Newly public Boeing documents cite ‘catastrophic’ 737 scenario

By Dominic Gates, Lewis Kamb and Steve Miletich / The Seattle Times

In a tense and revelatory hearing Wednesday, a U.S. House committee presented startling new evidence from internal Boeing documents showing that, before the first 737 Max crash in 2018, some company engineers had discovered that a failure in a new flight-control system could be “potentially catastrophic” — information that was dismissed and never communicated to regulators.

Another document showed that this catastrophic potential was reiterated in a presentation to the Federal Aviation Administration (FAA) seven weeks after the Lion Air crash in Indonesia killed 189 people. Boeing decided pilots could deal with it and continued to let the airplane fly. But less than three months later, after a similar erroneous activation, another 157 people died on an Ethiopian Airlines Max.

Those revelations set the stage for an intense five-hour grilling in Washington, D.C., of Boeing CEO Dennis Muilenburg on details of the design, certification and marketing of the Max during a second consecutive day of Congressional testimony.

The hearing was punctuated by repeated calls by members of the House Transportation and Infrastructure Committee for Muilenburg to step down.

“I think it’s pretty clear to me, to the families of the victims and to the American public that you should resign and do it immediately,” said Rep. Jesus Garcia, D-Ill.

With the new evidence displayed on slides in front of Muilenburg, the hearing turned into a relentless critique of Boeing’s management and its culture that will intensify the sense of crisis around the Max.

“The design of MCAS was fatally flawed,” said Rep. Greg Stanton, D-Ariz. “And relinquishing approval of MCAS by the FAA was a grave mistake with severe consequences.”

During the hearing, Rep. Rick Larsen, D-Everett, pressed Muilenburg on errors Boeing made in development of the Max.

Muilenburg had previously admitted that an angle-of-attack warning light didn’t work due to a software glitch. On Wednesday he also acknowledged that the overall architecture of the failed flight-control system was a mistake, as was the lack of information provided to pilots and airlines about the system.

Though Muilenburg repeated several times that “the only sustainable business model for Boeing is safety,” many members of the committee didn’t buy it.

“The way I see it, your relentless focus on stock price and your company’s bottom line may have negatively affected employee performance,” said Garcia. “It’s pretty clear there has been a culture of greed and compromising safety at Boeing.”

Members took turns pounding Muilenburg on the lack of redundancy in the flight-control software implicated in the crashes — the Maneuvering Characteristics Augmentation System (MCAS) — which was triggered by a single faulty angle-of-attack (AOA) sensor.

They also drilled into a batch of 2016 emails to FAA officials from 737 chief technical pilot Mark Forkner that discussed pressure from Boeing to omit MCAS from U.S. pilot manuals and pilot training, and a reference to him deploying “Jedi mind tricks” to convince foreign regulators and airlines to do the same.

Forkner justified that decision in his emails to the FAA by saying that MCAS “only operates WAY outside of the normal operating envelope.” Under questioning, Muilenburg and his chief engineer John Hamilton acknowledged that, given a late change that extended the conditions when MCAS operated to low-speed flight, on the accident flights MCAS had kicked in while the jets were within the normal flight envelope.

Muilenburg could only repeat that Forkner has left Boeing and won’t talk to the company.

Rep. Steve Cohen, D-Tenn., said Boeing “either did not understand or downplayed or, at worst, concealed” that MCAS could activate in normal flying conditions.

Committee members noted that Boeing had an economic motive to downplay MCAS and omit information about it: to cut costs to Boeing’s airline customers, who were demanding no changes from the previous model so that pilots could transition to the Max without simulator training.

Muilenburg acknowledged that when Southwest Airlines signed a launch order for up to 280 Maxs, Boeing promised the carrier a $1 million rebate per airplane if simulator training were required.

But he insisted that “we don’t make training decisions based on economics.” The panel members were not convinced.

“It’s the purposeful concealment that bothers so many of us, with an obvious financial drive behind it,” said Rep. Colin Allred, D-Texas.

Muilenburg was blasted for taking home $30 million last year and for providing pay incentives to managers to meet cost and schedule targets.

“You are driving profit,” said Rep. John Garamendi, D-Calif. “You sure as heck aren’t driving for safety.”

In a separate revelation unrelated to the flight-control system, one congressman read out a whistleblower letter written in June 2018 — four months before the Lion Air crash and two months before the plane that crashed was delivered to Lion Air — in which a senior manager on the 737 Max final assembly team in Renton expressed deep safety concerns over the high production rate at the time.

“Employees are fatigued from having to work at a very high pace for an extended period of time. … Fatigued employees make mistakes,” the manager wrote. “Schedule pressure (combined with fatigue) is creating a culture where employees are either deliberately or unconsciously circumventing established processes.

“Frankly right now all my internal warning bells are going off,” the manager wrote. “And for the first time in my life, I’m sorry to say that I’m hesitant about putting my family on a Boeing airplane.”

Muilenburg acknowledged receiving this complaint and said the company took action to address some of the concerns. But he conceded that the production rate had not been lowered.

Committee chairman Peter DeFazio, D-Ore., said the manager who wrote the letter, who was not identified, “retired in disgust.”

New evidence

Facing this lacerating criticism and the calls for his resignation, Muilenburg said he won’t step down.

Recalling his upbringing, he said, “I feel responsible to see this through … I grew up on a farm in Iowa. My dad taught me that you don’t run away from challenges.”

Yet regarding the deficiencies in Boeing’s development of the Max, he struggled to answer.

DeFazio displayed a Boeing internal engineering memo from June 2018 asserting that simulator tests of a failure of MCAS “found the failure to be catastrophic” if pilots took longer than 10 seconds to respond.

Boeing, adhering to an FAA guideline, had assumed during development of the Max that pilots would respond within four seconds to any failure.

The memo, written after the Max was already in passenger service, is the first indication that anyone within Boeing had raised the question of whether the pilot response time assumption was correct and the catastrophic consequences if it was not.

Based on the faulty assumption, the catastrophic scenario was dismissed and never raised outside the company. Boeing showed a “lack of candor all through this,” DeFazio said.

“I cannot speak to this document,” Muilenburg said.

DeFazio also presented a Boeing email from 2015 in which an engineer asked, “Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs?”

Hamilton said he wasn’t aware of the document but said it was evidence of an open culture in which engineers could raise questions.

One more engineering memo, from June 2018, after the Max entered service but before the crashes, lays out Boeing’s own requirements for the new system, which included:

• “MCAS failures shall be annunciated to the flight crew.”

• “MCAS shall not have any objectionable interaction with the piloting of the airplane.”

• “MCAS shall not interfere with dive recovery.”

MCAS clearly didn’t meet these requirements.

Hard questioning

Unlike the Senate committee that questioned Muilenburg Tuesday, the House committee challenged the Boeing responses with sharp follow-up questioning.

Larsen questioned Muilenburg’s Tuesday statement to the Senate committee that the system safety assessment of MCAS and the significant change to the system made in 2016 had been fully vetted by the FAA. Larsen pointed to the Lion Air report final accident report statement that the FAA had simply accepted Boeing’s submission.

Both Boeing executives doubled down. The extension of MCAS to low speed flight “was discussed with the FAA in many ways,” Muilenburg insisted.

DeFazio then directly challenged the CEO’s statement, citing the findings this month of an investigation by a group of international regulators that although “the FAA was not completely unaware of MCAS … the information and discussions about MCAS were so fragmented and were delivered to disconnected groups within the process, it was difficult to recognize the impacts and implications of this system.”

Meeting the bereaved families

Muilenburg met with the families of crash victims Tuesday night after his session in the Senate, and at one point in Wednesday’s hearing his voice cracked briefly with emotion.

“We wanted to listen,” he said with a stricken look. “Each of the families told us the stories about the lives that were lost. Those were heartbreaking. I’ll never forget that.”

During the hearing, DeFazio asked Muilenburg about Boeing’s push to move some Lion Air crash lawsuits to Indonesian courts. When the CEO said he wasn’t aware of those court motions, DeFazio was incredulous.

“Seriously? You don’t know that as a fact?” he asked. “You’re telling me that you don’t know your legal strategy in regards to Indonesia?”

As the hearing ended and Muilenburg got up to leave, he was approached by Nadia Milleron, mother of Samya Rose Stumo, 24, who died on the Ethiopian Airlines flight.

As Muilenburg paused, Milleron told him the family members as a group had heard him mention his humble upbringing on an Iowa farm “one too many times.”

She said the group’s unanimous response was that Muilenburg should “go back to the farm” and let someone else take over fixing the Max crisis.

“Go back to Iowa,” she told him. “You are not the person any more to solve this situation.”