The most damaging crisis to hit Boeing in its more than 100-year history really began nearly a year ago, on August 13, 2018, when Indonesia’s Lion Air took delivery of a new Boeing 737-MAX.
Lion Air was one of the world’s many budget airlines eager to acquire new fleets of the single-aisle jet. The 737 series is the best-selling commercial airplane ever built. More than 5,000 of the new MAX versions had been ordered, creating an order backlog of several years.
Asia is the fastest growing market for smaller jets. In Indonesia and numerous other Asian countries affordable regional air travel has compensated for the absence of 20th-century infrastructure like super highways and high-speed trains.
ADVERTISEMENT
Boeing was competing to meet that demand with its only rival, Airbus. The MAX program, the fourth generation of a jet that was conceived in 1964, was launched in 2011.
When the first 737-MAX was delivered to Malindo Air of Malaysia, a subsidiary of Lion Air, in May 2017, Boeing touted it as “the best-in-class, the most technically advanced aircraft available.” In fact, the only technically advanced thing about it was its engines, which delivered far greater fuel efficiency. Otherwise little had changed from the previous version of the 737, launched in 1996.
On October 29, 2018, the 737-MAX delivered to Lion Air on August 13 crashed a few minutes after takeoff, killing all 189 people on board, the largest number of deaths in any 737 crash. Barely four months later another 737-MAX, belonging to Ethiopian Airlines, crashed six minutes after takeoff, killing all 157 people on board.
A death toll of 346 people, and in such a short time, presented Boeing’s chief executive Dennis Muilenburg with a test of his leadership, for which he has appeared ill-prepared.
Since the Ethiopian crash, a damning picture has emerged of Boeing’s management of the development of the MAX on Muilenberg’s watch. He has yet to give a convincing answer to charges that by rushing the new jet to market the company deliberately ignored warnings about the system that triggered both crashes, the Maneuvering Characteristics Augmentation System (MCAS), or to explain why pilots were not even told that the system existed.
Muilenberg’s role in defending Boeing since the crashes is as contentious as his oversight of what was obviously a deeply flawed development program.
Within days of the Lion Air crash, the lines of Boeing’s public defense were clearly drawn. All of the company’s considerable public relations and legal resources were involved and almost every statement began with the standard mantra that in designing every part of every airplane, Boeing always put safety first.
A fundamental part of the company’s defense, made explicit in a statement issued on November 27, 2018, was that the Lion Air pilots could have recovered from the persistent actions of MCAS that were forcing the nose down and that eventually caused the fatal nose dive into the Java Sea—even though the pilots did not know that MCAS existed.
In making this claim, Boeing described an emergency procedure used on earlier models of the 737 that they said was a “memory item”—meaning that it was something they should have instantly recalled from their training. MCAS had overridden the pilot’s commands but, incredibly, Boeing insisted that the pilots did not need to know that MCAS was moving the horizontal stabilizer (the control surface forcing the nose down). Boeing said they could have cut off MCAS by following a standard set of actions for dealing with “unintended horizontal stabilizer movement.”
Boeing didn’t explain whether, in the event the pilots had managed to save the airplane, they might be entitled to learn what had actually imperiled the flight.
Two days later, Boeing held a conference call briefing with a number of reporters, including me. Several pilots had reviewed a first report by Indonesian investigators and said that the fatal intervention of MCAS appeared to have been caused by faulty data fed into a small sensor that indicated the jet’s “angle of attack”—its angle relative to oncoming air—a warning that the nose was pitching up and that the airplane was in danger of stalling, which it was not. It meant that, instead of saving the airplane from a stall, MCAS was repeatedly working against the pilots’ commands and forcing down the nose until it won that struggle and produced the terrifying death dive.
I took up this issue of the sensor as the initial trigger of the disaster with the Boeing vice president leading the briefing, Mike Sinnett, and asked if this scenario indicated a problem that all airplane designers are expected to avoid, a “single-point failure” in which there is no back-up system to prevent potentially catastrophic failure.
Sinnett and Boeing did not agree that, even if the false data came from a single sensor and remained uncorrected it was a single point failure. I asked the FAA the same question but they did not respond to it specifically.
Instead, they pointed out that they had issued an emergency directive to airlines citing an “Unsafe Condition” where “there is a potential for repeated nose-down trim commands” that could lead to “possible impact with terrain.” Their solution was the same as Boeing’s: remind pilots to follow the instructions on dealing with a runaway stabilizer.
Even after the Ethiopian crash, Boeing continued to suggest that the pilots could have prevented the crash. As recently as a few days ago, when the Wall Street Journal reported that some FAA staff had warned after the Lion Air crash that the same fatal sequence of failures could recur, Boeing stuck to its original line: “Boeing and the FAA both agreed, based on the results of their respective rigorous safety processes, that the initial action of reinforcing existing pilot procedures… and then developing and fielding a software update, were the appropriate actions.”
The captain of the Ethiopian flight was the youngest at the airline, 29-year-old Yared Getachew. In nearly nine years in the cockpit he had flown 8,122 hours, more than a thousand of them on two versions of the 737, first the previous generation and then 103 hours on the MAX.
The crucial difference was that, unlike the Lion Air crew, the Ethiopian pilots knew of the existence of MCAS and the procedures Boeing said would deal with another malfunction. A preliminary report by Ethiopian investigators showed that the pilots had followed Boeing’s procedures, flipping switches to disable MCAS and regaining control but, for some reason they later appeared to have re-engaged the system, sending the jet into the ground at more than 500 mph.
At a congressional hearing on the MAX crashes in June Daniel F. Carey, president of the Allied Pilots Association, which represents the pilots of American Airlines, said his members were offended by attempts to blame the pilots.
“Vilifying non-U.S. pilots is disrespectful and not solution-based,” he said.
A more trenchant defense of the pilots came from a pilot with outstanding airmanship credentials of his own: Chesley B. “Sully” Sullenberger, who famously saved a flight by ditching into the Hudson River in 2009.
“We are all subject to hindsight bias,” he said. “I think it’s unlikely that other crews would have had very different experiences or performed very differently… we shouldn’t be blaming dead pilots and we shouldn’t expect pilots to compensate for flawed designs.”
There was something disturbingly familiar to me in Boeing’s two principal assertions, that the pilots could have saved their airplanes and that there had not been a single-point failure.
In September 1994 USAir Flight 427 was on its final approach to Pittsburgh when it suddenly flipped over and nose-dived to earth, killing all 132 people on board. The airplane was what was then the most common model of the 737, the 300 series. I spent a year investigating the crash for Conde Nast Traveler.
Three years earlier a similar crash had happened while a 737-300 was on approach to Colorado Springs, killing all 25 people on board.
In both cases investigators discovered that something had caused the jets’ rudders to suddenly make a sharp movement that precipitated a steep turn followed by a dive.
The Pittsburgh crash initiated the longest-ever investigation by the National Transportation Safety Board (NTSB). Attention soon focused on what looked like a rogue action of the rudders triggered by a flaw in a device called a yaw damper, common to all jets, that automatically corrects an inherent tendency for the airplane to wallow.
From the beginning Boeing resisted this scenario. Giving evidence to the NTSB, a Boeing engineer insisted that the crash was “not an uncommanded event”—code for “the pilots did it”—and said of the pilots, “they could have flown out of this one.”
Eventually, the NTSB established that a faulty valve was responsible for the rogue movement. Even though Boeing claimed that because the 737 had three back-up systems for the rudder this could not have been a single-point failure the investigators revealed that all three of the back-up systems intersected at one point: the yaw damper.
Finally, after investigators recreated a detailed picture of the airplane’s last minutes in the air, a Boeing spokesman conceded of the pilots, “Everything unraveled so fast that they didn’t have a chance.”
The NTSB showed conclusively that, in fact, the rudder had moved forcefully in the opposite direction to the pilot’s commands. The board said that neither Boeing nor the makers of the flawed part had the analytical capacity to discover how this had been possible. It took two years to refit the 737 fleet with a new, and safe, yaw damper.
During my reporting I interviewed Richard Schaden, a lawyer representing families of victims of both crashes. Schaden was unusual in that he was also a qualified aviation engineer and piloted his own corporate jet. He had had a long experience of stonewalling by airplane companies and told me: “People will do things in a boardroom that they would never do as an individual. Group decisions, no personal liability… to a certain corporate cast of mind people who die in air crashes are the enemy.”
Schaden’s words have nagged at me since I have been covering the 737-MAX disasters.
It’s important to remember that Boeing and the FAA stubbornly resisted grounding the 737-MAX after the Ethiopian crash.
Within 24 hours of that disaster Chinese regulators ordered the Chinese fleet of nearly 100 of the jets grounded and were clear about why, citing “the management principle of zero tolerance for safety hazards and strict control of safety risks.”
A day after the Chinese order Dan Elwell, the FAA’s acting head, said there was no basis for grounding the airplanes and, “Nor have other civil aviation authorities provided data to us that would warrant action.”
This astounded other regulators. Agencies in Singapore, Australia and Europe ordered the grounding of their own airlines’ fleets but it was not until Canada followed that the FAA finally acted, and the world’s fleet of 371 MAX jets has remained grounded ever since, with no certainty about when that might end.
As a lot of reporting has made clear, most recently in the New York Times, that throughout this farrago FAA and Boeing have behaved as though they are a single entity with common interests, one of which is to allow commercial imperatives to override due diligence in certifying an airplane as safe to fly.
From the beginning of the jet age in the 1950s the FAA was the gold standard in driving international safety standards to a level that cut the accident rate by more than 80 percent in a decade. But now the agency is seen to have sacrificed that reputation by becoming the compliant servant of one company’s interests over those of airline passengers.
There are more than 30 aviation regulators worldwide. Many are dismayed by the breakdown of what was once a consensus on how to respond to urgent safety issues.
Elwell is unmoved. “I’m not driven by other countries’ decisions,” he said in June, “I’m driven by our process and the data we collect.”
As a result, countries have been left to make their own analysis and judgments of whatever Boeing and the FAA eventually come up with as fixes for the jet’s flawed systems. One consequence of this is that some nations’ agencies won’t want to seem happy following in the slipstream of Boeing and the FAA, and won’t clear their own fleets to fly until they have made independent certification tests of their own.
No Airbus CEO could ever have expected the easy ride from European regulators that Muilenburg had with the FAA as he pushed the MAX into the air at all costs, sustaining his reputation as a man who delivered record profits to stockholders as fast as he delivered airplanes to the airlines.
Muilenberg has had a one-company career, joining Boeing 34 years ago as an intern. He always comes across as somebody with a blind faith in his company’s blamelessness. To that end he seems ready to stick to whatever script his lawyers and PR staff give him, no matter how fatuous. For example, this passage appeared over his signature in a full-page newspaper advertisement after the second crash:
“Our mission is to connect people and nations, protect freedom, explore our world and the vastness of space, and inspire the next generation of aerospace dreamers and doers—and we’ll fulfill that mission only by upholding and living our values.”
But what exactly are those values?
Muilenberg has been caught in a classic trap of a lawyered defense. Once Boeing took the position that pilots could have recovered from an MCAS-induced emergency, however bizarre that assertion was, there was no retreat from it without admitting a very high degree of liability for the crashes.
As Muilenberg repeatedly doubled-down on this defense there was no way for him to ever get out ahead of the story—and the story was so patently indefensible that Boeing found itself subjected to a level of journalistic scrutiny that it had never before experienced and had no ability to deal with. Instead of candid transparency there has been obfuscation and evasion. Instead of reassurance, there have been more empty bromides about “our deepest sympathies to the loved ones of the passengers and crew on board.”
Muilenberg has recently admitted that if the grounding of the 737-MAX continues through the rest of this year, which is now thought possible, he will have to pause production. One reason is that the company is running out of space to park airplanes that continue to come off the production line—there are now at least 200 of them sitting outside the plant in Renton, Washington, a suburb of Seattle.
In the second quarter of this year the company made a record loss of $2.9 billion partly because of payouts it has to make to airlines for failing to deliver new jets to their fleets—the schedules of several major airlines have been disrupted for lack of capacity.
But what should count against Muilenberg more than just the end of his reputation as a rainmaker for the company is about a priceless asset—the loss of its credibility.
The mantra of “safety remains our top priority and is a core value for everyone at Boeing” rings hollow now. Nobody is more immersed in the Boeing corporate culture than Muilenberg, and as the leader of the company he owns that culture,. It has failed at its most basic level: to sustain the flying public’s confidence in the safety of the airplanes it produces.
He has presided over a calamity for which, at the very least, he bears partial responsibility. He should go.
