It has been a long and difficult week for those of us in the aviation industry. There has been a lot of speculation after two tragedies within 5 months with Boeing 737 MAX8 aircraft in which 346 people have been killed. Our hearts go out to all of the victims and their families that have experienced the unexpected and unspeakable.
It will take quite some time before we know the answers as to why both of these aircraft went down, and what happened to cause each accident. Through the years, we’ve seen initial speculation regarding the causes of crashes turn out to be false, and in some cases, the mysteries may never be solved.
One of the reasons that the cause of crashes are so difficult to determine is that the aircraft manufacturers and airlines study known risks and work together to prevent them with redundant systems that address all known issues. This has made modern air travel statistically much safer than driving to and from the airport. This is another reason that when a crash does occur, the industry seeks to find the cause as soon as possible so it can take appropriate actions to ensure that it never happens again. Unfortunately, those investigations are painstaking, exacting, and require considerable time given the myriad of possibilities that could occur in an aircraft crash.
Typically, something unusual or a confluence of multiple events that normally would not occur have been associated with aircraft accidents. With the routine already taken care of in basic designs and regulatory requirements, the forensic investigation into an accident is typically a difficult process. Fortunately, the latest flight data recorders measure an order of magnitude more parameters than the earlier generation, and the cockpit voice recorders are now digital, rather than tape, with a higher propensity to survive a crash without extensive damage. They will tell us a lot about the crash once analyzed.
But at this point in time, before the flight data recorder and cockpit voice recorder are downloaded and interpreted, no one knows with any certainty what happened to Ethiopian flight 302, except that it met an untimely demise shortly after takeoff. Beware of any premature conclusions or those who indicate that they think they know the answers why the accident happened, as they don’t. Theories need to be backed up by facts before corrective actions can be taken.
We do know that two crashes of a new model within five months, both of which occurred during climb-out after take-off, led international regulators, in an abundance of caution, to ground the aircraft until more definitive answers can be found.
Basics about the 737 MAX
The 737 MAX is the latest, a fourth major version, of the Boeing 737, which entered service in 1967. Since that time, the capacity of the aircraft has virtually doubled, the old cigar shaped turbojets have been replaced by modern, high-bypass-ratio engines that have larger diameters, and virtually every system, including the avionics that the pilots use to fly the airplane, which has transitioned from “steam gauge” to “glass cockpit” technology. In many respects, the 737MAX is ultra modern, but in others, a blend of older and newer technologies.
Differences in the MAX from older versions
More than 10,000 Boeing 737s have been produced, making it the world’s best selling airliner of all time. But the new version, the 737MAX8 has a number of important differences from prior models. Among those differences is the mounting of the larger and heavier LEAP-1B engine on the wing, replacing the CFM-56-7 engines on the 737NG models that preceded it.
Mounting the engines higher and further forward, to provide adequate ground clearance, moves the centerline of thrust from the center of gravity of the aircraft, resulting in a tendency for the aircraft to move into a slight nose-up attitude with the application of thrust. This has a destabilizing effect on the stability of the airplane, especially in high-banked tight-turn maneuvers at low speed, where a higher angle of attack could bring the aircraft close to an aerodynamic stall that would result in a loss of lift.
To combat that issue, Boeing designed a new program, the Maneuvering Control Augmentation System or MCAS. Today’s airplanes are essentially controlled by computers, using “fly-by-wire” technology to control actuators rather than the old fashioned analog control cables in initial models of the aircraft in the 1960s. The MCAS is essentially software written into the aircraft’s control system to ensure that the nose of the aircraft is at a proper angle for the speed and trajectory of the aircraft by automatically pushing the nose of the aircraft downward if the planes angle-of-attack created the risk of an aerodynamic stall.
How MCAS works
This system differs from the earlier 737NG models, which enabled the stabilizer controls to help balance the plane around its center of gravity with trim switches on top of the control yoke. In the 737MAX, the MCAS system was written to utilize stabilizer trim in a different way, ensuring that the airplane would not stall under certain conditions, and was necessary for FAA certification of the aircraft. Technical details about MCAS are available here.
While under normal flight, the MCAS system should behave exactly as the predecessor aircraft, only activating in unusual situations. As a result, Boeing and the FAA determined that this difference between the MAX and NG models were not significant enough to require additional training, and the MCAS, and how it operates, was initially not disclosed to pilots. While the system was clearly outlined in maintenance manuals and in different briefings to airlines, including the MCAS in the flight manual or requiring different training for pilots did not occur.
A Regulatory Issue?
One country’s regulators, Brazil, disagreed with the FAA and required MCAS to be flagged in transition training for its pilots, but EASA in Europe and several other regulatory agencies went along with the FAA’s determination.
One of the theories in the Lion Air 610 crash is that MCAS may have been receiving data from a faulty angle of attack sensor on the aircraft. While the aircraft has two angle of attack sensors on board, the MCAS choose the right or left sensor based on which of the two flight control computers, the captain’s or first officer’s, happened to be active.
That decision leaves the 737MAX vulnerable to a single malfunctioning sensor or malfunction in transferring data from it to the flight control computers. This appears to have occurred on Lion Air 610 on the day of the crash.
Other aircraft, such as the competing Airbus A320, utilize an odd number of multiple sensor inputs, with the computer comparing inputs and ignoring an input that disagrees from the majority as potentially faulty. This could be a potential area for future regulatory action, as multiple redundancies have become a standard mechanism for ensuring safety today.
Shutting off MCAS
There is a procedure to shut down the MCAS system if it is acting improperly. That process entails switching off stabilizer trim via two switches on the center console and opening the handles of the manual trim wheels that control the trim system and adjusting the trim by rotating them forward or backward as appropriate. Unfortunately, Boeing did not initially train pilots in this process, but after the Lion Air crash last November, a review of emergency procedures was distributed to airlines and pilots.
Apparently, MCAS also over-rides the electric trim switches on the control yoke of an aircraft, as it appears the Lion Air pilots attempted to utilize electric trim to counteract MCAS commands. From personal experience, having flown an aircraft with a faulty electric trim switch, I know what it is like to fight the airplane for pitch control. In this instance, I was able to disable the circuit breaker for the electric trim and regain control after using most of my strength to, in that case, push down the nose of the aircraft, which was being pushed upward. Malfunctions can happen, and a broken wire, a short, or another flaw can impact systems on any aircraft.
The Ethiopian Accident
After November’s accident, every MAX pilot should have become well aware of the potential problem, and know how to shut down the MCAS system should a malfunction occur. One would expect a pilot to recognize a similar malfunction quickly, and take corrective action.
But that leaves the accident a bit mysterious. Virtually all 737 pilots would know about the prior crash and potential issues with MCAS, and be aware that the system needs to be shut off in accordance with Boeing emergency procedures.
A key question for regulators will be to determine whether there is a similarity between the Lion Air and Ethiopian crashes, or two totally different causes. We don’t yet know the answer, and it is too early to speculate. Until more information becomes available from the investigation team, we simply don’t know what happened. That, to those in the aviation community, is frustrating in itself, as everyone would like to understand the factors contributing to the accidents, and how they can be prevented in the future.
The MAX is the only airliner with a system that can put the aircraft into an undesired angle of banking and against the pilot will. As for an example, flight AF447 had the wrong information about the aircraft speed because of the faulty pitot tube. But not systems did place the aircraft in high angle of attack causing it to stall. It is the pilot in the left seat who is responsible for keeping the aircraft in high angle of attack no computer or systems did that.
In the case of flight 601 from Lion Air, the MCAS did put to aircraft into a dive because of wrong data coming from the AOI, and the MCAS was acting against the will of the pilots. One of the problems with the MAX is that there is still cable and pulley for the primary flight control system, while spoilers are fly by wire and the MCAS was added on top. In the case of flight 601, it is evident that they didn’t mix very well. If Boeing would have opted for a full fly by wire controls, flight 601 would probably have not crashed and the occupants would be alive.