JETLINER CRASH HAS MANY UNRESOLVED ISSUES

are examining Lion Air’s history of maintenance problems.

But the tragedy has become a focus of intense interest and debate in aviation circles because of another factor: the determination by Boeing and the FAA that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that new engines could stall under certain conditions.

That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it appears to have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash: faulty data erroneously indicating the plane was flying at a dangerous angle, leading the flight control system to repeatedly push the plane’s nose down.

Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max more than seven years ago, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.

Those decisions ultimately prompted the company, regulators and airlines to conclude that training or briefing pilots on the change to the flight control system was unnecessary for carrying out well-established emergency procedures.

The story of the change to that system, and how it came to play a central role in the Lion Air crash, shows how safety on modern jetliners is shaped by a complex combination of factors, including fierce industry competition, technological advances and pilot training. It illustrates how, in the rare instances when things go awry, the interplay of those factors can create unintended and potentially fatal consequences.

The crash has raised questions about whether Boeing played down or overlooked, largely for cost and competitive reasons, the potential dangers of keeping pilots uninformed about changes to a critical element of the plane’s software.

And it has put a new focus on whether the FAA has been aggressive enough in monitoring Boeing in an era when technology has made airliners both remarkably reliable and increasingly complicated.

Boeing has taken the position that the pilots of the Lion Air flight should have known how to handle the emergency despite not knowing about the modification. The company has maintained that properly following established emergency procedures — essentially, a checklist — long familiar to pilots from its earlier 737s should have allowed the crew to handle a malfunction of the maneuvering characteristics augmentation system, known as MCAS, whether they knew it was on the plane or not.

Boeing plans to release a software upgrade for the 737 Max, according to a person briefed on the matter, though it is not clear how the upgrade will affect MCAS. Boeing said it “continues to evaluate the need for software or other changes as we learn more from the ongoing investigation.”

The FAA acknowledged that its own role was being examined.

“The FAA’S review of the 737 Max’s certification is a part of an ongoing investigation with the NTSB and Indonesian civil aviation authorities,” the agency said in a statement, referring to the National Transportation Safety Board. “We cannot provide details of that review until the investigation is complete.”

Boeing’s position has left many pilots angry and concerned.

“Any time a new system is introduced into an airplane, we are the people responsible for that airplane,” said Jon Weaks, president of the Southwest Airlines Pilots Association.

Saving airlines time and money

In designing the 737 Max, Boeing was selling airlines on the aircraft’s fuel savings, operating cost reductions and other improvements. At the same time, it was trying to avoid wholesale aerodynamic and handling changes that would spur the FAA to determine that existing 737 pilots would need substantial new training.

Internally, a primary requirement for the Max was that no design change could cause the FAA to conclude that pilots must be trained on the system differences between the then-current version of the plane, the 737 NG, and the Max using simulators, said Rick Ludtke, a flight crew operations engineering analyst who was involved in devising some of the other new safety features on the 737 Max.

By limiting the differences between the models, Boeing would save airlines time and money by not putting their 737 pilots in simulators for hours to train on the new aircraft, making a switch more appealing.

“Part of what we wanted to accomplish was seamless training and introduction for our customers, so we purposely designed the airplane to behave in the same way,” Dennis Muilenburg, Boeing’s chief executive, told CNBC in December in response to a question about whether the company wanted to hold down training costs. “So even though it’s a different airplane design, the control laws that fly the airplane are designed to make the airplane behave the same way in the hands of the pilot.”

But Boeing’s engineers had a problem. The new engines for the Max were larger than those on the older version, so they needed to be mounted higher and farther forward on the wings to provide adequate ground clearance.

Early analysis revealed that the bigger engines, mounted differently than on the previous version of the 737, would have a destabilizing effect on the airplane, especially at lower speeds during high-banked, tight-turn maneuvers, Ludtke said.

The concern was that an increased risk of the nose being pushed up at low airspeeds could cause the plane to get closer to the angle at which it stalls, or loses lift, Ludtke said.

Boeing decided to add a new program — what engineers described as essentially some lines of code — to the aircraft’s flight control system to counter the destabilizing pitching forces from the new engines.

That program was MCAS. MCAS, according to an engineer familiar with the matter, was written into the control law, the umbrella operating system that, among other things, keeps the plane in “trim,” or ensures that the nose is at the proper angle for the plane’s speed and trajectory. In effect, the system would automatically push the nose down if it sensed that the plane’s angle was creating the risk of a stall.

The modified system’s first task was to automatically offset the stall risk created by the change in the size and location of the engines.

“MCAS was necessary then for the airplane to be certified by the FAA to have met all of the regulatory design requirements for stability and control,” Ludtke said.

In addition to addressing safety, MCAS also let the plane handle much like its predecessors from a pilot’s perspective. In assessing whether existing 737 pilots would need to spend hours training on simulators to fly the Max, the FAA would take into account how similarly the two versions handled.

FAA sides with Boeing

Ultimately, the FAA determined that there were not enough differences to require pilots to go through simulator training.

While the agency did require pilots to be given less onerous training or information on a variety of other changes between the two versions of the plane, MCAS was not among those items either.

The bottom line was that there was no regulatory requirement for Boeing or its airline customers to flag the changes in the flight control system for its pilots — and Boeing contended that there was no need, since, in the company’s view, the established emergency procedures would cover any problem regardless of whether it stemmed from the original system or the modification.

At least as far as pilots knew, MCAS did not exist, even though it would play a key role in controlling the plane under certain circumstances.

Boeing did not hide the modified system. It was documented in maintenance manuals, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737.

Among the many unanswered questions raised by the crash is the degree to which Boeing and the FAA considered what would happen in the event that MCAS — or the sensors that fed the system information about the plane — were to malfunction.

In the Lion Air crash, one of the primary theories is that the system was receiving faulty data about the angle of the plane from what is known as an angle of attack sensor, vanelike devices on either side of the fuselage that measure how much the plane’s nose is pointing up or down. Preliminary findings from the investigation suggested that the sensor on the pilot’s side of the plane was generating erroneous data.

The stabilizers on older models could have moved in unpredictable and dangerous ways as well, because of factors like electrical shorts, bad sensor data or computer problems. Boeing reasoned, according to people the company has briefed, as well as a bulletin it sent airlines after the crash, that the emergency procedure for malfunctioning speed trim and other stabilizer problems on the earlier 737s would work on the Max for problems related to MCAS, too.

The centerpiece of that procedure is to switch off two “stabilizer trim cutout” switches on the central console of the cockpit, and then flip open the handles on wheels near the knees of the captain and first officer. By cranking those wheels, the pilots can adjust the stabilizers manually in an effort to keep the plane from pitching up or down.

The role of pilots

At the heart of the debate is whether the pilots would have responded differently if they knew the plane’s nose was being forced down specifically by MCAS.

Information from the flight data recorder shows that the plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If MCAS was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.

The preliminary results of the investigation, based on information from the flight data recorder, suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included activating switches on the control yoke that control the angle of the stabilizers on the plane’s tail — and when that failed to stop the problem, pulling back on the yoke.

There is no indication that they tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could establish in more detail what culpability, if any, rests with the Lion Air pilots.

Boeing’s position that following the established emergency checklist should have been sufficient understates the complexity of responding to a crisis in real time, pilots said.

Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”

Still, Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”