Boeing prepares to explain safety upgrades for 737 Max jets

Reporting from WASHINGTON —  Boeing is expected to announce details Wednesday about the software updates and other fixes it plans for its troubled 737 Max jets, but questions remain about whether the company and its regulators can be trusted to ensure that the planes are safe after two deadly crashes in less than five months.

The fixes are designed to address concerns about an automated anti-stall feature and will include a software enhancement, updated operating manuals and additional training for pilots. While the cause of the crash of a Lion Air jet in Indonesia in October and an Ethiopian Airlines plane crash earlier this month have not been determined, findings of preliminary investigations suggest that a new feature known as MCAS played a role in both.

Boeing said it also will add a warning light that alerts pilots if there is a disagreement between two sensors that provide information about the position of the plane’s nose. The alert was available before, but only if purchased as an upgrade by airlines.

Whether the changes will be enough to convince safety regulators in the United States and around the world that the company — already the target of investigations by the Justice Department and by the Transportation Department’s inspector general, as well as congressional inquiries — will make the planes safe enough to resume flying is unclear.

In the first of what are likely to be several congressional hearings, Sen. Ted Cruz (R-Texas), chairman of the subcommittee on aviation and space, is scheduled to hold a session Wednesday afternoon on the state of aviation safety. Testimony is expected from Daniel Elwell, acting administrator of the Federal Aviation Administration, Robert Sumwalt, chairman of the National Transportation Safety Board, and Calvin Scovel, the Transportation Department’s inspector general.

“We will be carefully monitoring Wednesday’s hearing on aviation safety,” Boeing said in a statement Tuesday. “Boeing continues to support the ongoing accident investigations, and is working with the authorities to evaluate new information as it becomes available. Safety is our top priority when we design, build, deliver and maintain Boeing aircraft. Boeing has worked with the FAA, DOT, NTSB, pilots and airline customers as well as other aviation community partners for decades to make flying the world’s safest mode of transportation.”

However, Rep. Peter DeFazio (D-Ore.), chairman of the House Transportation Committee, wants an independent third-party review of Boeing’s proposed changes and fixes for the plane before the 737 Max is allowed to resume service.

Such safety assurances are usually provided by the FAA, but the deaths of 346 people in two crashes of Boeing 737 Max 8 jets in the span of a few months has raised questions about the process the FAA, with Boeing’s help, used to certify that the planes were safe.

“The traveling public needs assurances that the FAA will only recertify the aircraft for flight if and when the FAA, outside safety and technical experts, and pilots agree the aircraft is safe to fly,” DeFazio said.

The FAA has said its “experts, including chief scientists, engineers and flight test pilots conducted in-flight testing” of the 737 Max’s flight control system, including the MCAS.

In testimony prepared for Wednesday’s hearing, Elwell added that the overall process included 297 certification flight tests and noted that the FAA was “directly involved in the System Safety Review of” the MCAS features.

At the heart of inquiries into the FAA’s role overseeing the plane — and into Boeing’s work developing the aircraft and working with regulators to certify it — are questions about exactly what information Boeing had about the risks of the automated features, what information the FAA required from the company, and what information Boeing provided the FAA.

Elwell did not say. He said the certification process was robust, but later events added critical new information.

“The certification process was detailed and thorough, but, as is the case with newly certified products, time yields more data to be applied for continued analysis and improvement,” Elwell said. “As we obtain pertinent information, identify potential risk or learn of a system failure, we analyze it, we find ways to mitigate the risk, and we require operators to implement the mitigation. And that is what has happened in the case of the 737 Max.”

With more than 380 of the jets grounded worldwide, and with some airlines demanding reimbursements for their losses, Boeing is anxious to get the planes back into the air. The company has suspended delivery of all new 737 Max planes, though production continues. At least one carrier, Indonesia’s national airline, Garuda Indonesia, has canceled an order for 50 of the Max planes.

In developing the software update, Boeing said its testers used simulators to create “the most challenging scenarios” possible, and saw what would happen with various human and technical errors.

Simulator “pilots worked with the software design team to incorporate multiple layers of protection in the event of sensor errors or other erroneous inputs. They assessed a broad range of piloting techniques, in order to ensure that normal airmanship skills are sufficient to control the airplane,” a Boeing spokesman said.

They put the updates in a real plane for an “engineering verification” flight with several steep or otherwise problematic maneuvers on Feb. 7, then held a certification flight with the FAA on March 12, two days after the Ethiopian Airlines plane crashed.

MCAS, which stands for maneuvering characteristics augmentation system, is a new feature on Boeing’s 737 Max planes designed to compensate for changes in the plane’s design by automatically pushing the plane’s nose downward if it appears it is too high and at risk of stalling. To do that, MCAS relies on information from one of two “angle-of-attack” sensors mounted on the plane’s nose.

In the case of the Lion Air crash, investigators suspect that the MCAS system received incorrect information from one sensor, prompting it to force the plane’s nose down even as pilots were trying to pull it up. In the wake of that crash, the FAA issued an emergency order warning that erroneous inputs from angle-of-attack inputs “can potentially make the horizontal stabilizers pitch the nose of the airplane downward, making the aircraft difficult to control.” U.S. operators were ordered to revise flight manuals so crews would have procedures for dealing with such an occurrence.

Officials at Boeing said the software fix would change the way MCAS receives information, requiring feeds from both sensors before the MCAS is triggered. Following the two crashes, many aviation experts expressed surprise that in an industry that stresses redundancy, the MCAS could be triggered by information from just one sensor.

Boeing officials also said the software updates will decrease the downward angle which the plane’s nose is pointed when it is in operation, and will prevent it from repeatedly engaging once it is corrected.

In the Oct. 29 Lion Air crash, a malfunctioning sensor and an automated response from the aircraft’s software impeded the pilots’ efforts to control the Indonesian flight from plunging into the sea, killing all 189 people on board, according to a preliminary investigative report.

The angle of attack sensor was showing erroneous readings throughout the time the plane was airborne. With the sensor insisting the nose was too high, the MCAS kicked in, sending the plane down as the cockpit crew fought to regain control, according to the preliminary report.

Every time the flight crew pulled the nose back to level, within seconds, the MCAS tipped it back downward.

Black-box data released by Indonesian investigators showed that pilots were pulling back on the control column, attempting to raise the plane’s nose, applying almost 100 pounds of pressure to it before they crashed into the Java Sea just 12 minutes after takeoff.

In addition to making the warning light that alerts pilots to discrepancies between angle-of-attack sensors standard on all Max jets, Boeing said it will also give airlines the option of installing angle-of-attack indicators, which feed pilots information from the two sensors. Both have been available to airlines, but only for an additional charge, outraging a group of lawmakers — led by Sen. Edward J. Markey (D-Mass.) — to press Boeing Chief Executive Dennis Muilenburg for answers on why the company charged airlines for the instruments.

“Safety features on jets that fly hundreds of passengers should never be sold as a la carte add-ons,” the senators wrote in a letter to Muilenburg.

Muilenburg is not expected to attend Wednesday’s hearing.

Pilots have mixed opinions on whether the instruments are necessary.

John Cox, an airline safety consultant with the aviation firm Safety Operating Systems, said the pilot community has long debated whether the additional display and warning light are needed.

“It’s not an easy yes-or-no question,” said Cox, a former pilot. “If you look at most airplanes around the world, most airlines don’t have it.”

He said pilots with military backgrounds often prefer to have the gauges because they are standard on many high-performance military aircraft, but pilots who come from the civilian ranks don’t necessarily see a need for them.

In the United States, only American Airlines paid extra to have both the warning light and angle-of-attack indicators installed in their cockpits. Southwest Airlines had the indicator light, but it was only after the Lion Air crash that it opted to include the indicator in the cockpit.

Officials at American Airlines said they included them because their pilots prefer to fly with them.

Both airlines declined to say how much the extra features cost, as did Boeing.

United’s Max 9 jets aren’t equipped with the instruments, because officials did not think they were necessary.

“We did not install these features, because our aircraft is already equipped with anti-stall indicators, which are proven and safe,” a spokesman said. “None of United’s airplanes have angle of attack on their primary flight display, as pilots are trained to use airspeed, pitch and power for the safe operation of aircraft.”

Lori Aratani, Luz Lazo and Michael Laris write for the Washington Post. Aaron Davis of the Post contributed to this report.