BIG READ: Boeing built an unsafe plane, and blamed the pilots when it crashed

Seattle — As passengers filed in behind them and stowed their bags that morning in Jakarta in October 2018, the Lion Air pilots completed their preflight checks amid the modern comforts of the Boeing 737 Max 8.

Compared to the earlier 737, which both had flown extensively, the cabin was blissfully quiet, even during the five minutes it took for the big new engines to start up. Four large colour screens arrayed in front of them made altitude and speed readouts easier to see — nothing like the old analogue dials that Boeing designers once called the “steam gauges”.

Bhavye Suneja, the captain, told his co-pilot, who went by the single name Harvino, that he was feeling ill, but in better health he was a sunny, life-of-the-party kind of guy. Suneja was passionate about machines; after this run he planned to fly home to New Delhi, then drive through the highlands near Nepal the next week with his wife of two years, Garima Sethi.

After flight school in California, Suneja had joined Lion Air in 2011, the same year the airline placed what was then the biggest single order in Boeing’s history, a $22bn Max purchase that co-founder Rusdi Kirana sealed with a handshake from US president Barack Obama.

At the Jakarta airport that morning, Paul Ayorbaba, 43, sent his family a choppy WhatsApp video of his walk down the jetway and onto the Lion Air Max jet, painted a cheery orange and white. In the minutes before the door closed, 22-year-old Deryl Fida Febrianto, a newlywed of two weeks, texted a selfie to his bride as he departed for a job on a cruise ship. Wahyu Aldilla sat with his son, Xherdan Fahrezi, with whom he’d gone to Jakarta for a football match.

It was 6.20am when Lion Air 610 left the runway for a short hop to an island off Sumatra. Neither Suneja nor Harvino knew that a tiny sensor on the left side of the plane called an angle-of-attack vane had a 21-degree misalignment in its delicate innards — an oversight by the mechanics who had inspected it.

The nose gear had barely left the ground when Suneja’s control column began shaking, the cue for a potential stall. Alerts signalling faulty altitude and airspeed readings blinked on.

Lion Air’s short history had included its share of turbulence, but on balance it was one of remarkable ascent. The company’s charismatic co-founder, Kirana, had started out as a distributor of Brother typewriters before opening a travel agency in Jakarta with his brother in the 1990s.

In the early days, he would hold up a name board at Soekarno-Hatta International Airport to pick up arriving passengers. Kirana and his brother eventually cobbled together $900,000 and leased an old 737-200 as well as a woeful Soviet-made competitor, the Yakovlev Yak-42. Lion Air began flying in 2000.

By 2015, with Asia’s powerhouse economies producing newly mobile middle-class travellers, Kirana was a billionaire. His airline controlled half the domestic market in Indonesia, a nation of 250-million people living on 17,000 islands stretching 4,800km from east to west.

At Boeing, Dennis Muilenburg, the buzz-cut Iowa native who became CEO that year, saw untapped markets like Indonesia and talked about how the aerospace industry had reached some kind of cycle-busting new normal.

Boeing had been a giant of American aviation for a century, but a financial reinvention under Muilenburg turned it into something else — a Wall Street darling. In 2017 it had reported a 67% jump in earnings, to $8.2bn. Boeing’s share price had almost tripled during Muilenburg’s short tenure, reaching more than $386, and his CFO, Greg Smith, told colleagues in one meeting that it could top $800 or $900 if the company kept doing what had made shareholders happy: raising the dividend, buying back shares, and keeping expenses low.

That’s precisely what some people at Boeing feared, according to hundreds of hours of interviews with current and former employees for the book from which this article is adapted, Flying Blind: The 737 Max Tragedy and the Fall of Boeing. Among themselves, they complained about how a company that had once been ruled by engineers who thumbed their noses at Wall Street now celebrated managers for cost-cutting, co-opted regulators, and pressured suppliers with relentless, Walmart-style tactics to cut their prices.

The Max, first delivered in 2017, fit right into this mindset. In emails later handed over to congressional investigators, a Boeing pilot boasted of using “Jedi mind tricks” to convince airlines and regulators there was no need for pilots who’d flown the previous version of the 737 (like Suneja and Harvino) to undergo expensive simulator training on the Max. For airlines, training is a big part of labour costs. Minimising the expense gave Boeing’s customers one less reason to defect to its European rival, Airbus SE.

Other evidence showed that Boeing pushed for cost reductions in testing and ignored engineers’ entreaties for more sophisticated flight controls. An employee despairing of foul-ups wrote: “This aeroplane is designed by clowns, who in turn are supervised by monkeys.” The company even turned down a request from Lion Air itself for additional training. “Idiots,” a Boeing pilot grumbled to a colleague about Lion Air.

As the control column shook violently, Harvino, the co-pilot, asked the captain if he planned to turn the plane around. Suneja, his voice strong despite his illness, told Harvino to get clearance to a holding point to buy some time.

“Flight control problem,” Harvino radioed. As Suneja steered towards the new heading, the nose mysteriously dipped. He squeezed a thumb switch on the control column to push it back up. It did, but then the nose dipped again. For eight minutes, the tug of war continued. The blue expanse of Jakarta Bay filled the windows.

Harvino flipped through Boeing’s 737 Quick Reference Handbook, searching pages of emergency checklists for an answer. Airspeed Unreliable. Dual Bleed. Pack Trip Off. Wing-Body Overheat. Nothing seemed to explain the ghost fighting them for control of the plane. Twenty-one times Suneja pressed the switch to keep the nose pointing up.

The plane was cleared for 27,000 feet but had reached less than 6,000. The passengers felt every sickening undulation in their stomachs. Harvino finally got on the phone to ask a flight attendant to send in a Lion Air engineer, who happened to be aboard, to help figure out the problem. The chimes of the intercom sounded as she called him forward.

Suneja, preparing to brief his colleague and probably wanting a look at the handbook himself, told his co-pilot to take over the controls. The nose dipped again.

“Wah, it’s very ...” Harvino muttered. He flicked the thumb switch but not as firmly as the captain had. After a few seconds the nose fell again, and again he hit the switch. The jet tilted towards the water. Harvino exclaimed that the plane was pointing down. Suneja, distracted, answered, “It’s OK.”

Ten seconds later they were plummeting at 10,000 feet a minute. Harvino pulled desperately on the control column, alarms blaring. (“Sink rate!” warned an automated voice.) The water was now immense and terrifying. Harvino began repeating “Allahu akbar, Allahu akbar” — the Muslim expression of faith” — and the robotic voice intoned, “Terrain, terrain.” Suneja was silent.

At 6.32am, the ghost won. Horrified fishermen on a nearby boat watched as the jet, carrying 189 people, hit the sea at an almost vertical angle at 800km/h. Television stations soon began broadcasting images of floating debris and interviewing the victims’ stunned relatives.

“I’m sure Dad could swim his way out,” said Nanda Ayorbaba, the 13-year-old daughter of the man who only hours before had sent the choppy video.

Soon the Indonesia Divers Rescue Team was in the water, retrieving cellphones, ID cards, bags, and photos. Winches started pulling up larger pieces of debris, and the divers began hunting for the flight data recorder and cockpit voice recorder.

Within hours of the crash, John Hamilton, vice-president for engineering at Boeing Commercial Airplanes, convened pilots and flight controls experts in Seattle to discuss what had gone wrong. It wasn’t a long discussion, as Hamilton described it later to congressional investigators.

Automated software known as the manoeuvring Characteristics Augmentation System, or MCAS, had deflected the horizontal stabiliser, the tiny wing at the back of the plane, in response to a faulty reading from the misaligned sensor.

“We quickly identified that this MCAS activation could have been a scenario,” Hamilton said. “And, once the flight data recorder came up later in the week ... we started working on a software change immediately.”

With its spotty safety record, Lion Air took most of the heat for the crash. For almost a decade, until June 2016, the airline had been banned from EU airspace, along with most other Indonesian airlines, because of concerns about maintenance and training practices in the country. A Lion Air flight overshot a runway at Adisumarmo International Airport in Central Java in 2004, killing 25 people. Another undershot a runway in Bali in 2013 and landed in the water, splitting the fuselage; miraculously, all 108 aboard survived.

At Federal Aviation Administration (FAA) offices near Seattle, engineers began scouring their files for information about the software in question and discovered what looked like incomplete and inaccurate work by the Boeing employees entrusted to oversee safety matters as the FAA’s authorised representatives.

The voluminous system safety assessment for MCAS had been turned over to the agency just four months before the plane was officially certified. The Boeing deputy who’d vetted the software design had categorised the risk of a failure as relatively minor.

But the documents on file reflected the software’s earlier design (Revision C), not the more powerful version later added in flight tests (Revision E). The documents showed the stabiliser had the capacity to adjust a plane’s ascent or descent by 0.6 degrees, but in its final form, the stabiliser could make adjustments at four times that angle.

“When they changed the design it drastically changed the potential criticality of the MCAS feature,” says an FAA engineer, who asked not to be identified because he isn’t authorised to speak publicly. “And that was not communicated to the FAA engineers who find compliance [with regulations]. In fact, they didn’t even know about it.”

Boeing’s Safety Review Board, a formal gathering of engineers and pilots, discussed the Lion Air crash in early November. Among themselves, board members had earlier acknowledged some of the software’s flaws. But they’d expected that pilots would safely respond to a misfire of the software. Now they questioned their own assumptions.

Within the fraternity of engineers and pilots, there’s an omertà, and it applied here. Partly this is for self-protection: if someone writes openly about a flaw, it exposes the manufacturer to additional liability for having known about the issues in advance.

In the wrangling over a Boeing rudder design blamed for two crashes in the 1990s, plaintiffs’ lawyers had eventually turned up a memo stating “we have a problem,” in which engineers acknowledged — even before a second crash — that a rudder valve had the potential to jam. Some at Boeing had seen the anguish it caused colleagues who were asked to explain themselves years later, and they became more careful about what they put in writing.

There was another reason for the reluctance to admit that the design had fallen short — one involving race and nationality, not cost. The empathy Boeing’s aviators might have had for a pilot who looked like them wasn’t being extended to Suneja and Harvino. Conversations at Boeing kept focusing on how Harvino, once he took over the controls, hadn’t been able to trim the plane with the thumb switch.

Boeing’s pilots, predominantly older white men, had long shared private jokes about the incompetent crews they ran into overseas. “Too dumb to spell 737”, went a frequent refrain of one pilot, according to someone who heard it. Another trainer would ask rhetorically if “Chung Fo Ho” could handle a given procedure.

The Safety Review Board concluded that Boeing should issue an alert directing pilots experiencing an MCAS problem to a specific checklist in the Quick Reference Handbook — in this case, the one for arresting a runaway stabiliser. The FAA went along with the recommendation on November 7, issuing an emergency airworthiness directive “prompted by analysis performed by the manufacturer”.

The bulletin told pilots and airlines that if an erroneous input is received from the angle-of-attack sensor, “there is a potential for repeated nose-down trim commands of the horizontal stabiliser” and, in the anodyne language of aviation, “possible impact with terrain”. It still made no mention of the MCAS software responsible for the malfunction.

In plain language, the directive was saying that Boeing’s brand-new aeroplane, supposedly a marvel of modern technology, could crash itself into the ground based on bad data from one tiny sensor. It sounded like the kind of single-point failure commercial aircraft weren’t supposed to have.

What most alarmed pilots was that this new feature overturned decades of Boeing design philosophy, the thing the manufacturer had always claimed set it apart from chief rival Airbus. “If it ain’t Boeing I ain’t going,” pilots would say, proud that a computer would never take the plane out of their hands. Now the colossus of American aviation was casually telling them it had done exactly that.

On November 13, Muilenburg, in a gray suit with a crisp white shirt and a purple tie, went on Fox Business to respond to the concerns. “New questions this morning for Boeing,” intoned host Maria Bartiromo. Muilenburg immediately launched into the first point of his mental script.

“Well, Maria, I think it’s important that we all express our sympathies for the loss of Lion Air 610, and certainly our thoughts go to the families affected,” he said. “We’ve been very engaged with the investigative authorities throughout,” he continued. In conclusion, he said, “The bottom line here is the 737 Max is safe. Safety is a core value for us at Boeing.”

Bartiromo asked what happened, and Muilenburg essentially blamed the pilots. The aeroplane “has the ability to handle” a bad sensor like the one suspected in the Indonesian crash, he said; in fact, Boeing had already issued a bulletin pointing pilots to “existing flight procedures”.

Over footage of rescue boats picking wreckage out of the water, Bartiromo asked if he regretted not telling pilots more about the system. “No, again, we provide all the information that’s needed to safely fly our aeroplanes,” he answered.

Bartiromo pressed: but was that information available to the pilots? “Yeah, that’s part of the training manual, it’s an existing procedure,” Muilenburg said.

“Oh, I see,” she said. But in fact, MCAS wasn’t in the manual, unless you counted the glossary, which defined the term but didn’t explain what the software did. The definition was likely a vestige of an earlier draft, before Boeing persuaded the FAA to delete a fuller description.

In a memo to employees on November 19, Muilenburg reassured them: “We’re going to learn from this accident and continue to improve our safety record.”

Some pilots weren’t so willing to let the matter drop. In Shanghai that fall, a couple of Boeing trainers ran into a pilot from American Airlines, who laid into them for “the lives that we cost” in Indonesia, as one of the trainers later described the uncomfortable encounter. “Hey, hold on,” one of the Boeing employees responded, cautioning the pilot to wait for more evidence.

Back in Seattle, the trainer joined a half-dozen colleagues for a briefing from Patrik Gustavsson, the chief 737 technical pilot, about how the MCAS software worked. When Gustavsson told them it fired based on a single angle-of-attack vane and that it would continue firing even after a bad reading, “we were universally shocked” says the trainer, who asked to remain anonymous discussing a private conversation. They instantly recognised the flaw in the design. “The pilot’s fighting the jet the entire time,” the trainer says.

Boeing sent a vice-president named Mike Sinnett and chief test pilot Craig Bomben to clear the air with pilots from major US customers. On November 27 the two men visited the American Airlines pilots’ union in Fort Worth. Dan Carey, president of the union, had agreed with staff beforehand that if what they heard sounded insincere, he’d record the conversation. The Boeing executives had been talking for only a few minutes when Carey discreetly turned on his phone’s recorder.

Sinnett has a mellow, almost stultifying voice, and as the recording started he was saying: “One of the things that we see in the press is that Boeing put a system on the aeroplane and didn’t tell anybody about it.” This was false, he said. “It’s just a little bit of software.”

Failures like the one in Indonesia were fully accounted for in the design and certification, Sinnett explained. And it was wrong for the press to call it a “single-point failure”, because “the function and the trained pilot work side by side and are part of the system”. The assertion brought the first of several challenges from a pilot with a rancher’s drawl. “I’m sorry, did you say trained pilot?” interrupted captain Michael Michaelis, who’d gone by the call sign “Taz” as an F-16 pilot in the US Air Force.

“Yes, yes,” Sinnett said. He tried to continue his presentation, but Michaelis and other pilots jumped in again. There was the obvious fact that Boeing hadn’t trained the pilots on MCAS. “These guys didn’t even know the damn system was on the aeroplane,” Michaelis said. And if it malfunctioned, the pilots said, it would be hard for a pilot in the heat of the moment to diagnose the problem amid all the conflicting alerts.

The plane was still new to the pilots, and few had flown it much or done little more than cursory training on an iPad. Michaelis fumed that, from the accounts he’d read, the software had kept whacking the nose of the plane down: “You’re touching my stick, you know?” Boeing “would’ve had a real shitstorm”, he continued, if the same failure had happened on a Max flight out of Miami and American had dropped a plane into Biscayne Bay. “Somebody at the corporate level made the decision that this isn’t important to brief our pilots on,” he said.

Sinnett responded that Boeing was working hard on an MCAS update to tame the system. “Not a year, but a couple — maybe six weeks-ish,” he said.

Still the Max kept flying. That “six weeks-ish” stretched into months — until a spring morning in Ethiopia, when the ghost appeared in the controls of another Max plane, this one carrying 157 people.

From Flying Blind: The 737 Max Tragedy and the Fall of Boeing, by Peter Robison, to be published on November 30 by Doubleday. Copyright 2021 by Peter Robison.

Bloomberg News. More stories like this are available on bloomberg.com