Little noticed, days before the holiday break, Boeing petitioned the Federal Aviation Administration for an exemption from key safety standards for the 737 Max 7 — the still-uncertified smallest member of its newest jet family.
Since August, earlier models of the Max currently flying passengers in the U.S. have had to limit use of the jet’s engine anti-ice system after Boeing discovered a defect in the system with potentially catastrophic consequences.
The flaw could cause the inlet at the front end of the pod surrounding the engine — known as a nacelle — to break and fall off.
In an August Airworthiness Directive, the FAA stated that debris from such a breakup could penetrate the fuselage, putting passengers seated at windows behind the wings in danger, and could damage the wing or tail of the plane, “which could result in loss of control of the airplane.”
Dennis Tajer, a spokesperson for the Allied Pilots Association, the union representing 15,000 American Airlines pilots, said the flaw in the engine anti-ice system has “given us great concern.”
He said the pilot procedure the FAA approved as an interim solution — urging pilots to make sure to turn off the system when icing conditions dissipate to avoid overheating that within five minutes could seriously damage the structure of the nacelle — is inadequate given the serious potential danger.
“You get our attention when you say people might get killed,” Tajer said. “We’re not interested in seeing exemptions and accommodations that depend on human memory. … There’s just got to be a better way.”
In its petition to the FAA, Boeing argues the breakup of the engine nacelle is “extremely improbable” and that an exemption will not reduce safety.
“The 737 Max has been in service since 2017 and has accumulated over 6.5 million flight hours. In that time, there have been no reported cases of parts departing aircraft due to overheating of the engine nacelle inlet structure,” the filing states.
On Thursday, Boeing said in an emailed statement that it is “developing a long-term solution that will undergo thorough testing and FAA review before being introduced to the 737 Max fleet.”
In the meantime, Boeing said “inspections are ongoing” to check for any damage to the nacelles on Maxes in service.
However, without an exemption from current safety regulations, the FAA cannot approve the final two Max models, the Max 7 and Max 10, to fly passengers.
On Christmas Eve, just before the deadline for public input on the proposed Max 7 exemption, the Foundation for Aviation Safety — a lobbying group set up by former Boeing manager and whistleblower Ed Pierson following the two deadly Max crashes — filed a submission calling on the FAA not to certify the airplane until Boeing fixes the safety defect.
“The Foundation is alarmed at the FAA safety culture, allowing consideration of an exemption proposal … for certification of a new airplane model with a known catastrophic failure (risk) resulting from a simple mistake by the flight crew,” the Foundation’s submission states.
Warning: Don’t forget to turn it off
Industry analysts and Boeing investors have long anticipated Max 7 certification being granted soon. The company’s share price rose significantly toward year-end based partly on that expectation.
If the exemption is granted, certification can go ahead, allowing the Max 7 to begin flying with Southwest Airlines.
Boeing would have until mid-2026 to design, test and certify a permanent fix for the engine anti-ice system defect that would then be retrofitted to all Maxes.
By then, there could be nearly 2,000 Maxes in service, meaning more than 4,000 engines needing the retrofit.
Until then, pilots would have to adhere to the limitation currently applied on the Max 8 and Max 9 models. After emerging from icy conditions into drier air they have to make sure they turn off the engine anti-ice system, which heats the inner barrel of the engine pod so that ice doesn’t build up.
If they fail to do so, the system can quickly overheat the carbon composite material and damage the structural integrity of the engine pod.
The problem is there’s no alert or indication to the crew that the system needs to be turned off. They just have to remember to do it.
If they forget, or are distracted by other tasks, the overheating can begin to damage the structure after just five minutes.
Tajer said it’s “not uncommon” for pilots on other aircraft to inadvertently leave the anti-ice system on when it is no longer needed.
On older 737s, for example, this would waste energy but not do any damage. The defect affects only the Max, with engine inlets made from carbon composite rather than the metal used on older models.
Independent aviation safety consultant and pilot John Cox said he’s run the anti-ice system on the previous 737 “for long periods of time.”
And he’s unsure how practical it is to ask a Max flight crew to limit the time the system operates in dry air.
“I’ve been in and out of cloud tops,” Cox said. “Do you turn it on, turn it off, turn it on, turn it off?”
“If you are doing that and get distracted, and end up with the anti-ice off and you go back into clouds where you pick up inlet icing, the next time you turn it on, you’re going to ingest that ice,” he added.
After reviewing Boeing’s petition, Cox said he’d recommend the FAA turn it down.
“With the possibility of such a failure and an Airworthiness Directive with significant limitation already in place, my vote would be to deny the exemption request,” Cox said. “Yes, it would affect entry into service, but it could create an ‘unsafe condition’ by the FAA’s own words.”
Michael Stumo, father of Samya Rose Stumo, who died in the second Max crash of an Ethiopian Airlines jet in 2019, said “Boeing claims to have learned its lessons with a new focus upon safety. That is not true.”
“Boeing is still avoiding safety rules rather than building safe aircraft,” Stumo said.
A single point of failure?
Boeing’s petition states that the potential breakup of the engine pod was discovered through analysis and flight testing and could happen only in the case of “multiple, independent system failures during specific operational and environmental conditions.”
“Boeing’s quantitative risk assessment evaluated this scenario to be extremely improbable,” the filing concludes.
But Joe Jacobsen, a retired FAA safety engineer and adviser to the Foundation for Aviation Safety, says the petition offers no evidence that this is not a single point of failure.
“A pilot forgetting to turn it off, that’s all it takes,” said Jacobsen.
Mike Dostert, another retired FAA safety engineer and also an adviser to the foundation, concurs.
“All it takes is for the system to be left on and you damage the structure,” said Dostert. “I don’t see the multiple failures.”
Without any kind of crew alert to tell the pilots they should shut off the system, he said “there’s a pretty good chance human error is going to occur.”
Notably, among the various regulations Boeing wants exempted from is one requiring the jetmaker to prove that any “single failure or malfunction or probable combination of failures (that) will jeopardize the safe operation of the airplane … is extremely remote.”
Dostert added that this defect could overheat and damage both engines on the plane simultaneously, making such an event potentially even worse than several serious accidents in recent years when broken engine fan blades caused the inlet cowl to break off a single engine.
In 2018, a passenger aboard a Southwest Airlines 737 died when a broken fan blade destroyed an engine cowl. Shrapnel penetrated the aircraft’s fuselage and broke a cabin window beside the passenger.
The pod around the engine is part of the airframe and is the responsibility of Boeing, not the engine maker.
Dostert said an earlier nonfatal engine blowout on a Southwest flight in 2016 had also led to the inlet cowl departing the aircraft but no fix was made before the fatality in 2018.
Almost six years later, the fix for that broken fan blade scenario in older 737s is still in the works. In December, the FAA published a proposal that gives Boeing until the middle of 2028 to develop a retrofit that will strengthen the inlet cowls and fan casings.
“There’s a pattern here,” Dostert said. “Of Boeing knowing about potentially catastrophic single failures, and not addressing them in an expeditious manner.”
Equivalent safety to the Max 8 and Max 9
In 2022, Boeing CEO Dave Calhoun threatened to cancel the Max 10 if Congress didn’t amend a law granting permission to certify the jet without meeting the safety regulation for crew alerting systems included in the 2020 Aircraft Certification, Safety and Accountability Act.
Congress bowed to the pressure and amended the law, amounting to a safety exemption for the Max 7 and Max 10 models.
Boeing argues in its December petition that granting the new exemption, with the same procedural limitation on how the pilots use the engine anti-ice system that applies to the Max 8 and Max 9, will leave the Max 7 no less safe than those two aircraft that are flying passengers every day.
But Cox said “there’s a difference in an unsafe condition found on the existing fleet and an unsafe condition prior to certification.”
He said he’s uncomfortable with the idea of “certifying an airplane with an acknowledged potential unsafe condition.”
With the Max 8 and 9 already flying, Cox said the FAA’s only alternative to imposing the operational restriction on those jets was to ground the fleet.
“Do I think it’s worth grounding the fleet? No, I don’t. It’s a bit of a tough call,” Cox said. Limiting use of the anti-ice system in dry air is “probably the best compromise that the FAA and Boeing could come up with and agree on.”
But for Boeing’s two still-to-be certified airplanes, the Max 7 and Max 10, he thinks an expedited permanent fix is a better approach.
“They need to make it a very strong priority to minimize the time under which the engine is operating with this potential problem and to restore the anti-ice system to normal,” Cox said.
The FAA said in an emailed statement that it will investigate how the defect was missed during the Max’s original development and certification and “will issue a corrective action to ensure Boeing’s future certification programs … are improved.”
The safety agency said it will rule on Boeing’s petition, but “there is no specific timetable.”
___
© 2024 The Seattle Times
Distributed by Tribune Content Agency, LLC.
