MAX Exposure

In the present day, the safety of commercial air travel is virtually taken for granted. The worldwide air transportation system is so reliable, accessible, and essential to commerce that the traveling public barely gives more than a passing thought to the possibility of catastrophe on any given flight. Indeed, a 2018 Airbus-sponsored study found that the fatal accident rate for commercial airliners declined by 95 percent since 1998.

It is, therefore, no surprise that rare instances of airline crashes garner widespread media attention. And when disaster strikes the latest development of the best-selling airliner ever produced twice in quick succession, it dominates the news cycle for weeks, leaves the world stunned, and generates demands for answers from manufacturers, operators, and regulators alike.

Let’s look at the development of the Boeing 737MAX series; the challenges it faced in certification of a new derivative; the two accidents that captivated the world, followed by the grounding of the type; and the claims implications emerging as the proverbial dust settles.

From Next Generation to the MAX

The ubiquitous 737 Next Generation, or 737NG and its various ilk, forms the backbone of the short- and medium-haul fleets of many airlines around the world. The 737NG is a development of the Boeing 737 “Classic,” which has evolved through several variations since the first flight of the 737-100 in 1968. To date, over 10,000 Boeing 737s have been ordered, making it the best-selling commercial airliner in history. Its chief competitor, the Airbus A320 series, has sold nearly as many examples since service entry in 1988.

In the mid-2000s, aircraft engine manufacturers CFM International and Pratt & Whitney began developing new models to incorporate advancements in turbofan technology. Promising between 15-20 percent reduction in fuel consumption, Airbus launched a new engine option derivative of the A320 in December 2011, called the A320neo, offering airlines a choice between the CFM International LEAP series or Pratt & Whitney’s latest product, the PW1000G.

Not to be outdone, in August 2012, Boeing announced the 737MAX, a development of the 737NG. As its sole powerplant, it featured the CFM International LEAP-1B engine, specifically developed for the 737MAX. A principal advantage conferred by a derivative of an existing product is commonality with in-service types, reducing complexity as well as costs for maintenance, training, and scheduling. Existing 737 customers made clear that this was a non-negotiable factor of paramount importance.

The larger fan diameter of the LEAP-1B presented an engineering dilemma for Boeing, though. To maintain consistency with earlier 737s, the junction of the wings to the body of the aircraft could not be substantially modified, so it could not simply revise the landing gear to increase ground clearance. Doing so would require a major airframe redesign, tantamount to developing an all-new type; a non-starter for potential customers.

To solve these challenges, Boeing designed a new pylon to mount the LEAP-1B engine slightly above and forward of the wing. By late 2012, Boeing concluded the LEAP-1B could be accommodated using the same landing gear and clearances of previous 737 generations. Satisfied the design would meet performance targets, Boeing moved ahead with production.

Enter MCAS

During flight testing, Boeing found that the 737MAX exhibited a slight nose-up control bias in particular phases of flight, which was attributed to the forward and elevated position of the larger LEAP-1B engines. This tendency manifests most notably in high-power, low airspeed, high angle-of-attack situations where the aircraft is oriented in a steep pitch relative to its forward movement through the air and the horizontal axis. From a pilot’s perspective, it resulted in a lighter elevator control “feel” as compared to the 737NG, a troubling finding for Boeing considering the importance of commonality of 737MAX flying characteristics to earlier variants. Boeing believed this lighter control feel and nose-up pitch moment could accelerate an aerodynamic stall in some phases of flight, such as climbing under manual control shortly after takeoff. An aerodynamic stall occurs when airflow over the wing is disrupted, reducing the ability of the wing to generate lift, creating a hazardous situation for an airliner.

To counteract this phenomenon, Boeing implemented a software-based system that autonomously commands nose-down pitch when the flight control computer identifies the simultaneous existence of four separate conditions:

1. The aircraft is in manual flight, with autopilot disengaged.

2. A high angle-of-attack above a certain threshold, as determined by one of two angle-of-attack sensors mounted to the nose of the aircraft.

3. Wing trailing-edge flaps in “up” (fully-stowed) configuration.

4. A high bank angle, indicative of a steep turn.

The program, dubbed “maneuvering characteristics augmentation system,” or MCAS, is designed to do as its name suggests: independently augment manual control of the 737MAX to more closely match the “feel” of previous generations of 737. It also assists pilots in avoiding critical angle-of-attack and potential stalls.

As originally conceived, MCAS functions by commanding incremental movement of the horizontal stabilizer, a large, wing-like control surface in the tail section of virtually all airliners. The horizontal stabilizer of the 737 pivots several degrees upward or downward to stabilize the aircraft about the vertical, or pitch, axis in a process called trimming. Trimming also improves the authority and feel of control surfaces on the trailing edge of the horizontal stabilizer that induce climb or descent, known as elevators. Elevators respond to the forward or backward movement of the control column, commonly known as the yoke.

If the flight control computer finds all four requisite conditions satisfied, MCAS engages and commands progressive nose-down horizontal stabilizer trim inputs. Once activated, MCAS will disengage if the flight control computer no longer recognizes one or more of the four requisite conditions. Similarly, if a pilot manually applies nose-up electric trim from a switch on the control column, MCAS will inhibit for a period of five seconds, after which the computer will evaluate whether the four conditions remain. If they do, MCAS will reactivate and the cycle begins again, applying additional nose-down trim from the stabilizer position at the time of activation. Finally, MCAS can be permanently inhibited by a cut-out of the electric trim system, using an procedure to address a so-called “runaway stabilizer,” for which all 737 pilots have been trained since the 1960s. After cutting out electric trim, manual trim inputs can be made using a control wheel mounted on a pedestal between the pilots.

Mechanical and software solutions to some insidious consequences of high-speed, high-altitude flight have been safely incorporated in aircraft design for generations. For instance, since the dawn of the Jet Age, “mach trim” systems have been installed in airliners, designed to prevent the nearly-unrecoverable “mach tuck” phenomenon found at high speeds. Another system, speed trim, is functionally similar to MCAS insofar as it adjusts pitch trim in manual flight without the pilot’s input, based on the flight control computer’s analysis of several factors, including angle-of-attack sensor data and airspeed indications. In fact, the software architecture of the original MCAS was nearly the same, but for the fact that MCAS only drew angle-of-attack data from one of the two sensors at a time. On the other hand, speed trim and similar systems consider data from both angle-of-attack sensors simultaneously, inhibiting the function when flight control computers identify a disagreement between the two sources.

Aviation regulators, working in conjunction with Boeing engineers in identifying and classifying potential failure modes of various systems, evaluated and approved MCAS during the certification process of the 737MAX.

First Signs of Trouble

On the evening of October 28, 2018, a three-month-old Lion Air 737MAX8, registered PK-LQP, reported airspeed and attitude abnormalities during a domestic flight from Denpasar/Bali to Jakarta, Indonesia. Passengers recalled a “roller-coaster” sensation as the airplane oscillated between nose-up and nose-down pitch for most of the 90-minute flight to the nation’s capital. The pilots alerted air traffic control to their issues but maintained control and safely landed in Jakarta. The pilots logged navigation and instrumentation problems with sensors on the left side of the airplane for maintenance attention during the overnight hours.

The next day, PK-LQP departed Jakarta shortly after 6:00 a.m., carrying 181 passengers and eight crewmembers on a domestic sector to Pangkal Pinang as flight JT610. Three minutes into the flight, the crew reported controllability issues and requested a return to Jakarta. In the following 10 minutes, radar returns show fluctuating altitude and airspeed, but a general trend of descent until the aircraft crashed into the ocean at 6:33 a.m., leaving no survivors.

The investigation focused on a faulty angle-of-attack sensor replaced at Bali two days before the crash. An interview with the crew of the flight from Bali to Jakarta identified anomalies with the aircraft’s automatic trim system, reportedly commanding multiple applications of nose-down pitch during the flight. The crew conducted a “runaway stabilizer” procedure and engaged cut-out switches for the electric trim, stopping the wild pitch variations. On arrival in Jakarta, testing revealed a 20-degree difference between the indications of the left and right angle-of-attack sensors. It remains unclear what steps mechanics took to correct this disagreement before the accident flight.

After recovery and analysis of the flight data recorder of PK-LQP, investigators found evidence that the MCAS system engaged more than 20 times on the accident flight, with the pilots inhibiting it each time with the application of nose-up electric trim. Every successive activation of MCAS, however, caused overall nose-down trim to increase, and the aircraft was found with full nose-down trim applied at the moment of impact.

In the meantime, engineers expressed concern over the architecture of MCAS, specifically for its reliance on data from only one angle-of-attack sensor, without redundancy. This, in theory, could cause a “garbage in, garbage out” scenario whereby the flight control computer acts on faulty data fed to it from a defective sensor. The result could be an unwanted activation of MCAS with nose-down trim inputs when all other factors, including visual cues to the pilot, indicate controlled flight.

On November 6, 2018, Boeing released an airworthiness directive pertaining to the 737MAX emphasizing the runaway stabilizer procedure to arrest continued unwanted nose-down trim inputs based on the flight control computer’s response to bad data. While 737 pilots receive training on the procedure and the presentation of a runaway stabilizer, widespread concern arose from the apparent lack of disclosure of the existence of MCAS in the first place.

To improve situational awareness, Boeing recommended airlines provide additional training on the runaway stabilizer procedure and the role of MCAS, but the worldwide 737MAX fleet remained in service. Boeing announced it would develop and implement a software update for MCAS to improve redundancy, specifically addressing the possibility of a defective angle-of-attack sensor. Certification and service entry of the software update was planned for April 2019.

Reaching a Crisis Point

737MAX service continued uneventfully until the morning of March 10, 2019, when a five-month-old 737MAX8 operated by Ethiopian Airlines, registered ET-AVJ, crashed six minutes after departure from Addis Ababa, Ethiopia while en route to Nairobi, Kenya. There were no survivors among the 149 passengers and eight crew of flight ET302.

Similarities with the Lion Air disaster became immediately apparent. Airspeed and altitude data from the Ethiopian flight showed unusual fluctuations commencing shortly after takeoff during climb, when the airplane is ordinarily in manual flight. Preliminary reports documented a disagreement between the left and right side angle-of-attack sensors, as well as deviating information presented to the pilots as to altitude, airspeed, and flight director pitch bars.

Shortly after takeoff, the pilots switched to an autopilot mode, which disengaged 30 seconds later and returned the airplane to manual flight. At 1,000 feet above the ground, flaps were retracted, and the captain commanded climb power. Takeoff and initial climb are defined as “critical” phases of flight due to the high pilot workload associated with crowded airspace and limited time/altitude to correct anomalies. During this critical period, just after the flaps were stowed, the ET302 crew suddenly faced multiple warning lights, aural alerts, and flight control notifications signaling multiple failures.

The pilots’ response was predictably frenetic. We now know MCAS activated once the flaps retracted, resulting in continuous nose-down trim inputs the pilots did not command. The captain, flying the airplane from the left seat, pulled back on the yoke, but the nearly full nose-down trim of the horizontal stabilizer negated the authority of the elevators to initiate a climb. Presumably because of the training received in the wake of the JT610 crash, the captain commenced the runaway stabilizer checklist and switched off electric trim. At the same time, consistent with the procedure, the first officer, in the right seat, began to turn the manual trim wheel in an attempt to pitch the stabilizer back to nose-up.

He had it right, except for one detail. The flight data recorder showed the manual trim wheel moved in the wrong direction, applying more nose-down trim, not nose-up.

While efforts to address runaway trim continued, the engines continued to generate 94 percent of their maximum thrust, with a power setting selected for climb. As the nose pitched downward, airspeed increased commensurately, well past the certified operating limit of the 737. At high airspeeds, aerodynamic forces exert massive pressure on control surfaces, making manual trim difficult to apply. Investigators believe this caused the first officer to concede the futility of his efforts to adjust trim using the wheel.

This led the pilots to a fateful decision. About 90 seconds after initiating runaway stabilizer procedures, the captain reversed course and switched on electric stabilizer trim. MCAS thus re-engaged, and despite subsequently inhibiting for multiple cycles by nose-up electric trim commands, the cumulative effect of the system’s activation resulted in more nose-down trim than before. This proved unrecoverable, and the airplane crashed several minutes later.

Aviation oversight authorities around the world swiftly grounded the worldwide 737MAX fleet, despite assurances from Boeing and other operators that the aircraft is fundamentally safe. Citing similarities between the Lion Air and Ethiopian crashes, the Federal Aviation Administration (FAA) grounded the aircraft type three days after the accident. As of the date of this publication, the 737MAX remains grounded, with Boeing working to certify and implement its software update, along with revisions to pilot training.

Claims and Liability Implications

Airplane crashes, especially those involving sophisticated commercial jetliners, rarely lend themselves to simple theories of causation. Even the conclusions of respected, purportedly neutral aircraft accident investigation bodies receive intense criticism once litigation inevitably ensues. For this reason, probable cause determinations by investigative authorities are deemed inadmissible in courts of law. The question of liability, at this point, has many parts and no clear answer.

Traditionally, claims in the realm of aviation accidents fall into four categories:

1. Against manufacturers of airframes, engines, and component parts, typically sounding in products liability and negligence.

2. Against operators of aircraft for negligence-based theories.

3. Against entities or individuals involved in the maintenance/repair/overhaul of airframes, systems, and components, if applicable, for negligence and breach of warranty.

4. Against governmental entities, especially those exercising oversight of air traffic control functions, where sovereign immunity is subject to statutory waiver.

With respect to the 737MAX disasters, there are self-evident paths to the first two categories involving claims against the airframe manufacturer— Boeing—and the respective operators— Lion Air and Ethiopian. An investigation may eventually yield evidence to support theories against maintenance/repair/overhaul entities, especially in the Lion Air case, suggesting maintenance of a faulty angle-of-attack indicator may be a concern. To date, no claims are anticipated against government agencies or authorities.

Families of passengers killed in the Lion Air and Ethiopian disasters have already commenced suit against Boeing in the state and federal courts of Illinois, owing to the location of Boeing’s headquarters in Chicago. On April 16, 2019, U.S. District Judge Thomas M. Durkin issued an order consolidating federal cases arising from Lion Air Flight 610 in the Northern District of Illinois, a move that will streamline the resolution of threshold issues of justiciability, choice of law, and discovery common to most, if not all, claims.

However, significant battles of a legal, procedural nature stand before the adjudication of substantive liability questions. In the case of the Lion Air crash, all but one of the passengers were citizens of Indonesia, and Boeing is expected to move to dismiss the Illinois cases based on the legal doctrine of forum non conveniens. In essence, Boeing will argue that the citizenship of the parties and facts of the case make the litigation more appropriately heard in the legal system of Indonesia. Many of the arguments applicable to the Lion Air litigation will have relevance to cases arising from the Ethiopian crash.

Review of currently filed complaints show plaintiffs targeting Boeing on several fronts. First, as identified in the wake of the Lion Air crash, the systems architecture of MCAS considers the data produced by only one angle-of-attack sensor, limiting redundancy to a single point of failure. Proponents argue an alternative dual-channel feed would identify data errors and annunciate faults to pilots, rather than risk unintended activation. In a similar vein, the lawsuits allege Boeing did not adequately inform pilots and operators of the existence and operation of MCAS, which arguably could have improved situational awareness.

Others have raised criticism of the 737MAX certification process, highlighting Boeing’s relationship with the FAA that resulted in the delegation of a number of regulatory tasks to Boeing engineers. While this arrangement is common in the aerospace industry, some observers object to the apparent closeness of Boeing and the FAA. Secondarily, the lawsuits contend Boeing misevaluated and under-classified failure modes relative to MCAS, leading to certification of a system that would have been insufficiently redundant if its failure modes ranked at a higher tier of severity.

A more abstract, but undoubtedly consequential, theory involves motives of profitability and competition with Airbus. Most plaintiffs contend the basic design of the 737, dating to the mid-1960s, restricts the capability of future developments, especially in comparison to the more-recent A320neo. Structural limitations therefore necessitate software or mechanical fixes, like MCAS, to compensate for unintended incidents of technical progress. In short, because an all-new design would require significantly more time and resources to develop, the argument submits the prospect of a faster and larger return on investment drove Boeing to push the design of the 737 a step too far. Conversely, this glosses over the possibility of Boeing’s own customers’ concurrence with the derivative strategy, and whose opinions or procedures may have weighed on certain engineering decisions.

Boeing also faces exposure, though perhaps of a more commercial nature, from airlines whose fleets of 737MAX aircraft were grounded for weeks, especially as the peak summer travel season approaches. Airliners, especially those fresh from the factory, are expected to perform reliably in demanding schedules, often well in excess of 14 flying hours per day. The federally mandated grounding forces airlines like American, Southwest, and United to cancel scheduled flights and increase utilization of other airplanes to pick up the slack. Consequently, airlines have updated quarterly financial guidance to reflect diminished revenue expectations and capacity forecasts through at least July 2019, and likely beyond. Precedent exists for operators to seek compensation from Boeing, albeit on a confidential basis, as was reportedly the case when battery fires forced the worldwide grounding of all Boeing 787s for over three months in early 2013.

Claims against operators will necessarily focus on crew training and the duty of care demanded of professional pilots. For example, the night before the JT610 crash, the crew of the inbound Lion Air flight from Bali encountered the same control difficulties, but appropriately managed the aircraft’s trim and, following the established procedure, managed to safely land the aircraft at Jakarta. Industry experts readily acknowledge competence on the runaway trim procedure must be demonstrated for a type rating, something that is required in order to serve as pilot-in-command of a Boeing 737. In the case of ET302, the crew trained on the post-Lion Air MCAS recommendations, and correctly followed protocol before inexplicably abandoning the procedure. It is unknown whether the aircraft was in a recoverable state at that moment, but the preliminary results of the investigation show controllability quickly deteriorated.

The Lion Air accident also involved the replacement of one angle-of-attack sensor several days prior to the accident, and the flight on the preceding night reported control issues related to data generated by this sensor. To date, no evidence has been revealed as to the steps, if any, taken to remediate these issues prior to the JT610 crash, but further investigation is necessary to evaluate the nature and sufficiency of the repair. As of this writing, no evidence of maintenance issues are advanced in connection with the Ethiopian crash.

As with any aviation disaster, any proclamations of liability made in the immediate aftermath of either of the 737MAX crashes must be evaluated with a critical eye. From a claims perspective, there is risk exposure for Boeing as the manufacturer of the 737MAX, as well as Lion Air and Ethiopian Airlines as operators. Investigation will determine whether other entities may come into the fold as the case matures. For now, on the basis of limited information, it is anyone’s guess as to the viability of the potential claims set forth herein, which comprise but a small sampling of the many theories to be heavily litigated.

There is, however, one prediction in which I have strong confidence: The investigation into the 737MAX disasters, and, importantly, the recommendations implemented as a result thereof, will result in a safer aviation system for all.