Last month, two prominent flight control experts and whistleblowers — one ex-Boeing, one ex-FAA — delivered to the U.S. Senate committee overseeing aviation a technical proposal to upgrade Boeing's 737 Max cockpit to current design standards.
The system on the Max for alerting pilots about malfunctions during flight is outdated — and without an upgrade Boeing may need congressional action to extend the jet's exemption from the latest safety regulation and get the upcoming final version of the Max into service.
The proposed fix was offered as an alternative that all models of the Max could be retrofitted with.
"It's a matter of the will to do it," said Joe Jacobsen, former Federal Aviation Administration safety engineer and agency whistleblower. "The question is, what's the price tag?"
That's a high-stakes decision. Boeing has argued bringing the Max into compliance with the current crew alerting standards would cost billions of dollars.
And at a precarious moment for the company as it emerges from the pandemic more dependent than ever on Max sales, requiring an upgrade would delay the entry into service of the final member of the jet family, the Max 10.
During the original certification of the Max, Boeing persuaded the FAA to exempt the plane from the crew alerting regulation, arguing that any safety benefit would not be "commensurate with the costs."
For the Max 10, Boeing is implementing a couple of enhancements that will improve the system — though it still won't comply with the current standard.
The push for a more substantial cockpit revamp comes as Boeing's regulatory reprieve is nearly at an end.
FAA certification of the Max 10 — its approval to fly passengers — is behind schedule and Boeing is expected to miss a critical year-end deadline written into legislation passed in 2020. After this year, only planes compliant with the crew alerting regulation can be certified.
However, there's pushback around extending that deadline.
After Boeing redesigned the flight control system that caused two Max crashes, critics — including families of the crash victims — turned their focus to the jet's failure to comply with the crew alerting standard.
Investigations into the Lion Air and Ethiopian Airlines crashes, which killed 346 people, found the cacophony of confusing alerts in the cockpit distracted the pilots and contributed to the accidents.
"We vigorously oppose an extension," said Michael Stumo, father of Samya Rose Stumo, who died in the second Max crash of Ethiopian Airlines Flight 302 in 2019.
The issue is not solely one of Boeing investing the money to upgrade.
The option recommended in the proposed cockpit revamp would require heavy investment and resources to design, test and certify.
But there are legitimate reasons besides cost to be wary of such a major system change.
Peter Morton, a retired Boeing senior executive and leading cockpit design engineer, cautioned that introducing changes to an airplane system and requiring pilots to adjust is a complex project.
Morton led the development of Boeing's modern cockpit design, first introduced on the 757 and 767 programs in 1981, the design that superseded the 737 version still in use on the Maxes.
He said airplane systems are tightly integrated and any change must be carefully tested to ensure it doesn't introduce new problems, inadvertently reducing safety.
"You have to be very, very careful in making these kinds of decisions," Morton said.
Yet after reviewing the new technical proposal at the request of The Seattle Times, Morton was impressed by its seriousness.
He said it addresses "many if not all of my concerns that there is a possibility of unintended consequences arising from crew alerting modifications."
He said the paper "is thoughtfully written with regard to analysis of direct and indirect consequences ... acknowledging the respective difficulties, cost impact, crew training implications" and other possible impacts.
Staff on the Senate Commerce Committee, chaired by Sen. Maria Cantwell, D-Wash., on Thursday forwarded the proposal to the FAA and the National Transportation Safety Board seeking technical help to evaluate it.
Boeing in a statement said "safety remains the driving factor" in the push to certify the Max 10 and that the company is "committed to meeting the FAA's expectations."
Two whistleblowers talk to the Senate
Inadequacies in pilot warning systems that cause confusion or inaction at a critical moment are a known factor in airplane accidents beyond the two Max crashes.
A 2019 NASA report written by Randy Mumaw, then a senior Boeing human factors specialist, analyzed 18 in-flight accidents where pilots lost control of older aircraft, one- third of them 737s, and identified a pilot-alerting failure in every case.
The new proposal for the Max crew-alerting system was written by a former Boeing flight control engineer who worked under Mumaw: Curtis Ewbank.
Ewbank prepared the upgrade proposal and Jacobsen endorsed it in response to a request from Cantwell's committee for an assessment of how the deficiencies in the 737's cockpit systems might be addressed.
Ewbank and Jacobsen were featured in the whistleblower report produced by the Democrats on Cantwell's committee in December that highlighted fundamental problems with safety oversight in the aerospace industry.
In 2019, The Seattle Times first made public a Boeing ethics complaint Ewbank filed internally. In it, he expressed dismay at how system safety upgrades on the Max were rejected during development on cost grounds and also at the way Boeing persuaded the FAA to grant the exemption to the crew-alerting standard.
He subsequently left Boeing and testified at a Senate hearing on the Max, but has declined all interviews. He told Jacobsen he is free to talk only with "appropriate government agencies."
Jacobsen provided a copy of Ewbank's proposal, which assessed four options.
These ranged from a completely new cockpit system matching those in other Boeing jets — a so-called Engine Indicating and Crew Alerting System, requiring a new central computer — to a minimal change that adjusted just a couple of the pilot alerts.
How crew alerting has evolved
When a malfunction occurs on a 737, the pilot will first see a master caution light on the glare shield at the top of the instrument panel and beside it a specific light will illuminate, labeled "fuel" or "engine" or "flight controls" or some other system.
The pilot must then turn to an overhead panel of switches, dials and lights arrayed in six different clusters, one for each major system, to find out more.
For example, the warning lights on the overhead panel might indicate a problem with a pump in the center fuel tank.
For the most serious malfunctions, pilots must memorize the appropriate response. For a less urgent problem such as that fuel system issue, the co-pilot would open the tab for the fuel pump system in the quick reference handbook to find out what to do.
All this is second nature to a 737 pilot and routinely works well. But Jacobsen, the retired FAA safety engineer, said it's problematic for a less experienced pilot if an emergency breaks out at a critical moment, such as landing during bad weather.
"Pilots have to look in several places to figure out what's wrong," Jacobsen said. "If it's a time-critical phase of flight, you don't want to be stumbling around."
In contrast, a full EICAS system tells the pilot using alphanumeric messages on a central screen that, for example, the left pump in the center wing tank has lost pressure and what action is needed in response.
Ewbank noted that a full EICAS system would be difficult to retrofit on the Max 8 and Max 9 models already flying — making pilot training for the Max 10 different — and would require a development program of about three years.
So instead he recommended an option he dubbed "EICAS lite," one notch above minimal change.
He wrote that this option is "retrofittable to the whole Max fleet, keeping the pilot pool common, but addresses the significant shortcomings of the current 737 alerting system."
His proposal adds a button on the control panel with which the pilot can silence an aural alert — a computerized voice warning. Otherwise, it consists of software changes.
Text messages will "centrally locate critical alerts that are currently in disparate locations around the flight deck, and assist the crew in prioritizing such alerts," he wrote.
"EICAS lite could fully comply" with the current crew alerting standard, Ewbank concluded.
To extend an exemption — or not
A group of relatives of the crash victims has met with the FAA and the European Union Aviation Safety Agency to press for a crew-alerting upgrade, and the group is lobbying Congress to deny an extension of the regulatory exemption for the Max 10.
Rep. Peter DeFazio, D-Ore., who chairs the House Transportation Committee, opposes waving the Max 10 through without an upgrade.
In a statement Friday, he reiterated that the grace period in the legislation should not be extended.
"The FAA should side with safety and establish a high bar for the certification of the 737 Max-10," he said.
Cantwell earlier said she would extend the grace period as long as the FAA agrees. She now wants an independent assessment of Ewbank's proposed fix.
"We want to hear from the FAA and NTSB on any safety proposals," said Cantwell in a statement Thursday. "Safety must be first. This means listening to safety experts on flight-alert systems and human factors."
A spokesperson for the FAA confirmed the agency received a copy of Ewbank's proposal from Cantwell's staff.
But it's unclear what the FAA will do with it.
The agency's role is typically to conduct a formal certification assessment of any system changes proposed by Boeing — not by a third party seeking to change a Boeing design.
"Ultimately, it's up to the manufacturer to propose design changes for FAA review," the spokesperson said.
Would the upgrade be safer?
The 737, a derivative of a 1960s-era design, is the only Boeing plane not compliant with the crew alerting safety standard.
Jacobsen told the Senate committee that the FAA should issue an Airworthiness Directive to mandate the system revamp.
That would require the FAA to stipulate that the current system is "unsafe." However it has repeatedly declined to do so, re-approving the original design and providing the exemption for each new derivative of the 737.
When Boeing originally certified the Max in 2017, it pointed to the 737's low accident rate.
Crew alerting deficiencies had contributed to three fatal 737 crashes in the previous decade — the 2005 Helios Airways crash, with 121 dead; the 2009 Turkish Airlines crash, with nine dead; and the 2008 Aeroflot-Nord crash, with 88 dead. But Boeing argued that after each of those crashes it made a change to fix the specific alert failure.
When Boeing estimated the cost to change the system as "greater than $10 billion" — largely costs for additional pilot training that would have been borne by Boeing's airline customers — the FAA deemed an upgrade impractical.
The FAA didn't change that position in 2020 when it approved the Max for return to service after the protracted grounding of the jet that followed the two deadly crashes.
However, pressed harder by the European and Canadian regulators, Boeing agreed to two system enhancements that will be introduced on the Max 10 that will improve the crew alerting system:
—A pilot will be able to silence a stick shaker — when the pilot yoke vibrates loudly — if it's erroneously warning of a stall, one of the major distractions in both Max crashes.
—Boeing is adding an enhanced measure of the jet's Angle of Attack, a faulty reading of which triggered both crashes. This will make erroneous alerts much less likely.
Boeing clearly believes this will fix any safety issues with Max crew alerting.
Jacobsen calls Boeing's $10 billion figure "ridiculous," but acknowledges that developing EICAS Lite would be costly.
"Even if it costs $1 billion or $2 billion, it's in Boeing's interest to do it," he said. "The next crash that gets pinned on the flight crew alerting system, they are sunk. It's a huge liability."
Boeing once before developed a large-scale cockpit redesign and retrofit — for business reasons.
In 2000, at the request of key customer FedEx, Boeing developed a new, advanced- technology cockpit for the DC-10 and offered it as a retrofit to the worldwide fleet of 413 aircraft.
This converted the plane, renamed the MD-10, from a three-crew jet to two-crew and gave it a common cockpit with FedEx's MD-11s.
Still, the case for requiring a Max cockpit revamp is far from straightforward.
Former Boeing executive Morton said he thinks Ewbank has not fully addressed the complications his proposal would create for airline fleets.
"Even if retrofittable to the entire Max fleet, that means you'd have a 5- or 6- or 10-year period in which you're still flying a mixed fleet," Morton said. "That's going to be a training challenge."
It's also arguably a safety risk, from the potential for confusion when a Max pilot or a maintenance mechanic moves from one plane to another that looks the same but has a different cockpit system.
Many airlines that fly the Max will also fly the earlier 737 NG model, offering another mixed fleet headache if they have different crew alerting systems.
At a critical moment when a malfunction arises, Boeing doesn't want pilots confused about what kind of airplane they are on.
In a statement, Boeing said it believes that "a common, consistent operational experience across the 737 Max family ... ultimately benefits flight crews by enhancing safety and reducing risk."
Jacobsen said a retrofit to all Maxes would achieve that.
"Boeing always tries to do the minimum," he said. "We're trying to push them to do more."
