Capt. Chesley “Sully” Sullenberger isn’t satisfied that the fixes for Boeing’s 737 MAX proposed by the Federal Aviation Administration (FAA) are enough.
In an exclusive interview, the celebrated pilot said that even if the FAA ungrounds the jet next month as expected, additional modifications are needed as soon as possible to improve the plane’s crew alerting system and add a third check on the jet’s angle of attack data.
“I’m not going to say, ‘We’re done, good enough, move on,’” said Sullenberger.
“People are going to fly on it and I will probably be one of them,” he added. “The updated MAX will probably be as safe as the (previous model) 737 NG when they are done with it. But it’s not as good as it should be.”
After the FAA announced in August the proposed design changes for the MAX’s return to service, there were numerous comments from aviation experts calling for such updates.
Dennis Tajer, spokesman for the Allied Pilots Association (APA), the union representing American Airlines pilots, said he’s with Sullenberger.
Though the specific flight control software — the Maneuvering Characteristics Augmentation System (MCAS) — that brought down the jets in two fatal crashes is now fixed, Tajer said, the investigations into the crashes “have exposed other areas we can do better on that airplane” and also on the 737 NG.
“We cannot lose this opportunity to address something that needs to be enhanced,” Tajer said.
With Boeing financially strapped, the cost of what they propose could be a major barrier — not least because the safety issues raised apply not just to the MAX but equally to older versions of the 737 currently flying, like the 737 NG.
But Sullenberger says these improvements will make 737s safer — both the MAX and the older models — and shouldn’t be shelved due to cost.
“Is that really something we are comfortable saying out loud to everybody who boards an airplane?” he said. “I just don’t think that’s defensible. In safety-critical domains, ‘just good enough’ isn’t.”
Air data and alert system weaknesses
Sullenberger took his first flying lessons in 1967 at age 16, while still in high school in Texas, the same year Boeing certified the original 737.
He flew fighters in the Air Force and was an active safety advocate in the pilot union during his 30-year airline career.
In 2009, when a flock of geese took out both engines of his US Airways jet soon after takeoff, Sullenberger guided the Airbus A320 to an emergency landing in New York City’s Hudson River, saving all 155 people on board.
The “Miracle on the Hudson” made Sullenberger an emblem of piloting skill and aviation safety.
In June 2019, testifying at a 737 MAX investigation hearing before the U.S. House Transportation Committee, he severely criticized both Boeing’s design failures and the FAA’s oversight during certification of the MAX.
With the ungrounding of the MAX now imminent, he weighed in on what still needs to be done.
His first concern echoes that of the European Aviation Safety Agency (EASA) and many of the public comments submitted on the FAA proposal: MCAS on the updated MAX will take input from the jet’s two angle-of-attack sensors, but Sullenberger believes a third check is necessary.
If one of two sensors is faulty, the computers won’t know which is correct.
The likely solution is not a third angle of attack vane on the jet’s exterior, but an indirect, “synthetic” software calculation of the angle of attack based on parameters such as the aircraft’s weight, speed, inertial position and GPS signal.
Boeing’s newest jet, the 787, has such a check on the reliability of its air data sensors called Synthetic Airspeed, a system Boeing rejected for the MAX on cost grounds.
“It’s really important that a third angle of attack input, or synthetic airspeed, be available on this airplane,” Sullenberger said. “I would hope for a rapid adoption of that technology, and the sooner the better.”
EASA has said Boeing has agreed to develop a third angle of attack input after the MAX returns to service and to retrofit it to the MAX by the time the largest member of the family, the 737 MAX 10, is ready — likely one or two years away.
Sullenberger’s other main concern is that Boeing do something about the cacophony of false alerts that were triggered erroneously on the crash flights by one failed sensor.
In June 2019, at the invitation of Dave Calhoun, now Boeing CEO, Sullenberger tried out both the original and the updated MCAS software in one of Boeing’s flight simulators in Miami, replicating what happened on the crashed flights.
There, he experienced “the multiple, compounded alerts and the ambiguity of the events and the physical workload and the distraction.”
“It was clear to me how the accident crews could have run out of time and altitude,” he said.
He contrasted his own experience in 2009 — when he saw the geese approach seconds before they hit and felt the shudder as they were drawn into the engines, leaving little mystery about what was happening to his airplane — with that of the crew of Lion Air Flight JT610 in 2018.
On that flight, one sensor failure set off “rapidly cascading effects through multiple systems that quickly became ambiguous and confusing,” he said. “It’s likely the crew never fully comprehended what was killing them, especially since they had never heard of MCAS.”
Sullenberger said there should be some way to shut off erroneous alerts, especially the highly distracting “stick shaker” stall warning.
If triggered inadvertently, this loud steady shaking of the pilot control column will nevertheless continue for the remainder of the flight. Fixing this is something Transport Canada has demanded, and again Boeing has agreed to find a solution.
More broadly, Sullenberger wants updates to bring the 737 crew alerts up to the standards on later aircraft. When certifying the MAX, the FAA at Boeing’s request allowed an exception to the latest crew alerting safety regulations.
“Neither the MAX nor the 737 NG have a modern crew-alerting system,” he said.
Not only the MAX
Sullenberger doesn’t suggest that the 737 NG is unsafe, only that we are now aware of some risks that we can deal with.
“Historically, the 737 NG has had a good safety record comparable to that of the A320,” he said. With MCAS fixed, the risk from the angle-of-attack sensors or the crew alerting shortfalls is “a small risk, but it’s not insignificant.”
“Eventually, whatever can happen, will happen,” he said.
APA’s Tajer, who currently flies the 737 NG for American, agrees.
“The 737 NG is extraordinarily safe,” he said. “This is an opportunity to make it better.”
Peter Lemme, a former Boeing engineer who specialized in automated flight controls, likewise agreed, but explained why he feels it’s OK to retrofit these upgrades after the MAX returns to service.
He said the problem of a false stall warning from one bad sensor triggering multiple erroneous alerts is an issue not only on all 737s but also on the 747 and 757.
Though that’s not ideal, “we’ve been living with this issue for decades,” said Lemme, and those airplanes have good safety records. “Very satisfied” with the fix for MCAS, he doesn’t think the MAX should be “held hostage” to these other fixes.
The multiple problems generated by a false stall warning “need to be fixed in the long term and it’s something that needs to be addressed across all the fleets, not just the MAX,” Lemme said. “To get a commitment to fix it is reasonable. But I don’t think it should be a condition for the MAX ungrounding.”
Sullenberger certainly accepts that in the U.S., aviation is safer now than it ever has been.
In 1960, for example, commercial airplane accident records show 10 separate U.S. airliner accidents that together killed just shy of 400 people.
Although one passenger died in 2018 when shrapnel from an engine blowout pierced a window on a Southwest Airlines flight, that’s the only fatality among U.S. airlines in the past 11 years, with zero fatal crashes.
“We have made huge strides,” said Sullenberger. “We have made aviation ultrasafe.”
Still, he believes the MAX crashes could have happened in the U.S. and the flaws revealed have ripped away the prior sense of security.
“For most of Boeing’s history, it had a stellar record for designing and building excellent airplanes,” he said. “On the MAX, the flight-control system design was flawed … They had inadvertently created a deathtrap. It was a matter of time until it claimed lives.”
As for the FAA, Sullenberger said its status as the “gold standard” among aviation regulators is “shattered.”
Though FAA chief Steve Dickson said last week his agency cannot share detailed technical data on the MAX fixes because it is proprietary to Boeing, Sullenberger said there’s not enough transparency.
“This was such a failure. They will have to show us,” he said. “Surely there is a way to protect proprietary data and still show they are taking this seriously. I want to see their work. I want to see the hazard analysis and know what assumptions were made.”
Sullenberger also takes issue with some of the training the FAA proposes for pilots.
This week, when the FAA proposed minimum pilot-training requirements for the MAX, it didn’t mention an old procedure called the “roller-coaster technique” that can be used in emergencies when the aerodynamic forces on a stuck horizontal tail make it difficult to move manually — as happened in the Ethiopian Airlines MAX crash.
“Pilots should at least be aware of it and I think they should practice it in the simulator,” he said.
Approval for the MAX to fly passengers again seems near. But Boeing also needs passengers to be convinced that it’s now a safe airplane.
Bob Bogash, a former Boeing engineer and company director with more than 30 years’ tenure, leads a very active group of Boeing retirees who take a keen interest in developments.
Bogash in an interview said he, too, would like more transparency from Boeing about the technical details.
And he said his comfort level with flying on the MAX in future “will depend on how Boeing and the FAA respond to all the comments” that have come in with suggestions to make it better.
Sullenberger suggests the ungrounding may not be the end of the MAX saga.
“I’m going to keep on pushing for future improvements to this airplane even if it flies in the meantime,” he said.
___
© 2020 The Seattle Times
Distributed by Tribune Content Agency, LLC.
