Content uploaded by Robert Cutler
Author content
All content in this area was uploaded by Robert Cutler on May 15, 2021
Content may be subject to copyright.
Ten Reasons to Defer Boeing 737 Max Recertification
Robert M. Cutler
October 2019
Abstract
The Boeing 737 Max aircraft, which experienced catastrophic crashes in 2017 and 2018,
were grounded pending their recertification as being safe. The problem is widely
recognized as vertical aerodynamic instability due to the aircraft’s enlarged engines, and
an erroneous angle of attack input to its Maneuvering Characteristics Augmentation
System which was intended to control the instability. Boeing has indicated that it will
correct the faulty software. This paper presents reasons why recertification should be
deferred pending additional changes, including airframe redesign to continue the tradition
of passenger aircraft stability that may benefit from but does not require dependence on
the corrective software. Details are explained under ten principal concerns: 1. profit
before safety, 2. outdated airframe, 3. series non-conformance, 4. aerodynamic instability,
5. unsafe “secret” software, 6. nose-down hazard, 7. reduced maneuverability, 8. low
ground clearance, 9. need for redesign, and 10. unwise precedent.
Introduction
The purpose of this paper is to advocate the deferral of grounded Boeing 737 Max
recertification until its airframe is redesigned, recertified, and physically modified to
achieve inherent stability, preferably as with its re-designation by a new series number
(not 737).
The author does not consider the presently unstable 737 airframe, even with correction by
instrumentation, software, and controls, to be acceptably safe. However, he is neither an
aircraft designer nor a pilot, and has depended on many others who have generously
provided specific details (any errors here being his own). He hopes that any inaccuracies
he may have introduced are excusable as leaving the conclusion intact.
The Boeing 737 Max has faulty instrumentation and controls which are undergoing
correction. Not as widely understood are the root causes, diverse aspects, and possible
future effects of the problem as described below. They imply that the ongoing correction
is not sufficient, and airframe redesign is imperative.
1
Principle Concerns
1. Profit Before Safety.
The Boeing Company built an enviable history of aircraft innovation and safety.
However, its 737 Max shortcut to outpace Airbus in a drive for profit compromised
safety; this led to the crashes of Lion Air Flight 610 on October 29, 2017 and Ethiopian
Airlines Flight 302 on March 10, 2018, killing a total of 346 people, with residual
dangers, worries, and costs to be borne by airlines and passengers worldwide. According
to a survey of 1,765 flyers, “Nearly half won’t fly MAX for year or more” (Sheetz,
2019).
2. Outdated Airframe.
Boeing designed, built, promoted, and sold aircraft with an outdated and only slightly
modified, 1965-93 vintage 737 airframe (reducing program cost by an estimated 75-85%
[Wise, 2019] and gaining quick certification) fitted with new, high-efficiency, powerful
engines. These introduced dangerous vertical aerodynamic instability, not previously an
acceptable characteristic of airline passenger aircraft. Though instability is needed by
agile fighter jets, as one pilot sarcastically noted in his Max critique, it lacks fighter
ejection seats. According to another analyst, “The 737 [Max] was, plain and simple, a
stopgap measure” (Campbell, 2019). Overall, the 737 Max does not appear to be
consistent with previous Boeing accomplishments. Instead, “The venerable company
somehow made an aircraft that violates aerodynamic principles and tried to amend or
conceal this with automation” (Travica, 2019).
3. Series Non-Conformance.
By designating the Max as a 737, Boeing knew that crew members with an old 737 “type
certificate” would be allowed to fly the Max with only very minor additional computer-
based training. However, since the new aircraft's handling requirements could differ
substantially, dubious Max crew-readiness was thus marketed to the airlines. Captain
Laura Einsetler, with flying experience of 30 years including on 737s, described the
inadequate training: “I don’t have the schematics. I don’t have the cockpit panels. I don’t
have an instructor that I can ask questions to … You’re hoping that the first time you see
the Max is on a nice clear day. But sometimes it’s not, and you’re showing up at night or
in bad weather into an airplane that has all these changes” (Campbell, 2019). But Boeing
was careful to minimize superficial changes, even “re-creating 40-year-old analog
instruments in digital formats … all for the sake of keeping the Max within the
constraints of its common type certificate.” (Campbell, 2019). Meanwhile, a totally new
system (described below) that Boeing considered necessary for safety, but that ultimately
caused two catastrophic aircraft crashes, was kept a virtual secret.
2
4. Aerodynamic Instability.
The unique instability of the 737 Max, due to its mismatched airframe and engines, tends
to result in a hazardous “nose-up” and climbing “angle of attack” (AoA), aerodynamic
stall, loss of control, and fall from the sky. Lacking an appropriate airframe re-design, an
alternative solution was sought. One “solution” could have been in-depth crew training to
fly the 737 Max and acceptance of an increase in cockpit workload, including the need
for continuous attention (not always given in auto-pilot mode), quick recognition of
excessive nose-up situations and instrumentation/software failures, and immediate
responsiveness. Such needs may run against the recent trend of replacing well-qualified
but increasingly scarce pilots with computer specialists in the cockpit. Furthermore, the
increased need for cockpit security from interference hinders crew member return to the
cockpit after a break, even when called back for an emergency.
5. Unsafe “Secret” Software.
Boeing therefore adopted a second “solution” to 737 Max instability: the addition of
equipment that it named the “Maneuvering Characteristics Augmentation System”
(MCAS). The MCAS was designed to respond to an excessive AoA sensor input by
pushing down a nose that had been allowed to rise too high, threatening a stall and loss of
control. However, there were several problems with the MCAS:
The generally deficient software repeatedly and excessively lowered the noses of
the aircraft until they crashed. This deficiency may have been accentuated by the
use by Boeing (but not by its competitor Airbus) of a yoke (steering device) that
resists movement away normal positions (Scott et al, 2019). Resistance to AoA
correction may even be considered to be too great for the strength of some pilots,
but according to a source close to the [recertification] situation: “Neither Boeing
nor regulators anticipate design or equipment changes as a result from the review”
(Boon, 2019). (Such a determination to recertify without design or equipment changes
seems to be misguided with regard to many aspects of the 737 Max.)
Though each airplane that crashed had switches to shut the errant MCAS, the
problem and solution were not recognized due to MCAS “secrecy.” The limited
opportunities for correction expired during an attempts to find answers not present
in the Quick Reference Handbook or QRH (Blum, 2019; Campbell, 2019). Also,
previous 737s required only a tug on the controls to change from autopilot to fully
manual flight, but the lost crews did not know that the MCAS would continue to
operate (Scott et al, 2019).
Though the MCAS was not considered as essential to fly the 737 Max (Scott et al,
2019), its reliance on erroneously high AoA sensor input or faulty software
brought two of them down. The MCAS should have been recognized as being
equivalent to critical in that sense. The display and use of both rather than only
one AoA sensor input was an available extra-cost option not present on the lost
airplanes. A more appropriate safety requirement would be for each aircraft to
3
carry not just two but three AoA sensors, all to be used in an automatic “voting”
scheme to facilitate overriding the sensor in disagreement.
6. Nose-Down Hazard.
Vertical instability also tends to decrease an errantly low AoA even further. The
large downwardly-directed engines would experience much air resistance pushing down
on their exposed upper surfaces. This effect may be an often-overlooked factor in the
rapid elevation losses that occurred.
7. Reduced Maneuverability.
Instability threatens to impair maneuverability of the 737 Max in difficult situations, such
as encountering an object improperly in the flight path, a high or gusty runway cross-
wind, a major storm system, or clear air turbulence.
8. Low Ground Clearance.
Older 737s had low engine ground clearance to facilitate luggage loading/unloading and
reduce airstair height for passenger boarding/deboarding (Wise, 2019). The low ground
clearance and increased air intake of the larger engines adds to concerns regarding engine
failure from sucking in birds or any kind of debris on or near a runway.
9. Need for Redesign.
Problems with the 737 Max such as those described above appear to have rightly led to
the statement that “Perhaps the question should not be when the 737 Max will return to
the sky but whether it should,” and that a solution could be design modification, e.g.,
lengthening the landing gear, repositioning the engines, and increasing the tail size to
gain stability (Wise, 2019). Financial pressure must not be allowed to lead to additional
safety deficiencies. If necessary, the United States government may need to intervene to
return Boeing to its historically safe path, with considerations of competitiveness with
Airbus (factoring in World Trade Organization views and subsidization issues), regulation
as a quasi-governmental entity, or even full nationalization).
10. Unwise Precedent.
If the Boeing 737 Max is recertified with only software or instrumentation modification,
Boeing can expect to be rewarded for its imprudent gamble with the lives of passengers
and crews. Furthermore, inherently unstable passenger aircraft may continue to be
designed by and certified for all manufacturers, sacrificing safety for profit. Instead, the
aircraft should be renamed (to differ from the 737 series) and redesigned for stability and
safety, independently ensured. Individuals at fault in past safety failures should atone by
working in the future not for profit, but only for safety.
References
4
Aren, Si Anak, Investigasi Kecelakaan Lion Air, Benturan Kepentingan dan
"Positioning" Media (Lion Air Accident Investigation, Conflict of Interest and Media
"Positioning”), June 18, 2019, https://sianakaren.blogspot.com/2019/06/investigasi-
kecelakaan-lion-air-jt-610.html
Blum, Sam, Lion Air Pilots Searched Plane Handbook Right Before Catastrophic Crash,
March 20, 2019, https://www.popularmechanics.com/flight/airlines/a26885871/lion-
air-pilots-handbook
Boon, Tom, Physical Pilot Strength Delaying Boeing 737 MAX Re-entry To Service, June
20, 2019, https://simpleflying.com/boeing-737-pilot-strength
Campbell, Darryl, Redline: The Many Human Errors That Brought Down the 737 Max,
May 2, 2019, https://www.theverge.com/2019/5/2/18518176/boeing-737-max-crash-
problems-human-error-mcas-faa
Chang, Alvin, Dion Lee, and Kim Mas, The Real Reason Boeing’s New Plane Crashed
Twice, April 15, 2019, https://www.youtube.com/watch?v=H2tuKiiznsY
Scott, Alwyn, Wen Foo, and Eric M. Johnson, Change to 737 Max Controls May Have
Imperiled Planes, Experts Say, March 22, 2019, https://graphics.reuters.com/ethiopia-
airline-controls/0100916v1nz/index.html
Sheetz, Michael, Boeing Downgraded by Barclays on Survey Showing Flyers Will
Avoid 737 Max, May 7, 2019, https://www.cnbc.com/2019/05/07/barclays-
downgrades-boeing-survey-shows-fliers-will-avoid-737-max.html
Travica, Bob, Beware of Dog: Aircraft Automation and Fatal Accidents 1.3, June 2019,
https://www.academia.edu/39704004/beware_of_dog_aircraft_automation_and_fatal_acc
idents_v3
Wise, Jeff, Is the Boeing 737 Max Worth Saving?, March 2019,
http://nymag.com/intelligencer/2019/03/is-the-boeing-737-max-worth-saving.html
5