Here’s a question. Well, two questions, actually. One: how could an aircraft manufacturer long celebrated for its commitment to engineering excellence produce an airliner with aerodynamic characteristics that made it unstable under some circumstances – and then release it with remedial computer software that appeared to make it difficult for pilots to take control? And two: why did the government regulator approve the plane – and then dither about grounding the model after it had crashed?

The aircraft in question is the Boeing 737 Max. The regulator is the US Federal Aviation Administration (FAA). The questions are urgent because this model has crashed twice – first in the Java Sea last October with the deaths of 189 people, and then in Ethiopia in March with the deaths of 157 people. Evidence retrieved from the second crash site suggested that the plane had been configured to dive before it came down. And the Ethiopian transport minister was quoted by Al-Jazeera on 4 April as saying that the crew “performed all the procedures repeatedly provided by the manufacturer but was not able to control the aircraft”. The FAA initially reaffirmed the airworthiness of the plane on 11 March but then grounded it on 13 March.

The full story of this catastrophe remains to be told, but we already know the outlines of it. Like many other spectacular failures – for example the Nasa Challenger disaster in 1986 – it involves the interaction of lots of factors. As Diane Vaughan found in her monumental study of Challenger, technology, organisational culture and commercial (or, sometimes, political) considerations are all involved. And therefore the 737 Max story has lessons that go way beyond aircraft manufacture.

The 737 Max was Boeing’s response to the A320neo aircraft made by its only competitor – Airbus. Originally, the intention was to design a new plane from scratch, but Boeing’s management decided instead just to modify its existing 737 model, principally by adding two new, more fuel-efficient, engines.

These engines were so large, however, that they couldn’t be hung under the wing without scraping the ground. The solution was to mount them up and in front of the wing. But this had some serious implications. According to Boeing’s technical documentation, the new location and larger nacelle (the engine casing) “cause the vortex flow off the nacelle body to produce lift at high AoA [angles of attack]. As the nacelle is ahead of the C of G [centre of gravity], this lift causes a slight pitch-up effect … which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall.”

The solution to this intrinsic aerodynamic instability was to add a new software component called MCAS (Manoeuvring Characteristics Augmentation System) to the flight-control system. This would turn down the nose of the plane whenever an AoA sensor in the nose detected an impending stall, regardless of the speed. Crucially, however, it seems that the new software was linked to only one of the two AoA sensors, and no provision was made for it to check with the sensor on the other side. So, as one analysis puts it, “the system was programmed to turn the nose down at the feedback of a single (and somewhat flimsy) sensor” – and to do that repeatedly. Which may explain why the pilots on the two fatal flights were unable to overcome their computerised hijacker.

This flaw was probably an honest mistake and one that would normally have been picked up in the certification process operated by the FAA. But it wasn’t, and here the story gets murky.

There are two strands to it. The first is how the organisational culture of Boeing had changed over the years since it acquired McDonnell Douglas, a failing aerospace contractor, in 1997. Boeing’s organisational culture is now radically different from its old engineering-led ethos. It’s now run by a board that seems driven more by marketers than by engineers – which may explain why it pressed for the Max not be be treated as a new aircraft (requiring thorough – and expensive – recertification by the FAA) but merely as a modification.

The second strand concerns the way the FAA has been emasculated by successive American administrations, starved of resources – and apparently unable to retain talented engineers who are regularly poached by the companies it is supposed to regulate. This enfeeblement was dramatically highlighted by the agency’s hesitant response to the first crash and the revelations that it had been unaware of what Boeing knew about critical flaws in the MCAS system prior to the first crash. So one of the unanswered questions that emerges from the 737 Max story now is the really disturbing one: is the FAA fit for purpose?

What I’m reading



Now hear this

Alex Danco has written a very thoughtful blog post at alexdanco.com about Marshall McLuhan, media and the power of headphones.

Never the twain...

“The dreamings of Dominic Cummings” is the title of a sobering London Review of Books essay by James Meek about how the UK has fragmented into two countries: Remainia and Leaveland.

Changing ranges

There is an intriguing and surprising blog post at veridici.com by the writer Shanu Athiparambath, who lives in the Himalayas, about how Airbnb is changing Himalayan villages.