Welcome back to Plane Crash Diaries with me your host Desmond Latham.
This week it’s the terrible crashes involving the Boeing 737 MAX 8 – one in October 2018 and the other in March 2019 which appears to have been caused by two main things.
On is an automated trim called the Movement Characteristics Augmentation System and the other is the shocking failure by one of the world’s most well known manufacturers – compounded by a cosy relationship between the Federal Aviation Authority and the world’s biggest aircraft manufacturer.
While the accident reports are awaited, there is enough information from both FAA and Boeing itself to cover this as an example of poor design, poor safety management, and poor oversight – particularly when it comes to risk analysis.
Since the accidents Boeing has announced a slew of changes to its quality control process, including the announcement in September that a new Safety Committee was being created led by Boeing veteran Beth Pasztor. Too little too late for 349 people.
Boeing has built a name around allowing pilots to fly their planes, whereas Airbus had designed their planes around more automation, but back in the mid 2000s something really radical happened at the American plane manufacturer.
Somewhere in the engineering process, someone decided it would be a good idea to let the plane have the last say when it came to control – and imbedded the Manouvreing Characteristics Augmentation Software into the system. This was to prove catastrophic for 349 people – two entire plane loads of passengers and crew were killed because of this MCAS design fault.
The two accidents I’m covering this week are still fresh in the minds and therefore we must proceed with extra caution. Anyone who follows aviation closely and is objective will find the actions of some involved tantamount to criminal negligence.
So starting this tale with the Lion Air of Indonesia crash in October 2018.
Let’s begin by pointing out that Indonesia has an abysmal aviation safety record – probably one of the worst records in recent memory.
All of Indonesia’s airlines were blacklisted by European Union air-safety regulators and banned from entering EU airspace in 2007 because of concern over lack of regulatory oversight in Indonesia.
Lion Air was allowed back into the EU zone after a safety audit in 2016.
A database compiled by aviation analytics firm FlightGlobal shows that before the JT610 disaster, Lion suffered 11 major accidents since 2002: the total loss of five aircraft, five accidents that resulted in major damage, and one minor loss.
These accidents were caused by a host of reasons, but included poor maintenance and poor flying with pilots making basic errors on flap selection for example, as well as complete failure of situational awareness. So it would be easy to write off the first MAX 8 crash as another example of ramshackle Indonesian aviation culture.
But the Boeing Max 8 crash was different.
The Boeing 737 Max took off on 29 October 2018, carrying 189 passengers and crew. The flight’s cockpit crew were 31 year-old captain Bhavye Suneja, who had flown with the airline for more than seven years and had over 6,000 hours of flight experience including 5,176 hours on the Boeing 737); and Indonesian co-pilot Harvino, who had 5,174 hours of flight experience, 4,286 of them on the Boeing 737.
The six flight attendants were also Indonesian.
The captain was at the controls of Lion Air flight JT610 when the jet took off from Jakarta, and the first officer was handling the radio.
While the cockpit voice recording has never been released, sources quoted by Indonesian and other media confirm the following took place.
Two minutes into the flight, the first officer reported a “flight control problem” to air traffic control and said the pilots intended to maintain an altitude of 5,000 feet, the November report said.
The first officer did not specify the problem, but according to at least one source airspeed was mentioned on the cockpit voice recording, and a second source said an indicator showed a problem on the captain’s display but not the first officer’s.
The captain asked the first officer to check the quick reference handbook, which contains checklists for abnormal events.
For the next nine minutes, the Boeing continued to sound alarms about stalling, and the MCAS pushed the nose downwards.
The captain fought to climb, but the computer, still incorrectly sensing a stall, continued to push the nose down using the plane’s trim system. Normally, trim adjusts an aircraft’s control surfaces to ensure it flies straight and level.
It appears to all that the crew did not know MCAS was causing the problem. You don’t have to be a rocket scientist to understand that a lack of training in this failure compounded what is now known to be an example of bad technical design.
According to sources quoted by Indonesian media, the crew thought only about airspeed and altitude – because that was the only thing they talked about.
Near the end, the captain asked the first officer to fly while he checked the manual for a solution.
About one minute before the plane disappeared from radar, the captain asked air traffic control to clear other traffic below 3,000 feet and requested an altitude of “five thou”, or 5,000 feet, which was approved.
As the 31-year-old captain tried in vain to find the right procedure in the handbook, the 41-year-old first officer was unable to control the plane.
The flight data recorder shows the final control column inputs from the first officer were weaker than the ones made earlier by the captain.
The Indian-born captain was silent at the end, all three sources said, while the Indonesian first officer said “Allahu Akbar”, or “God is greatest”.
The plane then hit the ocean at high speed, killing all 189 people on board.
The accident site was located 34 kilometres or 18 nautical miles off the coast of the island of Java. Investigators examining the Indonesian crash are considering how a computer ordered the plane to dive in response to data from a faulty sensor and whether the pilots had enough training to respond appropriately to the emergency, among other factors.
On 28 November, the Indonesian National Transportation Safety Committee (NTSC) released its preliminary accident investigation report.
After airspeed and altitude problems, an AoA sensor was replaced and tested two days before the accident.
It confirmed reports the day before where pilots had experienced the same conditions with the MCAS pushing the nose down in the same plane.
The air crew on that flight had switched off the electrical engine which drove the trimming and continued with manual trim.
But the crew on 29th October didn’t follow the same procedure.
Shortly after takeoff on 29 October, issues involving altitude and airspeed continued due to erroneous AoA data and commanded automatic nose-down trim via the Maneuvering Characteristics Augmentation System (MCAS).
The flight crew repeatedly commanded nose-up trim over the final ten minutes of the flight.
Boeing issued a statement shortly afterwards pointing to the successful troubleshooting conducted on 28 October as evidence that the MCAS did not change runaway stabilizer procedures, and emphasised the longstanding existence of procedures to cancel MCAS nose-down commands.
What Boeing failed to mention was that it had also removed a crucial Angle of Attack sensor failure alarm which had existed in a previous version of the Boeing 737. They have not explained why this was done but its clearly to reduce costs for operators. Airlines could buy an upgrade that involved a sensor failure alarm.
This is going to haunt the company in future litigation.
Investigators who analyzed the flight data recorder after the October 29 crash uncovered a fault between two Angle of Attack Sensors located on the nose of the plane.
It was the first major accident involving the new Boeing 737 MAX series aircraft, introduced in 2017, and the deadliest involving a 737, surpassing Air India Express Flight 812 in 2010.
It is the deadliest accident in Lion Air’s 18-year history – even for an airline dogged by incidents and accidents.
The first victim was identified two days after the crash then the flight data recorder was located on 1 November and recovered for analysis. The Cockpit voice recorder was eventually located in Mid January 2019.
Preliminary investigations revealed serious flight control problems that traumatized passengers and crew on the aircraft’s previous flight the day before the accident, as well as signs of Angle of attack (AoA) sensor and other instrument failures on that and previous flights, tied to a potential design flaw involving the Maneuvering Characteristics Augmentation System (MCAS) of the 737 MAX series.
As a result, the United States Federal Aviation Administration and Boeing issued warnings and training advisories to all operators of the 737 MAX series to avoid letting the MCAS cause an abrupt dive similar to the Lion Air flight.
But neither the FAA nor Boeing thought it apt that the MAX8 be grounded.
Jaw dropping – at the time as I reported on this crash it was pretty clear from initial reports by all involved in the previous flight that the MCAS system was causing a disturbingly dangerous situation.
Shortly after the Lion Air Crash in November 2018 The Wall Street Journal reported that Boeing and the FAA were planning to publish warnings about erroneous angle of attack indications on cockpit instrument displays of the 737 MAX in response to the Lion Air accident.
The Federal Aviation Administration then issued an emergency Airworthiness Directive (AD) requiring that amended operating limitations and procedures relating to erroneous data from an AoA sensor be inserted into the aircraft flight manual of each 737 MAX aircraft, and urged all airlines operating Boeing 737 MAX 8s to heed the warnings.
But they still did not advise an urgent training intervention. But some pilots I followed at the time were already calling the plane to be grounded.
During difference training, pilots of American Airlines and Southwest Airlines converting from earlier Boeing 737 Next Generation models to the 737 MAX were not informed of the MCAS linked to the fatal crash, leaving them concerned that they were possibly untrained with respect to other differences.
American Airlines’ Allied Pilots Association and Southwest Airlines Pilots’ Association were also caught unaware. The Wall Street Journal reported that Boeing had “decided against disclosing more details to cockpit crews due to concerns about inundating average pilots with too much information”.
This is truly gobsmacking. All we do as pilots is deal with information – you tell us what is likely to go wrong and then we practice for these eventualities. What you don’t do is keep it a kind of secret because we’re .. in Boeing’s words .. average.
On 15 November, the US Air Line Pilots Association representing 61,000 pilots, urged the FAA and NTSB to ensure pilots receive all relevant information addressing a “potential, significant aviation system safety deficiency”.
This was still before the Ethiopian crash. No-one took much notice.
But the United Airlines branch of the Airline pilots association said the MAX 8 should keep flying – despite reservations from more conservative pilots I was following at the time. They alleged the MCAS implication was mere speculation. They did this because they flew many MAX 8 planes and to ground them would have .. yes.. a big financial impact.
I wonder what they think now, this union. They put their own members in mortal danger by ignoring clear signs of technical failure merely because of business interests.
In an internal message on 19 November, Boeing CEO Dennis Muilenburg defended the Flight Crew Operations Manual as describing the MCAS relevant function.
But Boeing was taking heat -Lion Air co-founder and former CEO Rusdi Kirana reportedly considered cancelling Lion Air’s outstanding 190 Boeing aircraft orders worth some $22 billion at list prices over what he viewed as an attempt by Boeing to blame Lion Air for the crash.
On 31 December, the family of the first officer filed a lawsuit against Boeing, claiming negligence. The lawsuit also claimed that the aircraft’s sensors provided inaccurate flight data, causing its anti-stall system to improperly engage, as well as Boeing not providing proper instructions to pilots about how to handle the situation
In March 2019, victims’ families reported irregularities, saying that Lion Air pressured them into signing away their rights to seek legal recourse for under-compensation.
But Boeing’s horror year was about to get worse, as the March 10 2019 crash of the Ethiopian Airlines Max 8, Registration ET-AVJ was blamed on the same MCAS-linked errors.
The other really horrible reality for passengers and crew on the next MAX 8 crash in Ethiopia was these advisories were not fully implemented. And they also pointed to a serious problem with the plane design.
The aircraft took off at 08:38 local time with 149 passengers and 8 crew on board – many of the passengers were United Nations staff.
The captain of the plane was 29 yeqra-old Yared Getachew who had been flying with the airline for almost nine years and had logged a total of 8,122 flight hours, including 1,417 hours on the Boeing 737.
He had been a Boeing 737-800 captain since November 2017, and Boeing 737 MAX Captain since July 2018.
At the time of the accident, he was the youngest captain at the airline. But he wasn’t the youngest crew member, that was first officer, Ahmed Nur Mohammod Nur who was, 25.
Nur was a recent graduate from the airline’s academy with 361 flight hours logged, including 207 hours on the Boeing 737.
The fact that the First Officer did not have the usual 1500 hours minimum which most airlines demand may have contributed to the factors leading to this accident. That is clearly speculation – however I’ll read to you from other global airlines minimums
For a major airline in the USA the minimum requirements are typically 1,500+ hours total time, 1000+ hours pilot in command of a turbine aircraft, 1,000 hours multi-engine time, and an ATP rating. The average new-hires have 4,000-5,000 hours total time.
Ethiopian airlines like many other developing nations, is trying to fast-track its own nationals into the cockpit. The lack of experience is only a problem when there’s a problem or a crisis.
And ET 302 had an emergency.
One minute into the flight, the first officer reported a “flight control” problem to the control tower. Two minutes into the flight, the plane’s MCAS system activated, pitching the plane into a dive toward the ground.
The pilots struggled to control it and managed to prevent the nose from diving further, but the plane continued to lose altitude. The MCAS then activated again, dropping the nose even further down. The pilots then flipped a pair of switches to disable the electrical trim tab system, which also disabled the MCAS software.
The only other possible way to move the stabilizer would be by cranking the wheel by hand, but because the stabilizer was located opposite to the elevator, strong aerodynamic forces were making this almost impossible at high speed.
As the pilots had inadvertently left the engines on at full takeoff power, which caused the plane to accelerate to over 500 miles an hour, there was further pressure on the stabilizer. The only way it would be able to move by hand would be to throttle back significantly which they never did.
The pilots’ attempts to manually crank the stabilizer back into position failed.
Three minutes into the flight, with the aircraft continuing to lose altitude and accelerating beyond its safety limits, the captain instructed the first officer to request permission from air traffic control to return to the airport.
Permission was granted, and the air traffic controllers diverted other approaching flights.
Following instructions from air traffic control, they turned the aircraft to the east, and it rolled to the right. The right wing dipped as the turn steepened – they were beginning what is known as a spiral dive.
At 8:43, having struggled to keep the plane’s nose from diving further by manually pulling the control wheel, the captain asked the first officer to help him, and turned the electrical trim tab system back on in the hope that it would allow him to put the stabilizer back into neutral trim.
However, in turning the trim system back on, he also reactivated the MCAS system, which pushed the nose further down rapidly.
The captain and first officer attempted to raise the nose by manually pulling their control wheels, but the aircraft continued to plunge toward the ground.
The aircraft disappeared from radar screens and crashed at almost 08:44, six minutes after takeoff.
Flight tracking data showed that the aircraft’s altitude and rate of climb and descent were fluctuating.
Several witnesses stated the plane trailed “white smoke” and made strange noises before crashing. The aircraft impacted the ground at nearly 700 mph.
There were no survivors.
It crashed in a farm field near the town of Bishoftu, 62 kilometres southeast of Addis Ababa. The impact created a crater about 90 feet wide and 120 feet long, and wreckage was driven up to 30 feet deep into the soil. Wreckage was strewn around the field along with personal effects and other bits from inside the plane.
Personnel from Interpol and Blake Emergency Services, a private British disaster response firm contracted by the Ethiopian government, arrived to gather human tissue for DNA testing, and an Israel Police forensics team also arrived to assist in identifying the remains of the two Israeli victims of the crash.
Twenty two people on board were affiliated with the United Nations, including seven from the World Food Programme alone.
Both Addis Ababa and Nairobi have offices of UN agencies, and Addis Ababa has the head office of the African Union.
Slovak politician Anton Hrnko lost his wife and two children in the crash. All of these families are seeking answers to serious questions and Boeing is in the firing line.
The MCAS system was implicated in the second Crash on 10 March 2019 – following which all 737 MAX aircraft were grounded worldwide.
But it was in China, the EU and Canada that the grounding began – not the United States. This is really a shocking indictment of both the FAA and Boeing. The initial reports clearly showed a real technical problem with MCAS and I followed commercial pilots who were flying the MAX8 and who were extremely angry with both Boeing – and their airlines for hesitating at this point.
The initial report showed that there were two speeds in the cockpit in both cases – indicating the Angle of Attack Sensor was to blame for the initial failure – followed up by MCAS responding aggressively as it was designed. What compounded these accidents was the sets of air crew who had not been trained in MCAS failure of this sort.
But the real problem began with Boeing and its rushed re-design of the 737 which Boeing fast-tracked to compete with Airbus which was making inroads with its A320 single aisle class of plane.
Because the redesigned 737 had bigger CFM International LEAP engines, it meant they needed to be placed higher and further forward in relation to the wing than the previous 737 models.
This destabilises the aircraft pitch at higher angles of attack – so to deal with this, the engineers designed the Maneuvering Characteristics Augmentation System (MCAS) for the 737 MAX series.
Scientific American and the Wall Street Journal reported that former Boeing engineers expressed the opinion that a nose down command triggered by a sensor single point of failure is a design flaw if the crew is not prepared, and the FAA was evaluating a fix of the possible flaw and investigating whether the pilots’ transition training was adequate.
Engineers flagged this is a possible catastrophic failure, but Boeing eventually noted the failure as critical. The first has red flags, the second orange.
This is the crux of the legal case that Boeing will face in the future.
A malfunction in the AoA sensors could lead the MCAS system to believe that the aircraft is stalling when it wasn’t, causing it to dip the aircraft’s nose to recover from a non-existent stall even in level flight. At high altitude that was bad enough. Close to the ground this was, as we’ve seen, catastrophic.
The terrible fact is that no other plane type since the disastrous Gloucester Meteor crashes of 1966 that the same commercial plane had been implicated in two fatal accidents within five months of each other.
Soon after the Ethiopian Airlines crash, Brazil, China, and India grounded the Max 8.
The European Union followed shortly afterwards, but the FAA continued to dither which is really unforgivable. The US was particularly slow to act.
While Boeing has announced a new safety process led by veteran Beth Pasztor, their legal problems are only just beginning.
A Congressional panel wants to interview the engineer who
filed a scathing internal ethics complaint alleging that company management
blocked key safety improvements during the aircraft’s development due to cost
U.S. House Transportation and Infrastructure Committee members want to interview engineer Curtis Ewbank’s. The engineer has written a 5000 word report into safety failures.
As a possible cover-up of serious lapses is possible – it appears Boeing kept the Engineers report secret from the Transportation Panel and this along with other obvious mis-steps by the manufacturer are going to come back to haunt CEO Denis Muilenburg and his fellow executives – along with the shareholders.
I’ve reported and followed this story very closely since October 2018 and I am absolutely horrified by Boeing’s actions. As a pilot Boeing is close to my heart, its always been an aircraft that elevated pilot skill above automation – but MCAS is going to be seen as a kind of software driven robot gone mad – combined with a company that preferred quick profits to proper risk analysis.
The damages claims will end up running into the tens of billions of dollars. Boeing’s good name is forever sullied by these two accidents and the company’s muddled response – let alone the FAA’s apparent complicity.
And by the way, in late September 2019 another problem was discovered in Boeing 737 NGs, whch predate the MAX 8. The pickle fork attaches the plane’s fuselage, or body, to the wing structure and manages forces. A failure of the part in flight could pose a serious risk.
Boeing’s bad news continues.
I’ll be following this story as it unfolds in the future..