WASHINGTON: One of America's best-known airline pilots has told a congressional panel that an automated flight control system on the troubled Boeing 737 MAX aircraft was "fatally flawed" and should never have been approved.
Retired Captain Chesley "Sully" Sullenberger said he understands how the pilots of two 737 Max planes that recently crashed would have been confused as they struggled to maintain control of the aircraft, as an automated system erroneously began forcing the planes into nose dives.
Sullenberger performed a dramatic landing of a damaged US Airways A320 jet in the Hudson River in New York in 2009 after a bird strike disabled the engines.
All 155 people onboard the flight were rescued.
The House Aviation Subcommittee is investigating the crashes of Boeing 737 Max jets in Indonesia in October last year and in Ethiopia in March that killed a total of 346 people.
The panel is also examining what role, if any, Boeing's rush to develop the latest version of it's 737 and the FAA's process of certifying the new model as airworthy may have played in the tragedies.
Sullenberger said Wednesday that late in the flight testing of the 737 MAX, Boeing discovered an aircraft handling issue.
Because the 737 MAX engines were larger than the engines on previous 737 models they had to be mounted higher and farther forward for ground clearance, which reduced the aircraft's natural aerodynamic stability in certain conditions.
Boeing decided to address the handling issue by adding a software feature, Maneuvering Characteristics Augmentation System (MCAS), to the 737 MAX, the 68-year-old veteran pilot said.
The MCAS was made autonomous, able in certain conditions to move a secondary flight control by itself to push the nose down without pilot input, he said.
In adding the MCAS, Boeing added a computer-controlled feature to a human-controlled airplane but without also adding to it the integrity, reliability and redundancy that a computer-controlled system requires, Sullenberger said in a statement on his Twitter handle.
Boeing also designed MCAS to look at data from only one Angle of Attack (AOA) sensor, not two.
One result of this decision was that it allowed false data from a single sensor to wrongly trigger the activation of MCAS, thus creating a single point of failure, he said.
A single point of failure in an aircraft goes against widely held aircraft design principles, he said.
On both accident flights, the triggering event was a failure of an AOA sensor, he said.
"We do not yet know why the AOA sensors on these flights generated erroneous information, triggering MCAS, whether they were damaged, sheared off after being struck, were improperly maintained or repaired, or for some other reason," he told the congressional committee.
"It is clear that the original version of MCAS was fatally flawed and should never have been approved," he said.
The 737 Max planes remain out of service as aviation authorities around the world, including in India, grounded the planes shortly after the second crash in Ethiopia.
Boeing says it has now completed a software fix for the automated system called MCAS, which investigators say appears to be at least partly to blame in the crashes.
Sullenberger also said that Boeing designers also gave MCAS too much authority, meaning that they allowed it to autonomously move the horizontal stabilizer to the full nose-down limit.
Obviously Boeing did not intend for this to happen.
But to make matters worse, even the existence of MCAS, much less its operation, was not communicated to the pilots who were responsible for safely operating the aircraft until after the first crash, he said.
Highlighting the importance of safety, he said, "We owe it to everyone who flies, passengers and crews alike, to do much better than to design aircraft with inherent flaws that we intend pilots will have to compensate for and overcome.
"Pilots must be able to handle an unexpected emergency and still keep their passengers and crew safe, but we should first design aircraft for them to fly that do not have inadvertent traps set for them," Sullenberger said.
"We must also consider the human factors of these accidents," he said.
Pilots need physical, firsthand experience to be prepared for emergencies, Sullenberger said.
"Reading about it on an iPad is not even close to sufficient," he emphasised.
Daniel Carey, president of the Allied Pilots Association, which represents pilots at American Airlines, noted Boeing's strong safety record generally, but he criticised the aerospace giant for making "many mistakes" in order to reduce costs.
"Boeing designs and engineers and manufacturers superb aircraft," Carey testified.
"Unfortunately in the case of the MAX, I'll have to agree with the Boeing CEO, they let the travelling public down in a fatal and catastrophic way," he said.