Revisiting 737 MAX Crashes: Unraveling the Role of Human Factors
On October 29, 2018, Lion Air Flight 610, a Boeing 737 MAX 8, crashed into the Java Sea shortly after takeoff from Jakarta, Indonesia. The flight experienced various technical issues, including erroneous readings from a sensor that triggered the aircraft's Maneuvering Characteristics Augmentation System (MCAS), a flight control system designed to prevent stalling. The pilots struggled to control the aircraft as it repeatedly nosedived. All 189 people on board were killed. When this accident happened, I remember immediately thinking, “Indonesian low-cost airline, probably a training issue”. As it turned out, I was only partially correct.
On March 10, 2019, Ethiopian Airlines Flight 302, also a Boeing 737 MAX 8, crashed shortly after takeoff from Addis Ababa, Ethiopia. The flight experienced similar issues to the Lion Air crash, with the MCAS system being implicated. The aircraft's nose repeatedly pitched down, and the pilots were unable to regain control. All 157 people on board were killed. There was something else going on here.
Following these crashes, the 737 MAX was grounded worldwide, and investigations were launched into the design and certification of the aircraft. The crashes led to intense scrutiny of the MCAS system and raised questions about pilot training, aircraft certification processes, and the relationship between Boeing and regulatory authorities. Boeing has since made significant changes to the MCAS system and provided additional training for pilots flying the 737 MAX.
The Maneuvering Characteristics Augmentation System (MCAS) is a flight control feature designed by Boeing for the 737 MAX series of aircraft. MCAS was introduced to address handling characteristics of the 737 MAX that were different from previous 737 models due to the installation of larger, more fuel-efficient engines.
The primary function of MCAS is to enhance the pitch stability of the aircraft in certain flight conditions, specifically at elevated angles of attack (AOA) with the flaps up, which could lead to an increased risk of stalling. When the system detects that the aircraft's AOA is too high and the risk of a stall is elevated, MCAS automatically adjusts the horizontal stabilizer trim to push the nose of the aircraft down, thereby reducing the AOA and helping the pilots avoid a stall. However, in the two crashes involving the 737 MAX, investigations revealed that the MCAS system played a role in the accidents. A faulty sensor reading led to MCAS repeatedly activating and pushing the aircraft's nose down, overriding pilot control and contributing to the loss of the aircraft.
This system is quite different than the one installed on the B-777 and, in fact, installed in most aircraft. The pitch trim system in the Boeing 777 is designed to assist in maintaining the desired pitch or nose-up/nose-down attitude of the aircraft during various phases of flight. It adjusts the position of the horizontal stabilizer, which controls the aircraft's pitch. Pilots can manually control pitch trim using switches in the cockpit, and the system also has an automatic mode. Unlike the MCAS on the 737 MAX, the pitch trim system on the 777 does not have the same automated nose-down feature triggered by specific sensor inputs. It provides more direct control to the pilots. So, while both the 737 MAX MCAS and the 777 pitch trim system involve adjustments to the horizontal stabilizer to control the aircraft's pitch, the purpose, design philosophy, and level of automation differ between the two systems.
As previously stated, following these incidents, Boeing made significant modifications to the MCAS system. They redesigned the system to be less aggressive and ensure that it relies on input from two AOA sensors instead of only one. The number of times it can activate was also decreased. Additionally, pilots received enhanced training on how to respond to potential MCAS malfunctions and related emergency procedures.
Now, I’d like to explore some of the human factors involved. A better understanding and application of human factors psychology could have played a significant role in preventing accidents involving the Boeing 737 MAX or any other aircraft or complex system for that matter. Human factors psychology focuses on understanding human behavior, capabilities, and limitations in the design of systems and equipment to optimize human performance and safety. Human factors principles emphasize the importance of designing cockpit interfaces that are intuitive, easily understood, and conducive to effective decision-making and communication. This includes clear and unambiguous alerts, warnings, and indications related to critical systems such as the Maneuvering Characteristics Augmentation System (MCAS). A better understanding of human factors could have led to cockpit designs and displays that provided more explicit information about the operation and status of automated systems, potentially enabling pilots to recognize and respond to system malfunctions more effectively.
In both the Lion Air crash and the crash of Ethiopian Airlines Flight 302, cutting out the trim switches would have disabled the automatic function of the trim. I have practiced this procedure in the 777 many times. (As stated earlier, the systems are similar but not exactly the same.) Once the trim switches are cut out, the aircraft stays in the last trimmed position. This means that any change in airspeed will result in increasing control surface pressure. Following the two 737 MAX crashes, Boeing and regulatory authorities enhanced pilot training to ensure pilots are well-prepared to respond to unexpected flight control system activations, including those involving MCAS. These measures provide pilots with the knowledge and skills necessary to manage the aircraft in various runaway trim situations safely.
The MCAS switches on the Boeing 737 MAX were not red-guarded switches. In the original design of the 737 MAX, the MCAS system was not prominently highlighted to the pilots, and there were no specific switches dedicated solely to MCAS. Instead, the MCAS function was integrated into the broader flight control system of the aircraft.
A profoundly frustrating aspect of both crashes was that red flag events had occurred just the day before each crash. The aircraft involved in the Lion Air crash, a Boeing 737 MAX 8, experienced problems with the angle of attack (AOA) sensor and automated trim system on its flight the day before the crash. The pilots on that flight reportedly had difficulty controlling the nose-down trim and requested to return to the airport. The maintenance crew addressed the issue, and the aircraft was returned to service.
The aircraft involved in the Ethiopian Airlines crash had a similar situation on its penultimate flight. The crew experienced an un-commanded nose-down trim and successfully addressed the issue using the runaway stabilizer procedure provided by Boeing. The maintenance crew reviewed and cleared the aircraft for its final flight. Unfortunately, the crew on the fatal flight faced a similar issue, and despite following at least some of the prescribed procedures, they were unable to regain control. Both these accidents were avoidable even with the substandard lack of adherence to redundancy in design. In this case, MCAS was connected to only one AOA vane.
Redundancy is a widely practiced policy in aviation design and training. As I recall, the F-15A, which I flew years ago, had seven separate hydraulic circuits to make it as battle-damage-resistant as possible. The Sioux City DC-10 crash in 1989 involved a complete loss of hydraulic power due to a thrown engine fan blade. This situation was at least partially rectified by adding what later came to be called the “Sioux City switch.” It was adapted into the MD-10s I flew for years, and I even got to practice landing the aircraft with only the hydraulics protected by this switch. (It wasn’t pretty.) Had the MCAS been connected to a second AOA vane, both accidents may have been avoided.
A better understanding of human factors could have led to an organizational culture encouraging open communication, reporting safety concerns, and a proactive approach to addressing potential safety-critical issues. This could have facilitated information sharing about the MCAS system's behavior and contributed to a more robust safety oversight process during the days preceding the fatal crashes and the aircraft's development and certification.
A broader integration of human factors psychology in the design, training, and organizational aspects associated with the Boeing 737 MAX would have enhanced safety and provided a deeper insight into the interactions between pilots and automated systems. This, in turn, could have played a crucial role in averting these two accidents. Improved communication between maintenance, engineering, training, and operations could have alerted flight crews to persistent trim system problems. The application of human factors principles is valuable not only for commercial aircraft but can also bolster the safety and efficiency of any complex technological system.
