Air on the Tail

Running Rampant in the Sim

Eli: In 2016, Mark Forkner, Boeing's chief technical pilot for the 737, tested the new MAX in a flight simulator. That's a software copy of the plane on the ground, built to show how it handles before it's certified. Afterward he messaged a co-worker. A piece of flight software called MCAS, he wrote, was "egregious." It was "running rampant." Then: "So I basically lied to the regulators (unknowingly)."

Mara: So a stand-in airplane, and the stand-in showed the software misbehaving.

Eli: Right. A stand-in that's meant to fly like the real thing, used on the way to certification.

Mara: And Forkner sat close to what pilots would learn. As chief technical pilot, he helped develop the MAX's training and its flight manuals.

Eli: Which is where the listener's question starts. Why did the Boeing 737 MAX crash twice, and why couldn't the pilots stop the plane's own software? Today's angle is how scrubbing automated flight software to avoid simulator training created an aerodynamic trap.

Mara: The story runs from that simulator to two cockpits, and to a checklist crews were told to trust. Whether standard procedures could beat a system pilots were never told existed stays open.

Eli: In 2016, the pilot shaping the manuals had already watched that software run wild. Where it came from is Mara's part.

The Price of a New Manual

Mara: It starts with engines. Boeing hung bigger CFM LEAP engines on a 737 design that dates to the 1960s. To fit, the engine housings moved forward and higher. That cost the plane some stability and control feel when the nose pitched up steeply. Boeing's fix, after studying options, was some aerodynamic changes plus the Maneuvering Characteristics Augmentation System, MCAS. It's background software that nudges the nose down when the plane pitches up too far, so the MAX handles like older 737s. Boeing built it as an extension of an existing system called speed trim, which automatically adjusts the tail to keep the plane steady.

Eli: And handling like older 737s was worth real money.

Mara: That's type rating commonality: pilots already qualified on older 737s could fly the MAX without a costly new qualification. A 2013 Boeing memo recommended describing MCAS as an addition to speed trim, not a new feature. The employee wrote: "If we emphasize MCAS is a new function there may be greater certification and training impact."

Eli: There was a price on that impact. Boeing agreed to pay Southwest Airlines a million dollars per airplane if its pilots needed simulator training. A clause penalizing itself like that gave Boeing a strong incentive to keep MCAS out of pilot documents.

Mara: And pilot documents were Forkner's job.

Eli: In 2016, Boeing expanded MCAS. At lower speeds it could now move the tail up to 2.5 degrees; accounts put the earlier limit around 0.6. That's the same year Forkner saw it running rampant. In January 2017 he wrote: "Delete MCAS, recall we decided we weren't going to cover it in the flight crew operating manual or the CBT, since it's way outside the normal operating envelope." That envelope is the routine range of speeds and angles a plane flies in. CBT is the computer-based training. With the FAA's agreement, MCAS came out of the pilots' materials.

Mara: Roughly four times the reach, and gone from what pilots would read.

Eli: Software that moves the tail by itself. Somebody at the FAA had to look at that.

Mara: Under the FAA's delegation system, much of that review was done by Boeing's own staff on the agency's behalf. Peter DeFazio and former FAA engineer Joe Jacobsen read what happened as the agency ceding too much of its safety work to Boeing, to keep deliveries on schedule and cut certification costs.

Eli: Mara, the Justice Department and the investigator who led the congressional inquiry read it another way: Boeing people concealed the revisions that made MCAS stronger, so FAA engineers never got to analyze the hazard properly. In that account, an FAA test pilot knew of the change, but the engineers who first assessed MCAS didn't grasp its new authority, and the rules didn't require Boeing to tell them.

Mara: Either way, the people flying the plane weren't told. One captain, speaking to Congress in 2019, put it in a sentence: "The huge error of omission is that Boeing failed to disclose the existence of MCAS to the pilot community."

Searching Empty Handbooks

Eli: October 29, 2018, early morning. Lion Air Flight 610 lifts off from Jakarta. Right after rotation, pulling the nose up off the runway, the captain's stick shaker fires, his control column rattling to warn of a stall. When the flaps come up, the nose-down commands begin. MCAS is moving the stabilizer trim, the whole horizontal tail, tilted by a motor to set the plane's pitch. The crew trims back nose-up. MCAS pushes down again. And again.

Mara: And whether pulling back on the column could stop it is disputed.

Eli: The force on the column reaches 103 pounds, and the plane still descends. The captain goes to the handbook for a procedure. He searches for about nine minutes. The system pushing them down isn't in it; Boeing had removed references to it with FAA approval. One unnamed source said: "They didn't seem to know the trim was moving down."

Mara: Fighting the tail with no name for what was fighting back.

Eli: Near the end, the first officer is flying, and his pulls on the column are weaker than the captain's had been. Diving at more than 10,000 feet a minute, the jet hits the Java Sea. All 189 people aboard are killed.

Mara: The day before, the same jet flew from Bali to Jakarta. The captain's sensor disagreed with the first officer's. The stick shaker went off, and automatic nose-down trim followed. One passenger said: "All of us were screaming like we are in a roller coaster." The captain switched off the electric trim, and the crew flew on, turning the trim by hand. They landed safely.

Eli: Same jet, same fault, a day apart. One crew cut the trim power and landed. The next was still searching a manual that never named what it was fighting.

The Four-Second Clock

Mara: Here's how one bad reading did that. MCAS listened to a single angle-of-attack sensor, a small vane on the nose that measures how steeply the wing meets the oncoming air. The MAX carries two; MCAS read one. A design with redundant inputs could have been considered, but Boeing's hazard rating didn't require it. So when that vane read high, MCAS pushed the nose down. In November 2018, Boeing warned every MAX operator that bad data could cause "uncommanded nose-down movement of the aircraft" that "can repeat until the related system is deactivated."

Eli: Forkner saw it run rampant in a simulator in 2016. On Lion Air, it ran with people aboard.

Mara: The FAA issued an emergency directive. Boeing had to revise the MAX's flight manual procedures, and crews were pointed to the existing runaway stabilizer checklist, the Bali crew's steps made official. It turns on the stabilizer trim cutout switches, two console switches that kill the electric trim motor.

Eli: So the whole fix rested on that checklist.

Mara: And the plan leaned on timing. A Boeing official said in 2019: "We took it into simulator with pilots and the typical reaction was four seconds." According to documents released that year, Boeing had recognized internally that a response slower than 10 seconds would be "catastrophic." The certification assumptions pictured a pilot spotting moving trim quickly, not one under a rattling stick shaker, stacked warnings and repeated activations.

Eli: Sullenberger flew the accident scenarios in a MAX simulator and said that even knowing what was coming, crews could have run out of time and altitude.

Mara: Dennis Muilenburg, then Boeing's chief executive, points instead to maintenance lapses after the earlier sensor faults, and to crews not cutting trim power through the memory items before the loads became unmanageable. What would happen when a crew ran Boeing's checklist to the letter remained to be seen.

The Jammed Jackscrew

Eli: March 10, 2019. Ethiopian Airlines Flight 302 leaves Addis Ababa for Nairobi. Almost at once the angle-of-attack values diverge. The stick shaker starts. Soon after the autopilot disengages, MCAS trims the nose down. The captain says to trim up with him, and they do. Then the first officer calls "stab trim cut-out" twice. The captain agrees. The switches go off.

Mara: The directive's checklist, run about half a minute after MCAS first fired.

Eli: Now the trim has to be turned by hand. About a minute later the captain asks if the trim is working. The first officer says it isn't, and asks to try it manually. The captain tells him to try. Moments later: "it is not working." Near the end, the captain asks to pitch up together, and says it's not enough. They switch the electric trim back on.

Mara: Which gives MCAS its motor back.

Eli: Two brief nose-up inputs. Then, about five seconds later, MCAS drives the nose down. Both pilots pull, and the nose keeps going, to 40 degrees down. One airspeed reading hits 500 knots as the recording ends.

Mara: The FAA's own analysis explains the wheel. Manual trim forces rise with speed and with how far out of trim the tail is. The tail pivots on a jackscrew, and heavy air pressing on a mistrimmed stabilizer jams that screw against anyone turning the wheel. So at that speed, manual stabilizer trim-wheel forces could become significant.

Eli: And Boeing had said there was a documented procedure for this situation.

Mara: There was, and it never warned about heavy forces on the hand wheel. In an April 2019 meeting with airlines and pilot unions, an FAA official said that checklist hadn't been validated since 1967.

Eli: Three years after Forkner's "running rampant," Flight 302 did what the directive said, in order, and the wheel still wouldn't turn. What came next for the fleet starts with Mara.

The Grounding and the Fix

Mara: The two crashes came less than five months apart. Within days of the second, the fleet stopped.

Eli: Under pressure from Indonesia and Ethiopia, from airlines, pilots, the public and the families of the 346 people who died, the US President ordered every 737 MAX grounded on March 13, 2019.

Mara: And Boeing's bestselling plane stayed grounded for 20 months.

Eli: In October 2019, Boeing's chief executive was before Congress. House Transportation Committee Chairman Peter DeFazio called it "inexplicable and inexcusable," and said "a variety of decisions could have made those planes safer and perhaps saved the lives of those on board."

Mara: That same month, Forkner's simulator messages came out.

Eli: And more with them. David Gelles of The New York Times said that when Lion Air asked for simulator training, Forkner disparaged the airline to colleagues, calling them stupid. On October 14, 2021, a federal grand jury indicted Forkner on fraud charges. He pleaded not guilty the next day. On March 23, 2022, a federal jury in Fort Worth, Texas, acquitted him on all charges. As of that verdict, he was the only person the federal government had criminally charged over the MAX.

Mara: The one person charged was the author of that 2016 message, and he was acquitted.

Eli: Boeing had already settled. In January 2021, the Justice Department charged it with conspiracy to defraud the FAA over MCAS, then put the prosecution on hold under a deferred prosecution agreement. The Justice Department stated that Boeing admitted deceiving the FAA through "misleading statements, half-truths and omissions." Boeing agreed to $2.5 billion, $500 million of it for the families.

Mara: Then the fix. The redesigned MCAS uses dual-sensor redundancy: it compares both angle-of-attack sensors, and if they disagree beyond a set threshold, MCAS and speed trim switch off. Its activation is limited, and pilots can override it with the control column alone. And every pilot returning to the MAX does a one-time session in a full flight simulator, the very training the Southwest clause had put a price on.

Eli: Investigators believe the software mistakenly pushed the noses down. Boeing's own account says that in both accidents, a single sensor gave MCAS incorrect information, which caused it to activate.

Mara: So the MAX crashed twice because software kept pushing the nose down on the word of one faulty sensor. The pilots couldn't stop it because they'd never been told it existed, the column couldn't override it the way the redesign now allows, and once it had trimmed the nose down at speed, the air on the tail jammed the wheel meant to save them. In 2016, Forkner watched that software run rampant in a simulator. Since the return to service, a simulator is where every MAX pilot meets it.

Eli: Two things are still being worked out. Investigators are testing whether a bird strike or an electrical flaw set off Flight 302's first sensor spike. And analysts are studying why that crew left the engines at takeoff thrust as the jet gathered speed.

Mara: For further reading: horizontal stabilizer trim.

Eli: Listeners can follow technology with us as we ask: how should automation and pilot training fit together?

Mara: That's all for this one. I'm Mara.

Eli: And I'm Eli. Thanks for listening to Angle. Until next time.