News of two recent plane crashes has raised fears about whether planes made by U.S. aircraft manufacturers Boeing are safe to fly. The first incident occurred on October 29, 2018, when Lion Air Flight 610 departed from Jakarta, Indonesia at 6:20 a.m. local time. Twelve minutes later, the plane went down into the nearby Java Sea, killing all 189 of the passengers and crew on board.
The second incident occurred in Ethiopia. On March 10, 2019, Ethiopian Airlines Flight 302 took off from Addis Ababa, Ethiopia, at 8:38 a.m. local time heading for Nairobi, Kenya. Six minutes after takeoff, the plane crashed near to the town of Bishoftu, Ethiopia and all 157 of the passengers and crew were killed.
These two tragedies have sent shocks through the aviation industry as they both involved the same model of plane, the Boeing 737 MAX 8. Preliminary data from investigations of the crashes indicate that both may have been caused by the same issue with the planes.
In the days immediately following the second crash, aviation regulators in Europe and China opted to ground all MAX 8 flights until the safety of the planes could be assessed. At first, U.S. regulators and airlines affirmed the safety of the MAX 8 and allowed the planes to continue to fly. But after considerable public pressure, the U.S. also opted to ground the planes beginning on March 13.
What went wrong with the Boeing 737 Max 8 planes, and are other Boeing planes safe to fly in? Here’s everything you need to know.
About the Boeing 737 Max 8
The plane model involved in both crashes was the Boeing 737 MAX 8. This is the fourth generation of 737 planes and is an update to the previous 737 Next Generation (NG) series.
The 737 series is one of Boeing’s great successes, and there are thousands of these planes in the skies. The 737 Next Generation series, debuted in 1997, remains one of the safest models of planes flying today with an excellent safety record of just 0.08 fatal crashes per million departures. For reference, the average safety record across all types of Boeing planes is 0.66 fatal crashes per million departures.
You may well have flown in a 737-800, part of the NG series. For example, Ryanair has a whole fleet of 737-800s and the airline has never had a single fatality.
So what happened in the crashes? The issues that have been making the news are with the 737 MAX series specifically. Problems seem to have arisen because the MAX series was rushed into production so Boeing could stay competitive with its European rival, Airbus.
Why the MAX series was rushed
In the early 2000s, Boeing had comfortable market dominance in the supply of commercial airplanes. But in 2011, Airbus made inroads into the market when it made a deal to supply American Airlines with its A320 planes that had newer, more fuel-efficient engines. Fuel efficiency was a particular issue for airlines at the time due to a spike in the price of oil in 2008, which made fuel costs a pressing concern.
Boeing was forced to scramble to keep up with Airbus. It too required newer, more fuel-efficient engines on its planes, and it needed them quickly.
How the MAX differed from previous models
In order to make the 737 MAX more fuel efficient, Boeing added larger engines. The planes already sat low to the ground, so the larger engines were difficult to fit into the space available, and were thus moved toward the front of the plane and higher up. This required the nose landing gear to be extended by eight inches. By the end of the tweaking process, the planes were 14 percent more fuel efficient than previous models.
But planes are delicately balanced machines, and these seemingly small changes affected the way that the MAXs handled. The new location of the engine caused the planes to pitch upwards, with their noses pointing too high. This was a problem because if a plane pitches upward too much, the air around the wings creates eddies, leading to a stall.
To compensate for these changes in handling, Boeing added a system called the Maneuvering Characteristics Augmentation System (MCAS) which was supposed to prevent stalling by automatically bringing the nose down if the plane was pitching up.
The same plane?
Part of the controversy around the MAX series was the way that it was classified by Boeing. Boeing introduced the MAX planes as an update to the 737 Next Generation series, essentially saying that they were the same plane. Therefore, Boeing claimed pilots who had flown a 737-NG didn’t need additional training on the 737-MAX.
The Federal Aviation Administration (FAA), the U.S. government body that oversees aviation safety, agreed with Boeing’s assessment. They decided that no additional information or training for pilots was required, as established emergency procedures would cover any problems that could arise with the new models.
Getting the FAA to agree to no additional training was an essential internal requirement at Boeing, according to insiders who spoke to the New York Times. The company felt under time pressure to deliver the new model and didn’t want delays in rolling the planes out.
The problem with MCAS
The MCAS system was supposed to improve plane safety by preventing stalling but it appears to have actually been the cause of the two crashes.
The system works by adjusting the angle of the horizontal stabilizer trim, which refers to the two fins on the tail of the plane which sit parallel to the ground. When the system senses that the angle the plane is sitting at (called the “angle of attack”) is too steep, MCAS activates and adjusts the horizontal stabilizer trim to point the nose of the plane downwards.
The system is unusual in that it turns on automatically and runs in the background, without any pilot input. This goes against Boeing’s tradition of giving pilots complete control over the plane. The system was designed to only activate in extreme conditions, so it seems that Boeing didn’t consider a case where the system could be activated inadvertently and the pilots would be unaware of what was happening.
Investigators examining the wreckage of the Ethiopian jet found the trim set in an unusual position similar to that observed in the Lion Air plane, according to Reuters. This suggests that MCAS may be responsible for both crashes by kicking in unnecessarily and forcing the plane’s nose downwards even when the plane was not actually stalling.
Safety analysis based on incorrect information
Normally, systems on board planes have multiple safety checks and have to comply with stringent safety rules. Worryingly, these rules appear to have been side-stepped in the rush to get the 737 MAX planes to market.
When Boeing submitted their safety analysis of the new plane to the FAA, it stated that the MCAS system could only move the tail by 0.6 degrees out of a maximum of 5 degrees. However, in reality, this limit was later revised so MCAS could actually adjust the tail by up to 2.5 degrees. The FAA was unaware of this higher limit and their safety assessment was based on the lower limit, according to the Seattle Times.
Worse still, MCAS could be triggered multiple times, and each time it could adjust the tail by a new increment of 2.5 degrees — effectively giving the system authority to repeatedly change the angle of the plane.
With the FAA unaware of these issues, an incorrect activation of MCAS was classified as a “major failure,” which is defined as a failure that could cause distress to passengers but not serious injury or death. In an extreme situation, if a plane was going down, then activation of MCAS was classified as a “hazardous failure,” meaning it could cause injuries or death to a small number of people.
The failure of MCAS was not classified as a “catastrophic failure,” which is what actually occurred — when the entire plane goes down and multiple people onboard are killed.
The responsibility of the pilots
After the Lion Air crash, Boeing placed blame onto the flight’s pilots. The company said the pilots should have followed emergency procedures by going through a standard checklist to manage “stabilizer runaway,” and if they had done so then they could have regained control of the plane. Indeed, pilots of a previous Lion Air flight which experienced similar problems followed the checklist, hit the stabilizer cutoff switches, and were able to address the issue and land safely.
Data from the flight recorder of the crashed Lion Air flight showed the pilots did not follow the checklist and they entered a tug of war with the MCAS system, trying to pull the nose of the plane up while the system continually pushed it down. They may not have been aware that the MCAS system was active and was affecting the trim, thinking that the problem lay in their airspeed or altitude.
In the minutes before the plane went down, the pilot and first officer were checking the reference handbook in an attempt to find the checklist, according to Reuters.
However, aviation experts who spoke to the Seattle Times say that the crash did not appear to be a standard case of stabilizer runaway, as that is defined as a continuous uncommanded movement of the tail. What happened, in this case, wasn’t a continuous movement of the tail but rather a repeated one, with the pilots countering the movement multiple times.
Before the introduction of MCAS, pilots could pull back on the control column to interrupt stabilizer movements. But on new planes when MCAS was active, this function was disabled. The Lion Air pilots were unlikely to know about this change and attempted to pull the nose back up in a variety of ways, including pulling on the control column, but with MCAS active this was ineffective.
Why the crashes happened
Given that MCAS was only supposed to turn on in extreme conditions — when a plane is about to stall, for example — how was it activated during a flight when the plane had a normal angle of attack?
According to an analysis of the Lion Air black box, the problem appears to have been caused by a single faulty sensor. A blade on the outside of the fuselage measures the angle between the airflow and the wing, which is used to find the plane’s angle of attack. This is what tells the plane’s systems whether the nose is pointed up or down.
There are two such sensors on the 737 MAX plane: one on the pilot’s side and one on the first officer’s side. However, the MCAS system was designed to only accept input from one sensor at a time, depending on which of the redundant flight control computers was active.
Preliminary investigations into the Lion Air crash found that the sensor on the pilot’s side was generating incorrect data, and this was the reason that the plane’s systems behaved as if the plane’s nose was pointing up when it was not.
Had MCAS been designed to accept input from both sensors, it is likely that the error in the pilot’s side sensor data would have been spotted. But Boeing opted for simplicity, with the assumption that any malfunctioning trim would be corrected by following the same emergency procedures used for previous 737 models.
Poor training contributed to the crashes
As Boeing considered the 737 MAX to be similar enough to the previous generation model, minimal training was given to pilots on how to fly the new model. Many pilots and their unions complained about this, requesting that they be given training on the new planes.
After the Lion Air crash, the calls from pilots for better training intensified. In November 2018, a pilot logged a complaint in the Aviation Safety Reporting System run by NASA, calling it “unconscionable” that Boeing and the FAA would allow pilots to fly the planes without adequate training or information about the new systems, according to an investigation by the Dallas Morning News. Another captain referenced in the same investigation described the flight manual they had been given as “inadequate and almost criminally insufficient.”
No simulator training
The gold standard of pilot training is time spent in a simulator: a multimillion-dollar facsimile of a cockpit which mimics the flight experience on the ground. Pilots typically spend hours in such simulators, learning all the plane’s systems and practicing what to do in the event of a problem. These full-motion simulators not only simulate the controls of the plane but also the sensory feedback that a pilot would receive in the air.
The type of simulators used for pilot training is called Level D, the highest level of a full-flight simulator as qualified by the FAA. To be certified as Level D, a simulator must have a motion platform which can move in six degrees of freedom and it must have realistic sounds, an outside-world view of at least 150 degrees, and special effects for motion and visuals.
Because Level D simulators are enormously complex and costly to construct, they are generally created in-house by airplane manufacturers like Boeing and Airbus and made available to airlines for pilot training.
In the case of the 737 MAX, the plane was so rushed that there was no time to for Boeing create a simulator. “They were building the airplane and still designing it,” Greg Bowen, the training and standards chair at the Southwest pilots association, told the New York Times. “The data to build a simulator didn’t become available until about when the plane was ready to fly.”
After the Lion Air crash, pilot unions pushed for simulator training for the MAX planes, regardless of whether the FAA said it was a requirement or not. Instead, Boeing rolled out a software fix and said that extra training was not necessary.
“When you find out that there are systems on it that are wildly different that affect the performance of the aircraft, having a simulator is part of a safety culture,” Dennis Tajer, a spokesman for the American Airlines pilot union and a 737 pilot, said to the New York Times. “It can be the difference between a safe, recoverable flight and one that makes the newspapers.”
Trained on an iPad
As simulator training was unavailable, airlines had to come up with their own methods to disseminate information about the new models. Some training materials were put together by pilots who had never flown the new plane or used a simulator of it, but had trained on a mock cockpit instead. From this experience, a 13-page handbook was drawn up about the changes to the MAX model from the Next Generation model.
Most pilots learned about the new planes on a two-hour iPad training course offering by Boeing. However, none of the training materials mentioned the MCAS system that is now the focus of scrutiny.
Safety features an “optional extra”
In a final horrifying twist to the tale, it was recently reported that there were two safety features which may have been able to prevent the crashes. But they were not installed on the planes because Boeing sold these safety features as optional extras, and low-cost airlines like Lion Air opted not to pay for them.
One of the optional features was an angle of attack indicator: a display inside the cockpit which shows the readings from the two angle of attack sensors. The other was a disagree light, which is a light that indicates if the two sensors are not in agreement. Had either of these features been in place on the planes which crashed then the pilots would likely have been aware that the angle of attack sensor was generating incorrect data, cluing them in that something was wrong.
These features would have cost very little to install, but they were sold as an option alongside aesthetic and comfort upgrades like premium seating, extra bathrooms, or better cabin lighting. The decision by Boeing to monetize safety features in this way has drawn considerable criticism from both within the industry and from the general public.
Boeing has since announced that the disagree light will be installed as standard on new 737 MAX planes, without extra charges. However, the company continues to charge extra for other safety features, such as a backup fire extinguisher for the cargo hold which is required by Japanese regulators but not the FAA.
Where do we go from here?
Since 737 MAX planes were grounded around the world, Boeing has been scrambling to make amends. The company has created a software fix for the planes and the FAA has “tentatively approved sweeping software and pilot-training changes,” according to the Wall Street Journal.
The software fix would give pilots more control over the automated MCAS system, making it so that the system will not override cockpit commands and will only be activated once in the event of an issue. The system will also be prevented from mistakenly activating due to faulty readings from one sensor.
Even after the FAA’s tentative approval, however, the update still needs to be put through simulations and flight tests. The software fix could be rolled out within a few weeks, but this will be a long wait for airlines with grounded 737 MAXs who are having to cancel flights.
Rebuilding the public’s trust in Boeing will be an even longer process.
