The crash of the Boeing 737 Max-8 Lion Air flight 610 on October 29, 2018, and the crash of the Ethiopian Max-8 Flight 409 on March 10, 2019, resulted in the grounding of all the Boeing 737 Max series aircraft – even the last hold-out, the United States, belatedly grounded them when President Trump acted and overruled the Federal Aviation Administration (FAA) that opposed any halt to flights.

In the United States, the FAA certifies aircraft as airworthy, puts out bulletins and advisories on problems and fixes and often is the “go to” agency for many aviation flight authorities around the world.

The 737 Max series is a new version of the venerable 737, equipped with new engines and other modifications that have impacted the aircraft’s performance in good ways and bad.

Almost every expert today puts the blame for both flight disasters on faulty software that took over running the plane’s flight control system. Many have pointed to Boeing’s alleged lack of transparency in telling pilots what to do if the software malfunctioned. In addition, there had been at least eight pilot-reported flight control incidents prior to the first Lion Air crash.

Experienced pilots

Three of the pilots on the two doomed planes each had more than 8,000 hours flying experience – quite a lot – and the pilots of the Ethiopian airlines had additional information on the plane’s flight characteristics and what to do in an emergency.

While we are still awaiting a final report on last year’s Lion Air crash, we do have a quite informative initial report, although it lacks hard findings. In the Ethiopian case, we only have flight track information from ground radar and some incomplete reporting on what the pilots were saying to ground control. More will become available as the flight recorders are analyzed.

Yet despite this, we can understand some of what happened and clearly it is more than a single software glitch. This may help explain why Boeing did not meet its proposed deadline of January for installing updated software. Now in March Boeing says the replacement software will be available in April. But even if it is, there are more issues involving both hardware and software.

The software which so far has received virtually all the attention is called MCAS, for Maneuvering Characteristics Augmentation System. MCAS was added to the Max-8 series because new, heavier and larger engines replaced the old engines and as a result, the updated Max planes had a strong tendency to pitch nose up.

The new engine, CFM Leap-1B, was selected by Boeing because it was much more fuel efficient than the older models, one of the big reasons customers want the 737 Max.

The new engines forced re-engineering of parts of the 737.

Fitting the new engines meant moving them forward and lengthening the front landing gear to keep the engines from scraping on the ground. In turn, this changed the plane’s center of gravity and also altered the air flow on the wings.

MCAS was a band-aid to fix the pitch up problem caused by the relocated and heavier new engines. MCAS is designed to push the nose down and prevent the aircraft from going into a stall. MCAS was intended to deal only with a specific flight risk.

The problems

Here are some of the problems one finds when reviewing the Preliminary Air Accident Investigation Report on the Lion Air crash.

1. MCAS operates by receiving information from a special sensor that measures the flying angle of the plane and takes over the flight controls if the angle is too great – meaning the aircraft could stall. A stall happens when a plane has too low an airspeed and not enough lift and the plane will literally fall out of the air.

There are two sensors that measure the angle of attack or nose-up condition of the Boeing 737 Max, one that provides data to the pilot and another that provides data to the copilot. The sensors are known as Angle of Attack Sensors, or AoA.

In the Lion Air aircraft, the pilot’s AoA sensor had been found to be faulty on an earlier flight as reported by the pilot. That AoA sensor was replaced and tested by aircraft maintenance before the fatal flight.

The pilot gets no console or other warnings that his AoA sensor might be faulty. The pilot can ask his copilot what reading he is getting and see if there is a difference. That is exactly what happened on the Lion Air flight.

It would appear that the MCAS software is driven by information from the pilot’s sensor. If the sensor itself is not at fault, there could still be wiring and connection problems that could feed bad information to MCAS. These conditions cannot be determined in flight.

If it is true that MCAS relies on information from only one sensor, that could be a design error. Modern aircraft are famous for built-in flight system redundancy, but apparently not in the case of MCAS. In addition, the pilot cannot manually change the MCAS choice of sensor.

2. No one has yet explained why the pilot’s stick shaker was running on from the start of the flight and never stopped. The stick shaker is a motor with an unbalanced flywheel that is attached to the pilot’s control stick, and another is attached to the co-pilot’s stick. The stick shaker is supposed to warn the pilot of a potential stall. But why was it on nearly the whole time?  And why was the co-pilot’s stick shaker not on?

3. The pilots are supposed to be able to shut down MCAS, which only operates when the aircraft is manually operated, by switching the electronic trim control to off. The trim control is what MCAS uses to change the nose pitch of the 737 Max. But in the Lion Air case, we know the pilots turned off the electronic trim control. But MCAS kept adjusting the trim nose down, against the pilots’ wishes. Or possibly something else was driving the trim control nose down, such as a shorted circuit or bad wiring.

4. The pilots also tried turning the aircraft’s autopilot on, according to the report. MCAS is only supposed to work when the autopilot is off, that is only when the plane is operated under manual pilot control. The autopilot should have disabled MCAS but apparently it did not – in fact, the Lion Air autopilot would not turn on. There is no explanation for this. Was the autopilot locked out by MCAS? Or was there some other software or hardware foul up?

5. Pilots also had a very difficult time handling the aircraft stick, meaning that the flight control stick required a great deal of force to operate, especially when the pilots were, repeatedly, trying to recover the plane that was headed nose down, gaining speed and losing altitude. Stick force “feel” in 737s is artificial and is controlled by a couple of pitot tube sensors at the rear of the aircraft above the horizontal stabilizer.

There have been repeated problems on older 737s with the planes forward and rear pitot tubes, due partly to icing conditions and to pitot tube heater problems which are supposed to remove ice. Some pitot tubes have failed because of fouling. Pitot tubes detect aircraft speed and they do this by comparing the force of incoming air on the pitot tubes to what are called static ports located elsewhere on the plane. Accidents have been attributed to faulty or fouled pitot tubes.

It is not clear how the flight speed information from the pitot tubes is integrated into the MCAS if it is. But speed information is fed into the flight computer and if it is faulty it could create ambiguities in the MCAS and the flight computer.

6. Would better pilot training have helped pilots avoid disaster? Boeing has been criticized for not initially providing information about MCAS to Max pilots, and only later issuing a bulletin on how to deal with some MCAS anomalies. Boeing also apparently did not offer any additional pilot training, leaving pilots to find their way through a morass of complex problems made worse by possible hardware and software faults.

As it is, it appears the Lion Air pilots acted in the best way they could but were unable to overcome the instability of the aircraft as it headed nose down to disintegrate in the ocean. We don’t yet know how the Ethiopian Airline pilots performed, but they had the advantage of advisories from Boeing and the FAA. Still, the same final result.

What is clear is that there is more than one single cause for the two aircraft crashes. And we know that other planes experienced control problems but recovered. These disasters suggest there was a complex of problems that caused the two disasters.

Boeing’s engineers need to assess the entire flight control system, the electronics and mechanics, before a satisfactory solution is at hand.