Illustration of a 737 MAX in flight
Mark Nowlin / The Seattle Times

Two tragic flights, 12 problems

By Seattle Times staff

Published Oct. 27, 2019

Lion Air Flight 610

Lion 610

Oct. 29, 2018

Ethiopian Airlines Flight 302

Ethiopian 302

March 10, 2019

The flights were eerily similar, just minutes long, with pilots engaged in a terrifying battle against an automated safety system that ultimately sent the 737 MAX jets plunging to earth.

But the journeys of Lion Air 610 and Ethiopian Airlines 302 also contained some stark differences. The pilots in the second crash had the lessons of the first, with new guidelines from Boeing and the FAA. They tried to follow instructions for recovering the jet. It still wasn’t enough.

We’ve written before about competitive pressures that resulted in a rush to build the MAX, the flawed analysis behind the new, automated system called MCAS (Maneuvering Characteristics Augmentation System), the FAA’s shift to delegating certification tasks to Boeing, and internal pressures at Boeing to advance planes to completion.

Here, we examine the arc of the two tragic flights, tracking the movements of pilots and the details of flight-deck data through critical seconds.

Before takeoff

Problem 1

Even before takeoff with 189 people on board, the data on Lion Air 610 showed evidence of a problem. As the plane taxied, the two angle-of-attack (AOA) sensors on the nose of the jet recorded starkly different values. The left sensor was clearly wrong — the plane was still on the ground — but the aircraft didn’t recognize the discrepancy.

Angle-of-attack readings JT610

The angle of attack is the angle between the wing and the airflow. The sensors include vanes that align themselves with oncoming airflow. The angle of the vane changes as the plane’s nose rises or falls.

Two planes. One is in level flight, so the vane in the angle-of-attack sensor is horizontal. The second plane is in nose-up flight, so oncoming airflow causes the vane to point downward, at an angle.

Problem 2

Those sensors are critical. While some airplanes, particularly those from Boeing rival Airbus, have three such sensors that can work with one another in the case of an erroneous value, Boeing’s 737 MAX has just two, and the aircraft used only one of those sensors to trigger a new automated system — MCAS — that would force the nose of the plane down if the sensor indicated a potential stall. Records also show that previous flights of this aircraft had problems with the angle-of-attack sensor.

The first minutes

Immediately after takeoff, the Lion Air plane began giving the pilots warnings as a result of the faulty sensor. The captain’s control stick began shaking, an indicator of a potential stall. The crew asked ground controllers to confirm their altitude and airspeed, due to disagreements on their instruments caused by the same faulty angle-of-attack sensor. They reported problems with the flight controls.

After climbing above 2,000 feet, the pilots retracted the flaps on the wings. The MCAS system, which the crew was unaware of, is designed to turn on once the flight crew retracts the flaps and disengages the autopilot. Seconds later, just a couple of minutes into the flight, the MCAS safety system engaged, pushing the nose down. The plane descended.

An airplane with its horizontal tail pointed up, causing its nose to turn down.

The pilots were able to regain control of their ascent by extending the wing flaps again, preventing MCAS from engaging. But it wouldn’t be long before the crew was ready to retract the flaps again.

On Ethiopian Airlines Flight 302, with 157 on board, there was no sign of a problem before takeoff. Flight data shows the angle-of-attack sensors tracking each other identically. That stayed consistent while the plane was on the ground, but it was about to change, just not in the same way that it did on Lion Air 610.

Chart showing disagreement between the left and right angle-of-attack sensors

Shortly after takeoff, Ethiopian 302's angle-of-attack sensors recorded a sudden disagreement. It’s unclear what caused the fault, though the suddenness and severity of the change suggests a bird strike may have cut off one of the AOA vanes, which protrude from the front of the plane.

Two angle-of-attack sensors are located on the front of the 737 MAX, near the nose.

Problem 3

The plane’s left sensor, the one that apparently controlled the MCAS system, recorded an angle of attack at 74.5 degrees — far higher than would be conceivable. A stall would typically be a risk before 20 degrees.

The sensor’s value remained stuck. But even though the sensor was no longer showing even slight fluctuations and was stuck at an inconceivable value, MCAS continued considering it valid data.

At 8:38am, the left and right angle-of-attack sensors began to record different values.

Problem 4

This set off a cascade of warning indicators in both cockpits — airspeed, altitude and stall — for the pilots to consider. The MAX was supposed to come with an indicator to tell the pilots that there was a disagreement between the two angle-of-attack sensors. However, due to a software glitch that Boeing discovered back in 2017 but hadn’t fixed, that light wasn’t actually functional for most customers, including both Lion Air and Ethiopian Airlines.

Photo of cockpit
Dimas Ardian / Bloomberg

MCAS kicks in

Problem 5

After ascending to 5,000 feet, the Lion Air pilots retracted their flaps again. The MCAS system soon reactivated, turning the plane’s nose down. Flight data shows the pilots manually countering the MCAS system, using electrical thumb switches on the control column to bring the nose of the plane back up.

But instead of shutting off and ceding control to the pilots, MCAS repeatedly engaged. Over the next seven minutes, MCAS pushed the plane down more than two dozen times. By using the electric trim power, accessible by thumb switches on the yoke, and by pulling back on the control column, the pilots were able to move the nose back up.

Diagram shows Lion Air pilots’ repeated nose-up commands, alongside repeated nose-down commands from the automatic anti-stall system, MCAS

Problem 6

While MCAS moved the jet nose down with substantial power, Boeing had determined that pilot training was not necessary for the system and MCAS was not included in the pilot manual.

Boeing believed pilots would consider repeated nose-down commands to be similar to a runaway stabilizer, for which there is a cockpit checklist. But the pilots appear to have not interpreted their readings that way and fixated on other issues: They asked ground controllers to help determine their altitude because those readings were haywire due to the faulty sensor.

Problem 7

Five seconds after the Ethiopian pilots disengaged the autopilot, MCAS took control. The system moved the trim down 2.5 units, sending the plane into descent. As first reported in The Seattle Times, FAA officials believed, based on Boeing’s initial system safety assessment of the MAX aircraft, that MCAS was only supposed to be able to move the trim by 0.6 units, not 2.5.

Diagram shows MCAS moving the plane’s trim down. The automatic adjustments start about a minute after takeoff, and repeat.

Problem 8

In addition, because MCAS repeatedly engaged, it effectively acted with unlimited power. The pitch of the jet is marked on a scale that’s visible on the stabilizer trim wheel beside the throttles. On this scale, 0 is maximum nose-down pitch and 4.7 is level flight. The green band on the wheel shows the range of where the pitch should be in normal flight. At one point in the Ethiopian 302 flight, MCAS pushed the stabilizer to just 0.4 units, a severe nose-down pitch.

Then, just 35 seconds after the sudden takeover of MCAS, the pilots appeared to have relied on Boeing guidance on how to shut it off. The first officer called out “stab trim cutout” two times. The captain agreed, so the crew flipped the two “Stab Trim” cutout switches (seen at bottom right) to block electric movements of the horizontal tail.

Cockpit of the 737 MAX cockpit
Dimas Ardian / Bloomberg

The fight to save the plane

After more than five minutes of battling the plane, the repeated efforts by the Lion Air pilots broke down. They had been talking with ground controllers about their direction and plans, then the second-in-command asked for a new direction to apparently avoid some weather. Just 11 seconds later, the pilot asked for help determining the altitude again.

Data from the report shows that the captain successfully countered MCAS more than 20 times. However, the data suggests the first officer then took over, perhaps to let the captain figure out what was happening. The plane then responded to two further nose-down commands with only short flicks of the thumb switches, which failed to fully counter the movement. That sent the plane’s trim further down.

Problem 9

Separate data released to the Indonesian parliament shows the pilots desperately pulling the control column back. On the previous 737 model and other Boeing planes, a pilot pulling back hard on the column would trigger a cutout switch that would halt automatic commands in the opposite direction. In order to make MCAS work, Boeing had to disable that feature when the new flight control system was active.

Diagram shows increasing force on the control columns.

While the Ethiopian Airlines pilots had cut off the electric power that moved the horizontal tail, the tail was still in a position to pitch the nose down. The pilots pulled on the control column and continued ascending thanks to the elevator tabs on the trailing edge of the horizontal tail.

Airplane with the horizontal tail, at the rear of the plane, highlighted. Each side of the tail includes a stabilizer and an elevator.

The raised elevator tabs at the back and the leading edge of the horizontal tail swiveled upward form a sort of V shape that creates opposing nose-up and nose-down forces.

Diagram shows opposing forces on the tail end of the plane. Airflow on the horizontal stabilizer exerts upward force tilting the nose down. Airflow on the elevator forces the jet nose up. The opposing force on the jackscrew, from the elevator, resists manual efforts to swivel the stabilizer down.

Boeing’s previous 737 model had two separate cutout switches, one specifically for electric power to the automatic controls, the other for electrical power to the manual thumb switch on the control column. However, the option to operate these separately was never included in the manuals. And on the MAX, the two switches had identical functions. One primary and one backup, either one cut out all electric power, automatic and manual. Standard procedure was to flip both at once.

Two switches next to each other, labeled STAB TRIM
Dimas Ardian / Bloomberg

Problem 10

Having hit the cutout switches, the only way the Ethiopian crew could adjust the horizontal tail was to do it manually, by physically turning a wheel beside the pilot that is connected by cables to the back of the plane. The first officer tried but reported that it wasn’t working.

Boeing has described the shutoff of the trim as simple, but with the swiveled horizontal tail pushing nose down and the pilot-controlled elevator tabs on the back pushing nose up, the airflow can create substantial force that makes it physically challenging for pilots to move the wheel and swivel the trim manually.

Problem 11

Boeing’s emergency directive, issued after the Lion Air crash, included a line near the bottom that mentions a way to avoid high forces making the manual trim wheel hard to move. It says that pilots “can” use the electric trim switches on the control column to neutralize those forces before hitting the cutout switches.

But that was not emphasized as a necessary step to avoid disaster. It appears that the Ethiopian pilots, eager to stop MCAS quickly and avoid the fate of the Lion Air flight, jumped immediately to the cutout switches without the vital step of first using the thumb switches to ease the forces on the horizontal tail. That’s why they couldn’t move it manually.

Emergency instructions from the pilot manual. They say: “Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.

The final seconds

Just 31 seconds before the Lion Air crash, the pilot was still well aware of his surroundings, asking ground controllers to prevent other planes from flying near their altitude. When the controller asked their preferred altitude, the pilot responded: “five thou.” That was 19 seconds before the crash.

Problem 12

The pilot pulled on the control column with all possible force. But with the column only controlling the elevator tabs at the back of the horizontal tail, he was unable to fully counter the nose-down pitch from the MCAS swiveling of the larger portion of the horizontal tail.

Diagram shows increasing force on the control columns.

The airspeed rose.

The swiftness of the descent increased.

The pilots lost control.

Even in the doomed plummet, they yanked the control column in desperation. At 6:31:54 a.m., Lion Air Flight 610 nose-dived into the Java Sea at about 500 mph.

The Ethiopian Airline pilots inexplicably hadn’t throttled back the engines, which were still at takeoff power. As a result, the speed of the plane rose well above 400 mph — higher than the maximum design speed of the airplane. That triggered overspeed warnings in the cockpit that include an alarming clicking sound called a “clacker.” At that speed, the forces on the tail would have made it impossible to move manually.

The pilots were likely using sizable physical effort to keep the plane level by pulling back on the control column. They then made a call: Their efforts to keep the airplane pitch were not enough. They decided to re-engage the electric controls. With the electric power to the tail restored, they used the thumb buttons to trim the nose up — but, for some reason, not substantially, just two short flicks. One expert theorized that the plane’s high speed may have caused an alarming shudder when they moved the trim.

Diagram shows crew commands, on Ethiopian Airlines 302, moving the manual trim up while MCAS commands move the automatic trim down. After MCAS moves the plane’s trim down, altitude decreases quickly until abruptly, the data stops.

For a few seconds, they eased the descent. But with the electric power restored, MCAS now re-engaged.

The plane abruptly turned downward again with a force that would have pitched passengers off their seats. The plane dove steeper, faster.

Just 23 seconds after MCAS had re-engaged, Ethiopian Airlines Flight 302 — traveling at a speed approaching 600 mph — smashed into the ground at 8:43:43 a.m. The compact, deep crater in the earth indicated a near-vertical impact.


Reporting: Dominic Gates and Mike Baker

Graphics: Mark Nowlin

Design and development: Hilary Fung

Editing: Laura Gordon, Rami Grunbaum and Frank Mina

You can support watchdog journalism
Make a tax-deductible donation to The Seattle Times Investigative Journalism Fund, and subscribe to The Seattle Times.
Don’t Miss
View Comments
You must be logged in to leave a comment. or .

The opinions expressed in reader comments are those of the author only, and do not reflect the opinions of The Seattle Times.