the Max crashes in Indonesia in October last year and Ethiopia in March.

"At least do something other than fly an iPad," Mary Schiavo, former inspector-general of the US Department of Transportation, told the Financial Times in an interview, a reference to the fact that US pilots had received only one to three hours of training on an iPad to prepare them to fly the Max before the crashes.

Now the FAA, the lead regulator for the Max, must decide whether to require US pilots to be trained in a Max simulator after the faulty manoeuvring characteristics augmentation system (MCAS), which played a role in both crashes, is repaired by Boeing.

Boeing has said it has completed work on an MCAS fix, but has not yet submitted it to the FAA for approval. The fix will prevent the MCAS system from repeatedly forcing the nose of the Max down under certain circumstances and would also prevent it from being triggered by only one of the two exterior sensors that measure the plane's angle with the ground.

But with only one Max simulator in airline hands in North America - at Air Canada - an FAA mandate requiring simulator training as a prerequisite for lifting the grounding order could lead to severe delays, US airlines said.

Up to now, the US regulator has said computer-based training would be enough: the FAA Flight Standardisation Board said in April that simulator training would not be necessary. All three US pilots unions that fly the Max concurred that simulator training should not be a prerequisite for its approval for flying, but should happen as part of later training.

But aviation experts say the FAA appears to be backtracking. "The international community seems very willing to entertain a proposal that includes simulator training before returning the Max to service," said Captain Jason Goldberg, spokesman for the pilots of American Airlines, the second-largest US Max carrier. Daniel Elwell, the acting administrator of the FAA, went out of his way after the Texas meeting to stress that simulator training remained an open question.


"This is more than just an issue of pilot training, this is also a political and a public relations issue," said Vaughn Cordle, a Boeing 787 pilot who advises investors on the implications of the 737 crisis.

Mr Elwell is "trying to be responsive to what other countries are feeling - and they may be feeling political pressure. That's why he's vacillating," said a representative of one big US pilots' union.

The issue of training is sensitive because most pilots were not informed of the existence of MCAS before the crashes. One of the few exceptions was Brazil, whose regulator mandated that pilots be trained on MCAS. The Brazilian regulator, ANAC, said the MCAS system constituted such a significant difference from the Max predecessor, the 737 NG, that special training was required.

Canada's director-general of civil aviation said Canada knew about the MCAS system before the crashes, but did not mandate pilot training on it. Canada's transport minister, Marc Garneau, said in April that simulator training would be required before lifting the grounding in Canada, but Canadian officials on Thursday said the issue was still undecided.

Europe's aviation safety agency EASA has said that adequate training was a prerequisite to lifting the Max grounding in the EU, but it declined to comment on Friday on whether that meant simulator training.

Training on a simulator is expensive. Full-flight simulators cost C$8m to C$20m ($6m to $15m) depending on the aircraft type, said a spokesperson for CAE, a Canadian simulator manufacturer. Hourly rates for training in simulators range between $500 and $1,000, they added.

Boeing was also forced to correct a flaw in the software of the training simulators after it emerged it was unable to reproduce certain flying conditions.

Some US pilots say training on a Max simulator is unnecessary because the MCAS problem will already have been fixed by Boeing before the Max is allowed to fly again. "It's pointless to train for what is not going to happen anyway because of the software fix," said another US pilots union representative.

If simulator training is not required, pilots would have to complete two to three hours of computer-based training, or if simulator training is required, altered 737 NG simulators might be used.

Norwegian Airlines has historically trained pilots on a Boeing 737-800NG simulator and fine-tuned them for the Max with computer training.

But one pilot on Norwegian said the Ethiopian crash had brought up "a lot more concerns", particularly about training: "All we have been told to do is an online training course, nothing more. That doesn't sound the way to be trained on a new aircraft to me."

Philip von Schöppenthau, secretary-general of the European Cockpit Association, which represents more than 38,000 pilots, said the benefit of simulators over computer-based training was that rehearsing complex and stressful flight scenarios would give "thorough knowledge of how [the planes] function, not just how they are presented through the [computer] interface".

But a UK air accident investigator who is now a training captain on Boeing 737 aircraft said even simulator training would not be enough to solve the current problem.

"The fundamental problem is having MCAS. You cannot guarantee a pilot's instinctive reaction to be different through training. Getting it right needs to be more than just getting them trained to cope with it."

Boeing, he added, needed to make MCAS more reliable. "There needs to be a fail-safe that ensures the plane is not driven into the ground."