Boeing 737 Max Accidents

Ethics
Case Study: Boeing 737 Max
(information current as of June 4, 2019)

Boeing 737 Max Case Study
October, 2018 and March, 2019 crashes
Is it possible Boeing engineers violated
professional ethics with regard to the
MCAS anti-stall system that contributed
to both of these plane crashes?
This case study is based on information
available as of June 4, 2019 and may change
as further information becomes available
Source: https://commons.wikimedia.org/wiki/File:Boeing_737-8_MAX_N8704Q_rotated.jpg

Applicable Codes of Ethics
American Institute of Aeronautics and Astronautics
• Hold paramount the safety, health, and welfare of the public in performance of their duties;
• Avoid harming others, their property, their reputations or their employment through false or
malicious statements or through unlawful or otherwise wrongful acts;
• Issue statements or present information in an objective and truthful manner, based on
available data;
• Avoid real and perceived conflicts of interest, and act as honest and fair agents in all
professional interactions;
• Undertake only those tasks for which we are qualified by training or experience, or for which
we can reasonably become qualified with proper preparation, education, and training;
• Maintain and improve our technical and professional competencies throughout our careers
and provide opportunities for the professional development of those engineers under our
supervision;
• Treat fairly and respectfully all colleagues and co-workers, recognizing their unique
contributions and capabilities.
• Promote the lawful and ethical interests of AIAA and the aerospace profession;
• Reject bribery, fraud, and corruption in all their forms;
• Properly credit the contributions of others, accept and offer honest and constructive criticism
of technical work; and acknowledge and correct errors;
https://www.aiaa.org/about/Governance/Code-of-Ethics

National Society of Professional Engineers
Fundamental Canons
Engineers, in the fulfillment of their professional duties, shall:
1. Hold paramount the safety, health, and welfare of the public.
2. Perform services only in areas of their competence.
3. Issue public statements only in an objective and truthful manner.
4. Act for each employer or client as faithful agents or trustees.
5. Avoid deceptive acts.
6. Conduct themselves honorably, responsibly, ethically, and lawfully so as to enhance the
honor, reputation, and usefulness of the profession.
These canons are general principles and
require rules of practice for proper application
https://www.nspe.org/sites/default/files/resources/pdfs/Ethics/CodeofEthics/NSPECodeofEthicsforEngineers.pdf

National Society of Professional Engineers
Engineers, in the fulfillment of their professional duties, shall:
1. Hold paramount the safety, health, and welfare of the public.
Rules of Practice for Canon #1
• If engineers’ judgment is overruled under circumstances that endanger life or property, they
shall notify their employer or client and such other authority as may be appropriate.
• Engineers shall approve only those engineering documents that are in conformity with
applicable standards.
• Engineers shall not reveal facts, data, or information without the prior consent of the client or
employer except as authorized or required by law or this Code.
• Engineers shall not permit the use of their name or associate in business ventures with any
person or firm that they believe is engaged in fraudulent or dishonest enterprise.
• Engineers shall not aid or abet the unlawful practice of engineering by a person or firm.
• Engineers having knowledge of any alleged violation of this Code shall report thereon to
appropriate professional bodies and, when relevant, also to public authorities, and cooperate
with the proper authorities in furnishing such information or assistance as may be required.
https://www.nspe.org/sites/default/files/resources/pdfs/Ethics/CodeofEthics/NSPECodeofEthicsforEngineers.pdf

What Happened?

Boeing 737 Max
What happened?
Lion Air Flight 610 was a scheduled domestic flight operated by the
Indonesian airline Lion Air from Jakarta (in Indonesia) to Pangkal Pinang
(also in Indonesia). On October 29, 2018, Flight 610 (operated by the
Boeing 737 MAX 8) crashed into the Java Sea 12 minutes after takeoff,
killing all 189 passengers and crew.
This was the
first crash
involving a
Boeing 737
Max and the
deadliest
involving any
737 model.

Boeing 737 Max
What happened?
On October 28, 2018,
the same airplane
experienced similar,
repeated nose-down
maneuvers as Flight
610. A third off-duty
pilot who was also in
the cockpit during
that flight correctly
identified the
appropriate response
from the quick
action/quick
reference guide in
the cockpit.
Unusual and
repeated nose-
down
maneuvers
which are
intended to
avoid stalling
are called
“runaway trim”

Boeing 737 Max
What happened?
On October 28, 2018, the plane landed safely in Jakarta, having completed
its flight as planned and on schedule. This same airplane reported
problems with airspeed and altitude readings during four of the six flights
that occurred in the three days prior to the crash. The sticker shaker
activation (indicating an impending stall) that occurred on October 28 as a
result of runaway trim is considered an “un-airworthy” condition.
Was an
“un-airworthy”
airplane allowed to
take off as Lion Air
Flight 610 on October
29, 2018?
https://commons.wikimedia.org/wiki/File:Lion_Air_Boeing_737-MAX8;_@CGK_2018_(31333957778).jpg
https://www.popularmechanics.c
om/flight/airlines/a25349919/lion-
air-610-jet-not-airworthy/

Boeing 737 Max
What happened?
On October 28, 2018, flight data
indicated that the flight system
carried out three maneuvers to adjust
the nose downward, but the crew
initiated steps to override it a little
over eight minutes into the flight. The
flight made it safely to its destination
(Jakarta).
The Boeing 737 Max has override
switches that allow the pilot to take
control over these repeated nose down
maneuvers. The Quick Action/Reference
guide advises such override during
”runaway trim” conditions.

Boeing 737 Max
What happened?
On October 29, 2018, the pilots on Flight 610 were not able to identify the
proper quick action and response procedure to stop the same airplane from
similar runaway trim behaviors.
Did these pilots
have access to
information
regarding what
had happened
on the October
28, 2019 flight?

Boeing 737 Max
What happened?
On March 10, 2019, Ethiopian Airlines Flight 302 was scheduled to fly
internationally from Addis Ababa Bole International Airport in Ethiopia to
Jomo Kenyatta International Airport in Nairobi, Kenya. The plane crashed
in a field six minutes after takeoff, killing all 157 persons onboard.

Boeing 737 Max
What happened?
Did the nose control
(MCAS) system force
Flight 302 into the
ground? Was a sensor
providing incorrect
airspeed information?
Did both occur?
https://www.aviationcv.com/aviation-blog/2019/ethiopian-pilots-mcsas
The jackscrew which controls the horizontal stability of the airplane
involved in Ethiopian Air Flight 302 was found at the crash site in the full
nose-down position.

Boeing 737 Max
What happened?
After take-off, the Flight 302 airplane was going unusually fast (400 knots
or 460 mph compared to a more typical 200-250 knots). The pilot
requested permission to climb quickly – a request usually made and
granted when the pilot needs extra space to maneuver an aircraft that is in
trouble.
Why was the airplane going
too fast? Did a failed
airspeed sensor contribute?
Was human error involved?
In travelling too fast, any
attempts to override or
correct nose-down
movements are likely to
have been ineffective.
https://www.aviationcv.com/aviation-blog/2019/ethiopian-pilots-mcsas

Boeing 737 Max
What happened?
After take-off, a sudden spike occurred in the black box data, indicating a
potential anomaly in the angle of attack and airspeed sensors. Such a spike
may have been created by an outside factor.
https://www.reuters.com/article/us-ethiopia-airplane-reconstruction-insi/how-flawed-software-high-speed-other-factors-
doomed-an-ethiopian-airlines-737-max-idUSKCN1RH0FJ
Was sensor failure an issue in the Flight
302 crash?
The sensor that would have caused such a
spike in black box data has been
implicated in multiple fatal accidents and
other incidents in airplanes manufactured
by both Boeing and others.
https://commons.wikimedia.org/wiki/File:Angle_attack_sensor_hg.jpg

How does the
Technology Work?

Boeing 737 Max
How does the Technology Work?
The Boeing 737 Max is a
modification of an old (and
established) 737 design rather
than a new (“clean sheet”)
design. The original 737 (100
model) had its first flight in 1967.
In strong competition with
Airbus to reduce fuel
consumption, Boeing chose to
redesign the 737 rather than
design an entirely new airplane.
The first 737 Max was delivered
to Southwest airlines in 2015
with 14% reduction in fuel
consumption compared to the
737 NG (next generation) model.

Boeing 737 Max
The FAA requires that a pilot
operate only one type of
aircraft. Thus, it is to any
airline’s advantage to have as
many of the same type of
airplane as possible.
This added to the incentive
for Boeing to modify the 737
into the 737 Max rather than
come up with an entirely new
airplane design.

Boeing 737 Max
The original 737
had folding metal
stairs that attached
to the fuselage of
the aircraft in a
design that was low
to the ground to
facilitate access to
the airplane.
The larger engines
used in the 737
Max design had a
larger fan diameter
(69.4 inches) which
facilitated better
fuel performance. https://www.seattletimes.com/business/boeing-aerospace/u-s-pilots-flying-737-max-
werent-told-about-new-automatic-systems-change-linked-to-lion-air-crash/
Maintaining a mandatory minimum ground clearance
with the new and larger engines required larger landing
gear and moving the engines up and forward

Boeing 737 Max
The new geometry of the
737 Max caused by
design changes required
to facilitate larger, more
fuel efficient engines,
caused the airplane to
pitch upward more
frequently than previous
737 designs. The
Maneuvering
Characteristics
Augmentation System
(MCAS) was introduced
to manage this tendency
of the airplane to pitch
up.
https://en.wikipedia.org/wiki/Boeing_737_MAX#Structural_changes_and_other_improvements
The MCAS system was not originally designed
as a safety system but as an automatic
control system intended to maintain the
same handling as previous 737 designs.

Boeing 737 Max
Angle of Attack is the angle
between airflow and the
position of the wing.
Lift increases with Angle of
Attack, but at a certain
Angle of Attack, lift is lost,
and the airplane stalls,
unable to remain in the air.
Speed decreases the Angle
of Attack at which stall
occurs.
Angle of Attack can be
computed from one of two
types of sensors: wind vane
types or pressure sensors.
Most commercial jets use pressure sensors to
calculate airspeed and the Angle of Attack.
Angle of Attack sensors are placed in
locations where measurement error is likely
to be at a minimum.

Boeing 737 Max
Angle of Attack using pressure sensors (pitot tubes)
Air flows in to the tube at a certain flow velocity and is stopped, creating a
stagnation pressure that can be used, along with static air pressure, to
compute flow velocity,
The flow velocity computed at an angle consistent with air flow across the
wing can then be compared to the flow velocity at an angle consistent with
the plane’s forward motion to determine the angle of attack
In a pitot tube, the flow velocity (!) is related to the stagnation/total
pressure ("#) and the static air pressure ("$) as follows:
! =
2("# − "$)
*
where * is the density of the air

Boeing 737 Max
Pitot Tubes have caused a fatal aircraft accidents before....
• Air France Flight 447 (Airbus A330) on June 2009 crashed into the
Atlantic ocean, killing 228 people. Icing of the pitot tube was partly to
blame.
Over 200 instances
of angle of attack
sensor (pitot tube)
malfunction were
reported since
2004, not just on
Boeing planes.

Boeing 737 Max
What do we know?
Pitot Tubes have caused more fatal accidents before ...
• Birgenair (chartered) Flight 301 crashed on February 6, 1996, killing all
189 people on board. The cause of the crash was pilot error after
getting wrong information from one of the airspeed pitot tubes – likely
due to wasps creating a nest inside the tube.
• Northwest Orient Flight 6231 crashed on December 1, 1974 and killed
all three crew members on board. The cause of the crash was an iced
over pitot tube.
• Aeroperu Flight 603 (a Boeing 757) crashed en route from Miami to
Santiago, Chile on October 2, 1996. Incorrect airspeed and altitude
information on the cockpit displays were to blame (due in part to the
cleaning crew leaving tape on the static inlet to a pitot tube). The pilots
could not judge the airplane’s true altitude during night flight.

Boeing 737 Max
The B737 Max MCAS (Maneuvering
Characteristics Augmentation System)
automatically trims the airplane’s nose down
if a pre-determined angle of attack is sensed
by the AOA (Angle of Attack) sensors in order
to compensate for the altered geometry of
the 737 Max, avoid an impending stall, and to
create a handling experience similar to
previous 737 models.
This electronic trim control can be cut out by
the pilot at any time in order to return manual
control of the airplane’s angle of attack to the
pilot. The switches that enable this return to
manual control are located in the cockpit.

Boeing 737 Max
Many airplanes use three angle of attack sensors that reduce the overall
likelihood that an erroneous sensor reading will be taken seriously. The
two of three sensors that provide the most consistent readings are assumed
to be the fully operational and accurate sensors, while a third outlying
reading is assumed to be erroneous and is ignored.

Boeing 737 Max
The Boeing 737 Max uses only two angle of attack sensors and the MCAS
system reads from only one angle of attack sensor at a time. The only
indication of Angle of Attack is a disagree light in the cockpit that indicates
when the angle of attack may be approaching a stall.
An “optional” feature on the Boeing 737Max was a subsystem that would
allow the pilot to see the readings of both angle of attack sensors and also
see an indication of when the two sensors disagree.

What else do we know about these crashes?
Is the 737 Max safe to fly?

Boeing 737 Max
What else do we know?
The Boeing 737 Max uses only two angle of attack sensors and the MCAS
system reads from only one angle of attack sensor at a time.
Southwest Airlines will retrofit all of their 737 Max jets and require on any
new 737 Max orders that an angle of attack indicator (rather than just a
disagree or warning light) be present on the heads up displays that the pilot
uses to be aware of the aircraft’s position and movement in the sky.
Source: Wikimedia Commons
In general, heads-up displays
provide a less error-prone means
to assess aircraft position and
movement especially at night,
during landing and takeoff, and
during other low visibility or
extreme events. These displays
are often optional on
commercial jets.

Boeing 737 Max
What do we know?
And, MCAS takes 10
seconds to engage
(automatically adjust angle
of attack). In a crisis
situation, this delay may be
at odds with human ability
to cognitively process and
respond to the crisis.
The MCAS system was originally certified to a maximum angle of attack
adjustment of 0.6 degrees. Boeing later changed this to 2.5 degrees,
while most of the rest of the world thought MCAS remained limited to 0.6
degrees.
Further, the MCAS system was originally designed to offer take-off and
landing handling similar to previous 737 models. A decision was made
later on to keep MCAS on throughout flight.

Boeing 737 Max
What else do we know?
It is not possible to include a simulated stall in flight simulators and too
risky to create one in actual practice flights.
Thus, pilots are trained to use angle of attack as well as air speed,
altitude, and other indicators to diagnose impending stall.
Most aircraft issue a warning when the airplane is at 1.3 times the stall
speed.

What’s the bottom line?

Boeing 737 Max
the bottom line as we know it today
At the engineering level:
The MCAS system seems to be originally designed around enabling smooth
take-off and landing and duplicating the handling of previous 737 models
albeit with the bigger, more fuel-efficient engines of the 737 Max.
After the initial MCAS design (and design intent), however, the system was
expanded to operate during most of flight and allow up to 2.5 degree
changes in the angle of attack. Combined with a 10 second delay in
response, the system is confusing – which may explain why Boeing did not
extensively train pilots in its use.
Many changes appear to be made without considering the consequences on
other parts of the system and other scenarios. Unanticipated
consequences are a very common cause of failed technology and resulting
human tragedy. This could be a failure by Boeing to keep track of the “big
picture” – too many engineers focusing on only a small part of the system.

Boeing 737 Max
the bottom line as we know it today
At the pilot level:
The MCAS system is designed to be turned off (by pilots) if an angle of
attack sensor goes bad.
Heads-up displays seem to reduce the risk of a pilot misinterpreting the
speed, position, altitude, or other parameters associated with the aircraft.
There is a BIG difference between knowing how to fly a plane and knowing
how and why a plane can fly. Knowing both is essential in a world where
commercial jets are becoming more and more complicated.
Whose fault were these fatal accidents? Likely the only thing we know for
certain is that these 737 Max crashes were caused by more than one thing
going wrong. A full understanding of the complex factors that contributed to
the Lion Air and Ethiopian Air accidents is not yet available to the public.

Boeing 737 Max Accidents

More Related Content

What's hot

Similar to Boeing 737 Max Accidents

More from Denise Wilson

Recently uploaded

Boeing 737 Max Accidents