Boeing 737 MAX safety not yet reassuring

Boeing remains to be in hot waters. After an unprecedented presentation by European Union Airline Safety Agency (EASA),  the head of this organization Patrick Ky expressed   skepticism of Boeing/FAA safety standards and pledged a tougher stance on ungrounding the deadly Boeing 737 MAX,

FlyersRight.org  was granted an exclusive interview.

FlyersRights: With MCAS (Maneuvering Characteristics Augmentation System), Boeing has apparently added a form of envelope protection to the 737 MAX.  We believe that MCAS is implemented in the Rockwell-Collins EDFCS-730 autopilot/flight control computer(s) (FCC).  The architecture of the 737 MAX FCC appears to be considerably more primitive and limited when compared to the architecture of the A320neo envelope protection system.  Particularly in the areas of sensor redundancy, self-diagnosis and software heterogeneity (we believe the software is single-sourced).

Additionally, the automation philosophy between the 737 and the A320neo appears to differ in that the A320neo system incrementally gives more control to the pilots, through flight control law progression, in response to system fault and/or failure.  The MCAS system does not appear to operate on the same principle.

EASA: An aircraft is certified based on the demonstration that its design complies with all relevant airworthiness requirements and all features are safe. Our airworthiness requirements are not prescriptive. Depending on the technology and system architecture used, aeroplanes can meet the safety objectives differently. Therefore, we would not compare aircraft to each other, rather assess how they comply with the requirements.

We believe that the master minimum equipment list for the A320 series does not allow flight if any of the heaters for the three angle of attack sensors are inoperative.  The master minimum equipment list for the 737 MAX appears to allow flight if either or both of the two angle of attack sensor heaters is inoperative.

FR: The nature of the 737 MAX’s airframe stability with MCAS disabled is unknown.  If EASA determines that the 737 MAX airframe is unacceptably unstable with MCAS disabled what effect could that have on pilot training requirements?  In particular, could a MCAS failure in-flight constitute an emergency situation?

What, if any, effects on EASA’s certification process might the above have?

EASA: Aircraft longitudinal stability is subject to airworthiness requirements. Boeing has to demonstrate compliance of the 737 MAX airframe with these requirements. Consequences of failures of systems affecting potentially the aircraft stability need to be assessed using acceptable safety analysis methodology also subject to airworthiness requirements. Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint.

We believe that Boeing largely or entirely self-certified the 737 MAX airframe, including the flight control computer software, under the FAA’s Organization Designation Authorization (ODA) program.

EASA: Some investigations are ongoing on the certification process followed by the FAA in the case of the B737 MAX. EASA do not wish to comment on the presumable “self-certification” or on the level of delegation to Boeing that the FAA has granted.

FR: We understand that MCAS and flight automation are not just used in emergency situations but routinely engaged to fly the plane and mask inherent instability in the design. It is unclear if these systems are disabled or turned off. How difficult it will be for pilots to fly the MAX manually without these systems?

EASA: EASA has set requirements for flight and simulator evaluation with 70 test points to be evaluated, covering both normal and abnormal operations. The simulator evaluation was performed in June and July.

FR: At a June 19th US Congressional House Aviation Subcommittee hearing on the 737 MAX, Captains Sullenberger, American Airline chief pilot and union head Dan Carey and Randy Babbitt, a former FAA head and experienced pilot, all testified that much more pilot simulator training was needed, that the FAA and airlines have cut back on pilot simulator training, that pilots needed to master about 100 emergency conditions and the manual instructions often had pilots performing tasks that are unrealistic.

FR: The MAX is not rated to use high altitude airports in hot weather, but was allowed to take off at such an airport in Ethiopia using a long runway at a very high speed that made the plane impossible to manually control the March 10 crash.

FR: There are very few full-motion MAX simulators, but many Regular 737 simulators. It is unclear whether the regular 737 simulators can be modified to mimic the MAX.

Do EASA or Mr. Ky have an opinion on this?  If not, what does EASA plan to do to ensure that all MAX pilots have required and necessary simulator training?

EASA: Flight crew training does not systematically require training sessions on flight simulators specific to the aircraft model. It is not unusual that, depending on the differences between two models, flight crews are trained on a flight simulator not specific to the model (in this case it would be a B737 NG flight simulator) and then a computer-based difference training is provided in addition. This has been shown to be acceptable and effective in a number of cases. In the case of the B737 max, our review of pilot training requirements is not completed yet and we have not reached a conclusion yet on that matter.