The first thing to say after an aviation disaster, such as the Ethiopian Airlines crash that killed all 157 people aboard over the weekend, is that it is an unspeakable tragedy for those who perished and for the families, communities, and organizations that will forever feel the effects of this loss. Sympathies to all of them.
The second thing to say is that much of the initial guesswork and speculation about crashes turn out to be false, and it can take months or years to deduce what actually happened. (Or longer, as with the ongoing uncertainty about the lost Malaysia Airlines Flight 370, which vanished more than five years ago.)
Modern airlines are statistically very, very safe. The most recent U.S. airline fatality was in April 2018, when an engine blew up on a Southwest flight—and the debris hit a window and pulled one passenger partly outside, leading to her death. Five years before that, an Asiana Airlines plane, from Korea, had a misjudged-landing accident in San Francisco, in which three passengers died. Before that had been another multiyear stretch of no fatalities in U.S. airline operations.
This doesn’t make the tragedy or horror any less when a crash occurs. But it helps explain why it can take so long to determine the cause. Modern accidents almost always involve some strange, improbable, edge-case conditions, precisely because so many of the “normal” risks have been studied and prevented with redundant safety features.
So no one knows, yet, what happened in the Ethiopian Airlines disaster, and anyone who feigns certainty now should be viewed with wariness.
But here is an initial guide to the kinds of questions air investigators will be asking.
What’s the (possible) similarity between this crash and the Lion Air disaster in October 2018, in Indonesia, in which 189 people were killed?
The main known similarity at this point is that they both involved the same, relatively new model of airplane. This is a new version of the workhorse Boeing 737, known as the 737 Max 8. Both of the planes crashed shortly after takeoff—not mid-flight, like the Air France disaster over the Atlantic 10 years ago, and not on approach for landing, as with the Colgan commuter-airline crash en route to Buffalo in 2009.
What’s significant or different about this new plane?
The 737 is the most familiar and popular commercial airliner in the world. It’s been in production since the 1960s, and more than 10,000 of them have been in service. If you’ve ever taken a ride on Southwest Airlines, you’ve been on a 737, because it is all that Southwest flies. Complete standardization of the fleet has been an important part of Southwest’s business model since the start. (When I was working for Texas Monthly, back in the 1970s, I interviewed the late Herb Kelleher, a founder of the then-nascent Southwest, who stressed that with a single model of aircraft, everything about running an airline became simpler. Any pilot who worked for the airline could fly any plane the airline owned. Any mechanic at any Southwest repair facility would have the right parts for any plane that arrived, because all the planes were the same. I wrote about this part of Southwest’s vision in 1975, during the era of airline regulation, in Texas Monthly.)
Aircraft makers themselves have obviously invested in an evolutionary series of airplanes for different markets and circumstances. Thus we have, from Boeing, the long sequence from the now-obsolete 707, to the iconic and mainly decommissioned 747, to the 777 and 757 and 787 “Dreamliner,” and version after version of the 737.
Okay, but what’s “new” about this plane?
The “version after version” part is what’s significant about the 737. Airlines like it because it is standardized. Training, crew certification, parts, maintenance, are all much more similar than if you’re switching to a different model—such as a 787—or making the more dramatic shift to Airbus.
But airlines also want constant improvements: better and more efficient engines, improved avionics and other systems, and of course, more (and more crammed-in) seats. Thus the 737 range goes from the early 737-100 models, meant to hold about 100 passengers, to the latest models, which (depending on layouts) can hold 200 or more.
The 737s have gotten physically longer over the years, to hold more passengers, and that is part of the drama involving the latest model, which went down in both the Indonesian and Ethiopian crashes.
These new Max airplanes have different engines from previous 737 models—more powerful, and more efficient. But because these new engines are physically bigger than previous versions, they are mounted in a slightly different place on the wings than on previous lines of 737s. The ramifications of this shift are highly complicated (and very well laid out in this detailed New York Times account by James Glanz, Julie Creswell, Thomas Kaplan, and Zach Wichter, published only last month). But the crucial point is that the new positioning of the engines seems to have changed the handling characteristics of the airplane in a very, very precise way:
- The new Max planes handle enough like previous 737s that pilots are not required to go through a whole separate certification, as they would if switching, say, to a 787 or any model of Airbus; but
- They handle differently enough from previous 737s that a new software/automatic control system was added to control them.
What’s the new software system?
It is something called MCAS (for Maneuvering Characteristics Augmentation System), and the aspect now getting attention is its “anti-stall” protections. Despite the unfortunate similarity of the term, an aerodynamic stall has nothing to do with stalls as people usually encounter them, with cars. An automotive stall involves something that stops the engine. An aerodynamic stall occurs when the nose of the plane is pointed too steeply up against the oncoming wind. When this happens, the aircraft exceeds its critical “angle of attack” (AOA). The oncoming air no longer flows over the wing, as part of the process that provides lift and keeps the airplane up. Instead (to oversimplify), it starts beating against the bottom side of the wing, and in other ways stops keeping the plane aloft. When an aircraft stalls, it stops flying or gliding, and begins just falling, like a rock, out of the sky.
If the system’s sensors detect that the plane’s AOA against the air is becoming dangerously high, leading to a possible stall, the automated controls would intervene to push the plane’s nose down, whatever the pilot might be intending at that time. You can read many details about the 737 Max’s MCAS system, including some helpful diagrams, in a post in The Air Current.
For a crude parallel in automotive technology, you could think of an antilock-braking system in a car, which detects when a driver is mashing down too hard on the brakes, and intervenes to keep the car from going into a skid. Or, in upcoming models of autonomous vehicles, consider a system that might prevent a car from drifting out of its lane, or across the center line into oncoming traffic, or entirely off the road.
Even if it’s working perfectly, any such automated system has obvious limitations. For a car, the classic case is a split-second choice: What if a truck has crossed the median and is barreling toward you head-on, but if you swerve away you’ll hit a family on the curb? There’s no good answer there, but for now most people (I think) would be queasier about leaving that life-and-death choice to an algorithm.
With airplanes (except fighter planes in combat, aerobatic pilots, the Blue Angels, etc.), there are fewer split-second decisions to make. When something goes wrong, you usually have time to think for a minute, rather than instantly respond. The concern about automation in airplanes involves failure of a simpler sort: that somehow the computerized systems will misidentify where the airplane is, or what is happening to it, or what the safest maneuver would be, and thus “intelligently” take the aircraft on a path straight toward doom. A famous example is an American Airlines crash in Colombia in 1995. The pilots thought they had entered the right waypoint into the plane’s autopilot system. Because of a mix-up in labeling systems, they entered the wrong waypoint—and the plane faithfully headed toward the one they had selected, smashing into a 9,800-foot mountain en route. (Post-crash investigations found that the deceased pilots had been negligent in their programming. The automation-related point is that the guidance systems worked just fine, until the moment the plane was destroyed.)
How is this related to the Indonesian crash—and perhaps the one in Ethiopia?
Four and a half months after the Lion Air crash in Indonesia, evidence suggests that the MCAS system kept trying to push the airplane’s nose down—even when it was headed too far down, and the plane was plunging toward the sea. For details, see that New York Times story, this one by Dominic Gates in The Seattle Times (which, with its location in Seattle, has a long record of expert aviation coverage by Gates and others), or this column by the airline pilot Patrick Smith, on his Ask the Pilot site.
In the Lion Air crash, the pilots apparently kept trying to pull the plane’s nose back up. The MCAS system kept pushing it down. The automated system eventually won. The question that’s not yet answered about that crash is why the pilots didn’t turn off or disable this system. Such fail-safe override controls are built into every automated flight system I’ve ever heard about. As Patrick Smith discusses in his post, it’s possible that the pilots didn’t understand how the new MCAS system worked, or what it would be trying to do. It’s possible that they didn’t know where the overrides were. It’s possible that … well, anything might have occurred.
Is this what happened in the Ethiopian Airlines case as well? Was the AOA-sensing system that triggers the MCAS flawed or broken? Were the automatic controls trying to push the plane down, down, down, while the pilots fought to keep it up? Did the pilots try to override or disable the system? (For instance, by lowering the plane’s flaps, which happens on every landing and is designed to automatically disable the MCAS system.) Were they caught by surprise and unaware of what that system was doing? Were they fully aware, but still unable to alter the fatal path down?
Or was something else, something entirely unrelated, responsible for this crash? Something that had nothing to do with this model of airplane, or these new automated systems? At the moment, I believe no one knows. That is what Boeing, the Ethiopian authorities, the National Transportation Safety Board, and the world’s airlines are trying to figure out. There are enough differences between the two crashes—for instance, in the fluctuations in speed and altitude before impact—that the causes could turn out to be wholly unconnected.
In the haze of limited information and multiple possibilities, I’ll close with this update from Patrick Smith, which I’ve just now seen and which makes sense to me. He writes:
For pilots, dealing with the unwanted nose-down command [of the MCAS system] would be, or should be, relatively easy. The anti-stall system can be overridden quickly through a disconnect switch. Why the Lion Air pilots failed to do this, if in fact they did, is unclear, but unaware of the system’s defect in the first place, we can envision a scenario in which they became overwhelmed, unable to figure out in time what the plane was doing and how to correct it.
“Though it appears there’s a design flaw that Boeing will need to fix as soon as possible,” I wrote in November,“passengers can take comfort in knowing that every MAX pilot is now acutely aware of this potential problem, and is prepared deal with it.”
The Ethiopian accident, though, makes us wonder. With the Lion Air crash fresh on any 737 MAX pilot’s mind, you’d expect the crew to have recognized the malfunction right away and reacted accordingly. Did they realize what was happening? Did a disconnect somehow not work? Or was the problem something else completely?
We don’t yet know, but there’s a lot at stake here—for Boeing, for the world’s airlines, and for the traveling public.
More information and clues as they become available.