Each day, the Federal Aviation Administration’s (FAA) Air Traffic Organization provides service to more than 45,000 flights and 2.9 million passengers across more than 29 million square miles of airspace. There are over 16 million flights handled by the FAA each year, and for the most part, flights run according to plan. That is, millions of people safely make it from one destination to another without incident.
Often, travelers don’t think about the type of plane they’re on, the mechanics, their pilot’s training, and how – in rare instances – flaws in one or more of these systems can produce catastrophic results.
Such was the case for the Boeing 737 MAX. In two separate 737 MAX plane crashes months apart, 346 people were killed, ultimately resulting in the longest grounding of a plane in aviation history, criminal charges from the Department of Justice that led to a $2.5 billion settlement, additional victim payout fees (some claims are still ongoing), loss of trust among the flying public and tremendous harm to the brand identity.
We’re going to explore the tragedies of the Lion Air Flight 610 and Ethiopian Airlines Flight 302 crashes using a Cause Map™ diagram. With a complex problem, such as a plane crash, where does one start?
*Please note that this post was written based on the information available at the time of publishing. Because Cause Mapping® is an iterative process, it's important to update your Cause Map™ diagrams with new information that arises during your investigation.
When completing any complex task, one must start at the beginning. If you're running a mile, you have to start with the first step, followed by the second, third, fourth and fifth.
When creating a Cause Map diagram, we always start with a basic diagram. You can start with any number of causes and continue building your map until you have a solution, or several, that can reduce risk and help prevent the incident from occurring or recurring.
Here is a basic 5-Why:
It’s read from left to right by asking “why” at each connector arrow and answering “because” at each cause box. For example, there was an impact to safety and 346 lives were lost. Why? Because two Boeing 737 MAX 8 aircraft crashed. Why? Because the pilots lost control of the aircraft. Why? Because the Maneuvering Characteristics Augmentation System (MCAS) system activated. Why? Because the system was triggered by a faulty Angle of Attack (AOA) sensor.
It would be easy to blame pilot error, and in fact, that’s what the aircraft manufacturer did. But even if you explore that avenue, you’ll see that there were a number of other causes that had to happen simultaneously for the events to occur.
Below is a 12-Why Cause Map diagram. The crashes are separate, but for each disaster, you can see in addition to the pilots losing control of the aircraft, another event had to happen. This is notated with the word “AND” between the causes on the map.
Investigations have shown that engineers working on the aircraft raised concerns about the design, noting it left the pilots vulnerable.
Before the Lion Air crash, another memo from the engineering team said longer reaction times by pilots could be “catastrophic,” and an internal whistleblower filed an ethics complaint stating safety upgrades were rejected during the development phase of the jet. Additionally, a similar malfunction had occurred prior to the crash, but an off-duty pilot was able to assist in disabling the flight control system and keep the plane from crashing.
Each of the above was disregarded, leading to the certification of the plane to begin and continue to fly.
Similarly, had regulations grounded the plane immediately, the Ethiopian Airlines flight would have used another aircraft rather than the ill-fated Boeing 737 MAX with the same MCAS (Maneuvering Characteristics Augmentation System) installed. Each of these events combined with the pilot losing control of the plane led to the crashes taking place.
There were a number of reasons a pilot could lose control of a Boeing 737 MAX. Here, we explore two: a new MCAS system activated because of a faulty sensor, and pilots had a very short time to diagnose and fix the problem before it was too late to correct the plane’s course.
The Boeing 737 had been around for decades and was Boeing’s most successful aircraft. When its competitor, Airbus, launched a new design with a fuel-efficient engine, Boeing was under immense market pressure to deploy its own jet that rivaled the A320neo. In fact, “Boeing committed to the MAX without ... having a finalized design or engine supplier. In December that year, Southwest Airlines placed the first order.
“Because the 737 MAX was a derivative model of such an old design, one that has proven safe for many years, many of its systems were grandfathered in, rather than upgraded to the latest FAA safety standards.
“And because the airlines, to reduce their costs, demanded that the MAX be designed so that pilots flying the previous 737 model would require minimal training, Boeing assured them that the MAX would handle ... like the previous version of the 737,” Seattle Times Aerospace Reporter Dominic Gates (who, with three others, later won a Pulitzer Prize in National Reporting for reporting of the Boeing 737 MAX crashes and investigations) said.
MCAS is a piece of software that was designed to automatically counter a tendency for the aircraft’s nose to pitch up using the angle of attack and G-force as a guide for activation. The system could activate multiple times, so even if pilots tried to correct the plane, the software would reactivate.
There was also an assumption that pilots would intuitively know there was a problem and react appropriately within four seconds, the Seattle Times reported. These circumstances combined with other flaws and limited safety testing all contributed to the fatal events that followed.
Cause Mapping® training provides people with a simple way to dissect complex problems by applying the basics of the cause-and-effect principle. While we expanded to a 12-Why for the purposes of this blog post, it could easily be expanded to a map with hundreds of causes. Even the most complex investigations have to start at a basic level.
The goal is not to define as many causes as possible, but to define enough to enable you to take the best preventative actions and make decisions that are actionable. The more causes you add, the more potential solutions will emerge. Each action implemented helps add another layer of protection moving you toward your ultimate goal of reducing risk of recurrence.
If you’re interested in learning more about this method and how it could apply to issues within your organization – no matter the complexity – view our upcoming workshops.