In 12 Minutes, Everything Went Wrong

How the pilots of Lion Air Flight 610 lost control.

Comments: 34

  1. This is a manufacturer's failure. The 737 series isn't new; the 737-MAX is a narrow-body fourth-generation iteration that Boeing envisioned as a long-haul sardine can meant to haul human-herds in an even- tighter space. Boeing didn't even have a manual to address the catastrophic potential of Lion Air's fate; no manual override for a pilot to take control over a COMPUTER. What. The. Heck was Boeing thinking in turning out this death-trap?

  2. HAL: i’m sorry, Dave.

  3. MONEY

  4. There were several manual overrides. The pilots could have disconnected the computer from the control surface in question (the recommended procedure outlined in this article); they could have held the trim wheel against the computer's attempts to trim down; or they could have disengaged the flight computers entirely and flown the aircraft manually, which they are trained to do. Boeing's failure to notify crews about MCAS is deeply troubling; however, as with almost all modern air crashes, this accident is not so simple as man > machine. It is a complex interaction of failures, both human and engineered, that spirals out of control.

  5. Thanks to this enhanced format, I doubt if I’ll ever get on another airplane again, knowing more now about them than I wish to.

  6. This was criminal negligence by Boeing and the aircraft operating company. Boeing omitted crucial safety instructions in its updated manual. The incorrect readings on a previous flight were ignored. Almost 200 people died needlessly.

  7. This is the FUTURE. Automatic systems - planes, cars, manufacturing - everywhere are subject to tampering. Looks at what hackers can do TODAY. So, let's turn our lives over to the Internet Of Things and become just another "thing."

  8. Your claims do not align with actual data from real life cars in real life scenarios. In a National Highway Traffic Safety Administration (NHTSA) study, single-vehicle crash risks for cars were reduced by 35 percent while a 67 percent reduction was experienced by SUVs equipped with Electronic Stability Control systems. Self-driving cars are expected to reduce fatalities by an order of magnitude ie. ten-times.

  9. This is what corruption does to OUR lives - kills us. WE THE PEOPLE must take a stand. Boeing employees should walk out of every factory in the world along with pilots, stewardesses and stewards and airline reservation employees. Tourist companies, contractors who serve the airline industry and airports should shut down. Massive civil lawsuits for dereliction of duty and depraved indifference should be lodged against Boeing and their main contractors to literally bankrupt them so they can no longer put OUR lives in danger with their insatiable greed. If OUR regulatory agencies can be so easily corrupted and refuse to do their jobs of keeping 99.9% of us safe WE THE PEOPLE will do it ourselves.

  10. You might find my main comment helpful. In the end, it seems, Lion Air may be most culpable for insufficient pilot training; arguably, a form of corruption. An uncommanded pitch trim movement by the motorized drive is just that, whether it's caused by a new safety system, such as the MCAS receiving erroneous data, or a short-circuit in a switch. The 737 is controllable with manual pitch trim, similar to a small beginner-level personal airplane, especially in the daytime visual conditions when the accident occurred.

  11. Thank you for this. I saw a more detailed article either in the Times or the Washington Post that provided similar information, but in more detail. This type of article can be effective in reaching more pilots and providing the information needed for them to recognize this situation, and inform them of the tools available to them to correct it.

  12. In the end, the automatic "safety" system pushed the nose of the aircraft down and killed all aboard. Yes technically, there was an override, and technically the pilots should have been trained on it, and technically, the aircraft should not have been cleared for use. Technically, Boeing is correct. And I thought Boeing was the aircraft designer that left room for the humans to override the systems. After the disaster with Air France over the Atlantic, wherein the pilots also fought the computer all the way down; perhaps it is time for Airbus in that case and Boeing in this case, to remember that humans are the ones that ultimately need to be tasked with flying the plane. I would like to hope that the pilot and the co-pilot cursed the automatic safety system engineers and their offspring to hell. It is the least they could have done.

  13. This is a deeply oversimplified view of what happened, both here and in the case of AF 447. Lion Air 610 seems to have been a perfect example of cascading errors–a technical glitch, relatively minor, is compounded with human errors in judgment, rapidly spiraling out of control. You say that "technically," Boeing is correct. Aircraft are technical objects. Pilots are technicians. Boeing can and should be held to the fire for failing to inform all its customers about MCAS, the system in question, but MCAS is not the only thing that can cause a trim runaway–I can think of five or six other causes off the top of my head. The procedure for dealing with a trim runaway is no different if it's MCAS or anything else causing it. The pilots did not follow that procedure. They are not blameless here. In AF 447, the pilots were not fighting the computer all the way down; they were fighting each other. The accident sequence began with a technical error–quite minor–but it only progressed because one of the pilots utterly failed to comprehend what was happening. It was a failure of what's called "crew resource management," which is basically training in advanced communication, cooperation, and crisis management skills.

  14. An automated system should always have multiple ways of detecting errors in sensor readings, alerting the crew and reverting to manual control. Not explained by this article, Which altitude sources (barometric, radar, GPS, other) were inconsistent and why would that be? Also what is MCAS and how is it different from and similar to previous terrain collision avoidance systems.

  15. There is enough redundancy in the automated control system to withstand any single point of failure. For example, in Boeing's version of the ARINC 629 Digital Data Bus (the internal computer network used inside the aircraft), they rely on a process called 'Deferred Maintenance' which provides an additional (3rd) level of redundancy to enable the airline to defer maintenance of a failed component for up to three (3) flights. According to Yeh (1998): "Consequently, repair of random hardware failures can be deferred to a convenient time and place, resulting in reduction of dispatch delays or cancellations." (p. 3) "The PFC [Primary Flight Control] can be dispatched with one failed lane: maintenance alert is generated for maintenance attention. The PFC can also be dispatched with one failed channel: flight deck status message is generated requiring replacement of a PFC channel within three flights." (p. 3) All of this assumes, of course, that the airline actually performs the required maintenance. If the airline is pooly managed, then it may re-interpret these rules to mean that they don't need to repair at least one system (as a cost cutting measure). Cite: Yeh, Y.C. Design Considerations in Boeing 777 Fly-By-Wire Computers. Boeing white paper (1998, undated). From: yeh98_777-fbw.pdf

  16. Great explainer, NYT. Thanks! The origins of the problem aren't with the angle of attack sensor or even the software that worked too well. The problem is Boeing's, who installed the MCAS but didn't bother informing the people who fly the plane how to turn it off.

  17. This is a major failure on Boeing's part because they ignored the human factors engineering 101 principles of Visibility of System State and Keep the User in the Loop. With safety critical systems it is extremely important to provide very clear signals about system state, including whether sensors are operating appropriately. On top of this, steps to correct or overcome the problem must be immediately obvious. Of course, Boeing will point fingers because maximizing their profits are more important than our safety. Instead, they need to ground these planes until they are redesigned.

  18. So, is the fact that the pilots are fighting with the motorized pitch trim system not a clear signal of an end-state malfunction namely, Runaway Pitch Trim, as headed in the Abnormal Procedures section of the pilots' Quick Reference Handbook? My main comment is more detailed, thought to sum it up, take command; turn it off and hand-fly the airplane. I agree there should have been a paragraph or two on the MCAS in the Flight Crew Training Manual, but still, when you're fighting with a pitch trim motor, it doesn't matter if it's a confused MCAS or a short-circuited switch. Cut its power and use the manual trim crank.

  19. A lot more could be learned about the reactions of these pilots if the cockpit voice recorder (CVR) were recovered. Perhaps they were aware of Boeing's recommendations, and there was some other factor that contributed to the crash. In fact, it is somewhat mystifying that the CVR hasn't been found yet, as the wreckage lies at less than 100 ft. from the surface. This depth is so shallow that it can be reached by sports (SCUBA) divers. According to Silviana (11 DEC 2018): "The Lion Air jet crashed in relatively shallow water of 30-35 meters but only the data recorder has been found as the remaining device lies among oil pipelines requiring an expensive self-positioning vessel without an anchor." Apparently, Indonesia’s transport safety committee (KNKT) is refusing to foot the bill for the recovery. If they drag their feet much longer the 90-day 'pinger' battery on the CVR will soon fail. Cite: Silviana, Cindy. Exclusive: Red tape, funding problems hamper Lion Air black box search. Reuters, 11 DEC 2018

  20. This explainer acts as if the pilots were without fault. In reality, accidents result from failure chains -- usually long ones. No doubt, Boeing's decision to implement MCAS and not train pilots on it was a major link in the chain. But these pilots also failed to execute the very simple steps in their quick reference handbook (QRH) -- which covers emergency procedures) for runaway trim. Had they done so after the first, or second, third, fourth, nth... time the computer ran the trim forward, this tragedy would have been averted. That the pilot(s) repeatedly tried to use the trim up button on the yoke rather than disabling the system and cranking the trim manually (as described in the QRH) is hard to understand. The CVR, if ever recovered, will be interesting to tell us whether the pilots even attempted the emergency procedures for this situation.

  21. This is a fairly good explainer of the technical side of the accident, but I do have to question why the writers almost completely ignore the human side. I am no Boeing apologist–I agree that there's no excuse for system changes that are not communicated to the pilots, and Boeing should (and probably will be) punished in one way or another for it. But this is not simply a technical error; the pilots did not follow the correct procedure for a trim runaway, which is what the MCAS caused to occur. However, MCAS is not the only thing that can cause a trim runaway; a stuck motor, a jammed jackscrew, a computer failure, a trim switch failure, an autopilot failure, etc. The procedure for runaway trim, no matter the cause, is always the same: disconnect the trim motors. Like almost all modern air crashes, this is not so simple as a technical failure. It's a cascading sequence of events, starting with something small, compounded over time. As with almost all modern air crashes, it appears that a major component–far more important than this article makes clear–is a human failure. On any modern airplane–even on a 737 MAX–the computers are almost certainly making you more safe, not less. The pilots are much more likely to get in trouble.

  22. Makes me want to rush out and buy a drive a self-driving car, for sure.

  23. The pilots didn't need to know a thing about the MCAS system in order to know how to deal with this failure. This was clearly an electric trim issue, and the first step to deal with any trim issue is to disengage the electric trim. It's the same on a 737-300 as it is on a 737-MAXX. Non-pilots need to understand: this was about as basic an emergency situation as a professional pilot could ever face. In the U.S., airline pilots probably train these every 6 months. Any pilot of an aircraft with electric trim who doesn't know how to disengage it shouldn't be operating that aircraft. Period. And to think that two pilots on a transport category aircraft couldn't figure out between the two of them to turn off the electric trim after repeated malfunctions is just unimaginable. Not only that, but there are standard procedures for altimeter or airspeed disagreements. Neither of these things should have lead to a catastrophic outcome. This is two pilots who had no business being in that cockpit. End of story.

  24. Agreed. And for the record, the procedure for runaway stab in the 737 are QRH / memory items -- the pilots should have had them wired into muscle memory: """ I. Runaway Stabilizer CONTROL COLUMN - HOLD FIRMLY AUTOPILOT (if engaged) - DISENGAGE Do not re-engage the autopilot. Control airplane pitch attitude manually with control column and main electric trim as needed If the Runaway Continues STAB TRIM CUTOUT SWITCHES (both) - CUTOUT If the Runaway Continues STABILIZER TRIM WHEEL - GRASP and HOLD """ That's it. The article makes it seem like the pilots would have had to "reason out" what was happening and figure out what they could have done. But that's just not true.

  25. Mike - I greatly respect your opinion and point of view. However, I write this with the utmost respect: knowing what the issue(s) and potential solutions are AFTER THE FACT are always crystal clear and "obvious". Unless a person has been in the exact same position or scenario and has lived through it along with safely landing the plane, I think it is harsh, mean and rather arrogant to "Monday Morning Quarterback" these two pilots. Every mystery is easy to explain when one knows the answer.

  26. Except that in the Boeing 737 Max, Boeing installed the MCAS and that changed the proper response to runaway trim. Boeing didn't inform the pilots or their customers, so there was no training in the sim for that situation. It's telling that 6 days after the accident, the FAA issued an emergency order with the steps necessary to recover from the runaway trim, which is more complex and different than the procedure used in earlier generations of the 737. Both Southwest and American airlines claim they did not know and were not warned by Boeing on changes that came with MCAS.

  27. "It’s likely the pilots didn’t know about this automatic system, a new addition to Boeing’s 737 planes that many pilots were not made aware of. " It's unconscionable that Boeing could or would install any kind of new addition to a plane WITHOUT pilots being made aware. This action goes beyond a communication disconnect, it's blatant negligence. I cannot even begin to imagine the degree of fear the pilots, flight attendants and passengers endured during those horrid 12 minutes. I was in a cold swear merely after reading this painfully detailed article. Deepest condolences to the many families, loved ones and friends of the deceased.

  28. As any commercial or military pilot will tell you, the cockpit is adorned with lights and switches with a discomforting story to tell. Aviation’s evolution with automation and computerization can be similar to your experience updating your laptop or smart phone. Poor upgrades often are the problem. For example, the warning lights for unheated pitot tubes were an early improvement after a sports team fatal jet crash. But new software problems are more hideous with little or no visible indication of the change. Even airline flight manuals, now automatically inserting new pages and warnings, are carried on computer tablets. Misunderstanding, if just unaware or never included in training, can be fatal, a factor as in the B-777 crash a few years ago in San Francisco or the Air France hull loss. Reduced training syllabi, accelerated pilot retirement rates, rapid upgrades, reduced numbers in pilot candidate pools, computerized ground training, and other factors are ongoing problems. But the pilots’ over-reliance on auto-flight is a problem that only magnifies the other factors. After completing a 45-year pilot career, I am hopeful that the pilots, not the engineers, are the prominent fixtures in the decision tree. The common axiom is never fly the first model of an aircraft. Without your smartphone, how many phone numbers do you remember any more? Me neither.

  29. “… confident in the safety of the aircraft model ...” Yes, the aircraft model has flown many flights without incident. But, as was shown in the Lion Air crash, its safety is vulnerable to the failure of a single sensor. Virtually all safety-critical aviation systems are designed to be resilient enough to withstand ‘single-point failures’. In my view, the apparent fact that this modified design gave up so easily, reduced this model’s safety. The modified design could have been accompanied by specific corresponding pilot training to offset the added risk that MCAS introduced. Fortunately, the widespread publicity of this failure mode and the pilot instructions makes it highly unlikely it’ll cause other crashes. With that awareness well established, we can say that safety has been restored.

  30. I live in a part of the world that can sometimes be frightening. But that for better or worse if often part of the scenery. Not a surprise. What I read in this short piece is absolutely terrifying. My air travel will never be the same.

  31. It shouldn't be. This article is misrepresentative at best, and fear mongering at worst. My mother is, as I write this, on a 737 flying to visit my family. I am not worried about her safety.

  32. As a Boeing 737 pilot for the past three years with more than 1000 flight hours in older versions, I can assure the readers that there certainly is a manual override for what is in the end—newfangled MCAS or not—uncommanded pitch trim movement. Until the cockpit voice recorder is recovered, we can't know the whole picture (and may never know anyways), but everything known so far from what has been made public points to the failure to apply basic piloting skills, including cutting power to the motorized pitch trim drive with that pair of conveniently located toggle switches and utilizing the conveniently located manual trim wheel (one for each pilot on a common shaft) stabilizing the airplane manually—in sunlit, visual weather conditions. The Boeing manual states that the motorized trim system can be overpowered by operating the manual trim wheel; simply grasping the wheel will stop it from moving under motor power. One need not know, strictly speaking, that there is such a thing as MCAS to recognize that one is fighting the trim and to take control of it. Indeed, there is a memorized procedure for misbehaving pitch trim published in the Abnormal Procedures section of the airplane's Quick Reference Handbook. The 737 is a well established, proven, operator-friendly design. Sure, the MCAS was likely receiving bad data due to faulty sensing. The bottom line, though, appears to have amounted to uncommanded trim, for which there is a Piloting-101 remedy. Please, find the CVR.

  33. I think all aircraft with autopilot need a big red button that gives back manual control. The autopilot was stuck in a stall correction loop. The automatic stall correction is for the situation of the pilots are not taking corrective action. However, there is never a case for a stall correction loop. Pilots need a fast way to disable an autopilot that is listening to malfunctioning sensors. We also need more redundancy in the sensors. Perhaps using a quorum algorithm.

  34. All aircraft do have buttons to give back manual control. Few are big, but some are even red. The 737 has multiple layers of switches that allow the pilot complete control over varying systems; these include the electric trim cutout switches that would have saved this aircraft, and go all the way up to the master flight control computer switches that would disengage all automatic systems and give the pilots complete manual control. These are, in fact, covered by big red switch covers. This is a complicated topic, but all of this information is available on the open literature (I am a small-aircraft pilot, but I know how a 737 works, for example). If you are interested you can and should avail yourself of this information.