Pushing It to the Max Boeing's Crashes Expose Systemic Failings

Grounded 737 Max jets at Boeing Field in Seattle
Lindsey Wasson/ REUTERS

Grounded 737 Max jets at Boeing Field in Seattle

Part 3: How Did the 737 Max Get Approved in the First Place?


As has always been the case with large scandals, it is difficult to pinpoint the beginning. But there are plenty of reasons for identifying the year 2008 as the start of the 737 Max crisis, when Lufthansa made an announcement at the Farnborough Airshow that it planned to buy 30 Bombardier CS100s for its subsidiary Swiss. The jets, which are a bit smaller than the A320 and the Boeing 737, were a completely new model and, according to a former senior Lufthansa executive, that model was "the best on the market at the time." The deal came as a provocation to the management of Airbus and Boeing, spoiled as they had been by success, and they reacted. But Airbus reacted more quickly and rapidly developed the A320neo.

The Dec. 1, 2010 announcement by the Europeans that the entire A320 family would be re-engineered and outfitted with new, unusually fuel-efficient and quiet engines must have hit Boeing's Chicago headquarters like a bolt of lightning. Airbus promised to sink kerosene consumption by an entire 15 percent. And the year after the announcement, Airbus promptly sold more than 1,000 A320neo planes -- with many longtime Boeing customers among the purchasers.

At the time, Boeing had no fully developed plan for a new model or an acceptable new version of the 737. Most importantly, the company was not in a position to be able to install the new generation of jet engines on its planes. So, the industry was quite surprised when Boeing, just nine months later, appeared to catch up to Airbus. In late August 2011, the construction of the 737 Max was announced, and the company even promised that the plane could be operated 7 percent more cheaply than the A320neo.

It seems safe to assume that it was a difficult period for Boeing engineers. Even the smaller CFM56 turbines could only be crammed under the wings of the old 737 by resorting to a handful of tricks. But the CFM LEAP, which Airbus intended to use, has an air intake that is almost two meters in diameter -- and the Boeing engineers had to fit them onto a plane where they didn't fit at all.

Once again, they tried to compress the engine shape. And once again, they commissioned a customized, smaller version of the engine. They tried pretty much everything to create more space under the plane, even lengthening the landing gear by 20 centimeters. The most important change, though, was installing the turbines a bit higher on the wings and quite a bit further forward.

String-and-Chewing Gum Tricks

A former Lufthansa executive, himself a trained aerospace engineer who has decades of experience in reading technical evaluations of aircraft, is convinced that courts could very well determine that the actions taken by the Boeing engineers amount to "gross negligence." The ex-Lufthansa manager, who has to remain anonymous due to old contractual agreements, says he is convinced that the construction of the 737 Max on the whole is "amateurish." It is, he says, the culmination of the technical shortfalls that Boeing has essentially been seeking to eliminate since the mid-1990s.

The repositioning of the engines decisively changed the 737 Max's flight mechanics relative to all of its predecessors. In extreme flight situations with an especially steep angle of attack (the plane's position relative to airflow), the turbine cowlings with their flat bottoms create their own aerodynamic lift, not unlike an additional wing. That can lead to the sudden rise of the plane's nose, making a stall more likely. Should that happen, the plane loses lift and crashes.

To prevent such a scenario, the Boeing engineers reached deep into their bag of tricks. They knew that such an in-flight behavior was expressly prohibited by FAA regulations, so to ensure approval of the 737 Max, they needed a bit of electronic help. Boeing developed a software program that constantly monitored the angle of attack. As soon as this angle became too risky, the Maneuvering Characteristics Augmentation System (MCAS) would automatically lower the plane's nose without the pilot having to do anything at all. To do so, it doesn't manipulate the rudder, but the horizontal stabilizer trim, the most forceful control surface on the entire aircraft.

It was only by way of such string-and-chewing-gum tricks that engineers were able to achieve the stability necessary for safe flight. The FAA was informed of the system early on and accepted it. In hindsight, it is an open question whether they were really aware of all the details of the new software solution. When Boeing first presented the MCAS system to the FAA, the program only activated reluctantly and adjusted the horizontal stabilizer trim by just 0.6 degrees. Later, though, during the development process, Boeing gave the program much more leeway and increased its control over the plane, allowing it to make changes of up to 2.5 degrees. According to information currently available, it looks as though the FAA never approved this much riskier system.

Because of the several inconsistencies, the former Lufthansa executive believes the company could be facing the retroactive loss of its insurance coverage for the 737 Max. In a statement about the allegations, Boeing wrote: "The FAA considered the final configuration and operating parameters of MCAS during Max certification and concluded that it met all certification and regulatory requirements."

Significant Errors

Yet there are still more significant errors that are currently under discussion and investigation. For many experts, for example, it is incomprehensible that with the 737 Max, Boeing appears to have ignored the vitally important principle of redundancy. A fundamental rule of aeronautics has long held that every system in an aircraft must have a backup so that any system failure that might occur can be compensated for. For example, the Boeing 737 Max has two angle of attack (AoA) sensors mounted on the outside of the plane just under the right and left cockpit windows. The data collected by the two sensors is fed into the Flight Management System, which monitors the plane's flight.

But for reasons that have not yet been pinpointed, the MCAS software only uses the information delivered by a single AoA sensor. Should it be damaged -- by a collision with a bird, for example -- MCAS could be activated in error. With no pilot input whatsoever, without the pilot even knowing that the system as even been activated, MCAS will automatically adjust the horizontal stabilizer. For 9.26 seconds, the system will enact Aircraft Nose Down commands before a five second pause and then a repeat of the maneuver -- over and over again until the system calculates that the angle of attack has been corrected. If the pilot intervenes to pull on the yoke and raise the plane's nose, nothing happens. By doing so, in fact, pilots run the risk of the automatic anti-stall system countering their efforts even more energetically because the false data it has been fed leads the system to believe that danger is imminent.

One of two sensors that measures the angle of attack is pictured at bottom on a Boeing 737 MAX 8 airplane outside the company's factory: Boeing appears to have ignored the vital rule of redundancy.
Stephen Brashear / Getty Images / AFP

One of two sensors that measures the angle of attack is pictured at bottom on a Boeing 737 MAX 8 airplane outside the company's factory: Boeing appears to have ignored the vital rule of redundancy.

Pilots around the world were particularly furious that Boeing did not inform them of the MCAS software and launched a class-action lawsuit against Boeing. Indeed, until November 2018, there wasn't a single word about MCAS in the plane's operating manual. The company didn't tell pilots about the system because they apparently believed that in day-to-day operations, it would never make itself apparent. The result was that pilots could not train for erroneous MCAS activation -- because officially, the system didn't exist.

An Opaque, Dangerous Game

When boarding an aircraft, passengers must have absolute faith that engineers and mechanics have done all they possibly can to build a safe airplane. Every traveler must be able to trust that aircraft construction and maintenance followed strict oversight and certification protocols whose entire purpose is that of reducing safety risks as close to zero as possible. But that trust has now been shaken.

The system of air travel supervision, which has been transformed into little more than a pendant of the industry itself by radical neo-liberal politicians intent on deregulation, has been called into doubt. The FAA, respected worldwide for the depth of its expertise, demonstrably rubber-stamped the Boeing 737 Max despite the fact that the agency no longer had a clear overview of the individual steps in its development and production.

Indeed, the monitoring system is no longer worthy of the name, having transformed into an arrangement in which a company like Boeing is ultimately responsible for policing itself and certifying the market-readiness or airworthiness of its own products. It has become an opaque, dangerous game that raises questions about unbridled capitalism.

When confronted with such accusations, all the FAA can do is claim that the certification of the 737 Max followed standard agency procedures and took five years. "The 737 Max certification program involved 110,000 hours of work on the part of FAA personnel, including flying or supporting 297 test flights," the agency said in a statement.

Essentially, every airline passenger profits from knowledge that has been collected in a rather macabre way. Every crash, whether or not it results in fatalities, is examined by experts for months on end to determine the cause. They aren't interested in placing blame. Rather, they want to know what they can learn so that similar crashes can be avoided in the future.

The knowledge collected is reflected in a complex list of rules at the FAA and similar agencies. One of the most important FAA documents for commercial air travel is called "FAR Part 25," a 240-page document. It is essentially a list of all the safety requirements that every new civilian airplane must fulfill prior to certification.

All warning lights in the cockpit have to be red, for example. Another rule is that planes must be able to safely fly and land even after a frontal collision with a bird weighing 3.63 kilograms or less. Or: It must be possible to evacuate planes with more than 44 seats within 90 seconds on the ground.

Inexplicable Errors

The rules documented in FAR Part 25 are something like a constitution for global civilian air travel. For Boeing, though, the tome represents the greatest threat it is currently faced with. Although the 737 Max was officially certified in 2017 in accordance with the rulebook, there are significant doubts as to whether that certification was right and proper.

Both Boeing and the FAA seem to have made inexplicable errors. They violated standards that were developed and respected for decades -- standards which earned them global trust. Paragraph 25,671 of FAR Part 25 expressly states, for example, that an airplane must be able to safely land if, for example, the control surface on the horizontal stabilizer becomes jammed in flight or otherwise malfunctions.

Continuing flight in such circumstances must be possible "without requiring exceptional piloting skill or strength." Malfunctions "must have only minor effects on control system operation" and if the failure is not "extremely improbable," then the pilots must have the ability to immediately regain control.

It is difficult to imagine that the 737 Max fulfilled these certification protocols. What, though, does the FAA have to say about it? Daniel Elwell should know. He was acting head of the agency at the time of the crash and had earlier been deputy administrator of the FAA. Seventeen days after the crash in Ethiopia, he appeared before the Senate Subcommittee on Aviation in the Hart Senate Office Building in Washington D.C. and spent two hours squirming in his seat. Committee Chairman Ted Cruz's opening remarks, focusing on the two crashes, on trust and on safety, were articulate and poignant -- but his eloquence would not be matched by Elwell and the other officials who appeared in the witness stand. Indeed, Elwell's performance was particularly miserable. On several occasions, he seemed not to have understood the question or was forced to admit that he didn't know the answer.

Daniel Elwell, then the acting administrator of the Federal Aviation Administration, during his appearance before the Senate Commerce Committee: Safety above all else?
Erin Schaff/ The New York Times/ Redux/ Laif

Daniel Elwell, then the acting administrator of the Federal Aviation Administration, during his appearance before the Senate Commerce Committee: Safety above all else?

Elwell spoke of an FAA culture that values "safety above all else" and pointed to the significant safety improvements that have been made. Since 1997, he said, the risk of a deadly accident in the U.S. has dropped by 94 percent and that in the last 10 years, there had been only a single death out of a total of 90 million flights -- the result of an April 2018 incident when the turbine of a Boeing 737-700 exploded in flight, shattering a plane window and killing the woman in the seat behind it. Elwell's message, essentially, was that the two crashes were regrettable, but they were mere exceptions to the rule. And that the FAA monitoring processes were effective.

Elwell had brought along statistics pertaining to the 737 Max and said that the FAA had been completely integrated in the development process. Agency employees, he said, had been onboard for 133 of the 297 test flights, including flights during which the MCAS software was tested. But in his testimony before the Senate subcommittee on March 27, Elwell produced such gibberish that it wasn't clear what he was trying to say. The software, he said several times, wasn't a program at all. All it did was "give a proper feel to a pilot" and that, for example, it ensured that the 737 Max felt "exactly like the 737NG." MCAS, Elwell said, was merely a "sub-device" to a larger system and was active only "in a very thin envelope." His response produced little more than empty stares.

At some point, Democratic Senator Richard Blumenthal complained: "If I had been a passenger on one of those planes, I would have wanted a parachute." And when asked why it was actually standard procedure to have companies certify their own products (an element of certification called "organization designation authorization, or ODA), Elwell answered: "The concept of ODA has been around for 60 years. It is part of the fabric of what we use to become as safe as we are today."

A Perverse Representation of the Truth

That is a rather perverse representation of the truth. The FAA was established by Congress in 1958 in response to a collision between two passenger aircraft over the Grand Canyon in which 128 people died. At the time, airplanes were much more primitive than they are today, so the agency was easily able to fulfill its monitoring and certification duties. But with growing fleets and a rapidly rising number of flights, the FAA increasingly had to strike deals with airplane manufacturers and delegate monitoring duties to them. Since 2005, the FAA has been permitted to allow Boeing and other companies to delegate their own employees to handle FAA certification checks. The problem, though, is that this system of delegating safety checks doesn't work in practice.

The "authorized representatives" (ARs) may report to the FAA in theory, but because they are, for example, employees of Boeing, their loyalty to their own company might be higher -- and the pressure coming from above higher. A report from 2015 noted that the FAA de facto only has direct authority over 4 percent of ARs at airplane suppliers. An even earlier report, this one from 2011, listed 45 incidents that took place between 2005 and 2008 in which the FAA was accused of insufficient diligence. Which is hardly surprising given the agency's almost impossible mission. In its certification offices, the FAA employs 1,300 people, whereas Boeing alone has 56,000 engineers on its payroll. Parity is a pipedream.

President Donald Trump's deregulation drive threatens to further accelerate the conflation between regulators and those they are supposed to be regulating. Shortly after entering office, Trump signed two pivotal executive orders, number 13,771 and 13,777, which could further undermine the FAA's independence in that they call for the drastic reduction of regulatory requirements at all government agencies. That could mean that even more of the FAA's mission will be delegated to the industry. The FAA Reauthorization Act of 2018, passed just a few weeks before the Lion Air crash, follows in the same vein.

The political will to outsource erstwhile state responsibilities to industry has deeply unsettled a functioning global safety system, within which the FAA had been considered the gold standard. Everything that the FAA had checked and approved was consistently adopted by EASA and the Chinese aviation safety authority. Whether that is still the case will become clear once the 737 Max reauthorization process is complete.

The possibility that the FAA reauthorizes the 737 Max but other agencies refuse to follow suit is a rather frightening one for the aerospace industry. If producers are forced to convince several different agencies of the quality of their planes, they will lose time, money and planning dependability. And the airlines that are waiting for their planes may have to completely rewrite their schedules because a specific plane can only fly in the United States, but not in China or Africa. It would mark the end of a well-organized system.

An Industry Pushed to the Limits

Air travel has become an incredibly competitive business, and that starts with the aircraft manufacturers, led by Boeing and Airbus. And they heap pressure on their suppliers to be faster, better and cheaper -- to the point that the industry repeatedly finds itself at the limits of what is possible. In the search for new customers, airlines offer rock-bottom ticket prices and there is a steady stream of new markets. In the rising economies of Asia and Africa, the number of air travelers has skyrocketed in recent years and airlines are in dire need of modern, fuel-efficient aircraft.

The purchase price and operating costs of civilian aircraft are extreme. A short-haul passenger plane costs $100 million, with long-haul jumbos going for $400 million, investments that take decades to pay off. And once they are purchased, the costs of keeping them in the air are also significant. The fees are everywhere: general air passenger taxes, safety taxes, airport fees, gangways, buses, baggage handling -- the list goes on and on. In the U.S., there is a "September 11 security fee" that allegedly goes toward paying for added safety precautions. The vacation airline Condor once calculated the costs it must pay at the Frankfurt airport and arrived at a total of €90 per passenger.

The result is that airlines have spent years trying to cut costs: Lighter seats have been installed, coat closets have been eliminated and newspapers are no longer passed out to passengers. Some airlines have even got rid of seatback pockets so that nothing is left behind and no extra weight is carried unnecessarily. Efficiency has become the be-all and end-all. A Ryanair flight attendant in Germany receives a base salary of 1,400 euros per month.

The 737 Max is ideal for discount airlines and was developed with their needs in mind. And Michael O'Leary, head of Ryanair, Europe's largest discount airline, immediately went for it. He ordered 135 jets from Boeing and has options for 75 more. The Max, O'Leary said when the purchase was announced in 2014, will "allow Ryanair to lower our costs and airfares." The first planes were initially scheduled for delivery to Ryanair in April, but that deadline was not met. In May, O'Leary still hoped that delivery of the planes would commence in late October or November, but he has since had to completely rewrite the airline's timetable for the approaching season because the laundry list of 737 defects continues to grow.

FAA inspectors have noted that in some emergency situations, the autopilot cannot be disengaged quickly enough. Furthermore, some processors in the flight control computer are sometimes dangerously slow and Boeing itself was forced to admit that some important cockpit warning signals never function properly.

DER SPIEGEL

Other airlines have already received the jets, but they aren't in a much better position than Ryanair, at least for as long as the planes have to remain grounded. The U.S. budget carrier Southwest has ordered 280 of the planes and already has 34 of them in its fleet. American Airlines and Lufthansa partner United have 38 737 Max aircraft in their fleets and now have to improvise. The situation is particularly challenging at Norwegian Air, which operates 18 of the planes, making it the largest 737 Max fleet in Europe -- and the company was facing financial headwinds even before the grounding. The revenue losses are horrendously high -- and will have to be compensated for by Boeing, either in the form of damages paid or discounts on future purchases.

Emergency Order

The story of the grounding of the 737 Max hasn't yet been fully told, but it promises to be an intriguing one. In the time gap between March 10 and 13, scandals are hiding that must still be fully investigated. What did the Chinese know that the Americans did not? After all, following the crash in Ethiopia, China immediately banned all 737 Maxes from taking off or landing in the country whereas it took the U.S. three more days to do so, becoming one of the last countries to impose such a ban.

On Tuesday, March 12, two days after the crash, Trump tweeted: "Airplanes are becoming far too complex to fly." Later that day, he spoke on the phone with Boeing CEO Dennis Muilenburg, who Trump calls "a friend," and Muilenburg assured the U.S. president that the 737 Max was safe.

But apparently Trump wasn't completely convinced. On the one hand, he had wanted to ground the 737 Max already on Tuesday, a plan the FAA talked him out of by arguing that not all data had been evaluated. On the other hand, he was concerned about panic and market turbulence should he do so. In other crisis meetings, Trump spoke disparagingly of the 737 Max, saying the model "sucks" and paled in comparison to the 757 of the kind he owns as a private jet.

On March 13, Trump spoke with FAA head Elwell and Transportation Secretary Elaine Chao before again talking with Muilenburg. By then, even the FAA had enough information in its possession to ground the 737 Max, the necessity of which the agency had denied just one day previously. A single piece, found in the wreckage in Ethiopia, showed that the horizontal stabilizer trim was configured to force the nose down, just as had been the case with the 737 in the Lion Air crash.

A decision was made for the agency to release a statement, but Trump beat them to it. At a White House press conference called to discuss the drug trade on the U.S. border with Mexico, the president said: "We're going to be issuing an emergency order of prohibition to ground all flights of the 737 Max 8 and the 737 Max 9 and the planes associated with that line." To the annoyance of the FAA and the entire aviation industry, he then added the following: "We didn't have to make this decision today. (...) But I felt it was important both psychologically and in a lot of other ways."

On Wednesday, March 13, the last 737 Max flight with passengers onboard landed at 7 p.m. in Newark from Oakland. And immediately, a debate erupted in the U.S. as to whether the FAA, Trump and Boeing had negligently endangered flight safety for three days.

The facts are clear: 346 people are dead of unnatural causes. Of those, 157 lost their lives in a crash on an undulating, arid plateau just a six-minute flight from Addis Ababa, Ethiopia. The other 189 died just over four months earlier, on the morning of October 29.

A wallet belonging to a victim of the Lion Air passenger jet that crashed floats in the waters of Ujung Karawang, West Java, Indonesia: The facts are clear -- 346 people are dead of unnatural causes in the two crashes of Boeing 737 Max jets.
Achmad Ibrahim/ AP

A wallet belonging to a victim of the Lion Air passenger jet that crashed floats in the waters of Ujung Karawang, West Java, Indonesia: The facts are clear -- 346 people are dead of unnatural causes in the two crashes of Boeing 737 Max jets.

A fisherman named Kanta was nearby, after heading out before sunrise in his wooden boat to fish for shrimp. His boat had been tied up on the shores of the Citarum overnight, in one of the river's numerous arms near the Indonesian beach town of Tanjung Pakis. Kunta, 51, has been fishing since he was a boy, having learned the trade from his father. Together with his companion Sakir, he headed out to sea on the morning of the crash.

As the sun rose that day, Kunta could hardly see it through the haze. And one hour later, a single, loud blast rolled over the waves. Residents of Tanjung Pakis compared it to a New Year's firecracker exploding inside of a cane of bamboo. Immediately after the noise, silence returned. There were no screams and no cries for help. Kanta steered his boat in the direction the sound came from, wondering if perhaps something had gone wrong with one of the oil rigs drilling off the coast. But he found no answers, just a couple of life jackets floating on the sea. Kanta didn't learn until later what had happened.

The rest of the world heard about the crash at the same time -- that 189 passengers had lost their lives in a crash of a 737 Max, not knowing that the plane that flew them to their deaths had exhibited problems on several occasions in the three preceding days. The AoA sensors weren't working as they were supposed to. Each time, the plane was checked, each time mechanics fixed the problem the pilots described and each time the Boeing 737 Max was cleared.

On Nov. 10, 2018, a broad public heard for the first time about a software program called MCAS. On Nov. 13, Boeing's Dennis Muilenburg said on the television channel Fox Business that the 737 Max is safe and that Boeing is "providing all of the information necessary to make sure we do a full assessment of the situation." Not long later, at 8:44 on the morning of March 10, Ethiopian Airlines Flight 302 slammed into the ground in Ejere, creating a 10-meter-deep crater.

By Uwe Buse, Dinah Deckstein, Marco Evers, Ullrich Fichtner, Maik Großekathöfer, Guido Mingels, Martin U. Müller, Marc Pitzke and Gerald Traufetter

Article...


Comments
Discuss this issue with other readers!
Share your opinion!

© SPIEGEL ONLINE 2019
All Rights Reserved
Reproduction only allowed with permission


TOP
Die Homepage wurde aktualisiert. Jetzt aufrufen.
Hinweis nicht mehr anzeigen.