By Dominic Gates, Steve Miletich and Lewis Kamb / The Seattle Times
SEATTLE — Seven weeks after the second fatal crash of a 737 Max in March, a Boeing engineer submitted a scathing internal ethics complaint alleging that management — determined to keep down costs for airline customers — had blocked significant safety improvements during the jet’s development.
The ethics charge, filed by 33-year-old engineer Curtis Ewbank, whose job involved studying past crashes and using that information to make new planes safer, describes how around 2014 his group presented to managers and senior executives a proposal to add various safety upgrades to the Renton-built Max. Ewbank now works on airplane systems integration for the Everett-based 777X program.
The complaint, a copy of which was reviewed by The Seattle Times, suggests that one of the proposed systems could have potentially prevented the crashes in Indonesia and Ethiopia that killed 346 people. Three of Ewbank’s former colleagues interviewed for this story concurred.
The details revealed in the ethics complaint raise new questions about the culture at Boeing and whether the long-held imperative that safety must be the overarching priority was compromised on the Max by business considerations and management’s focus on schedule and cost.
Managers twice rejected adding the new system on the basis of “cost and potential (pilot) training impact,” the complaint states. It was then raised a third time in a meeting with 737 Max chief project engineer Michael Teal, who cited the same objections as he killed the proposal.
A version of the proposed system, called synthetic airspeed, was already installed on the 787 Dreamliner.
It was not directly related to a flight-control system — the Maneuvering Characteristics Augmentation System (MCAS) — that contributed to both crashes. But it would have detected the false angle of attack signal that initiated events in both accidents, so potentially it could have stopped MCAS from activating and repeatedly pushing down the nose of both jets.
Installing it in the Max, though, would likely have meant 737 pilots needed extra training in flight simulators. Running thousands of pilots through simulator sessions would have delayed the jet’s entry into service and added substantial costs for Boeing’s airline customers, damaging the Max’s competitive edge against the rival Airbus A320neo.
Ewbank’s complaint goes further than the decision not to install this one new system. He describes management as “more concerned with cost and schedule than safety and quality.” And he alleges that in one instance Boeing hid inflight safety incident data from the European Union Aviation Safety Agency (EASA).
As first reported in The Seattle Times, Boeing did an inadequate system safety assessment that missed flaws in the design of MCAS that were central to the two Max disasters. And Boeing engineers were under pressure to limit safety testing to certify the Max. These fresh allegations from inside Boeing indicate that the problems with the jet-maker’s safety culture might go deeper than MCAS.
Submitted via Boeing’s internal whistleblower system, Ewbank’s complaint alleges that Max program managers, concerned with avoiding higher costs and more pilot training, were intent on “shutting down trade studies that attempted to modernize the airplane and avoiding awareness of known issues encountered in historical 737 operation.”
The FBI has interviewed at least two Boeing employees about the complaint. It’s unclear how the Boeing document reached the agency, but federal investigators are known to have issued subpoenas to the company.
Department of Justice prosecutors, Department of Transportation inspectors and Securities and Exchange Commission officials are all involved in a wide-ranging federal investigation into possible wrongdoing at Boeing during certification of the Max that was already under way before the engineer filed his internal complaint in April.
Boeing declined to comment on the details of the ethics complaint. Teal, the 737 Max chief project engineer, could not be reached for comment. The Department of Justice also declined to comment. The Seattle Times is not naming the employees who have been questioned by the FBI to protect the identity of the source of that information.
Ewbanks declined to be interviewed. The Seattle Times is naming him because he identified himself in his complaint to Boeing.
The Max has been grounded worldwide for almost seven months as Boeing works on a comprehensive fix to flight-control systems that will satisfy air safety regulators around the globe. The final updates to the systems are expected to be submitted to the Federal Aviation Administration (FAA) this month, and Boeing anticipates clearance to return the jet to the sky in November.
Meanwhile, multiple investigations and reviews, internal and external, are examining what caused the deadly crashes. Last week, Boeing’s board announced a revamp of the company’s reporting structures aimed at producing better internal safety oversight. On Monday, Boeing chairman and chief executive Dennis Muilenburg said he’s “taking immediate steps” to implement those recommendations.
Ewbank’s ethics complaint expressed concern about the possible personal consequences of stepping forward inside the company.
“Given the nature of this complaint, the fear of retaliation is high, despite all official assurances that this should not be the case,” he wrote. “There is a suppressive cultural attitude towards criticism of corporate policy — especially if that criticism comes as a result of fatal accidents.”
Ewbank wrote that co-workers told him in private they are afraid to speak up about similar safety concerns out of “fear for their jobs.”
In a statement responding to requests for comment this week, Boeing said it “has rigorous processes in place, both to ensure that such complaints receive thorough consideration and to protect the confidentiality of employees who make them.”
“Accordingly, Boeing does not comment on the substance or existence of such internal complaints,” the statement added.
Ewbank’s LinkedIn profile shows he graduated from Embry-Riddle Aeronautical University in 2008 with a degree in aeronautical engineering, then got a master’s degree at Purdue. After college, he took a job as rocket scientist, doing launch site design engineering at the Kennedy Space Center in Florida with United Space Alliance, the joint venture between Boeing and Lockheed Martin.
He was hired by Boeing in 2010 to work on designing commercial airplane flight deck systems, including the Max.
However, dissatisfied with his experience on the Max program, he took a break from Boeing. LinkedIn shows he left the company in April 2015 and returned to work on the 777X only last November. The reason for the career break is cited in the ethics complaint: his feeling that Boeing management was “squeezing the engineering budget for new programs … more concerned with cost and schedule than safety and quality.”
In his first stint at Boeing, he worked on the safety of flight deck systems across multiple jet programs. It put him at the center of what has become one focus of the investigations into the crashes: The systems that tell pilots how their plane is performing in flight and alert them to anything going wrong.
Ewbank’s complaint says his job included “designing appropriate crew alerting and crew procedures based on expected (system) failures.”
Last week, a National Transportation Safety Board (NTSB) report called for improvements to such systems and criticized Boeing’s testing of the Max for failing to simulate the possible barrage of system failures and warnings the pilots on the crashed flights faced.
The proposal for system upgrades that Ewbank discusses in his complaint emerged from work he did alongside several veteran employees in Boeing’s Aviation Safety department “to analyze Loss of Control inflight accidents and design flight deck features that would work to break the accident chain of events.”
The Seattle Times interviewed four former Boeing employees who were involved in the work of assessing the proposed safety upgrades.
Rick Ludtke, a former flight deck integration engineer, worked alongside Ewbank and was a key participant in the proposal, which was presented in an engineering memo titled “Boeing Commercial Airplanes Strategy for Reducing the Risk of Loss of Control Events.”
Ludtke said the purpose of the memo, which Ewbank cites in his complaint, was to “capture the approval” of executives and to try to get a list of six system improvements accepted across Boeing’s airplane programs, including the Max, which was then in early development.
The memo, which was signed by Todd Zarfos, the Boeing vice president who heads the company’s engineering design centers, recommended that synthetic airspeed be installed on the Max “with the next appropriate software update.”
Another veteran Boeing engineer and associate technical fellow, Carlo Ruelos, was the early champion of synthetic airspeed at Boeing.
A pilot flying any airplane needs to know the current airspeed — the plane’s speed relative to the air. Depending on the direction of the wind, that can be faster or slower than the groundspeed, the plane’s speed relative to the earth. Too high an airspeed could stress the airframe. Too low an airspeed could stall the plane.
This key piece of data is measured by pitot-static air pressure sensors, little tubes that stick out of the fuselage on both sides under the cockpit. It’s entered into multiple calculations performed by the flight control computer, so an accurate value is important.
Synthetic airspeed is a new system that provides an additional, indirect calculation of airspeed using different sensors, including the plane’s angle-of-attack sensors. The system enters the airplane’s angle of attack, its weight, the position of its control surfaces and other parameters into a proprietary Boeing algorithm to come up with an independently determined airspeed reading.
The independence of the synthetic reading means that if it matches the direct airspeed readings, it verifies the data as highly reliable. If there’s a discrepancy, the air data is rejected and the plane’s automated systems won’t use it.
Ewbank’s complaint cites a study that found air data reliability, and airspeed awareness in particular, as a “dominant theme” in airplane accidents where the pilots lost control.
The only Boeing airplane using synthetic airspeed today is the company’s latest all-new jet, the Everett-built 787 Dreamliner.
On the Max, Ruelos saw an opportunity because the jet had a new integrated air data system box installed that had more computational power than that on the previous 737 NG model. That extra capability, Ruelos decided, would make it possible to add a variant of the 787 synthetic airspeed system to the Max. And if it could be added, he felt it should be — because it would broadly enhance the reliability of the 737’s air data systems.
Ruelos, now 75 and retired, said in an interview that the pitot and static probes used for standard airspeed measurement “stick out of the airplane and can be damaged by a bird strike. Or something can plug the very small hole.”
So, he said, “I firmly believe that as another means of verifying the air data,” synthetic airspeed “is a key element in maintaining the safety of the airplane.”
At the time of that proposal, no one had identified MCAS as a concern. Back then, the original design of MCAS was more benign than the final version that went haywire on the two crash flights. It required two sensors to activate — a high angle of attack and and a high G-force — and was less extensive in its ability to push the nose down.
It wasn’t until March 2016 that the MCAS design was changed to depend solely on a single angle-of-attack sensor.
Synthetic airspeed gains significance in the aftermath of the accidents because the system’s cross-check of the independent airspeed readings would raise a red flag if there’s any angle-of-attack sensor fault. If the readings disagree, Ewbank wrote in his complaint, the system as implemented on the 787 is designed to “monitor and detect erroneous angle-of-attack data, and then work to prevent the use of erroneous data by downstream systems.”
While Ewbank prefaces this statement with a careful qualifier — “It is not possible to say for certain that any actual implementation of synthetic airspeed on the 737 Max would have prevented the accidents” — his implication is clear: Synthetic airspeed might have stopped MCAS from activating in the circumstances of the two crashed flights.
Ludtke and Ruelos agreed.
There’s “a very good chance” that if Boeing had implemented synthetic airspeed on the Max, it would have prevented the crashes, Ludtke said.
Of course, Boeing could have achieved the same result in simpler ways — for example, if MCAS had been designed from the start to compare readings from the two angle-of-attack sensors instead of only one. Still, in hindsight the rejection of synthetic airspeed seems fateful.
In his complaint, Ewbank puts it down to “a corporate culture … of expediency of design-to-market and cost-cutting.”
“The 737 Max was designed via piecemeal updates to prevent triggering expensive certification and (pilot) training,” his complaint states.
Ewbank, a relatively young engineer at the start of his career and with less than six years at Boeing over his two employment stints, even goes so far in the complaint as to directly attack CEO Muilenburg.
He cites Muilenburg’s statement on a quarterly earnings teleconference, just four days before Ewbank filed the ethics complaint, denying that the two recent Max crashes were due to any “technical slip” by Boeing during the jet’s design or certification. Ewbank calls this “a false statement.”
“When CEO Muilenburg and others state that the Max was a safe airplane as designed, they seriously misrepresent what Boeing Engineering has learned about how data and control functions should be treated,” Ewbank wrote.
Seattle Times researcher Miyoko Wolf contributed to this report.