How the 737 MAX Flew into Aviation Infamy

Four months after Lion Air Flight JT610 plunged into the sea, killing 189 people; ten days after Ethiopian airways Flight 302 dug a crater, atomising its 157 passengers and crew, there is still a mystery surrounding the Boeing 737 Max aircraft.  No – not why these planes crashed, but why “the why” has not been told. Here’s the real story.

Four years ago, the aviation press was agog with excitement about the race between the two great airline manufacturers, Boeing and Airbus, to produce the latest version of their popular narrow-bodied single-aisle airliners. The Boeing 737 had long been pitted against the Airbus 320 series. More than 7000 versions of the 737 are flying; various airlines operate more than 8000 Airbus 320s and 321s.

Airbus won the race. Its A320 Neo – largely unchanged except for new engines and “sharklet” winglets – went into service with Lufthansa in January, 2016, and quickly garnered 6500 orders. Boeing’s first 737 MAX – a re-design with similarly more powerful and economical engines — went to Indonesia’s Malindo (a subsidiary of Lion Air) in May, 2017. Loyal Boeing customers placed 5000 orders for the plane.

Boeing’s modifications placed the new, bigger engines further forward; to compensate for the change in trim, changes were made to the nose, the tail assembly and a new “split winglet” was designed. And a new piece of automation to help pilots cope with emergencies was added to the flight-control system. Enter MCAS – the manoeuvering characteristics augmentation system. It was, helpfully, to over-ride the controls to push the nose of the plane down, when an imminent stall was detected.

The MCAS reacted to inputs from instruments indicating airspeed and angle of attack – that is the angle of the wings to the airflow. A stall occurs when the angle is too great for that airspeed; the result is the lift provided by the wings is too low to keep the plane flying. Stall recovery involves lowering the nose, picking up airspeed and thus increasing the lift. That is what the MCAS was supposed to do, automatically, especially at the high speeds of modern jets, when a high-speed stall is highly unlikely, but particularly dangerous.

When Indonesia’s National Transportation Safety Committee (NTSC) analysed the information on the flight data recorder from JT610, the chain of events that caused the accident was immediately obvious:

• The angle of attack sensor was faulty and wrongly indicated the plane was climbing too steeply.
• The “stick shaker”, a Boeing device to warn the pilot of impending stall, began vibrating the control column as soon as the plane became airborne.
• When the flaps were retracted at 3000 feet, the MCAS started trying to push the nose down.
• Twenty-one times, the captain cancelled the action with the thumb trim switch on the control column, and raised the nose. Each time the system replied by raising the nose. He then handed command to his co-pilot.
• The co-pilot quickly flicked his thumb switch twice. The plane went into a  steep dive.
• Ten minutes after takeoff the plane had lost 3000 feet. Its last recorded height was 2500 feet.
• The captain took back control and tried with all his might to pull back on the control column, but he could not stop the dive. The plane hit the sea at  500 kph.

It soon emerged that the flight manual for the 737 MAX made no reference to the MCAS. The system was supposed to operate in the background, coming into play only in an emergency. A month after the Lion Air crash, Boeing issued a bulletin explaining the characteristics of MCAS. In so many words, it clarified that:

• Erroneous AOA data could be cancelled or reversed with the trim switches on the control column.
• Even so, the nose-down operation would re-start itself after 10 seconds.
• Brute force on the control column could not override the system.
• The only way to stop what it called “uncommanded nose-down stabiliser”  was to turn off both Stabiliser Trim Cutout switches.

That is what the crew did when they struck the same problem on the plane’s previous flight, from Denpasar to Jakarta. The first release of information from the cockpit voice recorder (CVR) indicates that first one pilot, then the other, was frantically trying to find an explanation for the aircraft’s behaviour in the manual. They either didn’t know about, or think about, the trim cutout switches. The cockpit voice recorder may tell us why the JT610 crew didn’t do that, but the transcript won’t be released until the final report, between August and September.

Now, more information has emerged about the inherent design weaknesses of the MCAS. First, although the 737 MAX has two angle-of-attack sensors, MCAS is connected to only one. That breaks a cardinal rule of aircraft design – not to have a single point of failure. Second, each operation of the pitch trim system produces a 2.5 degree change in the tail stabiliser. The FAA certification documents are reported to have shown an effect of only 0.6 degrees. So the two flicks of his switch by the Lion co-pilot produced a 5 degree irreversible nose dive.

Crew of Ethiopian Flight 302 this month had even less time than the Indonesians to deal with their problem of “uncommanded nose-down stabiliser”. Their plane reached a height of only 3000 feet when controllers heard a scared voice asking for permission to return to Addis Abbaba. A minute later, the dot on their radar screens disappeared.

When the flight data recorder was recovered, Ethiopian Airlines opted to send it not to the NTSC in the     US, but to BEA at Le Bourget airport, near Paris. The Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile had determined the cause of the mid-Atlantic crash of Air France Flight 447 from their examination of its recorder. BEA quickly issued a public statement drawing attention to the significant similarities with the Lion Air crash. It said nothing else.

What is known, however, is that in both incidents the aircraft were travelling far too fast. Airspeed below 10,000 feet is normally restricted to 250 knots (460 kph), but the Lion Air plane was flying at 300 knots, and the Ethiopian plane at 400 knots. That suggests the pilots increased power to counter what they believed to be an impending stall.

The Lion Air Boeing had made three trips with the faulty AOA sensor before the fatal flight. At Bali, mechanics changed one sensor; perhaps it was the wrong one. The FDR data  showed that there was a 20 degree difference between the readings of the two sensors on the plane – even when it was on the ground!

A further complication is the revelation in American press reports – led by the Seattle Times in Boeing’s home town – that the certification of the MCAS was delegated to Boeing by the Federal Aviation Authority.

Aircraft accidents rarely have a single cause, so many investigations reveal a tragic convergence of errors, mistakes, misjudgements or mechanical faults, trivial in themselves but deadly in conjunction. So it seems with the 737 MAX.

An automated system designed to save pilots at a time when they are likely to be under most pressure, not properly executed or explained, flummoxed two flight crews when confronted with its malfunction. Whether from inexperience or sheer panic in the face of the unexpected, they failed to take the correct action to save their plane and passengers.

It is already obvious what needs to be done to make the 737 MAX a safer aeroplane, and it’s under way. The MCAS will take data from both AOA sensors, the movement of the tail stabiliser will be limited, and the system will be restricted to only one, instead of repeated actions.

What is not at all clear is where these tragic stories will end, and how much it will cost all those involved.

Geoffrey Luck, a veteran pilot, was an ABC journalist from 1950 until 1976. In January, 2014, he recalled how inexperience and power lines very nearly cost him his life