Richard Mithoff first learned that a Boeing 737 Max 8 had crashed off the coast of Indonesia while watching the news, growing astonished and then alarmed as the reports of the Oct. 29 Lion Air accident rolled in over the next several weeks.
The details of the tragedy were strikingly familiar to Mithoff, a prominent Houston trial lawyer who had represented the family of an American couple killed in the 2009 crash of an Airbus A330-200 operating as Air France Flight 447. In both cases, a sensor had provided incorrect data to automated operating systems, triggering a confusing cacophony of warnings and alarms.
The cockpits lacked an indicator that might have helped pilots to recognize the danger of their situation and correct the problems before it was too late.
“Boeing, you could argue, had the benefit of everything that should have been learned from Air France,” Mithoff said. “Boeing has to be measured against what the world of engineering, of avionics, should have known by the time they were pushing this (Max) design.”
The crash of Lion Air Flight 610 and the downing less than six months later of another Boeing Max 8, Ethiopian Airlines Flight 302, have prompted questions of whether the aviation industry heeded lessons of the Air France tragedy a decade ago. The similarities of the accidents reach beyond sensors and indicators to the broader issues of modern jets’ increasing reliance on automated, interconnected systems and the training of pilots to intervene when those systems operate incorrectly or inadequately.
Among those raising these concerns is Capt. Sully Sullenberger, a retired airline captain who in 2009 safely guided US Airways Flight 1549 to an emergency landing in the Hudson River after a bird strike knocked out the engines. Sullenberger said in an email that the Air France crash showed how relying on automation can cause dependence on it and undermine pilots’ confidence to take control of situations when automation fails.
It also showed the need to provide pilots with a deep understanding of all important systems and how they operate in both routine and rare situations.
“The global aviation industry has not effectively applied what we have learned from the crash of Air France 447,” Sullenberger said. “Had they done so, the 737 Max crashes might have been avoided.”
Neither Airbus nor Air France would comment. Boeing, in a statement, said that safety remains its top priority, but warned against speculating about the causes of the Lion Air and Ethiopian Airlines crashes until the investigations are complete and final reports issued.
Failing sensors
At 7:29 p.m. Brazilian time on May 31, 2009, Air France Flight 447 departed Rio de Janeiro for Paris on what was supposed to be a 12-hour flight. But the jet crashed into the Atlantic Ocean some three hours and 45 minutes later, killing all 228 people on board.
Among the passengers were Michael and Anne Harris, who owned a home in Montgomery County but were living in Brazil for Michael Harris’ work with Devon Energy Corp., an Oklahoma oil and gas company. Mithoff and fellow attorney Warner Hocker represented their children, Hampton Harris and Andrew Musgrove, in a wrongful death suit.
The lawsuit, filed Nov. 12, 2009, in U.S. District Court in Houston, highlighted severe storms and the plane’s insufficient weather radar, failed components that measure airspeed and a lack of adequate training on how to address component defects should they occur.
The final investigation report released nearly three years later supported several of the law firm’s allegations. Flying at about 35,000 feet, the Airbus A330-200 experienced a phenomenon called high altitude ice crystals, which blocked the pitot probes that measure air speed. This led to inconsistent readings and prompted the autopilot to disconnect, according to the French Civil Aviation Safety Investigation Authority’s report.
The crew struggled to control the plane while flying at a high altitude and in turbulence. They likely did not notice the plane beginning to stall — they never formally identified it, according to the accident investigation — and ultimately crashed into the Atlantic. It was later determined the crew lacked sufficient training on responding to stall situations when manually controlling an aircraft cruising at high altitude.
The 737 Max accidents, almost 10 years later, also began with a sensor. The 737 Max planes received faulty data from an angle of attack sensor that measures the angle at which wind hits the plane’s wings to provide lift, according to preliminary investigation reports and Boeing statements. Too steep an angle of attack causes wind to separate from the upper surface of the wing and can cause the plane to stall.
This angle of attack sensor was connected to the Maneuvering Characteristics Augmentation System, or MCAS. This new software was designed to make the Boeing 737 Max handle like previous generations of the 737.
The MCAS software was designed to bring the nose of the plane down if the angle of attack was too steep and could cause a stall. In both the Lion Air and Ethiopian Airlines accidents, the faulty sensor made the software system believe the plane was approaching a stall situation, so MCAS repeatedly brought the nose down even as pilots tried to climb with manual controls, according preliminary finidings.
As in the Air France crash, the 737 Max pilots apparently did not have sufficient training, according to media reports and at least one lawsuit. They lacked training on differences between the 737 Max as compared to previous 737 aircraft, with some pilots receiving just one hour of training on an iPad or computer. The FAA grounded the Boeing 737 Max 8 and Max 9 planes on March 13.
Boeing said it’s developing an MCAS software update to help protect against erroneous angle of attack data. Boeing also said the function performed by MCAS was referenced in the 737 Max Flight Crew Operations Manual as behavior that would occur if the plane reaches a high angle of attack.
Lion Air could not be reached for comment, and Ethiopian Airlines declined to comment.
Angle of attack indicator
Cockpit indicators exist to display a plane’s angle of attack. These can provide useful and direct information in many flight conditions, but very few planes have them, Sullenberger said.
Maintaining the proper angle of attack is important. If a plane reaches what is known as the critical angle of attack, which can vary from plane to plane, it can stall at any airspeed, altitude or attitude (which is the orientation of the plane relative to the horizon), according to a 2014 report from NASA.
Right now, most pilots deduce the plane’s angle of attack from airspeed indications, which only provide a rough estimate and don’t work in many situations, said Shem Malmquist, a Boeing 777 captain and visiting professor at the Florida Institute of Technology. An angle of attack indicator could allow pilots to more accurately monitor the angle of attack throughout the flight, not just getting an alert once it’s approaching a dangerous level.
The display also could be used to check if other sensors are acting incorrectly. Loss of airspeed indicators, for instance, might make pilots think they’re stalling. They could cross-check the angle of attack indicator to see if that’s the case, Malmquist said.
“It is ironic that most modern aircraft measure (angle of attack) and that information is often used in many aircraft systems, but it is not displayed to pilots,” added Sullenberger. “Instead, pilots must infer (angle of attack) from other parameters, deducing it indirectly.”
In the Air France accident, several aviation experts said an angle of attack indicator could have assisted crew members who apparently didn’t recognize the plane was stalling.
The French Civil Aviation Safety Investigation Authority recommended that the European Union Aviation Safety Agency and the Federal Aviation Administration evaluate the relevance of requiring angle of attack indicators. In its letter responding to the recommendation, the FAA said an angle of attack indicator may improve flight crew awareness in some circumstances, but the indicators would also increase pilot training requirements and pilot workload.
The FAA, noting that more familiar, existing cockpit gauges provide angle of attack-based information, opted not to mandate angle of attack indicators. The European Union Aviation Safety Agency similarly opted not to require angle of attack indicators.
Boeing offers angle of attack indicators as an add-on for its 737 Max planes and some other models, but not as standard equipment, saying they provide “supplemental information only and have never been considered safety features on commercial jet transport airplanes.” Neither Lion Air Flight 610 nor Ethiopian Airlines Flight 302 had angle of attack indicators, according to media reports.
Sullenberger said they might have helped in these two crashes.
“I have flown military aircraft that were equipped with (angle of attack indicators) and found them to be essential,” Sullenberger said in his email. “I have long understood their value and importance and think that every airplane should be so equipped and pilots trained in their use.”
Bit of nuance
The presence of these indicators is perhaps a little more nuanced in the Boeing crashes as the software apparently interfered with flying, said Malmquist, who is also co-author of the book Angle of Attack: Air France 447 and the Future of Aviation Safety. He said the pilots might have been aware of the situation but unable to beat the software.
But like Sullenberger, he supports having the angle of attack display and said it might have given the 737 Max pilots more time to address the problem. He emphasized that pilot training would be essential to introducing these indicators.
American Airlines of Fort Worth said it has purchased the angle of attack indicators for Boeing 737 aircraft since its first plane was delivered in 1999. The carrier would not say if this indicator is present on its other aircraft, which include other Boeing models, Airbus, Bombardier CRJ and Embraer ERJ.
Southwest Airlines, headquartered in Dallas, said it worked with Boeing earlier this year to add the angle of attack indicators on its 737 Max aircraft as a “supplemental cross-check in the event there is an erroneous (angle of attack) signal present.” It had previously installed these indicators on its 737-700 and -800 aircraft prior to the Lion Air accident in October. Southwest only flies Boeing 737 aircraft.
United Airlines of Chicago said it does not have angle of attack indicators on any aircraft, Boeing or otherwise, because the planes already have “proven and safe” anti-stall indicators and its pilots are trained to use other flight data for the safe operation of aircraft. Atlanta-based Delta Air Lines declined to comment.
Designing plane systems
Software has increased the complexity of planes, and the traditional way of scrutinizing systems — taking a linear approach that looks at how one component affects another, or examining each component separately and then combining those analyses for an overall picture — is no longer sufficient, Malmquist said.
Manufacturers and regulators must look at the interactions among various parts. A malfunction may no longer be isolated to a single component, but rather cascade across the many interconnected systems in modern jets, Sullenberger said when he testified before Congress in June on the Boeing crashes.
The cascading effects, he said in a written version of his testimony, can cause “multiple cockpit alarms, cautions and warnings, which can cause distraction and increase workload, creating a situation that can quickly become ambiguous, confusing and overwhelming, making it much harder to analyze and solve the problem.”
In the 737 Max aircraft, for instance, the failure of an angle of attack sensor triggered false warnings of speed being both too slow and too fast, Sullenberger said.
Moving forward, Malmquist said aircraft designers need a new technique to identify and consider how a plane’s systems will interact before it takes flight. That way, instead of just assuming pilots can handle the unexpected, cascading effects, aircraft designers will know how the systems interact and be able to create more adequate pilot training programs.
“We must find out how design issues, training, policies, procedures, safety culture, pilot experience and other factors affected the pilots’ ability to handle these sudden emergencies, especially in this global aviation industry,” Sullenberger said in congressional testimony. “Dr. Nancy Leveson, of the Massachusetts Institute of Technology, has a quote that succinctly encapsulates much of what I have learned over many years: ‘Human error is a symptom of a system that needs to be redesigned.’”
Moving forward
As for Mithoff and Hocker, their Air France case was resolved, but the terms kept confidential.
Still, they insisted that Boeing and the aviation industry, overall, should have learned from investigation findings released to the public. Those lessons included creating cockpit alerts that present data in a meaningful way and providing adequate pilot training.
The latter is potentially most important. In both accidents, had pilots been made fully aware of the systems and undergone extensive simulator training for the ways those systems could malfunction, the accidents might have been prevented.
“Training goes a long way in addressing a lot of these reoccurring issues,” Hocker said.
Twitter.com/a_leinfelder
———
©2019 the Houston Chronicle
Visit the Houston Chronicle at www.chron.com
Distributed by Tribune Content Agency, LLC.
