Fatal airline accidents are mercifully rare, so when two aircraft of the same new model crash in succession, killing a total of 346 people, it is an exceptional tragedy. That is the case with Boeing’s new 737 Max, a single-aisle jet that is an update of its best selling model. It was grounded last week by regulators around the world — belatedly including the US Federal Aviation Administration.
It is too early to tell the causes, but both a Lion Air crash off Indonesia in October and the Ethiopian Airlines accident last week involved Boeing 737 Max 8s encountering difficulty shortly after take-off. An initial investigation into the Lion Air crash found that the onboard flight control software had repeatedly countermanded the pilot’s commands and pushed the aircraft’s nose down as they tried to climb.
The accidents raise troubling questions about whether Boeing and the FAA allowed the 737 Max to be introduced into service without fully educating pilots about new software that was meant to prevent a stall as they climbed too steeply, or making the pilots retrain. With hindsight, they also look complacent in letting the aircraft keep flying after the Lion Air crash.
The FAA has a reputation for setting high safety standards in one of the world’s largest aviation markets. The fact that it only intervened after other global regulators — notably China’s aviation authority — had grounded the 737 Max could undermine the respect it commands, with damaging consequences. President Donald Trump tweeted displeasure at the FAA’s delay before it followed others.
In general, the modern generation of fly-by-wire aircraft in which software interprets pilots’ use of controls to change course and speed, and can overrule them in the case of danger, has made flying safer. The number of commercial aircraft crashes annually is a fraction of a few decades ago, largely thanks to the broader use of more sophisticated technology.
The 737 Max is an update of a Boeing model dating from the 1960s, in which conventional controls are augmented by digital software and some secondary fly-by-wire controls. Boeing added software to stop it being destabilised when climbing by larger engines having been fitted in a different position under the wings. The fact that thorough pilot retraining was not enforced by regulators made it easier to market to airlines as a seamless upgrade.
Until last week’s grounding, Boeing insisted that a software update it intended to roll out across airlines’ 737 Max fleets by April, and the use of more sensors to check the aircraft’s angle in flight, along with pilot training, would limit any further risks. It could yet be proved right, but that does not answer doubts as to why it and the FAA allowed the jet to continue in service while working on the changes, rather than behaving cautiously.
It is common for the first iteration of software on computers not to work as intended, and to be updated to fix the flaws. That is acceptable in many cases but aircraft in flight — and their passengers — are at much higher risk if any new technology does not work as intended. This requires manufacturers, as well as regulators, to test thoroughly before experimenting.
The onus is now on Boeing and the FAA to learn lessons from the 737 Max tragedy, and make necessary changes to how new models are introduced in future. If the aircraft only needs improved software and pilot training, they may be able to restore passenger confidence relatively soon. But if a bigger, more costly change to its physical design is required to make it safe, then they must not hesitate to act.