Moments after taking off from Jakarta, the pilots flying Lion Air 610 realized they were losing control of their 737 Max jetliner, the newest, most fuel-efficient and most automated model of Boeing's mainstay aircraft.
The jetliner's nose unexpectedly pointed down, sending it into a series of 26 dives at less than 5,000 feet. Toward the end, the pilot pulled back on the control yoke with all his might to bring the nose up, but the plane entered a death into the Java Sea.
The crash, 11 minutes after takeoff, killed 181 passengers and eight crew members.
The causes of the Oct. 29 crash are still being investigated by teams from Indonesia, Boeing and the U.S. National Transportation Safety Board. The investigation is examining the role of software intended to protect against pilot errors that have caused several deadly crashes around the world and whether the crew understood the system. When the aircraft's flight control system malfunctioned, the pilots didn't know that flipping a single switch in the cockpit would counteract the problem.
"They never pulled out of a mode of confusion and panic," said Hans Weber, a San Diego air safety expert and retired aerospace executive. As the aircraft's automated flight control system kept pushing the nose down, no matter how hard they tried to pull up, "they didn't have enough leverage," he said. "It seems crazy."
The accident involved many factors, including poor maintenance, inadequate pilot training and not reporting previous problems on the same aircraft, but the automated system's failure is a focus of the investigation.
Boeing has been well known in the aviation world for a design philosophy that gives pilots significant authority over the aircraft's flight controls. In contrast, European manufacturer Airbus' jetliners are highly automated, limiting what pilots can do to adjust controls.
But in a departure from its normal practice, Boeing inserted in the 737 Max software intended to prevent pilots from pulling up the nose of aircraft when they should push it down to counteract stalls and vice versa. Fatal crashes have occurred when pilots didn't heed stall warnings. In 2009, an Air France plane flying to Paris from Rio de Janeiro fell into the Atlantic Ocean after one of the pilots continued to pull the plane's nose up, despite multiple stall warnings. That same year, a twin-engine turboprop, operated by Colgan Air, crashed in Clarence City, N.Y., after the crew ignored stall warnings.
Engineers also redesigned the plane with bigger, more fuel-efficient engines that shifted the center of gravity forward, creating a potential for the aircraft's nose to pitch up after takeoff. Such a nose-high attitude can reduce the lift from the wings to the point that the aircraft starts to drop out of the sky.
To safeguard against such a condition, the 737 Max software automatically adjusts what is called the trim or the fine adjustments on a plane's rear stabilizer so that the nose can pitch down in certain conditions. The software was given the oblique name "maneuvering characteristics augmentation system" or MCAS.
"What Boeing did was take the pilot out of the loop," said Michael Barr, former director of the University of Southern California's Aviation Safety and Security Program, which trains accident investigators. "The concept was good, but the question is whether it was properly communicated to the pilots about what it is supposed to do and how it is supposed to work."
Boeing's viewpoint is that the procedure to handle a malfunction of the trim system did not change from previous generations of the 737 and the ability of flight crews to disable the automatic trim is the same on its aircraft dating back decades. Since the accident, two airlines have placed sizable orders for the 737 Max, leading Boeing to believe that the accident will not tarnish the plane's reputation.
In a message to employees, Boeing CEO Dennis Muilenburg said "the 737 MAX is a safe airplane." He denied media reports that "we intentionally withheld information about airplane functionality from our customers" and said "the relevant function is described in the Flight Crew Operations Manual."
"We have not changed our design philosophy," Muilenburg told CNBC in an interview Thursday. "These are airplanes that handled well in the control of the pilots. They're designed the same way our previous 737s are."
But unions representing American and Southwest airlines pilots say they were unaware of the MCAS system before the Lion Air crash. American pilots who flew the 737 Next Generation aircraft, the previous model, were able to qualify to fly the Max by taking a 56-minute computer lesson to understand the differences between flying the two planes, said Dennis Tajer, a spokesman for the Allied Pilots Association and a pilot. The MCAS system was not covered in that lesson.
For the MCAS system to work correctly depends on accurate measurements from outside sensors that report the angle at which the aircraft is flying _ whether it is cutting straight through the air or sliding at an angle. It's called the angle of attack.
Those sensors on the Lion Air jetliner had malfunctioned for the two days before the crash. Maintenance crews thought they had fixed the problem but never got to the bottom of it. The serious problem should have been reported by Lion Air to civil aviation authorities around the world, but wasn't.
The sensors were incorrectly telling the flight control computer the aircraft had a high angle of attack and was at risk of stalling. Seconds after the wheels left the ground, the pilot's yoke began to shake, signaling that the plane was flying too slowly and the nose was too high. In error, the software automatically adjusted the stabilizer trim to point the nose down.
Veteran pilots say the crew should have recognized something was causing what is known as "runaway trim," in which the control system keeps increasing the trim _ an error that can be caused by as many as five conditions. The captain of Flight 610 was a 31-year-old who had just 6,028 hours of experience, few by U.S. standards.
"They had just taken off, and the stick was shaking," said Robert Ditchey, a former airline executive and a co-founder of America West Airlines. "They should have known they were not stalling. You have all of the other instruments telling you that you are OK. You could look out the damn window."
The stabilizer trim system is also controlled manually by large black wheels in the cockpit that the pilots can twirl around to adjust trim. An aircraft engineer said the pilots should have seen the wheels automatically spinning for as much as 10 seconds, which would have been a giveaway that the plane had entered a runaway trim condition.
If the Lion Air pilots had figured out that the stabilizer trim was causing the plane to dive, they could have disabled the automated system with a switch on the center console, manually moving the large trim wheels or pushing a button on the trim wheels.
Crews on the two previous flights on the same aircraft encountered the trim problem and shut down the system, avoiding any further risk, according to a preliminary accident report issued by Indonesian civil aviation authorities.
John Cox, a veteran pilot and air safety expert, said the captain of the earlier flight dealt with the malfunction by turning over controls to the first officer early, so he could diagnose the problem. But on Oct. 29, the captain continued flying the plane well after takeoff.
"They are getting a cascade of fault messages," Cox said. "The captain is hand-flying the aircraft and he is very close to task saturation, trying to figure out how these messages are connected and what is broken on the airplane."
Weber said the accident is part of a culture problem, particularly among fast-growing Asian airlines, in which jetliners are operated as a computer rather than a machine controlled by hand.
"They are reluctant to fly the plane," he said. That cockpit culture was cited by many aviation experts in the 2013 crash of an Asiana jetliner in San Francisco that pointed out the weak manual flight qualifications of the crew.
As the latest crash investigation proceeds, airlines are moving to strengthen pilots' understanding of the new software. In the U.S., the MCAS system was a "hot item" during a recurrent ground school training session this week for American Airlines pilots, said Tajer, the union official.
"There's no question there's all hands on deck to make sure this never happens again and pilots are aware of the aircraft they take command of," he said. "Clearly, we embrace technology, but not when it's done in the absence of knowledge and without the pilot understanding it. In the event that the technology fails, we are the last line of defense."
