Boeing altered key switches in 737 Max cockpit

By Mike Baker and Dominic Gates / The Seattle Times

In the middle of Boeing 737 cockpits, sitting between the pilot seats, are two toggle switches that can immediately shut off power to the systems that control the angle of the plane’s horizontal tail.

Those switches are critical in the event a malfunction causes movements that the pilots don’t want. And Boeing sees the toggles as a vital backstop to a new safety system on the 737 MAX — the Maneuvering Characteristics Augmentation System (MCAS) — which is suspected of repeatedly moving the horizontal tails on the Lion Air and Ethiopian Airlines flights that crashed and killed a total of 346 people.

But as Boeing was transitioning from its 737 NG model to the 737 MAX, the company altered the labeling and the purpose of those two switches. The functionality of the switches became more restrictive on the MAX than on previous models, closing out an option that could conceivably have helped the pilots in the Ethiopian Airlines flight regain control.

Boeing declined to detail the specific functionality of the two switches. But after obtaining and reviewing flight manual documents, The Seattle Times found that the left switch on the 737 NG model is capable of deactivating the buttons on the yoke that pilots regularly press with their thumb to control the horizontal stabilizer. The right switch on the 737 NG was labeled “AUTO PILOT” and is capable of deactivating just the automated controls of the stabilizer.

On the newer 737 MAX, according to documents reviewed by The Times, those two switches were changed to perform the same function — flipping either one of them would turn off all electric controls of the stabilizer. That means there is no longer an option to turn off automated functions — such as MCAS — without also turning off the thumb buttons the pilots would normally use to control the stabilizer.

Peter Lemme, a former Boeing flight-controls engineer who has been closely scrutinizing the MAX design and first raised questions about the switches on his blog, said he doesn’t understand why Boeing abandoned the old setup. He said if the company had maintained the switch design from the 737 NG, Boeing could have instructed pilots after the Lion Air crash last year to simply flip the “AUTO PILOT” switch to deactivate MCAS and continue flying with the normal trim buttons on the control wheel. He said that would have saved the Ethiopian Airlines plane and the 157 people on board.

“There’s no doubt in my mind that they would have been fine,” Lemme said.

Boeing said in a statement that the company had historically called for pilots to flip both switches to shut of a problematic or “runaway” stabilizer, so the change on the MAX ensured that the function of the switches matched that procedure. The company said the two switches “were retained for commonality of the crew interface.”

“Boeing strongly disagrees with any speculation or suggestion that pilots should deviate from these long-established and trained safety procedures,” Boeing said.

On the Lion Air flight in October, pilots were apparently unaware of MCAS. As various warnings went off in the cockpit, they never reached the conclusion to use the runaway stabilizer procedure. In the end, data from the flight shows, the repeated commands of MCAS eventually sent the plane plummeting into the sea.

After that crash, Boeing issued a directive calling for pilots to use the typical runaway stabilizer procedure to deal with MCAS in the event of a problem. Then pilots would be able to swivel the tail down manually by physically turning a control wheel that connects to the tail via cables.

But on the Ethiopian Airlines flight, the pilots appear to have recognized the errant MCAS problem and flipped the cutoff switches as described in the checklist. But then it appears that the pilots were unable to move the manual wheel, likely because the forces on the tail made it physically challenging to turn.

The bottom of Boeing’s runaway stabilizer checklist seems to acknowledge the possibility of this physically challenging scenario. It suggests that the pilots can first use the electric trim to neutralize those potential forces before hitting the cutout switches.

After failing to manually control the stabilizer, the Ethiopian Airlines pilots appear to have flipped the cutoff switches back on, which awakened the MCAS system. It soon sent the plane diving to Earth.

Lemme said he’s surprised that Boeing made the change to take away the functionality that could have allowed the pilots to shut off MCAS without shutting off the electric switches at their thumbs.

“I don’t get it at all,” Lemme said. “I don’t see what the benefit was for making that change. It was like change for change’s sake.”

But Doug Moss, an aviation consultant who has worked as a commercial pilot on Boeing planes, said the cutout switches need to be as simple as possible. Asking the pilots to flip one of the switches — instead of what they have historically known about flipping two switches simultaneously — may have just added a layer of complexity that isn’t helpful in an intense scenario.

“When you’re pulling on the column with 80-100 pounds of force trying to save your life, your troubleshooting techniques are very weak,” Moss said. “You need some gut-level instinctive things to do to solve the problem.”

A veteran Boeing 737 test pilot said that all Boeing planes have two such cutoff switches, not just the 737. And both he and American Airlines Captain Dennis Tajer, a spokesman for the Allied Pilots Association who flies 737s, said they could think of no existing procedure that called for flipping only one of the switches.

The procedure appears to be designed to prepare for a situation in which the plane’s stabilizer motor is for some reason jammed and moving uncommanded in one direction — a classic “runaway stabilizer” situation. That would require shutting off all power to the motor.

As the FAA worked to inform pilots about the changes on the MAX airplane when it first came into service, the agency didn’t describe the new functionality of the switches. In its documentation, it simply noted a labeling change: “Stab Trim cutout switches panel nomenclature,” the Flight Standardization Board included on its list of differences between the plane models.

Boeing did not answer questions Friday about the original purpose of the two-switch design on the 737 model — a plane that first entered service in the 1960s — or about whether the company plans any upcoming changes on the cutout switches.

With the 737 MAX grounded around the world, Boeing is now working on a fix to its MCAS system. The software update is expected to limit the power of MCAS and will consider multiple inputs so that it won’t take action in response to a single faulty sensor.