By Eric M. Johnson, Alwyn Scott and Allison Lampert
SEATTLE/NEW YORK (Reuters) - Boeing (NYSE:BA) Co said it will submit by the end of this week a training package that 737 MAX pilots are required to take before a worldwide ban can be lifted, proposing as it did before two deadly crashes that those pilots do not need time on flight simulators to safely operate the aircraft.
In making that assessment, the world's largest planemaker is doubling down on a strategy it promoted to American Airlines Group Inc and other customers years ago. Boeing told airlines their pilots could switch from the older 737NG to the new MAX without costly flight simulator training and without compromising on safety, three former Boeing employees said.
At the time billions of dollars in plane orders hung on Boeing's ability to deliver a new plane that matched European rival Airbus SE in performance but kept changes and training for pilots converting from a previous model to a minimum. Airbus had already booked hundreds of orders for its A320neo jet, which came to market nine months ahead of Boeing.
At Boeing's factory in Renton, Washington, managers told engineers working on the MAX, including its anti-stall system known as MCAS, their designs could not trigger Level C or D training designations from the U.S. Federal Aviation Administration, the three former Boeing employees and a senior industry executive with knowledge of MAX development told Reuters. Otherwise, pilots would have to spend time in simulators before flying the new planes. Instead pilots will need to complete a roughly 30-minute training programme on a computer.
"Boeing said all along that we believe that we can design this new MAX with all the fuel efficiencies and design improvements over the NG and it will only require Level B training," said a former Boeing test pilot with direct knowledge of the matter, referring to an earlier iteration of the 737 jetliner.
Level B training does not involve simulators.
On Wednesday, Boeing outlined a series of changes to the MCAS system. It continues to believe existing emergency protocols allow pilots to correct a runaway stabiliser, which can be caused by a MCAS failure among other things. Boeing says its new changes give pilots more authority.
(Graphic: https://tmsnrt.rs/2OjLSAt)
SYSTEM UNDER SCRUTINY
The amount and quality of training that Boeing and airlines provided to 737 MAX pilots is one of the issues as investigators around the world try to determine the causes of two 737 MAX crashes within five months that claimed 346 lives. All 737 MAX airliners are grounded until regulators around the world approve the new software and training protocols.
The U.S. Department of Justice is investigating Boeing's development process and what Boeing disclosed about MCAS.
A Boeing spokeswoman said the company followed industry standards and conducted thorough safety analyses in designing the MAX flight controls and other systems.
"The design and certification of the MCAS flight control law adhered to these processes and assumptions," she said.
The decisions to avoid simulator training had their roots in the company's decision under intense pressure from the aircraft market over a weekend in 2011 to change strategy and outfit an upgraded 737 with more efficient engines similar to those on the new Airbus, rather than build an all-new design.
The new 737 MAX engines had to be mounted further forward on the wing, raising the risk that the plane's nose would tilt up, threatening a stall in some situations.
MCAS was designed to automatically and powerfully push the nose down if data from an "angle of attack" sensor mounted near the front of the plane showed risk of a stall.
Former Boeing engineers who worked on MCAS said there was no pressure to compromise safety. After analysing solutions for MCAS, Boeing's engineers chose a simpler design for solving the jet's pitch-up tendency, according to the three former Boeing employees and an industry executive with knowledge of the decision.
"It wasn't necessarily the simplest way to get around the regulations," said Mike Renzelmann, a former Boeing engineer who worked on flight controls on the 737 MAX. "It was the safest way to get around the regulations."
MCAS was just one of many so-called control laws on the 737 MAX, a few lines of code embedded into the flight control system.
"It's always a balance between complexity and availability of the function. The more complex you make something, the more likely it is to be unavailable when you need it," a Boeing official said.
LAST LINE OF DEFENCE
Boeing rated MCAS a "hazardous" risk, an FAA term that means multiple deaths could result if the system failed, the Boeing official said. That is a step below "catastrophic," which could cause loss of the plane and death of all on board.
Boeing's rationale was that trained pilots would know how to respond if MCAS failed, the official said. Long-established procedures for runaway stabilizer trim would prompt pilots to shut down MCAS, whether they knew it existed or not.
Under FAA rules, hazardous risks are allowed to happen more frequently than catastrophic ones.
One industry source familiar with plane certification said he was "astonished" that Boeing was able to gain FAA approval for the MCAS system with one angle of attack sensor and pilots as backup.
"In reality, no single device is that robust and reliable which is why there needs to be mitigations," he said.
On Wednesday, Boeing said the MCAS system would now rely on two sensors.
During nine to 12 months of MAX flight testing, test pilots injected errors into the flight system that tested stall conditions and runaway stabilizer, among other scenarios, the people said. But no one was aware of a specific test of an MCAS failure mode triggered by erroneous sensor data.
"The problem with these two accidents is that there were failure modes that people didn't analyse properly or consider they could happen that way," according to an FAA official with direct knowledge of the 737 MAX certification.