737 MAX design
The Maneuvering Characteristics Augmentation System (MCAS) was developed for the 737 MAX to prevent stalls in flaps-retracted, low-speed, nose-up flight. The MCAS uses airspeed and other sensor data to make an attempt at computing when a dangerous condition has developed and then trims the aircraft nose down.
Boeing 737 MAX aircraft have engines mounted higher and further forward than previous 737 models. According to The Air Current, "the relocated engines and the refined nacelle shape" cause an upward pitching moment. In order to pass Part 25 certification requirements, Boeing employed the MCAS to automatically apply nose-down trim when the aircraft is in steep turns or in low-speed, flaps-retracted flight. When the angle of attack (AOA) exceeds a limit that depends on airspeed and altitude, the system activates without notice to the pilot. The system is temporarily deactivated when a pilot trims the aircraft using a switch on the yoke.
The system is sensitive to failure of AOA sensors mounted outside the aircraft. The FAA and Boeing made the AOA Disagree alert an optional feature for the 737 MAX, deciding it was not critical for safe operation. Following the crashes of Lion Air Flight 610 and Ethiopian Airlines Flight 302 soon after takeoff, for which several technical experts implicated the MCAS, Boeing announced a planned software upgrade that notifies pilots of a sensor failure. It will be deployed to aircraft operators "in the coming weeks", the company said on March 11, 2019.
Lion Air Flight 610 crash
PK-LQP, the aircraft involved in the crash of Flight 610
On October 29, 2018, Lion Air Flight 610, a scheduled domestic flight operated by the Indonesian airline Lion Air from Soekarno–Hatta International Airport in Jakarta to Depati Amir Airport in Pangkal Pinang, crashed into the Java Sea 12 minutes after takeoff. All 189 passengers and crew were killed in the accident.
The preliminary report tentatively attributed the accident to the erroneous AoA data and automatic nose-down trim commanded by MCAS.
Ethiopian Airlines Flight 302 crash
ET-AVJ, the aircraft involved in the crash of Flight 302
On March 10, 2019, Ethiopian Airlines Flight 302, a scheduled international passenger flight operated by Ethiopian Airlines from Addis Ababa in Ethiopia to Jomo Kenyatta International Airport in Nairobi, Kenya, crashed six minutes after takeoff near Bishoftu, killing all 157 passengers and crew aboard the aircraft.
Initial reports indicated that the Flight 302 pilot struggled to control the airplane in a manner similar to circumstances of the Lion Air crash. A stabilizer trim jackscrew found in the wreckage of Ethiopian flight 302 was set to put the aircraft into a dive. Experts suggested this evidence further pointed to MCAS as at fault in the crash. After the crash of flight ET302, Ethiopian Airlines spokesman Biniyam Demssie said in an interview that the procedures for disabling the MCAS were just previously incorporated into pilot training. "All the pilots flying the MAX received the training after the Indonesia crash," he said. "There was a directive by Boeing, so they took that training." Ethiopia’s transportation minister, Dagmawit Moges said that initial data from the recovered flight data recorder of Ethiopian flight 302 shows "clear similarities" with the crash of Lion Air flight 610.
In addition to the crashes in Indonesia and Ethiopia, Boeing 737 MAX pilots in the United States registered several complaints about the way the jet performed in flight, including reports that pilots in the United States may have experienced similar issues to what happened in the Lion Air crash. Several reports were filed in the Aviation Safety Reporting System in November 2018, including one where the captain "expressed concern that some systems such as the MCAS are not fully described in the aircraft Flight Manual."
On March 13, 2019, it emerged that pilots on at least two 2018 flights in the U.S. filed safety concerns after the nose of a 737 MAX pitched down suddenly when they engaged the autopilot. In response, the FAA made a statement, "Some of the reports reference possible issues with the autopilot/autothrottle, which is a separate system from MCAS, and/or acknowledge the problems could have been due to pilot error." MCAS only activates if the autopilot is turned off. Boeing had advised pilots to disengage autopilot in nose-down incidents, though MCAS initiates nose-down in response to stall incidents.
On 17 March 2019, the Seattle Times stated that they had raised concerns about the flawed certification of the MCAS system already on 6 March 2019, five days before the Air Ethiopia crash. The Seattle Times also stated that they had still been awaiting an answer to these concerns, when the Air Ethiopia crash occurred. Boeing responded that “there are some significant mischaracterizations” in the description. The concerns (of unnamed current and former engineers directly involved with the evaluations or familiar with Boeing's safety analysis) were that:
- The FAA had delegated the certification of the system to Boeing themselves. While not unusual per se, the delegation of certification over such a system was felt to be dubious. Anonymous sources at the FAA had reported that they were repeatedly pressured to delegate to Boeing, which was under commercial pressure and needed the 737 to become certified quickly.
- The system had potentially been mis-rated - it was rated as "hazardous" (capable of causing hazard upon malfunction) rather than "catastrophic" (potential catastrophic consequences of failure).
- The system relied on a single sensor, which was unusual and inappropriate for a system rated "hazardous", and certainly incorrect if the system should have been rated catastrophic.
- The system was certified for corrections of up to 0.6 degrees. But by the time the 737 MAX was operational, it was discovered that larger corrections were needed, and the system was modified in production to allow 2.5 degrees of control of the vertical tail. This was 50% of its maximum 5-degree correction and a range over 4 times as large as that certified. As well as being an uncertified range, this meant that the system could quickly impose a vertical correction to the same 5 degree vertical extent that the pilots could. There was no scope for human control beyond this.
- Regulators and airlines were only informed of the greatly increased range after the Lion Air crash. Until that time, it had been understood that the system limit was 0.6 degrees of correction. An FAA engineer is quoted as stating that "The FAA believed the airplane was designed to the 0.6 limit, and that’s what the foreign regulatory authorities thought, too. It makes a difference in your assessment of the hazard."
- Boeing's certification appeared to overlook the fact that the system could reset, and then reapply further repeated corrections.
- The MCAS system was only supposed to operate in "extreme" situations, and therefore pilots were not specifically trained on it or informed much about it. The report states that "Boeing decided that 737 pilots needed no extra training on the system — and indeed that they didn’t even need to know about it. It was not mentioned in their flight manuals [...] Minimizing MAX pilot transition training was an important cost saving."