Pilots of doomed Lion Air flight may have been befuddled by safety system designed to prevent errors
- Causes of October 29 crash, which killed 189 people, still being investigated by teams from Indonesia, Boeing and the US National Transportation Safety Board
- Boeing has been well known in aviation world for design philosophy that gives pilots significant authority over the aircraft’s flight controls
Moments after taking off from Jakarta, the pilots flying Lion Air 610 realised they were losing control of their 737 Max jetliner, the newest, most fuel-efficient and most automated model of Boeing’s mainstay aircraft.
The jetliner’s nose unexpectedly pointed down, sending it into a series of 26 dives at less than 5,000 feet. Toward the end, the pilot pulled back on the control yoke with all his might to bring the nose up, but the plane entered a death dive into the Java Sea. The crash, 11 minutes after take-off, killed 181 passengers and eight crew members.
The causes of the October 29 crash are still being investigated by teams from Indonesia, Boeing and the US National Transportation Safety Board. The investigation is examining the role of software intended to protect against pilot errors that have caused several deadly crashes around the world and whether the crew understood the system. When the aircraft’s flight control system malfunctioned, the pilots didn’t know that flipping a single switch in the cockpit would counteract the problem.
“They never pulled out of a mode of confusion and panic,” said Hans Weber, a San Diego air safety expert and retired aerospace executive. As the aircraft’s automated flight control system kept pushing the nose down, no matter how hard they tried to pull up, “they didn’t have enough leverage,” he said. “It seems crazy.”
The accident involved many factors, including poor maintenance, inadequate pilot training and not reporting previous problems on the same aircraft, but the automated system’s failure is a focus of the investigation.
Boeing has been well known in the aviation world for a design philosophy that gives pilots significant authority over the aircraft’s flight controls. In contrast, European manufacturer Airbus’ jetliners are highly automated, limiting what pilots can do to adjust controls.
But in a departure from its normal practice, Boeing inserted in the 737 Max software intended to prevent pilots from pulling up the nose of aircraft when they should push it down to counteract stalls and vice versa. Fatal crashes have occurred when pilots didn’t heed stall warnings.
In 2009, an Air France plane flying to Paris from Rio de Janeiro fell into the Atlantic Ocean after one of the pilots continued to pull the plane’s nose up, despite multiple stall warnings. That same year, a twin-engine turboprop, operated by Colgan Air, crashed in Clarence City, New York, after the crew ignored stall warnings.
Engineers also redesigned the plane with bigger, more fuel-efficient engines that shifted the centre of gravity forward, creating a potential for the aircraft’s nose to pitch up after take-off. Such a nose-high attitude can reduce the lift from the wings to the point that the aircraft starts to drop out of the sky.
To safeguard against such a condition, the 737 Max software automatically adjusts what is called the trim or the fine adjustments on a plane’s rear stabiliser so that the nose can pitch down in certain conditions. The software was given the oblique name “manoeuvring characteristics augmentation system” or MCAS.
“What Boeing did was take the pilot out of the loop,” said Michael Barr, former director of the University of Southern California’s Aviation Safety and Security Programme, which trains accident investigators. “The concept was good, but the question is whether it was properly communicated to the pilots about what it is supposed to do and how it is supposed to work.”
Boeing’s viewpoint is that the procedure to handle a malfunction of the trim system did not change from previous generations of the 737 and the ability of flight crews to disable the automatic trim is the same on its aircraft dating back decades. Since the accident, two airlines have placed sizeable orders for the 737 Max, leading Boeing to believe that the accident will not tarnish the plane’s reputation.
In a message to employees, Boeing CEO Dennis Muilenburg said “the 737 MAX is a safe aeroplane.” He denied media reports that “we intentionally withheld information about aeroplane functionality from our customers” and said “the relevant function is described in the Flight Crew Operations Manual.”
Lion Air may cancel US$22 billion in Boeing orders, as airline’s co-founder bid to avoid crash blame
“We have not changed our design philosophy,” Muilenburg told CNBC in an interview on Thursday. “These are aeroplanes that handled well in the control of the pilots. They’re designed the same way our previous 737s are.”
But unions representing American and Southwest airlines pilots say they were unaware of the MCAS system before the Lion Air crash. American pilots who flew the 737 Next Generation aircraft, the previous model, were able to qualify to fly the Max by taking a 56-minute computer lesson to understand the differences between flying the two planes, said Dennis Tajer, a spokesman for the Allied Pilots Association and a pilot. The MCAS system was not covered in that lesson.
For the MCAS system to work correctly depends on accurate measurements from outside sensors that report the angle at which the aircraft is flying – whether it is cutting straight through the air or sliding at an angle. It’s called the angle of attack.
Those sensors on the Lion Air jetliner had malfunctioned for the two days before the crash.
Maintenance crews thought they had fixed the problem but never got to the bottom of it. The serious problem should have been reported by Lion Air to civil aviation authorities around the world, but wasn’t.
The sensors were incorrectly telling the flight control computer the aircraft had a high angle of attack and was at risk of stalling. Seconds after the wheels left the ground, the pilot’s yoke began to shake, signalling that the plane was flying too slowly and the nose was too high. In error, the software automatically adjusted the stabiliser trim to point the nose down.
The stabiliser trim system is also controlled manually by large black wheels in the cockpit that the pilots can twirl around to adjust trim. An aircraft engineer said the pilots should have seen the wheels automatically spinning for as much as 10 seconds, which would have been a giveaway that the plane had entered a runaway trim condition.
If the Lion Air pilots had figured out that the stabiliser trim was causing the plane to dive, they could have disabled the automated system with a switch on the centre console, manually moving the large trim wheels or pushing a button on the trim wheels.
Crews on the two previous flights on the same aircraft encountered the trim problem and shut down the system, avoiding any further risk, according to a preliminary accident report issued by Indonesian civil aviation authorities.
John Cox, a veteran pilot and air safety expert, said the captain of the earlier flight dealt with the malfunction by turning over controls to the first officer early, so he could diagnose the problem. But on October 29, the captain continued flying the plane well after take-off.
“They are getting a cascade of fault messages,” Cox said. “The captain is hand-flying the aircraft and he is very close to task saturation, trying to figure out how these messages are connected and what is broken on the aeroplane.”
Weber said the accident is part of a culture problem, particularly among fast-growing Asian airlines, in which jetliners are operated as a computer rather than a machine controlled by hand.
“They are reluctant to fly the plane,” he said. That cockpit culture was cited by many aviation experts in the 2013 crash of an Asiana jetliner in San Francisco that pointed out the weak manual flight qualifications of the crew.