Tweet
Feature
What Really Brought Down the Boeing 737 Max?
Malfunctions caused two deadly crashes. But an industry that puts unprepared pilots in the cockpit is just as guilty.
CreditCreditPhoto illustration by Matt Dorfman
By William Langewiesche
Published Sept. 18, 2019Updated Sept. 20, 2019
On Oct. 29, 2018, Lion Air Flight 610 taxied toward the runway at the main airport in Jakarta, Indonesia, carrying 189 people bound for Bangka Island, a short flight away. The airplane was the latest version of the Boeing 737, a gleaming new 737 Max that was delivered merely three months before. The captain was a 31-year-old Indian named Bhavye Suneja, who did his initial flight training at a small and now-defunct school in San Carlos, Calif., and opted for an entry-level job with Lion Air in 2011. Lion Air is an aggressive airline that dominates the rapidly expanding Indonesian market in low-cost air travel and is one of Boeing’s largest customers worldwide. It is known for hiring inexperienced pilots — most of them recent graduates of its own academy — and for paying them little and working them hard. Pilots like Suneja who come from the outside typically sign on in the hope of building hours and moving on to a better job. Lion Air gave him some simulator time and a uniform, put him into the co-pilot’s seat of a 737 and then made him a captain sooner than a more conventional airline would have. Nonetheless, by last Oct. 29, Suneja had accumulated 6,028 hours and 45 minutes of flight time, so he was no longer a neophyte. On the coming run, it would be his turn to do the flying.
His co-pilot was an Indonesian 10 years his elder who went by the single name Harvino and had nearly the same flight experience. On this leg, he would handle the radio communications. No reference has been made to Harvino’s initial flight training. He had accumulated about 900 hours of flight time when he was hired by Lion Air. Like thousands of new pilots now meeting the demands for crews — especially those in developing countries with rapid airline growth — his experience with flying was scripted, bounded by checklists and cockpit mandates and dependent on autopilots. He had some rote knowledge of cockpit procedures as handed down from the big manufacturers, but he was weak in an essential quality known as airmanship. Sadly, his captain turned out to be weak in it, too.
“Airmanship” is an anachronistic word, but it is applied without prejudice to women as well as men. Its full meaning is difficult to convey. It includes a visceral sense of navigation, an operational understanding of weather and weather information, the ability to form mental maps of traffic flows, fluency in the nuance of radio communications and, especially, a deep appreciation for the interplay between energy, inertia and wings. Airplanes are living things. The best pilots do not sit in cockpits so much as strap them on. The United States Navy manages to instill a sense of this in its fledgling fighter pilots by ramming them through rigorous classroom instruction and then requiring them to fly at bank angles without limits, including upside down. The same cannot be expected of airline pilots who never fly solo and whose entire experience consists of catering to passengers who flinch in mild turbulence, refer to “air pockets” in cocktail conversation and think they are near death if bank angles exceed 30 degrees. The problem exists for many American and European pilots, too. Unless they make extraordinary efforts — for instance, going out to fly aerobatics, fly sailplanes or wander among the airstrips of backcountry Idaho — they may never develop true airmanship no matter the length of their careers. The worst of them are intimidated by their airplanes and remain so until they retire or die. It is unfortunate that those who die in cockpits tend to take their passengers with them.
It was a blue-sky morning in Jakarta, with a few clouds floating offshore to the north. The flight was assigned a standard departure route over the Java Sea. At 6:20 a.m., it was cleared for takeoff. To anyone observing the airplane externally, for instance from the control tower, the takeoff would have appeared ordinary as the Boeing lumbered down the runway and lifted into the air. The first external hint of trouble came about a minute later, after a departure controller cleared the flight for a climb to 27,000 feet. Harvino asked the controller to confirm the airplane’s current altitude as shown on the controller’s display. The request was unusual, and it went unexplained. The controller answered that he showed the altitude as 900 feet, and Harvino acknowledged him without comment as if he concurred.
Twenty-five seconds later (a long interlude in flight), Harvino requested a clearance to “some holding point” where the airplane could linger in the sky. The request was surprising. The controller did not provide a holding point but asked about the nature of the problem. Harvino answered, “Flight-control problem.” He did not mention which kind, but before they die, pilots are rarely so descriptive. Harvino did not declare an emergency. The controller asked about their intended altitude. Harvino answered 5,000 feet, which was strangely low and to this day remains unexplained.
Two and a half minutes after takeoff, as the airplane was climbing through 2,175 feet, it suddenly went into a violent 700-foot dive, rounding out of it at 1,475 feet and pulling into an uncertain climb. No turn was associated with the plunge, so the airplane’s problem seemed to be unrelated to roll control and the age-old menace of a spiral dive. Right from the start of the investigation, suspicions focused on Lion Air 610’s trim mechanism — and specifically on the possibility of a failure known as a runaway trim. Trim refers to an aerodynamic condition related to pitch — the nose-up-or-down attitude of an airplane in flight. It can be thought of as a balance point, or the nose attitude at which an airplane naturally rides when no up-or-down elevator-control deflections are applied. That is a slight simplification, but good enough. Trim is routinely adjusted in flight. In the Boeing 737, the adjustments are made by the use of thumb switches on the control wheels when the pilots are “hand flying” the airplane manually, as they would on takeoff and landing. The thumb switches control an electric mechanism that changes the angle of the horizontal stabilizer — the all-important tail surface that counteracts the natural pitching effects of the wings and provides the necessary aerodynamic balance for flight. In its functioning, the electric trim is smooth, powerful and usually well behaved. On occasion, however, it may start running on its own volition and prompt the airplane to nose up or down. That’s a runaway trim. Such failures are easily countered by the pilot — first by using the control column to give opposing elevator, then by flipping a couple of switches to shut off the electrics before reverting to a perfectly capable parallel system of manual trim. But it seemed that for some reason, the Lion Air crew might not have resorted to the simple solution.
Lion Air 610 climbed to 5,000 feet and stayed there shakily for an additional six minutes. Soon it was out over open water. At some point, Harvino declared the crew’s intent to return to the Jakarta airport. Air-traffic control approved the return and later advised the crew to plan on Runway 25 Left, the one closest to their position. But nothing occurred as a result. The airplane kept flying away from the airport. Harvino asked the controller for the airplane’s speed across the ground. This was another unusual question, given that multiple independent indications of speed should have been available in the cockpit. The controller answered that the groundspeed was 322 knots (371 miles per hour). At that altitude, it was nearing the 737’s maximum engineered aerodynamic airspeed of approximately 340 knots. The airplane was flying unusually fast.
It should have been obvious to air-traffic control that the pilots were struggling, but maybe because they had not declared an emergency, the controller continued to treat them routinely, repeatedly instructing them to maintain their chosen altitude of 5,000 feet and issuing multiple new compass headings to steer. Each new heading involved a banked turn, and each bank complicated the crew’s ability to keep the nose from dropping. It is hard to imagine what the controller was thinking. One of his headings steered the flight away from conflicting traffic, when instead it was the traffic that should have been steered away from the flight. Equally unfortunate was the acquiescence of Suneja and Harvino, who dutifully complied with every air-traffic control request.
At 6:31 a.m., 11 minutes into the flight, Suneja got on the radio for the first time. He did not know their altitude, he told the controller, because all their altitude indicators were showing different values. This is unlikely and has never been explained. Perhaps reflecting the strain he felt, Suneja misidentified himself as Lion Air 650. Appropriately, the controller acknowledged Suneja’s transmission without quibbling and responded, “No restriction.” He meant that Suneja was cleared to fly at whatever altitude he chose. But apparently Suneja did not understand. A few seconds later, he unnecessarily asked the controller for a block clearance to all altitudes 3,000 feet above and below his current altitude for traffic avoidance. The controller, who had just heard Suneja say he did not know his altitude, asked him what altitude he wanted. Suneja answered, “Five thou.”
Suneja was shepherding 188 hapless souls through the sky, 189 if you include his own, and struggling with a confusing failure of some kind. Under stress, his performance had become abysmal. Right from the start — months before the cockpit voice recorder was found and listened to — his obsession with altitude clearances could only be explained as a pilot drowning in minutiae. “Five thou” was his final transmission. Twelve minutes into the flight, Lion Air 610 disappeared from radar.
Airline crashes are rare, and rarer still are crashes that force the grounding of an entire fleet. Lion Air 610 was not immediately among them. But about four months later, on March 10, 2019, an equally new 737 Max flown by Ethiopian Airlines went down on departure from Addis Ababa with the loss of everyone aboard, and within a week all further flights of the 737 Max were stopped worldwide.
After both accidents, the flight-data recordings indicated that the immediate culprit was a sensor failure tied to a new and obscure control function that was unique to the 737 Max: the Maneuvering Characteristics Augmentation System (MCAS). The system automatically applies double-speed impulses of nose-down trim, but only under circumstances so narrow that no regular airline pilot will ever experience its activation — unless a sensor fails. Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane’s flight manuals.
The system in question is complicated, and we will return to it later, but for now it is enough to know that after the loss of Lion Air 610, the company suggested that the 737 Max was as safe as its predecessors. Its tone was uncharacteristically meek, but not for lack of conviction. The company seemed hesitant to point the finger at a prickly customer — Lion Air — that had several billion dollars’ worth of orders on the table and could withdraw them at any time. The dilemma is familiar to manufacturers after major accidents in which it is usually some pilot and not an airplane that has gone wrong. Nonetheless, Boeing’s reticence allowed a narrative to emerge: that the company had developed the system to elude regulators; that it was all about shortcuts and greed; that it had cynically gambled with the lives of the flying public; that the Lion Air pilots were overwhelmed by the failures of a hidden system they could not reasonably have been expected to resist; and that the design of the MCAS was unquestionably the cause of the accident.
But none of this was quite true. The rush to lay blame was based in part on a poor understanding not just of the technicalities but also of Boeing’s commercial aviation culture. The Max’s creation took place in suburban Seattle among engineers and pilots of unquestionable if bland integrity, including supervising officials from the Federal Aviation Administration. Although Boeing’s designers were aware of timetables and competitive pressures, the mistakes they made were honest ones, or stupid ones, or maybe careless ones, but not a result of an intentional sacrifice of safety for gain. As always, there was a problem with like-mindedness and a reluctance by team players to stand out from the crowd. Even more pernicious was the F.A.A.’s longstanding delegation of regulatory authority to Boeing employees — a worry that is perennially available to chew on if you like and may indeed be related to the configuration of the troublesome system as it was installed. Nonetheless, in Seattle, at the level where such small choices are made, corruption, like cynicism, is rare.
That is not meant as a blanket defense of Boeing. On the corporate level, the company is the worst sort of player — a corrosive agent that spreads money around Washington, pushes exotic weapons on Congress, toys with nuclear annihilation, sells all sorts of lesser instruments of death to oppressive regimes around the world and dangerously distorts American society in the ways that President Dwight D. Eisenhower warned against in his prescient 1961 farewell address. But hardly any of that matters in the story of the 737 Max. What sent an expensive new Boeing into the ocean on that beautiful, bright morning in Indonesia? It is understandable to look for a simple answer. Laying the blame on a poorly implemented system, even a complex one, made the accident relatively easy to understand and also provided for a material solution: Simply fix the system. But the focus on a single shoddy component — as the news media and government regulators have rushed to do — has obscured the larger forces that ultimately made these accidents possible.
The paradox is that the failures of the 737 Max were really the product of an incredible success: a decades-long transformation of the whole business of flying, in which airplanes became so automated and accidents so rare that a cheap air-travel boom was able to take root around the world. Along the way, though, this system never managed to fully account for the unexpected: for the moment when technology fails and humans — a growing population of more than 300,000 airline pilots of variable and largely unpredictable skills — are required to intervene. In the drama of the 737 Max, it was the decisions made by four of those pilots, more than the failure of a single obscure component, that led to 346 deaths and the worldwide grounding of the entire fleet.
If you were to choose a location in the developing world in which to witness the challenges facing airline safety — the ossification of regulations and in many places their creeping irrelevance to operations; the corruption of government inspectors; the corruption of political leaders and the press; the pressure on mechanics, dispatchers and flight crews to keep unsafe airplanes in the air; the discouragement, fatigue and low wages of many airline employees; the willingness of bankers and insurers to underwrite bare-bones operations at whatever risk to the public; the cynicism of investors who insist on treating air travel as just another business opportunity; and finally the eagerness of the manufacturers to sell their airplanes to any airline without restraint — you would be hard pressed to find a more significant place than Indonesia.
The country began deregulating its airline industry in the late 1990s in the hope of providing for the sort of fast, low-cost travel that might help bind its islands together. No-frills newcomers who cared nothing for prestige rushed in to compete for the business of bargain-conscious passengers and undercut the flagship national airline, Garuda, in a booming domestic market that started growing at a rate second only to China’s. The free-for-all soon raised questions about how to manage safety. That is a polite way of putting it. A race to the bottom comes to mind.
At the forefront of the boom was a streetwise Jakarta local named Rusdi Kirana, then 36, who came from a humble background, once sold typewriters for a living and became an airport freelancer hustling for scraps of opportunity among the passengers moving through the terminal buildings. Initially that meant wheeling suitcases to and from the curb, holding up name signs in the arrival flows or spotting people who might appreciate some friendly guidance. He was good at the hustle, but little else has been reported about his early work at the airport, except that in the 1990s he and his brother started what they called a travel agency. This was in a pre-electronic era, when the airlines issued paper tickets. In Jakarta, the airport terminals had become marketplaces where thousands of passengers in search of cheap flights hunted for last-minute discounts offered by airlines wanting to fill empty seats at any price. Kirana and his brother stepped in as middlemen, acquiring tickets by the fistful from airline clerks and scalping them to the crowds. The mechanics of the scheme remain murky, but even Garuda profited from Kirana’s hustle. No one complained.
Kirana’s travel agency did not make him rich, but it apparently convinced him that a large, unexploited market existed in Indonesia for cheap flights, and that someday, because of the country’s island geography, air travel might be seen as routine by ordinary people. At the time, the industry remained regulated. Kirana seemed to believe that it was price rather than convenience that counted and that the trips would have to cost about the same as those by ferry and bus. To achieve that, he would have to use his own airplanes and control every aspect of the operation. More important than reducing costs, he would have to fill his airplanes to capacity and keep them flying. He would call the airline Lion Air. To save money, he sketched out the logo and uniforms himself. He approached the Transportation Ministry to inquire about licensing the airline and was laughed off and advised to set up a condom factory instead. But when the industry was deregulated shortly afterward, Kirana could not be denied. He leased a decrepit Boeing 737, and in June 2000, Lion Air started operations, offering low-cost flights on two of Indonesia’s most popular routes.
Within five years, domestic passenger traffic doubled and then tripled. Lion Air’s fleet grew by even larger multiples as the airline gobbled up an increasing share of the market, and Kirana turned out to be a master of financial dealings. The public flocked to him even while reviling his airline for its poor on-time performance and, soon enough, for its safety record. He did not appear to care about the complaints that came in. One afternoon, he pointed to a trash can in his office and said to a businessman I know, “Here’s my complaints department.” People called him ruthless, but shrewd is a better description. Having given up at typewriter sales, he was determined to succeed at something else. He told the businessman that it is a mistake in an airline venture to get wrapped up in the romance and art of flying, because money is what counts. He may have been right, except that this approach reduces pilots to journeymen and ignores the role of airmanship in safety.
The twist is that Kirana could have built his airline on the Airbus 320, an airplane that is less challenging to fly, but instead chose the equivalent Boeing 737, which counts on pilots as the last resort if something mechanical or otherwise goes wrong. I have been unable to speak to Kirana despite multiple attempts to reach him, so I do not know if he cares about these distinctions. For sure, though, he cares that once an airline makes a choice between Airbus and Boeing, changing manufacturers is expensive to do. Simulators, shop equipment, stocks of spare parts and training curriculums have to change. Kirana has become a major Airbus customer — but for other airlines he now controls. As for Lion Air, having begun with Boeing, it stuck with Boeing and by 2005 placed an order for up to 60 Next-Generation 737-900ERs. ER stands for extended range. The 900 is a 220-passenger airplane. The model was unpopular and had garnered not a single customer before Lion Air came along. The deal came close to $4 billion. This got Boeing’s attention.
The deregulated Indonesian airline industry was also attracting attention, but not of the desirable kind. Accompanying the drastic expansion in traffic was a disproportionate rise in accidents. There were many contributing factors, mostly among the budget carriers but affecting Garuda as well: an onrush of inexperienced pilots willing to work long hours for low pay; discouragement among mechanics, ramp workers and dispatchers; pressure to keep airplanes flying despite component failures that should have grounded them; the falsification of cargo and passenger manifests; dual maintenance and flight logs; and corruption permeating the entire system, including even air-traffic control.
In Jakarta, a graybeard captain, speaking to me on the condition of anonymity, described the attitude of the new owners toward their pilots. He said: “The pilots passed the check ride! They can fly the airplanes!” Also, in some owners’ view, the semiannual simulator training is wasteful because the simulators are costly to run and maintain, and while the pilots are playing around in them (while collecting their pay), they are not out producing revenue. Normally two pilots train in a simulator at a time, with an instructor seated behind them — so, three in the box. I was told that in Indonesian simulators, there are sometimes seven in there: two pilots flying, one instructing and four others standing up and logging the time.
One Indonesian newcomer was a low-cost airline called Adam Air, which was a Lion Air competitor for several years. Its disregard of safety ran the gamut and resulted in the dispatch of shabby airplanes in the hands of beleaguered pilots. (Former Adam Air employees could not be reached for comment.) Many pilots quit out of disgust or fear. I know how it feels, because as a young man I flew for fly-by-night cargo operators in the United States and suffered most of the survivable failures known to pilot-kind — engine failure, engine fire, electrical failure, electrical fire, radio failure, radar failure, pressurization failure, wing-flap failure, landing-gear failure, gyroscopic failure, airspeed-indication failure, altimeter failure, anti-ice failure, personal (girlfriend) failure, tail-tin-canning lightning-strike failure and trim failures at least four times. By trim failures, I mean runaway trims. Our mechanics laughed about “pencil whipping” the airplanes into the air, and we agreed that the paperwork was a joke. The F.A.A. inspected it and never caught on. But we carried only freight. One winter night, one of our pilots died. He was taken down by a de-icing failure over high terrain inbound to Los Angeles, and none of us were surprised.
But Adam Air carried unwitting passengers. Its president director was a wealthy young man named Adam Suherman, who lived in Los Angeles for a few years. One day, he went back to Jakarta and, with the help of family money, started an airline. It began flying in December 2003. One of its 737s — an airplane that had been around the block for 18 years and was leased from Wells Fargo — was written up by pilots for recurring defects 154 times over the final three months of 2006. The number was high because the defects were not fixed. By far the largest number of defects was related to discrepancies between the airplane’s two independent inertial reference systems, navigational and flight instrumentation drivers that are important to the safe completion of a flight.
Speaking about Adam Air, Dave Carbaugh, a former Boeing test pilot and one of the world’s top aviators, who trained airline pilots throughout Asia, told me: “They kept dispatching a faulty aircraft. Eventually they ran into a crew that couldn’t handle it.” It happened on New Year’s Day in 2007. While flying through an area of bad weather at 35,000 feet, the crew noticed discrepancies between the navigational systems; while fiddling with a solution, they switched off the autopilot unintentionally and drifted into a bank that turned into an uncontrolled spiral dive, during which the descent rate exceeded 50,000 feet per minute and the airplane approached the speed of sound before the captain pulled the wings off in flight. All 102 occupants died in terror.
Seven weeks later, another Adam Air 737 flew an erratic approach to the Surabaya airport among thunderstorms and made a landing so hard that its fuselage cracked and was badly bent, leaving the aft section drooping toward the pavement. No passengers were seriously injured, but the airplane had to be written off. The airline did not provide investigators with the identities of its pilots and was not forced to. Their training histories and qualifications therefore remain unknown. In 2008, Adam Air lost yet another 737 and was grounded by the Indonesian government. The airline declared bankruptcy and ceased operations. Adam Suherman faded from view. The more important point was that Adam Air no longer posed a threat to the flying public.
By 2007, Garuda, the national airline, had a notoriously bad safety record. Two weeks after Adam Air’s bent-airplane episode in Surabaya, a Garuda captain at the controls of a 737 bound for another airport on the island of Java allowed the airplane to get too high on the approach and tried to resolve the problem by pointing the nose down and diving at the runway despite the co-pilot’s calls to abort the approach and circle around. The captain got the airplane going so fast that when he called for flaps to configure for landing, the co-pilot did not dare extend them for fear of structural damage and did not communicate his doubts to the captain. Investigators later criticized the co-pilot for poor teamwork, specifically for not taking control of the airplane, but short of clubbing the captain into submission, there wasn’t much he could do. The airplane landed long, touched down going 100 miles an hour too fast, bounced three times and went careering off the far end of the runway, slicing through an airport perimeter fence and sliding across a road, a ditch and an embankment before coming to rest in a rice paddy and bursting into flames. Because rescue vehicles could not cross the ditch, firefighters could not get their equipment close enough to suppress the flames effectively, and the fire burned for more than two hours. The captain and the co-pilot were not hurt, but 21 people died and others were severely injured.
Garuda was the last straw. From 2003 to 2007, the Indonesian accident rate as measured by fatal flights per million departures had grown to be 15 times as high as the global average. The United States Embassy in Jakarta advised Americans to avoid travel on Indonesian airlines, though within Indonesia that was practically impossible to do. As usual, the numbers worked in favor of individual travelers: Even on the worst Indonesian airlines in the worst of times, the chances of being killed were minuscule. But for foreign governments that had become the self-anointed guardians of their citizens worldwide, the exposure was similar to that of the airplane manufacturers, though less consequential: Inevitably, accidents would continue to occur in Indonesia, and foreigners would die, and it would be hard for their officials to duck accountability unless the officials had registered concern in advance.
In 2007, the European Union and the United States permanently banned all Indonesian airlines from their national territories. This was done for reasons of safety. The ban was largely symbolic, because the Indonesians were focused on their expanding regional markets and had no immediate plans to open such long-distance routes, but it signaled official disapproval of Indonesia’s regulatory capabilities and served as a public critique of a group of airlines, some of which were out of control. Residents of Europe and the United States generally did not know or care, but many of the ordinary Indonesians who had grown to hate their airlines were in favor of the ban simply as a form of punishment. Deregulation had transformed Indonesia into a complicated Wild East of flying, inhabited by consumers who were immune to prestige, just as Lion Air’s Kirana had predicted.
The ban put Boeing and Airbus into a delicate position. They would now be selling airplanes to officially declared unsafe airlines that the American and European authorities expected would keep killing and injuring their passengers at a rate that would be unacceptable in the West. By 2007, the biggest of those airlines was Lion Air. That year, it placed a new order for 40 additional 737s, and Boeing happily agreed to fill it. In 2011, Lion Air returned to the table with what at the time was the largest commercial order in aviation history, a $22 billion deal for 230 units of the 737, including 201 units of the coming 737 Max. The deal was finalized during an Asean summit meeting in Bali that was attended by President Barack Obama. Photographs show Obama looking on approvingly as Kirana and a senior Boeing executive signed the contract. No mention was made in the associated news reports that Lion Air was considered to be a dangerous airline and that it was banned from the United States.
Lion Air had been contributing to the casualties almost since its inception. By the time of the signing ceremony in Bali, it was responsible for 25 deaths, a larger number of injuries, five total hull losses and an unreported number of damaged airplanes. An old truth in aviation is that no pilot crashes an airplane who has not previously dinged an airplane somehow. Scratches and scrapes count. They are signs of a mind-set, and Lion Air had plenty of them, generally caused by rushed pushbacks from the gates in the company’s hurry to slap airplanes into the air. Kirana was once asked why Lion Air was experiencing so many accidents, and he answered sincerely that it was because of the large number of flights. Another question might have been why, despite so many crashes, the death toll was not higher. The answer was that all of Lion Air’s accidents happened during takeoffs and landings and therefore at relatively low speed, either on runways or in their immediate obstacle-free vicinities. These were the brief interludes when the airplanes were being flown by hand. The reason crashes never happened during other stages of flight is most likely that the autopilots were engaged.
Boeing knew it had a problem. A widespread culture of corruption lay at the core, but that was beyond anyone’s ability to reform. Instead, Boeing decided to intervene at its own expense to raise standards at Lion Air and try to reduce its contributions to the accident rate. Both Boeing and Airbus had taken larger such actions before. Foremost were their epic interventions in China that gathered speed in the late 1980s and endured for years. At the start, civil aviation in China was a mess, with one of the highest accident rates in the world.
Dave Carbaugh, the former Boeing test pilot, spent his first 10 years with the company traveling the globe to teach customers how to fly its airplanes. He mentioned the challenge of training pilots in Asia. “Those were the rote pilots,” he said, “the guys standing up in the back of a sim. They saw a runaway trim. They saw where and how it was handled in the curriculum — always on Sim Ride No. 3. And so on their Sim Ride No. 3, they handled it correctly, because they knew exactly when it was coming and what was going to happen. But did they get exposed anywhere else? Or did they discuss the issues involved? No. It was just a rote exercise. This is Step No. 25 of learning to fly a 737. Period.” I asked about China specifically. He said: “The Chinese? They were probably the worst.” He spent every other month in China for years. He said: “They saw flying from Beijing to Tianjin as 1,352 steps to do. Yet if they flew from Beijing to Guangzhou, it was 1,550 steps. And they didn’t connect the two. It would get so rote that they just wouldn’t deviate. I remember flying with a captain who would never divert no matter how many problems I gave him. I asked him, ‘How come?’ He said, ‘Because the checklist doesn’t say to divert.’ ”
That changed over time. With the support of the Chinese government, which went so far as to delegate some regulatory functions to foreigners like Carbaugh, the manufacturers were able to instill a rigorous approach to safety in a small cadre of pilots and managers, who in turn were able to instill it in others. The effort was made not out of the goodness of the manufacturers’ hearts, but out of calculations related to risk and self-preservation. It is widely seen to have been a success. Today the Chinese airlines are some of the safest in the world.
This was the history that Boeing had in mind 10 years ago when it decided to intervene with Lion Air. Carbaugh said: “Boeing spent a shitpot full of money trying to bring those folks up to Western standards. We could only do so much, but we knew we had to try. It was an extraordinary effort.” But it was not good enough. Lion Air continued to crash airplanes around runways as it had before. The Indonesian authorities lacked the political will to rein that in. It is no secret that Rusdi Kirana prioritized efficiency over regulation. Recently he made it clear that he also resented Boeing as being presumptuous and typically condescending. “They look down on my airline and my country,” he told Reuters. “They treat us as third-world.”
It was perhaps inevitable that the relationship between Boeing and Lion Air would prove fractious. Boeing became the world’s pre-eminent commercial airplane manufacturer in part because it developed a coherent design philosophy that relied on pilots’ airmanship as the last line of defense. It made sense in an era when airplanes were vulnerable to weather and prone to failures and pilots intervened regularly to keep airplanes from crashing. By the 1980s, however, the situation had evolved. It became apparent that because of engineering improvements, very few accidents were caused by airplanes anymore, and almost all resulted from pilot error. This occurred at a time when airlines were being deregulated, discount carriers were springing up, major new markets were beginning to appear in developing countries, pilots’ unions were being busted, pilots’ salaries were in steep decline and airmanship globally was being eroded by an increasing reliance on cockpit automation, production-line training and a rote approach to flying.
In the face of these changes, Boeing clung resolutely to its pilot-centric designs, but in Toulouse, France, the relative newcomers at the European consortium called Airbus were not nearly as shy. Led by an outspoken former military test pilot turned chief engineer named Bernard Ziegler, Airbus decided to take on Boeing by creating a robotic new airplane that would address the accelerating decline in airmanship and require minimal piloting skills largely by using digital flight controls to reduce pilot workload, iron out undesirable handling characteristics and build in pilot-proof protections against errors like aerodynamic stalls, excessive banks and spiral dives. The idea was that it would no longer be necessary to protect the public from airplanes if Airbus could get airplanes to protect themselves from pilots.
The approach was diametrically opposed to Boeing’s. Ziegler announced that he was going to build an airplane that even his concierge could fly. The implicit insult won him the enmity of some French airline pilots, who then as now thought highly of themselves. Ziegler told me he received death threats and lived under police protection for a while. But his efforts led to the smartest airplane ever built, a single-aisle medium-range “fly-by-wire” masterpiece called the A320 that entered the global market in 1988, led the way to all other Airbus models since and has been locked into a seesaw battle with Boeing’s relatively conventional 737s for the past 30 years.
You might think that the 737 would have grown increasingly disadvantaged given the New World qualities of the A320, but in my estimation pilots have managed to crash the 320 at about the same rate, largely because of confusion over automation. In other more positive ways, the 737 and A320 were closely matched: same payloads and performance, same operating costs, same potential for profit-making. That threatened to change in 2010 when Airbus introduced a version of the 320 called the Neo (for “new engine option”) that offered large improvements in fuel efficiency, range and payload. The following year, American Airlines warned that it might abandon Boeing and buy hundreds of the new Airbus models. Boeing responded with a rush program to re-engineer the 737, modify the wings and make other changes to improve the performance of the airplane and give it some perceptible advantage over the A320Neo.
The rush took five years to complete. Boeing called the result the Max. To keep costs down, as with all previous iterations, the redesign had to lie within the original 1968 F.A.A. certification of the type and not be treated officially as a new airplane. Airbus had similar requirements for the Neo. In its marketing literature comparing the Max to the earlier Next-Generation 737, Boeing wrote: “same pilot type rating, same ground handling, same maintenance program, same flight simulators, same reliability.” Equally important was that it had to have the same flying characteristics. This was a regulatory necessity if the Max was to escape onerous reclassification as a new airplane. And there was a problem. Boeing test pilots discovered that the Max had unusual stall characteristics when the wing flaps were up and the engines were thrusting.
Aerodynamic stalls are central to the Boeing 737 saga, so let’s explore them briefly now. Airplanes fly because their wings greet the oncoming air at a positive angle, known as an angle of attack. The faster an airplane flies, the lower the angle of attack needs to be to generate the necessary lift. Conversely, the slower an airplane flies, the greater the angle of attack needs to be. But at some point, the angle of attack becomes too great for the oncoming air to negotiate smoothly. As the airplane approaches that critical angle, the first event is a stall warning in the cockpit. In the 737, it is a rattling “stick shaker” that vibrates the control columns and is meant as an urgent warning to lower the nose. If the pilot does not respond, the airflow starts to boil across the top of the wings, sometimes causing buffets that shake the airplane, before separating from the wings conclusively at the moment of the stall. At that point, the wings’ effectiveness is hugely degraded, roll control becomes difficult and the nose drops unavoidably in what is known as a G-break, so called because it may be felt as a brief lessening of the normal (unaccelerated) 1-G pull of gravity.
The nose drop can be drastic, typically about 30 degrees in a classic 737. Now fully stalled, the airplane enters into a precipitous, low-airspeed descent — a condition referred to as mushing that if left unattended will lead to a catastrophic impact with the ground. The event does not take long. In June 2009, when an Air France crew stalled a twin-aisle Airbus 330 on a night flight from Rio de Janeiro to Paris, the descent required merely three minutes and 30 seconds from 38,000 feet to the ocean’s surface. Start to finish, that was an exercise in poor airmanship. Investigators later determined that the Air France flight — a heavy jet stalling at absurdly high angles of attack — passed the point of possible recovery as it mushed down through 12,000 feet. After that, it was just as a co-pilot said before pancaking into the Atlantic: “[Expletive], we’re dead.”
The Max’s stall characteristics, which indirectly bear on the accidents, have been widely reported as being an unusual tendency to pitch up when the airplane is flown at high angles of attack, in realms beyond the stick shaker where airline pilots never go. But pitching up into a stall is a characteristic of all jets with underslung engines, and the tendency in the Max, though slightly stronger than in previous 737s, was probably not sufficiently different to rouse the F.A.A. during the airplane’s testing and certification process. Rather, it was an entirely new characteristic that caused regulatory concern. During stall testing in the Max, the area of buffet was found to be unusually wide, and the G-break, when it occurred, was unusually mild. More important, within the buffet zone as the airplane approached the stall, the control forces — the necessary backpressure on the control column — did not increase in a conventional linear manner as they had in previous 737s and as certification standards required. As a mild behavioral quirk, this was a remote concern, and it occurred in an area of the flight envelope where airline pilots never go. But if the Max was to avoid designation as an entirely new model, the control-force problem needed to be addressed.
Some at Boeing argued for an aerodynamic fix, but the modifications would have been slow and expensive, and Boeing was in a hurry. Its solution was to create synthetic control forces by cooking up a new automated system known as the MCAS to roll in a burst of double-speed nose-down stabilizer trim at just the right moment, calculated largely by angle of attack. There were two other conditions for MCAS activation: the wing flaps had to be up and the autopilot off. The logic of those conditions is clear, but not worth the digression here. After some initial tweaking, the system produced control forces that closely mimicked those of the earlier 737 models, allowing the Max to avoid onerous recertification. Indeed, on initial impulse the artificial forces were so realistic that Boeing convinced itself (and the F.A.A.) that there was no need to even introduce the MCAS to the airplane’s future pilots. The omission meant that the possibility of a false positive in cruising flight — a pushover occurring where it naturally would not — would likewise not be addressed. Boeing believed that in the worst case, a false positive would present as a mere runaway trim, a problem any pilot would know how to handle. The 737 features two prominent toggle switches on the center pedestal whose sole purpose is to deal with such an event — a pilot simply switches them off to disengage the electric trim. They are known as trim cutout switches. They are big and fat and right behind the throttles. There is not a 737 pilot in the world who is unaware of them. Boeing assumed that if necessary, 737 Max pilots would flip them much as previous generations of 737 pilots had. It would be at most a 30-second event. This turned out to be an obsolete assumption.
It took several months and the slow and reluctant release of investigative findings before the inside story of the tragedy of Lion Air 610 could be told. That story actually starts three days before the accident, when the same airplane — under different flight numbers and Lion Air crews — experienced errors in airspeed and altitude indications on the captain’s (left side) flight display that weren’t properly addressed. Those indications are driven by a combination of sensors on the surface of the airplane. A set of independent duplicate sensors drive the co-pilot’s (right side) display. A third standby system provides additional independent backup and allows for intuitive troubleshooting when any one of the three systems fails: If two indications agree and the third one does not, the odd one out is obviously the one to ignore. This sort of arrangement helps to explain why flying a Boeing is not normally an intellectual challenge. Furthermore, the airplane provides an alert when airspeed or altitude indications disagree.
All the faulty indications on that airplane were only ever on the captain’s side. The respective crews wrote them up repeatedly. During intervals on the ground, the airline’s technicians ran built-in tests, got coded responses and did plug-out plug-in reboot attempts of the mindless sort performed at automotive service centers. None of it worked here, but the technicians kept zeroing the fault messages and approving the airplane for flight. Two days before the final flight, the airplane was in Bali, and technicians did more of the same. Additionally, in response to an error message indicating possible failures in angle-of-attack information, they replaced the angle-of-attack vane on the nose of the airplane on the captain’s side. Angle-of-attack vanes are exposed to the winds and are vulnerable to impact, ice and wear. The replacement vane put onto this airplane in Bali was older than the airplane itself. It was a used part that had been provided by a shop in Miramar, Fla., and shipped to Lion Air one year before. In the maintenance log in Bali, the company technicians documented replacing the angle-of-attack vane and testing it. They wrote, “Installation test and heater test result good.”
I had some doubts whether these tests were really run, and I mentioned these doubts to John Goglia, a no-nonsense Bostonian who spent 35 years as an airline mechanic and an additional nine years as a board member of the competent crash-investigation unit of the United States government, the National Transportation Safety Board. Goglia has followed the investigations surrounding the 737 Max closely. Speaking of the Lion Air mechanics, he said: “They’re full of shit. They suspected they found the problem in Bali. So they replaced one problem with another — a dubious unit from Cockroach Corner in Miami. Cockroach Corner is the source of tons of suspected unapproved parts. Many of those repair stations in Miami are junk peddlers.” And the Lion Air mechanics? He said: “They didn’t finish, whatever the log says. They didn’t do an adequate check of the systems.” If they had, in Goglia’s view, they would have seen that the unit was faulty.
According to the official narrative, which — discounting its omissions — seems to be mostly true, when a fresh crew arrived to take the next run, a night flight 600 miles west to Jakarta, a technician showed the new captain the maintenance log and explained that the angle-of-attack sensor on the left side had been replaced. The captain informed the co-pilot and said that he himself would do the flying. They would have a hitchhiker in the cockpit, sitting on the jump seat just behind them. He was an off-duty pilot and, according to one Indonesian pilot I spoke to, a 737 Max captain for a Lion Air subsidiary. For mysterious reasons, this man was not mentioned in subsequent Indonesian accounts. When I asked a senior investigator about the omission, he explained that it was because the investigators had been busy. Only recently and reluctantly have the Indonesians acknowledged the third pilot’s presence, though, as it happened, he played an important role.
None of the Bali crew have been named, and access to them has been blocked. The airplane took off at 10:20 p.m. with 189 people aboard, or 190 if the ghost in the cockpit is included. Immediately after liftoff, the captain’s airspeed indication failed, airspeed-disagreement and altitude-disagreement warnings appeared on his flight display and his stick shaker began to rattle the controls in warning of an imminent stall.
Comment