UPDATE: For the latest story, see Boeing CEO Muilenburg gets through day one of D.C. hearings on the 737 MAX mostly unscathed
On Tuesday in Washington, D.C., on the first anniversary of the Lion Air 737 MAX tragedy that killed 189 people in Indonesia, U.S. senators will question Boeing CEO Dennis Muilenburg in a public hearing — the first of two days of congressional grillings.
It’s essential to the recovery of both the 737 MAX and Boeing, and perhaps also to Muilenburg’s own future, that he prove convincing when he claims the airplane is now safe following a system redesign.
He will need to be more persuasive than he was in a disastrous April press conference in Chicago, when he steadfastly refused to admit any error in Boeing’s design of the 737 MAX flight controls. Muilenburg insisted then that was just one link in a chain of events and asked everyone to “let the investigation process run its due course.”
The Lion Air investigation has now run its course, and the final report released Friday laid out the precise chain of events.
737 MAX CRISIS
In that crash, the chain started with a bad replacement angle-of-attack sensor supplied by an aviation-repair station in Florida that the Federal Aviation Administration (FAA) shut down the day the report was released.
It continued with the Boeing link — the flight control software called MCAS (Maneuvering Characteristics Augmentation System) — that took the input from that one bad sensor and repeatedly pushed the nose of the aircraft down.
And it ended with a captain who, though he didn’t understand what was happening, over a span of six minutes successfully countered the system more than 20 times, but who then handed off to a less capable co-pilot who a minute later lost control of the jet.
Yet the specifics of that chain don’t change Boeing’s responsibility.
The Lion Air investigation report points out that “over the last 17 years in the Boeing 737 fleet alone, there were 25 events of stick-shaker activation during or shortly after takeoff” that are likely also angle-of-attack failures. And the Ethiopian crash looks like it began with a bird strike that knocked out the sensor.
Sometime, somewhere, an angle-of-attack failure on a MAX that would activate MCAS was inevitable.
And sometime, somewhere, that activation was going to intersect with a flight crew that was poorly prepared to respond.
In less than five months, a faulty angle-of-attack sensor set off MCAS three times, and on two of those occasions the crews failed to handle it.
The Lion Air final report concluded that Boeing’s MCAS system on the MAX “was not a fail-safe design and did not include redundancy. A single failure to the AOA sensor … resulted in erroneous activation.”
Muilenburg, 55, who in April insisted that MCAS “was designed per our standards … certified per our standards,” will have to defend that extraordinary deviation from standard aviation design practice.
Admitting fault
In his opening statement to the senators, led by Commerce committee chair Sen. Roger Wicker, R-Miss., and ranking member Sen. Maria Cantwell, D-Wash., Muilenburg will for the first time admit to some outright errors, according to a written submission Boeing released Monday.
“We know we made mistakes and got some things wrong,” he’ll tell the hearing. “We own that, and we are fixing them.”
In previous public statements, Muilenburg denied any “technical slip” in the jet’s development.
On Tuesday, he’ll describe Boeing’s software improvements, which will “ensure MCAS cannot be activated based on signals from a single sensor, and cannot be activated repeatedly.”
“When the 737 MAX returns to service, it will be one of the safest airplanes ever to fly,” he’ll insist.
Muilenburg will reference Boeing’s legacy of more than 100 years of deeply impressive history, “the company that brought the Jet Age to the world and helped land a person on the moon.”
And he’ll recall recent visits to its far-flung facilities, including the Renton final assembly jet plant “where 12,000 amazing people pour their hearts into building the 737 MAX.”
Questionable decisions on MCAS
The final report regarding the Lion Air crash, released Friday by the National Transportation Safety Committee of Indonesia, added detail to what’s known about serious flaws in the design and certification of the MAX’s new MCAS flight control software.
During early development of the jet in 2012, Boeing did a preliminary evaluation of the consequences of MCAS failure as a low-level event that would increase the crew’s workload but not threaten serious injuries.
This assessment was based on false assumptions by Boeing, the primary one being that pilots would take immediate action to counter the MCAS nose-down movement.
In the real-life scenarios of the crash, the pilots did not.
The Lion Air report notes that multiple activations of MCAS were not each time completely countered by the pilots, creating a heavy force on the control column — it reached 103 pounds on Lion Air Flight 610, when 75 pounds is the maximum allowed.
It also concluded that Boeing hadn’t considered the effect of multiple flight-deck alerts slowing the pilot’s responses. And that Boeing’s decision not to put anything about MCAS in the pilot manual or training contributed to the pilots’ not recognizing what was happening and how they should respond.
Boeing’s formal analysis considered only the scenario of MCAS activating once and being countered by the pilots, not activating multiple times.
However, the final investigation report also includes information about a crucial missed opportunity when a worse scenario was at least briefly looked into.
During development of the MAX, Boeing “engineering personnel and test pilots discussed the scenario of repeated uncommanded MCAS activation due to erroneously high AOA and considered whether a system redesign was necessary to address this issue,” the Lion Air report states.
Again, based on an assumption that each activation would be recognized and immediately countered, this meeting concluded that “no redesign was necessary.”
In addition, in March 2016, Boeing discovered during flight test that it needed to expand the role of MCAS beyond its application in a high-speed turn maneuver to also apply in certain low-speed flight scenarios.
This entailed increasing the maximum authority of the system from 0.6 degrees to 2.5 degrees — when 4 degrees is all it takes to go from level flight to maximum nose-down.
Since Boeing’s engineers considered the high-speed maneuver the more dangerous scenario, they decided this late expansion to low-speed flight wouldn’t increase the consequences of a failure.
All of this analysis was delegated by the FAA to Boeing itself.
And though Boeing was supposed to communicate all of its work for approval by FAA technical specialists, in the last-minute rush to certify the jet not all those within the FAA who should have signed off on the changes to MCAS were made aware of them.
The report noted that Boeing in November 2016 submitted its revised system safety assessment to the FAA and that just a month later, in December 2016, the FAA’s response to Boeing was to simply “accept” the submission, with a notation added indicating that approval of the assessment was delegated to Boeing.
In any case, the report concluded, the FAA’s focus on the system safety assessment “was mainly around other system changes and not MCAS.”
In short, Boeing failed to realize it was inserting into the MAX a highly aggressive system that could cause pilots to lose control. And the FAA, having delegated most of the oversight to Boeing, gave the system only a perfunctory review and didn’t catch its tragic vulnerabilities.
This brings up two stark questions for Muilenburg:
- How did Boeing miss the flaws in MCAS that it has now fixed?
- And does the system of delegating oversight to the manufacturer need to be rolled back for the future?
The second question is one that lawmakers need to pose with some humility, for Congress — at the behest of Boeing lobbyists — has over many years pushed the FAA into delegating more and more of its oversight to the manufacturers.
Most recently, the FAA Reauthorization Act of 2018, which was signed into law on Oct. 5, just three weeks before the Lion Air crash, further diluted the degree of government oversight.
The law requires the FAA to “delegate fully” to the manufacturer unless the head of the agency determines there is specific public safety reason to limit the delegation for a particular item.
Doubts about Boeing’s culture
Muilenburg will also be asked about how he’s addressing the whistleblower charges of Curtis Ewbank, a Boeing flight controls engineer who submitted an internal ethics complaint alleging that management — determined to keep down costs for airline customers — had blocked significant safety improvements during the MAX’s development.
Ewbank’s complaint resonates with the view of many veterans in Boeing’s local engineering community that the company culture has deteriorated to the point where safety has been compromised by management’s focus on schedule and cost.
Complaints to that effect have been voiced repeatedly since Boeing embarked on the extensive outsourcing of the 787 Dreamliner program that proved so destructive.
Similarly, Muilenburg needs to respond to concerns that Boeing made too many safety compromises to get what’s now a 50-year-old original airplane design recertified as the MAX.
In 2014, Boeing convinced the FAA to relax the safety standards for the MAX related to cockpit alerts that would warn pilots if something went wrong during flight.
Boeing successfully argued that full compliance with the latest requirements would be “impractical” for the MAX and would cost too much.
Two earlier reports based on the MAX accident investigations, an NTSB report in September, and a report by international regulators this month, recommended the opposite approach: a move toward better-designed pilot alerting systems to address the problems posed by increased cockpit automation:
- Does Boeing need to change the way it designs planes in future?
- Has its leadership focused too much on cost and schedule?
- How does the CEO propose to turn things around?
Beyond these tough, big-picture questions, on Tuesday Muilenburg will also have to confront the human consequences.
Some two dozen family members of victims of the MAX crash in Ethiopia are expected to be in the audience for the Senate hearing. The families are expected to meet with Muilenburg and other executives after his testimony.
The opinions expressed in reader comments are those of the author only and do not reflect the opinions of The Seattle Times.