In my post last Thursday, I laid out why I thought the 737 MAX shouldn’t have been grounded with the information we knew at the time. Some readers took that as me standing behind Boeing, but that’s not the case. Even if the airplane is safe to fly, it should be safer than it is. Boeing should absolutely shoulder blame here.
Though we don’t know for sure if the same issue that caused the Lion Air crash last year caused the Ethiopian one, let’s look at that particular issue in more detail.
Lion Air Accident
Lion Air flight 610 had just departed from Jakarta on October 29, 2018 when the pilots almost immediately reported flight control problems and asked to return to the airport. They never made it and crashed into the sea shortly after.
While the investigation hasn’t been officially finalized, it seems pretty clear what happened here. On the four previous flights, the airspeed indicators had malfunctioned and apparently hadn’t been fixed. On the flight right before the accident, there was a 20-degree disagreement between the angle of attack sensors, and that caused the airplane to put itself into a dive. The pilots overrode that automation and landed safely.
Apparently Lion Air didn’t bother fixing the problem after landing, because this is exactly what happened on the ill-fated final flight of the aircraft as well. This time, the pilots didn’t override the automation. Had maintenance properly fixed the airplane or had the pilots overridden the automation, the flight would have landed safely. But it didn’t, and now we’re all learning more about the details of how that automation works.
A Four-Letter Word: MCAS
If this airplane had not crashed, the general public would never know about the Maneuvering Characteristics Augmentation System or MCAS for short. The problem is, pilots didn’t know about it either, and that’s the first concern.
MCAS didn’t exist on previous 737 models, but it was introduced on the MAX because of the engines on the airplane. The MAX uses bigger engines, and since Boeing uses a 50+ year old airframe that was designed for much smaller engines, it had to find a way to fit these new beasts on the wing while keeping the airplane airworthy.
As you can see above, since the new engines were so big, they had to be fit higher up to give enough ground clearance. To do that, Boeing moved the engines further forward and up, out from under the wing.
Because of the placement of the engines, when pilots push up the throttle on this airplane, the added thrust can push the airplane’s nose up too much, particularly in tight turns. As a safeguard, MCAS reads the angle of attack measures (here’s an explanation of what that is) to determine whether to act. If the angle of attack starts getting too high, the MCAS kicks in by adjusting the horizontal stabilizer trim tabs (small surfaces that adjust to keep the airplane in stable flight) on the airplane to bring it back down when it’s being flown by hand. That means if autopilot is engaged, MCAS doesn’t kick in. Also, if flaps are deployed, so on initial departure or on final approach, then it also won’t kick in.
To Train or Not to Train
Boeing says that the MCAS was in the manual but that has been disputed by airlines operating that airplane. Even if it was in the manual, that wasn’t enough. Boeing acted like this was just a minor automation that would only slightly adjust the airplane in extreme circumstances. But it wasn’t designed that way. And if there’s bad data being fed into the system, it can prove deadly if the pilots don’t react properly.
In the Lion Air accident, the two angle of attack sensors were off by 20 degrees. This was known to be an issue before the flight, and Lion Air didn’t properly fix it. Lion Air also didn’t select the optional indicator that would alert pilots to an angle of attack measurement discrepancy, so the pilots wouldn’t have been alerted to that. Because it wasn’t fixed, MCAS misinterpreted what was happening to the airplane and it adjusted the trim to bring the airplane’s nose down multiple times.
In this case, the pilots recovered, but then MCAS kept trying to lower the nose. Eventually the pilots lost control of the airplane. Naturally, the question turned to the MCAS. Was it enough to have this in the manual? Or should the pilots have been trained on the existence of this system? Everyone now agrees that pilots should have been trained, and that did finally happen immediately following this accident… though Boeing was clearly pushed into it.
While there’s no question that training for this scenario is good, the reality is that the response to a trim problem is the same whether the MCAS caused it or not. These pilots should have been able to save the airplane, just as the pilots did on the previous flight.
Anti-MCAS Maneuvers
If the airplane is auto-trimming itself in a way that the pilots don’t like, it’s a very easy fix. All the pilots have to do is flip this switch:
Then there is a giant trim wheel which pilots can use to manually control the trim on the airplane. (And I do mean manual. This isn’t fly by wire, as I understand it.)
That’s it.
It’s important to repeat this point. This has nothing to do with MCAS alone. If there is any trim-related problem, this is the procedure to shut off auto-trimming and take manual control. That is something pilots are trained for.
Boeing’s Faulty Logic
Regardless of how easy it should be to counter MCAS, that doesn’t minimize just how poorly this system appears to have been designed by Boeing.
Incredibly, the MCAS was designed to act with the input from just a single angle of attack sensor even though there is more than one onboard. In the case of the Lion Air accident, it apparently saw the faulty reading and acted. Had it bothered to compare both readings to see the discrepancy, then that would have prevented the automation from acting.
Side note: Why are the angle of attack sensors having these discrepancies on a brand new airplane? Is it the sensor? Or is it how the data is being interpreted? This is something that deserves closer scrutiny.
Also surprisingly, the trim adjustment is really aggressive. As Boeing describes it, in the new software release the trim adjustment will now be limited so that faulty readings from the angle of attack sensors won’t create the large upset that we’ve seen. This is also mind-boggling that it wasn’t designed this way initially, because the updated response is more than sufficient to correct an angle of attack problem, it seems.
Lastly, why was the system designed to continue acting even if the pilots are pushing back against it? If the auto-trim is left enabled, the pilots can still try to counteract the nose-down attitude through the control wheel. Even if they succeed, the MCAS will continue trying to push the nose forward. That is flawed logic.
All of this is going to be fixed in a future software update that Boeing is furiously working on now, but it remains extremely hard to understand why this was designed this way in the first place. There is a lot more detail here, if you’re interested.
One Last Thing to Keep in Mind
Where does this leave us? Well, when the software fix comes out soon, it will, as Boeing says, make an already safe aircraft even safer. We have to remember that even without the software fix, it is very easy to override the system. Good pilots should have no trouble with it even if it was poorly-designed.
There is one other thing to keep in mind… we still don’t know if this was a reason for the crash of Ethiopian flight 302. If MCAS was involved, as the aircraft track makes it appear, we don’t know that there weren’t other issues that complicated the situation.
For example, there were reports of smoke and possibly debris trailing the aircraft before the airplane crashed. While we have no idea if this is true since eyewitness reports are often unreliable, if it is, it could certainly have made for a much busier cockpit. Just imagine if there was a fire or a bomb or something else onboard. That combined with the activation of the MCAS could have wreaked havoc. Or what if the pilots did everything right and MCAS still didn’t deactivate? Well then we have a whole different, MUCH more serious issue that could keep that airplane grounded for a long time. We really need the black boxes to tell us more, and it sounds like that information is starting to come out.
Regardless of what we find out from the black boxes, we know that there is a lot Boeing did in the design process that can and should be questioned. The fixes that are being planned will improve safety further, but that doesn’t mean Boeing will get out of this easily. Boeing is going to feel a whole lot of pain from the decisions it made, and I don’t think anyone feels sorry for the company. This is quickly turning in a full-blown PR crisis.
