APD | Flawed analysis, failed oversight: similar reasons behind the Ethiopian Airlines and the Lion Air crashes

By APD writer Hu Yahui

When the Federal Aviation Administration announced that it grounded all Boeing 737 Max planes, the agency said it had identified similarities between last week's Ethiopian Airlines crash and the Lion Air crash in Indonesia six months earlier.

The Ethiopian Minister of Transport reiterated also said on Sunday that the preliminary data recovered from the black boxes of the crash in Ethiopia showed similarities to the Air Lion crash.

Ethiopian Airlines Flight 302 crashed on March 10 after taking off from Addis Ababa on its way to Nairobi, Kenya, killing all 157 people on board. The plane was carrying passengers from around the world, many of whom worked for the United Nations.

Lion Air Flight 610 crashed into the Java Sea in Indonesia on October 29 after taking off from Jakarta, causing 189 people on board died. The plane was scheduled to make a one-hour journey to Pangkal Pinang on the island of Bangka.

The planes were equipped with automated flight software called the Maneuvering Characteristics Augmentation System (MCAS), a relatively new feature to Boeing's Max planes.

The MCAS is a system that automatically lowers the nose of the plane when it receives information from its external angle of attack (AOA) sensors that the aircraft is flying too slowly or steeply, and at risk of stalling.

The AOA sensors send information to the plane's computers about the angle of the plane's nose relative to the airflow over and under the wings to help determine whether the plane is about to stall.

Jean-Paul Troadec, the former head of France's aviation accident investigation bureau, told CNN that he saw flaws in the system.

"I think the design of this system is not satisfactory as it relies on only one sensor," he said. "In case this sensor fails, of course the system doesn't work. And in this case it could be difficult for the pilot to overreact to the system."

Boeing CEO Dennis Muilenburg said Monday a software update and related pilot training for the 737 MAX will be released "soon" and will address concerns discovered in the aftermath of the Lion Air crash.

However, a Boeing spokesman said 737 MAX was certified in accordance with the identical FAA requirements and processes that have governed certification of all previous new airplanes and derivatives. The spokesman said the FAA concluded that MCAS on 737 MAX met all certification and regulatory requirements.

FLAWED ANALYSIS

As Boeing hustled in 2015 to catch up to Airbus and certify its new 737 MAX, Federal Aviation Administration (FAA) managers pushed the agency's safety engineers to delegate safety assessments to Boeing itself, and to speedily approve the resulting analysis.

But the original safety analysis that Boeing delivered to the FAA for a new flight control system on the MAX, a report used to certify the plane as safe to fly, had several crucial flaws.

That flight control system, called MCAS (Maneuvering Characteristics Augmentation System), is now under scrutiny after two crashes of the jet in less than five months resulted in the FAA's March 13 order to ground the plane.

Current and former engineers directly involved with the evaluations or familiar with the document shared details of Boeing's "System Safety Analysis" of MCAS, which The Seattle Times confirmed.

The safety analysis:

1. Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document.

2. Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane's nose downward.

3. Assessed a failure of the system as one level below "catastrophic." But even that "hazardous" danger level should have precluded activation of the system based on input from a single sensor - and yet that's how it was designed.

The people who spoke to The Seattle Times and shared details of the safety analysis all spoke on condition of anonymity to protect their jobs at the FAA and other aviation organizations.

FAILED OVERSIGHT

The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.

Early on in certification of the 737 MAX, the FAA safety engineering team divided up the technical assessments that would be delegated to Boeing versus those they considered more critical and would be retained within the FAA.

"There wasn't a complete and proper review of the documents," the former engineer added. "Review was rushed to reach certain certification dates."

But several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing.

A former FAA safety engineer who was directly involved in certifying the MAX said that halfway through the certification process, "we were asked by management to re-evaluate what would be delegated. Management thought we had retained too much at the FAA."

"There was constant pressure to re-evaluate our initial decisions," the former engineer said. "And even after we had reassessed it … there was continued discussion by management about delegating even more items down to the Boeing Company."

The Ethiopian Airlines pilot said he was having difficulties and asked to return to base, Ethiopian Airlines CEO Tewolde GebreMariam told CNN. The pilot was granted permission to return to ground around the same time the flight disappeared from radar.

A preliminary report by Indonesia's National Transportation Safety Committee said the crew of Air Lion Flight 610 struggled to override the plane's automatic systems in the minutes before it plunged into the ocean. The system pulled the plane's nose down more than two dozen times, the report said.

The report said the MCAS system was responding to incorrect data transmitted by an AOA sensor. A different flight crew experienced the same issue on a flight from Denpasar to Jakarta the previous day, but had turned off the MCAS and took manual control of the plane, the report said.

Before that crash, however, the Seattle Times told the FAA what it had. The FAA did not respond. Since the crash, the FAA said only that it followed its standard certification process for the jet, but refused to say anything more.

（ASIA PACIFIC DAILY）