Crash landing: what now for Boeing?
Two of its new 737 Max aircraft crash within months, leaving 346 dead. How can Boeing drag itself from the wreckage?
The sun was rising in a clear sky when Yared Getachew strapped himself into the captain’s seat aboard his Ethiopian Airlines jet on March 10. Brilliant, athletic and cheerful, the 29-year-old was a company star, the youngest ever captain at Ethiopian Airlines, Africa’s biggest airline. Raised in Nairobi, Getachew was looking forward to his imminent marriage. Before boarding Flight 302 in Addis Ababa’s Bole airport, he called Dr Rayan Shapi, his mother, in Kenya. “I’m coming to Nairobi. I’ve forgotten my phone, but we’ll talk when I get there,” he said.
In the right-hand seat as they briefed for the two-hour flight was Ahmednur Mohammed, 25, who had just trained for two years at the airline’s academy. While Getachew was a 10-year veteran with 8000 flying hours, Mohammed had turned late to flying after five years at architecture school. He was still an apprentice with a mere 361 hours and a commercial rather than airline pilot’s licence, but he was qualified to fly as first officer on the 737 Max 8, a new Boeing that Ethiopian had acquired in November. Behind them were six cabin crew and 149 passengers from 37 countries.
Everything looked normal as Getachew eased back the control column to lift the jet off the runway. But seconds after takeoff, the column jolted. The stick shaker, an alarm in the form of a vigorous vibration, was warning that the aircraft was close to an aerodynamic stall. Near the ground, few things are more dangerous for an aircraft than a stall — the sudden loss of lift when airflow over the wings is disrupted, typically when an aircraft’s “angle of attack” when climbing is too steep.
The crew started troubleshooting. The plane was climbing normally under near full power and the warning was coming only on the captain’s side, so an instrument anomaly would seem to explain it; the airspeed readings were also erratic. Barely a minute into the climb, Getachew told his co-pilot to report to air traffic control that they were having control problems. They switched off the autopilot to manually fly the aircraft and retracted the wing flaps. These actions sealed their fate.
Without any manual input from the pilots, the aircraft’s nose was pitching downwards. The electronics issued a ground proximity alert, barking, “Don’t sink!” The captain restored the climb by pulling back on the control column, but was resisted by a nose-down force caused by the stabiliser — the big flat tail surface — pivoting to “trim” the craft downwards. This rogue behaviour by the stabiliser was caused by the Manoeuvring Characteristics Augmentation System (MCAS), a new computer-commanded device Boeing had added to the 737 Max to counter stalls.
The pilots counteracted this with bursts of upward trim on the electric thumb switches on the control wheel that command the stabiliser. The plane was no longer climbing, but bucking up, then down, with the nose-down force winning.
The pair clearly understood what was going on. Only a few months earlier an Indonesian 737 Max had crashed into the Java Sea after just such a post-take-off sequence. Like 737 pilots everywhere, Getachew and Mohammed had been briefed on the remedy. Amid the din of cockpit alerts, Getachew ordered Mohammed to flick the two switches that cut electric power to the stabiliser. That stopped movement in the stabiliser.
The next part of the drill should have been to crank back the nose-up trim with wheels in the cockpit that are connected the old-fashioned way, with cables, to the stabiliser. Instead, the pilots tried to pitch upwards by pulling back together on their control columns, the normal up-down control that commands the elevator flap on the back of the stabiliser. This had little effect because the inert stabiliser was stuck in “nose-down” position. The puny elevator flap got nowhere against its force. Getachew called out to Mohammed three times, “Pull up!” In the meantime, the Boeing’s engines remained at near full power, pushing the plane ever faster and deepening their plight. At this stage, the passengers would have known that bad things were happening.
On Getachew’s command, Mohammed then apparently tried to turn the manual trim wheel, on the central console by the pilot’s knees. He reported that it was not working. The captain told him to ask air traffic control for guidance back to the airport. Then power was switched back on to the stabiliser system. This was against the drill, but we suppose the pilots were acting in desperation. The power reactivated their thumb switches and they managed two upward blips on the stabiliser, counteracting the rogue system. But it won the battle as they heaved together with all their might on their columns. Although the sticks were fully back to the stops, the monster on the tail just held the nose down.
The plane pitched down 40 degrees, dived and slammed into a field at 925km/h. The flight had lasted seven minutes, and never climbed more than 1800m from the ground. “You don’t see anything that indicates there are people who died there,” said Nadia Milleron, mother of one of the Americans on the plane, Samya Stumo, 24, when she visited the site days later. “The plane became one with the earth,” she said.
For Boeing and the aviation world, the demise ofFlight 302 was a shock. Great safety advances mean that few airliners drop out of the sky these days. In 2017, not a single jet airliner in passenger service had crashed. But it had now happened twice in almost five months — and to the same new-model Boeing 737.
The venerable US plane-maker, founded by William Boeing in Seattle in 1916, was already in trouble over Indonesia’s Lion Air flight 610, the 737 Max that crashed in October last year killing all 189 aboard. In the early hours of that Sunday morning in Seattle, the company’s manufacturing home, Boeing’s worst fears were confirmed. The two disasters looked the same. The Indonesian jet was known, from its flight recorders, to have crashed after its MCAS system caused rogue behaviour in the stabiliser. Anyone with a free flight-tracking app could see Getachew’s plane followed the same seesaw flight path.
Boeing CEO Dennis Muilenburg ordered his team onto the defensive. The 737 Max was a safe airliner and the company was working on making it even safer, he insisted. Even if the stabiliser misbehaved, a competent crew could handle the anomaly with standard procedures, the company stated. It had full confidence in its best-selling airliner.
Behind the Boeing defence lay a message: Max series jets were safely making more than 8500 flights a week; the two 737s had come to grief in the hands of sub-par pilots with third world airlines, it was implied. The idea that first-world pilots would have dealt with the issue as routine, as Boeing hinted, was endorsed by many pilots.
The furore was instant. Causes had yet to be officially assigned to the Indonesian crash, let alone the Ethiopian one, but according to popular consensus Boeing had built a flaw into its latest 737s. This had led to one crash before pilots even heard of the existence of the MCAS. The company had failed to fix it, another plane had crashed and 346 people were now dead. A day after the second crash China grounded all its 737 Max Boeings, then Europe followed. Boeing and the US regulator, the Federal Aviation Administration (FAA), followed suit after refusing for more than a day.
All 360 or so 737 Max jets around the world were now parked indefinitely. As Congress called for inquiries, it emerged that Washington prosecutors had been on Boeing’s case for months, investigating how it had rushed the 737 Max into the air in 2017, and its close ties with the FAA.
Emerging from retirement to lead the attack came Ralph Nader, the scourge of corporate America in the late 20th century who also happened to be victim Samya Stumo’s great-uncle. “The arrogance of your algorithms overpowering the pilots can move law enforcement to investigate potential personal criminal negligence,” Nader, 85, warned Boeing. Stumo’s family accused Boeing of disregard for life in its lawsuit against the company. “Blinded by its greed, Boeing haphazardly rushed the 737 Max 8 to market … and actively concealed the nature of the automated system defects,” they said. Boeing has denied it was rushed to market.
Contrary to the popular view, the Max tale is not about sophisticated flight automation. The 737 Max is a straightforward plane with systems that are a relic of its ’60s origin. Cables and pulleys connect the controls to the tail — unlike the electrics of Airbuses and more modern Boeings. Its flight computer has the power of a ’90s home desktop. Many pilots like all Boeings because the company has kept the stick and rudder controls under the hands and feet of the aviators. Autopilots and computerised flight directors fly Boeings most of the time, but in manual flight, which is used on takeoff and landing, there was no computer supervising the pilots — until the arrival of the 737 Max. Automation has made flying much safer, but it has also opened a new path to trouble. This is the shaky link between the machine and the human it is supposedly working for. Pilots joke that the words most often heard in the modern cockpit are: “What’s it doing now?”
Boeing engineers devised the MCAS to help pilots“in the background”, and only when flying by hand. The reason goes back to 2011, when Boeing was scrambling to catch up with the booming orders for a new efficient Airbus, the A320neo. The company dropped plans for a new airframe and decided it was quicker to again revamp the 737, a plane that first entered service in 1968.
The great size of the 737 Max’s two turbofan engines meant hanging them further forward under the wings. As a result, the plane’s nose pitches upwards under high power. The MCAS was designed to avoid the need for new pilot training to deal with that; it was supposed to intervene and nudge down the nose only if the angle of attack air sensors showed the plane nearing a stall. “They developed a fix, MCAS, but did not tell airline pilots about it,” said Chesley “Sully” Sullenberger, the US Airways captain who in 2009 glided his Airbus onto New York’s Hudson River with no loss of life. “In mitigating one risk, they seem to have created another, greater risk.”
For many 737 pilots, the transition to the Max series was supported by a 90-minute session on an iPad. Pilots working for various US airlines early last year began reporting to the authorities about the aircraft’s tendency to pitch its nose down under the influence of the stabiliser, according to files that emerged in March.
Lion Air Flight 610 took off from Jakarta to the town of Pangkal Pinang on October 29. The night before, the same plane had been saved from mishap by an off-duty pilot in the cockpit, who intervened when faulty angle of attack data caused the MCAS to push down the nose. The mechanics were supposed to fix the air flow sensors overnight, but the plane left again in an unairworthy condition, according to the Indonesian inquiry. The MCAS kicked in as soon as Captain Bhavye Suneja and his first officer got into the air. Bewildered by the downward force, they frantically leafed through a manual in search of a remedy. Unlike modern jets, the 737 still requires paper checklists. “They didn’t seem to know the trim was moving down,” said an investigator. “They thought only about airspeed and altitude.”
The crew lost their fight with the bucking airliner and it dived into the sea after 12 minutes in the air. The crash put Boeing in the dock and opened a debate across the flying world on whether the MCAS was lethally flawed or just tricky in the hands of incompetent pilots. One US Max captain called the flight manual “inadequate and almost criminally insufficient”. John Carr, a veteran British 737 pilot, said the system was “relatively benign once you understand it … but Boeing was remiss not to have explained it to flight crew”.
The FAA ordered a safety bulletin to alert operators to the existence of the MCAS and instruct pilots on how to cope with it, while Boeing promised a software update. The promised software fix was still in the works when the Ethiopian jet crashed, sparking an all-out crisis. The flight recorders from the Ethiopian jet revealed the same horror facing the pilots as on the Indonesian plane. They showed that the MCAS could defeat its human masters even when they were prepared for it. Dennis Tajer, a 737 captain and an official in the American Airlines pilots’ union, said of the MCAS: “Every time you make a gain, it makes a double gain back on you.” Boeing had “left the pilot with no ability to gain control of the aircraft if it went to the full limit”, he said.
Some experts argued the Ethiopian pilots erred by failing to reduce power and slow down the plane. This made manual recovery much harder. Others faulted the presence of a trainee co-pilot whose experience would barely have equipped him for an emergency. The initial accident report is out but the inquiry is far from a conclusion. And for the aviation world, the verdict is in: Boeing equipped the new 737 with a killer system that takes a hero-pilot to master it when it goes wrong.
In the aftermath, Boeing’s stonewall defence has crumbled. The US media has exposed a cosy relationship between Boeing and the FAA, and the way the agency outsourced airworthiness decisions to the company’s own personnel. On April 4, Boeing’s CEO finally acknowledged a degree of fault. “We at Boeing are sorry for the lives lost,” Muilenburg said. “All of us feel the immense gravity of these events.”
It was clear that in both crashes the MCAS had activated in response to false airflow data, Muilenburg said. “As pilots have told us, erroneous activation of the MCAS function can add to what is already a high workload environment. It’s our responsibility to eliminate this risk. We own it and we know how to do it.” At a press conference in late April he held the line, declining to take any more than partial blame for the two crashes and pointing to the actions of the two pilots who he said didn’t “completely” follow standard procedure.
The stakes are high for Boeing as it races to tame the MCAS and convince regulators to let it back into the air. Suspicious of the FAA, the European and Chinese authorities will no longer just sign off after the green light from the US agency. The loss of trust in the FAA may have opened a Pandora’s box, making it harder to win swift global certification for new aircraft, industry insiders say.
Boeing, still the world’s biggest plane-maker, is losing about $1 billion per month from delays to the delivery of the 5000 737 Max aircraft on order. (Virgin Australia announced it would defer taking delivery of its first 737 Max jets until 2021.) It also faces big bills from airlines with grounded jets and, barring new evidence exculpating the company, damages expected from US courts to families of the dead will exceed $1 billion, lawyers say. On top of that is a risk of even more costly punitive damages from class-action suits. The first was filed by shareholders in Chicago on April 9 claiming that Boeing had defrauded them by “effectively [putting] profitability and growth ahead of airplane safety and honesty”.
As a historic company whose name has long been a byword for quality, Boeing’s survival is not in question, according to the experts. Over a century, it has weathered other crises. Amid ever growing demand for air travel, Boeing and Airbus have strengthened their global duopoly, delivering 12,700 airliners in the past decade.
Aircraft makers are preparing for rocketing demand in the next decade. This has direct implications for the technical gremlin at the heart of the 737 Max disasters. Boeing estimates the world will need 635,000 new commercial pilots over the next 18 years. The shortage is already becoming serious. Fewer young people are entering the profession the old-fashioned way, climbing the ladder from small planes. Companies are increasingly recruiting men and women with no great yearning for wings and training them from scratch to fly big jets. The arrival of a generation of fast-trained pilots like Ahmednur Mohammed means making planes simpler to handle and not building into them traps like MCAS that require the skills of old “sky gods” to foil.
Although public fear of the 737 Max is running at fever pitch, many in the industry believe the hysteria will fade. And Boeing is fighting back, paying for adverts promising a new safer 737 Max at the top of Google searches that come up with critical articles. Striking a new contrite note, Muilenburg told an audience in Dallas last month: “These last few weeks have been the most heart-wrenching of my career.” He acknowledged the brand had been damaged but said Boeing would “do everything possible to earn and re-earn that trust and confidence” from the public.
Chesley “Sully” Sullenberger, the pilot’s pilot, summed up the Boeing lesson neatly: “The only way to really protect one’s brand or product is to protect the people who use it,” he wrote. “It is always better and cheaper to do it right instead of doing it wrong and trying to repair the damage after the fact, and when lives are lost, there is no way to repair the damage.”