By Lambert Strether of Corrente.
At some point in the future, I’d like to do failure matrix for the pathways to misfortune (example of such a matrix here) that precipitated two deadly Boeing 737 MAX crashes on take-off in five months, but I don’t feel that I have enough information yet. (I’m not unsympathathetic to the view that the wholesale 737 MAX grounding was premature on technical grounds, but then trade and even geopolitical factors enter in, given that Boeing is a “national champion.”) We do not yet have results from the cockpit voice and flight data recorders of either aircraft, for example. But what we do know is sufficiently disturbing — a criminal investigation into Boeing had already been initiated after the Lion Air crash, but before the Ethiopian Airlines crash — that I think it’s worthwhile doing a play-by-play on the causes of the crashes, so far as we can know them. About that criminal investigation:
According to the Wall Street Journal, a Washington D.C. grand jury issued a March 11 subpoena requesting emails, correspondence, and other messages from at least one person involved in the development of the aircraft.
“It’s a very, very serious investigation into basically,?” Arthur Rosenberg, an aviation attorney who is representing six families whose relatives died in the Ethiopian Airlines and Lion Air crashes, explained.
“Nobody knows the answer to that yet,” Rosenberg cautioned, adding that he had not yet seen the Justice Department’s subpoena and therefore could not know its full scope.
Rosenberg expects the criminal probe to question whether Boeing fully disclosed to the FAA the engineering of the 737 Max 8’s MCAS flight control system, called MCAS (Maneuvering Characteristics Augmentation System), during the plane’s certification process. The flight control system was designed to prevent the plane from stalling.
. While airline accidents have at times raised criminal issues, such as after the 1996 crash of a ValuJet plane in the Florida Everglades, such cases are the exception.
Before we get to the play-by-play, one more piece of background: CEO Dennis Muilenburg’s latest PR debacle, entitled “Letter from Boeing CEO Dennis Muilenburg to Airlines, Passengers and the Aviation Community.” The most salient material:
This overarching focus on safety spans and binds together our entire global aerospace industry and communities. We’re united with our airline customers, international regulators and government authorities in our efforts to support the most recent investigation, understand the facts of what happened and help prevent future tragedies. Based on facts from the Lion Air Flight 610 accident and emerging data as it becomes available from the Ethiopian Airlines Flight 302 accident, we’re taking actions to fully ensure the safety of the 737 MAX. We also understand and regret the challenges for our customers and the flying public caused by the fleet’s grounding.
Boeing has been in the business of aviation safety for more than 100 years, and we’ll continue providing the best products, training and support to our global airline customers and pilots. This is . Soon we’ll release a software update and related pilot training for the 737 MAX that will address concerns discovered in the aftermath of the Lion Air Flight 610 accident.
Fine words. Are they true? Can Boeing’s “commitment to everyone to ensure ” safe and reliable travel” really be said to be “absolute”? That’s a high bar. Let’s see!
I’ve taken the structure that follows from a tweetstorm by Trevor Sumner (apparently derived from a Facebook post by his brother-law, Dave Kammeyer). However, I’ve added topic headings, changed others, and helpfully numbered them all, so you can correct, enhance, or rearrange topics easily in comments (or even suggest new topics). Let me also caveat that this is an enormous amount of material, and time presses, so this will not be as rich in links as I would normally like it to be. Also note that the level of abstraction for each topic varies significantly: From “The Biosphere” all the way to “Pilot Training.” A proper failure matrix would sort that out.
(1) The Biosphere: The 737 MAX story begins with a customer requirement for increased fuel efficiency. This is, at bottom, a carbon issue (and hence a greenhouse gas issue, especially as the demand for air travel increases, especially in Asia). New biosphere-driven customer demands will continue to emerge as climate change increases and intensifies, and hence the continued 737 MAX-like debacles should be expected, all else being equal. From CAPA – Centre for Aviation:
The main expected impacts of climate change on aviation result from changes in temperature, precipitation (rain and snow), storm patterns, sea level and wind patterns. In addition, climate change is expected to lead to increased drought, impacts on the supply of water and energy, and changes in wildlife patterns and biodiversity. Consequences for aviation include reduced aircraft performance, changing demand patterns, potential damage to infrastructure, loss of capacity and schedule disruption.
All of these factors will affect aircraft design, manufacturing, maintenance, and use, stressing the system.
(2) Choice of Airframe: The Air Current describes the competitive environment that led Boeing to upgrade the 737 to the 737 MAX, instead of building a new plane:
Boeing wanted to replace the 737. The plan had even earned the endorsement of its now-retired chief executive. “We’re gonna do a new airplane,” Jim McNerney said in February of that same year. “We’re not done evaluating this whole situation yet, but our current bias is to not re-engine, is to move to an all-new airplane at the end of the decade.” History went in a different direction. Airbus, riding its same decades-long incremental strategy and chipping away at Boeing’s market supremacy, had made no secret of its plans to put new engines on the A320. But its own re-engined jet somehow managed to take Boeing by surprise. Airbus and American forced Boeing’s hand. .
Why? The earlier butchered launch of the 787:
Boeing justified the decision thusly: There were huge and excruciatingly painful near-term obstacles on its way to a new single-aisle airplane. In the summer of 2011, the 787 Dreamliner wasn’t yet done after billions invested and years of delays. More than 800 airplanes later here in 2019, each 787 costs less to build than sell, but it’s still running a $23 billion production cost deficit.…. The 737 Max was Boeing’s ticket to holding the line on its position — both market and financial — in the near term. Abandoning the 737 would’ve meant walking away from its golden goose that helped finance the astronomical costs of the 787 and the development of the 777X.
So, we might think of Boeing as a runner who’s tripped and fallen: The initial stumble, followed by loss of balance, was the 787; with the 737 MAX, Boeing hit the surface of the track.
(3) Aerodynamic Issues: The Air Current also describes the aerodynamic issues created by the decision to re-engine the 737:
Every airplane development is a series of compromises, but to deliver the 737 Max with its promised fuel efficiency, Boeing had to fit 12 gallons into a 10 gallon jug. Its bigger engines made for creative solutions as it found a way to mount the larger CFM International turbines under the notoriously low-slung jetliner. It lengthened the nose landing gear by eight inches, cleaned up the aerodynamics of the tail cone, added new winglets, fly-by-wire spoilers and big displays for the next generation of pilots. It pushed technology, as it had done time and time again with ever-increasing costs, to deliver a product that made its jets more-efficient and less-costly to fly.
In the case of the 737 Max, with its nose pointed high in the air, the larger engines — generating their own lift — nudged it even higher. The risk Boeing found through analysis and later flight testing was that under certain high-speed conditions both in wind-up turns and wings-level flight, that upward nudge created a greater risk of stalling. It’s now at the center of the Lion Air investigation and stalking the periphery of the Ethiopian crash.
(4) Systems Engineering: Amazingly, there is what in a less buttoned-down world that commercial aviation would be called a Boeing 737 fan site, which describes the MCAS system in more technical terms:
MCAS was introduced to counteract the pitch up effect of the LEAP-1B engines at high AoA [Angle of Attack]. The engines were both larger and relocated slightly up and forward from the previous NG CFM56-7 engines to accomodate their larger diameter. This new location and size of the nacelle causes it to produce lift at high AoA; as the nacelle is ahead of the CofG [Center of Gravity] this causes a pitch-up effect which could in turn further increase the AoA and send the aircraft closer towards the stall. MCAS was therefore introduced to give an automatic nose down stabilizer input during steep turns with elevated load factors (high AoA) and during flaps up flight at airspeeds approaching stall.
Unfortunately for Boeing and the passengers its crashed aircraft were carrying, the MCAS system was very poorly implemented. Reading between the lines (I’ve helpfully labeled the pain points):
Boeing have been working on a software modification to MCAS since the Lion Air accident. Unfortunately although originally due for release in January it has still not been released due to both engineering challenges and differences of opinion among some federal and company safety experts over how extensive the changes should be. Apparently there have been discussions about potentially adding [A] enhanced pilot training and possibly mandatory [B] cockpit alerts to the package. There also has been consideration of more-sweeping design changes that would prevent [C] faulty signals from a single sensor from touching off the automated stall-prevention system.
[A] Pilot training was originally not considered necessary, because MCAS was supposed to give 737 MAX the same flight characteristics as earlier 737s; that’s why pilots weren’t told about it. (This also kept the price low.) [B] Such alerts exist now, as part of an optional package, which Lion did not buy. [C] The single sensor was the result of regulatory capture, not to say gaming; see below.
(The MCAS system is currently the system fingered as the cause of both the Lion Air and Ethiopian crashes; we won’t know for sure until the forensics are complete. Here, however, is the scenario for an MCAS-induced crash:
Black box data retrieved after the Lion Air crash indicates that a single faulty sensor — a vane on the outside of the fuselage that measures the plane’s “angle of attack,” the angle between the airflow and the wing — triggered MCAS multiple times during the deadly flight, initiating a tug of war as the system repeatedly pushed the nose of the plane down and the pilots wrestled with the controls to pull it back up, before the final crash.
(5) Regulatory Capture: Commercial aircraft need to be certified by the FAA before launch. The Washington Post labels today’s process “self-certification”:
The FAA’s publication of pilot training requirements for the Max 8 in the fall of 2017 was among the final steps in a multiyear approval process carried out under the agency’s now 10-year-old policy of entrusting Boeing and other aviation manufacturers to certify that their own systems comply with U.S. air safety regulations.
In practice, , signing on behalf of the U.S. government that the technology complied with federal safety regulations, people familiar with the process said.
(Note that a 10-year-old process would have begun in the Obama administration, so the regulatory process is bipartisan.) I understand that “safety culture” is real and strong, but imagine the same role-playing concept applied to finance: One bankers plays the banker, and the other banker plays Bill Black, and after a time they switch roles…. Clearly a system that will work until it doesn’t. More:
The process was occurring during a period when the Transportation Department’s Office of Inspector General was warning the FAA that its oversight of manufacturers’ work was insufficient.
Four years after self-certification began, fires aboard Boeing’s 787 Dreamliner jets led to the grounding of the fleet and a wave of questions about whether self-certification had affected the FAA’s oversight.
Why “self-certification”? Investigative reporting from the Seattle Times — the article is worth reading in full — explains:
The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.
Alert readers will note the similarity to the Neoliberal Playbook, where government systems are sabotaged in order to privatize them, but in this case regulatory capture seems to have happened “by littles,” rather than out of open, ideological conviction (as with the UKs’s NHS, or our Post Office, our Veteran’s Administration, etc.).
(6) Transfer of Authority to Boeing: In the case of the 737 Max, regulatory capture was so great that certification authority was transferred to Boeing. In order to be certified, a “System Safety Analysis” for MCAS had to be performed. The Seattle Times:
The safety analysis:
- Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document.
- Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward.
- Assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed.
So who certified MCAS? Boeing self-certified it. Once again The Seattle Times:
Several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing….
“There wasn’t a complete and proper review of the documents,” the former engineer added. “Review was rushed to reach certain certification dates.”
(I’m skipping a lengthy discussion of even more technical detail for MCAS, which includes discrepancies between what Boeing self-certified, and what the FAA thought that it had certified, along with the MCAS system acting like a ratchet, so it didn’t reset itself, meaning that each time it kicked in, the nose was pitched down even lower. Yikes. Again, the article is worth reading in full; if you’ve ever done tech doc, you’ll want to scream and run.)
(7) Political Economy: This tweet is especially interesting, because even I know that Muddy Waters Research is a famous short seller:
This is a great example of real short-termism by a corporate. It’s clearly in $BA LT interest to have robust cert system, but those chickens come home to roost years later, allowing mgmt to meet ST expectations. BTW, semi-annual reporting would do NOTHING to fix this mentality. 4
— MuddyWatersResearch (@muddywatersre) March 18, 2019
And here we are! There are a myriad of other details, but many of them will only prove out once the black boxes are examined and the forensics are complete.
It should be clear at this point that the central claims of Muilenburg’s letter are false. I understand that commercial aviation is a business, but if that is so, then Muilenburg’s claim that Boeing’s commitment to safety is “absolute” cannot possibly be true; indeed, the choice to re-engine the 737 had nothing to do with safety. Self-certification makes Boeing “a judge in its own cause,” and that clearly contradicts Muilenburg’s absurd claim that “safety” — as opposed to profit — “is at the core of who we are.” The self-certification debacle that allowed MCAS to be released happened on Muilenburg’s watch and is already causing Boeing immense reputational damage, and a criminal case, not to mention the civil cases that are surely coming, will only increase that damage. Mr. Market, the Beltway, and even Trump, if his trade deals are affected, will all soon be bellowing for a sacrificial victim. Muilenburg should recognize the inevitable and gracefully resign. Given his letter, it looks unlikely that he will do the right thing.