When an airplane design is questioned, Boeing gets defensive

By Douglas MacMillan / The Washington Post

EVERETT — The artifacts displayed in a museum at Boeing’s corporate campus are meant to show how tragic accidents in the company’s history have given rise to major advances in airplane safety.

A wristwatch frozen at 6:56 honors the moment when Japan Airlines Flight 123 struck a mountain in 1985, a deadly crash that led to improved repair protocols across the industry.

A photograph shows the 18-foot hole that ripped open an aging Aloha Airlines jet mid-flight in 1988 and swept a flight attendant to her death. This prompted new limits on the number of times one plane is permitted to fly.

Boeing opened the museum to employees in 2017 and this year added a fountain honoring the 346 people who died in the two recent crashes of 737 Max jets. The memorial says nothing about what caused the crashes or what lessons Boeing has learned from them.

“It’s too early to tell,” John Hamilton, chief engineer of Boeing’s commercial planes division, said during a tour of the facility in early October. The crashes, he said, are still “under investigation.”

One year after rescuers hoisted fragments of the wreckage of Lion Air Flight 610 out of Indonesia’s Java Sea, Boeing has apologized for the loss of life but has not detailed what mistakes it made in its design of the 737 Max. Indonesian authorities’ 320-page final report on the accident, released Friday, faults Boeing for developing a powerful flight control system called MCAS that relied on a single problematic sensor, and for failing to adequately inform pilots and regulators how it works.

The report, which also cited problems with Lion Air’s maintenance and lapses on the part of a Florida sensor manufacturer, added to a growing body of evidence feeding public concerns about safety oversight at Boeing.

Boeing’s response to the public uproar over the 737 Max follows a historical pattern for the company, according to interviews with 11 former employees, government officials and aviation safety experts, all of whom worked on crash investigations involving Boeing. For decades, the aerospace giant has tried to carefully shape public perceptions around the causes of plane crashes — both to limit its legal liability and to maintain the confidence of customers, employees and investors in the integrity of its planes, those interviewed said.

The company has earned a reputation in the aviation community for withholding information, favoring theories of pilot errors over product flaws and being slow to make engineering changes to planes that could prevent future crashes, said Jim Hall, a former chairman of the National Transportation Safety Board, the federal agency that oversees investigations into all crashes that occur in the United States.

“In my opinion, they are just not transparent with factual information,” Hall said.

Gordon Johndroe, a Boeing spokesman, acknowledged that “we know we need to be more transparent with information.” However, Johndroe said in a statement: “Boeing has cooperated fully with accident investigators to understand the root causes of all accidents. We are committed to sharing data to improve the overall safety of the transportation system — which has undeniably improved over the last three decades.”

Chief executive Dennis Muilenburg will face questions from U.S. lawmakers at a Senate hearing on Tuesday and a House hearing on Wednesday — part of Boeing’s campaign to win back the trust of regulators and the flying public amid a crisis that has grounded hundreds of planes, prompted a probe by the Justice Department’s criminal division and halted sales of the company’s flagship jetliner.

Boeing and the Justice Department have declined to comment on any possible federal investigation.

In response to the Lion Air report, Boeing said it has made changes to the 737 Max to “prevent the flight control conditions that occurred in this accident from ever happening again,” including activating MCAS only when two separate sensors agree the plane is approaching an aerodynamic stall. The company said it is updating crew manuals and pilot training “to ensure every pilot has all of the information they need to fly the 737 Max safely.”

Because Boeing planes dominate the sky, the company has more experience with crashes than anyone else. Boeing commercial jets have been involved in more than 240 fatal accidents over the past 60 years, according to the company’s own research, nearly as many as all other active manufacturers combined. Boeing makes two of the three most produced planes of all time — the 737, the Airbus A320 and the Boeing 777 — and its planes have historically had some of the lowest accident rates in the industry.

Boeing draws on this experience every time a plane goes down, dedicating millions of dollars, hundreds of staff, state-of-the-art flight simulators and other resources to assist with major investigations.

Jim Hall led the NTSB during the 1990s, when a five-year investigation concluded that a malfunction in the Boeing 737’s rudder system most likely caused two fatal crashes, resulting in a total of 152 deaths. Boeing declined to follow an NTSB recommendation to modify the rudder system after the first crash, in 1991, and repeatedly argued that a pilot was to blame for a second crash in 1994, despite strong similarities between the two incidents.

Over several years, Boeing investigators built a case that one of the pilots of 1994’s USAir Flight 427 overreacted to turbulence and slammed his foot on a pedal, causing a loss of control. The NTSB determined in 1999 that a defect with the rudder’s hydraulic valve was the “most likely” cause. At the time of the final report, Boeing maintained that the rudder failure could not be replicated, despite years of attempts by investigators, and the Federal Aviation Administration said questions remained unanswered about the accident.

The FAA directed Boeing to upgrade the rudder system in all 737s — a complex and costly task the company completed in 2008.

“When they run into a problem like the rudder, it is very difficult for them to step back and look at it in a critical way,” Peter Goelz, a former NTSB administrator, said of Boeing. “That represents the fundamental philosophy of the company: They designed a good plane and wouldn’t put it in the air if it wasn’t.”

When an Aloha Airlines plane ruptured in 1988, resulting in the death of flight attendant Clarabelle Lansing, Boeing blamed the air carrier for failing to address corrosion of the plane’s metal fuselage. The NTSB’s final report faulted Aloha Airlines for poor maintenance but also said Boeing and the FAA knew about the problem of corrosion and cracking from overuse of the 737 many years before the incident. Boeing should have issued a “terminating action,” a mandatory fix for all operators of affected airplanes, and the FAA should have required it, the report said.

After another crash of a Boeing commercial jet in Thailand in 1991, the company was slow to admit a flaw in the plane’s design had caused the crash, according to an essay in The Guardian written by Niki Lauda, the owner of the airline that operated the downed airplane. Lauda, also a well-known Formula One driver, said he visited Boeing offices and demanded that the company explain it made a mistake that caused the plane’s thrust reverser, a braking mechanism, to mistakenly deploy in mid-flight, causing a loss of control that led to the deaths of all 223 people on board.

“What really annoyed me was Boeing’s reaction once the cause was clear,” Lauda wrote in 2006. “Boeing did not want to say anything. It was absolutely clear why the plane had crashed. But the legal department at Boeing said they could not issue a statement.”

Avoiding words like ‘failure’

At Boeing’s production facility in Renton, work on the 737 Max presses on.

A small city of engineers works around the clock building more than a dozen 737s at a time, completing one to two new Max airplanes per day. In the early morning hours, completed jets are towed off the production line and flown to one of Boeing’s storage facilities in Washington state or San Antonio, where they sit waiting for the regulatory grounding to be lifted.

Boeing executives have defended the company’s design and manufacturing process in courtrooms, at news conferences, in analyst calls and internal company meetings over the past year, repeating the message that the 737 Max met the company’s rigorous standards for safety and suggesting that pilots on both flights could have prevented the accidents if they had followed protocols.

That opinion conflicts with the conclusions of Indonesian authorities, who said Boeing’s design decisions on the 737 Max directly contributed to the crash. Boeing made incorrect assumptions about how pilots would respond to MCAS, a software system that was vulnerable to error because it relied on a single angle-of-attack sensor, the report said.

A separate report earlier this month by the Joint Authorities Technical Review, an international panel of aviation experts, found that Boeing provided regulators vital information about MCAS in a “fragmented” fashion, leading to an “inadequate awareness” of the system by authorities tasked with overseeing the plane’s safety.

Boeing spokesman Johndroe said the company understands that “crews felt MCAS should have been called out explicitly in the flight crew operations manual,” and it plans to “review the recommendations of the JATR report and the accident reports.”

The FAA recently asked Boeing why it waited several months to bring forward messages that show employees appearing to discuss concerns with MCAS years before the crashes. In a series of 2016 text messages only recently shared by Boeing, Mark Forkner, the former flight test engineer for the 737 Max, wrote about an “egregious” problem he experienced while testing MCAS in a simulator and said he “basically lied to the regulators (unknowingly)” about it.

The FAA said in a statement that it “finds the substance of the document concerning” and is “disappointed that Boeing did not bring this document to our attention immediately upon its discovery.”

Boeing says it did provide the text messages to investigators earlier this year and says Muilenburg has called the FAA to address the agency’s concerns. Forkner’s attorney has said the text messages referred to a problem with Boeing’s simulator rather than the functionality of the flight control system itself.

Boeing employees are trained to avoid discussing safety in ways that may open the company up to liability, former employees said. New workers are given a one-day seminar from Perkins Coie, Boeing’s outside law firm, on how to “watch your language” when discussing and documenting anything involving safety, said one former employee who requested anonymity because they were not authorized to discuss internal company matters. Attorneys review the public statements prepared by Boeing’s crash investigators and have suggested avoiding words like “failure,” a word that means different things to engineers and lawyers, said another former employee who was not authorized to discuss company matters.

Many companies exposed to the legal risks of product liability exercise caution when making statements about safety, said Christopher Hart, a former NTSB chairman who led the JATR international safety group in its recent report on the 737 Max.

Curtis Ewbank, a Boeing engineer who filed an internal whistleblower complaint this year, alleged the company rejected a safety feature in the development of the 737 Max that may have prevented the crashes. In a copy of his complaint reviewed by The Seattle Times, Ewbank said the company has “a suppressive cultural attitude towards criticism of corporate policy — especially if that criticism comes as a result of fatal accidents.”

Boeing says it encourages employees to come forward with any concerns and has recently expanded its internal anonymous reporting system to elevate any potential problems with safety. Boeing also named a new internal safety czar to oversee safety reviews and a new board member with experience in aviation safety.

Hamilton said the safety museum in Everett is part of an effort to get employees thinking about their responsibility to build safe planes.

“When they come through here, I want them to come out thinking: ‘What am I going to do different? How am I going to make a difference going forward?’” he said.

‘Our daughter died in vain’

Some people who have lost friends and family members in plane crashes say Boeing’s resistance to admitting mistakes prevents it from making planes safer. The company failed to recognize the urgency of the MCAS problem after the Indonesian accident, leading to a disaster in Ethiopia five months later, said Michael Stumo, whose 24-year-old daughter died in the Ethiopian crash.

“Our daughter died in vain,” he said.

Stumo and other family members of people who died in 737 Max crashes are in settlement negotiations with Boeing. At an Oct. 17 court hearing in Chicago, the company said it had settled 17 cases related to Lion Air. Boeing has separately set up a $100 million relief fund to support families.

A group of family members of the victims of USAir Flight 427 still gather for a memorial service each September in a cemetery near Pittsburgh. No bodies had been fully recovered after the crash, so the scattered remains of the 132 deceased were collected and spread across 40 caskets. Insurers for Boeing and USAir paid up to $25 million to settle the wrongful-death claims of each victim, with neither company admitting fault.

Joanne Shortley-Lalonde, whose husband died in the accident, said in an email she attended every regulatory hearing about the crash and took notes to try to understand what happened.

“I wanted to know why that plane suddenly fell from the sky,” she said. “Even after that last NTSB hearing, when they concluded it was indeed the rudder that malfunctioned, I don’t recall receiving any sort of apology from either the airlines or Boeing.”