Why did "only" two Max 8 accidents occur? Before the grounding, there must have been at least dozens but surely 100s if not 1000s of flights with this model. How come the vast majority of those flights didn't experience any problems?
With a well functioning angle of attack sensor the 737 MAX was safe. Only a malfunction which let the sensor report a higher angle than real would result in the repeated attempt of the MCAS to trim the airplane nose down.
Such a malfunction is a rare event (10 per year across all types flying in the US). This should explain the many uneventful 737 flights. However, to rely on only one sensor was criminally negligent. A safe design would have redundancy built in. Ironically, the 737 MAX has such a second sensor (just opposite of the one which fed the MCAS) but the software did not crosscheck the readings.
Now there have been so many comments, and they all have been caused by my rather cursory description of the problem, that I better expand this answer so people will not feel a need to add more comments.
MCAS was already introduced with the Boeing 707 and the KC-46 (tanker version of the 767), but would only add nose-down trim once if a prescribed angle of attack is exceeded.
With the more powerful LEAP engines of the 737 MAX, pitch stability at high angle of attack and high thrust would become negative, something that would make any airplane immediately impossible to certify under current regulations for civil aircraft. The more forward position of the intakes and the high suction on the intake at high angle of attack would had required a larger horizontal tail if proper design rules would had been applied.
But Boeing is run by ex-McDonnell-Douglas management where cost-cutting is more important than applying proper design rules. A larger horizontal tail would result in structural changes throughout the rear part of the airplane, require new jigs and tests and a much more complex certification. Simpler solutions did not work out, either: Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. So the instability had to be fixed in software.
The result was a system that read inputs from a single sensor, and under the right conditions (flaps up and autopilot disengaged) changed pitch nose-down by 2.5 degrees stabilizer rotation when a specified angle of attack was exceeded and repeated this mindlessly after five seconds if the angle of attack was still too high. No provisions had been made for a defective sensor. Concerns by engineers and test pilots about the hazards resulting from a sensor failure were ultimately dismissed. Eventually, Boeing officially assumed that pilots would respond to an unexpected MCAS activation as if it were a runaway stabilizer trim event, and do so within four seconds.
All 737s have two AoA sensors, but the MAX MCAS relied on only one sensor at a time, switching between the left and right one each flight. By the way, the KC-46 MCAS, although less powerful, uses the inputs of two sensors and trims the stabilizer by just 0.6°, and only once per activation.
Next, in order to limit the amount of pilot training for the new type to Level B (no simulator), the MAX should feel to the pilot like a next generation 737. This made it possible to fly the MAX with the type rating for a regular 737, a big selling argument to airlines which already operated the 737. MCAS helped to achieve this, and information about its details was not part of mandatory training (which consisted of a two hour iPad tutorial). By repeating the pitch trim change, the MCAS had become safety critical where earlier versions were not. Nevertheless, information about it was hidden and most pilots did not even know of its existence after their transition to the MAX.
Another factor was the insufficient funding and regulatory capture of the FAA in the last decades which had less personnel to check new designs, so it gladly handed much of the testing for certification to the manufacturers: Boeing Authorized Representatives are Boeing employees who are granted special permission to represent the interests of the FAA and to act on the FAA’s behalf in validating aircraft systems and designs’ compliance with FAA requirements. The core function of the certification process, to let a second pair of trained eyes look over the new stuff, was outsourced to the same people who had authorized those designs. Also, the capacity of MCAS was misrepresented to the FAA as an addition to speed trim in order to avoid more scrutiny and testing. Later investigations found a disturbing trend of FAA management treating operators favorably and overruling the work of technical experts.
As usual, several opportunities to avoid what happened were missed and several causes conspired to make MCAS the trap it became.
Most accidents in aviation are not the result of a single failure or mistake, but result from many contributing factors. If one of those had been eliminated, the accident would not have happened (or would have been less severe). This is often called the Swiss cheese model:
(image source: Wikipedia)
Only when all holes in the cheese line up, can the line pass through. In aviation this means, only when all contributing factor occur at the same time, an accident occurs. It is the task of the accident investigation to identify all contributing factors and publish them in a final report such that the holes in the cheese can be filled (meaning the problems can be fixed) so future accidents due to these factor can be prevented.
The 737 MAX crashes were largely the result of the following (for the full list of contributing factors from the Lion Air crash, see the bottom of this answer):
- Boeing's decision to only use a single AoA sensor for MCAS and not limit its activation.
- A broken AoA sensor on the accident aircraft resulting in incorrect information feeding into MCAS.
- Insufficient flight crew training resulting in incorrect response to the runaway stabilizer trim by the pilots.
It is wrong to blame the accidents on a single contributing factor (like only blaming Boeing or only blaming the pilots). All contributing factors are important and the accident reports do not rank these factors by severity.
By now, MCAS has been updated to use both AoA sensors and only activate once:
This required software function operates in unusual flight conditions only and now relies on two sensors, activates only once and never overrides pilots’ ability to control the airplane.
Most regulators also require pilots to undergo simulator training before being allowed to fly the 737 MAX again:
This is not just about changes to the design of the aircraft: every individual 737 MAX pilot needs to undergo a once-off special training, including simulator training, to ensure that they are fully familiar with the redesigned 737 MAX and trained to handle specific scenarios which may arise in flight.
That way, at least two holes are now filled and even if an AoA sensor breaks on a 737 MAX again, this should not result in another accident.
For completeness, here is the full list of contributing factors of the Lion Air crash. The final report of the Ethiopian crash is not yet published and the interim report does not list contributing factors.
During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.
Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.
MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.
The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.
The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.
The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.
Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.
The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.
All the answers here are good, and they address what you were probably intending to ask. But I want to address the question that you literally asked
Why not more Max 8 accidents?
i.e. why were there exactly two Max 8 accidents, and not, say, three or or five or ten?
Lets review the timeline
October 29, 2018: Crash 1: Lion Air Flight 610 March 10, 2019: Crash 2: Ethiopian Airlines Flight 302 March 13, 2019: FAA grounded fleet March 13 (many other countries grounded soon)
Let's imagine a hypothetical parallel universe with this timeline:
October 29, 2018: Crash 1: Lion Air Flight 610 December 1, 2018: Crash 2: XYY airlines flight 123
What would have happened then? Well, mostly likely the FAA would have grounded the fleet on December 4th, 2018. And so Ethiopian Airlines Flight 302 would never have happened. You'd still only have two crashes.
You could imagine many different variations on this. Like maybe Lion Air Flight 610 got lucky, so that Ethiopian Airlines was actually Crash 1, and the some other flight crashed in June 2019 and then the grounding happened a few days after that. You'd still only have two crashes.
My point is, if there are ever two major fatal crashes within a short time span of each other that appear to be related, the Aviation authorities are going to ground the fleet before there is a third. Maybe, if the two crashes don't obviously have the same causes, it might get to three. For some cases, the fleet would be grounded after just one crash. But there is no universe in which there are going to be ten or twenty fatal crashes for the same reason without the fleet being grounded.
To be clear, the caveats here are:
- Major fatal crashes. There have definitely been repeated incidents that did not lead to immediate grounding (e.g. fan blade failures like on Southwest Flight 1380), but those did not involve a hull loss and the death of everyone on board
- Short time span. Had the two 737 Max events happened years apart, the second one might not have led to an immediate grounding
- Related reason.
Part of this has to do with how the 737-MAX was designed. I explained this in more detail in this answer, but the TL;DR here is
- The Max 8 was designed to be as close to identical to existing 737s as possible so that pilot retraining and full FAA certification would not be necessary
- MCAS could be shut off using the same methods as a runaway stabilizer (an issue all 737s could encounter). The prior air crew on the craft that was Lion Air 610 figured it out and avoided a crash
The puzzled cockpit crew checked a quick reference handbook, running through other emergency steps before successfully regaining control of the plane by executing the checklist for a runaway stabilizer. That turned off MCAS and the crew flew manually for the rest of the trip.
In other words, it mostly behaved like a well-known aircraft. You just had to be able to diagnose the problem correctly before the plane crashed. It seems, in most cases, the air crew did. The problem is the cost of failing to diagnose it is unacceptably high...