After first 737 Max crash, why did Boeing’s pilot warning fail to stop second plane from going down?

Eight days after a Boeing Co. 737 Max went down in the Java Sea, killing all aboard, the planemaker issued a worldwide warning to pilots identifying the malfunction that triggered the crash.

The bulletin, which was followed almost immediately by a similar notice from U.S. regulators, listed the symptoms cockpit crews faced in such an emergency and explained how to counteract it. News reports described the problem.

Yet less than five months later a second 737 Max went down, slamming into a field in Ethiopia, after suffering the same malfunction. As the one-year anniversary of that crash approaches, many questions remain about why the two pilots lost control.

Was the bulletin’s technical language clear enough? Did Boeing and the regulators who signed off on the warning underestimate the chaos of alarms blaring in the cockpit of the doomed jet? Could the pilots have been fatigued or sick? Should, as one whistle-blower has suggested, Ethiopian pilots have gotten more training on the malfunction?

“I think that’s a central question: Why?” said Jeffrey Guzzetti, the former head of the FAA’s accident investigation bureau. “There’s all kind of potential underlying threads.”

A flaw in the design of the 737 Max has already been identified as a main reason for the crash of a Lion Air plane near Jakarta. The Ethiopian Aircraft Accident Investigation Bureau hasn’t released its findings but a preliminary report out last April showed a similar malfunction also occurred on that flight.

The Ethiopian investigators are poised to release an interim report on the March 10 crash in coming days. A draft of the report focuses on Boeing’s flawed design according to people who have seen it.

Ethiopian government officials and the airline have steadfastly defended the pilots. Transport Minister Dagmawit Moges in April said they followed “all the procedures repeatedly.” Airline Chief Executive Officer Tewolde GebreMariam has bristled in interviews over implications that the crew didn’t perform properly.

A committee of the U.S. Congress on Friday issued its own preliminary findings on the Max and said its design and development “was marred by technical design failures, lack of transparency with both regulators and customers, and efforts to obfuscate information about the operation of the aircraft.”

Boeing added a flight-control feature called the Maneuvering Characteristics Augmentation System, or MCAS, which was programmed to automatically drive down the nose in some circumstances, without adequately assessing its risks, Indonesia’s National Transportation Safety Committee concluded in October.

The company assumed pilots would respond to a malfunction of MCAS within four seconds, but the Lion Air crash and an incident on the same plane a day earlier showed that wasn’t realistic, the investigation found.

Boeing’s bulletin on Nov. 6, 2018, and an emergency directive by the U.S. Federal Aviation Administration didn’t specifically name MCAS, but the system was widely identified in news reports within days.

The bulletin listed nine possible symptoms in such a failure. If any of them occurred while the plane tried to nose down on its own, the directive said: “do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.”

In the nomenclature of aviation, that meant perform an emergency checklist shutting off power to the motor driving down the nose and keep it off.

The directive was made a part of the Ethiopian carrier’s manuals. Within two days of Boeing’s notice, a senior Ethiopian Airlines pilot had emailed the company’s crews to reiterate the warning, according to records reviewed by Bloomberg News.

Teasing out clues for why Captain Yared Getachew and copilot Ahmed Nur Mohammod reacted the way they did is critical, according to several former crash investigators and safety experts. Not only will it help shed light on the grounded 737 Max’s flaws and whether initial warnings were adequate, but it also is relevant to broad issues of pilot training and competency, they said.

According to the Ethiopian preliminary report, the pilots took several vexing actions.

They performed an important step in Boeing’s recommended emergency response to the malfunction: shutting off power to the electric motor that was driving down their nose. But they then restored power shortly before losing control.

They also left the plane’s throttle set to takeoff power, which prompted it to fly faster than its maximum allowable speed and made it far more difficult to control. Other actions, such as trying to activate the autopilot, appear to have been opposite of what they should have done in the emergency.

It would be easy to simply point the finger at the pilots, but that doesn’t take into account the calamitous conditions in the cockpit, said John Cox, a former airline pilot and president of the consulting company Safety Operating Systems.

A failed sensor was triggering multiple errors and warnings, including a loud thumping noise on the captain’s control column signaling -- falsely, it turned out -- the plane was nearing an aerodynamic stall. They also had unreliable airspeed and altitude readings.

It’s unfair “sitting in an office saying they should have known” how to respond, Cox said. Investigators should examine how the chaos would have impacted the pilots’ performance, he said.

Another area investigators should review is the adequacy of the Boeing bulletin, Cox said. While it mentioned the multiple failures that could occur at the same time, it didn’t expressly warn crews about how chaotic they could be, he said.

Such pilot warnings have been criticized as inadequate in previous accidents, Guzzetti said.

The U.S. National Transportation Safety Board, for example, criticized the FAA for a similar type of warning it issued to pilots after an earlier model of the 737 crashed near Pittsburgh in 1994.

“It should be something they are looking at,” Guzzetti said. “How effective was the wording, the presentation and the prioritization?”

While it will be impossible to know exactly what Getachew and Nur were thinking during the frantic five-minute flight, crash investigations typically follow a basic script to get clues.

They take a close look at pilots’ lives in the days prior to the crash for signs of illness, fatigue or other personal factors that could affect their actions.

In the Lion Air crash, investigators found that the captain was sick and the copilot had been called in at 4 a.m. as a substitute for the scheduled crew member.

The type of training that pilots received and how well they performed in their careers are also areas that can help investigators understand accidents.

Nur, the 25-year-old Ethiopian copilot who was almost new to the plane, might get attention from investigators. He had only 361 hours of flying experience in his brief career and less in the 737: 56 hours in the Max and 151 hours in other models of the plane. He had been flying the aircraft for less than 90 days.

Pilots’ training and skills have been relevant in multiple previous accidents.

Both of the Lion Air pilots had exhibited problems in those areas, Indonesian investigators found. Most significantly, the copilot had had difficulty locating checklists and performing in emergency scenarios.

A Canadian man who was a pilot for Ethiopian Airlines before resigning last year said he tried before the crash to warn the carrier that crews weren’t adequately prepared.

In the months after the Lion Air accident, Bernd Kai von Hoesslin frequently quizzed copilots he worked alongside about the MCAS bulletin and most of them couldn’t answer detailed questions, he said in multiple interviews with Bloomberg News.

The airline called von Hoesslin a disgruntled former employee and disputed his allegations in statements. The airline “strictly complies with all global safety standards and regulatory requirements,” it said in a Twitter post last year.

Von Hoesslin submitted records to the U.S. NTSB, which is participating in the probe, but hasn’t been contacted by Ethiopian investigators, he said in an email.

The quality of training at the airline should also be a part of the investigation, said Roger Cox, a former NTSB investigator and airline pilot.

Representatives of the airline didn’t respond to requests for comment on this story.

Were crews adequately taught to be comfortable flying a plane manually during an emergency? Were junior pilots coached to speak up when a captain made a mistake? Were they given realistic emergency scenarios during training?

These are not just questions that could help explain why the Ethiopian crew lost control, but probing them for answers could help improve safety across the world, Cox said.

“Have you done enough to ensure that those guys together have an adequate ability to handle an emergency?” he said. “It’s an extremely important question to ask.”

Many people have suggested that they should have a backup AOA probe. But with two probes how do you know which one is right and which one is wrong? I suppose you could have a third probe and then “vote” to see which data to use. I think this might lead to more problems than it fixes.

But every single MAX aircraft already does have two AOA probes. One drives the Captain's instrumentation and one drives the First Officer's side.

Boeing wrote the MCAS software to use just one AOA probe, either the Captain's or the FO's, alternating every other flight. The problem came when Boeing wrote the flight display software, there was supposed to be an error flag "AOA DISAGREE" on the flight display unit if the two AOA sensors disagreed by more than 10 degrees.

However, the way the software was ultimately written, the AOA DISAGREE error flag was only active on those aircraft where the optional AOA display was purchased. If you didn't buy the optional AOA display, you didn't get the AOA DISAGREE warning.

Boeing knew of this problem, and had planned on quietly correcting it in a future software update, but the two crashes occurred, the MAX was grounded, and the whole software error fiasco was exposed.

Boeing's proposed fix to the MAX aircraft is to activate the AOA DISAGREE warning on all aircraft, and to disable MCAS completely if the two AOA probes are in disagreement.

And an erratic altimeter reading would be caused by an obstructed static pressure port, not an AOA probe.

Boeing was made the responsible party because they had the financial resources to compensate the victims and juries view them as greedy and evil. They forget that Boeing employees and families fly on the same aircraft as everyone else and have the best safety record of any aircraft manufacturer in the world. I would fly comfortably on any aircraft that the pilot and first officer put their own lives on.

One of the reasons why they wouldn’t let The NTSB near this is they wanted to stick to Boeing rather than admit they short change their crews.. Both Airlines..

Yes, an obstructed static port can also cause an erratic altimeter reading also. But I know from my own repair experience that a dirty AOA probe will cause WILDLY erratic readings.

There are two types of AOA sensors. Supersonic aircraft, like the F-111A that I worked on, usually have the pressure differential type, and subsonic aircraft including most Airbus and Boeing aircraft, including the MAX, use the vane type.

I suspect that in your Air Force days, like mine, that the pressure differential type of AOA sensor was used, and the air pressure was also used somehow in the altimeter.

The MAX uses the vane type, and cannot possibly affect the altimeter.

Thanks for the diagram. Yes, the F-4D had a pressure differential type of AOA like the one in the diagram.

I wasn’t trying to imply that the MAX crashes were caused by faulty altimeter readings, rather my comments about the wild altimeter readings were intended to point out that AOA information can be wildly inaccurate at times.

From what I’ve read, the MAX uses AOA information fed into a system which then controls the flight surfaces. I believe that the MAX crashes may have been caused by faulty AOA readings that made the system “think” it was in a stall situation, when in fact, it was not.

I remember the F-4’s AOA system because we had so much trouble with it - the altimeter problems. But I also worked on some Boeing built planes, the KC-135, the RC-135, and the EC-135 when I was at Offutt for 6 months. I don’t even remember the AOA system on these aircraft so they were probably pretty reliable but probably had the vane type of AOA probe. But I think the vane type would be just as susceptible to corrosion as the probe type because the problems were inside the housing and not in the probe itself (unless the heater wasn’t working).

FYI: The static ports on the F-4D were located on the side of the Radome and this may be why they had to correct the raw static information for changing AOA. Also, the flushness of the static port itself was crucial. The F-4E models (and I think the C models) had a probe that stuck out in front of the planes, but I never worked on those model so I don’t know whether or not these other models changed the static information based on AOA inputs.

— libertylover

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.