Faultory

Case file 64 · Engineering & technology

One vane, and a system pilots had not been told about

Lion Air 610 (2018) and Ethiopian 302 (2019): how could one angle-of-attack sensor command a new airliner nose-down again and again?

Subject
Boeing 737 MAX MCAS crashes (2018–2019)
Reading
15 min
Evidence
5 exhibits
Reasoning
4 steps
Level
Advanced
A Boeing 737 MAX airliner at a roll-out event.
8 December 2015 A Boeing 737 MAX at a 2015 roll-out, shown as an example of the type. It is not the aircraft involved in either accident. Photo: Aka The Beav · CC BY 2.0 · Wikimedia Commons.
Illustrative signature. An illustrative trace of a trim-like signal that repeatedly dips and recovers, sketched to show repeated activation rather than recorded data. Drawn to explain the case, not plotted from source data.

01 · The briefing

Begin with the question.

The Boeing 737 MAX carried MCAS, the Maneuvering Characteristics Augmentation System, which could move the horizontal stabilizer to push the nose down in certain high-angle conditions. The system was intended to improve handling and reduce pitch-up tendency at elevated angles of attack. In both flights the crews struggled against the nose-down trim for much of the flight. On 29 October 2018 Lion Air flight 610 crashed after departing Jakarta, and on 10 March 2019 Ethiopian Airlines flight 302 crashed after taking off from Addis Ababa with 157 people on board. In both accidents investigators found that MCAS commanded repeated nose-down trim after input from an angle-of-attack sensor giving wrong readings. The investigations weigh the pilots’ response, the maintenance actions on the sensor and the design of the flight control system. The Ethiopian report and the US response disagree about what first made the sensor wrong. This investigation separates three questions: what the design allowed, what the certification review assumed about pilot response, and what the crews had been told. Use the four sources to test each claim, and note where they disagree.

The timeline

  1. In a flight simulator test, a Boeing test pilot takes more than 10 seconds to respond to an uncommanded MCAS activation, a result the House committee reports was described as catastrophic.

  2. A Boeing engineer questions whether MCAS is vulnerable to single AOA sensor failures. The House committee cites an internal email dated 17 December 2015.

  3. A mechanic in Denpasar replaces the left angle-of-attack sensor on the airframe of Lion Air flight 610, the day before the crash flight.

  4. Lion Air flight 610 departs Jakarta. MCAS acts more than 20 times as the pilots fight the nose-down trim, and the aircraft crashes.

  5. Ethiopian Airlines flight 302 crashes after takeoff from Addis Ababa. The Ethiopian investigation counts four MCAS activations.

  6. The Joint Authorities Technical Review submits its report to the FAA, finding that MCAS was not evaluated as a complete and integrated function in the certification documents.

  7. Ethiopia’s Aircraft Accident Investigation Bureau issues its final report, attributing the erroneous sensor reading to an electrical fault in the sensor heater.

A researched reconstruction for learning. These reasoning steps simplify a complex record; no score can capture the full history.

02 · The evidence

What does the record show?

Read each exhibit before settling on an explanation. The source links below every exhibit lead to the record behind it.

Exhibit 01

A single sensor was enough

The House committee report states that Boeing permitted MCAS to act on input from a single angle-of-attack sensor and did not classify MCAS as a safety-critical system. It also records that a Boeing engineer questioned in 2015 whether MCAS was vulnerable to single AOA sensor failures. The committee says the decision was widely criticised by safety experts. This establishes the design decision and the internal questions raised about it. It is a committee’s assessment based on documents, and it does not measure how often a single sensor fault would occur.

Source record s1democrats-transportation.house.gov

Exhibit 02

A certification review that did not see the whole

The Joint Authorities Technical Review, prepared by international regulators for the FAA, found that MCAS was not evaluated as a complete and integrated function in the certification documents. It also records that applicants seemed to treat FAA guidance as assuming a pilot would respond correctly within about four seconds, and that no studies were found to substantiate the FAA’s recognition and reaction time figures. This establishes the assumption the certification process relied on. It does not establish how pilots would have responded if they had been trained on MCAS.

Source record s2faa.gov

Exhibit 03

Contributing factors in the Ethiopian report

The Ethiopian Aircraft Accident Investigation Bureau lists as its most probable cause repetitive, uncommanded nose-down inputs from MCAS caused by an erroneous angle-of-attack input. Its contributing factors include reliance on a single AOA sensor, the absence of an AOA DISAGREE warning on the displays, and MCAS not being covered in crew training. The report records the fourth MCAS activation during the flight. This establishes the report’s findings. It does not establish the origin of the erroneous sensor reading, which the report attributes to an electrical heater fault that the NTSB disputes.

Source record s3bea.aero

Exhibit 04

The disputed trigger

The NTSB’s response to the Ethiopian report concurs with the investigation of MCAS and related systems and the roles they played. It says the final report included new information the NTSB had not reviewed, and that the NTSB’s comments were not appended as Annex 13 requires. The NTSB states that the erroneous sensor output was caused by the separation of the vane after impact with a foreign object, most likely a bird, and that it gave the bureau supporting evidence. This establishes a documented disagreement about the trigger. It does not decide which view is correct, because the physical sensor was not examined in this review.

Source record s4ntsb.gov

Exhibit 05

Lion Air, the refurbished sensor and repeated activation

The House report describes Lion Air flight 610’s sensor replacement the day before the crash flight: a mechanic fitted a refurbished angle-of-attack sensor that had been used on another aircraft and rebuilt in late 2017. On the crash flight, the report says MCAS acted more than 20 times as the pilots fought the nose-down trim. It notes that a previous crew had not documented its use of the trim cutout switches, so the next crew lacked that information. This establishes what the committee reported. These figures come from the committee's summary of the Indonesian KNKT report, not from that report directly.

Source record s1democrats-transportation.house.gov

03 · Your reasoning

Follow the strongest explanation.

Choose an interpretation, then compare it with the evidence. You can revise your choice. The goal is understanding, not a perfect score.

Reasoning step 01 of 04

Which design feature allowed a single faulty sensor to command repeated nose-down trim?

Evidence-based explanation

The House committee and the Ethiopian report both describe MCAS as dependent on a single angle-of-attack sensor, and the Ethiopian report lists that reliance as the first contributing factor. The House report records that Boeing later said MCAS would use two sensors and would no longer activate repeatedly, which reflects the weakness the design had. Averaging, airspeed input and autopilot override do not match the descriptions in these sources.

Weigh it against

Exhibit 01A single sensor was enoughExhibit 03Contributing factors in the Ethiopian report

Reasoning step 02 of 04

Why could the crews not stop the nose-down commands in time?

Evidence-based explanation

The House report says Boeing concealed the existence of MCAS from pilots and failed to disclose that the AOA DISAGREE alert was inoperable on most of the fleet. The Ethiopian report lists the missing alert, the training gap and the confusing combination of indications as contributing factors. Together these explain why a crew could struggle with the trim without a clear cue for its cause, which is the operational context the commands arrived in.

Weigh it against

Exhibit 01A single sensor was enoughExhibit 03Contributing factors in the Ethiopian reportExhibit 05Lion Air, the refurbished sensor and repeated activation

Reasoning step 03 of 04

Which best explains the disagreement over what first made the Ethiopian sensor read wrongly?

Evidence-based explanation

The Ethiopian bureau’s final report, as the NTSB summarises it, relies on an electrical fault in the left sensor heater. The NTSB’s response says the vane separated after impact with a foreign object, most likely a bird, and that it gave the bureau the supporting evidence. The two bodies agree on MCAS and its role, so the dispute is narrower than the whole accident. The NTSB’s view is not independently verified in this review.

Weigh it against

Exhibit 03Contributing factors in the Ethiopian reportExhibit 04The disputed trigger

Reasoning step 04 of 04

Which change would most directly address the timing problem the JATR describes?

Evidence-based explanation

The JATR found that applicants used FAA guidance as a 4-second design assumption, and that no studies were found to substantiate that guidance. The House report records a 2012 test in which a Boeing test pilot took more than 10 seconds to respond. Testing the complete function under realistic timing, with simulator training for uncommanded activation, is the change that follows from the evidence. Lengthening the assumption, reducing scrutiny or relying on the existing procedure do not address the gap the reports describe.

Weigh it against

Exhibit 02A certification review that did not see the wholeExhibit 01A single sensor was enough

04 · The findings

The chain behind the outcome.

Repeated nose-down commands came from a design in which MCAS could drive the horizontal stabilizer from one angle-of-attack sensor, with no cross-check against the second, and could activate more than once. The House report, the JATR and the Ethiopian report all treat single-sensor reliance as a central weakness. The JATR also found that MCAS was not evaluated as a complete, integrated function in the certification documents, and that the response times assumed for pilots lacked substantiation. A 2012 simulator test had already recorded a Boeing test pilot taking more than 10 seconds to respond. Pilots were not told MCAS existed, and the AOA DISAGREE alert that could have flagged a faulty sensor was inoperative on most aircraft. The Lion Air aircraft had received a replacement sensor the day before, and the next crew had no record of the earlier trim-cutout actions. The Ethiopian trigger is disputed: the Ethiopian bureau attributes the sensor fault to an electrical heater problem, while the NTSB attributes it to a vane damaged by an impact, most likely a bird. Both bodies agree that MCAS played the central role. The established facts are the design, the certification assumptions and the missing alerts. The sensor trigger on the Ethiopian aircraft remains contested.

Contributing causes and conditions

  1. MCAS was designed to push the nose down on input from one angle-of-attack sensor, without a cross-check against the second.
  2. MCAS could activate repeatedly, and each activation moved the horizontal stabilizer further nose-down.
  3. The certification review did not evaluate MCAS as an integrated function, and its pilot response assumptions were not substantiated.
  4. Pilots were largely unaware that MCAS existed, and the AOA DISAGREE alert was inoperative on most aircraft.
  5. Sensor readings were erroneous on both flights, with the cause of the Ethiopian error disputed between the two investigating bodies.
  6. Procedures and orders issued after the Lion Air accident did not prevent a second MCAS-related accident.

OutcomeBoeing 737 MAX MCAS crashes (2018–2019)

Take the method with you

  1. A safety analysis that treats a critical input as single-sourced must say so, and must test the failure against the crew’s realistic response time.
  2. When a design’s safety depends on a crew’s response, the assumed response time needs evidence, not convention.
  3. Where investigators disagree about the trigger, separate the parts they agree on from the part they dispute before judging the whole.

You can read findings at any time. Exploring every reasoning step marks this case as complete in your notebook.

Open another investigation

The open record

Sources & further reading

Read the original record and its scope before relying on a conclusion. Source references support the exhibit summaries; Faultory’s reasoning prompts are editorial reconstructions.

  1. s1
  2. s2
  3. s3
  4. s4

Written and curated for Faultory by Yunus Emre Vurgun, with AI-assisted research and drafting. Sources and interpretations can need correction. Read our editorial standards or report an issue.

From the journal

Field notes that use this case

Keep investigating