Written by James Glanz, Julie Creswell, Thomas Kaplan and Zach Wichter
In the brutally competitive jetliner business, the announcement in late 2010 that Airbus would introduce a more fuel-efficient version of its best-selling A320 amounted to a frontal assault on its archrival Boeing’s workhorse 737.
Boeing scrambled to counterpunch. Within months, it came up with a plan for an upgrade of its own, the 737 Max, featuring engines that would yield similar fuel savings. And in the years that followed, Boeing pushed not just to design and build the new plane, but to convince its airline customers and, crucially, the Federal Aviation Administration, that the new model would fly safely and handle enough like the existing model that 737 pilots would not have to undergo costly retraining.
Boeing’s strategy set off a cascading series of engineering, business and regulatory decisions that years later would leave the company facing difficult questions about the crash in October of a Lion Air 737 Max off Indonesia.
The causes of the crash, which killed 189 people, are still under investigation. Indonesian authorities are studying the cockpit voice recorder for insights into how the pilots handled the emergency and are examining Lion Air’s long history of maintenance problems.
But the tragedy has become a focus of intense interest and debate in aviation circles because of another factor: the determination by Boeing and the FAA that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.
That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it appears to have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash.
Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.
Those decisions ultimately prompted the company, regulators and airlines to conclude that training or briefing pilots on the change to the flight control system was unnecessary for carrying out well-established emergency procedures.
The crash has raised questions about whether Boeing played down or overlooked, largely for cost and competitive reasons, the potential dangers of keeping pilots uninformed about changes to a critical element of the plane’s software. And it has put a new focus on whether the FAA has been aggressive enough in monitoring Boeing.
Boeing has taken the position that the pilots of the Lion Air flight should have known how to handle the emergency despite not knowing about the modification. The company has maintained that properly following established emergency procedures long familiar to pilots from its earlier 737s should have allowed the crew to handle a malfunction of the maneuvering characteristics augmentation system, known as MCAS, whether they knew it was on the plane or not.
The FAA declined to comment about the crash but acknowledged that its own role was being examined. “The FAA’s review of the 737 Max’s certification is a part of an ongoing investigation with the NTSB and Indonesian civil aviation authorities,” the agency said in a statement, referring to the National Transportation Safety Board. “We cannot provide details of that review until the investigation is complete.”
Boeing’s position has left many pilots angry and concerned. “Any time a new system is introduced into an airplane, we are the people responsible for that airplane,” said Jon Weaks, president of the Southwest Airlines Pilots Association.
Saving Airlines Time and Money
In designing the 737 Max, Boeing was selling airlines on the aircraft’s fuel savings, operating cost reductions and other improvements. But at the same time, it was trying to avoid wholesale aerodynamic and handling changes that would spur the FAA to determine that 737 pilots would need substantial new and time-consuming training.
Internally, a primary requirement for the Max was that no design change could cause the FAA to conclude that pilots must be trained on the system differences between the then-current version of the plane, the 737 NG, and the Max using simulators, said Rick Ludtke, a flight crew operations engineering analyst who was involved in devising some of the other new safety features on the 737 Max.
By limiting the differences between the models, Boeing would save airlines time and money by not putting their 737 pilots in simulators for hours to train on the new aircraft, making a switch to the Max more appealing.
“Part of what we wanted to accomplish was seamless training and introduction for our customers, so we purposely designed the airplane to behave in the same way,” Dennis A. Muilenburg, Boeing’s chief executive, said on CNBC in December. “So even though it’s a different airplane design, the control laws that fly the airplane are designed to make the airplane behave the same way in the hands of the pilot.”
But Boeing’s engineers had a problem. Because the Max’s engines are larger than those on the older version, they needed to be mounted higher and farther forward on the wings to provide adequate ground clearance. Early analysis revealed that the engines would have a destabilizing effect on the airplane, Ludtke said.
The concern was that an increased risk of the nose being pushed up at low airspeeds could cause the plane to get closer to the angle at which it stalls, or loses lift, Ludtke said. After weighing many possibilities, Ludtke said, Boeing decided to add a program to the aircraft’s flight control system to counter the destabilizing pitching forces from the new engines.
That program was MCAS.
MCAS, according to an engineer familiar with the matter, was written into the umbrella operating system that, among other things, keeps the plane in “trim,” or ensures that the nose is at the proper angle for the plane’s speed and trajectory. In effect, the system would automatically push the nose down if it sensed that the plane’s angle was creating the risk of a stall.
The FAA Sides With Boeing
Ultimately, the FAA determined that there were not enough differences between the 737 Max and the prior iteration to require pilots to go through simulator training. While the agency did require pilots to be given less onerous training or information on a variety of other changes between the two versions of the plane, MCAS was not among those items.
The bottom line was that there was no regulatory requirement for Boeing or its airline customers to flag the changes in the flight control system for its pilots — and Boeing contended that there was no need, since, in its view, the established emergency procedures would cover any problem regardless of whether it stemmed from the original system or the modification.
At least as far as pilots knew, MCAS did not exist, even though it would play a key role in controlling the plane under certain circumstances.
Boeing did not hide the modified system. It was documented in maintenance manuals for the plane, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737.
The Role of Pilots
Among the many unanswered questions raised by the crash is the degree to which Boeing and the FAA considered what would happen in the event that MCAS — or the sensors that fed the system information about the plane — were to malfunction.
In the Lion Air crash, one of the primary theories is that the system was receiving faulty data about the angle of the plane. At the heart of the debate is whether the pilots would have responded differently if they knew the plane’s nose was being forced down by MCAS.
Information from the flight data recorder shows that the plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If MCAS was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.
The standard checklist for dealing with that sort of emergency on the previous version of the 737 focuses on flipping two “stabilizer trim cutout” switches on the central console of the cockpit, then adjusting the stabilizers manually to keep the plane from pitching up or down.
Boeing has asserted the pilots on the next-to-last flight of the same Lion Air aircraft that crashed encountered a similar, if less severe, nose-down problem. They addressed it by flipping off the stabilizer cutout switches, in keeping with the emergency checklist. That flight, with different pilots from the flight that crashed, landed safely.
Older 737s had another way of addressing certain problems with the stabilizers: Pulling back on the yoke, or control column, would cut off electronic control of the stabilizers, allowing the pilots to control them manually.
That feature was disabled on the Max when MCAS was activated — another change pilots were unlikely to have been aware of. After the crash, Boeing told airlines that when MCAS is activated, as it appeared to have been on the Lion Air flight, pulling back on the control column will not stop stabilizer runaway.
The preliminary results of the investigation, based on information from the flight data recorder, suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included activating switches on the control yoke that control the angle of the stabilizers on the plane’s tail — and when that failed to stop the problem, pulling back on the yoke.
There is no indication that they tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could establish in more detail what culpability, if any, rests with the Lion Air pilots.
Boeing’s position that following the established emergency checklist should have been sufficient understates the complexity of responding to a crisis in real time, pilots said.
Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”
Still, Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”