Thursday, September 26, 2019

Boeing 737 MAX: Two Competing Views

Two long and very detailed articles on the background to the 737 MAX disasters present very different views. William Langewiesche's What Really Brought Down the Boeing 737 Max? is subtitled:
Malfunctions caused two deadly crashes. But an industry that puts unprepared pilots in the cockpit is just as guilty.
Maureen Tkacik's Crash Course: How Boeing's Managerial Revolution Created The 737 MAX Disaster puts the theme in the headline. Below the fold I discuss them, and relate them to my post First We Change How People Behave.

Tkacik starts a long time ago:
Nearly two decades before Boeing’s MCAS system crashed two of the plane-maker’s brand-new 737 MAX jets, Stan Sorscher knew his company’s increasingly toxic mode of operating would create a disaster of some kind. A long and proud “safety culture” was rapidly being replaced, he argued, with “a culture of financial bullshit, a culture of groupthink.”


Sorscher, ... said he didn’t previously imagine Boeing’s brave new managerial caste creating a problem as dumb and glaringly obvious as MCAS ... On some level, though, he saw it all coming; he even demonstrated how the costs of a grounded plane would dwarf the short-term savings achieved from the latest outsourcing binge in one of his reports that no one read back in 2002.
She recounts how Boeing bought the failing McDonnell-Douglas in 1997 and basically handed management of the combined company  to the team that had driven McDonnell-Douglas into the ditch:
The line on Stonecipher was that he had “bought Boeing with Boeing’s money.” Indeed, Boeing didn’t ultimately get much for the $13 billion it spent on McDonnell Douglas, which had almost gone under a few years earlier. But the McDonnell board loved Stonecipher for engineering the McDonnell buyout, and Boeing’s came to love him as well.
Stonecipher was notorious for treating engineers like dirt:
In 2000, Boeing’s engineers staged a 40-day strike over the McDonnell deal’s fallout; while they won major material concessions from management, they lost the culture war. They also inherited a notoriously dysfunctional product line from the corner-cutting market gurus at McDonnell.

His metric was Return On Net Assets (RONA):
The McDonnell Douglas engineers had seen it all before: In the name of RONA, Stonecipher’s team had driven the last nail in the coffin of McDonnell’s flailing commercial jet business by trying to outsource everything but design, final assembly, and flight testing and sales of the MD-11. In 2001, one McDonnell engineer wrote a scathing critique of the metric and its inevitable result, “Out-sourced Profits,” that went viral on Boeing’s intranet server.
The airframe market became a duopoly. Not wishing to end up with a monopoly, the airlines started to give the stock price of the weaker of the two a helping hand, led by captive Boeing customer Southwest:
It went without saying that MCAS was an honest mistake, but the secrecy shrouding the program’s very existence told you it wasn’t a 100 percent honest honest mistake. The story of the secrecy begins with the universally beloved, unusually labor-friendly, strangely not-evil Southwest Airlines. ... On something of a lark, Boeing had given Kelleher a sweet no-money-down deal on his first four 737s in 1971, and Kelleher repaid the favor by buying more than 1,000 737s over the next 50 years—and zero of any other plane. According to a recent lawsuit against Southwest and Boeing, the airline had rewarded this loyalty with an unwritten but zealously enforced “handshake” agreement, dating back to the 1990s, that Boeing would not sell any planes for less than Southwest was paying, or Boeing would send Southwest a rebate check.
I wrote about this characteristic of two-vendor markets two years ago:
Seagate's poor performance poses a real problem for the IT industry, similar to problems it has faced in other two-vendor areas, such as AMD's historically poor performance against Intel, and ATI's historically poor performance against Nvidia. The record shows that big customers, reluctant to end up with a single viable supplier of critical components, will support the weaker player by strategic purchases of less-competitive product.
Here's how it worked in the airframe market:
Southwest reliably swooped in with big orders and/or accelerated payments after accidents, stock price plunges, or both; the same lawsuit claims that, after September 11, the airline formed an off–balance-sheet slush fund to bail out Boeing during unanticipated shortfalls, and lent other airlines its own planes when Boeing production fell behind, all while it waited patiently for its order deliveries to be filled at a time when it was convenient for Boeing. As the carriers became more profitable in the twenty-first century, more of them followed Southwest’s lead and helped Boeing make its numbers, with United Airlines and Alaska Airlines pitching in during fourth-quarter 2015, alongside Southwest, to make payments not due until 2016. Those partnerships were but one numbers-smoothing mechanism in a diversified tool kit Boeing had assembled over the previous generation for making its complex and volatile business more palatable to Wall Street, and while not entirely kosher and not at all sustainable, they were by far the least destructive tool in the kit—until Southwest called in the favor on its orders for the MAX.

The favor was the $1M/plane penalty if Southwest's pilots had to spend time in the simulator before flying the MAX. This made it essential for Boeing, and the Boeing employees certifying the MAX, to keep quiet about MCAS. Of course, if the airlines' managements found out about it they'd be motivated to keep quiet too.

Tkacik is most interesting recounting the massive PR operation that swung into operation once the second crash made it impossible to keep quiet about MCAS:
Starting almost immediately after the Ethiopian crash, Daniel Elwell and Sam Graves, respectively the then-acting FAA chief and the ranking Republican on the House Transportation and Infrastructure Committee, led a coordinated campaign to blame the dead pilots for crashing the planes. The crux of their argument was that there was nothing to see here—that correct execution of the runaway stabilizer checklist would have saved all 346 lives, and that the real scandal behind the two crashes was a regime of lax foreign pilot training standards. Graves proceeded, in the storied tradition of congressional grandstanding, to call for the Department of Transportation to launch an investigation into this manifest nonissue.

And where did the "pilot error" meme come from?
The pilot errorists took their primary talking points from a blog post titled “The Boeing 737 Max 8 Crashes: The Case for Pilot Error,” written by two pilots and published on a site called Seeking Alpha. According to The Seattle Times, the post in question had been commissioned by one of Boeing’s institutional shareholders; ... The Wall Street Journal, in particular, homed in laserlike on matters of pilot behavior—even managing to transform the impossibility of manual flight under the conditions of the Ethiopian crash into a story about the FAA’s new concern that “female” pilots might lack the physical strength to fly the old-fashioned way.

It was all part of a calculated campaign to sow uncertainty, doubt and confusion:
Indeed, most of Boeing’s response to the MAX disasters has involved disseminating a kind of misinformation and doubt that makes the crashes look more complex than they really are. First Boeing issued, then instructed the FAA to circulate, a terse directive to the aviation community essentially copying-and-pasting the 737 flight manual’s instructions for handling a runaway stabilizer—a rare (but terrifying, and well-understood) situation in which the plane’s horizontal stabilizer doesn’t respond to a pilot’s commands. Then, when the airlines informed pilots about MCAS, they dispatched executives to talk pilots off the ledge about the deadly software—explaining, in the words of a Boeing vice president Mike Sinnett to the American Airlines pilots’ union, that Boeing simply didn’t want to “overload the crews with information that’s unnecessary.” Sinnett also suggested that an MCAS malfunction would never happen to American pilots, because the AOA “Disagree” light, an optional feature for which American had paid extra to outfit its fleet, would alert the crew before takeoff that the plane’s angle-of-attack sensors were contradicting each other and that the plane was not airworthy.


That part turned out to be a lie. (The plane needed to be at least 400 feet in the air to activate the Disagree light—at which point the pilots, already preoccupied with getting the plane in the air, would only have a few seconds to turn it around.) But the idea that some safety feature existed that would have saved American planes perpetuated the fiction that an MCAS crash couldn’t have happened in a civilized country, even if its pilots were ill-informed enough to fail to remember the runaway stabilizer checklist.

In fact, the Ethiopian pilots had remembered the checklist:
the anonymous but very pilot-famous Mentour Pilot, a 737 captain and “type rating examiner” with half a million YouTube subscribers, had solved at least one mystery: The Ethiopian pilots had followed the Boeing checklist. They had switched the stabilizer trim cutout switches to the “cutout” position and attempted to turn the nose of the plane back up using the manual crank—they just couldn’t. ... The Mentour Pilot had noticed the problem in his day job evaluating the final flight simulator exams of hundreds of would-be 737 pilots. He had even filmed a terrifying video in which he attempted to implement the MCAS override checklist in a simulator to demonstrate the system failure.
The PR campaign continues. William Langewiesche is an experienced pilot. His father Wolfgang Langewiesche literally wrote the book (Stick and Rudder) on airmanship. William's article reads as a paen to a lost era of heroic airmanship when pilots had The Right Stuff and only ex-military pilots were allowed to fly airliners. He lays out the "pilot error" thesis in great detail, and sums it up thus:
What we had in the two downed airplanes was a textbook failure of airmanship. In broad daylight, these pilots couldn’t decipher a variant of a simple runaway trim, and they ended up flying too fast at low altitude, neglecting to throttle back and leading their passengers over an aerodynamic edge into oblivion. They were the deciding factor here — not the MCAS, not the Max. Furthermore, it is certain that thousands of similar crews are at work around the world, enduring as rote pilots and apparently safe, but only so long as conditions are routine.
Christine Negroni's critique in Irony of Pilot Laying Blame On Pilots in Boeing 737 Max Disasters sums it up better than I can:
In a lengthy piece just published, Langewiesche weaves the known facts of the two 737 Max disasters into a jumble of opinion, pilot-bashing and Western superiority.
...
Explaining how the U.S. Navy trains fighter pilots, Langewiesche says, “The best pilots do not sit in cockpits so much as strap them on.” It’s a far different protocol for the folks flying us on our vacations and business trips. These pilots who Langewiesche writes, “never fly solo and whose entire experience consists of catering to passengers” are unlikely to develop true airmanship no matter the length of their careers unless they make extraordinary efforts. “The worst of them are intimidated by their airplanes and remain so until they retire or die.”

That’s quite an indictment of an industry with a safety record that is the envy of all other modes of transportation.

In Langeweishe’s telling, that deficit is most keenly felt in countries where aviation is booming and governments are prone to a light regulatory touch because of the influence of the airlines on the national economy. Suggesting Indonesia and Ethiopia turned a blind eye to inadequate training of its airlines’ pilots and that was the cause of the crashes seems to overlook the point that Congressional hearings were convened to discuss how the FAA passed it’s certification responsibilities off to Boeing.

Even so, the argument that more competent pilots could have handled the problem is not knowable to Langewiesche and it misses the most basic tenet of air safety anyway. Accident investigations aren’t about blame. There’s no single cause. Investigators are looking for what only so they can get to why.
But here is the striking thing, and how all this relates to First We Change How People Behave. Even Langewiesche, the devotee of airmanship and skeptic of the level of pilot expertise, is forced to admit that it is irresponsible for Boeing to continue to build airplanes that are safe only if flown by exceptional pilots:
Airbus has gone further than Boeing in acknowledging this reality with its robotic designs, though thereby, unintentionally, steepening the very decline it has tried to address. Boeing is aware of the decline, but until now — even after these two accidents — it has been reluctant to break with its traditional pilot-centric views. That needs to change, and someday it probably will; in the end Boeing will have no choice but to swallow its pride and follow the Airbus lead.
Langewiesche's disdain for Airbus' "robotic designs" is strange, because a decade ago he wrote Fly by Wire: The Geese, the Glide, the Miracle on the Hudson. In that book he explained how much assistance the A320's fly-by-wire system gave Chelsey Sullenberger, generally agreed to be a very fine pilot, in successfully ditching in the Hudson River without loss of life after losing both engines from bird-strikes.

Boeing Board to Call for Safety Changes After 737 Max Crashes by David Gelles and Natalie Kitroeff reports:
The committee is expected to deliver its findings to the full Boeing board this week, and call for several meaningful changes to the way the company is structured, according to three people briefed on the matter who spoke on the condition of anonymity because the report has not yet been submitted.

The recommendations will include that Boeing change aspects of its organizational structure, calling for the creation of new groups focused on safety and encouraging the company to consider making changes to the cockpits of future airplanes to accommodate a new generation of pilots, some of whom may have less training.
Exactly. To paraphrase Donald Rumsfeld, "you go fly with the pilots you have, not the pilots you might want or wish to have at a later time".

11 comments:

David. said...

Natalie Kitroeff's Boeing Underestimated Cockpit Chaos on 737 Max, N.T.S.B. Says reports that:

"A monthslong federal investigation into Boeing’s 737 Max plane has called into question some of the most fundamental assumptions used by manufacturers and regulators when certifying aircraft, and challenged Boeing’s repeated assertions that pilots should have been able to easily handle a malfunction on its jet.

The National Transportation Safety Board, which released the results of its review of potential lapses in the design and approval of the 737 Max on Thursday, faulted the company for making erroneous assumptions during the development of the jet and pushed for broader changes in the way airplanes are certified."

David. said...

Andy Pasztor's Plane Tests Must Use Average Pilots, NTSB Says After 737 MAX Crashes reports that:

"Five of the NTSB’s seven recommendations, released Thursday, called for the use of more-objective methods to predict likely responses of airline pilots in such cases when automation goes haywire. The board’s announcement challenged long-held industry and FAA practices that largely use the nearly instantaneous responses of highly trained test pilots—rather than those of average pilots, who typically have less experience—to verify the safety of new jetliner models. Some of the recommendations cover future airliner designs, not just the MAX."

Think about it - adopting the recommendation means that, in an emergency, there's a 50% chance that your pilot isn't as good as the one used for testing. That's better than now, when the chance is maybe 95%, but still not good.

David. said...

Yves Smith's Southwest Pilots Blast Boeing in Suit for Deception and Losses from “Unsafe, Unairworthy” 737 Max reports that:

"At first blush, the suit filed in Dallas by the Southwest Airlines Pilots Association (SwAPA) against Boeing may seem like a family feud. SWAPA is seeking an estimated $115 million for lost pilots’ pay as a result of the grounding of the 34 Boeing 737 Max planes that Southwest owns and the additional 20 that Southwest had planned to add to its fleet by year end 2019. Recall that Southwest was the largest buyer of the 737 Max, followed by American Airlines. However, the damning accusations made by the pilots’ union, meaning, erm, pilots, is likely to cause Boeing not just more public relations headaches, but will also give grist to suits by crash victims."

and:

"the filing also recounts, in gory detail, how Boeing went into “Blame the pilots” mode after the Lion Air crash, insisting the cause was pilot error and would therefore not happen again. Boeing made that claim on a call to all operators, including SWAPA, and then three days later in a meeting with SWAPA.

However, Boeing’s actions were inconsistent with this claim."

David. said...

Boeing 737 Max: European regulators insist on more testing of troubled plane by Edward Helman makes it clear that the FAA has blown its credibility:

"European air safety regulators have told their US counterpart they want more testing on fixes to the troubled 737 Max flight-control systems before the plane is cleared to re-enter service."

David. said...

As expected, Damning Report Faults Boeing and F.A.A. on 737 Max Certification:

"Boeing failed to adequately explain to regulators a new automated system that contributed to two crashes of the 737 Max, and the Federal Aviation Administration lacked the capability to effectively analyze much of what Boeing did share about the new plane.

Those are among the findings in a damning report from a multiagency task force that the F.A.A. convened to scrutinize the Max’s certification process after the second plane crashed in March.
...
The review’s scope was narrow: It only scrutinized the F.A.A.’s certification of the Max's flight control system. But that allowed the task force to review the certification of the new automated system, MCAS, that played a role in both crashes, in Indonesia last October and in Ethiopia in March."

David. said...

Captain Sullenberger weighs in on William Langewiesche's "blame-the-pilot" screed:

"In resurrecting this age-old aviation canard, Langewiesche minimizes the fatal design flaws and certification failures that precipitated those tragedies, and still pose a threat to the flying public. I have long stated, as he does note, that pilots must be capable of absolute mastery of the aircraft and the situation at all times, a concept pilots call airmanship. Inadequate pilot training and insufficient pilot experience are problems worldwide, but they do not excuse the fatally flawed design of the Maneuvering Characteristics Augmentation System (MCAS) that was a death trap. As one of the few pilots who have lived to tell about being in the left seat of an airliner when things went horribly wrong, with seconds to react, I know a thing or two about overcoming an unimagined crisis. I am also one of the few who have flown a Boeing 737 MAX Level D full motion simulator, replicating both accident flights multiple times."

David. said...

David Shephardson's Boeing 2016 Internal Messages Suggest Employees May Have Misled FAA On 737 MAX reports that:

"Boeing Co turned over instant messages from 2016 between two employees that suggest the airplane maker may have misled the Federal Aviation Administration about a key safety system on the grounded 737 MAX, according to documents seen by Reuters.

The FAA confirmed Friday that Boeing told it a day earlier about internal messages it had discovered “some months ago” that characterize “certain communications with the FAA during the original certification of the 737 MAX in 2016.”
...
The messages are between the MAX’s then-chief technical pilot, Mark Forkner, and another Boeing pilot, the sources said, and raised questions about the MCAS’s performance in the simulator in which he said it was “running rampant.”

Forkner has since left Boeing. The Seattle Times reported in September that Forkner repeatedly invoked his Fifth Amendment right to not turn over documents subpoenaed by the Justice Department."

David. said...

Dominic Gates' Boeing’s defense of 737 MAX’s flight-control system in wake of pilot messages stands up
provides a lot of detail showing that the initial response to Forkner's messages was incorrect.

David. said...

Documents Show Safety Concerns at Boeing Before Deadly Crashes by David Gelles and Natalie Kitroeff reports on additional details of the 737 MAX development process revealed during CEO Muilenburg's House grilling:

"One Boeing employee worried the 737 Max might be “vulnerable.” A company document said if pilots didn’t respond to a new automated system within seconds it would be “catastrophic.” A plan to include an alert for the system, known as MCAS, was considered but scrapped.
...
In one partly redacted email from 2015, years before the plane was certified, a Boeing employee questioned whether the system was vulnerable to malfunctioning if a single sensor failed."

David. said...

Dominic Gates' After Lion Air crash, Boeing doubled down on faulty 737 MAX assumptions shows how Boeing both focused on blaming the Lion Air pilots and on concealing MCAS details from the FAA.

David. said...

In The Long-Forgotten Flight That Sent Boeing Off Course, Jerry Useem supports Tkacik's thesis that McDonnell-Douglas' culture led to Boeing's problems. After DOuglas bought Boeing with Boeing's money:

"In the next four years, Boeing’s detail-oriented, conservative culture became embroiled in a series of scandals. Its rocket division was found to be in possession of 25,000 pages of stolen Lockheed Martin documents. Its CFO (ex-McDonnell) was caught violating government procurement laws and went to jail. With ethics now front and center, Condit was forced out and replaced with Stonecipher, who promptly affirmed: “When people say I changed the culture of Boeing, that was the intent, so that it’s run like a business rather than a great engineering firm.” A General Electric alum, he built a virtual replica of GE’s famed Crotonville leadership center for Boeing managers to cycle through. And when Stonecipher had his own career-ending scandal (an affair with an employee), it was another GE alum—James McNerney—who came in from the outside to replace him."