Three years after Lion Air Flight 610 crashed into the Java Sea, fresh evidence shows how Boeing built an unsafe plane — and blamed foreign pilots for what went wrong.
Cost-cutting, corporate arrogance, and a new plane that was supposed to be easy to fly. An exclusive excerpt from Flying Blind: The 737 Max Tragedy and the Fall of Boeing.
As passengers filed in behind them and stowed their bags that morning in Jakarta in October 2018, the Lion Air pilots completed their preflight checks amid the modern comforts of the Boeing 737 Max 8. Compared to the earlier 737, which both had flown extensively, the cabin was blissfully quiet, even during the five minutes it took for the big new engines to start up. The pilots’ seats were cushier. Four large color screens arrayed in front of them made altitude and speed readouts easier to see—nothing like the old analog dials that Boeing designers once called the “steam gauges.”
Bhavye Suneja, the captain, told his copilot, who went by the single name Harvino, that he was feeling ill, but in better health he was a sunny, life-of-the-party kind of guy. Suneja was passionate about machines; after this run he planned to fly home to New Delhi, then drive through the highlands near Nepal the next week with his wife of two years, Garima Sethi. Airlines were a family affair for the Sunejas. His mother was a manager at Air India Ltd., and his younger sister aspired to become a pilot. After flight school in California, Suneja had joined Lion Air in 2011, the same year the airline placed what was then the biggest single order in Boeing Co.’s history, a $22 billion Max purchase that co-founder Rusdi Kirana sealed with a handshake from U.S. President Barack Obama.
At the Jakarta airport that morning, Paul Ayorbaba, 43, sent his family a choppy WhatsApp video of his walk down the jetway and onto the Lion Air Max jet, painted a cheery orange and white. In the minutes before the door closed, 22-year-old Deryl Fida Febrianto, a newlywed of two weeks, texted a selfie to his bride as he departed for a job on a cruise ship. Wahyu Aldilla sat with his son, Xherdan Fahrezi, with whom he’d gone to Jakarta for a soccer match.
It was 6:20 a.m. when Lion Air 610 left the runway for a short hop to an island off Sumatra. Neither Suneja nor Harvino knew that a tiny sensor on the left side of the plane called an angle-of-attack vane had a 21-degree misalignment in its delicate innards—an oversight by the mechanics who had inspected it. The nose gear had barely left the ground when Suneja’s control column began shaking, the cue for a potential stall. Alerts signaling faulty altitude and airspeed readings blinked on. Flight data recorders don’t pick up the expressions on pilots’ faces, or the stab in their spines when they sense their machine might kill them.
Lion Air’s short history had included its share of turbulence, but on balance it was one of remarkable ascent. The company’s charismatic co-founder, Kirana, had started out as a distributor of Brother typewriters before opening a travel agency in Jakarta with his brother in the 1990s. In the early days, he would hold up a name board at Soekarno-Hatta International Airport to pick up arriving passengers. Kirana and his brother eventually cobbled together $900,000 and leased an old 737-200 as well as a woeful Soviet-made competitor, the Yakovlev Yak-42. Lion Air began flying in 2000.
By 2015, with Asia’s powerhouse economies producing newly mobile middle-class travelers, Kirana was a billionaire. His airline controlled half the domestic market in Indonesia, a nation of 250 million people living on 17,000 islands stretching 3,000 miles from east to west. At Boeing, Dennis Muilenburg, the buzz-cut Iowa native who became chief executive officer that year, saw untapped markets like Indonesia and talked about how the aerospace industry had reached some kind of cycle-busting new normal.
Boeing had been a giant of American aviation for a century, but a financial reinvention under Muilenburg turned it into something else—a Wall Street darling. In 2017 it had reported a 67% jump in earnings, to $8.2 billion. Boeing’s share price had almost tripled during Muilenburg’s short tenure, reaching more than $386, and his chief financial officer, Greg Smith, told colleagues in one meeting that it could top $800 or $900 if the company kept doing what had made shareholders happy: raising the dividend, buying back shares, and keeping expenses low.
That’s precisely what some people at Boeing feared, according to hundreds of hours of interviews with current and former employees for the book from which this article is adapted, Flying Blind: The 737 Max Tragedy and the Fall of Boeing. Among themselves, they complained about how a company that had once been ruled by engineers who thumbed their noses at Wall Street now celebrated managers for cost-cutting, co-opted regulators, and pressured suppliers with relentless, Walmart-style tactics to cut their prices.
The Max, first delivered in 2017, fit right into this mindset. In emails later handed over to congressional investigators, a Boeing pilot boasted of using “Jedi mind tricks” to convince airlines and regulators there was no need for pilots who’d flown the previous version of the 737 (like Suneja and Harvino) to undergo expensive simulator training on the Max. For airlines, training is a big part of labor costs. Minimizing the expense gave Boeing’s customers one less reason to defect to its European rival, Airbus SE.
Other evidence showed that Boeing pushed for cost reductions in testing and ignored engineers’ entreaties for more sophisticated flight controls. An employee despairing of foul-ups wrote, “This airplane is designed by clowns, who in turn are supervised by monkeys.” The company even turned down a request from Lion Air itself for additional training. “Idiots,” a Boeing pilot grumbled to a colleague about Lion Air.
As the control column shook violently, Harvino, the copilot, asked the captain if he planned to turn the plane around. Suneja, his voice strong despite his illness, told Harvino to get clearance to a holding point to buy some time. “Flight control problem,” Harvino radioed. As Suneja steered toward the new heading, the nose mysteriously dipped. He squeezed a thumb switch on the control column to push it back up. It did, but then the nose dipped again. For eight minutes, the tug of war continued. The blue expanse of Jakarta Bay filled the windows.
Harvino flipped through Boeing’s 737 Quick Reference Handbook, searching pages of emergency checklists for an answer. Airspeed Unreliable. Dual Bleed. Pack Trip Off. Wing-Body Overheat. Nothing seemed to explain the ghost fighting them for control of the plane. Twenty-one times, Suneja pressed the switch to keep the nose pointing up. The plane was cleared for 27,000 feet but had reached less than 6,000. The passengers felt every sickening undulation in their stomachs. Harvino finally got on the phone to ask a flight attendant to come into the cockpit. “Yes, sir,” she answered, replacing the phone with a ca-chunk (audible on the cockpit voice recorder) and opening the door. The captain asked her to send in a Lion Air engineer, who happened to be aboard, to help figure out the problem. The chimes of the intercom sounded as she called him forward.
Suneja, preparing to brief his colleague and probably wanting a look at the handbook himself, told his copilot to take over the controls. The nose dipped again. “Wah, it’s very …” Harvino muttered. He flicked the thumb switch but not as firmly as the captain had. After a few seconds the nose fell again, and again he hit the switch. The jet tilted toward the water. Harvino exclaimed that the plane was pointing down. Suneja, distracted, answered, “It’s OK.” Ten seconds later they were plummeting at 10,000 feet a minute. Harvino pulled desperately on the control column, alarms blaring. (“Sink rate!” warned an automated voice.) The water was now immense and terrifying. Harvino began repeating “Allahu Akbar, Allahu Akbar”—the Muslim expression of faith”—and the robotic voice intoned, “Terrain, terrain.” Suneja was silent.
At 6:32 a.m., the ghost won. Horrified fishermen on a nearby boat watched as the jet, carrying 189 people, hit the sea at an almost vertical angle at 500 miles per hour. Television stations soon began broadcasting images of floating debris and interviewing the victims’ stunned relatives. “I’m sure Dad could swim his way out,” said Nanda Ayorbaba, the 13-year-old daughter of the man who only hours before had sent the choppy video.
Soon the Indonesia Divers Rescue Team was in the water, retrieving cellphones, ID cards, bags, and photos. Winches started pulling up larger pieces of debris, and the divers began hunting for the flight data recorder and cockpit voice recorder. Suneja’s father went to Kramat Jati Police Hospital in East Jakarta, sitting mutely as an orderly swabbed the flesh inside his cheek to collect a DNA sample to identify his son’s remains. During the search, one more name was added to the death toll: A diver, Syachrul Anto, 48, had drowned.
Within hours of the crash, John Hamilton, vice president for engineering at Boeing Commercial Airplanes, convened pilots and flight controls experts in Seattle to discuss what had gone wrong. It wasn’t a long discussion, as Hamilton described it later to congressional investigators. Automated software known as the Maneuvering Characteristics Augmentation System, or MCAS, had deflected the horizontal stabilizer, the tiny wing at the back of the plane, in response to a faulty reading from the misaligned sensor. “We quickly identified that this MCAS activation could have been a scenario,” Hamilton said. “And, once the flight data recorder came up later in the week … we started working on a software change immediately.”
With its spotty safety record, Lion Air took most of the heat for the crash. For almost a decade, until June 2016, the airline had been banned from European Union airspace, along with most other Indonesian airlines, because of concerns about maintenance and training practices in the country. A Lion Air flight overshot a runway at Adisumarmo International Airport in Central Java in 2004, killing 25 people. Another undershot a runway in Bali in 2013 and landed in the water, splitting the fuselage; miraculously, all 108 aboard survived.
A week after the Max accident in Jakarta, grieving family members crowded into a sweaty auditorium for a meeting led by Indonesia’s transport minister. They spotted Lion Air’s Kirana in the crowd and demanded he identify himself. He stood and bowed his head, a gesture they took as either contrition or shame.
At Federal Aviation Administration offices near Seattle, engineers began scouring their files for information about the software in question and discovered what looked like incomplete and inaccurate work by the Boeing employees entrusted to oversee safety matters as the FAA’s authorized representatives. The voluminous system safety assessment for MCAS had been turned over to the agency just four months before the plane was officially certified. The Boeing deputy who’d vetted the software design had categorized the risk of a failure as relatively minor.
But the documents on file reflected the software’s earlier design (Revision C), not the more powerful version later added in flight tests (Revision E). The documents showed the stabilizer had the capacity to adjust a plane’s ascent or descent by 0.6 degrees, but in its final form, the stabilizer could make adjustments at four times that angle. “When they changed the design it drastically changed the potential criticality of the MCAS feature,” says an FAA engineer, who asked not to be identified because he isn’t authorized to speak publicly. “And that was not communicated to the FAA engineers who find compliance [with regulations]. In fact, they didn’t even know about it.”
Boeing’s Safety Review Board, a formal gathering of engineers and pilots, discussed the Lion Air crash in early November. Among themselves, board members had earlier acknowledged some of the software’s flaws. But they’d expected that pilots would safely respond to a misfire of the software. Now they questioned their own assumptions.
Within the fraternity of engineers and pilots, there’s an omertà, and it applied here. Partly this is for self-protection: If someone writes openly about a flaw, it exposes the manufacturer to additional liability for having known about the issues in advance. In the wrangling over a Boeing rudder design blamed for two crashes in the 1990s, plaintiffs’ lawyers had eventually turned up a memo stating “We Have a Problem,” in which engineers acknowledged—even before a second crash—that a rudder valve had the potential to jam. Some at Boeing had seen the anguish it caused colleagues who were asked to explain themselves years later, and they became more careful about what they put in writing.
There was another reason for the reluctance to admit that the design had fallen short—one involving race and nationality, not cost. The empathy Boeing’s aviators might have had for a pilot who looked like them wasn’t being extended to Suneja and Harvino. Conversations at Boeing kept focusing on how Harvino, once he took over the controls, hadn’t been able to trim the plane with the thumb switch. Boeing’s pilots, predominantly older White men, had long shared private jokes about the incompetent crews they ran into overseas. “Too dumb to spell 737,” went a frequent refrain of one pilot, according to someone who heard it. Another trainer would ask rhetorically if “Chung Fo Ho” could handle a given procedure.
The Safety Review Board concluded that Boeing should issue an alert directing pilots experiencing an MCAS problem to a specific checklist in the Quick Reference Handbook—in this case, the one for arresting a runaway stabilizer. The FAA went along with the recommendation on Nov. 7, issuing an emergency airworthiness directive “prompted by analysis performed by the manufacturer.” The bulletin told pilots and airlines that if an erroneous input is received from the angle-of-attack sensor, “there is a potential for repeated nose-down trim commands of the horizontal stabilizer” and, in the anodyne language of aviation, “possible impact with terrain.” It still made no mention of the MCAS software responsible for the malfunction.
In plain language, the directive was saying that Boeing’s brand-new airplane, supposedly a marvel of modern technology, could crash itself into the ground based on bad data from one tiny sensor. It sounded like the kind of single-point failure commercial aircraft weren’t supposed to have. And as Boeing employees began privately talking more with airlines about MCAS, elaborating on how the software worked, the pilot grapevine started jumping.
What most alarmed pilots was that this new feature overturned decades of Boeing design philosophy, the thing the manufacturer had always claimed set it apart from chief rival Airbus. “If it ain’t Boeing I ain’t going,” pilots would say, proud that a computer would never take the plane out of their hands. Now the colossus of American aviation was casually telling them it had done exactly that.
MCAS had been shoehorned into the controls to address a quirk of physical design, and reacting to the new software asked a lot of pilots. They would have to notice, within seconds, that the stabilizer was running away, then start working the right checklist with robotic efficiency. Pilots began registering their concerns in the anonymous Aviation Safety Reporting System maintained by NASA. One captain called the Max flight manual “inadequate and almost criminally insufficient.”
On Nov. 13, Muilenburg, in a gray suit with a crisp white shirt and a purple tie, went on Fox Business to respond to the concerns. “New questions this morning for Boeing,” intoned host Maria Bartiromo. Muilenburg immediately launched into the first point of his mental script. “Well, Maria, I think it’s important that we all express our sympathies for the loss of Lion Air 610, and certainly our thoughts go to the families affected,” he said. “We’ve been very engaged with the investigative authorities throughout,” he continued. In conclusion, he said, “The bottom line here is the 737 Max is safe. Safety is a core value for us at Boeing.”
Bartiromo asked what happened, and Muilenburg essentially blamed the pilots. The airplane “has the ability to handle” a bad sensor like the one suspected in the Indonesian crash, he said; in fact, Boeing had already issued a bulletin pointing pilots to “existing flight procedures.”
Over footage of rescue boats picking wreckage out of the water, Bartiromo asked if he regretted not telling pilots more about the system. “No, again, we provide all the information that’s needed to safely fly our airplanes,” he answered.
Bartiromo pressed: But was that information available to the pilots? “Yeah, that’s part of the training manual, it’s an existing procedure,” Muilenburg said.
“Oh, I see,” she said. But in fact, MCAS wasn’t in the manual, unless you counted the glossary, which defined the term but didn’t explain what the software did. The definition was likely a vestige of an earlier draft, before Boeing persuaded the FAA to delete a fuller description.
In a memo to employees on Nov. 19, Muilenburg reassured them, “We’re going to learn from this accident and continue to improve our safety record.” Some pilots weren’t so willing to let the matter drop. In Shanghai that fall, a couple of Boeing trainers ran into a pilot from American Airlines Group Inc., who laid into them for “the lives that we cost” in Indonesia, as one of the trainers later described the uncomfortable encounter. “Hey, hold on,” one of the Boeing employees responded, cautioning the pilot to wait for more evidence.
Back in Seattle, the trainer joined a half-dozen colleagues for a briefing from Patrik Gustavsson, the chief 737 technical pilot, about how the MCAS software worked. When Gustavsson told them it fired based on a single angle-of-attack vane and that it would continue firing even after a bad reading, “we were universally shocked” says the trainer, who asked to remain anonymous discussing a private conversation. They instantly recognized the flaw in the design. “The pilot’s fighting the jet the entire time,” the trainer says.
Boeing sent a vice president named Mike Sinnett and chief test pilot Craig Bomben to clear the air with pilots from major U.S. customers. On Nov. 27 the two men visited the American Airlines pilots’ union in Fort Worth. Dan Carey, president of the union, had agreed with staffers beforehand that if what they heard sounded insincere, he’d record the conversation. The Boeing executives had been talking for only a few minutes when Carey discreetly turned on his phone’s recorder.
Sinnett has a mellow, almost stultifying voice, and as the recording started he was saying, “One of the things that we see in the press is that Boeing put a system on the airplane and didn’t tell anybody about it.” This was false, he said. “It’s just a little bit of software.” Failures like the one in Indonesia were fully accounted for in the design and certification, Sinnett explained. And it was wrong for the press to call it a “single-point failure,” because “the function and the trained pilot work side by side and are part of the system.” The assertion brought the first of several challenges from a pilot with a rancher’s drawl. “I’m sorry, did you say trained pilot?” interrupted captain Michael Michaelis, who’d gone by the call sign “Taz” as an F-16 pilot in the U.S. Air Force.
“Yes, yes,” Sinnett said. He tried to continue his presentation, but Michaelis and other pilots jumped in again. There was the obvious fact that Boeing hadn’t trained the pilots on MCAS. “These guys didn’t even know the damn system was on the airplane,” Michaelis said. And if it malfunctioned, the pilots said, it would be hard for a pilot in the heat of the moment to diagnose the problem amid all the conflicting alerts.
“We struggle with this,” Sinnett acknowledged. Then he raised an issue that some of the pilots took as a subtle dig at their “airmanship,” a term used among flyers to describe their natural facility for piloting—and by extension, their manhood. If there’s a runaway stabilizer, Sinnett asked them, why does the reason matter? Can’t a pilot in such a situation just run the checklist? The American Airlines flyers knew instinctively that a malfunction like the one on the Lion Air jet would take time to diagnose. “This particular one is masked by so many other distractions,” union spokesman Dennis Tajer answered. “Exactly,” Michaelis agreed.
The plane was still new to the pilots, and few had flown it much or done little more than cursory training on an iPad. Michaelis fumed that, from the accounts he’d read, the software had kept whacking the nose of the plane down: “You’re touching my stick, you know?” Boeing “would’ve had a real shitstorm,” he continued, if the same failure had happened on a Max flight out of Miami and American had dropped a plane into Biscayne Bay. “Somebody at the corporate level made the decision that this isn’t important to brief our pilots on,” he said.
The pilots kept raising scenarios for Sinnett, and they ended up almost talking among themselves. One pilot wondered why he got only 40 minutes of training on the Max when the display was so different from its predecessor’s. Another pointed out that American still didn’t have a Max simulator.
Sinnett finally summoned words to match their intensity. “You’ve got to understand that our commitment to safety is as great as yours,” he said. “It really is. And the worst thing that can ever happen is a tragedy like this. And the even worse thing would be another one. So we have to do all the things we can to make sure that this never happens again.” He said Boeing was working hard on an MCAS update to tame the system. “Not a year, but a couple—maybe six weeks-ish,” he said.
The next day, Indonesian authorities released the results of their preliminary investigation. Their report suggested the pilots had been confused by the automated software and pointed out the mistakes made by the maintenance crew. Boeing put out its own statement that same day, highlighting the maintenance mistakes as the start of the chain of errors.
Soon after, Kirana, Lion Air’s co-founder, got on the phone with Muilenburg. He swore repeatedly and accused Boeing of betraying one of its best customers, according to a person who heard the exchange. He went public, too, telling reporters that the shifting of the blame toward Lion was “without any ethics” and that he planned to cancel the airline’s further orders. Muilenburg coolly responded, via CNBC, that Boeing’s contracts are “long-term arrangements” and “these are not things that can be exclusively canceled on either side.”
Early that December, staffers in the FAA’s Aircraft Certification Service concluded there might be 15 more Max crashes without a software fix, based on a rough estimate that one in every hundred pilots might have trouble handling the rare sensor failure.
Still the Max kept flying. That “six weeks–ish” stretched into months—until a spring morning in Ethiopia, when the ghost appeared in the controls of another Max plane, this one carrying 157 people.
From Flying Blind: The 737 Max Tragedy and the Fall of Boeing, by Peter Robison, to be published on Nov. 30 by Doubleday. Copyright 2021 by Peter Robison
Read original story on Bloomberg