Behind the Lion Air Crash, a Trail of Decisions Kept Pilots in the Dark
In the brutally competitive jetliner business, the announcement in late 2010 that Airbus would introduce a more fuel-efficient version of its best-selling A320 amounted to a frontal assault on its archrival Boeing’s workhorse 737.
Boeing scrambled to counterpunch. Within months, it came up with a plan for an upgrade of its own, the 737 Max, featuring engines that would yield similar fuel savings. And in the years that followed, Boeing pushed not just to design and build the new plane, but to persuade its airline customers and, crucially, the Federal Aviation Administration, that the new model would fly safely and handle enough like the existing model that 737 pilots would not have to undergo costly retraining.
Boeing’s strategy set off a cascading series of engineering, business and regulatory decisions that years later would leave the company facing difficult questions about the crash in October of a Lion Air 737 Max off Indonesia.
The causes of the crash, which killed 189 people, are still under investigation. Indonesian authorities are studying the cockpit voice recorder for insights into how the pilots handled the emergency, and are examining Lion Air’s long history of maintenance problems.
But the tragedy has become a focus of intense interest and debate in aviation circles because of another factor: the determination by Boeing and the F.A.A. that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.
That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it appears to have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash: faulty data erroneously indicating that the plane was flying at a dangerous angle, leading the flight control system to repeatedly push the plane’s nose down.
Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max more than seven years ago, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.
Those decisions ultimately prompted the company, regulators and airlines to conclude that training or briefing pilots on the change to the flight control system was unnecessary for carrying out well-established emergency procedures.
The story of the change to that system, and how it came to play a central role in the Lion Air crash, shows how safety on modern jetliners is shaped by a complex combination of factors, including fierce industry competition, technological advances and pilot training. It illustrates how, in the rare instances when things go awry, the interplay of those factors can create unintended and potentially fatal consequences.
The crash has raised questions about whether Boeing played down or overlooked, largely for cost and competitive reasons, the potential dangers of keeping pilots uninformed about changes to a critical element of the plane’s software.
And it has put a new focus on whether the F.A.A. has been aggressive enough in monitoring Boeing in an era when technology has made airliners both remarkably reliable and increasingly complicated. European regulators initially disagreed with the F.A.A.’s judgment about the need for additional training but ultimately went along, a pilot familiar with the certification process said, while regulators in Brazil broke with the F.A.A. and required that pilots be made familiar with the change.
Boeing has taken the position that the pilots of the Lion Air flight should have known how to handle the emergency despite not knowing about the modification. The company has maintained that properly following established emergency procedures — essentially, a checklist — long familiar to pilots from its earlier 737s should have allowed the crew to handle a malfunction of the so-called maneuvering characteristics augmentation system, known as M.C.A.S., whether they knew it was on the plane or not.
Boeing said that various systems on both the Max and its previous generation 737 can push the nose down. “Regardless of cause,” the company said, the flight crew should go through the checklist, “which is contained in existing procedures.”
The company said that in developing training materials for the 737 Max, it followed long-established practices. “The process ensures flight crews have all the information to safely operate the airplane,” Boeing said, “and for maintenance and fleet chiefs to understand how to ensure the airplanes are serviceable.”
But in the aftermath of the crash, Boeing plans to release a software upgrade for the 737 Max, according to a person briefed on the matter, though it is not clear how the upgrade will affect M.C.A.S. Boeing said that it “continues to evaluate the need for software or other changes as we learn more from the ongoing investigation.”
The F.A.A. declined to comment about the crash but acknowledged that its own role was being examined.
“The F.A.A.’s review of the 737 Max’s certification is a part of an ongoing investigation with the N.T.S.B. and Indonesian civil aviation authorities,” the agency said in a statement, referring to the National Transportation Safety Board. “We cannot provide details of that review until the investigation is complete.”
Boeing’s position has left many pilots angry and concerned.
“Any time a new system is introduced into an airplane, we are the people responsible for that airplane,” said Jon Weaks, the president of the Southwest Airlines Pilots Association.
Referring to the addition of M.C.A.S., Mr. Weaks added, “We felt and we feel that we needed to know about that, and there’s just no other way to say it.”
John Barton, a 737 captain who spoke on the condition that the airline he flies for not be identified, said the blame started with Boeing and the F.A.A. but extended to airlines and pilot unions.
“Many pilots feel the training was inadequate, and therefore it appears to me that Boeing, the F.A.A., the airline training centers and possibly the unions themselves are culpable for the incident that happened,” he said.
Saving Airlines Time and Money
In designing the 737 Max, Boeing was selling airlines on the aircraft’s fuel savings, operating cost reductions and other improvements. But at the same time, it was trying to avoid wholesale aerodynamic and handling changes that would spur the F.A.A. to determine that existing 737 pilots would need substantial new and time-consuming training.
Internally, a primary requirement for the Max was that no design change could cause the F.A.A. to conclude that airline pilots must be trained on the system differences between the then-current version of the plane, the 737 NG, and the Max using simulators, said Rick Ludtke, a flight crew operations engineering analyst who was involved in devising some of the other new safety features on the 737 Max.
By limiting the differences between the models, Boeing would save airlines time and money by not putting their 737 pilots in simulators for hours to train on the new aircraft, making a switch to the Max more appealing.
“Part of what we wanted to accomplish was seamless training and introduction for our customers, so we purposely designed the airplane to behave in the same way,” Dennis A. Muilenburg, Boeing’s chief executive, said on CNBC in December in response to a question about whether the company wanted to hold down training costs. “So even though it’s a different airplane design, the control laws that fly the airplane are designed to make the airplane behave the same way in the hands of the pilot.”
But Boeing’s engineers had a problem. Because the new engines for the Max were larger than those on the older version, they needed to be mounted higher and farther forward on the wings to provide adequate ground clearance.
Early analysis revealed that the bigger engines, mounted differently than on the previous version of the 737, would have a destabilizing effect on the airplane, especially at lower speeds during high-banked, tight-turn maneuvers, Mr. Ludtke said.
The concern was that an increased risk of the nose being pushed up at low airspeeds could cause the plane to get closer to the angle at which it stalls, or loses lift, Mr. Ludtke said.
After weighing many possibilities, Mr. Ludtke said, Boeing decided to add a new program — what engineers described as essentially some lines of code — to the aircraft’s existing flight control system to counter the destabilizing pitching forces from the new engines.
That program was M.C.A.S.
M.C.A.S., according to an engineer familiar with the matter, was written into the so-called control law, the umbrella operating system that, among other things, keeps the plane in “trim,” or ensures that the nose is at the proper angle for the plane’s speed and trajectory. In effect, the system would automatically push the nose down if it sensed that the plane’s angle was creating the risk of a stall.
Both M.C.A.S. and the so-called speed trim system — the automatic stabilizer controls used on the 737 NG and earlier versions — operate primarily via the horizontal section of the 737’s tail fin, which consists of a relatively narrow “elevator” in the back and a larger surface called a stabilizer in the front. In manual flight, pilots move the nose up and down by pulling or pushing on a control column, also called a yoke, to pivot the elevator one way or the other.
Ordinarily, the stabilizers accomplish a more subtle task, making sure that the up or down forces on the tail keep the plane balanced around its center of gravity. Either pilot can control the stabilizers electrically using switches at the top of the yoke.
M.C.A.S. was written to use the stabilizers in a different way.
The modified system’s first task was to automatically offset the stall risk created by the change in the size and location of the engines.
“M.C.A.S. was necessary then for the airplane to be certified by the F.A.A. to have met all of the regulatory design requirements for stability and control,” Mr. Ludtke said.
In addition to addressing safety, M.C.A.S. also let the plane handle much like its predecessors from a pilot’s perspective. In assessing whether existing 737 pilots would need to spend hours training on simulators to fly the Max, the F.A.A. would take into account how similarly the two versions handled.
Boeing said that the modification “improves aircraft handling characteristics” and decreases “pitch-up tendency” only in unusual circumstances. “It does not control the airplane in normal flight,” the company said.
The F.A.A. would also determine what kind of training would be required for pilots on specific design changes to the Max compared with the previous version. Some changes would require training short of simulator time, such as computer-based instruction.
“I would think this is one of those systems that the pilots should know it’s onboard and when it’s activated,” said Chuck Horning, the department chairman for aviation maintenance science at Embry-Riddle Aeronautical University.
That was not the choice that Boeing — or regulators — would make.
The F.A.A. Sides With Boeing
Ultimately, the F.A.A. determined that there were not enough differences between the 737 Max and the prior iteration to require pilots to go through simulator training.
While the agency did require pilots to be given less onerous training or information on a variety of other changes between the two versions of the plane, M.C.A.S. was not among those items either.
The bottom line was that there was no regulatory requirement for Boeing or its airline customers to flag the changes in the flight control system for its pilots — and Boeing contended that there was no need, since, in the company’s view, the established emergency procedures would cover any problem regardless of whether it stemmed from the original system or the modification.
At least as far as pilots knew, M.C.A.S. did not exist, even though it would play a key role in controlling the plane under certain circumstances.
Boeing did not hide the modified system. It was documented in maintenance manuals for the plane, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737.
But the F.A.A.’s determination that the system did not have to be flagged for pilots gave pause to some other regulators.
Across the Atlantic, the European Aviation Safety Agency, the European Union’s equivalent of the F.A.A., had qualms, according to a pilot familiar with the European regulator’s certification process.
At first, the agency was inclined to rule that M.C.A.S. needed to be included in the flight operations manual for the Max, which in turn would have required that pilots be made aware of the new system through a classroom or computer course, the pilot said. But ultimately, he said, the agency did not consider the issue important enough to hold its ground, and eventually it went along with Boeing and the F.A.A.
When Brazilian regulators published their required training for pilots, they singled out M.C.A.S. as one of the changes that needed to be flagged.
The F.A.A. said that “other countries base their standards on conditions specific and unique to each nation.”
Among the many unanswered questions raised by the crash is the degree to which Boeing and the F.A.A. considered what would happen in the event that M.C.A.S. — or the sensors that fed the system information about the plane — were to malfunction.
In the Lion Air crash, one of the primary theories is that the system was receiving faulty data about the angle of the plane from what is known as an angle of attack sensor, vanelike devices on either side of the fuselage that measure how much the plane’s nose is pointing up or down. Preliminary findings from the investigation suggested that the sensor on the pilot’s side of the plane was generating erroneous data.
In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight.
That decision kept the system simpler, but also left it vulnerable to a single malfunctioning sensor, or data improperly transferred from it — as appeared to occur on the day of the crash.
There is no evidence that Boeing did flight-testing of M.C.A.S. with erroneous sensor data, and it is not clear whether the F.A.A. did so. European regulators flight-tested the new version of the plane with normal sensor data feeding into M.C.A.S. but not with bad data, the pilot familiar with the European certification process said.
The stabilizers on older models could have moved in unpredictable and dangerous ways as well, because of factors like electrical shorts, bad sensor data or computer problems. Boeing reasoned, according to people the company has briefed, as well as a bulletin it sent airlines after the crash, that the emergency procedure for malfunctioning speed trim and other stabilizer problems on the earlier 737s would work on the Max for problems related to M.C.A.S., too.
The centerpiece of that procedure is to switch off two “stabilizer trim cutout” switches on the central console of the cockpit, and then flip open the handles on wheels near the knees of the captain and first officer. By cranking those wheels, the pilots can adjust the stabilizers manually in an effort to keep the plane from pitching up or down.
The Role of Pilots
At the heart of the debate is whether the pilots would have responded differently if they knew the plane’s nose was being forced down specifically by M.C.A.S.
Information from the flight data recorder shows that the plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If M.C.A.S. was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.
The standard checklist for dealing with that sort of emergency on the previous version of the 737 focuses on flipping the stabilizer trim cutout switches and using the manual wheels to adjust the stabilizers.
Boeing has asserted the pilots on the next-to-last flight of the same Lion Air aircraft that crashed encountered a similar, if less severe, nose-down problem. They addressed it by flipping off the stabilizer cutout switches, in keeping with the emergency checklist. Still, Indonesian investigators found, the pilots broke from the checklist by flipping the switches back on again before turning them off for the rest of the flight. That flight, with different pilots from the flight that crashed, landed safely.
Older 737s had another way of addressing certain problems with the stabilizers: Pulling back on the yoke, or control column, one of which sits immediately in front of both the captain and the first officer, would cut off electronic control of the stabilizers, allowing the pilots to control them manually.
That feature was disabled on the Max when M.C.A.S. was activated — another change that pilots were unlikely to have been aware of. After the crash, Boeing told airlines that when M.C.A.S. is activated, as it appeared to have been on the Lion Air flight, pulling back on the control column will not stop so-called stabilizer runaway.
The preliminary results of the investigation, based on information from the flight data recorder, suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included activating switches on the control yoke that control the angle of the stabilizers on the plane’s tail — and when that failed to stop the problem, pulling back on the yoke.
There is no indication that they tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could establish in more detail what culpability, if any, rests with the Lion Air pilots.
Boeing’s position that following the established emergency checklist should have been sufficient understates the complexity of responding to a crisis in real time, pilots said.
Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, the spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”
Still, Mr. Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”
The pilot of the plane’s next-to-last flight, in his entry into an electronic log, noted a variety of problems he had encountered, and speculated that the plane’s speed trim system — the stabilizer functions used on the 737 NG and earlier versions — was not operating correctly. But no one involved in that next-to-last flight of the doomed plane flagged M.C.A.S. or seems to have recognized that it might have been the root of that flight’s problems.
“It really tells you what professional pilots, having flown this very aircraft for the past 10 years, are feeling,” said Bjorn Fehrm, an aeronautical engineer and former fighter pilot for the Swedish air force, referring to the previous generation 737. “They have no idea Boeing has introduced something new.”
