Flying Blind: The 737 MAX Tragedy and the Fall of Boeing

by Peter Robison

The Boeing deputy who’d vetted the software design had categorized the risk of a failure as relatively minor. But the documents on file reflected the software’s earlier design (Revision C), not the more powerful version later added in flight tests (Revision E). They showed the stabilizer had the capacity to adjust a plane’s ascent or descent by only 0.6 degrees—in its final form, it had been given the authority to make adjustments at four times that angle. “When they changed the design it drastically changed the potential criticality of the MCAS featu...

Boeing’s Safety Review Board, a formal gathering of engineers and pilots to go over recent safety incidents, discussed the Lion Air crash in early November. Among themselves, they had quickly acknowledged some of the software’s flaws. Their expectation that a pilot could safely untangle the chaos of confusing alerts and intervene to turn off the stabilizer had been challenged.

The empathy that Boeing’s aviators might have had for a pilot who looked like them wasn’t being extended to Suneja and Harvino.

The FAA went along with the recommendation on November 7, issuing an emergency airworthiness directive “prompted by analysis performed by the manufacturer.” The bulletin told pilots and airlines that if an erroneous input is received from the angle-of-attack sensor, “there is a potential for repeated nose-down trim commands of the horizontal stabilizer” and, in the anodyne language of aviation, “possible impact with terrain.” It still made no mention of the MCAS software responsible for the malfunction.

In plain language, the directive was saying that Boeing’s brand-new airplane, supposedly a marvel of modern technology, could crash itself into the ground based on bad data from one tiny sensor. It sounded like the kind of single-point failure commercial aircraft weren’t supposed to have.

“If it ain’t Boeing I ain’t going,” pilots would say, proud of the fact that a computer would never take the plane out of their hands. Now the colossus of American aviation was casually telling them it had done exactly that.

MCAS had been shoehorned into the controls to address a quirk of physical design, and reacting to the new software asked a lot of pilots. They would have to notice, within seconds, the stabilizer running away, then start working the right checklist with robotic efficiency.

What’s more, if MCAS fired and the pilots simply tried to pull back on the control column to push the nose back up—the natural instinct—it wouldn’t respond. The software had been given the authority, not them.

Adding MCAS to the flight controls also led to a change in the switches under their thumbs, and few of the MAX’s early pilots were even aware of it.

Pilots that November began registering their concerns in the anonymous Aviation Safety Reporting System maintained by NASA. “I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models,” one wrote. “The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone—even if the pilots aren’t sure what those systems are, what redundancies are in place, and failure modes. I am left to wonder: what else don’t I know?” Another captain called the MAX flight manual “inadequate and almost criminally insufficient.”

“Well, Maria, I think it’s important that we all express our sympathies for the loss of Lion Air 610 and certainly our thoughts go to the families affected,” he said. “We’ve been very engaged with the investigative authorities throughout,” he continued, finally concluding, “The bottom line here is the 737 MAX is safe. Safety is a core value for us at Boeing.”

She asked what happened, and he essentially blamed the pilots. The airplane “has the ability to handle” a bad sensor like the one suspected in the Indonesian crash, he said. Boeing, he stressed, had already issued a bulletin pointing pilots to “existing flight procedures.” Over footage of rescue boats picking wreckage out of the water, Bartiromo asked him if he regretted not telling pilots more about the system. “No, again, we provide all the information that’s needed to safely fly our airplanes,”

MCAS, of course, wasn’t in the manual—not unless you counted the glossary, which defined the term but didn’t explain what it did.

The pilot unions, he told Duberstein, just wanted to stir up doubt so that the MAX might be classified as a new airplane type requiring “more pay” to fly.

Now the girls were crying for hours at a time. That same day, Rini got a call from a notary who invited her to an office on the third floor of the hotel to sign some documents. The notary was there along with two officials from Lion Air, and they showed her a release form that she’d need to sign to claim 1.3 billion rupiah, or $91,600. “I was not in a state to sign anything,” Rini said. A petroleum engineer who also happened to be fluent in English, she scanned an appendix that listed eight pages of companies grouped into two columns, more than four hundred names in all—including Boeing, Lion Air, and a who’s who of the world’s major aerospace suppliers. All were to be released from liability in any global court in exchange for the money. She asked if she could take the document home and study it; they told her it couldn’t leave the room. Rini left without signing it. That evening, someone from the forensics lab called to say her sister’s remains had been identified.

He soon began hearing about loosely identified, official-looking people milling around the crisis center talking to families. Relatives had the impression they worked for the airline, or maybe the government. Some of them, he would learn, were actually local lawyers working on behalf of the insurer for both Boeing and Lion Air, and they were trying to convince family members to sign forms like the one Rini saw.

Indrajana, raised in Indonesia, saw it as a cynical and ultimately racist deception that would never have happened after a crash on U.S. soil.

Crucially for the victims in Indonesia, Global Aerospace was the lead insurer for both Boeing and Lion Air.

There was a standard procedure for crashes like this one, and the insurer executed it. The people working on its behalf in the crisis center helped convince the families of as many as seventy of the victims to sign the settlement offer. Even by Indonesian standards, the amount was a pittance when considered as compensation for the wrongful death of a loved one—not even four times the average annual wage of $25,000.

“We wanted the psychological pressure to stop,” Dedi Sukendar, a relative of one of the victims who signed the release in order for the dead man’s two children to stay in school, later told the New York Times.

The settlement also listed Global Aerospace among the hundreds of companies that, in return for the money, were to be released from liability. Left unexplained was that the amount was almost exactly what a 2011 Indonesian law already mandated a responsible party pay for loss of life in an aviation accident, or that the amount was supposed to be a minimum, without limiting relatives’ right to sue.

“The underbelly of aviation is the disenfranchisement of people of color globally—they’re being treated like absolute pawns,” Singh said.

“It’s the same mistakes, the same arrogance, the same notion that they could just push things through on their timeline, their agenda, and they could just finesse the process,” Singh said.

“You may have seen media reports that we intentionally withheld information about airplane functionality,” he said. “That’s simply untrue.

Back in Seattle, he joined a half dozen fellow Boeing trainers for a briefing about how the MCAS software worked from Patrik Gustavsson, the former Ryanair pilot who had traded frustrated messages with Forkner two years earlier. Gustavsson was now the chief 737 technical pilot. When Gustavsson told them the software fired based on a single angle-of-attack vane and that it would continue firing even after a bad reading, “we were universally shocked,” this person said. The group consisted of trainers who’d been left “out of the loop,” as Gustavsson himself had put it. They instantly recognized the flaw in its design. “The pilot’s fighting the jet the entire time,” as one person there put it.

To these pilots, the stakes were immediately clear. The situation was life-threatening.

Dan Carey, president of the union, had agreed with staffers beforehand that if what they heard sounded insincere, he’d record the conversation. The Boeing executives had only been talking for a few minutes when Carey discreetly turned his phone’s recorder on (legal in Texas, where only one party’s consent is required).

“It’s just a little bit of software,” he went on.

“the function and the trained pilot work side by side and are part of the system”—an assertion that brought the first of several challenges from a pilot with a West Texas drawl. “I’m sorry, did you say trained pilot?” interrupted American captain Michael Michaelis,

Michaelis fumed about the fact that, from the accounts he’d read, the software had kept whacking the nose of the plane down. “You’re touching my stick, you know?”

“Somebody at the corporate level made the decision that this isn’t important to brief our pilots on,”

“You’ve got to understand that our commitment to safety is as great as yours,” he said. “It really is.

Boeing put out its own statement, which highlighted the maintenance mistakes as the beginning of the chain of errors.

He went public, too, telling reporters that the shifting of the blame toward Lion was “without any ethics” and that he planned to cancel the airline’s further orders.

Fifteen crashes would be comparable to the number for the Boeing 757, 767, 777, 787, and the newest 747s over the previous three decades combined.

Still the MAX kept flying. That “six weeks–ish” stretched into months.

Their flight was uneventful, but the improvising showed what little faith some of the most knowledgeable pilots had in what Boeing was telling them about a dangerous flaw in its most important product.

Boeing’s engineers were still working on Sinnett’s promised update to the software.

Meanwhile, flights of the 737 MAX continued, and Boeing’s assembly lines strained to get more of them to airlines.

Even if the software update had been finished, the FAA wouldn’t have had the staff in place to review it. Most of that month, federal workers were on furlough as part of the longest government shutdown in U.S. history.

By the FAA’s own analysis, the risk posed by the MAX was immense. A crash might happen every two to three years. There still wasn’t any serious consideration given to grounding the planes, according to agency specialists informed of the discussions. The reason was clear enough: This wasn’t something as important as a battery fire at Logan, on American soil. It was an accident in Indonesia. No Americans were killed. The pilots were foreign. It had vanished from the headlines.

ten seconds before the plane potentially became uncontrollable.

Boeing and FAA officials assured them that the Lion Air accident wasn’t worth their scrutiny.

Rick Larsen, head of the aviation subcommittee. He called the crash a “one off” caused by poor pilot performance.

Muilenburg pushed to increase the MAX’s production rate to fifty-seven planes a month from fifty-two. His board of directors never challenged him on any of the multiple red flags since the Lion Air crash.

The Boeing board posts had become lucrative

The board rewarded Muilenburg in turn. Two months after the Lion Air crash, it had awarded him the highest pay of his tenure: $31 million, including a $13 million bonus for performance.

In a simulator, the Ethiopian Air pilots probably wouldn’t have needed more than a couple of tries to crack this particular non-normal situation.

But the pilots hadn’t had the luxury of MAX simulator training.

This time the plane had killed its occupants in six minutes, half the time in which the MCAS software had brought down the Lion Air plane.