The recent 737 Max 8 crashes have had a whirlwind of articles and information presented trying to figure out what happened. I’m adding to this group of speculators, but I believe we bring a unique perspective and background to the tragedy [I co-authored this article with Vaughn Cordle, CFA, also, a highly experienced airline pilot]. We wrote the piece with the sole intent of objectively looking at contributing factors in each of the crashes. We go into an in-depth review of released accident reports and data to determine our conclusion. In our opinion “pilot error” was the largest contributing factor to both these accidents, not the sole factor (Boeing is also culpable) but the most consequential. I hope you get out of this what we did, some valuable lessons learned.
An upfront admission…it is a long but worthwhile read…
You can read on my LinkedIn page or below:
The Boeing 737 MAX 8 Crashes: The Case for Pilot Error
A Detailed Review of the Ethiopian And Indonesian Preliminary Accident Reports
April 9, 2019
In our previous article, “Boeing’s Grounding: Catastrophic Crashes, and Questions about Boeing’s Liability and 737 MAX Aircraft Viability,” we wrote about the many issues surrounding the recent 737 MAX 8 crashes and connected disparate elements into a preliminary review. One of our early observations was that “pilot error” was the largest contributing factor in both accidents—not the only one but the most consequential factor. The second largest contributing factor for the Lion Air accident was Boeing’s failure to disseminate critical MCAS characteristics to both the FAA (especially during the safety analysis required for certification) and all regulatory bodies and MAX series aircraft operators worldwide.
Since the release of the Ethiopian Aircraft Accident Investigation Preliminary Report, numerous articles and analyses have surfaced that appear to put the blame on the manufacturer. We do not dispute Boeing’s possible culpability but feel it is important that the major contributing factors are put into proper context and weighed appropriately.
Culpability is the central issue of the manufacturer-versus-pilot-error controversy and our new analysis of the crashes and the accident reports point to pilot error being the most important contributing factor.
Before we begin, we will present our analysis of Ethiopian Airlines (ET) Flight 302 since it is the most recent report and has produced some unfortunate controversy. We will follow with a review of the Lion Air accident, the plethora of MCAS information and lessons learned, which, had they been known, should have prevented the Ethiopian crash.
Pilot Errors in Ethiopian Airlines Flight 302
There are two critical and fatal pilot errors that were not properly identified and discussed in the Ethiopian preliminary report’s Initial Findings and Safety Recommendations. The report falls short in terms of properly identifying or prioritizing the primary causes and their relationship to the ultimate effect—the crash. We believe that our analysis of the report’s findings and “ET302 Preliminary FDR [Flight Data Recorder] (DFDR) Data” provides strong evidence that supports our view.
We divide our analysis of why ET 302 crashed into essential and critical arguments that identify the two fatal pilot errors.
- The pilots (crew) mismanaged engine thrust and airspeed
- Excessive airspeed rendered manual trim ineffective
- The crew deviated from the emergency procedure
- Crew experience and competency a major contributing factor
- Mismanagement of engine thrust and airspeed
- Deviation from company and Boeing procedures
We realize that simplification of a complicated accident is difficult but after a careful analysis of the Ethiopian Accident Investigation Bureau report, we are confident that our original conclusion is correct. The Ethiopian accident report findings and safety recommendations lack context and insight to adequately explain why the aircraft crashed, resulting in the loss of eight crew and 149 passengers on board. We provide that context and additional insight.
Why ET Flight 302 Crashed
The Ethiopian preliminary report confirms, in the appendixes, that Boeing and the FAA issued bulletin recommendations and directives dealing with the potential MCAS problem and how to diagnose and properly handle potential faulty AOA sensor issues. Ethiopian airlines received Boeing’s Flight Crew Operations Manual Bulletin number TBC-19 dated November 6, 2018—116 days before Flight 302 crashed.
After takeoff, the AOA’s faulty inputs showed up in various [left side] flight indicators
Shortly after takeoff, there were several indications and warnings presented to the pilots, much like Lion Air Flight 43 and the fateful Lion Air Flight 610 some months earlier. In fact, according to the report, “shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while the value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°.” In addition, the reports states, “the airspeed, altitude, and flight director pitch bar values from the left side noted deviating from the corresponding right side values”—a variance that should have displayed an ALT DISAGREE alert.
The problems compound
According to the report, “At this time, the left stick shaker activated and remained active until near the end of the recording.” Also, adding to their problems, the master caution warning along with an ANTI-ICE light came on alerting them to an anti-ice system problem. Toward the end of the flight, another master caution will illuminate associated with an L ALPHA VANE light indicating an AOA vane heat failure—the AOA vanes are heated (on after engine start) and are part of the PROBE HEAT system.
Why this is important
The warnings and alert indications highlight the immediate problems the pilots experienced—but also highlights Boeing’s bulletin, issued to Ethiopian Airlines on November 6th, describing that these types of indications (i.e., problems) were the result of “erroneous AOA inputs” and their relationship to an impending runaway trim.
An erroneous AOA can cause some or all of the following indications and effects:
- Continuous or intermittent stick shaker on the affected side only
- Minimum speed bar (red and black) on the affected side only
- Increasing nose down control forces
- Inability to engage the autopilot
- Automatic disengagement of the autopilot
- IAS DISAGREE alert
- ALT DISAGREE alert
- AOA DISAGREE alert
- FEEL DIFF PRESS light
However, to have that many aircraft warnings and indicators going off is highly unusual and when presented during a critical phase of flight, like takeoff or during a climb, can create a very stressful and time-compressed situation. It is during these situations that pilots make the most mistakes and why we rely heavily on our training and following—standard operating procedures (SOPs)—emergency procedures. It should be noted the entire flight lasted only 6 minutes and 45 seconds before the plane slammed into the ground killing all aboard.
Let’s begin with four critical arguments:
1) Pilots mismanaged engine thrust and then allowed airspeed to exceed the certified aircraft speed limit (critical error #1)
After takeoff, the left and right recorded AOA values deviated and the left stick shaker activated (remained active until the end of the recording). At 400 feet above the ground (AGL), the pilots engaged the autopilot—although it subsequently disengaged 30 seconds later. Erroneous AOA signals can cause automatic disengagement of the autopilot.
At 1000 feet AGL, the pilots retracted the flaps and selected “Level-Change” mode, which controls the aircraft’s pitch and also, via the autothrottles, the engine thrust (power and speed). In this case, the thrust was set to 94% (N1 Reference), a normal high-power setting for climb-out. At the same time, and a requirement for Level-Change mode, the pilots manually put 238 knots airspeed in the airspeed window.
The first indication of a problem
Once the flaps retracted and the autopilot disengaged, faulty AOA signals to MCAS drove the stabilizer nose-down (AND), causing a loss in altitude and subsequent “DON’T SINK” alert in the cockpit—an aural ground alert for potentially hazardous flight conditions that could result in the aircraft hitting the ground. To recover, the pilots pulled back on the yoke (moves the elevators) but also initiated yoke mounted electric trim to move the stabilizer pitch to a nose-up position.
The elevator is the smaller flap surface attached to the much larger horizontal stabilizer on the tail of the aircraft. The horizontal stabilizer is automatically trimmed for this phase of flight and the pilots use the yoke control column to move the elevator to fly (in pitch along the lateral axis) the aircraft (Figure 1, 2).
Figure 1: Elevator and horizontal stabilizer
Figure 2: 737 Control yoke electric trim switches, manual trim wheel, and lateral axis pitch
While this was occurring, the auto-throttles remained at the 94% (N1 Reference) climb thrust setting. The selection of the Level-Change pitch mode caused the autothrottles (in a climb phase) to reference climb thrust or in this case 94%—thrust remained at 94% for the entire flight. What’s important is that Level-Change is a pitch mode, which means the airspeed is controlled by pitch, not by the autothrottles (they remain in a climb thrust position).
In Level-Change the flight computer generates a “flight-director” reference on the primary flight display that guides the pilots in pitch. With the autopilot disengaged (bad AOA inputs) the pilot must manually follow the guidance. If the pilots maintain the aircraft symbol (small square nose position reference) below the flight director or not superimposed on the center, then the aircraft will accelerate past the selected airspeed (Figure 3).
In this case, together with the autothrottles remaining at 94%, and the fact that MCAS was driving the aircraft symbol reference well below the flight director, the aircraft rapidly accelerated past the pilot-selected airspeed of 238 knots. In fact, the pilots most likely never followed the flight director (pitch guidance) or reduced the thrust which in turn resulted in excessive airspeeds—so excessive that the airspeed clacker alert sounded warning the pilots they had accelerated past the airspeed limit (VMO is 340 knots) for the aircraft—more on this later.
Figure 3: 737 MAX Primary Flight Display
For unexplained reasons—probably because the pilots were overwhelmed trying to deal with the runaway trim—the flight director, power setting, and excessive airspeed were ignored by the pilots. Worse, they made no attempt during the flight to slow down the aircraft. In hindsight, they should have turned off the autothrottles, manually retarded the throttles, and reduced the speed—these critical mistakes (pilot error) would ultimately doom the flight. Moreover, if the aircraft had been slowed to a safe, below flap-extend, speed, extending the flaps would have disabled MCAS auto trim and allowed the pilots to easily manually trim the horizontal stabilizer with the manual trim wheel—an MCAS disabling condition highlighted in Boeing’s bulletin.
Having covered in detail the pilot’s mismanagement of airspeed and power, we should point out that one action might still have saved the day. During climb-out with an emergency, it is standard procedure to level off at an intermediate altitude to address the problem—remember, the pilots had set 32,000 feet in the altitude window. Interrupting the climb profile by leveling off at a lower altitude allows pilots to focus on what needs to be done but, more importantly, prepare them for an immediate return to the airport.
If the pilots had requested a lower altitude after recognizing they had runaway trim and made the initial correction, the aircraft would have leveled off. What would have happened then? The autothrottles would have retarded because the aircraft was in the Level-Change mode and leveling the pitch would have kept the airspeed at 238 knots, which the pilots had set in the airspeed window. The result would have been a much a slower airspeed with significantly less aerodynamic forces on the aircraft’s tail and most likely a more effective use of the manual trim. Whether this would have changed the outcome is uncertain, but it would have controlled the aircraft’s airspeed and eliminated one problem from the pilots’ frenetic agenda.
2) Manual trim became ineffective after the pilots initiated runaway trim procedures
After the pilots recognized the runaway trim, they executed the runaway trim emergency procedure by moving the stabilizer trim switches to cutout (autopilot and electric trim off). For the next two and a half minutes (up to 40 seconds before impact), “the stabilizer position gradually moved in the AND [auto nose-down] direction from 2.3 units to 2.1 units. During this time, aft force was applied to the control columns [drives the elevators] which remained aft of neutral position [because of the heavy nose down force being felt on control column yoke],” as stated in the report. Further, “The left-side indicated that the airspeed increased from approximately 305 kt to approximately 340 kt (VMO)”—the already mentioned certified airspeed limit for the 737 aircraft. But the right side (the correct airspeed) reported an airspeed that was 20-25 knots higher. The correct (right-side) airspeed finished 40 knots (380 knots) above VMO when the final and fatal MCAS-actuated nose-down trim reached its near limit of 40 degrees.
This highlights two critical issues
First, the pilots most likely attempted to use the manual trim wheel(s) (Figure 4), which is part of the runaway stabilizer trim checklist. However, the stabilizer position only moved .02 units to 2.1 units of trim—a very small change. This is not unusual since the trim wheel only makes incremental changes compared to the faster electric trim. The point is that to make enough of a change in the stabilizer position (nose-up) required an aggressive use of the manual trim wheel.
But—and this is important—according to the report, “the stabilizer position gradually moved in the AND [nose-down] direction from 2.3 units to 2.1 units.” This movement is in the wrong direction. It appears that the first officer moved the manual trim wheel nose-down instead of nose-up, further aggravating a nose-down stabilizer position. It should be noted that the captain was the “flying pilot” and the co-pilot was the “monitoring” pilot. The monitoring pilot assists the flying pilot while he or she focuses on flying the aircraft.
Figure 4: 737 MAX Manual Trim Control Wheel
Another important point is that the nose-down stabilizer trim position of 2.1 units requires the pilots to move the stabilizer 2-3 units just to get it back to a pre-emergency climb position of 5-6 units—very difficult to do, even with less aerodynamic forces acting on the stabilizer, which occurred in the fatal Lion Flight 610—more on that later. Further, the nose-down position of the stabilizer creates large forces on the control column requiring the pilots to maintain constant aft pressure on the yoke—not easy to maintain and tiring.
This type of emergency takes both pilots acting in concert to accomplish—one flying the aircraft and pulling back on the yoke (at times required by both pilots, as the report indicates) and the other aggressively moving the manual trim wheel. Not to mention, maintaining heading and altitudes, following air traffic control directions, and to the largest contributing [pilot error] factor in this accident—the pilots mismanaged the throttles and airspeed.
This raises the question of how, or whether, Ethiopian Airlines trained its pilots for this emergency
Second, as we have already alluded to, for some reason the pilots let the aircraft accelerate to excessive/extreme speeds. According to the flight control parameter data, the right-side indicated airspeed increased to 380 knots (40 knots above VMO) prior to the last and fatal MCAS-actuated nose-down pitch. We cannot emphasize enough how unusual it is for airline pilots to reach such extreme speeds at low altitude. A mistake that Lion Air flight 43 avoided by keeping their airspeeds below 250 knots, which allowed the pilots to better manage the manual trim—because of the significantly lower aerodynamic force on the large horizontal stabilizer.
At 380 knots, the aerodynamic forces acting on the tail portion of an aircraft (stabilizers and elevators) are enormous, especially at lower altitudes where the air is denser—the aircraft was between 9000 feet and 12,000 feet pressure altitude. The captain’s indications were 20-25 knots lower than the right-side due to faulty AOA signals.
In fact, to the pilots, it would seem like the manual trim wheel was ineffective. This is verified in the exchange between the captain and the first officer (FO) after the stabilizer trim switches were moved to cutout: “At 05:41:46 [one minute and thirty seconds after stabilizer trim cutout], the Captain asked the First Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54 [eight seconds later], the First-Officer replied that it is not working.”
Two major concerns with this exchange
First, was the first officer admitting that he tried to use the electric trim when it was disabled by the stabilizer trim switch being moved to cutout. He replied that “the trim was not working” when asked by the captain “if the trim was functional.” More confusing, he followed the answer with a question, whether he could “could try it manually.” What was the first officer doing for one minute and thirty seconds if he made it seem like he hadn’t used the manual trim? Was he (erroneously) using an ineffective electric trim switch on the control yoke? This trim would have been disabled with the stabilizer trim switches (STAB TRIM CUTOUT) in the off positions.
Second, did he waste one minute and thirty seconds not correcting the stabilizer nose-down position? Why was he not aggressively completing the rest of the runaway trim checklist by grasping the manual trim wheel and correcting the stabilizer? Or did he try to use it and, for some reason, when the captain asked, he made it seem like it hadn’t? Also, while this confusion was occurring, the airspeed had increased by almost 50 knots. Instead of correcting the problem, the pilots were making it worse.
Apparently, the captain didn’t realize that the first officer moved the manual trim wheel in the wrong direction, further aggravating the nose-down position and putting even more pressure on the control column. That mistake is most likely why they stopped using the manual trim wheel and failed to finish the runaway emergency checklist. The appearance of nothing working probably drove them to turn the stabilizer trim cutout switches back on—a desperate attempt to move the stabilizer nose-up but one that would assure their fate.
These subtle mistakes were the difference between flying and losing control of the aircraft
Figure 5: Boeing 737 MAX horizontal stabilizer and MCAS
3) Pilots deviated from runaway trim emergency procedures (critical error #2)
After turning off the electric stabilizer trim, the pilots continued to battle for control of the aircraft. Approximately 3 minutes after the STAB TRIM switches were moved to cutout and only 1 minute from hitting the ground, the pilots in frustration (remember, manual trim was ineffective) decided to turn the stabilizer trim switches back on—deviating from the runaway trim emergency procedure, as previously mentioned.
This action would be their last in a series of mistakes
Once the electric stab trim was back on, they quickly initiated the electric yoke mounted trim to relieve pressure on the back stabilizer—remember, the last position of the stabilizer trim was 2.1 units or an aggravated nose-down position. This action was only somewhat successful since according to the report, “two momentary manual electric trim inputs are recorded in the ANU [nose-up] direction,” only moving the [yoke-mounted] stabilizer trim .02 units.
But, as we have highlighted already, MCAS resets five seconds after electric trim is released. So, five seconds after the pilots stopped electric trim, MCAS—still getting faulty AOA signals—initiated a nose-down trim signal to the stabilizer—grossly adding to an already nose-down stabilizer position and eventually creating such an exaggerated nose down trim position that it proved to be unrecoverable (ending up 40 degrees nose down).
Why did the pilots stop using electric trim? The yoke mounted electric trim switches interrupt MCAS and if the pilots had been informed and trained about MCAS as well as runaway trim, as Ethiopian Airlines claims, then they would have known this and aggressively used electric trim to counter the MCAS trim.
There were no more electric trim inputs with only the pilots pulling back on the yoke (elevators)—at this point due to extreme nose-down stabilizer position and excessive speeds, just pulling back on the yoke using the smaller control surface elevator was futile.
An important point, moments before the pilots turned the stabilizer trim switches back on they were still controlling the aircraft and climbing. In fact, they had been steadily climbing for over three minutes using the yoke (elevators). It would take less than 18 seconds after turning on the stab trim to lose complete control of the aircraft.
It begs the question if the pilots practiced the procedure during training at 250 knots or at a much higher speed, how did they incorporate the autothrottles into the emergency? Only Ethiopian Airlines can answer these questions.
4) Crew experience and competency was a major contributing factor
Pilots learn early that experience can make up for a lack of book knowledge and aircraft complexity. Years of empirical data obtained through countless takeoffs and landings provide a seasoned pilot with the skill that is hard to quantify. Yet, rarely is it needed. The more technologically advanced and automated aircraft become, the less flying skill is required and the more automation management is needed. The requirement to know about the inner-workings of the aircraft systems are no longer essential because the pilot is disconnected from how computers and software fly the aircraft. However, flying skill and proficiency are still crucial even though, in reality, modern aircraft are forgiving and easy to fly, making the skies safer than ever before.
What happened in these accidents and the pilots’ errors highlight the need to understand the automation and the experience required to master it. Like flying skills, the ability to manage automation is critical for safe flying. Misunderstood or, worse, mismanaged, it can result in tragic accidents. Together, flying and handling the automation is the new norm for pilot experience, especially when the automation is not working correctly and both skills are needed in concert—it is a team effort and, ideally, the team should have similar experience levels. When things go awry, it is the pilot’s experience—and standard operating procedures—that will save the day.
In an emergency, it takes one pilot to fly the aircraft and the other to monitor and manage the automation.
The first officer on ET Flight 302 had limited experience: 361 flight hours. This limited background placed additional responsibility (and workload) on the captain who was busy trying to maintain control of the aircraft. The captain depended on the first officer to manage the automation and monitor key tasks, making sure that what the captain asked for was done. Meaning, recognize the problem, go to the correct checklist and execute it, not to mention talking to air traffic control (ATC) and managing the warnings, alerts, messages, and automation—this crew was extremely busy.
When a pilot(s) gets into these high stress and time compressed situations, mistakes can happen. Some mistakes are acceptable but others can be fatal. Here are a few subtle errors that can be very telling about a pilot’s experience and competency—we are not saying the FO was incompetent (he had his hands full) but rather that with limited experience, competency became an important and relative term.
Shortly after takeoff, ATC issued a clearance to Flight level 340, but the FO put 32,000 in the altitude window—and as part of the normal crew coordination both should have verified it. They didn’t double check. It was never verified and only changed when they elected to level off early at 14,000 feet for the emergency.
Also, at the height of the problem, the FO was still answering ATC instructions and inputting heading changes, calling out AOA master caution anti-ice warnings and ignoring the overspeed warning, no doubt because he was overwhelmed. The overspeed warning is a loud aural tone to alert pilots that the aircraft has exceeded its maximum airspeed and is a non-normal checklist item requiring pilots to reduce power and slow down. In fact, by this time, both left and right overspeed warnings were sounding. It appears that the FO’s priorities were on less important issues rather than on assisting the captain with controlling the aircraft.
More importantly, as we have highlighted before but it’s worth repeating, once they recognized the runaway trim problem, the first officer appeared to have moved the manual trim in the wrong direction worsening the nose-down stabilizer position (Figure 6). It was apparent that these actions were not confirmed either, questioning the execution (or completion) of the checklist.
Lastly, as we have pointed out, the crew elected to deviate from the runaway trim checklist (most likely out of frustration, thinking the manual trim was ineffective) and returned the electric STAB TRIM CUTOUT switch to normal (back on)—in direct violation of company procedures. Even though it allowed them to try the yoke-mounted electric trim in a final desperate attempt to correct the nose-down stabilizer position, it also reset the same MCAS (ever-increasing trim reference position) nose-down trim problem. At no time after this did either pilot attempt electric trim.
What this should tell anyone examining this accident is that a lack of experience in one of the seats likely contributed to the final and fatal (pilot error) actions by the crew.
Figure 6: ET 302 Preliminary Flight Data Recorder (FDR) Data
As the report states, “According to Ethiopian Civil Aviation Authority (ECAA) records, the Captain’s most recent simulator training experience was September 30, 2018, and his most recent simulator proficiency check was October 1, 2018.” Further, it states, “…737MAX differences training on 3 July 2018.” It should be noted that there were no dates reported for the MAX series updates provided by Boeing after the Lion Air Crash.
The first officer’s “most recent simulator event was listed as a proficiency check and occurred on December 3, 2018. His line training/check (conducted in the B737 aircraft) was completed on January 31, 2019.” He had only 361 hours of flying, a very low number of flight hours for a major airline. Most U.S. major airlines must have 1000-1500 hours of jet engine time just to apply and fly for a passenger-carrying airline. Pilots normally have thousands of hours before they are hired. Again, there were no dates reported for MAX series updates provided by Boeing after the Lion Air Crash.
What is significant about these dates?
The Lion Air crash occurred on October 29th, 2018. Boeing’s Flight Crew Operations Manual Bulletin for Ethiopian Airlines was issued November 5th, 2018. On March 21st, Ethiopian Airlines tweeted (see below):
Why would the captain’s or first officer’s credentials not reflect the FAA’s Air Worthiness Directive briefing dates or other Boeing information and recommendations sent to Ethiopian Airlines? It would seem prudent to provide these dates in the report to ensure compliance, as stated above.
Yet, the most mysterious missing piece of the Ethiopian accident is the fact that this week (2 April) the Wall Street Journal reported that “according to people briefed on the probe’s preliminary findings, “the crew couldn’t get the aircraft to climb and ended up turning it [stabilizer trim switches] back on [normal position] and relying on other steps before the final nose-down plunge.” Additionally, after further examination of the parameter slide (see Figure 6) it appears they were correct. However, it was never mentioned in the report—why?
There are many questions that need answers to ensure that all contributing factors to this accident are accounted for and properly weighed.
What Ethiopian Airlines Already Knew—Lessons Learned from the Lion Air Flight 610 (LA 610) Accident
The Indonesian preliminary Aircraft Accident Investigation Report is a more thorough review of the accident and provides useful “Findings” and “Safety Actions”—critical information that can help any airline avoid an MCAS-related accident. However, this does not clear Lion Air of pilot or procedural culpability that led to the accident. Like our review of the Ethiopian report, we believe that our analysis of the report’s “Factual Information”, “Aircraft Flight and Maintenance Log” history, and “FDR [Flight Data Recorder] (DFDR) Data” provides strong evidence supporting the view that pilot error was the largest contributing factor.
Like the Ethiopian accident, we can divide our analysis of the LA 610 crash into critical arguments culminating into two fatal pilot errors. Even though the accidents of Lion Air and Ethiopian Airlines have similarities with respect to MCAS issues, they are significantly different in the circumstances leading up to and during the emergency. Because of this, the format used to support these arguments and errors will be presented differently—yet reach the same conclusion: pilot error was the largest contributing factor.
- Previous Lion Air Flight 43 did not pass on critical aircraft information
- Previous Captains or Maintenance did not ground the aircraft
- The pilots (crew) identified the wrong checklist
- The pilots misdiagnosed the runaway trim problem
- Inappropriate transfer of aircraft control during a critical phase of the emergency
Fatal Pilot Errors
- Misdiagnosed runaway trim
- Inappropriate transfer of aircraft control
Important Lessons Learned from the Previous Lion Air Flight 43 (LA 43)
It is important to note that both the captain and first officer of Flight 43 were experienced airline pilots and had almost 10,000 hours in the 737-type aircraft. However, according to reports, Lion Air pilots may not have had the recommended 737 MAX ‘differences training’ required by U.S. carriers.
Another notable point is that there was a third qualified pilot in the cockpit of Flight 43, sitting in the jump seat. These seats are normally reserved for observers when giving pilots ‘check rides’, but if empty can be used by a qualified pilot for travel. The fact that there was a jump seater on this flight would end up being a life-saving factor.
A short history of Lion Air 43 (the flight prior to the doomed Flight 610)
Shortly after takeoff, the report states, “At 400 feet, the PIC [pilot in command or Captain] noticed on the Primary Flight Display (PFD) that the IAS [Indicated Airspeed] DISAGREE warning appeared and the stick shaker activated.” The stick shaker is a physical movement of the control column, designed to alert pilots of an impending stall. In addition—and this was not in the captain’s comments—there was a “Takeoff Configuration Warning” indication, which is a warning designed to alert pilots that the aircraft is not properly configured for takeoff—a serious alert.
Reacting to the airspeed warning, the captain handed over control of the aircraft to the first officer and announced, “memory item airspeed unreliable,” driving both pilots to the “airspeed unreliable” emergency checklist. While this was happening, the first officer noticed after flap retraction that “the aircraft was automatically trimming aircraft nose down (AND),” as stated in the preliminary report. The first officer began fighting for control of the aircraft, by pulling back on the yoke with manual trim to counter the AND (auto nose-down) trim.
In fact, the report findings reveal that the first officer commented, “…the control column was too heavy to hold back,” even though this was never mentioned by the crew in any aircraft write-ups (an ominous similarity that occurred with the fatal Lion Air Flight 610). The result was that the plane immediately went from a state of climbing to losing 100-200 feet, which is significant during the initial climb-out phase of flight. Maintaining control of the aircraft quickly became the priority.
At this point, the crew engaged the autopilot, an action that was absent in the preliminary report “FINDINGS” and only identified on PK-LQP “flight control parameters” slides (refer to Figure 7: The Previous Lion Air Flight 43). The autopilot was most likely engaged to help control the aircraft, a normal procedure during an emergency which allows the pilots to focus on the problem.
Figure 7: The Previous LA 43: Examination of the Flight Control Parameters
Alone, this action appears routine for emergencies but a closer look at the flight data reveals that the autopilot was quickly disengaged—possibly because turning off the autopilot is the first step in the “airspeed unreliable” checklist. However, the significance of this action is that, as with flap retraction, it stopped the auto nose-down (AND) MCAS trim. For clarification, the MCAS system is activated only when the pilots are flying manually and the flaps are retracted, which is normal on climb-out but cannot be disengaged by only pulling back on the yoke. The crew would engage the autopilot one more time with the same results—and, again, this action disengaged the MCAS trim. The autopilot remained off for the remainder of the flight.
First, the captain’s transfer of control of the aircraft to the first officer at a very low altitude and before flap retraction is highly unusual. Transferring control in the middle of a developing emergency—during the “critical phase of flight” (initial climb out)—is considered unsafe by most U.S. airline pilots. Most are taught to (1) fly the aircraft and stabilize at a safe altitude, (2) identify the emergency, and (3) run the appropriate emergency checklist(s). Interestingly, the flight data recorder revealed that the stick shaker activated on liftoff, but the captain stated in the report that it came on at 400 feet.
Second, the crew started executing what they thought was the correct checklist based on the stick shaker and the IAS DISAGREE warning. Normally, this would be a good decision had it not been for the [MCAS-activated] auto nose-down trim and subsequent loss of altitude—but the more important issue was the first officer battling for control of the aircraft with a control column too heavy to hold back. Even though this was a complicated and challenging situation with multiple emergency warnings, pilots are trained to prioritize and control (fly) the aircraft first.
Third, (and to restate the importance of prioritizing emergencies, especially in a critical phase of flight) the “airspeed unreliable” procedure may be a memory item as stated by the captain, but, a “runaway trim” event is a higher priority requiring immediate action. It cannot be emphasized enough that when presented with multiple system and flight control problems, flying the aircraft is the priority and addressing lesser priority issues are secondary. This requires thorough training and good judgment. Good judgment comes with years of experience and great training.
Finally, the pilots committed a cardinal sin of aviating: problem-solving. If you get the desired state by moving a switch or control, then keep it there. If retracting the flaps or engaging the autopilot results in an undesired condition, then put the switches or levers back where they were (this was a fatal mistake for Flight 610). In other words, once the desired outcome is achieved, leave everything alone.
More lessons from Lion Air 43
As identified in the LA 43 report, “After three automatic nose-down trim occurrences,” the first officer was losing the battle with the aircraft, which, we learned later, resulted in the loss of control and the crash of Flight 610. For LA 43, the good news was that the jump seater recognized the more critical and serious runaway trim problem and suggested moving the “STAB TRIM CUTOUT” switches to CUTOUT. This immediately relieved the problem and begs the question of why it took a jump seater to recognize not only the priority in the cockpit but also to remember the more significant memory item checklist that saved the day. The clear implication is that not all Lion Air pilots are proficient (or properly trained) in recognizing and dealing with a runaway trim problem.
Flying the aircraft and confirming the emergency are THE critical first steps during an emergency. The failure to identify the critical problem and safely control the aircraft (and its systems) is, by definition, pilot error.
Also, the Flight Data Recorder (FDR) revealed that faulty AOA sensors were already feeding bad data to the flight control computers during takeoff: faulty AOA signals on takeoff role; stick shaker on liftoff; Takeoff Configuration Warning after gear retraction; and IAS DISAGREE alert shortly after gear retraction. Together, these presented a complicated and challenging situation for the pilots—and an event that exposed the flight control problems of the MCAS and its MAX 8 AOA sensor logic.
As a fix, following the Lion Air crash, Southwest Airlines (the largest U.S. carrier of the 737 MAX) decided to include a new AOA indicator on the pilot Primary Flight Display (PFD) to safeguard against faulty AOA sensor data (Figure 8). The new indicator provides “continuous visual feedback to the Flight Crew allowing identification of erroneous AOA sensor input that could lead to un-commanded stabilizer trim actuation,” according to an internal message provided to Southwest pilots.
Figure 8: Primary Flight Display (PFD) with AOA indicator and disagree warning
However, after examining the indicator and where it is displayed in the cockpit, we can attest that it provides little value during an emergency when the electric stabilizer trim is running away and controlling the aircraft is in question. The indicator, along with an AOA disagree warning message, was an option (at additional cost) to the airlines. Most airlines—and this includes Lion Air and Ethiopian Airlines—decided not to purchase it and for good reason.
When presented with flight control problems, as was identified by the fatal Lion Air Flight 610 crew, pilots are trained to monitor and scan the primary flight indicators which are airspeed, altitude, and pitch (and at low airspeed the Pitch Limit Indicator shown above), not an AOA indicator. It is not a primary flight instrument and is only used as an additional reference (time permitting). It’s akin to wasting time referencing the oil pressure gauge when the pilot should be focused on recovering from an upset aircraft condition.
Moreover, the rationale for incorporating the AOA indicator and disagree light for identifying “erroneous AOA sensor input that could lead to un-commanded stabilizer trim actuation,” as stated in an internal message provided to Southwest pilots, could lead the general public (and media) to believe that it’s a critical indicator for flight.
In our view, we do not believe that this indicator, if installed, would help the pilots to identify and stop a runaway stabilizer trim—most airlines currently do not have this indicator installed on any of their aircraft—and airlines have already flown the MAX aircraft for thousands of hours accident-free. The AOA indicator option offered by Boeing has been touted in the media as a questionable (cost-saving) shortfall by carriers; the truth is that it doesn’t help the pilots fly the aircraft.
Review: AOA inputs for flight guidance on the PFD and HUD
The primary flight indicators for which the Angle of Attack (AOA) sensor provides input include the Pitch Limit Indicator (PLI), which is graphically displayed on the Primary Flight Display (PFD), and the Angle of Attack Limit, which is displayed on the head-up display (Figure 9).
The PLI graphically displays the proximity of the stick shaker activation point (nearing a stall speed pitch) in relation to the aircraft’s current pitch attitude for existing flight conditions. On the HUD, the distance between the Angle of Attack Limit symbol and the flight path vector symbol is the margin available to the stick shaker.
The flight path vector symbol is similar to that on the PFD, with some minor differences. Information, derived from the inertial sources, indicates where the airplane is going. The position of the center of the flight path circle relative to the pitch scale indicates the flight path angle.
Figure 9: Head-up display (HUD), flight director guidance cue and flight path vector symbol
The guidance cue (the small circle shown on the HUD display) is associated with the flight path vector symbol. Displayed when the flight directors are turned on, it provides flight director guidance. Positioning the circular body of the flight path vector symbol around the guidance cue causes the aircraft to follow the flight director guidance.
The angle-of-attack (AOA) limit symbol is referenced to the flight path vector symbol, whereas the pitch limit indicator on the PFD is referenced to the airplane symbol.
The distance between the AOA limit symbol and the flight path vector symbol represents the margin available to the stick shaker (Figure 10). It is displayed during any of the following: angle-of-attack is within 5° of the stick shaker, whenever the stick shaker is active, or whenever the wind shear (solid) guidance cue is displayed.
Figure 10: Head-up display (HUD), AOA limit indicator
Pilots are trained to look at the airspeed and pitch references on the PFD and the AOA limit symbol on the HUD to fly the aircraft—the new AOA indicator (and warning) on the PFD is NOT a flight indicator as some appear to believe. Southwest’s 737 MAX aircraft have the HUDs installed but not all operators have elected to install the drop-down glass screen. The optional AOA indicators are not activated on the airlines Next Generation (NG) 737 fleet.
Back to LA 43: Judgment
After noticing the warning lights, running through the lesser priority checklist, and the stabilizer trim being cutout (by the jump seater), the pilots still elected to continue to their destination. As major airline pilots, we can tell you that if there are known flight control problems and emergency checklists involved, then the best decision is to “plan to land at the nearest suitable airport”—even if it does not specifically say this in the checklist. It’s called judgment. Why was it absent? It is drilled into U.S. pilots, to the point of common sense.
The pilots disregarded their flight control problems and continued the flight
At cruising altitude, the Lion Air pilots reported to air traffic control an autopilot and altitude failure. This forced them to level off at 28,000 feet because, without the autopilot (the autopilot was disabled when the stabilizer trim cutout switch was moved to CUTOUT), they could not go above 29,000 feet in RVSM (Reduced Vertical Separation Minimum) airspace (another unusual pilot decision). RVSM reduces the vertical separation required between aircraft to allow more aircraft to travel in close proximity, but it requires equipment such as a functional autopilot. The pilots maintained this cruising altitude and proceeded to their destination disregarding the multiple emergencies that had occurred during the flight—essentially, they continued with a crippled aircraft.
More than a few mistakes were made by the Lion Air pilots
Good judgment suggests that the pilots should have landed at the nearest suitable airfield. Most emergencies in complex aircraft tend to have several related failures along with the primary issue. In other words, there are compounding problems, as was the case in LA 43. For U.S.-carrier trained pilots, this could be considered gross negligence.
So, why did the Lion Air pilots act differently than U.S. trained pilots? Why was this aircraft not grounded by the crew or maintenance? Why didn’t the captain write-up the runaway trim, excessive control forces, and the fact that the stabilizer trim cutout switches were moved to cut-out, which solved the problem? We will address these questions shortly.
Fatal flight: Lion Air 610
Like LA 43, the pilots of LA 610 experienced an aggressive nose down trim and a loss of several hundred feet. This occurred on climb-out and immediately after the flaps were retracted. The preliminary report states, “After the flaps retracted, the FDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim.”
As with the previous flight, during takeoff rotation, the left control column stick shaker activated and continued for the entire flight. Also, the same IAS DISAGREE warning appeared on the captain’s Primary Flight Display (PFD). We have already pointed out that a stick shaker on takeoff, even though it can be associated with an IAS DISAGREE warning, is troubling and should have led to the plane returning to the departure airport.
However, in defense of the pilots’ initial reaction to the problem, the combination of the IAS DISAGREE warning and stick shaker likely took them to the lesser priority checklist, just as it did with the pilots of LA 43. Had they also known about the MCAS system and that a faulty AOA, together with unreliable airspeed warnings, could drive both a stick shaker activation and a severe nose down trim, an early diagnosis of the real problem might have led to a different outcome. In other words, if the pilots had known about MCAS and its (anti-stall) purpose, as well as the effect of the faulty AOA signals, perhaps they would have been better prepared to handle a runaway stabilizer trim.
One further point concerning pilot judgment: according to the preliminary report, the pilots responded to nine heading changes by Air Traffic Control (ATC), four altitude requests, and one heading change initiated by the pilots for weather—all of which may have further distracted them. Again, it is not unusual for ATC or pilots trying to find an area (“some holding point”) to work declared “flight control problems” or to position them back for an immediate landing—but, instead of taking the initiative, declaring an emergency and being directive (in the U.S. ATC is very flexible when an aircraft declares an emergency, letting the pilots maneuver as needed), they continued to follow ATC directions while trying to maintain control of the aircraft.
The critical life-saving action that would have saved the passengers and crew
Running a lesser priority checklist and misdiagnosing the problem is serious enough, but the crew of the fatal crash did something that was highly unusual, which, if not done, might have saved their lives and the lives of everyone else on the aircraft.
After the flaps had retracted, the pilots put the flaps back down, guess what happened? The nose down trim stopped, as stated in the preliminary report: “After the flaps retracted, the FDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim. The flaps extended to 5 and the automatic AND trim stopped” (refer to Figure 11: The Fatal Lion Air Flight 610).
Figure 11: Lion Air Flight 610: Examination of the Flight Control Parameters
If this solved the problem, then why did the plane crash seven minutes later?
The pilots, once again, committed a cardinal sin of aviating: problem-solving. If you get an undesired state by moving a switch or control, in this case retracting the flaps, and it solves the problem, then leave it where it is. Why didn’t they extend the flaps to their original position, which would have returned the aircraft to the desired state by stopping the runaway trim? With the benefit of hindsight, the pilots should have slowed the aircraft and put the flaps back down, left them down and proceeded back to the airport for a (declared) emergency landing. Instead, they left the flaps up for the entire flight, battling the aircraft all the way to impact.
Sadly, it didn’t stop there
Based on numerous reports—although not identified in the Indonesian preliminary report—the captain, at the height of the nose-down trim problem, nearly a minute before the crash, handed over the flight controls to the first officer. To be fair, this alone is not unusual. In fact, it is standard practice for U.S. carriers during emergency situations. What is different (as with Flight 43) is that handing over the flight controls during a critical phase of flight, while fighting a severe flight control problem, especially one that had most likely developed into severe control column (yoke) pressure, is extremely poor judgment.
The mistake of transferring control
We believe that a typical U.S. trained pilot would not transfer control of the aircraft to another pilot if there was a serious flight control problem. The non-flying pilot would have no feel of the flight control (excessive at that time) or what the flying pilot might have been experiencing to get out of the dire situation. Even the flight data recorder shows, “the final control column inputs from the first officer were weaker than the ones made earlier by the captain.”
To make the point clear: it would be like flying upside down in an aircraft at low altitude, with little altitude to recover, and the other pilot blindfolded (remember, he was most likely head down, frantically trying to find the right checklist), handed the flight controls and told to recover. We believe that no experienced or properly trained pilot would have transferred control of the yoke to the non-flying pilot under these critical circumstances.
The previous four
The Indonesian preliminary report goes over the maintenance write-ups of the previous four flights of the fatal aircraft. Every one of these flights experienced similar problems that were documented in the maintenance flight log.
Here is a synopsis of the flight maintenance log write-ups
“The Aircraft Flight Maintenance Log (AFML) recorded that since 26 October 2018 until the occurrence date (29 October) several problems occurred related to airspeed and altitude flag appeared on Captain (left) Primary Flight Display (PFD) three times, SPEED TRIM FAIL light illumination and MACH TRIM FAIL light illumination two times and IAS (Indicated Airspeed) and ALT (Altitude) Disagree shown on the LA 610 Denpasar to Jakarta the day before the accident flight.”
Further, the captain on the previous LA 43 wrote up the problem, even mentioning the “STS [speed trim system] running in the wrong direction…” However, he didn’t mention the use of the STAB TRIM CUTOUT switches that solved the problem. Ironically, maintenance changed the AOA sensor, not because of multiple aircraft write-ups but because they couldn’t repeat the errors during maintenance checks and considered replacing the AOA prudent. A good decision.
Important Review: One major MCAS shortcoming is that Boeing designed the system to receive input from only one of the AOA sensors during each flight. The left and right sensors alternate between flights, sending AOA data to the Flight Control Computers (FCC) and the MCAS. Instead of designing a redundant system where the aircraft would use another AOA sensor in case of faulty data or failure, Boeing allowed only one sensor to send data.
The critical point is that after four previous flights had experienced similar problems that were written up and the fact that an immediate action procedure of runaway stab trim was used to solve the flight control problem, the captain failed to write-up the use of the stab trim switches. In fact, why were other significant problems with the aircraft not fixed or the aircraft grounded? It is one thing for maintenance to get a non-repeat test of the system once, but four times? Moreover, why didn’t successive captains, who are the last line of defense in ensuring an aircraft is safe to fly, address these critical problems with maintenance and ground the aircraft? Though not deliberate, such omissions would be considered negligent by U.S. airlines.
One final question and thought about Ethiopian Airlines Flight 302
After reviewing the Indonesian report, it begs the question: If Ethiopian Airlines had (1) all the pertinent information from the Lion Air accident report as well as (2) Boeing’s recommendations and MCAS information, then how could their pilots have crashed under similar conditions? How does one account for this—it’s a question that only Ethiopian Airlines can answer.
Examining both accidents separately provides valuable insights—it’s easy to understand how these unrelated airlines and crew may have responded in similar ways—but the overall conclusion in our previous article, “Boeing’s Grounding: Catastrophic Crashes, and Questions About Boeing’s Liability And 737 MAX Aircraft Viability,” still stands—the major contributing factor to these accidents was pilot error.
After a more comprehensive analysis of each of the two accidents, especially Lion Air Flight 610, we are persuaded more than ever that the case for pilot error—as well as inadequate training—are the dominant contributing factors in both accidents, not the only ones but the most serious factors.
The LA 610 accident is somewhat excusable since the pilots were not privy to MCAS and its challenges. Even so, there were surprising pilot practices and judgment shortfalls as well as concerns with appropriate MAX training. The Ethiopian accident, however, is more confounding since it was verified by the airline that the pilots were trained in accordance with Boeing (and FAA) recommendations. Perhaps the company’s training verification should be scrutinized.
As we have highlighted, the ET 302 pilots did follow the runaway trim procedure, at least initially. However, questions remain as to why the pilots mismanaged the airspeed and deviated from company and Boeing procedures. These actions led to an unrecoverable dive resulting in the loss of crew and passengers. We believe that the final accident report will (or should) reflect this finding.
We need to know why these accidents occurred
Thousands of planes with hundreds of thousands of passengers fly each day. Every accident, tragic as it is, is a learning moment for pilots and the airlines that train them. You can be sure that every airline pilot has now looked at the manuals for runaway trim to make sure they know the procedures as well as they can. If we seem hard on pilots, we are! The profession is not for the faint of heart or thin of skin. In those rare instances when things go wrong, the lives of hundreds of people depend on the pilot’s quick thinking, knowledge, experience, and skill—in a word, expertise.
Equally important, pilots depend on the aircraft manufacturer’s design of the flight control systems and automatic features that actuate when required. These systems and their designs are critical for safe flight. This is why Boeing must be held accountable for any [safety analysis] 737 MAX certification shortcuts that may have occurred. We know that Boeing did not test the MAX to gauge how pilots would react in the event that a malfunctioning sensor triggered the automated system—according to acting FAA Administrator Daniel Elwell when he testified in front of a Senate panel recently. The flying public and airline crews need to know why the MCAS was not more fully tested during the safety analysis required for certification. Only Boeing and the FAA can address this issue.
Piloting is a complex profession with strict rules, standard operating procedures, and training. Pilots have sole responsibility for their passengers and crew, which is why they spend so much time training for the unexpected. Problems need to be identified and corrected in seconds, sometimes in fractions of a second. When pilots most need it, time is never plentiful.
Safety is every pilot’s priority—everything else is secondary.
The latest Update on the Boeing Fix
In a recently released “737 MAX Software Update,” Boeing states that it “has developed an MCAS software update to provide additional layers of protection if the AOA sensors provide erroneous data. The software went through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration (FAA) representatives on board as observers.”
The company continues: “[The] flight control system will now compare inputs from both AOA sensors. If the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate. An indicator on the flight deck display will alert the pilots. If MCAS activates in non-normal conditions, it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs. MCAS can never command more stabilizer input that can be counteracted by the flight crew pulling back on the column. The pilots will always continue to have the ability to override MCAS and manually control the airplane.”
These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.
Vaughn Cordle, CFA has 40 years of experience in the airline industry, including 20 years as an airline analyst for (and founder of) AirlineForcasts and Ionosphere Capital, LLC. He is currently a senior B787 captain for a major airline, with 34 years / 27 years as Captain and 25,000+ flight hours. Ratings, licenses, and awards include LRJET, CE500, A320, B727, B737, B747, B757, B767, B777, B787. Gold Seal Instructor, Flight Engineer, B767, B777, B787. CFII/MEI/Gold Seal Instructor, Flight Engineer.
Don McGregor is a B777 pilot for a major airline with 27 years of experience and over 7000 commercial flight hours; retired Air Force two-star general with 35 years of service; former National Guard Director of Strategy, Policy, Plans, and International Affairs; Lead advisor to a Member of the Joint Chiefs of Staff; Air Force fighter pilot and operational test pilot. He flew F-4 and F-16s with over 3300 flight hours and is an Air Force Fighter Weapons School (Top Gun) graduate.