Why did the 737 MAX Crash?
It is one of the most, if not the most, controversial of airliners in modern history. Its name continues to send shivers down the spines of nervous airline passengers — not since the DC-10 of the 1970s has an airliner gained this level of notoriety among the general public. Following two fatal accidents of a similar nature months apart, the Boeing 737 MAX was grounded worldwide for over one-and-a-half years beginning in March 2019 — the longest grounding of any airliner type in 35 years. This article seeks to detail the downfall of Boeing’s bestselling aircraft, the culmination of a long sequence of circumstances decades in the making as various chains of events came together to result in two of the most poignant aviation disasters in recent memory.
The story of the Boeing 737 began in the mid-1960s. Just over ten years after the first jet airliner was introduced, manufacturers all over the world were churning out larger, faster aircraft which would come to shape the way we fly today. Airlines clamoured for more of the new jets to phase out their slower piston-engined aircraft — during this period, it would not be out of the ordinary to see large fleets of piston airliners being put out to pasture after little more than a decade of use.
In Seattle, Washington, The Boeing Company was seeing unprecedented success. For much of their history, they had been relegated to a distant second place in the country’s aviation industry— ever since commercial aviation took off in the United States, the preeminent aircraft manufacturer had been the Douglas Aircraft Company. The company’s DC-3 aircraft had utterly dominated commercial aviation during the interwar years, setting the standards for speed, comfort, and reliability, and their DC-6 did the same post-World War 2. In stark contrast, Boeing had sold a grand total of just 55 airliners in the decade following the war, and it seemed for a while that they would never be able to get out of the shadow of Douglas.
All that changed at the dawn of the Jet Age — the Boeing 707, more so than any other aircraft, truly defined the jet airliner when it entered service in 1958. With nearly double the capacity and speed of preceding airliners, the 707 was a significant leap in aircraft technology, and far outsold the closest competition, the Douglas DC-8 — perhaps the greatest triumph in the 42-year history of the company at the time.
Buoyed by the success of the long-range 707, Boeing would go on to develop the medium-range 727, which would prove even more popular, cementing the company’s status as the leading aircraft manufacturer in the country, if not the world. By 1965, a year after the 727 entered service, US airlines began to express interest in a smaller, short-haul jet airliner to replace the last of their piston aircraft.
The Boeing 737, as the new aircraft was named, would be far from the first jetliner aimed at the regional market. As early as 1959, on the other side of the Atlantic, the French-built Sud Aviation Caravelle entered service with Scandinavian Airlines; and in 1965, just as Boeing began drafting plans for preliminary studies on their new aircraft, the BAC 1–11 carried its first passengers with British United Airways. Back at home, even Boeing’s old competitor Douglas had beaten them to the chase — the Douglas DC-9 would make its maiden revenue flight with Delta Air Lines later that year. In the face of such stiff competition, Boeing knew they had to make their aircraft stand out, or else it would simply flop right out of the door.
A regional jetliner would typically be expected to make many flights in a day, often shuttling passengers between major airline hubs and small airports. In the 1960s, these small airports were all too often woefully lacking in the infrastructure required to handle large, conventional jet airliners, having little in facilities beyond a runway and a few parking spaces. Baggage handling technology was virtually non-existent, as was the equipment needed for technicians to reach certain parts of the aircraft in order to perform line maintenance. As such, aircraft manufacturers had to adopt the design of their aircraft to suit these constraints.
It would be no surprise, then, that the early regional jetliners all adopted a similar configuration. They contained a set of built-in airstairs to allow passengers to embark and disembark without depending on the facilities provided by the airport. They had a short landing gear, keeping the fuselage low above the ground to allow easy access for both baggage handlers and maintenance technicians to perform their respective duties. To achieve this low ground clearance, their engines were mounted at the rear of the aircraft, sandwiching the vertical stabiliser, rather than at their conventional position under the wings. Because of this, their cabins were slightly narrower than their long-haul counterparts, seating five economy class passengers per row instead of six, as a wider cabin would disrupt the flow of air entering the inlets of the tail-mounted engines.
As Boeing engineers laid out preliminary designs of the 737, they hit upon an ingenious set of solutions that would allow their aircraft to gain an edge over its competitors. They would give the 737 the same cross-section as their earlier 707 and 727, seating six passengers per row instead of five. The engines, which could no longer be rear-mounted like the other regional jets due to the wider cabin, would be fitted tightly against the underside of the wings instead of hanging out like pods as they did on the long-haul 707. Such a configuration would allow the 737 to carry more passengers while still sitting low to the ground and being able to operate into small airports. While the capacity of the other regional jets topped out at 100 passengers, the 737 would start from 100 passengers as a baseline.
The Boeing 737–100, as the initial version was denoted, entered service with German flag carrier Lufthansa in 1967. Just months later, the stretched 737–200 followed. Seating 136 passengers, it entered service with United Airlines in 1968. Over the next decade, sales of the 737 skyrocketed, spearheaded by the stretched 737–200, as its superior operating economics became apparent to airlines all over the world.
By 1979, the demand for short-haul air travel was on the rise, especially in the United States. Earlier that year, the country’s airline industry was deregulated, meaning that airlines were free to compete with each other on domestic inter-state routes. As competition brought down fares, more people could afford to travel by air. More routes opened up. The 737–200s flown by many of the country’s airlines soon became too small for many of the routes they operated, and the smaller DC-9 even more so. Airlines now wanted a domestic airliner that could carry more passengers and fly longer distances.
At the same time, Boeing was wary that a new aircraft could supplant the 737’s status as the world’s dominant short-haul jetliner. Since its launch, the fuel efficiency of jet engines had improved tremendously, and the 737 was still using the older fuel-guzzling engines. However, due to the unique design of the 737, a simple re-engining of the aircraft was not feasible.
The 737–100 and -200 were introduced during the early years of the turbofan engine, and were thus powered by low-bypass turbofans. These engines were small enough to fit under the wing of the aircraft and still maintain a reasonably low ground clearance. However, these engines were now being gradually phased out in favour of high-bypass turbofans, which were much more fuel-efficient. As the name suggests, a larger amount of air bypasses the engine’s combustion chamber in a high-bypass turbofan, necessitating the use of a larger fan unit. A high-bypass turbofan engine is thus much wider in diameter than a low-bypass turbofan.
This posed a challenge for Boeing, as the high-bypass turbofans could not fit under the wing of the 737 in its existing low configuration. The solution was to move the engines forward such that the widest portions were in front of the wing, allowing them to be mounted higher up. Even so, accommodating the larger engines was no easy feat. Engine manufacturer CFM International, which would produce the engines of the new 737 variant, had to re-engineer their CFM56 engine, relocating many of its components to fit the 737. The resulting engine had a unique, distinctive flat-bottomed shape. It just managed to fit — barely.
The 737–300 entered service with USAir in 1984. Larger and longer-ranged than its predecessors, it carried a maximum of 149 passengers, and was an instant hit with many airlines in the United States. Over its 15-year production lifespan, 1,113 aircraft of this version alone were delivered. In 1988, a further stretched version, the 737–400, was introduced, which saw more success in Europe and Asia; while a shrink, the 737–500, was offered in 1990 as a direct replacement for the now aging 737–200s still flown by many airlines around the world.
In 1988, European manufacturer Airbus introduced the trailblazing A320 as a direct competitor to the 737. Its futuristic glass cockpit, filled with almost nothing but computer screens, mesmerised onlookers, while the aircraft’s state-of-the-art fly-by-wire control system gave it far superior handling qualities. The second-generation 737 (which would later be known as the 737 Classic) now looked antiquated in comparison despite only having been introduced four years prior.
While this was not immediately a deal-breaker for airlines, Boeing knew they had to upgrade the 737 yet again if they wanted to remain competitive in the long run. Preliminary studies were undertaken alongside discussions with some of the 737’s largest airline customers. By the end of 1993, the 737 Next Generation was launched.
The Boeing 737 Next Generation, or 737 NG, for short, would feature a new wing design, reducing drag and increasing fuel capacity. These enhancements would increase the aircraft’s range, enabling it to operate non-stop transcontinental services. It would also feature a glass cockpit, similar to the A320, in which analogue dials were replaced by digital displays, easing the workload of the pilots. Because the 737 NG continued to use the same type of engines (though an upgraded version) as the 737 Classic, the topic of ground clearance would not be an issue.
The first 737–700, the baseline 737 NG variant, was delivered to Southwest Airlines in December 1997. It had an identical seating capacity to the earlier 737–300, which it was intended to replace. The stretched 737–800 and shortened 737–600 entered airline service the next year, replacing the 737–400 and 737–500 respectively. However, some airlines were not content with more of the same, and wanted an even larger 737. Boeing promptly followed by introducing the 737–900, a further stretch of the 737–800, which entered service in 2001.
With these four variants, the 737 NG family covered a wide spectrum of the market, from the -600 seating 110 passengers to the -800 and -900 seating 189 (the -900 had the same maximum capacity as the -800 as the emergency exit configuration was unchanged, though of course it could seat this number of passengers much more comfortably), and became exceedingly popular with airlines all over the world, especially among existing 737 operators. In addition, two of the world’s largest low-cost carriers would operate large fleets of the 737 NG: in the US, Southwest Airlines operated 685; and in Europe, Ryanair operated 537. In a sign of the changing times and increasing passenger numbers, the most popular version of the third-generation 737 was no longer the 149-seat 737–700, but the 189-seat 737–800.
There was just one spot left for the 737 to fill. In 2003, Boeing announced that they would be ending production of their 757, a long-range, high-capacity single-aisle airliner. This effectively left the 737 as Boeing’s largest narrowbody in production, and its largest variant, the 737–900, had neither the range nor the passenger capacity to become a viable 757 replacement. Across the Atlantic, however, it was a different story. Airbus had been producing the A321–200, a stretched and improved version of their revolutionary A320 closely matching the performance and capacity of the 757, since 1996. With many airlines across the world operating 757s that would soon exceed 20 years of age, Boeing had to come up with something to prevent themselves from losing market share to their European rival.
Using the 737–900 as a baseline, Boeing added a pair of exit doors to increase the maximum certified capacity of the aircraft to 220. The fuel capacity of the aircraft was also increased, extending its range, and new winglets were installed to improve efficiency. The resulting aircraft would be known as the 737–900ER (Extended Range). Its range and capacity still fell short of the 757, but it would do the job — at least for now. The 737–900ER entered service in 2007.
Towards the end of the 2000s, a new generation of turbofan engines was born. These new engines were much quieter than existing ones, and promised a marked leap in fuel efficiency. As manufacturers scrambled to put these new engines on their aircraft, Boeing was understandably itching to do the same with their best-seller, the 737.
There was just one problem — the new engines were much larger than those on the 737 NG, and the problem of ground clearance reared its ugly head once again. This time, it seemed, there was simply no way to get the engine to fit — no amount of shifting and squashing its components could do the trick. It seemed the 737, Boeing’s coveted cash cow, had reached the end of the line. When Airbus announced the A320neo, a new version of their A320 equipped with the new engines, in late 2010, the upper echelons of Boeing management were in a quandary: should they pour billions of dollars into developing a new aircraft, a process that could take years, and simply cede potential business to Airbus in the meantime?
All of a sudden, in August 2011, they received some good news: Engineers had found a way to fit the new engines on the 737. A new aircraft would not be necessary.
Boeing’s management could not have been more pleased to learn that the writing was not yet on the wall for their beloved golden goose. From the perspective of the company, the benefits of developing a fourth-generation 737 instead of a new, clean-sheet design were endless. Development time and costs would be very much reduced, allowing the aircraft to market sooner — an especially weighty detail given that Airbus had launched their competing A320neo months ago. The airlines already operating the 737 would also be able to easily re-certify their pilots onto the new 737 variant, minimising their downtime and training costs. The green light to proceed with the plan was given on August 30, 2011, and Boeing’s marketing department gave the new aircraft a catchy name: the 737 MAX.
Throughout the development of the 737 MAX, efficiency was key. Faced with the prospect of rising fuel prices, airlines were itching to dump their older, less efficient planes in favour of new ones. Boeing knew that if there was one aspect in which their aircraft could not lose out to the A320neo, this was it. Preliminary studies were promising — initial data showed that a re-engined 737 could potentially provide a rate of fuel consumption 4% lower than the rival A320neo. Even so, Boeing’s engineers continued to find ways to further improve the efficiency of their aircraft: the tail cone, vertical stabiliser, and engine nacelles were revised to reduce drag. It was also in this vein that they gave the 737 MAX one of its most distinctive design features: a set of split scimitar winglets on the tip of its wings. With these enhancements, the 737 MAX would be among the most fuel-efficient aircraft in the skies, and would be able to cover much longer distances than any other 737 before it without an increase in fuel capacity.
Just about everyone involved in the 737 family at Boeing was elated to hear the news that a solution had been found to the issue of the aircraft’s engines. Flattening the engines to fit under the wing, as had been done on the Classic and Next Generation, was no longer feasible on the MAX. Instead, the engines would be shifted even further forward, with the entire engine nacelle in front of the wing instead of under it. Now that the wings were out of the way, the engines could be mounted higher up, solving the problem of insufficient ground clearance for the larger engines.
The relief on that front was short-lived, for it was soon discovered that the change in engine position posed a new problem of its own.
In everyday operations, an aircraft will encounter numerous disturbances that ever so slightly change its pitch, roll, and yaw. A pilot cannot be expected to continually adjust the controls to counter these disturbances, thus the aircraft has to be engineered in a manner such that it will have the tendency to return to its original flight attitude after being subject to a small disturbance. This concept is known as stability, and an aircraft must demonstrate longitudinal (pitch), lateral (roll), and directional (yaw) stability to be considered stable, corresponding to its three axes of motion.
Of particular concern to the 737 MAX was its longitudinal static stability, that is, the tendency of the aircraft to self-correct to minor fluctuations in pitch. To achieve longitudinal static stability, an aircraft should have its centre of gravity positioned slightly forward of its centre of lift. In such a configuration, the lift from the wings, acting upwards from behind the centre of gravity, exerts a nose-down pitching moment on the aircraft. This is countered by the tailplane at the rear of the aircraft, which exerts a downwards lift force to balance the aircraft. Since the moment of a force about a point is given by the product of the force and the perpendicular distance between the line of action of the force to the reference point (in this case the centre of gravity, for ease of explanation), this downwards balancing force has a much smaller magnitude than the upwards lift from the wings, by virtue of the tailplane being located much further aft of the centre of gravity than the wings are, allowing the resultant vertical force on the aircraft to be zero for the aircraft to fly without a vertical acceleration.
Such a configuration confers longitudinal stability to the aircraft as the lift generated by a surface is linearly proportional to its angle of attack (up to a point beyond which it stalls, but this is irrelevant to the story). This means that if the aircraft experiences a disturbance in flight which causes a small nose-up pitch, for instance, the increase in angle of attack causes the lift from both the wings and the tailplane to increase (in the upwards direction, which in the case of the latter means a reduction in magnitude downwards). This increase in the nose-down moment from the wings, coupled with the decrease in the nose-up moment from the tailplane, causes the aircraft to pitch downwards back to its original attitude. The reverse is also true in the case of a pitch downwards resulting from a disturbance, in which case these forces adjust to provide a restoring nose-up moment.
In level flight, there was no issue with the longitudinal stability of the 737 MAX. However, things changed if the aircraft was flown at a high angle of attack.
At high angles of attack, the shape of the engine nacelles (the outer casing of the engine) causes them to exert a small upward lift force. While this effect is usually negligible, the new engines on the 737 MAX upended that conventional wisdom. Its engine nacelles were larger than those on previous 737s, providing a larger area for this rogue lift to be generated, while the further forward position of the engines allowed for a stronger moment about the aircraft’s centre of gravity for the lift force to act. This additional lift force acted forward of the aircraft’s centre of gravity, creating a nose-up moment which was found to be large enough to overcome the corrective nose-down moment from the wings and horizontal stabiliser that would normally take hold. As a result, the aircraft would have a tendency to pitch up even further, making it longitudinally unstable. If such a situation manifested in flight, this pitch-up tendency would require significant attention and effort from the pilots to correct — a marked change in handling characteristics from the previous versions of the 737 which had been certified.
This discovery threatened to be a major stumbling block in the certification process of the 737 MAX. Boeing had planned to offer the 737 MAX as a variant of the existing 737, which would allow airlines to minimise training and certification times for pilots, as was what Airbus offered with the A320neo. However, in order to be certified as a 737 variant, the 737 MAX had to feel exactly the same as the 737 NG from a pilot’s perspective. A hard solution would require major engineering changes to the airframe, which at this stage threatened to significantly increase the development costs of the programme. In lieu of this, Boeing’s engineers devised a seemingly ingenious solution to this problem.
Instead of leaving the work of controlling the aircraft’s pitch to the pilots, a computer system would adjust the controls behind the scenes, giving pilots the illusion of longitudinal static stability. To understand how this system works, we must first look into how pitch control is achieved on an aircraft.
On a conventional aircraft, pitch is controlled by two types of surfaces: the horizontal stabiliser and the elevators, which together comprise the tailplane. The horizontal stabiliser is a wing-like structure protruding from both sides of the rear of the aircraft, while the elevators are small control surfaces hinged to the trailing edge of the horizontal stabiliser. When a pilot pulls and pushes on their yoke, the elevators rotate about this hinge, changing the relative angle between the horizontal stabiliser and the elevators to deflect the incoming airflow. This action exerts a turning effect about the lateral axis of the aircraft’s centre of gravity, causing a change in pitch. When the yoke is in the neutral position, the elevators are aligned with the horizontal stabiliser, meaning that the behaviour of the aircraft is governed by the position of the horizontal stabiliser.
The angle of the horizontal stabiliser can also be adjusted. This is done to change the effect of the neutral yoke position on the behaviour of the aircraft, and is also known as trimming the aircraft. Being much larger than the elevators, the range of motion of the stabiliser is typically much smaller and more restricted than that of the elevators. Trimming the aircraft is traditionally accomplished by rotating a mechanical trim wheel located on the centre pedestal between the pilots. On modern aircraft like the 737 MAX, however, the horizontal stabiliser may also be controlled electronically, making use of an electric motor to reduce the physical effort required to trim the aircraft. A pair of trim switches located on the yokes allow pilots to do just that without having to touch the trim wheel.
Thus, when an aircraft is flown manually, adjusting the pitch is usually accomplished in the following manner: A pilot will first pull or push on the yoke, manipulating the elevators to achieve the desired pitch. They will then trim the aircraft, adjusting the horizontal stabiliser to a position such that the aircraft maintains this attitude without the need for sustained input on the yoke. An aircraft is said to be in trim if it maintains the desired attitude without any continuous pilot input, and out of trim if not.
To solve the controllability problem with the 737 MAX at high angles of attack, Boeing’s engineers introduced a computer system known as the Manoeuvring Characteristics Augmentation System, or MCAS for short. If the aircraft’s sensors detected that its angle of attack was excessive, MCAS would adjust the horizontal stabiliser to provide a nose-down moment, trimming the aircraft nose-down for 10 seconds to counteract the nose-up moment resulting from the additional lift from the engine nacelles. In the absence of any manual trim inputs, the system would hold the stabiliser at the resulting position as the aircraft pitched down, until the angle of attack decreased to a value less than 0.5 degrees below the activation threshold. It would then trim the aircraft nose-up to the original stabiliser position, restoring the flight dynamics that existed before the high angle-of-attack situation was encountered. This was a seemingly elegant solution which would ensure that from the standpoint of the pilots, the 737 MAX would appear to be longitudinally stable and behave just like its older counterparts when operated manually.
Boeing was still concerned that the new system could catch the attention of regulators around the world, which would prompt an additional layer of scrutiny resulting in a lengthening of its certification process. This did not seem like a worthwhile trade-off, given that it would take a very specific set of conditions to trigger an MCAS activation: the autopilot had to be deactivated; the flaps had to be retracted; and an abnormally high angle of attack had to be detected — an extremely rare combination of events.
In the modern era of automated flight, the autopilot is typically engaged throughout most of the flight, with the exceptions of during takeoff and certain landings. These are also the stages of flight where the aircraft’s flaps would be extended. In addition, the angle of attack required to trigger an MCAS activation was an abnormally high value (the exact value would be calculated from the airspeed and altitude of the aircraft), one far outside the bounds of a typical flight.
Given the odds, it seemed highly unlikely that a flight crew would ever see the system in action. Furthermore, the movement of the trim wheel in the event of an MCAS activation would produce a distinctive noise in the cockpit. If MCAS were to activate erroneously, it would not be difficult for a crew to pick up on this sound and notice the uncommanded movement of the trim wheel.
Boeing also reasoned that pilots were already trained to diagnose a runaway stabiliser — an uncommanded movement of the horizontal stabiliser, to which an erroneous MCAS activation would appear indistinguishable. The procedure to deal with this issue — toggling the two stabliser trim switches to the cut-out position, deactivating the electric stabiliser motors — would also inhibit MCAS from making further trim adjustments, as it operated through these motors. With such provisions in place, it would be unnecessary to describe MCAS in the aircraft manuals and potentially attract the attention of regulators, which could delay the certification of the aircraft. Thus, in January 2017, just months before its planned entry into service, a decision was made to remove all mentions of MCAS from pilot training manuals.
On May 16, 2017, the first Boeing 737 MAX was delivered. Having the honours of marking this momentous milestone was Malindo Air, the Malaysian division of Indonesian low-cost carrier Lion Air. The aircraft entered commercial service six days later, operating the route between Kuala Lumpur and Singapore on May 22.
Production was swiftly ramped up to fulfil the large number of orders, in a bid to catch up with the Airbus A320neo which by this point had more than a year’s head start on them. Boeing invested heavily in additional aircraft production infrastructure, with plans to increase the 737 MAX production rate to a blistering 57 aircraft a month. Soon, the 737 MAX was flying all over the world, and rapidly re-shaped global aviation markets.
The 737 MAX was by far the longest-ranged version of the 737, and many airlines were eager to make full use of its ability. On July 15, 2017, European low-cost carrier Norwegian Air debuted their 737 MAX on the transatlantic route between Edinburgh Airport, Scotland, and Bradley International Airport in Connecticut. Norwegian was just the second airline to operate the 737 MAX, and their move unveiled the wide range of possibilities that could be opened with the new aircraft. With a passenger capacity much lower than most long-haul airliners and burning significantly less fuel, airlines could operate non-stop flights between small to medium-sized cities located far apart, routes which would have made little economic sense with traditional long-haul aircraft. A year after entering service, there were 24 scheduled routes on the 737 MAX exceeding 6 hours of flight time. The longest of these, an Aerolineas Argentinas flight between Buenos Aires, Argentina, and Punta Cana in the Dominican Republic, clocked in at over 8 hours.
Just as Boeing had done decades earlier with the 737 NG, a series of 737 MAX variants of different lengths were planned to replace the older variants. The first, the 737 MAX 8, succeeded the 737–800, the most popular 737 NG variant. Three other variants were in the pipeline. The smaller 737 MAX 7 would take the place of the 737–700, while the larger 737 MAX 9 would replace the 737–900 and -900ER. At the same time, the issue of a replacement for the Boeing 757 was still a thorn in Boeing’s side. Since production for that aircraft had ended, many 757s in airline service were now well over 20 years old, As such, Boeing announced development of a further stretch of the 737 MAX in 2017, which would be known as the 737 MAX 10 and function as a true 757 replacement.
Of these variants, the 737 MAX 9 would be the next to enter service. Once again, the first aircraft was delivered to Lion Air on March 21, 2018.
Lion Air’s executives could not have been more proud when the airline’s first Boeing 737 MAX 9, and the first delivered to any airline, arrived at its new home. The airline had ambitious plans for expansion out of Indonesia and across Southeast Asia, having set up divisions in Malaysia and Thailand in the years prior. To fuel this growth, they had announced a record-setting order in November 2011 for 230 Boeing 737 aircraft — 29 for the 737–900ER and 201 for the MAX family — valued at an eye-watering US$21.7 billion. Seven years later, all of the -900ERs had since been delivered, and the first of the MAX family orders were just beginning to come online.
It was one of these aircraft, a three-month-old Boeing 737 MAX 8 bearing registration PK-LQP, that landed at Ngurah Rai International Airport in Denpasar on the morning of October 28, 2018, operating flight JT775 from Manado. As the aircraft arrived at the gate slightly behind schedule at 10:00 a.m., the pilots notified the maintenance crew of unreliable airspeed and altitude readings on the captain’s instruments. It was the fifth time in the past two days that similar faults were reported on this aircraft, and engineers in Denpasar found that the problems originated from the left-hand-side angle of attack sensor installed on the aircraft. They decided to ground the aircraft until the sensor was replaced, but soon ran into a hiccup — there was no replacement angle of attack sensor in stock at Denpasar, meaning that one would have to be transported from another maintenance base elsewhere.
A suitable sensor was located at Hang Nadim International Airport in Batam. This sensor, serial number 14488, had been lying in a storage facility at Batam for nearly a year, and was ordered to be ferried to Denpasar at the next available opportunity. However, a lack of nonstop flights between Batam and Denpasar meant that the sensor would not arrive until much later in the day, and it was immediately evident that the aircraft would not be able to proceed with its next scheduled flight. Flight dispatchers worked to reschedule the airline’s departures from Denpasar for the day. Under the new plan, PK-LQP’s next flight would be flight JT43 to Jakarta, with a scheduled departure time of 7:30 p.m.
Unbeknownst to anyone, sensor 14488 had a troubled past. On August 19, 2017, it was removed from aircraft 9M-LNF, a Boeing 737–900ER operated by Lion Air’s Malaysian subsidiary Malindo Air, in Kuala Lumpur after pilots reported a similar fault to those observed on flight 775 (the angle of attack sensors are interchangeable between the 737 NG and MAX). Two months later, on October 20, it was sent to Xtra Aerospace in Miramar, Florida, for repair. An inspection there revealed that the vane was eroded and had to be replaced, and a replacement was performed in short order.
After the new vane was installed, it was calibrated using a Peak Electronics SRI-201B Angle Position Indicator. This was in contravention of the directions in the maintenance manual authored by the manufacturer, which did not specify it as an appropriate tool for calibrating the vane. The use of this non-standard equipment resulted in the sensor being calibrated with a 21-degree bias, meaning that it would record an angle of attack 21 degrees higher than the actual value. This error was not detected in the post-maintenance tests, and sensor 14488 was returned to Kuala Lumpur on December 1. Three weeks later, it was transferred to a storage facility in Batam on December 22, where it would sit unused for the next 10 months.
A further flight delay resulted in the sensor only arriving in Denpasar at about 6:30 p.m. With only an hour to replace the sensor, have passengers boarded and load the cargo for the flight, it would be a Herculean task to enable PK-LQP to depart on time. The clock was now ticking.
In the hangar, engineers installed angle of attack sensor 14488 onto the left-hand side of the nose of PK-LQP without any hiccups. The procedure now called for them to perform a test to verify the accuracy of the values provided by the sensor, deflecting the vane to the fully up, centre and fully down positions in succession while verifying the readings on the Stall Management Yaw Damper system in the 737’s electronics bay at each point. Possibly pressed to minimise the aircraft’s delay, they did not record or verify the readings on the computer system, and simply went through the motions of deflecting the vane assuming it was good to go.
At the terminal building, the passengers of Lion Air flight 43 were getting increasingly impatient. By now, they were already supposed to be in Jakarta, yet hours had passed since their scheduled departure time with no indication of when they would finally be able to leave Denpasar. Watching as PK-LQP was towed back to the gate for their flight, no one could have guessed that a defective sensor had just been installed on the aircraft. Though it was not apparent on the ground, this single miscalibrated sensor would have drastic implications once the aircraft took to the skies.
Lion Air flight 43 finally departed Denpasar for Jakarta at 10:21 p.m., nearly three hours behind schedule. Annoying as it was, this delay would soon be the least of the concerns of those on board.
On takeoff, the angle of attack is typically in the vicinity of 10–15 degrees. Due to its miscalibration, the left-hand side angle of attack sensor provided readings of over 30 degrees, a value that is well above the critical angle of attack that would cause a wing to stall. The first condition required to trigger an MCAS activation had now been met.
Once the aircraft left the ground, the faulty data prompted the flight computers to trigger the captain’s stick shaker, a warning that the aircraft is about to stall, even though the aircraft was in fact nowhere near stalling. This warning manifests itself as a forceful vibration of the control yoke, and is only triggered in the most dire of circumstances. The pilots were no doubt alarmed, but they soon realised the warning was false — the aircraft was still controllable, and was maintaining a speed and climb rate well within the bounds of normal flight. Comparing their instruments, they ascertained that the first officer’s instruments were still providing accurate data. The first officer thus took the controls of PK-LQP, while the captain attempted to troubleshoot the warnings. In the midst of the chaos, neither of them engaged the autopilot, meeting the second condition required to trigger an MCAS activation.
One minute into the flight, as the aircraft climbed through 1,500 feet, the pilots retracted the flaps as was routine at this point in the flight. In an instant, things began to go haywire. All three conditions required to trigger an MCAS activation had now been met at the same time. The system activated, commanding nose-down trim and sending the aircraft into a dive. Pulling back on the yoke seemed to have little effect, if any. The pilots quickly toggled the trim switches to move the horizontal stabiliser into the nose-up position, overriding the MCAS inputs.
The perilous journey of Lion Air flight 43 was not yet over. MCAS activated twice more during the climb out from Denpasar. Each time, the pilots responded by trimming the aircraft nose-up. After the third activation, one of the pilots noticed that the trim wheel was moving towards the nose-down position whenever they released their trim switches. Not knowing about the existence of MCAS, they diagnosed the problem as a runaway stabiliser — the only other situation they were aware of that would cause uncommanded stabiliser trim movements, and deactivated the electronic trim system by switching the two stabliser trim switches to the cut-out position. This ceased the MCAS inputs as the computer could no longer move the horizontal stabiliser electronically. The aircraft continued on to Jakarta uneventfully, arriving at 10:56 p.m. local time.
Upon arrival in Jakarta’s Soekarno-Hatta International Airport, the pilots of flight JT43 informed the maintenance crew that their airspeed and altitude readings differed during the flight. However, they failed to mention the three MCAS activations at the beginning of the flight. On the basis of this incomplete information, technicians in Jakarta inspected the airspeed and altitude sensors and instruments, and cleaned their electrical connections. They found nothing untoward — this was, of course, because the problem lay not with the instruments themselves, but with the miscalibrated angle-of-attack sensor they obtained their data from — a textbook case of garbage in, garbage out. Satisfied that the aircraft was good to go, the maintenance team cleared PK-LQP to return to service.
The next morning, October 29, 2018, Captain Bhavye Suneja and First Officer Harvino reported for work at Soekarno-Hatta International Airport. Their first mission of the day, the early morning flight 610 to Pangkal Pinang scheduled to depart at 5:45 a.m., would be a short 70-minute journey. As was routine, they headed to Lion Air’s office at the airport to retrieve the paperwork for their flight. This would have included, among other things, information about weather conditions, NOTAMs, the flight plan, as well as the tail number of the aircraft to be used. They then proceeded to the aircraft indicated on their paperwork and entered the cockpit of PK-LQP shortly before 4:30 a.m.
Captain Suneja was 31 years old. Born in India, he had joined the Indonesian airline 7 years ago, and had been flying the 737 for the past 3 years. His records were satisfactory with no red flags and he was generally regarded as a proficient, meticulous pilot, but today he was evidently under the weather. During the hour-long pre-flight preparations, Suneja was recorded coughing no less than 15 times.
First Officer Harvino was 41 years old. Though he had joined Lion Air just months after Suneja, his training records left much to be desired. Unlike Suneja who was swiftly promoted to captain, Harvino had regularly demonstrated difficulties during regular check rides, and continually required remedial training to get his skills up to par. To make matters worse, he was likely sleep-deprived today. He had not been originally scheduled to operate flight 610 this morning, and had to rush down to the airport after receiving a call from the airline informing him of the schedule revision less than an hour ago.
At some point during the pre-flight preparations, Suneja flipped through the maintenance log of PK-LQP, just in case there was anything worth noting for this flight. He noted that the previous flight crew had reported airspeed and altitude discrepancies — certainly not an everyday occurrence, but it appeared that the maintenance team had rectified the issue and signed off the night before.
This morning, flight JT610 was fully booked. Every single one of the 180 passenger seats on the aircraft was filled, while a Lion Air engineer travelling on this flight as a passenger occupied one of the crew jumpseats. Along with the 2 pilots and 6 flight attendants, there were a total of 189 people on board PK-LQP for the flight to Pangkal Pinang. As the pilots prepared the aircraft for departure, the passengers settled in for the flight. Pilots routinely take turns to perform flying duties, and for this flight, Suneja would be at the controls. Flight 610 pushed back from the gate at 6:10 a.m., 25 minutes behind schedule.
After a 9-minute taxi, Suneja lined PK-LQP up on runway 25L and advanced the throttles. The aircraft began accelerating down the runway.
“V1,” a synthetic voice announced in the cockpit. The aircraft had reached decision speed — it was now travelling too fast to stop.
“Rotate,” announced Harvino, who was monitoring the instruments, a second later. They had now reached takeoff speed.
Suneja pulled back on his yoke, raising the nose for takeoff.
As soon as flight 610 left the ground, the miscalibrated left-hand side angle of attack sensor began detecting an excessively high value and activated Suneja’s stick shaker, just as had happened on flight 43 the night before. Because the angle of attack data also affects the computation of airspeed, the left-hand side and right-hand side instruments started to display different readings. Due to this discrepancy, the aircraft’s computers could not accurately determine their airspeed, and disabled many of the automated systems onboard. A cascade of warnings was instantly set off in the cockpit, alerting the pilots to the failures.
“Takeoff config,” Harvino called out. “Auto brake disarmed. Indicated airspeed disagree,” he continued.
“Gear up,” Suneja instructed Harvino to retract the landing gear of the aircraft. Harvino complied.
“Altitude disagree,” Harvino advised Suneja of another warning, and Suneja acknowledged.
Unaware that anything was amiss in the cockpit of flight 610, the air traffic controller directed the pilots to climb to their cruising altitude of 27,000 feet. Still unsure of the aircraft’s actual altitude, Harvino asked the controller to confirm their altitude.
“900 feet,” was the reply.
Suneja remembered the faults in the maintenance log, and came to the conclusion that the airspeed problems recorded on the previous flight were occurring again. With his hands full flying the aircraft, he instructed Harvino to perform the “memory items” for this situation — a set of procedures which pilots are trained to recall from memory. These are intended to be carried out in the immediate aftermath of a failure to contain the problem. Under the stressful circumstances, however, it seemed that Harvino had momentarily forgotten the procedures. Instead of admitting so, he stayed silent and did not respond to Suneja’s request.
As flight 610 climbed through 1,300 feet, Harvino suggested making a left turn to return to the airport.
Suneja had another idea. “Request some holding point,” he replied. Seeing as the aircraft was still controllable, he did not want to rush into anything before getting a hold of the situation.
“Flaps 1?” Harvino suggested retracting the flaps by a notch, as was customary at this point of the flight.
“Flaps 1,” Suneja affirmed. Harvino retracted the flaps to position 1.
Turning his aircraft to the left on the standard departure route, Suneja realised it was challenging to fly the aircraft using a yoke that was vibrating perpetually. As the flaps began to retract, he struggled to maintain the climb amidst the decrease in lift, and the aircraft descended by 100 feet. Seeing as his first officer’s stick shaker was not activated, he asked Harvino to take over the controls.
“Stand by,” Harvino responded.
Air traffic control took notice of the momentary descent, and queried the pilots on their intended altitude.
“You want flaps up?” Harvino continued with the flap retraction process.
“Flaps up,” Suneja confirmed, and Harvino retracted the flaps completely.
Regarding the controller’s question, Suneja asked Harvino to request an altitude of 5,000 feet. Air traffic control granted the request, and instructed the pilots to fly in a north-easterly heading. Facing south at the moment, the aircraft continued to turn left to comply. Suneja managed to raise the nose, continuing with the climb out of Jakarta, while Harvino entered the assigned altitude of 5,000 feet into the flight computers.
Suneja was still struggling to control the aircraft as it turned. “BANK ANGLE,” an automated voice announced, warning him that he had banked too sharply.
1 minute and 58 seconds into the flight, the flaps reached the fully retracted position. With a high angle of attack registered, flaps retracted, and the autopilot switched off, all three conditions needed to trigger an MCAS activation had been met simultaneously on this aircraft for the second time in just over seven hours. Flight 610 plunged towards the ground below from an altitude of just over 2,000 feet.
Suneja instinctively pulled back on his yoke to stop the descent; however, the elevator deflections were insufficient to counter the movement of the much larger horizontal stabiliser. MCAS continued to trim the aircraft nose down for the next 10 seconds. Flight 610 descended at a blistering rate of 3,200 feet per minute, a vertical speed four times that of a normal descent. Recalling that all was fine prior to the retraction of the flaps, Suneja instructed Harvino to extend the flaps back to position 1.
The plan worked. As Harvino extended the flaps, the MCAS inputs stopped. Suneja toggled the trim switches to command nose-up trim, and the aircraft resumed its climb. It seemed a crisis had just been averted. The pilots attempted to troubleshoot the problem they were facing.
“Feel differential already done, auto brake… engine start switches off,” Harvino read off a list of items.
“Check,” Suneja replied.
Harvino scrambled through the aircraft’s manual to find the right page.
“Feel differential pressure… Which one?”
“No, no. Airspeed unreliable,” Suneja advised him of the appropriate checklist to go through.
“Sorry, airspeed unreliable, standby,” Harvino answered.
3 minutes and 55 seconds after takeoff, the aircraft reached 5,000 feet, the altitude the pilots had previously decided to hold at. Still struggling with his vibrating yoke, Suneja was unable to level off. Flight 610 continued to climb.
“Where is the… no airspeed…airspeed…airspeed,” Harvino muttered to himself, as he frantically flipped the pages of the manual, trying to locate the correct procedure.
Finally, Harvino located the checklist. However, just as he began reading the first steps, something peculiar occurred: one of the pilots retracted the aircraft’s flaps. Whoever it was that performed this action, he did not mention it to the other pilot. All the conditions required to trigger an MCAS activation had once again been satisfied.
As soon as the flaps reached the fully retracted position, MCAS activated again, trimming the aircraft nose-down. This time, Suneja was prepared, and immediately toggled his trim switch to command nose-up trim. His inputs overrode those by the MCAS, arresting the descent. The aircraft pitched up steeply, prompting him to release the trim switch to prevent the pitch from becoming excessive, which could cause the aircraft to enter a stall. However, as soon as he stopped these inputs, MCAS would activate again, and as the nose pointed downwards, he again activated the trim switch in response. The cycle continued, and flight 610 ascended and descended repeatedly in a precarious roller-coaster-like trajectory. Suneja battled for control of the aircraft, attempting to maintain an altitude of 5,000 feet, as Harvino went through the airspeed unreliable checklist. Over the next few minutes, MCAS would activate 24 more times.
6 minutes and 24 seconds into the flight, as the aircraft left the coast of Jakarta and headed out over the Java Sea, air traffic control instructed flight 610 to make a right turn eastwards to avoid traffic. Contending with his vibrating yoke and now the persistent MCAS activations, Suneja was only able to coax PK-LQP into a shallow right bank. The aircraft continued to fly further out to sea, away from the shore, still porpoising in altitude.
By this point, Suneja was getting frustrated by his first officer’s lack of progress in troubleshooting the warnings. He decided that he had to figure out the problems himself. 10 minutes and 13 seconds after takeoff, he asked Harvino to relieve the controls from him, so that he would be in a better position to evaluate the situation. Crucially, however, he did not mention the fact that he had to apply nose-up trim more than 30 times since the aircraft had left the ground.
“I have control,” Harvino confirmed.
While the pilots were aware that there was a discrepancy between the airspeed readings on the two sets of instruments in front of them, they seemed to have had forgotten that this difference extended to the altitude readings as well. Although Suneja had maintained an altitude close to 5,000 feet with reference to his own set of instruments, the value on Harvino’s instruments was closer to 6,000 feet. As MCAS activated yet again, causing the aircraft to descend, Harvino perhaps assumed that the flight computers were bringing them down to the altitude of 5,000 feet which he had entered into the autopilot earlier, and initially did nothing to stop the dive.
However, the descent did not stop at 5,000 feet, and in fact steepened as MCAS continued to increase nose-down trim.
“Wah, it’s very…” Harvino exclaimed, startled by the behaviour of the aircraft.
Harvino toggled his trim switch, but he did not sustain his input as Suneja had been doing. Instead, he merely depressed the switch briefly. This was a typical action performed under normal conditions to adjust the horizontal stabiliser in small amounts without causing large fluctuations in pitch. However, their situation was far from normal, and his inputs were woefully inadequate to counter the nose-down trim commands by the MCAS. The nose of the aircraft dipped five degrees below the horizon.
Suneja now picked up on the altitude discrepancy once again, and informed air traffic control that they were unable to determine their altitude.
“LNI610, no restriction,” was the reply, telling the pilots that they were cleared to fly at any altitude they needed.
Harvino pressed on his trim switch twice more, momentarily interrupting the MCAS inputs. The rate of descent slowed briefly.
“It’s flying down,” Harvino exclaimed.
“It’s okay,” Suneja reassured his first officer. Having himself been able to fly the aircraft less than a minute ago, albeit unstably, he could see no reason why Harvino would be having any severe difficulties keeping the aircraft in the air.
MCAS activated again. Harvino pulled back on his yoke with all his might, but it was not enough. The aircraft pitched down, with the nose eventually reaching a terrifying 45 degrees below the horizon. Flight 610 fell towards the sea below.
“Fly up!” Harvino cried out in despair.
It was too late to recover. 11 minutes and 20 seconds after taking off, Lion Air flight 610 crashed into the Java Sea.
Emergency response teams rushed out to sea and located the wreckage of the aircraft less than an hour after the crash, but all they could find was aircraft debris floating on the surface of the Java Sea. It was soon clear that there was nobody left to be rescued. With a death toll of 189, it was the deadliest crash of a Boeing 737 in the 51-year history of the aircraft, and the second-deadliest aviation accident ever to occur in Indonesia. As news of the accident got out, people all over the world were shocked to learn about the crash of the brand new aircraft. It would be up to the Indonesian National Transportation Safety Committee (NTSC) to find out why. Three days after the crash, they made their first major breakthrough with the recovery of the aircraft’s flight data recorder (FDR).
It did not take long for investigators to make an intriguing find based on the data from the FDR of flight 610: there was a consistent deviation between the readings from both of the angle of attack sensors on the aircraft for the duration of the accident flight, as well as the flight before it. Because one of the sensors detected an excessively high angle of attack, MCAS was activated, trimming the aircraft nose-down. While the crew of the previous flight — flight 43 — had caught on to the problem and deactivated the electric stabiliser trim in response, preventing further MCAS activations, the crew of flight 610 did not. This seemed to indicate that not all pilots would be able to catch on to the occurrence of such a problem and take steps to mitigate it, which could potentially cause other flights involving the 737 MAX to end in jeopardy. The investigators published these findings in a preliminary report a month after the crash, bringing this critical gap in knowledge to light. With this information, it was thought, pilots would be clear on what to do if such an event were to occur again. This would be sufficient to prevent another disaster even as the investigation into the root cause of the failure was still ongoing.
Sadly, it would not be nearly enough. Just over four months later, history would repeat itself.
Production and deliveries of the Boeing 737 MAX proceeded virtually unimpeded in the days and months following the crash of Lion Air flight 610. It was no secret that the safety record of aviation in Indonesia was mediocre at best — in fact, until just months ago, all Indonesian airlines had been banned from flying into the European Union owing to safety concerns. Many expected the investigation to yield the same familiar story of a pair of improperly trained pilots reacting inappropriately to an unexpected technical issue surfacing in-flight and getting disoriented in the process — a sequence of events that unfortunately continues to occur all too often to this day with Indonesian budget airlines (see here, here, and here for excellent write-ups of some of these cases). Hence, most airlines around the world were unperturbed, and continued to introduce their new jets into service — surely the same wouldn’t happen to them?
The day after flight 610 crashed and half a world away from the disaster zone in the Java Sea, two brand new Boeing 737 MAX aircraft were undergoing final preparations to take to the air for the very first time on the tarmac at Renton Municipal Airport, the site of a Boeing assembly line which had been churning out 737s since 1970. One of them, a MAX 9, was to be delivered to Emirati low-cost carrier FlyDubai; while the other, a MAX 8, was destined for Ethiopian Airlines.
The MAX 8 aircraft in question, designated as line number 7243, was just the fourth of 30 737 MAX aircraft ordered by Ethiopian Airlines to be built. This aircraft would make its first flight later that day, circling the skies over Washington before arriving at King County International Airport (better known as Boeing Field) where the pre-delivery flight test programme of the 737 was based. The number of flights undertaken by an aircraft during flight testing varies greatly, and the duration of the programme can range from as short as a few weeks to as long as several months. Aircraft 7243 had an exceptionally smooth flight testing regiment — after arriving at Boeing Field on October 30, it would make just one more test flight on November 12 before it was ready to be accepted by Ethiopian Airlines (whereas the previously mentioned FlyDubai MAX 9 would require five test flights and a further two weeks). Three days later, on November 15, aircraft 7243 was granted the Ethiopian registration ET-AVJ and headed to its new home in Addis Ababa, via a refuelling stop in Dublin.
Though ET-AVJ had had a relatively trouble-free flight test programme, it was a completely different story once it was delivered. Just 18 days later, on December 3, the first of these problems emerged when pilots noticed that the vertical speed indicator was showing erratic readings after taking off from Dar es Salaam, Tanzania. The next day, while descending into Addis Ababa, a similar problem occurred — but this time with the altimeter, causing the vertical channel of the autopilot to disconnect as it determined that the aircraft was behaving in a manner differing from what was being commanded. Such glitches continued to occur sporadically throughout the month of December, as after each occurrence engineers were unable to reproduce the issues on the ground to identify the root cause and rectify it.
Whether these issues would be of relevance to the events that followed remains a point of contention to this day.
Meanwhile, in the following months, Boeing continued to ramp up production of the 737 MAX, delivering record numbers of aircraft each month. In November 2018, 37 were delivered; and in December, 50 were delivered. Their customers could not have been more pleased. The operating economics of the MAX were next to unrivalled, and the swift deliveries of the new aircraft allowed them to quickly remove the older, less efficient 737 Classic and Next Generation aircraft from service. By March 2019, 387 737 MAX 8s and MAX 9s were flying passengers across the globe in the colours of their respective airlines, collectively making over a thousand flights each day.
On the morning of March 10, 2019, one of these flights was Ethiopian Airlines flight 302, a regularly scheduled trip from Addis Ababa, Ethiopia, to Nairobi, Kenya. Operating this flight would be the same ET-AVJ discussed earlier, now in its fourth month of operation as one of the regular workhorses of the Ethiopian Airlines fleet. At the gate at Bole International Airport, 149 passengers entered the cabin and settled into their seats for the two-hour journey between the two capitals, joined by the standard complement of two pilots and six flight attendants.
In command of flight 302 was Captain Yared Getachew. At just 29, he was the youngest captain at Ethiopian Airlines. His young age, however, belied the very respectable 8,122 flight hours that he had clocked over his nine-year career with the airline — a number greater than what many older pilots would have. Today, like almost every other time he was scheduled on this flight, the Kenyan-born captain arranged to meet his mother, who lived in Nairobi, for lunch during his short turnaround at Jomo Kenyatta International Airport before flying back to Addis Ababa.
First Officer Ahmed Nur Mohammod Nur, aged 25, was a recent graduate of the Ethiopian Airlines flight academy. A former architect, he had just obtained his license three months ago, and was no doubt looking forward to a rewarding career with his country’s flag carrier.
At 8:37 a.m., with the aircraft lined up on runway 07R, the pilots commenced the takeoff roll by pressing the Takeoff/Go Around (TO/GA) switch on the throttles. This engaged the automatic takeoff and climb sequence of the autothrottle, which would manage the engine thrust settings during these phases of the flight — a perfectly routine action for the crew to take.
“V1,” the automated V1 call on the 737 MAX alerted as they accelerated through decision speed.
“Rotate,” First Officer Ahmed announced two seconds later. Captain Getachew pulled back on his yoke, raising the nose for takeoff.
The aircraft began to lift off from the runway, with Getachew at the controls and Ahmed monitoring the instruments and handling the radio. The pilots planned to fly a standard instrument departure route known as SHALA 1A, one of the common routes for flights bound for destinations south of Addis Ababa.
“Positive rate,” Ahmed called out as the aircraft reached 50 feet above the ground, confirming that the aircraft was safely airborne and climbing.
“Gear up,” Getachew instructed.
“Gear up,” Ahmed confirmed as he pulled the lever to retract the aircraft’s landing gear.
What happened at this exact moment remains disputed — investigators from the US National Transportation Safety Board (NTSB) postulated that the aircraft encountered a bird strike, damaging the left-hand side angle of attack sensor, while Ethiopian investigators theorised that the intermittently occurring problems previously reported on this aircraft had been rooted in an electrical fault in the left-hand side angle of attack sensor, and the issue now recurred with a much greater severity. Whatever the case, the result was dire — the left-hand side angle of attack sensor abruptly began to register a value of 74.5 degrees nose-up instead of 15, a value much greater than what would cause the aircraft to stall. Captain Getachew’s yoke began to vibrate vigorously as the stick shaker activated in response to the erroneous data. He reacted instinctively, pushing his yoke forward slightly to reduce the aircraft’s angle of attack, lowering the nose from 15 degrees to 7 degrees above the horizon.
Two warning lights illuminated on the glare shield. “Master caution, anti-ice,” Ahmed announced as he read out the warnings.
“Okay,” Getachew acknowledged.
While the pilots had so far not noticed it (only seven seconds had passed since the failure of the sensor), the difference between the angle-of-attack readings from both sensors had caused the airspeed and altitude values displayed to both pilots to deviate. A piece of software in the flight computers, known as the pitch comparator, compares the airspeed and altitude values from both sets of sensors to ensure their integrity and warn the pilots of potential false information. As the disparity in these readings increased beyond the limit of the pitch comparator in takeoff mode, the flight directors — pink horizontal and vertical bars superimposed on the digital attitude indicators to guide pilots to achieve the desired flight path — disappeared from their screens. Simultaneously, the erroneous angle of attack data led one of the computers to provide a minimum operating speed greater than the current airspeed of the aircraft. On Getachew’s primary flight display, the airspeed readings disappeared, replaced by alternating black and red stripes.
“Command,” Getachew called out four seconds later, an instruction for Ahmed to engage the autopilot, as he momentarily released his yoke to allow the autopilot to take over.
Ahmed pushed the button to engage the autopilot. However, instead of engaging, a warning horn blared in the cockpit, informing the pilots that the autopilot had disconnected — without the flight directors, the autopilot cannot be engaged.
Flight 302 continued its climb out of Addis Ababa, passing through 400 feet above the ground. At this point, the flight computers switched out of takeoff mode, deactivating the pitch comparator for the flight directors. The flight directors reappeared on the aircraft’s primary flight displays.
“Command,” Getachew instructed again. Ahmed pushed the button for the second time, but to no avail — once again, the only response they were met with was the autopilot disconnection warning horn. This was likely because Getachew was applying sufficient force to the yoke to disconnect the autopilot.
“What’s going on?” Getachew exclaimed in confusion at the situation.
As the aircraft climbed through 800 feet above the ground, Getachew instructed Ahmed to contact the radar controller, who was responsible for departing and arriving traffic from Addis Ababa. Ahmed gave a standard, routine transmission, with nothing to indicate to the controller that anything was untoward on board the flight.
1000 feet above the ground, the pilots attempted to engage the autopilot yet again. This time, it worked.
“Command engaged,” Ahmed announced.
“Okay, checked,” Getachew confirmed. The autopilot was now in control of the aircraft, meaning that the pilots could finally begin to take stock of the situation they were in. It had been only 40 seconds since the angle of attack sensor malfunctioned.
“Confirm calling, 302?” air traffic control responded to Ahmed’s initial transmission.
“Affirm, 302,” Ahmed confirmed.
“Identified. Continue climb, flight level 340. When able, right turn direct to RUDOL,” the controller cleared the crew to climb to their cruising altitude of 34,000 feet and to make a right turn towards a waypoint south of the airport, as was the standard departure route to Nairobi.
“When able, right turn direct to RUDOL…Ethiopian 302,” Ahmed replied.
“Flaps up,” Getachew instructed. Ahmed retracted the aircraft’s flaps. With an abnormally high angle of attack reading from the defective sensor and the flaps retracted, the engagement of the autopilot would be the only thing preventing an MCAS activation on flight 302.
While all this was ongoing, the malfunctioning sensor continued to supply erroneous data to the aircraft’s systems, thus the minimum operating speed remained incorrectly greater than the computed airspeed. Now in control of the aircraft, the autopilot began to trim the aircraft nose-down to accelerate towards this computed minimum operating speed.
Getachew noticed that the aircraft was now descending. “Okay, advise we are unable. Request to maintain runway heading,” he said to Ahmed, not comfortable with continuing on the departure route in their current state.
The autopilot was now faced with an impossible dilemma: the programmed route necessitated a climb, but with the aircraft still flying below the minimum operating speed, doing so was outside its authority. After five seconds, it disconnected — as designed, since the complexity of the situation was beyond the scope of its rudimentary logic and necessitated the human brain to resolve. For the third time in the past one minute, the autopilot disconnect warning horn blared in the cockpit. The aircraft was now descending at a rate of 1,400 feet per minute — an already perilous situation for a crew to find themselves in just 74 seconds after taking off, but things were about to get much worse.
The autopilot on flight 302 disconnected only six seconds after Ahmed retracted the flaps. At this point, they were still in the process of moving up and were yet to be completely stowed, thus staving off an immediate MCAS activation. With the autopilot disconnected, Getachew pulled back on his yoke to arrest the descent.
Four seconds later, the flaps reached the fully retracted position, and all three conditions required to trigger an MCAS activation were now satisfied. The system kicked in, commanding more nose-down trim, and the descent steepened further.
“Request to maintain runway heading. We are having flight control problems,” Getachew repeated his earlier instruction to Ahmed, as he struggled to keep the aircraft level.
“DON’T SINK. DON’T SINK,” a synthetic voice chimed in as the flight computers detected that the aircraft was descending when it should have been climbing.
“Ethiopian 302, unable to maint… to SHALA 1A,” Ahmed said over the radio.
“Request runway heading,” Getachew reminded him.
“Request runway heading,” Ahmed continued with his transmission.
“Ethiopian 302, approved,” air traffic control cleared them to continue flying in their current direction.
With MCAS commanding nose-down trim, Getachew’s yoke inputs had little impact on the trajectory of the aircraft. After nine seconds of futile wrangling, he figured that the aircraft was out of trim, and pressed his trim switch to trim the aircraft nose-up, interrupting the MCAS inputs. As the aircraft climbed, sensing that the aircraft was back in trim, he stopped further trim inputs.
“Okay, flaps up speed,” Getachew verified that the aircraft was travelling at a sufficiently high speed to maintain a climb without the additional lift provided by the flaps.
Without the pilots making any trim inputs, MCAS activated again.
“DON’T SINK. DON’T SINK,” the synthetic voice announced again.
“Trim with me, trim with me, trim with me,” Getachew said to Ahmed as he applied nose-up trim once again to counter the MCAS inputs.
“Stab trim cut-out? Stab trim cut-out?” Ahmed suggested, perhaps noticing the movement of the trim wheel and recalling the details of the Lion Air crash four-and-a-half months ago.
“Yes, yes, do it,” Getachew concurred.
“Stab trim cut-out,” Ahmed confirmed as he flicked the two stabiliser trim switches to the cut-out position.
With the electric trim system deactivated, further MCAS inputs were suppressed — though the system continued to activate, it no longer had any means of moving the horizontal stabiliser. Getachew pulled back on his yoke, raising the nose of the aircraft. Flight 302 began to climb at a rate of 1,800 feet per minute, slightly lower than what would be expected at this stage of the flight. For now, a crisis had been averted, but unbeknownst to the pilots, another problem was developing.
When the pilots engaged the autothrottle at the beginning of the takeoff roll, they expected engine power to be adjusted automatically to maintain an appropriate speed, and consequently had paid little attention to the engine power settings. However, the erroneous angle of attack data had left the system unable to determine the phase of the flight. As a result, the thrust levers had remained in the TO/GA position, commanding near maximum thrust — far more thrust than what was required to sustain a climb. By this point, just two minutes after takeoff, the aircraft had reached a speed of 332 knots (615 km/h), about 100 knots faster than what was typical at this point, and continued to accelerate.
At the moment that Ahmed had deactivated the electric trim system, the horizontal stabiliser was positioned such that it would cause the aircraft to pitch downwards with the pilot’s controls in the neutral position, as a result of the preceding MCAS inputs — and now, the pilots had no way to move it. As such, Getachew had to continually hold his yoke backwards to stop the aircraft from pitching down. With the elevators being much smaller than the horizontal stabiliser, a larger deflection of the elevators would be required to counter the forces imposed by the horizontal stabiliser, and the force required to accomplish this would further increase with speed. At 332 knots, Getachew had to apply about 90 pounds of force (or 400 Newtons, approximately the force required to lift a 41 kg mass) on his yoke, and as the aircraft accelerated further, he had to exert himself even more.
“Pull up, pull up,” Getachew urged Ahmed for help as he strained against his yoke.
As both pilots attempted to coordinate their yoke inputs, the pitch of the aircraft began to oscillate between 7 degrees nose up and 2 degrees nose down, with the vertical speed fluctuating between -2,500 feet per minute and +4,400 feet per minute.
“Okay, advise we would like to maintain 14,000. We have flight control problems,” Getachew said to Ahmed. He wanted to level off at 14,000 feet, the minimum safe altitude for the terrain in the area.
Ahmed relayed his request to air traffic control, who granted them permission to do so. He then entered the target altitude of 14,000 feet into the mode control panel to update the flight directors.
Three seconds later, the aircraft exceeded its maximum operating airspeed of 340 knots, setting off the distinctively piercing overspeed clacker.
“The speed,” Getachew pointed out. Now, as Ahmed had momentarily let go of his yoke to update the target altitude, Getachew once again struggled to keep the nose above the horizon.
“Pitch up, pitch up, pitch up,” he urged.
“Pitch up?” Ahmed clarified.
“Yes, with me,” Getachew confirmed.
“Okay,” said Ahmed.
“Is the trim functional?” Getachew queried a few seconds later.
Ahmed pressed his trim switch to command nose-up trim, but with the electric stabiliser trim deactivated, this had no effect on the aircraft. “It’s not working, shall I try it manually?” he suggested.
“Try it,” said Getachew.
Without the electric system, the only way the pilots could trim the aircraft was by rotating a mechanical trim wheel, which is connected directly to the jackscrew controlling the stabiliser. The procedure for operating the stabiliser in this manner calls for the pilots to return the elevators to the neutral position by releasing their yokes, or else the resulting aerodynamic loads on the stabiliser may be too large to overcome manually without the aid of hydraulic or electric power, especially at high speeds. However, with the aircraft already severely out of trim and still low over the ground, letting go of the yoke was simply not an option — the aircraft would pitch downwards and crash in a matter of seconds before they could trim it appropriately. Under such circumstances, a possible recourse would be to perform a “yo-yo” manoeuvre, pulling up into a steep climb to buy time before releasing the yoke to adjust the trim (and repeating this cycle as many times as required to achieve the right trim setting, hence the name), but this was also out of the question — they could barely keep the aircraft level, let alone climb as steeply as conducting such a manoeuvre called for. Ahmed attempted to rotate the trim wheel, but with Getachew still pulling back on his yoke, it would not budge.
“It’s not working,” he told the captain.
“Okay, keep with me. We have to go up to 14,000.” Getachew replied. If they were unable to trim the aircraft, they would have to fly it through brute force.
Ten seconds later, Getachew decided that he had had enough. “Request a vector to return,” he said. Ahmed conveyed the request to air traffic control, who granted the crew a heading of 260 degrees, or approximately due west. With the aircraft facing east at the moment, Getachew began a sweeping turn to the right to attain this new heading.
The pilots now began to review the situation they were in. “Okay, what was it? Master caution?” Getachew recalled the warnings that had gone off at the beginning of the flight.
Ahmed pushed the master caution recall button, illuminating the fault warnings which had previously sounded. “Master caution, anti-ice,” he read out.
“Left alpha vane,” Getachew observed another fault. The angle-of-attack sensor is also known as the alpha vane. Finally, 4 minutes and 11 seconds after the sensor failed, they had found the source of their problems.
“Left alpha vane,” Ahmed confirmed.
Knowing what was causing their problems did not make the aircraft any easier to fly. The aircraft had now accelerated to a speed of 367 knots, and was climbing slightly in a right bank. Getachew continued to strain with his yoke, now having to apply 94 pounds (418 N) of force to prevent the aircraft from falling.
“Should we pitch together? Pitch is not enough,” he asked Ahmed.
Even with Ahmed’s help, it was barely enough — the forces required were simply too high to be sustained. Physically exhausted from fighting the aerodynamic forces on the stabiliser, and faced with the prospect of at least several more minutes of such exertion before they would be able to land back in Addis Ababa, Getachew made a fateful decision.
“Put them up,” he directed, likely gesturing at the electric stabiliser trim switches. Ahmed flicked the switches upwards, reactivating the electric trim system.
“Command, put it on,” Getachew now instructed Ahmed to re-engage the autopilot. He then pressed his trim switch to command nose-up trim, which would reduce the forces required from the pilots to keep the aircraft level. Ahmed pushed the button to engage the autopilot, but once again they were met only by the autopilot disconnect warning — again, because Getachew was simultaneously applying force to the yoke.
“No, no, leave it, leave it, it’s okay, it’s okay, let’s go up, let’s go up,” Getachew responded. As he felt the aircraft respond to his trim inputs, he could at last relax his yoke inputs, and expected to have an easier time controlling the aircraft with it finally being trimmable.
The relief did not last for long. Just as Getachew eased up on the yoke, MCAS activated, trimming the aircraft nose-down. The aircraft pitched downwards violently, going from 0.5 degrees nose-up to 7.8 degrees nose down in three-and-a-half seconds, with the descent rate increasing through 5,000 feet per minute.
“Pitch up, pitch up, pitch up!” Getachew urged.
Both pilots pulled back on their yokes with all the strength they could muster, collectively exerting over 180 pounds of force (800 N), but it was all in vain as the aircraft continued to pitch further downwards.
“Pitch!” Getachew cried out, a hint of distress in his voice.
“TERRAIN, TERRAIN. PULL UP,” a synthetic voice warned as the ground rose up to meet them.
Just five minutes after leaving the ground, it was all over. Flying at a speed in excess of 500 knots (926 km/h), pitched more than 40 degrees downwards, and falling at over 33,000 feet per minute, Ethiopian Airlines flight 302 crashed into a farm north of the village of Ejere.
It was soon evident that no one had survived the crash of flight 302 — all 157 passengers and crew on board had been killed. The force of the impact had carved a 10-metre deep crater in the ground, and most of the aircraft had been driven deep into the earth, with only small fragments remaining above the surface. Instead of a salvage operation where wreckage could immediately be examined for clues, investigators would have to contend with an excavation operation as the ground was dug up, in hope that the relevant parts of the aircraft would be recovered.
Even before the black boxes were found, it could be observed from radar data and air traffic control transcripts that the pilots seemed to be having trouble keeping the aircraft level, as the altitude fluctuated wildly before nosediving. It was a chillingly familiar set of circumstances — one that had also seemed to have unfolded in the skies over Indonesia less than five months prior. With two similar crashes involving the brand new aircraft in such short order, regulators around the world began to feel uneasy. The next day, China became the first country to ground the Boeing 737 MAX, instantly removing one quarter of all 737 MAX aircraft in operation from the air. Many countries followed suit in the following days. On March 12, two days after the crash, the US Federal Aviation Administration affirmed that the 737 MAX continued to be airworthy, but walked this statement back a day later by grounding the aircraft from the country’s skies. By March 18, the 737 MAX was grounded worldwide. From this point on, no 737 MAX would be allowed to take to the air, save for a handful of ferry flights conducted with the flaps extended to prevent an MCAS activation.
Initially, Boeing expected that the grounding would be a short one — that a small technical fix would be required and the aircraft would be back in the air in no time. As such, they continued to produce new 737 MAX aircraft even with the grounding in place. However, it was not to be, and their plan backfired — as the assembly line churned out aircraft that could not be delivered, aircraft began to pile up at Boeing facilities, at first at Renton and Boeing Field, then at Paine Field and Moses Lake. Car parking spaces were repurposed for aircraft storage. Over the next few years, scenes of stored 737 MAX aircraft filling the airfield would be a signature sight at the Boeing factories along the western United States.
As the grounding continued through the end of 2019 and into 2020 with no end in sight, Boeing was left with no other option. In January 2020, the manufacturer suspended production of the 737, bringing the Renton assembly line to a standstill for the first time in 20 years.
Once the details were laid bare, it was clear that the crash of flight 302 had been fundamentally a repeat of the events of Lion Air flight 610 less than five months prior — a malfunctioning angle-of-attack sensor had caused the activation of MCAS, which trimmed the aircraft nose-down beyond the point of recovery. Despite being armed with the knowledge of the Lion Air crash, the Ethiopian Airlines pilots were unable to regain control of their aircraft. Clearly, something had to be done about MCAS — otherwise a third accident would only be a matter of when and not if.
As the investigation (as well as multiple legal cases) ensued, the internal decisions undertaken at Boeing to release the system to the public were heavily scrutinised. More details, in addition to the omission of MCAS from training manuals discussed early on in this story, were exposed — for instance, the system was able to command a range of motion four times greater than stated in the safety analysis documents, far beyond the authority of what a pilot would be able to command with the yoke, and it would activate repeatedly as long as the conditions required to trigger it were met. Furthermore, despite the longstanding practice of designing aircraft systems with a large degree of redundancy such that no single failure has a catastrophic effect, MCAS would be activated so long as any individual angle of attack sensor registered an abnormally high value (and the other two conditions were met). By this point, it had for decades been commonplace for the internal logic of aircraft systems to dictate them to compare data across multiple sensors and reject any inaccurate data, but Boeing inexplicably failed to implement this process when they designed MCAS. It seemed that in the rush to see the 737 MAX through certification, only the best-case, most ideal situations were considered, with caution for all other scenarios thrown to the wind.
The debate over what was to be done with MCAS would go on for over a year, with Boeing sparring back and forth with regulators around the world. Eventually, an airworthiness directive was issued in November 2020, mandating modifications to the flight control laws of the 737 MAX. Specifically, data from both angle of attack sensors would now have to be taken into account for MCAS to be activated, closing the glaring loophole in redundancy which had previously existed. The system would also be inhibited if the readings between the two sensors differed by 5.5 degrees for an extended period of time, which would be indicative of an error either with one of the sensors or the computer interpreting the data from it. In addition, the system would now only activate once instead of repeatedly in the event of a high angle of attack, allowing pilots to regain control after an erroneous activation while still being able to use the electric trim system. The range of motion of the stabiliser available to the system was also restricted, such that a pilot would be able to override the system using only the yoke in the event of an erroneous activation.
These changes paved the way for the re-certification of the 737 MAX. On November 18, 2020, 619 days after the Ethiopian Airlines crash, the FAA announced that it had cleared the 737 MAX to return to the skies once the modifications had been completed. Exactly three weeks later, on December 9, Brazilian low-cost carrier Gol Transportes Aéreos became the first airline to resume passenger flights on the 737 MAX, with Aeromexico and American Airlines following suit later that month. For the rest of the world, it would take a while longer, with most jurisdictions lifting their groundings on the aircraft throughout 2021.
So, is the 737 MAX safe? Only with time will we know for sure, but it is worth considering that no other aircraft type in recent years has come under a comparable level of examination. Though MCAS continues to exist on the 737 MAX, it is a more subdued version of it, much less likely to go rogue. Today, every pilot is surely aware of the system and knows what to do if it were to activate erroneously, as opposed to the situation in 737 MAX cockpits back in 2018. Boeing certainly knows that they cannot afford to get it wrong again — after two high-profile crashes resulting in the loss of 346 lives, a third could very well sound the death knell for the credibility of the company as a manufacturer of commercial airliners. There is a lot at stake that Boeing cannot bear to lose.
As for the future of the 737 MAX, the type has received well over 5,000 orders as of this writing in February 2023, with the vast majority of these still yet to be delivered. Most airlines have since returned their grounded aircraft back into service, though some, wary of scaring away nervous passengers, have quietly “rebranded” the 737 MAX and now refer to the MAX 8 and MAX 9 as the “737–8” and “737–9” respectively (not to be confused with the 737–800 and 737–900, which are variants of the older 737 NG family and do not have MCAS). Though such a reputation is hard to shed, it should be noted that back in 1988, the Airbus A320 got off to a similar rocky start — its very first public demonstration flight culminated in the first fatal crash of the aircraft type, raising doubts about the technology in the cockpit of the aircraft — and yet the A320 has gone on to become the world’s best selling airliner. With new airframes coming off the production line each day and many more yet to be built, the future of the 737 MAX is far from over, and it will undoubtedly continue to play an indispensable role in shaping the global aviation network for decades to come. For anyone who might have an upcoming flight on the 737 MAX and is feeling apprehensive, rest assured that the statistics are on your side — flying remains by far the safest mode of travel, even on a 737 MAX.
