Should you fly on the Boeing 737 MAX now that Boeing and the U.S. regulators say it’s safe?
Before that question can be answered it’s important to understand that Boeing and the Federal Aviation Administration have repeatedly failed to honor their obligation to keep airline passengers safe—and these are the same people telling us the airplane is now safe.
Let’s begin with this simple and sobering fact: the 737 MAX, potentially the most dangerous airplane in the air, was allowed in the skies for 23 months before it was finally grounded in March, 2019.
At that point there were 371 of the airplanes in service with 47 airlines around the world. Many millions of passengers had flown on them, even after a first crash, in Indonesia in October 2018 of Lion Air Flight 610, killed 181 people.
The airplane was grounded after a second crash in Ethiopia, in March 2019, killed 157 people. Both flights ended in horrendous dives.
After the Ethiopian crash many people asked why it took a second catastrophe for regulators to act.
Wrong question. Why was the 737 MAX declared safe in the first place?
Thanks in large part to the diligence of congressional investigators we now know that long before the first 737 MAX was delivered to an airline in May 2017, Boeing managers and FAA inspectors knew there was a potentially fatal flaw in the airplane’s control system.
Indeed, in the aftermath of the first crash, the FAA had calculated that unless that flaw was fixed there would be an estimated 15 more catastrophic crashes within the estimated lifetime of the airplane. They kept this to themselves.
The flaw lay in new software that added another layer to the controls, the Maneuvering Characteristics Augmentation System, MCAS.
This system has been extensively investigated following the disasters. But Boeing’s reasons for adopting it—and the FAA’s readiness to clear it as safe—have been made much clearer by the congressional probes. They have revealed that critical decisions were taken to press ahead with the program despite frequent warnings of the risks.
1. THE FATAL CHAIN OF DECISIONS
Something had always puzzled me about the role of the MCAS in the two crashes.
The whole justification for installing the system in the first place was to deal with the discovery that in some high-speed turns the nose of the airplane suddenly rose up and there was a risk of a high speed aerodynamic stall.
And yet in both crashes the airplanes were flying at low speed and low altitude, shortly after takeoff. Why, therefore, had the MCAS been triggered?
Not long after the Lion Air crash, when Boeing gave the risk of a high-speed stall as the reason for installing the MCAS, I took part in a briefing in which a top Boeing engineer confirmed to me that this behavior was first revealed in wind tunnel tests in 2011.
A former Boeing test pilot, who was helping me to understand the 737’s control systems, told me that during everyday operations very few airline pilots would ever find themselves in such a situation.
Only during the investigation carried out by the House Committee on Transportation and Infrastructure did the answer to this puzzle emerge, and its importance cannot be overstated.
Boeing had concealed a fatal chain of decisions.
It turned out that early in 2016 flight tests—not wind tunnel tests—had revealed that in certain low-speed situations the MAX did not behave like previous models of the 737.
This was really bad news for Boeing’s sale pitch for the MAX, which was based on the claim that pilots migrating to the MAX from earlier models of the 737 could do so without spending costly hours retraining on a flight simulator and there was no need for changes to the flight manuals.
The reason why the MAX was skittish at low speed was the same as the reason for needing the MCAS at high speed: the increased weight and changed positioning of its new engines altered its “trim”—the airplane’s basic aerodynamic balance and stability. Installing the MCAS was, in effect, a deliberate resort to stealth—to fix the trim problem without ever involving the pilots.
The investigations uncovered that as a result of the flight test discovery, in March 2016, Keith Leverkuhn, the executive in charge of the MAX program, approved a critical change to the MCAS. New software was written to expand its role to include its engagement at low speed and low altitude if there was any warning of a low-speed stall—exactly what happened in the two crashes that occurred as the airplanes were beginning their climbs to cruise altitude.
The specific control surface deployed by the MCAS was the horizontal stabilizer, at the tail, which directs the nose up or down. In June 2016, when the MCAS was reconfigured for low speed flight, the horizontal stabilizer was given more power—or, as it is technically known, authority.
This was potentially lethal because it meant that if the MCAS was falsely activated at low speed it had the authority to override the actions of the pilots, as happened in the two doomed flights.
Back in March, at the same time that the decision to expand the role of the MCAS was taken, another executive, chief technical pilot Mark Forkner, requested that any mention of the existence of the MCAS be removed from flight manuals and this was done—again, to avoid the cost of retraining.
Thus, a year before the first 737 MAX aircraft began flying passengers, these two decisions combined to produce a mutually reinforcing scenario of disaster. A system was introduced that in a critical situation took control of the aircraft from the pilots—and the pilots would not even know of its existence.
It didn’t take long for the consequences to show up. The House report notes that during a test flight in the summer of 2016 a Boeing pilot had trouble handling the airplane at low speed because the MCAS kept engaging. An engineer on the flight, showing great prescience, saw what was happening and asked, “What happens if we have a faulty angle of attack?”
That question went unheeded by Boeing Managers.
He had, unknowingly, identified the third link in the chain of fatal flaws that caused both crashes. Warning of an impending stall was triggered by a sensor that monitored the airplane’s angle of attack—a pitching up of the nose—and that, in turn, triggered the MCAS. A faulty sensor could, and did, begin the sequence that cost 346 lives.
2. 10 SECONDS TO SAVE THE AIRPLANE
Boeing blamed both crashes on the pilots, as did the FAA.
The Lion Air pilots had no knowledge that the MCAS existed, as Boeing intended. The Ethiopian pilots knew about the MCAS and followed steps supposed to overcome its effects but those steps were futile.
Immediately following the Lion Air crash all reporters on the story, including me, were subjected to adamantine assertions from Boeing that the pilots could have successfully saved the airplane by assuming that they were dealing with a pre-existing condition, listed in their manual as a runaway stabilizer.
That was there to deal with the horizontal stabilizer on earlier models of the jet before the introduction of the MCAS, in situations where, without the authority given to MCAS, the pilots could regain control if the stabilizer overreacted, as it occasionally did.
Boeing’s view was reinforced by the FAA. A week after the crash they issued an Emergency Airworthiness Directive reminding pilots of the procedure.
Boeing and the FAA remained in lockstep on that issue even beyond the second crash. In fact, both were concealing a trail of their own negligence.
That was brought home with devastating directness when Captain Chesley “Sully” Sullenberger, who pulled off the “miracle on the Hudson” splashdown of U.S. Airways Flight 1594 in 2009, gave evidence to the House committee.
He said: “Accidents are the end result of a causal chain of events, and in the case of the Boeing 737 MAX, the chain began with decisions that had been made years before, to update a half-century old design.”
The 737 MAX is unique among current jets in that it does not embody a discrete generation of technology. Several very different generations of technology converge in its cockpit. As one pilot said when he sat in the cockpit for the first time, he was looking not only at modern video screens displaying data but at “dozens of switch throws, button pushes and knob turns that date back to the original 737 designed in the Apollo era.”
Critically, the key flight controls are not part of a modern “fly-by-wire” automated system and electronically driven (as they were in Sully’s Airbus A320) but mechanically driven, via hydraulics. When things go wrong in a 737 cockpit that means pilots are dealing with both the sudden physical challenges of “hands on” flying and the sensory challenges of numerous alerts flashing on video screens.
Sullenberger said, “I’m one of the relatively small group of people who have experienced such a sudden crisis—and lived to state what we learned about it… within seconds, these crews would have been fighting for their lives in the fight of their lives.”
Boeing had, all along, been ignoring that reality. In their scenario the pilots should have been able, single-mindedly, to act within seconds and correctly identify what was happening and remember a procedure—it was actually called “a memory item”—buried in their manual that was totally unrelated to the MCAS.
It’s hard to believe that Boeing really thought that was possible.
The House committee discovered Boeing documents showing that in June 2018, just five months before the Lion Air crash, their engineers had recognized that if it took more than 10 seconds for the pilots to respond effectively to a faulty action of the MCAS the result would be catastrophic.
Incredibly, Boeing assumed that pilots would be able to begin a recovery within four seconds. And the FAA inspectors agreed with that as they certified the airplane safe to go into airline service in March, 2017.
Cockpit voice recorders recovered from both crashes showed that rather than coolly and intuitively being able to isolate what was happening to them the pilots were bombarded with aural and visual warnings from multiple instruments.
They were suffering from “startle effect”—a condition that the FAA defines as “An uncontrollable, automatic muscle reflex, raised heart rate, blood pressure, etc, elicited by exposure to a sudden, intense event that violates a pilot’s expectations.”
Research at the University of North Dakota has shown that in this situation pilots don’t regain their full cognitive skills for to 30 to 60 seconds after a startle event.
Leverkuhn, the Boeing executive who signed off on extending the role of the MCAS to low-speed sectors of the flight, gave evidence to the lawmakers in May 2019. He was asked about Boeing’s belief that pilots would be able to act within the 10 seconds allowed before the fate of the airplane was sealed.
“The assumptions that were made at the time were correct based upon what we knew” he said, “but what we now subsequently know is that those assumptions have been proved incorrect… that’s a learning we’ve had on this program. It’s a learning that we are now putting forth on the new aircraft.”
This echoed the line being peddled by other Boeing executives including the CEO David Calhoun and I found it astonishing and, at best, disingenuous.
I have covered aviation for 25 years and I have interviewed scores of engineers, regulators, investigators, and designers. There is a large body of research about the role of the human factor in crashes and the need to design emergency procedures around the actual visceral experience in the cockpit, particularly allowing a realistic time for pilots to react.
That research began at NASA and was used in the training of astronauts. The knowledge was then transferred to the FAA via Dr. Kathy Abbott who became their first human factors specialist.
In 1999 Dr. Abbott, in a long interview with me, explained her approach. She strongly opposed the impulse to blame crashes on human error and warned that new systems in the cockpit introduced new vulnerabilities. “Pilot error is a symptom of other problems” she said, “and not a cause of accidents.”
Boeing was fully aware of that body of knowledge as they designed the 737 MAX and so, obviously, was the FAA but both chose to ignore or forget it when they pressed ahead with trying to fix the 737 MAX’s flight control problems. Far from taking pilots into consideration, they knowingly left an innately lethal defect for pilots to deal with.
3. THE CULTURE OF CONCEALMENT
The trail of revelations about the 737 MAX are a reassuring example of the value of bipartisan congressional oversight. There are no other cops on the case.
It would have been impossible to reveal the derelictions of Boeing and the FAA in the two crashes without the work of the two congressional committees, one in the House and one in the Senate. Both were able to find and make wide use of whistleblowers (the Senate committee alone heard from 57) who would otherwise have not found a hearing.
Even then, both investigations were hampered by the withholding of witnesses and documents by Boeing and the FAA. The House committee complained about the Department of Transportation’s tardiness in handing over key FAA documents and the chairmen of both committees said they were frustrated by the lack of cooperation.
The House committee specifically accused Boeing of a culture of concealment: “In several critical instances, Boeing withheld crucial information from the FAA, its customers, and the 737MAX pilots.”
They also detailed lax oversight of Boeing by the FAA: “Multiple career FAA officials have documented examples where the FAA management overruled the determination of the FAA’s own technical experts at the behest of Boeing.”
It is, however, one thing to investigate and expose the scandal and another thing to make sure it cannot be repeated. And this goes to the fundamental issue of trust: Can the traveling public have faith that the bad actors have been removed and the lessons learned?
A new report by the Senate committee suggests otherwise.
It shows that more than a year after the Ethiopian crash Boeing executives were still trying to defend the fantasy that pilots confronted with a rogue intervention by the MCAS would successfully deal with it in less than 10 seconds.
In July 2019, two test pilots were in a simulator that was programmed to trigger the sudden onset of a nose-dive directed by the MCAS, as it would have been if an angle of attack sensor had fed it false data.
A whistleblower told the committee that before the test a Boeing official had told the pilots to “remember, get right on that pickle switch”—referring to the procedure to deal with a runaway stabilizer.
One test pilot hit the right switch in the designated time of four seconds; the other took 16 seconds—too late, according to the agreed scenario, to avoid catastrophe.
(In another test three airline flight crews, presented in a simulator with a runaway stabilizer emergency in the previous 737 model, the NG, without the MCAS to contend with, took 49, 53 and 62 seconds to regain control of the airplane.)
The Senate committee concluded: “FAA and Boeing officials involved in the conduct of this test had established a pre-determined outcome to reaffirm a long-held human factor assumption… Boeing officials inappropriately coached test pilots in the MCAS simulator testing contrary to testing protocol.”
And they underlined that this took place while Boeing and the FAA were in the process of recertifying that the airplane was now safe to fly.
4. “IT’S NOT AS GOOD AS IT SHOULD BE”
The 737 MAX was grounded for 22 months. The first people who had to be persuaded that it was safe to fly again were the airline pilots. They fly it every day.
Do they now believe that everything has been done that could be done to make it safe?
Who better to ask than Captain Sullenberger? In an interview with the Seattle Times he said: “People are going to fly on it and I will probably be one of them. The updated MAX will probably be as safe as the 737 NG when they are done with it. But it’s not as good as it should be.”
(The Daily Beast confirmed with Captain Sullenberger’s office that he stands by this view.)
Sullenberger and other pilots have a continuing concern about the role in both crashes of the angle of attack sensors.
The FAA has cleared the jet to fly with two sensors, after changes were made to the software in the flight control computer that would detect a faulty sensor and disable it. That’s not good enough for the European Aviation Safety Authority, EASA. They want a third sensor added as backup—as does Sullenberger.
This was exactly what a Boeing engineer called for, back in 2013, when the MCAS was being developed. He recommended that the 737 MAX should have the benefit of a new technology used on the 787 Dreamliner, a third sensor that unlike the other two was not mechanical and vulnerable to damage but was a computerized calculation.
Boeing executives ruled that out because, as a new feature, it would have required the airline pilots to have the simulator training that Boeing was, at all costs, trying to avoid. (That training is now mandated as part of the recertifying the jet).
Because of the pressure from EASA, Boeing has agreed to retrofit the MAX fleet with the third sensor—but that will take years to complete.
As EASA worked to recertify the 737MAX independently of Boeing and the FAA it found itself at odds with them over the extent of changes needed.
“If we had listened to the FAA and Boeing we would have settled for making modifications to the MCAS” said Patrick Ky, EASA’s director general, in a conference call to reporters.
Ky’s reservations were the reason why EASA did not greenlight the MAX’s return to airline service when the FAA did in November. They are now expected to do so in January.
EASA has pressed Boeing hard to drop the delusional line on pilot reaction times—Ky spoke of reviewing “alarm management” in the cockpit and other weaknesses that apply not just to the MAX but the earlier NG models.
In his interview with the Seattle Times, Sullenberger said, “For most of Boeing’s history, it had a stellar record for designing and building excellent airplanes. On the MAX, the flight control system design was flawed… they had inadvertently created a deathtrap.”
As part of recertifying the airplane the FAA has set new training standards that include how pilots could successfully deal with a runaway stabilizer and the manual effort involved. Pilot groups wanted that training to be obligatory every two years, but the FAA, responding to pressure from the airlines about the cost, reduced it to every three years.
Passengers now have to decide, on the basis of what the regulators are telling us, that the 737MAX is safe to board. American Airlines is reintroducing it to its routes imminently, followed by United and Southwest early in 2021.
On many routes, passengers will have a choice, and if they can, they may switch to another airline flying a different airplane, often the rival Airbus A320.
A stigma of this magnitude is a tough thing to shake off, and the 737 MAX is stigmatized. Airlines know this. The Irish budget airline Ryanair, which bought a lot of the airplanes at a bargain-basement price, certainly knows this and is no longer referring to it as the MAX, but as the 737-8200. Expect others to follow.
