Boeing is imposing yet more losses on carriers that were hapless enough to have purchased its 737 Max.
Early on Sunday, United Airlines and American Airlines announced they were keeping Boeing 737 Max aircraft out of their flight schedules through early November. That’s two months later than their most recent plans.
The Wall Street Journal swung into action and got more detail. Its take? That the scandal-plagued model may not fly until 2020. That would hit airlines that own the plane with lower capacity during the big volume holiday season. From the Journal:
Boeing Co.’s 737 MAX planes are unlikely to be ready to carry passengers again until 2020 because of the time it will take to fix flight-control software and complete other steps, an increasing number of government and industry officials say….
The situation remains fluid, no firm timeline has been established and Boeing still has to satisfy U.S. regulators that it has answered all outstanding safety questions. But under the latest scenario, the global MAX fleet is now anticipated to return to the air in January 2020, a full 12 months after the plane maker proposed its initial replacement of software eventually implicated in a pair of fatal crashes—one in October and one in March—according to some Federal Aviation Administration officials and pilot-union leaders….
Boeing executives, FAA engineers and international aviation regulators have steadily expanded their safety analyses to cover a growing list of issues spanning everything from emergency recovery procedures to potentially suspect electronic components. Some of those assessments are further complicated because they also cover earlier 737 models.
The article acknowledges that Boeing and the FAA are shooting for an earlier date but increasingly recognize that January is more realistic. And given all the missed deadlines, that supposedly conservative target may again prove to be optimistic.
The hurdles the 737 Max has to surmount include:
Making the MCAS correction to a potential stall less aggressive.
Changing the inputs to MCAS so it looks at both angle of attack sensors
Giving pilots a warning when the angle of attack sensors disagree (this was an upcharge as an extra safety feature; one assumes it becomes standard)
The Journal rather blandly described two issues that are known to be holding up giving the 737 Max an FAA green light. As we’ll discuss shortly, they could be difficult to remedy:
The topics included concerns about whether the average pilot has enough physical strength to manually crank a flight-control wheel in extreme emergencies.
In late June, Boeing and the FAA disclosed still another flight-control problem on the MAX, involving failure of a microprocessor that meant test pilots couldn’t counteract a potential misfire of MCAS as quickly as required.
Moon of Alabama provided very informative posts on each issue when they were first reported in the press. The first is that the manual trim wheel may require too much force under certain circumstances for some pilots to be able to operate it. This is a problem not just for the 737 Max but also for NG. From Moon of Alabama:
In the NG series a new Flight Management Computer (FMC) was added to the plane. …The lengthy FMCs did not fit on the original central pedestal. The trim wheels on each side, used to manually trim the airplane in its longitudinal axis or pitch, were in the way. Boeing’s ‘solution’ to the problem was to make the manual trim wheels smaller.
Smaller trim wheels = more pilot force required. Back to the article:
But the problems described above are 737 NG problems. The 380 or so existing 737 MAX are currently grounded. But some 7,000 737 NG fly about every day. The record provides that it is a relatively safe airplane. But a runaway stabilizer is a well known electrical malfunction that could by chance happen on any of those flights.
The changes from the 737 Classic to the 737 NG make it more difficult, if not impossible, for the pilots to recover from such a situation:
- The smaller manual trim wheels on the 737 NG make it more difficult to trim a runaway stabilizer back into a regular position.
- The larger stabilizer surface makes it more difficult to counter a runaway stabilizer by using the elevator which was kept at the same size.
- 737 NG pilots no longer learn the rollercoaster maneuver that is now the only way to recover from a severe mistrim.
Simulator sessions demonstrate(video) that a runaway stabilizer incident on a 737 NG can no longer be overcome by the procedures that current Boeing manuals describe.
It is pure luck that no NG crash has yet been caused by a runaway stabilizer incident. It is quite astonishing that these issues only now become evident. The 737 NG was certified by the FAA in 1997. Why is the FAA only now looking into this?
Erm, sounds like more training will be required…something Boeing has been very keen to avoid.
Moon of Alabama covered the second problem in June, citing the work of former Boeing flight control engineer Peter Lemme. If his take is correct, it sounds intractable, at least on time frames Boeing and its 737 Max customers would consider to be reasonable.
The trigger was that the “newer, better” MCAS software failed a test in one of its trials, catastrophically, because the chips couldn’t process the input quickly enough (emphasis original):
Meanwhile a new problem that will cause further delays was revealed only yesterday:
…In at least one instance, an F.A.A. pilot was unable to quickly and easily follow Boeing’s emergency procedures to regain control of the plane. The pilot rated that failure as catastrophic, meaning it could lead to the loss of an aircraft midflight, the people said.
The issue discovered last week is linked to the data-processing speed of a specific flight control computer chip, according to the two people with knowledge of the matter. In the test, the F.A.A. pilot encountered delaysin executing a crucial step required to stabilize an aircraft.
It seems that the additional signal processing and calculations needed for the MCAS fix overload the Flight Control Computer’s (FCC) processor and delay its reaction.
Boeing has been developing a software update for the Max for eight months, [a Boeing spokesman] said. It is unclear whether the new flaw can be resolved by reprogramming the software or requires a hardware fix, which would be costlier and could take much longer.
The interpretation by the author, who coded in assembly language on the very type of chip in question back in the day:
The processors in question are said to be Intel 80286 type CPUs. The original Intel version of that CPU, sold between 1982 and 1991, had a maximum clockrate of 4, 6 or 8 MHz. It was later manufactured by a number of other firms, including by AMD and aeronautics company Harris, with a clockrate of 20 and 25 MHz. It is likely that the Boeing 737 FCC uses these or similar types.
These old processors are very reliable and error free. But they have less than 1/1000nds of the computing capacity of a modern cell phone. According to Lemme one CPU in the flight computer runs up to 11 different processes. All need to receive the input of external sensors, run through their algorithms, and signal a command to the relevant actuators that control the moveable flight surfaces of the plane. That the FAA pilot “encountered delays in executing a crucial step” caused by the computer points to a capacity overload….
Programs written for flight control purposes are already highly optimized. To further optimize them ‘by hand’ would break the regulated process that production of such software requires.
Boeing says that it can again fix the software to avoid the problem the FAA just found. It is doubtful that this will be possible. The software load is already right at the border, if not above the physical capabilities of the current flight control computers. The optimization potential of the software is likely minimal.
Readers discussed this problem at length in comments when the Moon of Alabama post on the chip problem first ran. If his take is correct, this is a nasty problem. The chips are so old that any software on them has to be highly optimized, so there’s almost certain to be no headroom to ask it to do more. And for efficiency sake, the code is written in a low-level language, and also “optimized” for the physical characteristics of that chip. That means it can’t be ported to a newer chip (if it was not a horrifically big task to move to more advanced chips, Boeing would have done so a while back) without starting from close to zero. This means not just heavy-duty development and testing, but new certification….which is what Boeing has been desperate to avoid.
The Journal, at a 50,000 foot level, seemed to be on the same page:
Since the 737 MAX and its earlier version, called the 737 NG, share the same flight-control computer, fixes related to the microprocessor also apply to NG models, thousands of which remain in service around the world. Boeing also faces the task of convincing the FAA that a software fix, instead of physically replacing the suspect electronic component on all MAX planes, will suffice.
Now it may be that things are not as dire as the foregoing suggests. The press is full of reassuring noises that the 737 Max will be flying soon….just not as soon as hoped.
But at this point, Boeing deservedly has no credibility. At every turn, CEO Dennis Muilenburg has understated the severity of the problems with the 737 Max. Boeing also kept its customers in the dark about key issues, like the famed “AOA disagree” alert and gave them inconsistent information. In keeping, in the Wall Street Journal’s comment section, a few readers maintained they’d never fly the 737 Max, and while that sounds like a difficult vow to honor, one said he’d stick to Delta which hasn’t bought the plane.
And the longer this fiasco drags on, the greater the damage to the airlines that own the plane and to Boeing. That famed order of 200+ planes at the Paris Air Show is likely to go poof or be cut way back if 737 Max approval drags on too long. And we also have the non-trivial issue that foreign regulators will be more hard-nosed than the FAA.
If the latest delay doesn’t lead more investors to successfully pressure the board to have Muilenburg’s head, one will have to wonder if he has Jeffrey Epstein level dirt on some directors. There’s no good explanation for his continued survival.