The discovery of foreign object debris (FOD) in the fuel tanks of two-thirds of the recently manufactured MAX jets in storage has appalled Boeing’s top leadership.
Boeing has had issues with FOD for some time, not just on the 737 Max. FOD has shown up in air-refueling tankers recently delivered to the US Air Force and on other commercial jets. But the concern of Boeing’s CEO, while somewhat laudatory, comes rather late in the day.
And FOD is not the only problem with the 737 or more generally with Boeing.
In fact, Boeing faces two problems: one is engineering, and the other is manufacturing. Both raise deep concerns about Boeing aircraft and both need urgent attention.
So far the Federal Aviation Administration (FAA) has approached Boeing’s issues with blinders on, trying to only address one problem, and that one only partially. The FAA needs to do a much better job and it had best begin by demanding a complete re-inspection of Boeing aircraft delivered to customers, not just the 737 Max jets.
The MCAS Saga
MCAS is the Maneuvering Characteristics Augmentation System that Boeing grafted onto the 737 Max design when it was forced to relocate the new plane’s bigger engines, changing the aircraft’s center of gravity. Without MCAS, Boeing engineers understood the plane would pitch up on take-off and go critical, possibly causing a stall (when the airplane does not have enough lift) and a subsequent crash.
There is nothing particularly special about the need for MCAS. Modern airplanes, both commercial and military today use “fly-by-wire” systems to control elevators, rudders and ailerons – that is, the flight controls. Fly-by-wire (originally analog but today fully digital) run the aircraft and make it far easier for the pilot to control the plane. It also allowed military jets to optimize certain flight performance characteristics that, without a fully digital fly-by-wire system, these planes would not fly at all. Fly-by-wire uses the plane’s sensors, gyros and flight computers to do its work.
Boeing needed MCAS to add a feature to the 737 Max fly-by-wire system to prevent stalls during take-off procedures. But it took a shortcut: it linked the MCAS to a single sensor, the angle of attack sensor. There are two angle-of-attack sensors on the Boeing: one on the pilot’s side, the other on the co-pilot’s side of the aircraft. But the original MCAS took input only from one sensor and did not allow the pilot to change to the other if the sensor inputs appeared wrong or data output was erratic. (The choice of input sensor is varied from one sensor to the other for each flight.) We know for sure that erratic sensor outputs doomed the two fatal 737 Max crashes because it left the pilots fighting the control system and losing the battle. Boeing claims it has fixed all this by “permitting” the pilots to switch to the “correct” sensor and also by limiting the MCAS to only one flight control correction, instead of multiple and repetitive corrections causing a death spiral that the pilots could not correct.
All of these changes by Boeing sound good, but they still raise serious doubts. The FAA seems to be not asking important questions. These questions are, among others: Why didn’t MCAS take input from other sensors to arrive at a flight solution, such as from the plane’s artificial horizon, airspeed indicator, altitude data and other computer solutions on the flight profile? And what happens if the problem is not the sensor, but the wiring that connects the sensor to the flight computer and thence to the flight software and MCAS? It is known by now that the MCAS solution was a rush job and some whistleblowers from the company claim that MCAS was not properly designed or tested. Nor were pilots properly trained, or simulators able to replicate the MCAS gone haywire. The training and simulator issue is being addressed, but allegedly not the wiring or the weakness in the actual design, or why the sensors and algorithms ignore other possible inputs.
Also, MCAS is not being altitude limited – that is, it can trigger at any time in the plane’s climb out. Yet when the plane is still very low to the ground, the MCAS could force its nose down. In such cases, pilots might not have time to react and correct the attitude of the aircraft. This potential issue remains.
Before Lion Air Flight 610 crashed, the pilots on a previous flight reported an erratic angle of attack sensor, or so they thought. While the sensor tested good, maintenance replaced it anyway. What happened next was the crash. The crash has been analyzed and investigated, but the conclusion overlooks a key point: these sensors don’t typically fail; the presumably faulty sensor, in any case, was replaced with a new one, yet it is credited with giving readings that led to the crash.
While mentioned, the idea of faulty wiring or poor connectivity was not really addressed. Could it be that the angle-of-attack sensor was giving false readings because of loose connections spiking the results that went into the flight computer, meaning that the sensor itself was good but the hook-up was bad? Or, that it was getting cross-information from other data traversing the wiring, or processed by the computer?
The answer is, we do not know the answer, and it does not seem to be part of either the investigation or the proposed fix to the problem – meaning that the threat is not necessarily being entirely eliminated.
The MCAS saga leads directly to the issue of the plane’s manufacturing and, more importantly, quality control. The fact that two-thirds of the recently manufactured 737 Max aircraft had FOD in their fuel tanks, and this applies to other planes manufactured in other Boeing factories, suggests that management and oversight and quality control are completely broken down.
While Boeing no doubt tests different plane components on test stands, there are many problems that need visual inspection and careful checking, or problems that only show up in real use, when jets are under use and stress. Keep in mind that the planes that crashed were both virtually new, but they were put into service and disaster struck because the testing protocols were inadequate. No one has suggested longer flight testing is needed before aircraft are delivered to the customer and go right to commercial flights.
On February 15, 1996, the launch of an Intelsat satellite on a Chinese Long March 3B rocket went astray, with the rocket turning sideways after take-off, flying over the Xichang Satellite Launch Center fence and crashing into a nearby village (causing fatalities and damages). The Long March rocket launch was an important event supported by Loral Space Systems, which made the satellite. It involved the US government, which was concerned that the technology on the satellite might ‘leak’ to China. In the crash aftermath, it was determined that the launch failed because of a cold solder joint in one of the rocket gyros, something that bench testing never revealed.
For such reasons, testing and quality control has to be rigorous and can’t be left to testing methods that rely solely on technical measurements. Human visual inspection may have revealed the cold solder joint in the gyro; similarly, visual inspection might have quickly seen the FOD in Boeing-built fuel tanks.
How many disasters were averted since Boeing finally checked planes that not only were completed in the factory, but had already been flown to storage yards? And if the Max jets already delivered to customers are reinspected, the chances are extremely good that they too will be saturated with FOD.
Why would anybody fly on these aircraft without thorough re-inspection, even if it means that aircraft have to be torn down?
Companies that have already had Max jets delivered would be well advised to get going on a total re-inspection program.
But not a single owner has announced yet that they are doing so, and the lethargic FAA has not issued any airworthiness directives or orders demanding a re-inspection before the planes can be deemed airworthy.
Stephen Bryen has served as a senior staff director of the US Senate Foreign Relations Committee, as the Deputy Under-Secretary of Defense for Trade Security Policy, as the founder and first director of the Defense Technology Security Administration, as the President of Delta Tech Inc, as the President of Finmeccanica North America, and as a Commissioner of the US-China Security Review Commission. He has won civilian awards from the US Defense Department and is seen as an expert on technology security policy.