DUBLIN — If you are looking for a tale that highlights everything that can go wrong in a complex and difficult project managed by a sprawling and gigantic company, look no further. The story of how the Boeing 737 Max 8 came to be the plane falling out of the sky in Indonesia and Ethiopia is a story of many small failures by many parties. To me, this really underscores just how complicated our modern world has become. Technology has advanced dramatically, making our world safer than ever before. But the systems we have in place to monitor, assess, and quality check all the new tech are strained – sometimes strained beyond capacity. I’m not convinced that anyone involved was acting out of malice or evil. It seems more like Boeing was in a rush to get the plane into the skies and was willing to make some optimistic assumptions and grease some palms to make that happen. But it turns out that carelessness and haste can have consequences just as severe as anything malevolent. There are plenty of terror attacks with a lower body count than the 737 Max. – Felicity Duncan
How Boeing’s 737 MAX failed
By Andy Pasztor, Andrew Tangel, Robert Wall and Alison Sider
Boeing needed the redesign of its crucial 737 jetliner to go swiftly and smoothly, so it pursued a path that reduced regulatory scrutiny and accommodated its biggest customer by requiring as little new training for pilots as possible.
___STEADY_PAYWALL___
Many pilots now say Boeing’s choices for the 737 MAX left them in the dark about a new feature whose malfunctioning has been implicated in one deadly crash and is under scrutiny for a possible role in a second – disasters that claimed 346 lives.
Pilots flying the 737 MAX, which entered service in 2017, received no training on a new stall-prevention system and saw almost no mention of it in manuals, according to the pilots and industry officials. Most would get no visible cockpit warnings when a sensor used to trigger the system malfunctioned, and they had no access to simulators that could replicate the kinds of problems believed to have downed Lion Air flight 610 in October.
Following the second crash, in Ethiopia this month, a picture is emerging that suggests Boeing, as it hurried to get the plane on the market, put too much faith in its design and engineering, particularly of the automated stall-prevention system that was supposed to make the plane safer, according to interviews with safety experts, industry officials and former Boeing employees and former regulators.
Many questions remain about Boeing’s handling of the redesign and what went wrong. The Justice Department and other federal agencies are investigating whether Boeing provided incomplete or misleading information to get the airliner certified as safe to fly.
Ethiopian investigators have yet to detail their preliminary findings, although authorities have cited similarities between both crashes. Ethiopian Airlines’ chief executive has said the stall-prevention system appears to have played a role.
Boeing has said it would overhaul the flight-control system, called MCAS, and make safety alerts that had been optional a standard feature. The fix has been undergoing flight trials since Feb. 7, Boeing said, before the Ethiopian airliner crashed.
There are indications that Boeing was aware that some 737 MAX models in the air lacked all the possible safety features available.
On Nov. 27, about a month after the first crash, Boeing executive Mike Sinnett told American Airlines ’ pilot union that their pilots wouldn’t experience the sort of problems that doomed the Lion Air flight, according to Dan Carey, union president. That’s because American paid for an additional cockpit warning light that would have alerted them to the problem, while Lion Air and most other airlines didn’t.
“This wouldn’t have happened to you guys,” Mr. Carey recalled Mr. Sinnett saying during the meeting. The cockpit indicators would have directed pilots to have the potential problem checked out on the ground. A Boeing spokesman said Mr. Sinnett didn’t recall making that statement, and was unavailable for an interview. Mr. Sinnett is slated to brief reporters about impending changes on Wednesday.
The first of what is expected to be a series of congressional hearings looking at the decisions of both Boeing and the Federal Aviation Administration is scheduled to begin Wednesday.
The Boeing spokesman said the company followed “established and accepted assumptions and processes” in designing and certifying the new stall-prevention system. He said Boeing “determined that a pilot would be able to counteract erroneous system input” by following established procedures for which pilots have received training previously.
Boeing said the FAA considered the system’s final design during its certification of the aircraft and concluded that it met all regulatory requirements.
One senior Boeing official said the company had decided against disclosing details about the system that it felt would inundate the average pilot with too much information—and significantly more technical data – than he or she needed or could realistically digest.
It is Boeing’s biggest crisis in years. The 737 has been the centrepiece of Boeing’s business for decades, and the MAX was intended to carry that on. Now the entire 737 MAX fleet is grounded. Industry executives and former regulators say it could take years for the company to rebuild trust among airlines, pilots and foreign regulators. The fallout could affect the way the FAA monitors the development and approval of new aircraft essential for airlines to meet soaring global demand for air travel.
Boeing needed the MAX to offer a fuel-efficient option for customers to avoid losing market share to chief rival Airbus SE. Boeing didn’t even wait for its board of directors to approve the design before offering it to American Airlines, which was on the cusp of buying planes from Airbus. Boeing’s board didn’t formally sign off on the MAX until a month later.
“Design, development and certification was consistent with our approach to previous new and derivative airplane designs,” Boeing said.
Boeing engineers realised the MAX needed engineering changes from the existing 737s to accommodate its larger, fuel-efficient engines. The engines made the new plane tougher to fly in certain conditions than the 737s already in service, according to people familiar with the plane’s development. To help pilots manage that, Boeing decided to add the stall-prevention system, known as MCAS.
In the Lion Air crash, the stall-prevention system, based on erroneous sensor information, repeatedly pushed the plane’s nose down. According to a preliminary accident probe, the pilot battled the flight controls while facing a cacophony of alarms before losing control and plunging into the Java Sea.
Some former Boeing engineers, safety experts and pilots said that while the system was conceived to enhance safety, the design fell short.
Throughout the MAX’s development, Boeing was intent on minimising design changes that could require extra pilot training, said Rick Ludtke, a former Boeing engineer who worked on 737 MAX cockpit features but not the MCAS system. Extra training could have added costs for airlines introducing the MAX into service.
The company had promised Southwest Airlines Co., the plane’s biggest customer, to keep pilot training to a minimum so the new jet could seamlessly slot into the carrier’s fleet of older 737s, according to regulators and industry officials.
Mr. Ludtke recalled midlevel managers telling subordinates that Boeing had committed to pay the airline $1m per plane if its design ended up requiring pilots to spend additional simulator time. “We had never, ever seen commitments like that before,” he said.
Southwest, which has ordered 280 MAX aircraft, declined to comment on the issue, as did Boeing. A Southwest spokeswoman has said the airline developed its 737 MAX training based on Boeing’s information and was a recipient of, not a driver of, the training mandates.
It was difficult for Boeing to figure out what changes it could make without triggering the need for more training, Mr. Ludtke said, in part because of the FAA’s approval process.
According to Mr. Ludtke and a US government official, the agency would evaluate the entire plane only after it was complete, and wouldn’t give step-by-step guidance on what would or wouldn’t lead to additional training demands. That added pressure on Boeing’s engineers to keep changes to a minimum, he said.
The FAA has said that the 737 MAX was approved as part of the agency’s standard certification process.
The MAX planes entered service before the first flight simulators were even ready for use by airlines, according to airline executives, and the few that have now been introduced can’t replicate the malfunction the Lion Air crew faced. The simulators are set to be enhanced to allow pilots to practice dealing with such failures, though the upgrade could be months away.
Following the Lion Air crash, Boeing said that pilots are routinely trained to respond to erroneous automated nose-down pushes regardless of the cause and turn off related systems. The company has told pilot groups and others that the system behaves similarly to the ones in an earlier generation of 737s. It said it discussed the MCAS system’s functions at several airline conferences in recent years and wrote manuals to include information it believed pilots needed to operate the aircraft safely.
Numerous pilots and safety experts interviewed by The Wall Street Journal said that in practice, amid the chaos of an aircraft lurching into a steep dive with emergency warnings blaring, it is unrealistic to expect pilots to recognise what is happening and respond almost instantaneously.
Bryan Lesko, an airline pilot who wrote an article last year for his union’s magazine about the 737 MAX before it entered service, repeatedly asked Boeing officials if there were any major new systems. The answer was no, according to a person who recently discussed the matter with him. The union declined to make Mr. Lesko available for comment.
Since the stall-prevention system emerged as a potential factor in the Lion Air crash, industry and government officials around the world have learned that the system can in certain situations push the plane’s nose down repeatedly, undercutting the pilot’s ability to regain control manually.
A software overhaul Boeing is set to distribute to airlines in the coming weeks will address that problem.
An earlier design decision by Boeing engineers was intended to make the stall-prevention system simple. It relied on data from a single sensor, rather than two, to measure the angle of the plane’s nose, Boeing said.
Safety experts, pilots and some former Boeing engineers say it is rare for aircraft to rely on just one sensor for almost any system whose failure could cause a crash. A sensor malfunction was implicated in the 2009 crash of Air France flight 447, when an iced-up airspeed sensor triggered a series of events that caused the plane to plunge into the Atlantic.
“If your airplane needs such a Band-Aid, then it is incumbent on you to make sure it’s a good Band-Aid,” said Frank McCormick, a former Boeing flight-controls engineer who became a consultant to regulators and manufacturers before retiring.
The Boeing spokesman said the plane maker’s analysis determined that a pilot would be able to address the flight-control system misfiring with switches to counteract it or turn it off. “Single sources of data are considered acceptable in such cases by our industry, and additional changes to the system were not deemed warranted,” he said.
An FAA-sponsored panel of international safety experts years ago concluded that crew training tended to stress that computers typically handle unusual situations more smoothly and effectively than the pilots. “There is a natural reluctance to turn [systems] off, because it’s not clear what else is being turned off,” said Ray Valeika, a retired senior maintenance and engineering official at Delta Air Lines .
Boeing is changing its approach to provide pilots with information about the sensors that measure the angle of a plane’s nose.
Boeing has long argued that such angle-of-attack information wasn’t necessary for crews to safely operate aircraft, and that other data such as altitude and air speed were more relevant. Over the years, a few carriers, such as American Airlines and Delta Air Lines Inc., have pushed Boeing to provide its pilots additional angle-of-attack information, according to an airline official.
In the wake of the Lion Air and Ethiopian Air crashes, Boeing now is making the alerts standard on the MAX, rather than as a paid option.
The promised software fixes for the 737 MAX amounts to reversal of key Boeing design decisions in developing the plane. With the new software in place, the stall-prevention system will rely on data from two sensors, not one, and won’t activate if the data from those angle-of-attack sensors doesn’t match.
– Ben Otto, Jim Oberman and Elisa Cho contributed to this article.
Write to Andy Pasztor at [email protected], Andrew Tangel at [email protected], Robert Wall at [email protected] and Alison Sider at [email protected]
