Pilots of ill-fated Lion Air flight may have been befuddled by safety system

Only moments after taking off from Jakarta, the pilots flying Lion Air 610 realized they were losing control of their 737 Max jetliner, the newest, most fuel-efficient and most automated version of the popular Boeing model.

The jetliner unexpectedly pointed its nose down, sending it into a series of 26 dives at less than 5,000 feet. Toward the end, the pilot pulled back on the control yoke with all his might to bring the nose up, but the plane entered a death dive into the Java Sea. The crash, 11 minutes after takeoff, killed 181 passengers and eight crew members.

The causes of the Oct. 29 accident are still being investigated by teams from Indonesia, Boeing and the U.S. National Transportation Safety Board. But the investigation is examining the role played by software intended to protect against pilot errors that have caused several deadly crashes around the world and whether the crew understood that system. When the aircraft’s flight control system malfunctioned, the pilots had no clue that flipping a single switch in the cockpit would counteract the problem.

“They never pulled out of a mode of confusion and panic,” said Hans Weber, a San Diego air safety expert and retired aerospace executive. As the aircraft’s automated flight control system kept pushing the nose down, no matter how hard they tried to pull up, “they didn’t have enough leverage,” he said. “It seems crazy.”

The accident involved many factors, including poor maintenance, inadequate pilot training and failure to report prior problems on the same aircraft, but the automated system’s failure is a key focus of the investigation.

Many of the questions about the accident may be resolved if and when divers recover the cockpit recording device from the ocean bottom. A second device, the flight data recorder, was found shortly after the crash.

Traditionally, Boeing has been well known in the aviation world for a design philosophy that gives pilots significant authority over the aircraft’s flight controls. By contrast, European manufacturer Airbus has highly automated its jetliners, limiting what actions pilots can take to adjust controls.

But in an evolution of its normal practice, Boeing inserted in the 737 Max software that aimed to prevent pilots from pulling up the nose of an aircraft when they should push it down to counteract stalls and vice versa. Fatal crashes have occurred when pilots didn’t heed stall warnings. In 2009, an Air France plane en route to Paris from Rio de Janeiro fell into the Atlantic Ocean after one of the pilots continued to pull the plane’s nose upward, despite multiple stall warnings. That same year, a twin-engine turboprop, operated by Colgan Air, crashed in Clarence City, N.Y., after the crew ignored stall warnings, killing 49.

Engineers also redesigned the plane with bigger, more fuel-efficient engines that shifted the center of gravity forward, creating a potential for the aircraft’s nose to pitch up after takeoff. Such a nose-high attitude can reduce the lift from the wings to the point that the aircraft literally starts to drop out of the sky.

To safeguard against such a condition, the 737 Max software automatically adjusts what is called the trim or the fine adjustments on a plane’s rear stabilizer so that the nose could pitch down in certain conditions. The software was given the oblique name “maneuvering characteristics augmentation system” or MCAS.

“What Boeing did was take the pilot out of the loop,” said Michael Barr, former director of USC’s Aviation Safety and Security Program, which trains accident investigators. “The concept was good, but the question is whether it was properly communicated to the pilots about what it is supposed to do and how it is supposed to work.”

Boeing’s viewpoint is that the procedure to handle a malfunction of the trim system did not change from prior generations of the 737 and that the ability of flight crews to disable the automatic trim is the same on its aircraft dating back decades. Since the accident, two airlines have placed sizable orders for the 737 Max, leading Boeing to believe that the accident will not tarnish the plane’s reputation.

In a message to employees, Boeing Chief Executive Dennis Muilenburg said “the 737 MAX is a safe airplane.” He denied media reports that “we intentionally withheld information about airplane functionality from our customers” and said “the relevant function is described in the Flight Crew Operations Manual.”

“We have not changed our design philosophy,” Muilenburg told CNBC in an interview Thursday. “These are airplanes that handled well in the control of the pilots. They’re designed the same way our previous 737s are.”

But unions representing American and Southwest airlines pilots say they were unaware of the MCAS system before the Lion Air crash. American pilots who flew the 737 Next Generation aircraft, the prior model, were able to qualify to fly the Max by taking a 56-minute computer lesson to understand the differences between flying the two planes, said Dennis Tajer, a spokesman for the Allied Pilots Assn. and a captain. The MCAS system was not covered in that lesson.

Proper functioning of the MCAS system depends on accurate measurements from outside sensors that report the angle at which the aircraft is flying — whether it is cutting straight through the air or sliding at an angle. It’s called the angle of attack.

Those sensors on the Lion Air jetliner had malfunctioned for the previous two days. Maintenance crews thought they had fixed the problem but never got to the bottom of it. The serious problem should have been reported by Lion Air to civil aviation authorities around the world, but word was never sent out.

The sensors were incorrectly telling the flight control computer the aircraft had a high angle of attack and was at risk of stalling. Seconds after the wheels left the ground, the pilot’s yoke began to shake, signaling the plane was flying too slow and the nose was too high. In error, the software automatically adjusted the stabilizer trim to point the nose down.

Veteran pilots say the crew should have recognized something was causing what is known as “runaway trim,” in which the control system keeps increasing the trim — an error that can be caused by as many as five conditions. The captain of Flight 610 was a 31-year-old who had just 6,028 hours of experience, few by U.S. standards.

“They had just taken off, and the stick was shaking,” said Robert Ditchey, a former airline executive and a co-founder of America West Airlines. “They should have known they were not stalling. You have all of the other instruments telling you that you are OK. You could look out the damn window.”

The stabilizer trim system is also controlled manually by large black wheels in the cockpit that the pilots can twirl around to adjust trim. An aircraft engineer said the pilots should have seen the wheels automatically spinning for as much as 10 seconds, which would have been a dead giveaway that the plane had entered a runaway trim condition.

If the Lion Air pilots had figured out that the stabilizer trim was causing the plane to dive, they could have disabled the automated system with a simple switch on the center console or by manually moving the large trim wheels or by pushing a button on the trim wheels.

Indeed, crews on the two prior flights on the same aircraft encountered the trim problem and simply shut down the system, avoiding any further risk, according to a preliminary accident report issued by Indonesian civil aviation authorities.

John Cox, a veteran pilot and air safety expert, said the captain of the earlier flight dealt with the malfunction by turning over controls to the first officer early, so he could diagnose the problem. But on Oct. 29, the captain continued flying the plane well after takeoff.

“They are getting a cascade of fault messages,” Cox said. “The captain is hand-flying the aircraft and he is very close to task saturation, trying to figure out how these messages are connected and what is broken on the airplane.”

Weber said the accident was part of a culture problem, particularly among fast-growing Asian airlines, in which jetliners are operated as a computer rather than a machine controlled by hand.

“They are reluctant to fly the plane,” he said. That cockpit culture was cited by many aviation experts in the 2013 crash of an Asiana jetliner in San Francisco that pointed out the weak manual-flight qualifications of the crew.

As the latest crash investigation proceeds, airlines are moving to strengthen pilots’ understanding of the new software. In the U.S., the MCAS system was a “hot item” during a recurrent ground school training session that occurred this week for American Airlines pilots, union official Tajer said.

“There’s no question there’s all hands on deck to make sure this never happens again and pilots are aware of the aircraft they take command of,” he said. “Clearly, we embrace technology but not when it’s done in the absence of knowledge and without the pilot understanding it. In the event that the technology fails, we are the last line of defense.”

[email protected]

[email protected]

Twitter: @RVartabedian, @smasunaga