USA TODAY International Edition
Our view: What we've got here is a failure to communicate
“Know your airplane, fly your airplane” is a bedrock principle for pilots.
But pilots can’t know their airplane if the maker fails to disclose a new emergency feature in its flight operations manual, as happened with the Boeing 737 Max.
On Oct. 29, the feature, known by the acronym MCAS, relentlessly pushed down the nose of Indonesia’s Lion Air Flight 610 more than 20 times before the jet plunged into the Java Sea, killing all 189 on board.
Pilots struggled against the new system, which is designed to prevent a stall by automatically pushing the nose down. Tragically, on Flight 610 it was apparently triggered by a sensor delivering a false reading.
The 737 Max, Boeing’s newest version of the workhorse 737 series, is flown by airlines around the world, including American, Southwest and United. Hundreds more are on order. Since the Lion Air crash, American and Southwest pilots have complained about Boeing’s failure to communicate.
“The key to any emergency is identifying the system that is betraying you or failed,” says Dennis Tajer, a veteran 737 captain and spokesman for the Allied Pilots Association, which represents pilots at American. “We did not know about the system” until after the Lion Air crash. It was not on previous versions of the 737. Jon Weaks, president of the Southwest Airlines Pilots Association, put it simply: “We should have known the system existed.”
With all the safety built into today’s jetliners, it typically takes a cascading series of events to bring down a plane. Based on a preliminary report released last week by Indonesian authorities and questions raised by safety experts, the final flight of Lion 610 is a textbook example of multiple failures.
Investigators will need to get to the bottom of several issues involving:
Boeing. A potential design or manufacturing flaw might have allowed a single sensor, with an erroneous reading, to trigger MCAS — which stands for Maneuvering Characteristics Augmentation System — and the nose-down movements. Two sensors on the jet were measuring what’s known as angle of attack, “one giving you an accurate reading, one inaccurate,” says former National Transportation Safety Board Chair Mark Rosenker. “The problem was the inaccurate one appeared to take over.” He questioned why a single malfunctioning sensor could create a situation potentially leading to a catastrophic failure. The answer might be that it shouldn’t.
Days after the crash, Boeing issued a bulletin telling 737 Max pilots to deal with erroneous sensor data and nosedown movements by turning off the automatic system, in accordance with “existing procedures.” A Federal Aviation Administration directive followed, warning that faulty readings could cause “difficulty controlling” the plane and “possible impact with terrain.”
Lion Air. The day before the crash, Lion Air maintenance replaced the sensor on the same plane. But pilots got erroneous readings on that flight and experienced a nearly identical problem to the one on Flight 610. Was the sensor installed properly by company crews? Based on the serious problems on Oct. 28, should the plane have been grounded before the fatal flight?
Flight 610 pilots. On the Oct. 28 flight, pilots initially reacted to the nose-down movements the same way as pilots on Flight 610 the next day. When that didn’t work, they used two switches to cut off the system — a standard emergency procedure. Oddly, the pilots on Flight 610 failed to do the same thing. Perhaps, faced by an inaccurate reading from a faulty sensor and a system they likely knew nothing about, they were confused in the emergency. Perhaps they were not well-trained.
The causes of the crash will be determined by Indonesian authorities and the U.S. National Transportation Safety Board, which has an interest in keeping American fleets safe.
Boeing issued a statement asserting, “We are confident in the safety of the 737 MAX.” A company spokesman added that the “function performed by MCAS is referenced” in the flight manual, and “existing procedures” to deal with it are documented. The chairman of the United Airlines branch of the Airline Pilots Association echoed that statement, breaking with two other unions and his own union leadership.
Backup systems, what the industry calls redundancy, are designed to keep planes in the air if one component fails. The ultimate safety backups are the pilots — who deserve to know about every change on the aircraft they fly.