Learning from the MAX

No one knows with certainty what mix of factors brought down two of the world’s most sophisticated passenger jets. The final accident reports from the Lion Air and Ethiopian Airlines crashes are still being drafted. Jan Tegler looks at how the crews might have been able to save their aircraft from all that was working against them.

This story was updated to correct an error in the description of the procedure that pilots follow to cope with runaway trim.

The emergencies came to light with eerily similar calls to air traffic controllers. “Flight control problem,” the first officer of the doomed Lion Air jet reported after requesting permission to enter a holding pattern. “Having control problems,” the first officer of an Ethiopian Airlines jet radioed four months later.

The crashes of these 737 MAX 8 jets killed 346 passengers and crew members and sparked months of investigations, public criticism of Boeing and the FAA, and analyses of actions by the captains and first officers.

In this article, we look specifically at the performance of the crews as they struggled mightily against the Maneuvering Characteristics Augmentation System, or MCAS. Boeing had developed this software to automatically compensate for the tendency for the MAX’s nose to rise because of its engine placement.

With only preliminary accident reports released so far for each accident, it is too soon to identify all the lessons that these tragedies might eventually hold for air safety in the age of partial automation. But constructive observations are starting to be made, and they center not just on faulty technology and questions over FAA certification of the MAX, but also on pilot training for handling emergencies caused by automation.

Harrowing scenario

Whether the loss of control in these accidents was indeed recoverable, as some experts contend, a long list of factors was working against the pilots. The emergencies began when one of the two angle-of-attack sensors on each jet failed, investigators say. These metal vanes pivot with the wind to measure the angle between the oncoming air, called the relative wind, and the aircraft, specifically the fuselage in the case of the MAX. Raise the nose too high, and the aircraft loses lift and stalls. That’s what MCAS was programmed to watch for. When it received the faulty AoA readings, it commanded the horizontal stabilizer on the tail to rotate its leading edge upward to trim the nose down.

Compounding matters for the Lion Air captain and first officer was that they almost certainly did not know that a new piece of software called MCAS was aboard and operating in the background. Hence the mystified tone of the communications from the cockpit. Only after Lion Air crashed did Boeing and FAA inform its customers of the existence of MCAS, and even then the information dribbled out. On Nov. 6, Boeing issued a bulletin to MAX customers warning that a faulty AoA reading could trigger the aircraft’s pitch system to push the airliner’s nose down. FAA followed on Nov. 7 with an Emergency Air Worthiness Directive. Neither of the notices identified MCAS by name. That did not happen until Nov. 11, when Boeing sent a message to customers naming MCAS as the system that caused the Lion Air jet to dive repeatedly.

U.S. pilots were as surprised as anyone about the existence of MCAS, and some voiced their outrage to Boeing. The Dallas Morning News reported in May that members of the Allied Pilots Association, the union for American Airlines pilots, grilled Boeing representatives a few weeks after the first crash about why pilots were not informed of the existence of MCAS.

At the Nov. 27 meeting, Boeing “categorized [MCAS] as just another control law, nothing to worry about,” says Dennis Tajer, an airline pilot and chairman of the union’s communication committee who attended the meeting. “Obviously, that first incident [the Lion Air crash] proves different. The second one solidified that [MCAS] is a powerful and deep system.”

I was not able to obtain the MAX crew manual, but Tajer says MCAS is referred to only once, in a list of abbreviations. Boeing cautions that any “media reports that we intentionally withheld information about airplane functionality from our customers are simply untrue.”

Taking control

Matthew Menza, a former Boeing 737 production test pilot, said the responses of the pilots to the emergencies must be examined, as painful as that might be. He flew several experimental test flights on the 737 MAX 7, a version that is all but identical to the 737 MAX 8 versions that crashed, and dozens of MAX production test flights before leaving Boeing in July 2018.

In Menza’s view, the pilots did not need to know the underlying cause of the problems they were experiencing to save their airliners. “It doesn’t matter if it was a short circuit in a trim motor or MCAS or a problem with the wiring,” he says. “The only thing that matters as a pilot is the simple situation before you. The airplane is pitching down, the airplane is pitching up. I did not tell it to do that. OK, how do we solve that?”

The solution would have been to follow the same procedures for coping with runaway trim, such as when the horizontal stabilizer trims the nose beyond what was commanded.

With me as his hypothetical first officer, Menza shows me how the procedures work. Fast action is required so that the plane does not accelerate to a speed at which it can no longer be controlled.

Our scenario starts with the aircraft flying with its autopilot and auto-throttle engaged, as was the case with the Lion Air and Ethiopian flights.

“Say you and I are flying along and the nose starts pitching down suddenly and I’m fighting it. What was that?!”

Menza in the role of captain tells me, the first officer, that he is going to disconnect the autopilot and auto throttle. “Disconnect, disconnect!” This action removes these features from the control equation. Though the following is not in the crew manual, throttles might also be moved to the flight-idle position to keep the engines from contributing to any acceleration toward the ground.

In the background, MCAS would still be operating at this point because it is separate from the autopilot.

“It’s still pitching down! Jan, give me the stab trim cutout — switches now.”

What he means is that I should turn off the power to the electric motor that drives the jackscrew attached to the horizontal stabilizer, the control surface that MCAS was errantly rotating upward.

“Got it!” I say.

We can now take manual control of the horizontal stabilizer by winding two large trim wheels on either side of the throttle pedestal. If a malfunctioning motor or faulty wiring had caused the runaway trim, we have now removed these factors from the equation. Likewise, even if we did not know that MCAS existed — a situation that pilots say Boeing and FAA should never have allowed to happen — following this protocol would have defeated its command to trim the nose down. There is no off switch for MCAS.

Turning the wheel forward trims the nose up: “Give me forward turns nose-up trim. Now give me two more turns,” Menza says.

We have regained control of our hypothetical aircraft.

Speed became the enemy

Whether the Lion Air crew last October took any of the previous steps remains unknown. The preliminary report from the Indonesian National Transportation Safety Committee says that about three minutes after takeoff the crew experienced an episode of uncommanded “automatic nose down trim” that lasted for 10 seconds and that in response the “flight crew commanded aircraft nose up trim.” About two minutes later, the crew experienced another nose-down episode. This cycle of uncommanded nose down trim and attempts by the crew to raise the nose continued until the crash.

The Ethiopian scenario in March was different in that the crew must have been aware of the Lion Air crash, and probably knew the procedures outlined by Boeing and the FAA to recover from such a scenario. The preliminary report shows that the captain and first officer turned off their autopilot and auto throttle and activated the stab trim cutout switch to turn off the horizontal stabilizer motor. They began manually trimming the nose.

Two events then caught the eye of Rep. Sam Graves, R-Mo., the senior Republican on the House Transportation and Infrastructure Committee and a pilot with an Airline Transport license. Graves discussed his view of the accident during a May hearing. The pilots did not take the MAX’s throttles back from takeoff thrust, the report confirms, and the plane accelerated to 930 kph, far beyond the 630 kph maximum operating speed. “That fundamental error appears to have had a domino effect on all the events that followed,” Graves said.

With the plane flying so fast, the captain and first officer could not physically pull up the nose with the trim wheel. The report shows that they turned back on the trim motor, but this had the effect of turning back on MCAS. The software pushed the nose down again, and the plane crashed.

Perhaps most tragically, Menza notes that at the outset of the uncommanded nose-down trim, the air speed was well within a range that would have allowed the crews to recover to stable flight and be flown manually thereafter.

“As production test pilots at 15,000 feet and 250 knots [280 kph], we would turn off the stabilizer trim motors and fly the airplane manually with the trim wheels on every flight. The airplanes were absolutely controllable until the pilots got the aircraft into a too-nose-low attitude and then the speed and dynamic pressure buildup simply became too high to overcome.”

Emphasize training

At the May hearing, Graves said the crashes “compound my concerns about quality training standards in other countries.” He noted that “pilots can master the cockpit’s technology, but they must be able to fall back on their training to fly the plane — not just fly a computer.”

Earlier, Ethiopian Airlines CEO Tewolde Gebremariam told CNN: “It has been proved that the pilots were well-trained and they have demonstrated they were exercising all of the emergency procedures recommended by the manufacturer and approved by the regulator.”

At the same hearing, FAA Acting Administrator Dan Elwell noted that in each accident, one of the two control yokes in the cockpit began shaking and the other did not, facts verified in the preliminary reports. Control yokes or “sticks” are designed to shake this way to alert pilots to pending aerodynamic stall. The stick shaker discrepancy should have been “immediately recognizable” as evidence of a false stall indication, he said. Tajer, of the pilots union, dismisses this contention as “cubicle” thinking rather than cockpit thinking.

Regardless of how the inquiries turn out, Menza stresses that airlines must be certain that their pilots understand MCAS, even if in theory the crews could have regained control of their planes without knowing it was aboard. Boeing has not yet outlined a requirement that pilots receive simulator training before the aircraft returns to flight, but Menza thinks it should be required. He adds that a MAX simulator would not be needed to practice recovery procedures — any current 737 simulator could be used.

“If we can start teaching pilots how to handle non-normal situations, coupling basic piloting skills and basic systems knowledge with proper crew resource management, the outcome of these situations can be much better.”

Menza knows it can be emotionally difficult to assess the actions of flight crews who cannot speak for themselves. “Sometimes you have to put your sensitivities aside to have an honest discussion about the realities of what is affecting safety,” he says.