Accident Details


Boeing 737 MAX 8 crashes
Domain: Air
Year: 2018
Data Categories: Dynamic, Staffing and training, Justification, Adaptation, Asset, Performance
Properties Lost: Integrity, Completeness, Accuracy, Availability, Verifiability, Fidelity / Representation

Summary:

On two occasions a single faulty Angle-of-Attack sensor repeatedly commanded the nose down, leading to the aircraft flying into the sea/ground

Details:

On October 29th 2018, Lion Air flight 610 was lost with all on board when it flew into the sea. On March 10th 2019, Ethiopian Airlines flight 302 flew into the ground. In each case the aircraft was a Boeing 737 MAX 8 — the latest modernised iteration of the 737 airframe design, and in each, a software system called the Manoeuvring Characteristics Augmentation System (MCAS) has been established as the principle cause of the crashes.

The MCAS system was introduced because bigger, and hence more fuel efficient, engines are used on the 737 MAX 8, which had to be positioned higher on the wing and further forward (to ensure sufficient ground clearance for the larger engines). This changed the aerodynamic properties of the aircraft and meant the 737 MAX 8 tended to pitch up during high angles of attack. MCAS was introduced to counter this effect by taking input from an Angle of Attack (AoA) sensor and commanding the horizontal stabiliser control surfaces to bring the nose down. Although the aircraft has two AoA sensors, only one sensor gave input to MCAS at any one time, meaning that a single sensor failure could cause the nose to be forced down incorrectly. The design of MCAS allowed this to happen repeatedly, which if left unchecked would eventually force the aircraft into an unrecoverable dive.

MCAS did not compare data from the two sensors in order to detect a discrepancy between them, and hence indicate that the sensor data was not trustworthy (Data Category: Dynamic; Properties lost: Integrity, Accuracy, Fidelity/representation; Mitigations unused: redundancy). Furthermore, the function (outside MCAS) to report a discrepancy between the sensors to the pilots was not enabled, reducing the crew’s ability to respond appropriately (Data Category: Dynamic; Properties lost: Availability).

Several other data-safety-related failures can also be found in the report on flight 610:

  • The MCAS system was not described in the pilot’s manual and training materials (Data Category: Staffing and training, Properties lost: Availability)

  • There was no indication to the pilots that MCAS was active (Data Category: Dynamic; Properties lost: Availability)

  • The AoA sensor fitted to flight 610 was incorrectly calibrated during a previous repair, reporting an angle 21 degrees higher than the correct value. But this was not detected during the repair (Data Category: Justification; Properties lost: Availability, Fidelity/representation, Verifiability).

  • The evidence of the testing of the AoA sensor after fitting to flight 610 by the maintenance crew was erroneous (Data Category: Justification; Properties lost: Integrity, Availability, Verifiability)

  • 31 pages were missing from the maintenance log-book for flight 610, including the records of the testing of the AoA sensor after fitting to the aircraft (Data Category: Asset; Properties lost: Completeness, Availability, Verifiability)

  • During the previous flight of the aircraft on flight 610, the pilots experienced repeated activation of the stick shaker, and other alarms, which were caused by the faulty AoA sensor. However they did not fully report all the issues in the flight logs, and so the maintenance crew’s remediation activities did not lead them to suspect an issue with the sensor. (Data Category: Performance, Properties lost: Availability)

  • During flight testing, adaptation was changed to give MCAS more authority, without a new safety impact assessment (Data Category: Adaptation; Properties lost: Verifiability).

Links:

© 2025 Mission Critical Applications Limited. Company number 3838464.