What went wrong inside
Boeing's cockpit?

There was nothing more the pilots could have done.

As alarms sounded in their cockpit, the captain and first officer struggled to regain control of their stricken aircraft.

They were far too close to the ground, and needed to gain altitude. Yet when Capt Yared Getachew tried to guide the nose of the Boeing 737 upwards, an electronic system forced it down again.

Simply pulling back on his control column wasn’t enough. So he used a thumb switch as well, to adjust the aerodynamic balance of the plane, and encourage it to climb. But a few seconds later, those adjustments were automatically reversed.

The column was shaking in his hands, a mechanical warning that the aircraft was in danger of stalling and falling out of the sky. A harsh robotic voice called out “don’t sink” three times, indicating that the plane was losing height.

Together, he and First Officer Ahmednur Mohammed Omar worked quickly to find a solution. They flicked switches on the centre console to disable part of the electronics, and began using manual controls instead, in an attempt to make the plane fly normally.

Capt Yared Getachew (right)

Capt Yared Getachew (right)

Regaining control was difficult. By now the aircraft was gathering speed, and aerodynamic forces were building rapidly; it’s likely they had simply become too great for the pilots to fight against using manual controls.

Whatever the reason, they turned the electronics back on and Capt Getachew tried once more to raise the nose of the aircraft, using the thumb switch on his controls. With power assistance restored, the aircraft responded. Briefly it began to climb.

But then, inexorably, the process was reversed as the computers intervened yet again. Another alarm was now chirping urgently, warning that the speed of the plane had become dangerously high, as it began to dive towards the ground.

In desperation, Capt Getachew called on his co-pilot for help. Together, they hauled back on their control columns, using their combined strength, in a last-ditch effort to overcome the forces arrayed against them with sheer muscle power.

The dive became steeper and steeper, and the aircraft fell faster and faster, until it slammed into the ground at more than 500mph, just six minutes after taking off.

One hundred and fifty seven people from 35 different countries died.

They included 49-year-old Anthony Ngare, deputy director of communications for the UN's cultural agency, Unesco; Ethiopian flight attendant Sara Gebre Michael, a mother of three children; and retired Nigerian diplomat Abiodun Bashua.

Kosha Vaidya and her husband Prerit Dixit were travelling with their daughters, Ashka and Anushka

Kosha Vaidya and her husband Prerit Dixit were travelling with their daughters, Ashka and Anushka

From Canada, there were three generations of one family.

Kosha Vaidya and her husband Prerit Dixit were travelling with their two teenage daughters, Ashka and Anushka, as well as Kosha’s parents, Pannagesh and Hansini.

All had boarded the plane for an early morning flight from the Ethiopian capital Addis Ababa to Nairobi, in Kenya.

The weather was good, and the visibility was clear. The aircraft, a Boeing 737 Max 8, was new.

Just five months beforehand, a near identical Boeing 737 Max 8, operated by Indonesian carrier Lion Air, had set out on another routine journey from the Indonesian capital, Jakarta.

The flight to the western city of Pangkal Pinang was meant to last little more than an hour. But moments after taking off, the pilots found themselves in serious trouble.

They were fighting for control, mystified as the aircraft seemed to take on a mind of its own, trying to descend when it was supposed to be climbing.

They had no idea what was going on. Each time they tried to bring the nose up, their actions would be reversed a few seconds later as automatic systems forced it down again.

This happened more than 20 times, with the aircraft bucking erratically through the sky. Air traffic controllers became worried when they noticed on their radar screens that it was descending. On the radio, one of the pilots told them he had a “flight control problem”.

As the crew tried to work out what had gone wrong, they became even more confused, because their instruments were indicating different altitudes. They didn’t know how high the plane was, or how fast it was going.

Eventually, they lost control altogether. The aeroplane went into a steep dive that couldn’t be recovered, and crashed at high speed into the Java Sea.

One hundred and eighty nine people lost their lives.

Two remarkably similar accidents, just five months apart, involving the same brand new aircraft design. Within days of the second crash, investigators had noted “clear similarities” between them. So was there a common cause?

Vertical speed readings show rate of climb\/descent, based on available data from Flight Radar 24

Vertical speed readings show rate of climb/descent, based on available data from Flight Radar 24

When an aircraft crashes, an investigation has to start quickly.

Relatives want answers. Airlines and manufacturers need to know if the same thing could happen again.

What investigators really want to find is the flight data recorder.

In the case of the Lion Air jet, this was recovered from the sea floor within days. It provided a wealth of detail about the doomed flight.

Official shows the flight data recorder of Lion Air flight 610

Suspicion quickly focused on a piece of flight control software designed to operate in the background, without the pilot even being aware of it.

It was meant to make the plane easier and more familiar to fly for pilots who were already used to the previous generation of Boeing 737. It was designed to curb a tendency for the 737 Max’s nose to rise too much, when it was already pitched up at a steep angle.

But it appeared to have been activated at the wrong time and to have forced the nose of the aircraft down when it was supposed to be climbing.

The stabilisers - small wings on either side of the tail - were being moved into the wrong position by the flight computer. When the crew tried to correct them, they simply moved back.
Boeing insisted its aircraft was safe, but issued a bulletin to airlines explaining what could happen, and what to do.

In their everyday work, pilots rely heavily on printed checklists, which set out step by step precisely how different operations should be carried out. When something goes wrong in the air, there are further checklists they can draw on, to help them diagnose and solve a range of different problems.

In this case, pilots were told to follow steps set out in an existing checklist which they are required to memorise, designed to help them deal with an abnormal situation affecting the stabilisers.

It told them to turn off power to the automatic control system, by flipping two cut-off switches. They could then operate the stabilisers manually, using a crank handle in the cockpit.

Boeing was confident that if pilots followed these instructions the plane could be flown safely. Nevertheless, it began developing new software to eradicate the problem.

This was still being worked on when Ethiopian Airlines flight 302 set out on its final journey.

The cause of the two accidents, we now know, was very probably the same.

And according to an interim report, the Ethiopian Airlines pilots reacted to the emergency as the manufacturer had told them to. But it didn’t save their lives, or those of their passengers.

Now, Boeing is facing serious questions - about whether it was right to assume the aircraft was safe, or whether it should have taken more radical steps after the Lion Air crash.

The 737 Max has been grounded.

The way in which pilots around the world are trained to deal with the increasingly high-tech systems aboard modern airliners is also being thrown into sharp relief.

And the close relationship between the aerospace giant and the US body that is meant to regulate the industry, the Federal Aviation Administration, has come under scrutiny as never before.

Families of the victims of Lion Air flight 610, visit an operations centre to look for personal items of their relatives. Jakarta, Indonesia

Why was the 737 Max built?

It was a proud moment, and the culmination of four years of hard work.

On 8 December 2015, in front of thousands of employees at its factory in Renton, Washington State, Boeing unveiled its latest aircraft.

There was intense anticipation as music boomed out, lights flashed, and the vast hangar doors slowly opened.

Standing there, resplendent in Boeing’s dark blue and white corporate livery, and emblazoned with the tailfin logos of some 60 airlines, was the Spirit of Renton, the first ever 737 Max.

Boeing’s workers thronged around their creation, wearing their blue 737 Max baseball caps, taking selfies with the plane.

The new model would go on to become the fastest-selling aircraft in Boeing’s history.

But the Max wasn’t entirely new. It was the latest version of Boeing’s 737, a model which first flew in 1967. Since then, the 737 had been periodically reinvented and re-engineered to keep it flying into the 21st Century.

The Max was to be the fourth generation of the 737 family - cleaner, quieter and much more efficient than its predecessors.

Boeing really needed it to succeed.

Four years before the launch, the company had had a serious problem. Its great European rival Airbus was already developing a new version of its A320 - a direct competitor to the 737.

Rivalry between Boeing and Airbus has always been intense. The 737 and A320 are the workhorses of the aviation world, with thousands of them plying their trade on short and medium-haul routes around the globe every day.

They have provided a steady and reliable source of profit for both companies, with the market split relatively evenly between them. But the new A320 threatened to give Airbus a big advantage.

The modified aircraft would have revised aerodynamics, and would be fitted with a choice of new engines. This would enable it to become quieter and to produce fewer emissions, as well as giving it the choice of a longer range or a higher payload.

But more importantly it would be much cheaper to operate. In recent years, fuel has typically accounted for 20% to 25% of carriers’ operating expenses. According to Airbus, the new engine would be up to 15% more fuel efficient.

Airbus began racking up orders for the overhauled plane, christened the A320neo (for new engine option), while demand for the 737 flagged.

Boeing simply had to respond.

“The longer Boeing left it, the further it would fall behind,” explains pilot and 737 expert Chris Brady.

Boeing had been studying options for a possible 737 replacement for several years.

But at the time, its 787 Dreamliner - billed as a groundbreaking and super-efficient design - was years behind schedule and billions of dollars over budget.

The company’s board appeared reluctant to give the go-ahead for another plane to be designed from scratch. The only other option was to re-engineer its existing aircraft and fit new, more efficient engines.

As commercial pressures mounted, and amid signs one of its main customers, American Airlines, was about to place a major order with Airbus, Boeing gave the 737 Max programme the green light.

Although the A320 and the 737 look very similar, the engineering challenges faced by the two manufacturers were very different.

The A320 is fundamentally a much more modern aircraft, one which began flying in the late 1980s. It is taller than the 737, which is still based on its 1960s airframe.

For Boeing, this meant installing the new engines was far from easy.

A solution had to be found. But that solution had unintended consequences.

System failure

When it was introduced in the 1960s, the 737 was built to be low to the ground. This made it easier to load baggage and get passengers aboard using stairs - a particular advantage at the small, regional airports it was designed to serve.

Look at a photo of one of the early 737s, and you’ll see that the engine is a slim, cigar shape mounted directly beneath the wing. But as engine technology developed, and the aircraft was updated, the low ground clearance caused problems.

In recent years, quieter and more efficient engines have been developed, but for technical reasons, they are much fatter than their predecessors.

With the 737 Max, Boeing wanted to use the most efficient engine available: the CFM International LEAP. A variant had already been chosen by Airbus for the updated version of its A320.

“Once Airbus said they’d use it and the A320 was going to become much more fuel efficient, Boeing had to do the same,” says Brady. “It would have been commercial suicide otherwise.”

But the LEAP was too big to sit comfortably beneath the wing of Boeing’s low-slung aircraft. So the engine was moved higher up and further forward on the wing. This solved one problem, but created another.

Boeing 737 MAX's LEAP engine

Boeing 737 MAX's LEAP engine

The modifications created unusual handling characteristics. In essence, it was found that the aircraft had a tendency to lift its nose upwards, particularly when it was already pitched at a steep angle.

This was unhelpful, because an excessively high “angle of attack,” as it is known, can cause an aerodynamic stall - suddenly robbing the wings of lift and causing the plane to lose altitude. It’s a situation flight crews would be careful to avoid.

Yet under these circumstances experienced pilots found the controls of the aircraft felt unfamiliar: unusually light, and rather different to what they had experienced with the previous generation of 737.

Boeing’s engineers developed a control system called MCAS - Manoeuvring Characteristics Augmentation System - to ensure that the way the 737 Max behaved in the air remained consistent and matched that of previous generations of the plane.

This piece of software brings the nose of the aircraft down automatically, under very specific circumstances, without the intervention of the pilot.

Investigations into both 737 Max crashes are still under way, but the finger of suspicion has already been pointed firmly at MCAS.

What it does is relatively simple. It moves the horizontal stabilisers - the tail wings of the aircraft, which are normally used to help the aircraft maintain level flight - to bring the nose downward.

This has two effects: it increases pressure on the pilot’s control column, making the handling feel more familiar to experienced 737 pilots; and it reduces the risk of the nose rising too far and triggering a stall - although Boeing insists it is not an anti-stall system, and is simply there “to enhance the pitch stability of the airplane - so that it feels and flies like other 737s”.

What now seems apparent with the benefit of hindsight is that MCAS had design flaws.

First, it relied on data from a single angle of attack sensor, even though the aircraft had two of them. This type of sensor, in the nose of an aircraft, measures the angle at which it is encountering the airstream.

But relying on only one of them meant that if it failed, the system could deploy at the wrong time, and push the nose of the aircraft down when it was supposed to be climbing, for example.

Second, although the pilot could use a thumb control to correct the pitch of the aircraft, MCAS would deploy repeatedly in cycles, forcing the nose down again and again.

MCAS worked in the background, and it wasn’t until after the Lion Air crash that Boeing explained what it was and how it could be deactivated. It was not specifically mentioned in the flight manual - which is meant to give pilots the information they need to fly the aircraft safely.

Recent reports in the US media suggest that flight crews themselves were deeply unhappy they had not been kept informed. An audio recording obtained by CBS News purportedly contains an exchange between members of American Airlines’ pilots union and a company official, which took place a month after the first crash. In it, one pilot angrily informs the official that “we flat out deserve to know what is on our airplanes”.

Boeing emphasises that there are set procedures for pilots to follow, which are meant to help them deal with uncontrolled stabiliser movements, whatever their cause. These were contained in the manual, and should have been memorised by the pilots as well. It says the manual did tell crews to expect automatic stabiliser movements as the plane approached stalling speed, the “same type of aircraft behaviour” caused by MCAS.

It has also pointed out that the day before the Lion Air crash, the same aircraft experienced similar problems, but was able to continue safely to its destination.

On that flight, within seconds of take-off, the airspeed and altitude indicators gave sharply different readings. Then the nose of the aircraft began moving down of its own accord.

But this time, the pilots worked out what to do about it. They cut off power to the electronics operating the stabilisers and began controlling them manually.

They may have been lucky, though. According to media reports, they were told what to do by a third pilot who happened to be in the cockpit, having hitched a ride aboard the plane.

Since these incidents, serious questions have been raised about the design of the MCAS software and whether the 737 Max was allowed into service despite a potential catastrophic flaw.

So what were the circumstances in which it was certified as safe to fly in the first place - and why was it not grounded when that flaw first came to light?

Many analysts are now pointing the finger at the close, even symbiotic, relationship between the company and the regulator responsible for aviation safety in the US, the Federal Aviation Administration (FAA).

Boeing and the FAA

Grounded Boeing 737 MAX planes at Southern California logistics airport

The charge being levelled against the FAA is that it was a victim of so-called “regulatory capture”.

This is what happens when a government agency’s relationship with the industry it oversees becomes too close for comfort; instead of acting primarily in the interests of the public, it puts the needs of businesses first.

The FAA was responsible for certifying the 737 Max and giving it permission to fly.

Critics have suggested both that the agency was too slow to ground the plane and that the original certification process itself was flawed.

Among them is US senator Richard Blumenthal. In a tense hearing organised by a Senate committee after the Ethiopian Airlines crash, he was scathing about the FAA’s alleged failings.

Richard Blumenthal

Richard Blumenthal

It had, he said, lagged behind other aviation authorities in preventing the 737 Max from flying. But more seriously, he said, it had “decided to do safety on the cheap… and put the fox in charge of the henhouse”. In other words, too much of the safety work on the plane had been outsourced to Boeing itself.

In the rush to produce the new aircraft, he argued, critical safety features had been disregarded.

Mary Schiavo, a former Inspector General at the US Department of Transportation who has been a thorn in the side of the FAA for many years, takes a similar view.

Mary Schiavo

Mary Schiavo

During her tenure at the DoT in the mid-1990s, she oversaw an audit of the FAA’s work relating to the Boeing 777, and concluded that the bulk of the work was done by Boeing itself, with little real oversight.

“At the FAA, they know they’re outgunned by Boeing,” she says. “They know they don’t have the kind of resources they need to do the job they’re tasked with doing.

“They pretend to inspect, and Boeing pretends to be inspected, when in fact Boeing is doing it all almost entirely by itself.”

There’s no question Boeing does have tremendous economic clout.

In the US alone, it employs more than 135,000 people, and claims to support more than a million more jobs across thousands of American suppliers. It is the world’s biggest aerospace company, with annual revenues of more than $100bn, and profits of more than $10bn.

Barbara Lichman, an aviation lawyer and former Washington lobbyist, says it also has plenty of political power.

“Companies of that size have very proficient lobbyists,” she says. “They hit Congress very, very hard, and put pressure on them to relieve pressure on the company.”

Whether or not politics were involved, the FAA certainly appeared reluctant at first to ground the 737 Max, far more so than other civil aviation authorities.

On 11 March, the day after the Ethiopian Airlines flight 310 crashed, the FAA published a “continued airworthiness notification”, which in effect gave the aircraft the green light to continue flying.

Although it acknowledged that external reports were “drawing similarities” between the latest accident and the Lion Air disaster in October 2018, the agency insisted that as the investigation into the Ethiopian crash had just begun, it did not have sufficient data “to draw any conclusions or take any actions”.

Yet others were more cautious. China’s civil aviation authority was one of the first to order the grounding of the plane, along with Ethiopia, just a day after the accident. Many others followed suit.

But it was not until 13 March that the FAA itself banned the plane from flying.

The FAA insisted that by this point further information had come to light which justified its actions. The acting head of the agency, Daniel K Elwell later told American lawmakers that while the US had indeed been one of the last countries to ground the 737 Max, it was the first to do so “with data”.

The more worrying accusation against the FAA, however, is that the entire process of certifying the aircraft as safe to fly was flawed - because most of the work was carried out by Boeing itself, and the agency failed to provide sufficient oversight.

The FAA operates a system - known as the Organisation Designation Authorisation programme - which allows designated companies and individuals to carry out certification work on aircraft.

The 79 current ODA holders are, in effect, allowed to act as representatives of the FAA, and are permitted to conduct inspections, carry out tests and issue certificates on its behalf.

There is a good reason for this. Modern airliners are complex beasts, combining cutting-edge engineering with powerful computers that run software requiring millions of lines of code. The FAA, meanwhile, is a government institution with limited resources.

By delegating some 90% of its certification work, in theory the agency is able to focus on oversight, ensuring that tasks are carried out properly, according to its own rules and procedures.

According to Elwell, this is not just desirable, but essential. He told senators that without the ODA programme, the FAA would need an extra 10,000 employees to do the same work, and it would cost US taxpayers around $1.8bn per year.

Meanwhile, former Boeing safety engineer Dr Todd Curtis, who now runs the website Airsafety.com, says the system does create a potential conflict of interest because work on behalf of the FAA is carried out by people who receive their pay cheques from the aerospace giant. But he insists he personally never saw any behaviour that gave cause for concern.

In the case of the 737 Max, critics believe that in its desperation to get the aircraft on to the market, the potential dangers of the MCAS system were not explored thoroughly enough - and the FAA failed to step in.

“Because Boeing knew whatever they did, and whatever they submitted [to the FAA], it was going to be certified. So, they got sloppy. Or sloppier,” says Mary Schiavo.

Both Boeing and the FAA entirely reject this.

In a statement the FAA told the BBC: “The FAA’s aircraft certification processes are well established and have consistently produced safe aircraft designs. The 737 Max programme took five years and involved 110,000 hours of work on the part of FAA personnel, following the FAA’s standard certification process.”

It added: “The use of delegation has been a vital part of our safety system since the 1920s and without it the success of our country’s aviation system likely would have been stifled.”

Test pilots emerge from from a Boeing 737 MAX 8 airliner at Boeing Field after completing the plane's first flight on 29 January, 2016 in Seattle, Washington

Boeing, meanwhile, says it “operates in full accordance with all Federal Aviation Administration oversight requirements and processes”. It insists that “the long-standing collaborative engagement between the FAA, Boeing, its customers and industry partners has created the safest transportation system in the world”.

Nevertheless, since the Ethiopian Airlines accident, the Department of Transportation has set up an expert committee to review the FAA’s certification processes.

Meanwhile pressure on Boeing itself is mounting.

It is already facing a number of lawsuits from relatives of the victims of both crashes. Outside the company’s annual general meeting in late April, protesters called for chief executive Dennis Muilenburg to face prosecution.

Dennis Muilenburg

Dennis Muilenburg

It is also being sued by some investors who claim the company concealed problems with the 737 Max and “effectively put profitability and growth ahead of airplane safety and honesty”.

Damaging information continues to emerge. In early May, Boeing admitted that a warning mechanism which should have been fitted as standard to the 737 Max would not work unless customers had also fitted a separate, paid-for cockpit display.

Tarek Milleron holds photographs of victims of the Ethiopian Airlines Flight 302 plane crash while protesting outside Boeing's annual shareholders meeting. Chicago, Illinois

The warning system, known as an AoA Disagree alert, was meant to tell pilots when the two angle of attack sensors on the aircraft were giving conflicting readings, in case one of them failed.

Engineers first became aware of the problem months before the Lion Air crash, but airlines were not informed until afterwards, and nor was the FAA - because Boeing staff believed it did not compromise safety.

A further evaluation was carried out after the accident - and this time Boeing says the FAA and airlines were informed.

Boeing continues to insist that the absence of the system was not safety-critical. It says:

“On every airplane delivered to our customers, including the MAX, all flight data and information needed to safely operate the aircraft is provided in the flight deck on the primary flight deck displays... Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane.”

But 737 expert Brady thinks the information it provided would still have been useful to the pilots in both stricken aircraft.

“I firmly believe that… any information or clue that helps you troubleshoot a problem and piece together what is happening has to be of value,” he says.

Meanwhile, the revelation has raised further questions about transparency at the aerospace giant - and whether or not it has failed to report any other potential safety concerns.

Pilot training crisis

Boeing 737 flight simulator (not the MAX 8)

As you line up at the departure gate before a flight, unless you’re a particularly nervous traveller, the chances are you don’t give too much thought to safety. Reports of air crashes are invariably harrowing - but they are also extremely rare. Last year, there was one fatal accident for every 2,520,000 flights, according to the Aviation Safety Network.

One reason why safety standards have traditionally been so high is because pilots have to be highly qualified.

As a general rule, pilot training is lengthy, disciplined and rigorous. For example, in the UK, the cost of obtaining a commercial licence to fly large aircraft can easily exceed £100,000. It involves hundreds of hours of teaching.

First you need to gain a private pilot’s licence. Then you need further training in order to build up flying hours and learn how to fly using instruments in poor visibility, not to mention passing theory exams, before being awarded a commercial licence.

That can then be followed by yet more training to learn how to fly a specific aircraft, and get the necessary certificate, or “type rating”.

Yet some experts are concerned that these high standards are starting to slip, as airlines and manufacturers try to reduce the amount of time and money that needs to be spent on training.

Some see what happened with the 737 Max as symptomatic of this trend.

Although there were significant physical differences between the previous 737 and the Max, pilots who had flown the older version were only required to complete a short online tutorial before carrying passengers aboard the Max.

By making the plane handle like the previous generation of 737, Boeing also ensured that pilots would not need extensive extra training to fly it.

Dai Whittingham is the chief executive of UK Flight Safety Committee, an independent trade organisation with major UK airlines, airports, academics and manufacturers among its members. He thinks there is a definite downward trend.

“Standards of UK training and safety are excellent,” he says. “But as an industry we’ve had a bit of a race to the bottom on the costs associated with training.

“Airlines don’t want to spend money on training if they don’t have to. We’ve seen this with the Boeing 737 Max. It is a different body and aircraft but certifiers gave it the same type rating.”

This is a crucial point. If a new aircraft is awarded the same type rating as previous models in a series, less training is needed. That reduces costs, particularly if the job can be done through a fairly simple online tutorial, rather than, for example, time spent in a full-scale simulator, which can be expensive.

Boeing 737 cockpit.Boeing 737 cockpit.

Whittingham insists that "shareholders are squeezing airlines hard on costs”.

“Training requirements are being set to the absolute minimum. If airlines want to do more training then they have to argue with their financial teams to get it signed off.”

Getting pilots to talk about this is difficult. Nevertheless, a few have chosen to do so. Among them is Dr Karlene Petitt, an experienced pilot based in the US. She has become a vocal critic of airline safety culture, drawing on research carried out for her doctoral thesis.

Dr Karlene Petitt

Dr Karlene Petitt

“I believe we have a problem with pilot training worldwide, and the data supports this analysis,” she says.

“Safety and training are going in the wrong direction. It is something that the Federal Aviation Administration has known for years.

“Is learning from a flash drive the same as structured classroom learning with an instructor? More so, is an electronic exam an accurate assessment of knowledge?"

As part of her two-year research programme, Dr Petitt distributed a survey among pilot groups expecting a few hundred responses. She says she received more than 7,500.

“The significance of this number identifies that pilots worldwide care about the safety of the industry,” she says.

“Comments received from these pilots have further identified concern with the trajectory… of where this industry is going.”

Another area which worries her is the increased automation of flying. She fears that as pilots become more reliant on computerised systems, they are losing the skills to fly the planes themselves - and respond when things go wrong.

Dai Whittingham takes a similar view. “Physical, hands-on flying - pilots do less of it now, because the computer is more efficient for fuel. Pilots make mistakes and that costs money,” he says.

This isn’t a new theory. Back in 1997, in a famous lecture at American Airlines’ Flight Academy, Captain Warren Vandeburgh warned that pilots were becoming “Children of the magenta”, over-reliant on the magenta lines on their cockpit displays. He identified a culture among pilots of becoming too dependent on automated systems, undermining their ability to react to fast-moving situations.

Boeing now says all pilots who intend to fly the Max when it has been recertified as safe to fly will have to undertake a new training programme.

Meanwhile investigators will continue to look closely at how well the pilots involved in the two crashes understood the systems they were using.

What does the future hold?

Boeing has developed a software update to change the way MCAS works.

In future, the system will rely on information from two angle-of-attack sensors, rather than just one. If the two sensors give different readings, the pilots will be alerted to the fact and if they vary too much MCAS will simply be switched off.

There will be other safeguards, too - ensuring that the system can always be counteracted by the flight crew, and preventing it from deploying multiple times “in non-normal conditions”.

At a congressional hearing on 15 May, the FAA’s acting administrator Daniel Elwell said he expected to receive details of the update from Boeing “in the next week or so”.

It would, he said, be subject to a “thorough and rigorous safety analysis”. The aircraft would not be allowed to fly in the US until it was “absolutely safe to do so”.

It is still far from clear when this will happen. Safety agencies from around the world are due to meet in Washington on 22 May to discuss the FAA’s latest safety analysis.

Meanwhile, winning back the confidence of passengers may not be easy, but aviation historian Shea Oakley believes the aircraft can still be a success, once it has been allowed back in the sky.

“There have been a number of commercial airliners that suffered fatal crashes early on, that were linked to either design or pilot training issues,” he says.

He points out that aircraft such as the Boeing 727, the BAC 1-11 and McDonnell Douglas DC10 were involved in major accidents soon after being launched, remained on sale for decades afterwards.

Boeing’s chief executive Muilenburg has pledged that once MCAS has been modified, the 737 Max will be one of the safest aircraft ever built.

Boeing still has more than 4,500 orders for the Max, and airlines want their new planes. Those efficiency improvements are still badly needed, and Airbus alone cannot hope to meet demand.

Production continues and the chances are most of those outstanding orders will be fulfilled.

But that doesn’t mean Boeing can simply get the aircraft flying and act as though nothing has happened.

The two accidents claimed the lives of 346 people. Formal investigations are ongoing, and more information may yet emerge. Relatives of the victims are demanding answers. There is a great deal of anger - and lawsuits are mounting up.

The US Department of Transportation is looking into the certification process for the 737 Max, and the Department of Justice is also taking an interest. It’s far from clear where these inquiries will lead, and what the outcome could mean for the company or its senior executives.

Nor should we forget the impact these accidents will have had on Boeing’s own employees. They were clearly proud of their new creation. They certainly did not intend to make a product that was in any way unsafe. Now, people within the aerospace giant say they feel “shattered” by what has happened.

Nevertheless, Boeing will almost certainly recover in the end. And despite the two tragedies, it is highly likely the 737 Max itself will be flying for years or even decades to come.

Devotees hold candles during a special service for the families of the victims of the crashed Ethiopia Airlines plane at Ethiopian Orthodox Church. Nairobi, Kenya