What went wrong inside Boeing's cockpit?

There was little more the pilots could have done.

As alarms sounded in their cockpit, the captain and first officer struggled to regain control of their stricken aircraft.

They were far too close to the ground, and needed to gain altitude. Yet when Capt Yared Getachew tried to guide the nose of the Boeing 737 upwards, an electronic system forced it down again.

Simply pulling back on his control column wasn’t enough. So he used a thumb switch as well, to adjust the aerodynamic balance of the plane, and encourage it to climb. But a few seconds later, those adjustments were automatically reversed.

The column was shaking in his hands, a mechanical warning that the aircraft was in danger of stalling and falling out of the sky. A harsh robotic voice called out “don’t sink” three times, indicating that the plane was losing height.

Together, he and First Officer Ahmednur Mohammed Omar worked quickly to find a solution. They flicked switches on the centre console to disable part of the electronics, and began using manual controls instead, in an attempt to make the plane fly normally.

Regaining control was difficult. By now the aircraft was gathering speed, and aerodynamic forces were building rapidly; it’s likely they had simply become too great for the pilots to fight against using manual controls.

Whatever the reason, they turned the electronics back on and Capt Getachew tried once more to raise the nose of the aircraft, using the thumb switch on his controls. With power assistance restored, the aircraft responded. Briefly it began to climb.

But then, inexorably, the process was reversed as the computers intervened yet again. Another alarm was now chirping urgently, warning that the speed of the plane had become dangerously high, as it began to dive towards the ground.

In desperation, Capt Getachew called on his co-pilot for help. Together, they hauled back on their control columns, using their combined strength, in a last-ditch effort to overcome the forces arrayed against them with sheer muscle power.

The dive became steeper and steeper, and the aircraft fell faster and faster, until it slammed into the ground at more than 500mph, just six minutes after taking off.

One hundred and fifty seven people from 35 different countries died.

They included 49-year-old Anthony Ngare, deputy director of communications for the UN's cultural agency, Unesco; Ethiopian flight attendant Sara Gebre Michael, a mother of three children; and retired Nigerian diplomat Abiodun Bashua.

From Canada, there were three generations of one family.

Kosha Vaidya and her husband Prerit Dixit were travelling with their two teenage daughters, Ashka and Anushka, as well as Kosha’s parents, Pannagesh and Hansini.

All had boarded the plane for an early morning flight from the Ethiopian capital Addis Ababa to Nairobi, in Kenya.

The weather was good, and the visibility was clear. The aircraft, a Boeing 737 Max 8, was new.

Just five months beforehand, a near identical Boeing 737 Max 8, operated by Indonesian carrier Lion Air, had set out on another routine journey from the Indonesian capital, Jakarta.

The flight to the western city of Pangkal Pinang was meant to last little more than an hour. But moments after taking off, the pilots found themselves in serious trouble.

They were fighting for control, mystified as the aircraft seemed to take on a mind of its own, trying to descend when it was supposed to be climbing.

They had no idea what was going on. Each time they tried to bring the nose up, their actions would be reversed a few seconds later as automatic systems forced it down again.

This happened more than 20 times, with the aircraft bucking erratically through the sky. Air traffic controllers became worried when they noticed on their radar screens that it was descending. On the radio, one of the pilots told them he had a “flight control problem”.

As the crew tried to work out what had gone wrong, they became even more confused, because their instruments were indicating different altitudes. They didn’t know how high the plane was, or how fast it was going.

Eventually, they lost control altogether. The aeroplane went into a steep dive that couldn’t be recovered, and crashed at high speed into the Java Sea.

One hundred and eighty nine people lost their lives.

Two remarkably similar accidents, just five months apart, involving the same brand new aircraft design. Within days of the second crash, investigators had noted “clear similarities” between them. So was there a common cause?

When an aircraft crashes, an investigation has to start quickly.

Relatives want answers. Airlines and manufacturers need to know if the same thing could happen again.

What investigators really want to find is the flight data recorder.

In the case of the Lion Air jet, this was recovered from the sea floor within days. It provided a wealth of detail about the doomed flight.

Suspicion quickly focused on a piece of flight control software designed to operate in the background, without the pilot even being aware of it.

It was meant to make the plane easier and more familiar to fly for pilots who were already used to the previous generation of Boeing 737. It was designed to curb a tendency for the 737 Max’s nose to rise too much, when it was already pitched up at a steep angle.

But it appeared to have been activated at the wrong time and to have forced the nose of the aircraft down when it was supposed to be climbing.

The stabilisers - small wings on either side of the tail - were being moved into the wrong position by the flight computer. When the crew tried to correct them, they simply moved back.

Boeing insisted its aircraft was safe, but issued a bulletin to airlines explaining what could happen, and what to do.

In their everyday work, pilots rely heavily on printed checklists, which set out step by step precisely how different operations should be carried out. When something goes wrong in the air, there are further checklists they can draw on, to help them diagnose and solve a range of different problems.

In this case, pilots were told to follow steps set out in an existing checklist which they are required to memorise, designed to help them deal with an abnormal situation affecting the stabilisers.

It told them to turn off power to the automatic control system, by flipping two cut-off switches. They could then operate the stabilisers manually, using a crank handle in the cockpit.

Boeing was confident that if pilots followed these instructions the plane could be flown safely. Nevertheless, it began developing new software to eradicate the problem.

This was still being worked on when Ethiopian Airlines flight 302 set out on its final journey.

The cause of the two accidents, we now know, was very probably the same.

And according to an interim report, the Ethiopian Airlines pilots reacted to the emergency as the manufacturer had told them to. But it didn’t save their lives, or those of their passengers.

Now, Boeing is facing serious questions - about whether it was right to assume the aircraft was safe, or whether it should have taken more radical steps after the Lion Air crash.

The 737 Max has been grounded.

The way in which pilots around the world are trained to deal with the increasingly high-tech systems aboard modern airliners is also being thrown into sharp relief.

And the close relationship between the aerospace giant and the US body that is meant to regulate the industry, the Federal Aviation Administration, has come under scrutiny as never before.

“The longer Boeing left it, the further it would fall behind,” explains pilot and 737 expert Chris Brady.

Boeing had been studying options for a possible 737 replacement for several years.

But at the time, its 787 Dreamliner - billed as a groundbreaking and super-efficient design - was years behind schedule and billions of dollars over budget.

The company’s board appeared reluctant to give the go-ahead for another plane to be designed from scratch. The only other option was to re-engineer its existing aircraft and fit new, more efficient engines.

As commercial pressures mounted, and amid signs one of its main customers, American Airlines, was about to place a major order with Airbus, Boeing gave the 737 Max programme the green light.

Although the A320 and the 737 look very similar, the engineering challenges faced by the two manufacturers were very different.

The A320 is fundamentally a much more modern aircraft, one which began flying in the late 1980s. It is taller than the 737, which is still based on its 1960s airframe.

For Boeing, this meant installing the new engines was far from easy.

A solution had to be found. But that solution had unintended consequences.

When it was introduced in the 1960s, the 737 was built to be low to the ground. This made it easier to load baggage and get passengers aboard using stairs - a particular advantage at the small, regional airports it was designed to serve.

Look at a photo of one of the early 737s, and you’ll see that the engine is a slim, cigar shape mounted directly beneath the wing. But as engine technology developed, and the aircraft was updated, the low ground clearance caused problems.

In recent years, quieter and more efficient engines have been developed, but for technical reasons, they are much fatter than their predecessors.

With the 737 Max, Boeing wanted to use the most efficient engine available: the CFM International LEAP. A variant had already been chosen by Airbus for the updated version of its A320.

“Once Airbus said they’d use it and the A320 was going to become much more fuel efficient, Boeing had to do the same,” says Brady. “It would have been commercial suicide otherwise.”

But the LEAP was too big to sit comfortably beneath the wing of Boeing’s low-slung aircraft. So the engine was moved higher up and further forward on the wing. This solved one problem, but created another.

The modifications created unusual handling characteristics. In essence, it was found that the aircraft had a tendency to lift its nose upwards, particularly when it was already pitched at a steep angle.

This was unhelpful, because an excessively high “angle of attack,” as it is known, can cause an aerodynamic stall - suddenly robbing the wings of lift and causing the plane to lose altitude. It’s a situation flight crews would be careful to avoid.

Yet under these circumstances experienced pilots found the controls of the aircraft felt unfamiliar: unusually light, and rather different to what they had experienced with the previous generation of 737.

Boeing’s engineers developed a control system called MCAS - Manoeuvring Characteristics Augmentation System - to ensure that the way the 737 Max behaved in the air remained consistent and matched that of previous generations of the plane.

This piece of software brings the nose of the aircraft down automatically, under very specific circumstances, without the intervention of the pilot.

Investigations into both 737 Max crashes are still under way, but the finger of suspicion has already been pointed firmly at MCAS.

What it does is relatively simple. It moves the horizontal stabilisers - the tail wings of the aircraft, which are normally used to help the aircraft maintain level flight - to bring the nose downward.

This has two effects: it increases pressure on the pilot’s control column, making the handling feel more familiar to experienced 737 pilots; and it reduces the risk of the nose rising too far and triggering a stall - although Boeing insists it is not an anti-stall system, and is simply there “to enhance the pitch stability of the airplane - so that it feels and flies like other 737s”.

What now seems apparent with the benefit of hindsight is that MCAS had design flaws.

First, it relied on data from a single angle of attack sensor, even though the aircraft had two of them. This type of sensor, in the nose of an aircraft, measures the angle at which it is encountering the airstream.

But relying on only one of them meant that if it failed, the system could deploy at the wrong time, and push the nose of the aircraft down when it was supposed to be climbing, for example.

Second, although the pilot could use a thumb control to correct the pitch of the aircraft, MCAS would deploy repeatedly in cycles, forcing the nose down again and again.

MCAS worked in the background, and it wasn’t until after the Lion Air crash that Boeing explained what it was and how it could be deactivated. It was not specifically mentioned in the flight manual - which is meant to give pilots the information they need to fly the aircraft safely.

Recent reports in the US media suggest that flight crews themselves were deeply unhappy they had not been kept informed. An audio recording obtained by CBS News purportedly contains an exchange between members of American Airlines’ pilots union and a company official, which took place a month after the first crash. In it, one pilot angrily informs the official that “we flat out deserve to know what is on our airplanes”.

Boeing emphasises that there are set procedures for pilots to follow, which are meant to help them deal with uncontrolled stabiliser movements, whatever their cause. These were contained in the manual, and should have been memorised by the pilots as well. It says the manual did tell crews to expect automatic stabiliser movements as the plane approached stalling speed, the “same type of aircraft behaviour” caused by MCAS.

It has also pointed out that the day before the Lion Air crash, the same aircraft experienced similar problems, but was able to continue safely to its destination.

On that flight, within seconds of take-off, the airspeed and altitude indicators gave sharply different readings. Then the nose of the aircraft began moving down of its own accord.

But this time, the pilots worked out what to do about it. They cut off power to the electronics operating the stabilisers and began controlling them manually.

They may have been lucky, though. According to media reports, they were told what to do by a third pilot who happened to be in the cockpit, having hitched a ride aboard the plane.

Since these incidents, serious questions have been raised about the design of the MCAS software and whether the 737 Max was allowed into service despite a potential catastrophic flaw.

So what were the circumstances in which it was certified as safe to fly in the first place - and why was it not grounded when that flaw first came to light?

Many analysts are now pointing the finger at the close, even symbiotic, relationship between the company and the regulator responsible for aviation safety in the US, the Federal Aviation Administration (FAA).

The charge being levelled against the FAA is that it was a victim of so-called “regulatory capture”.

This is what happens when a government agency’s relationship with the industry it oversees becomes too close for comfort; instead of acting primarily in the interests of the public, it puts the needs of businesses first.

The FAA was responsible for certifying the 737 Max and giving it permission to fly.

Critics have suggested both that the agency was too slow to ground the plane and that the original certification process itself was flawed.

Among them is US senator Richard Blumenthal. In a tense hearing organised by a Senate committee after the Ethiopian Airlines crash, he was scathing about the FAA’s alleged failings.

It had, he said, lagged behind other aviation authorities in preventing the 737 Max from flying. But more seriously, he said, it had “decided to do safety on the cheap… and put the fox in charge of the henhouse”. In other words, too much of the safety work on the plane had been outsourced to Boeing itself.

In the rush to produce the new aircraft, he argued, critical safety features had been disregarded.

Mary Schiavo, a former Inspector General at the US Department of Transportation who has been a thorn in the side of the FAA for many years, takes a similar view.

During her tenure at the DoT in the mid-1990s, she oversaw an audit of the FAA’s work relating to the Boeing 777, and concluded that the bulk of the work was done by Boeing itself, with little real oversight.

“At the FAA, they know they’re outgunned by Boeing,” she says. “They know they don’t have the kind of resources they need to do the job they’re tasked with doing.

“They pretend to inspect, and Boeing pretends to be inspected, when in fact Boeing is doing it all almost entirely by itself.”

There’s no question Boeing does have tremendous economic clout.

In the US alone, it employs more than 135,000 people, and claims to support more than a million more jobs across thousands of American suppliers. It is the world’s biggest aerospace company, with annual revenues of more than $100bn, and profits of more than $10bn.

Barbara Lichman, an aviation lawyer and former Washington lobbyist, says it also has plenty of political power.

“Companies of that size have very proficient lobbyists,” she says. “They hit Congress very, very hard, and put pressure on them to relieve pressure on the company.”

Whether or not politics were involved, the FAA certainly appeared reluctant at first to ground the 737 Max, far more so than other civil aviation authorities.

On 11 March, the day after the Ethiopian Airlines flight 310 crashed, the FAA published a “continued airworthiness notification”, which in effect gave the aircraft the green light to continue flying.

Although it acknowledged that external reports were “drawing similarities” between the latest accident and the Lion Air disaster in October 2018, the agency insisted that as the investigation into the Ethiopian crash had just begun, it did not have sufficient data “to draw any conclusions or take any actions”.

Yet others were more cautious. China’s civil aviation authority was one of the first to order the grounding of the plane, along with Ethiopia, just a day after the accident. Many others followed suit.

But it was not until 13 March that the FAA itself banned the plane from flying.

Boeing, meanwhile, says it “operates in full accordance with all Federal Aviation Administration oversight requirements and processes”. It insists that “the long-standing collaborative engagement between the FAA, Boeing, its customers and industry partners has created the safest transportation system in the world”.

Nevertheless, since the Ethiopian Airlines accident, the Department of Transportation has set up an expert committee to review the FAA’s certification processes.

Meanwhile pressure on Boeing itself is mounting.

It is already facing a number of lawsuits from relatives of the victims of both crashes. Outside the company’s annual general meeting in late April, protesters called for chief executive Dennis Muilenburg to face prosecution.

It is also being sued by some investors who claim the company concealed problems with the 737 Max and “effectively put profitability and growth ahead of airplane safety and honesty”.

Damaging information continues to emerge. In early May, Boeing admitted that a warning mechanism which should have been fitted as standard to the 737 Max would not work unless customers had also fitted a separate, paid-for cockpit display.

The warning system, known as an AoA Disagree alert, was meant to tell pilots when the two angle of attack sensors on the aircraft were giving conflicting readings, in case one of them failed.

Engineers first became aware of the problem months before the Lion Air crash, but airlines were not informed until afterwards, and nor was the FAA - because Boeing staff believed it did not compromise safety.

A further evaluation was carried out after the accident - and this time Boeing says the FAA and airlines were informed.

Boeing continues to insist that the absence of the system was not safety-critical. It says:

“On every airplane delivered to our customers, including the MAX, all flight data and information needed to safely operate the aircraft is provided in the flight deck on the primary flight deck displays... Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane.”

But 737 expert Brady thinks the information it provided would still have been useful to the pilots in both stricken aircraft.

“I firmly believe that… any information or clue that helps you troubleshoot a problem and piece together what is happening has to be of value,” he says.

Meanwhile, the revelation has raised further questions about transparency at the aerospace giant - and whether or not it has failed to report any other potential safety concerns.

As you line up at the departure gate before a flight, unless you’re a particularly nervous traveller, the chances are you don’t give too much thought to safety. Reports of air crashes are invariably harrowing - but they are also extremely rare. Last year, there was one fatal accident for every 2,520,000 flights, according to the Aviation Safety Network.

One reason why safety standards have traditionally been so high is because pilots have to be highly qualified.

As a general rule, pilot training is lengthy, disciplined and rigorous. For example, in the UK, the cost of obtaining a commercial licence to fly large aircraft can easily exceed £100,000. It involves hundreds of hours of teaching.

First you need to gain a private pilot’s licence. Then you need further training in order to build up flying hours and learn how to fly using instruments in poor visibility, not to mention passing theory exams, before being awarded a commercial licence.

That can then be followed by yet more training to learn how to fly a specific aircraft, and get the necessary certificate, or “type rating”.

Yet some experts are concerned that these high standards are starting to slip, as airlines and manufacturers try to reduce the amount of time and money that needs to be spent on training.

Some see what happened with the 737 Max as symptomatic of this trend.

Although there were significant physical differences between the previous 737 and the Max, pilots who had flown the older version were only required to complete a short online tutorial before carrying passengers aboard the Max.

By making the plane handle like the previous generation of 737, Boeing also ensured that pilots would not need extensive extra training to fly it.

Dai Whittingham is the chief executive of UK Flight Safety Committee, an independent trade organisation with major UK airlines, airports, academics and manufacturers among its members. He thinks there is a definite downward trend.

“Standards of UK training and safety are excellent,” he says. “But as an industry we’ve had a bit of a race to the bottom on the costs associated with training.

“Airlines don’t want to spend money on training if they don’t have to. We’ve seen this with the Boeing 737 Max. It is a different body and aircraft but certifiers gave it the same type rating.”

This is a crucial point. If a new aircraft is awarded the same type rating as previous models in a series, less training is needed. That reduces costs, particularly if the job can be done through a fairly simple online tutorial, rather than, for example, time spent in a full-scale simulator, which can be expensive.

Whittingham insists that "shareholders are squeezing airlines hard on costs”.

“Training requirements are being set to the absolute minimum. If airlines want to do more training then they have to argue with their financial teams to get it signed off.”

Getting pilots to talk about this is difficult. Nevertheless, a few have chosen to do so. Among them is Dr Karlene Petitt, an experienced pilot based in the US. She has become a vocal critic of airline safety culture, drawing on research carried out for her doctoral thesis.

“I believe we have a problem with pilot training worldwide, and the data supports this analysis,” she says.

“Safety and training are going in the wrong direction. It is something that the Federal Aviation Administration has known for years.

“Is learning from a flash drive the same as structured classroom learning with an instructor? More so, is an electronic exam an accurate assessment of knowledge?"

As part of her two-year research programme, Dr Petitt distributed a survey among pilot groups expecting a few hundred responses. She says she received more than 7,500.

“The significance of this number identifies that pilots worldwide care about the safety of the industry,” she says.

“Comments received from these pilots have further identified concern with the trajectory… of where this industry is going.”

Another area which worries her is the increased automation of flying. She fears that as pilots become more reliant on computerised systems, they are losing the skills to fly the planes themselves - and respond when things go wrong.

Dai Whittingham takes a similar view. “Physical, hands-on flying - pilots do less of it now, because the computer is more efficient for fuel. Pilots make mistakes and that costs money,” he says.

This isn’t a new theory. Back in 1997, in a famous lecture at American Airlines’ Flight Academy, Captain Warren Vandeburgh warned that pilots were becoming “Children of the magenta”, over-reliant on the magenta lines on their cockpit displays. He identified a culture among pilots of becoming too dependent on automated systems, undermining their ability to react to fast-moving situations.

Boeing now says all pilots who intend to fly the Max when it has been recertified as safe to fly will have to undertake a new training programme.

Meanwhile investigators will continue to look closely at how well the pilots involved in the two crashes understood the systems they were using.

Boeing has developed a software update to change the way MCAS works.

In future, the system will rely on information from two angle-of-attack sensors, rather than just one. If the two sensors give different readings, the pilots will be alerted to the fact and if they vary too much MCAS will simply be switched off.

There will be other safeguards, too - ensuring that the system can always be counteracted by the flight crew, and preventing it from deploying multiple times “in non-normal conditions”.

At a congressional hearing on 15 May, the FAA’s acting administrator Daniel Elwell said he expected to receive details of the update from Boeing “in the next week or so”.

It would, he said, be subject to a “thorough and rigorous safety analysis”. The aircraft would not be allowed to fly in the US until it was “absolutely safe to do so”.

It is still far from clear when this will happen. Safety agencies from around the world are due to meet in Washington on 22 May to discuss the FAA’s latest safety analysis.

Meanwhile, winning back the confidence of passengers may not be easy, but aviation historian Shea Oakley believes the aircraft can still be a success, once it has been allowed back in the sky.

“There have been a number of commercial airliners that suffered fatal crashes early on, that were linked to either design or pilot training issues,” he says.

He points out that aircraft such as the Boeing 727, the BAC 1-11 and McDonnell Douglas DC10 were involved in major accidents soon after being launched, remained on sale for decades afterwards.

Boeing’s chief executive Muilenburg has pledged that once MCAS has been modified, the 737 Max will be one of the safest aircraft ever built.

Boeing still has more than 4,500 orders for the Max, and airlines want their new planes. Those efficiency improvements are still badly needed, and Airbus alone cannot hope to meet demand.

Production continues and the chances are most of those outstanding orders will be fulfilled.

But that doesn’t mean Boeing can simply get the aircraft flying and act as though nothing has happened.

The two accidents claimed the lives of 346 people. Formal investigations are ongoing, and more information may yet emerge. Relatives of the victims are demanding answers. There is a great deal of anger - and lawsuits are mounting up.

The US Department of Transportation is looking into the certification process for the 737 Max, and the Department of Justice is also taking an interest. It’s far from clear where these inquiries will lead, and what the outcome could mean for the company or its senior executives.

Nor should we forget the impact these accidents will have had on Boeing’s own employees. They were clearly proud of their new creation. They certainly did not intend to make a product that was in any way unsafe. Now, people within the aerospace giant say they feel “shattered” by what has happened.

Nevertheless, Boeing will almost certainly recover in the end. And despite the two tragedies, it is highly likely the 737 Max itself will be flying for years or even decades to come.

Credits

Author: Theo Leggett

Additional reporting: Simon Browning

Producer: James Percy

Editor: Kathryn Westcott

Graphics: Gerry Fletcher, Salim Qurashi, Tom Housden Lilly Huynh

Images: Getty, Alamy, Facebook

Publication date: 17 May 2019 (Updated 27 January 2020)