Black box data from a doomed Ethiopian Airlines flight suggests the crash was caused by a faulty sensor that erroneously activated an automated system on the Boeing 737 Max, a series of events suspected in an Indonesian disaster involving the same jet last year.
Data from a vane-like device, called the angle-of-attack sensor, incorrectly activated the computer-controlled system, according to several people who have been briefed on the contents of the black box in Ethiopia. The system, known as MCAS, is believed to have pushed the front of the plane down, leading to an irrecoverable nose-dive that killed all 157 people aboard.
The black box, also called the flight data recorder, contains information on dozens of systems aboard the plane. The black boxes on the jets, Boeing’s latest generation of the 737, survived the crashes, allowing investigators to begin piecing together what caused the disasters. Both investigations are continuing, and no final determinations have been made.
The new connections between the two crashes point to a potential systemic problem with the aircraft, adding to the pressure on Boeing. The company already faces scrutiny for its role in the design and certification of the plane. The Federal Aviation Administration delegated significant responsibility and oversight to Boeing.
The company is now on the defensive, as investigators, lawmakers and prosecutors try to determine what went wrong. The Justice Department is investigating the jet’s development, while the Transportation Department’s inspector general is looking into the certification process. The inspector general has issued a subpoena to at least one former Boeing engineer for documents related to the 737 Max, according to a person familiar with the investigation.
MCAS was originally designed to activate based on data from a single angle-of-attack sensor, which measures the level of the jet’s nose relative to oncoming air. Air-safety experts, as well as former employees at Boeing and the supplier that made the sensor, have expressed concern that the system had this single point of failure, a rarity in aviation.
“That’s not a good engineering system,” said Bjorn Fehrm, an aeronautical engineer and a former fighter pilot for the Swedish Air Force. “That’s where they screwed up royally.”
In a tacit acknowledgment that the initial design was flawed, Boeing this week unveiled a software update that specifically addresses the concerns about MCAS and the sensors. American authorities will have to approve the fix before the planes start flying again.
Regulators around the world grounded the Max this month, and airlines are not expected to use them soon. On Friday, Southwest Airlines said it planned its flight schedule through May without its 34 Max jets.
Boeing said it could not comment on the black box findings until investigators released their official report, per international aviation agreements. Rosemount Aerospace, a subsidiary of the industrial giant United Technologies based in Burnsville, Minn., made the sensor. A United Technologies spokeswoman did not immediately respond to requests for comment.
Angle-of-attack sensors are highly reliable and have been used on passenger jets for years, but like any aircraft component, they can fail. Given that, former Boeing and Rosemount engineers said it was surprising that Boeing would allow a single sensor to activate a crucial system that pushes the aircraft toward the ground.
The sensors, which are effectively wind vanes on the jet’s nose, have malfunctioned in the past, for a variety of reasons, including bird strikes, according to the former engineers. They have also been broken by jetways that attach to the plane for passengers to board and exit the plane.
The sensors can also malfunction if water pools around them and then freezes when the plane reaches a certain altitude, the engineers said. The sensors have built-in heaters to prevent freezing at such high altitudes, but they sometimes do not work quickly enough or can fail outright.
“Generally speaking, aviation components are highly reliable,” said Mel McIntyre, a retired Boeing engineer who worked with such sensors for years. “But everything can fail. Nothing is invincible.” Mr. McIntyre declined to comment further on any specifics of the 737 Max.
Investigators of the Indonesia crash in October, who have produced a preliminary report and released some of the information from the black box, found one sensor produced a reading that was at least 20 degrees different from the other as the plane began its ascent. Based on the bad data, MCAS was activated, erroneously pushing the nose of the plane down.
The pilots on the Indonesian flight tried repeatedly to override the system. But after about 12 minutes, they lost their battle.
None of the people briefed on the contents of the Ethiopian Airlines black box said whether its data indicated that the pilots tried to counteract the system. But the plane in Ethiopia had the same bouncing, bobbing trajectory seen in the Indonesian flight as the pilots tried to save the plane, according to publicly available flight data.
Air traffic controllers in Ethiopia also said they saw the oscillating trajectory before the plane crashed on March 10. The pilot radioed to them that he was having trouble controlling the aircraft, but did not give details on what systems were causing problems.
Boeing has defended the 737 Max, its best-selling jet, which is expected to bring in hundreds of billions of dollars in the coming years. And most airlines, which have ordered thousands of planes, have stood by the manufacturer.
“The 737 is a safe airplane,” Mike Sinnett, Boeing’s vice president for product strategy, said at a briefing on Wednesday. “And the 737 Max builds on that tremendous history of safety that we’ve seen through the last almost 50 years.”
But Boeing’s coming software fix specifically addresses the suspected problems that may have led to the two deadly crashes.
The F.A.A. classifies potential problems with aircraft at different levels of risk. The agency did not classify a failure of MCAS as the highest risk level, meaning Boeing was allowed to design the system to rely on data from a single sensor, according a company official with knowledge of the matter. After the crashes, the company wanted to make the system more robust and rely less on pilots to intervene if it failed, the official said.
The software fix will make the system rely on two sensors, rather than just one. The update will also limit MCAS, in most cases, from engaging more than once, a concern in the Lion Air crash in Indonesia. And it would prevent the system from pushing the plane’s nose down more than a pilot could counteract by pulling up on the controls.
“The rigor and thoroughness of the design and testing that went into Max gives us complete confidence that the changes that we’re making will address any of these accidents,” Mr. Sinnett, the Boeing vice president, said on Wednesday.
