Over the last few months, countless experts have speculated about the tragic 737 MAX 8 crashes in Indonesia and Ethiopia. Aviation experts, journalists, the manufacturer, congressional members, carriers, pilot unions, and even grieving families have all played a part in shaping a narrative of who to blame. This has morphed into a political David vs. Goliath-like atmosphere, quick to demonize a supposed devious manufacturer and a conspiring federal aviation administration (FAA). It has become a politicized three-ring circus of finger-pointing and an insatiable urgency to find a culprit. What is getting missed is what really happened.
The question in any aircraft accident—and I’ve seen and reviewed dozens—is What happened? not Who’s to blame? It is imperative when examining a complex set of conditions, such as aircraft mishaps, that objectivity and an unbiased review is at the forefront of any safety investigation. The issue always boils down to a set of contributing factors or conditions that influenced its final outcome. Once these have been established, it is important to determine the level or degree to which they contributed—that is, to identify root causes and culpability.
Accident investigations determine where the emphasis must be placed so that efforts to fix the problem are proportional to the weight of their contributions. If not, then root causes may be inadequately addressed or, worse, not addressed at all, raising the possibility of further accidents. Therefore, to ensure that contributing factors are not buried under a politicalized blame-game, it’s critical to assess honestly what happened.
The pilots in each of these incidents were presented with a very difficult emergency situation. Faulty angle of attack (AOA) sensors generated simultaneous visual, aural and physical warnings in the cockpit during a critical phase of flight (climb-out). On top of these initial problems, the defective AOA sensors fed a poorly designed and integrated flight control system called the Maneuvering Characteristic Augmentation System (MCAS). MCAS is a new pitch augmentation system specifically designed for the 737 MAX aircraft.
During the testing phase, pilots noticed that, at slower airspeeds, the MAX did not handle the same as older 737 models. What made it different and attractive to carriers was Boeing’s addition of new and more powerful engines. The advantage of these engines was a 14%-16% improvement in fuel efficiency, which for the airlines was a potential fuel-saving bonanza. However, the new engines could not fit under a normal 737 wing, so they were moved forward and up on the wing. This—and the fact that they were more powerful—created a more aggressive aircraft pitch-up tendency at slow airspeeds and high AOAs, which is what the pilots were experiencing during testing.
To ensure that the new MAX responded in a similar manner to the older 737 aircraft, MCAS was incorporated to trim the stabilizer (the aircraft’s horizontal tail that controls pitch) in a similar manner (or feel) to the older models when they approached a stall condition. The reason to have the MAX respond in a comparable manner was to cut time and training costs for carriers, a large selling point for the manufacturer. It seemed like a legitimate fix—unless the system activated at the wrong time.
Boeing engineers realized this inadvertent MCAS possibility and felt comfortable moving forward in production since there was already an emergency procedure that could effectively handle any improper activation. Since the purpose of MCAS was to trim the aircraft out of a stall condition, any inappropriate activation would be considered what emergency manuals refer to as “runaway trim.” In such an event, the pilots would use an already well-established emergency procedure to handle any un-commanded trim situation. In fact, every 737 pilot, no matter which model they fly, is trained to handle this type of emergency.
Problem solved? Right? Well, yes and no. This is why we must review what happened.
The Lion Air Flights
The Aircraft Maintenance Flight Logs Left Quite a Few Clues.
The Indonesian preliminary report highlights the Aircraft Flight and Maintenance Logs of four flights recorded prior to the fateful Lion Air Flight 610 (LA610). The four flights totaled (or trended) three occurrences of indicated airspeed (IAS) and altitude (ALT) warning flags on the Captain’s Primary Flight Display (PFD); two occurrences of Speed and Mach Trim fail lights; one occurrence of Indicated Airspeed (IAS) and Altitude (ALT) disagree as well as a Feel Differential Pressure light. Maintenance tests revealed two test occurrences of Stall Warning System fail and AIR DATA invalid; one occurrence of Angle of Attack (AOA) signal fail and one occurrence of AOA signal out of range (the same sensor that feeds MCAS). Because of these issues and after Lion Air Flight 43 (LA43)—the previous flight to LA610—maintenance replaced the AOA sensor.
These warnings would become ominous indications of an impending unintended MCAS activation, which Boeing eventually acknowledges in a bulletin after the Lion Air accident…
What does this tell us?
There is an old saying: once is a coincidence, two’s a trend—and three’s a problem. I added the third occurrence to the cliché to emphasize that this aircraft had repeated maintenance writeups prior to the doomed LA610. Bells and whistles should have been going off and the hair on the back of the maintenance chief and the captains’ necks should have been standing. These repeated warnings were telling the pilots of trending sensor problems that included the AOA, specifically on the captain’s side. Individually or collectively, those responsible should have grounded the aircraft.
Further, and more concerning, is the post-flight report for Lion Air Fight 43 (LA43). Remember, this was the flight just prior to LA610. Nowhere in the preliminary report on the flight logs is there an account for the runaway trim emergency or the fact that the flight crew moved the stabilizer trim switches to cutout—an emergency action to stop all electric trim power to the stabilizer—thus shutting off MCAS. In fact, according to the report, LA43 did not declare an emergency for runaway trim or mention the un-commanded automatic nose-down inputs.
Additionally, and more troubling, is that the flight continued for another ninety minutes, landing at its destination using only manual trim (since the pilots had shut off electric trim with the stabilizer trim switches) and no auto-pilot—even after having experienced an emergency procedure. Essentially, they flew a crippled aircraft. Nothing in the maintenance flight log or in the preliminary report addresses these violations.
All of which would be contributing factors in the fateful LA610…
What Happened in Lion Air Flight 43?
Pilot and Manufacturer Errors, Compounding Warnings, and Pilot Corrections (Figure 1.)
- The captain hands over aircraft control to the first officer during a critical phase of flight (low altitude climb-out) with several emergency warnings activated.
- The captain moves the stabilizer trim switches back to normal (on), deviating from established checklist procedures.
- The crew continues the flight to their destination using only manual trim, no auto-pilot, an activated stick shaker, and the stabilizer trim switches in cutout (off).
- Faulty Angle of Attack (AOA) signals on takeoff.
- After flap retraction, MCAS inadvertently activates.
Compounding Cockpit Warnings due to faulty AOA signals:
- On take-off role, a faulty left AOA signal – only identified on the Flight Control Parameter figure, taken from the Flight Data Recorder (FDR).
- After lift-off, the stick shaker activates, and the airspeed disagree warning appeared.
- Master Caution Warning – Inadvertent takeoff configuration warning informing the pilots of an unsafe-to-fly condition.
- The first officer unsuccessfully attempts to engage the auto-pilot.
- The first officer trims out MCAS inputs and maintains a level-to-climb profile.
- The third pilot (jump seater) identifies the runaway trim emergency and suggests to the flying pilots to move the stabilizer trim switches to cutout.
- Pilots move the stabilizer trim switches to cutout and stops MCAS inputs.
- The first officer trims out MCAS inputs and neutralizes the stabilizer prior to moving the stab trim switches to cutout.
Figure 1. LA43 Pilot and Boeing Manufacturer Errors and Pilot Corrections
What does this tell us?
The crew of LA43 had multiple cockpit emergency warning indications on climb-out due to a faulty AOA sensor and inadvertent MCAS activation. But the pilots should have been prepared for these warnings since the previous maintenance write-ups identified similar problems. And remember, had they written up in the maintenance flight log that the stabilizer trim switches were moved to cutout, the outcome of LA610 might have been very different.
Initially, the crew began the “airspeed unreliable” emergency checklist based on cockpit indications but were interrupted by a higher priority flight control problem, a problem they would appropriately prioritize and address, unlike the doomed LA610. Yet, in the middle of these warnings and during a critical phase of flight, the captain handed over aircraft control to the first officer. An unusual and possibly dangerous pilot action.
As fate would have it, LA43 had an uncommon situation where they had an additional pilot riding in the jump-seat. Not only did this extra pilot properly assess the runaway trim but he also suggested moving the stabilizer switches to cutout. A potential lifesaving assessment. In addition, and just as important, they effectively neutralized the stabilizer by trimming out MCAS inputs prior to moving the stabilizer trim switches to cutout. These positive pilot actions placed them in an optimum situation to manually trim the aircraft, unlike the ill-fated flights LA610 and Ethiopian Airlines Flight 302 (ET302), which did not properly perform these steps.
Finally, and what I consider the most damning aspects of this flight is twofold. First, the fact that with all of these warnings—the loss of the auto-pilot, and the execution of an emergency procedure—the crew continued the flight to their destination. Essentially, flying an impaired aircraft. Good pilot judgment dictates that a defective aircraft should land at the nearest suitable airfield. Second, according to the preliminary report, the maintenance writeups do not mention the stabilizer trim switches being moved to cutout. A significant red flag, since this would have alerted LA610 to the AOA and runaway trim issues, possibly avoiding that accident?
Why was LA43 so significant?
According to an Aviation article, “Ethiopian MAX Crash Simulator Scenario Stuns Pilots,” current 737 MAX pilots, as part of a recurrent training simulator, attempted to emulate the same conditions experienced by the ET302 pilots. The actual flight parameters were different and more favorable for use of the manual trim wheel—a cockpit device used by the pilots when there is no electric trim power—since they started at 250 knots instead of the 340 knots in the Ethiopian accident. Yet, even with these favorable conditions, the pilots supposedly found it very difficult to recover and had to use an old recovery technique called the “roller coaster,” apparently used in early 737-200 training.
To the average person reviewing this reenactment, it would appear that the ET 302 pilots were put in an unrecoverable situation. However, what was missing is that the reenactment started from a position where the crew had deviated from an emergency checklist, missing several emergency steps that the crew of ET302 had unsuccessfully accomplished. Steps such as neutralizing the stabilizer trim prior to moving the stabilizer trim switches to cutout and trimming out MCAS inputs—all recommended by Boeing and Ethiopian Airlines.
The point is that by reenacting an accident from a position where the pilots had already committed several mistakes and deviated from checklist procedures does little to assist in determining what happened or the weight of contributing factors.
Yet, what makes LA43 so significant is that somehow the crew managed to survive without the “roller coaster” maneuver. In fact, they flew over ninety minutes with the stabilizer trim switches in cutout, using manual trim. Unknown to them, their actions effectively survived an MCAS induced runaway trim. This is a testament to the importance of following established procedures and providing appropriate operator training, which should be a part of any 737-recertification program.
So, What Happened in Lion Air Flight 610?
Pilot and Manufacturer Errors, Compounding Warnings, and Pilot Corrections (Figure 2.)
- 1st Pilot Error: The FDR recorded MCAS induced automatic aircraft nose-down (AND) trim for 10 seconds. The pilots responded with yoke-mounted electric-trim but never announced or performed runaway trim procedures.
- 2nd Pilot Error: The crew extended the flaps to 5° and the MCAS inputs stopped. Two and a half minutes later the flaps were retracted, reactivating the MCAS, which continued for the remainder of the flight.
- 3rd Pilot Error: Based on numerous reports—although not identified in the Indonesian preliminary report—the captain, at the height of the nose-down trim condition, and only a minute before the crash, handed over the flight controls to the first officer.
- Final Pilot Error: The yoke-mounted electric-trim inputs lessened significantly, which means that for unknown reasons the pilots stopped trimming-out MCAS inputs.
Important contributing notes: According to the preliminary report, the pilots responded to nine heading changes by Air Traffic Control (ATC), four altitude requests, and one heading change initiated by the pilots for weather—all of which may have distracted or partly distracted them. Instead of taking the initiative, declaring an emergency and being directive, the pilots continued to follow ATC directions while trying to maintain control of the aircraft. In fact, they were still acknowledging ATC instructions 20 seconds before impact with the aircraft severely nose low.
- Faulty Angle of Attack (AOA)…20° difference between left and right sensors.
- After flap retraction, the FDR recorded MCAS induced nose-down trim inputs. These inputs continue for the remainder of the flight.
Compounding Cockpit Warnings due to faulty AOA signals:
- The FDR recorded a difference between left and right Angle of Attack (AOA) of about 20° and continued until the end of the recording.
- At lift-off, the left control column stick shaker activated and continued until impact.
- Master Caution Warning – Came on for unknown reasons. Speculation is either a TAKEOFF CONFIGURATION warning (similar to previous flight) or a DON’T SINK warning due to pitch and altitude loss or, most likely, Indicated Airspeed (IAS) and Altitude (ALT) warning flags (not mentioned in the preliminary report but on the FDR).
- LA610 maintained a manageable airspeed and thrust setting.
- The captain consistently trimmed-out the MCAS nose-down inputs, returning the stabilizer trim back to level or slightly nose down.
Figure 2. LA610 Pilot and Manufacturer Errors Contributing to the Fatal Accident
What does this tell us?
Like LA43, the crew of LA610 had several visual, aural and physical warnings during initial climb-out. Although it is unknown whether they followed an emergency checklist, they did acknowledge a “flight control problem” to ATC prior to MCAS activation. The multiple warnings could have led them to the wrong checklist (i.e. airspeed unreliable checklist) and distracted them from the higher priority problem of runaway trim. Clearly, each time MCAS activated it was a severe un-commanded nose-down trim that aggressively rotated the manual trim wheel. The importance of this is the fact that the trim wheel is loud when it moves and should have alerted the pilots to an un-commanded or runaway trim condition.
However, with all this occurring in the cockpit, the captain did a stellar job battling MCAS by trimming-out each nose-down input. Yet, based on several reports but not identified in the Indonesian preliminary report, the captain, at the height of the nose-down trim condition, and only a minute before the crash, handed over the flight controls to the first officer. In principle, this is not unusual. In fact, it is standard practice for U.S. carriers during emergency situations. What is unusual (as with LA43) is that handing over the flight controls during a critical phase of flight or emergency, while fighting a severe flight control problem, especially one that had most likely developed into severe control column (yoke) pressure, is extremely poor judgment.
Other than the fact that the crew misdiagnosed the runaway trim problem, which might have prevented the crash, this single errant action by the captain is what sealed their fate. Even the flight data recorder shows that “the final control column inputs from the first officer were weaker than the ones made earlier by the captain,” which confirms that the FO did not adequately respond to the nose-down trim forces. These actions detail an unsettling trend at Lion Air of captains inappropriately handing over aircraft control during critical phases of the flight.
So, 132 days later, it happens again to Ethiopian Airlines Flight 302…how is this possible?
What Happened to ET302
It is important to point out that the Ethiopian Airline pilots were given all of the post LA610 accident information. This included Boeing and Company bulletins covering MCAS inputs, runaway or uncommanded stabilizer trim, the runaway pitch trim effect caused by erroneous AOA signals, and cockpit indications associated with a faulty AOA. In fact, Ethiopian Airlines stated after the accident that each 737 pilot had been trained on the new procedures.
Here are some worrisome clues…
Pilot and Manufacturer Errors, Compounding Warnings, and Pilot Corrections (Figure 3.)
- 1st Pilot Error: The airspeed increased from 238 knots to over 300 knots in less than a minute and a half. The airspeed continued to increase, reaching speeds in excess of 380 knots, which is 40 knots over the 737 MAX airspeed limits, while engine thrust setting remained at a very high climb-out thrust throughout the flight.
- 2nd Pilot Error: The pilots never completed or properly executed the “Runaway Stabilizer” checklist since Step 3 in the checklist disengages the auto-throttles. This would have forced the pilots to manually adjust the thrust setting and control the airspeed.
- 3rd Pilot Error: Approximately 32 seconds before impact, two momentary electric trim inputs in the aircraft nose up direction. This indicates that the stabilizer trim switches were moved back to normal deviating from Boeing and Company procedures.
- Final Pilot Error: MCAS activated and moved the stabilizer to a full nose-down position. There were no further electric trim commands to try to trim-out the MCAS inputs.
- Faulty Angle of Attack (AOA) signals after takeoff.
- MCAS induced nose-down trim occurred, moving the pitch trim from climb-out trim to nose-down trim.
- Moving the stabilizer trim switches to normal reactivated MCAS nose-down inputs, since the flight control computer was still receiving faulty AOA signals.
Compounding Cockpit Warnings due to faulty AOA signals:
- After lift-off, the AOA values deviated, and the stick shaker activated, remaining on until the end of the recording.
- After takeoff, the Master Caution Warning Anti-Ice came on with most likely an associated L ALPHA VANE light (part of the probe heat system).
- The flight data recorder shows an AOA, airspeed, and altitude divergence.
- Auto-pilot successfully engages but erroneously disengages after 33 seconds.
- Four Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occur.
- Toward the end of the flight, the Master Caution Anti-Ice Warning came on again with an associated “left alpha vane” or L ALPHA VANE warning light.
- Pilots recognize runaway trim and move stabilizer trim switches to cutout.
- Pilots successfully climb for over three minutes using the yoke (elevators), which appeared to counter the nose-down trim. However, it would take only 18 seconds after turning the stab trim back on for the pilots to lose control of the aircraft.
Figure 3. ET 302 Pilot and Manufacturer Errors Contributing to the Fatal Accident
What does this tell us?
As with LA43 and LA610, the crew of ET302, presented with a similar emergency situation, experienced numerous visual, aural and physical warnings on climb-out. Consistent with the other incidents, a possibly defective AOA fed a poorly designed and integrated flight control system (MCAS), which further complicated their situation with repeated invalid nose-down trim inputs. Once again, a tough predicament for any pilot.
However, what sealed their fate was the mismanagement of the airspeed, deviating from an emergency checklist, and not properly trimming out MCAS inputs. To emphasize, the excessive airspeed, which activated the over-speed aural warning, and should have alerted the pilots to their airspeed predicament, placed large aerodynamic forces on the stabilizer, making manual trim movements extremely difficult if not impossible. Also, the captain’s failure to trim-out the MCAS inputs or neutralize the stabilizer trim prior to the stabilizer trim switches being moved to cutout placed them in a less than optimum situation to handle inadvertent MCAS inputs. All of these actions did not follow Boeing and Company recommendations.
But what is so alarming, is that the ET302 accident occurred 132 days after the LA610 accident. The crews were informed about the MCAS issues, its inadvertent activations, and trained in accordance with Boeing and Company recommendations. They should have been ready—properly trained—for this problem. Yet, not only did it appear they were not ready but that they compounded the problem by committing pilot errors —errors so significant that they caused the pilots to lose control of the aircraft.
Why is What Happened so Important?
Thousands of commercial aircraft with hundreds of thousands of passengers fly each day. Every accident, tragic as it is, is a learning moment for pilots and the airlines that train them. In those rare instances when things go wrong, the lives of hundreds of people depend on the pilot’s quick thinking, knowledge, experience, and skill—in a word, competence.
However, in recent months, ill-informed journalists and an insatiable desire to lay blame have created a politicized atmosphere clouding what really happened in these accidents. The media appears to have decided that the manufacturer is solely to blame. Further, they question the integrity of the FAA or, more incredulously, have built a narrative of the manufacturer and the FAA conspiring to cut corners and overlook safety. There is little evidence of any malfeasance or purposeful neglect by either.
Further, issues about foreign pilots, better trained U.S. pilots, or even the unfortunate identity politics brought into these tragedies, are all irrelevant. If efforts are directed to a blame game, then we have lost what must be learned from any tragedy…what happened and how do we ensure it is not repeated. The accidents are being politicized at the expense of the traveling public. The reality of contributing factors in each of these crashes (to include LA43) must be adequately addressed and culpability appropriately allocated. If not, the next misfortune will not be a matter of if but when.
There is plenty of blame to go around but the MCAS did not make the pilots misdiagnose the runaway trim problem. MCAS did not lead them to over-speed the aircraft by 40 knots or more, putting excessive aerodynamic loads on the stabilizer. MCAS did not cause the pilots to improperly trim-out the nose-down inputs. MCAS did not force the pilots to hand over aircraft control during an emergency, which sealed their fate. And MCAS did not force them to deviate from established checklist procedures. The pilots did this all on their own.
Even so, there is no free pass for those involved in these accidents (manufacturer, FAA, carriers, or pilots). The facts are clear that the pilots were overwhelmed in the cockpit, which was due, in part, to a faulty AOA sensor activating a poorly designed and integrated MCAS flight control system. However, the pilots severely and fatefully compounded the emergency with disastrous mistakes that eventually positioned them in an unrecoverable condition.
What really happened was that pilot error was the largest contributing factor in these accidents—not the only factor but the most consequential.
For a more detailed review of the 737 MAX accidents, please reference the following article:
Don McGregor is a B777 pilot for a major airline with 27 years of experience and over 7000 commercial flight hours; retired Air Force two-star general with 35 years of service; former National Guard Director of Strategy, Policy, Plans, and International Affairs; Lead advisor to a Member of the Joint Chiefs of Staff; Air Force fighter pilot and operational test pilot. He flew F-4 and F-16s with over 3300 flight hours and is an Air Force Fighter Weapons School graduate.