EASA Sees 737 MAX Approval In November, Says Boeing To Add Third AOA Sensor

EASA expects to clear the Boeing 737 MAX to return to service by year-end after securing commitments from Boeing to address specific safety issues the agency found in its review of the model, including adding a third source for measuring a key flight parameter. 

“We are in the process of finalizing everything that needs to be finalized, and I think that for the first time in a year and half now I can say that the end is in sight of this work on the MAX,” EASA director general Patrick Ky said during the AJPAE French journalists’ association conference Sept. 25. 

Ky said he expects EASA to give its technical sign-off in November, at around the same time as the U.S. FAA’s green light, adding that operational authorization for the aircraft to re-enter service depends on individual airlines and civil aviation authorities.   

Boeing’s proposed changes to the MAX address issues spotlighted in two fatal accidents—Lion Air Flight 610 in October 2018 and Ethiopian Airlines Flight 302 in March 2019. EASA and all other regulators around the globe grounded the MAX after the second accident.  

The modifications ordered by the FAA revamp the MAX’s maneuvering characteristic augmentation system (MCAS) flight-control law software implicated in both accident sequences when faulty angle-of-attack (AOA) data triggered it when it wasn’t needed, leading to nose-down horizontal stabilizer commands that confused and overwhelmed the pilots. Boeing also has changed other flight control computer (FCC) software and enhanced pilot training. Boeing is hoping to get sign-off from FAA clearing the MAX to fly again in the coming weeks.  

EASA’s requirements go beyond what the FAA laid out in a draft mandate issued in August by adding a third AOA sensor to the model. The synthetic sensor, which will provide more data redundancy for systems including the MCAS, will be introduced on the 737-10 and retrofitted on other models, including those in service, Ky said. 

“We wanted not only to make the corrections linked to the MCAS but also reexamine significantly all the architecture of the flight controls. This work brought us—together with Boeing and the FAA—to discover some weaknesses which had not been discovered before,” Ky said, noting that among these were the problems with “the famous [AOA] sensors.”   

Among FAA-mandated changes Boeing made to the MCAS is ensuring the two sensors compare readings and are within 5.5 deg. before triggering nose-down stabilizer inputs. The third sensor required by EASA will independently calculate a reading to supplement the two existing ones, Ky said. In the meantime, EASA will approve operational protocols that allow pilots to safely manage a scenario where the two sensors disagree significantly. 

“This was one of the essential criteria for us, that we have confidence in the fact that one sensor breakdown does not lead to a catastrophe,” Ky said. “My pilots and safety analysts all said that what was planned as a provisional measure for the coming two years was easy enough in terms of security.” 

“We spent an enormous amount of time looking at this problem,” Ky added. “It is not so much the number of probes which is important but more the probability that if one of both of the sensors give incorrect information that would spark a catastrophic chain of events.”   

The only outstanding issue is EASA’s push for Boeing to provide pilots with a way to disable stick-shaker stall warnings, Ky said. The issue has been raised by other stakeholders as well, including pilot groups that provided public comments on the FAA’s draft mandate.  

The Allied Pilots Association (APA), which represents pilots for MAX operator American Airlines, said recent simulator tests showed an erroneous stall warning—which pilots in both MAX accident sequences received because of the faulty AOA data—still presents unnecessary risk, even with the other FCC changes.  

“Feedback from APA participants ... confirmed that the continuous erroneous activation of the stall warning system (stick shaker) resulted in considerable and unnecessary distraction, significantly compromising the process of managing the non-normal condition and recovering the aircraft,” the union said in comments to the FAA.  

The Air Line Pilots Association (ALPA) and British Airline Pilots Association also raised the issue in their comments. 

“In the event that a stick shaker indication is triggered erroneously, it can be difficult for flight crew to be able to conduct actions imperative to continued safe flight,” ALPA said. “In these rare instances, the nuisance stick shaker may serve to reduce safety, rather than enhance it.” 

The unions recommended adding a procedure to checklists on how to disable the warning, such as by pulling a circuit breaker. 

The stick-shaker issue is part of a broader look at pilot workload during emergencies triggered by the MAX grounding. While the MAX reviews found issues specific to the model’s design—notably the MCAS software added so the MAX handled like its predecessor in certain, rare flight conditions—many shortcomings apply to the broader 737 fleet, and some other models as well.

“The other element [besides flight controls] that we looked at very closely was alarm management,” Ky said. “We spent a lot of time on the stick shaker and also on the runaway trim.”  

Boeing said it is “committed to addressing all of the regulators’ questions and meeting all certification and regulatory requirements,” but declined to provide specific details on changes requested by EASA. “We continue to follow the lead of global regulators on the process they have laid out for the safe return of the 737 MAX to commercial service.” 

EASA is among several regulators working alongside the FAA during extensive reviews of the MAX’s certification and operational characteristics. The European agency’s insistence on ensuring multiple failure scenarios were either manageable by pilots or improbable enough to present risks helped expand Boeing’s work beyond the MCAS software into other areas. Runaway trim scenarios figured prominently, prompting extensive analysis of how much time pilots have to respond, and the difficulties presented by the last-ditch step of using a manual trim wheel to move the stabilizer. 

“We worked very hard on our side to insist on independently re-certifying all the elements we considered critical,” Ky said. “We have recertified all the flight controls, including information about altitude and speed. That made for a number of difficulties with our Boeing and FAA colleagues as we were going beyond simply correcting the contributing factors. If we had listened to the FAA and Boeing we would have settled for making modifications to the MCAS which was the contributing factor for both accidents.” 

EASA is now finalizing its work on the MAX following the completion of inflight tests, which Ky said “went well.” 

Ky also said that, looking to the future, EASA would look at the Boeing 777X with “increased vigilance.”