How Boeing’s Responsibility in a Deadly Crash ‘Got Buried’


After a Boeing 737 crashed close to Amsterdam greater than a decade in the past, the Dutch investigators centered blame on the pilots for failing to react correctly when an automatic system malfunctioned and brought on the aircraft to plummet into a discipline, killing 9 folks.

The fault was hardly the crew’s alone, nonetheless. Decisions by Boeing, together with dangerous design decisions and defective security assessments, additionally contributed to the accident on the Turkish Airlines flight. But the Dutch Safety Board both excluded or performed down criticisms of the producer in its ultimate report after pushback from a group of Americans that included Boeing and federal security officers, paperwork and interviews present.

The crash, in February 2009, concerned a predecessor to Boeing’s 737 Max, the aircraft that was grounded final yr after accidents in Indonesia and Ethiopia killed 346 folks and hurled the corporate into the worst disaster in its historical past.

A evaluation by The New York Times of proof from the 2009 accident, a few of it beforehand confidential, reveals placing parallels with the current crashes — and resistance by the group of Americans to a full airing of findings that later proved related to the Max.

In the 2009 and Max accidents, for instance, the failure of a single sensor brought on methods to misfire, with catastrophic outcomes, and Boeing had not offered pilots with info that would have helped them react to the malfunction. The earlier accident “represents such a sentinel event that was never taken seriously,” stated Sidney Dekker, an aviation security knowledgeable who was commissioned by the Dutch Safety Board to research the crash.

Dr. Dekker’s research accused Boeing of making an attempt to deflect consideration from its personal “design shortcomings” and different errors with “hardly credible” statements that admonished pilots to be extra vigilant, in line with a copy reviewed by The Times.

The research was by no means made public. The Dutch board backed away from plans to publish it, in line with Dr. Dekker and one other particular person with data of its dealing with. A spokeswoman for the Dutch board stated it was not widespread to publish knowledgeable research and the choice on Dr. Dekker’s was made solely by the board.

At the identical time, the Dutch board deleted or amended findings in its personal accident report about points with the aircraft when the identical American group weighed in. The board additionally inserted statements, some practically verbatim and with out attribution, written by the Americans, who stated that sure pilot errors had not been “properly emphasized.”

The muted criticism of Boeing after the 2009 accident suits inside a broader sample, dropped at mild for the reason that Max tragedies, of the corporate benefiting from a light-touch method by security officers.

References to Dr. Dekker’s findings in the ultimate report had been temporary, not clearly written and never sufficiently highlighted, in line with a number of aviation security specialists with expertise in crash investigations who learn each paperwork.

One of them, David Woods, a professor on the Ohio State University who has served as a technical adviser to the Federal Aviation Administration, stated the Turkish Airlines crash “should have woken everybody up.”

Some of the parallels between that accident and the newer ones are notably noteworthy. Boeing’s design choices on each the Max and the aircraft concerned in the 2009 crash — the 737 NG, or Next Generation — allowed a highly effective pc command to be triggered by a single defective sensor, although every aircraft was outfitted with two sensors, as Bloomberg reported last year. In the two Max accidents, a sensor measuring the plane’s angle to the wind prompted a flight control computer to push its nose down after takeoff; on the Turkish Airlines flight, an altitude sensor caused a different computer to cut the plane’s speed just before landing.

Boeing had determined before 2009 that if the sensor malfunctioned, the crew would quickly recognize the problem and prevent the plane from stalling — much the same assumption about pilot behavior made with the Max.

And as with the more recent crashes, Boeing had not included information in the NG operations manual that could have helped the pilots respond when the sensor failed.

Even a fix now proposed for the Max has similarities with the past: After the crash near Amsterdam, the F.A.A. required airlines to install a software update for the NG that compared data from the plane’s two sensors, rather than relying on just one. The software change Boeing has developed for the Max also compares data from two sensors.

Critically, in the case of the NG, Boeing had already developed the software fix well before the Turkish Airlines crash, including it on new planes starting in 2006 and offering it as an optional update on hundreds of other aircraft. But for some older jets, including the one that crashed near Amsterdam, the update wouldn’t work, and Boeing did not develop a compatible version until after the accident.

The Dutch investigators deemed it “remarkable” that Boeing left airlines without an option to obtain the safeguard for some older planes. But in reviewing the draft accident report, the Americans objected to the statement, according to the final version’s appendix, writing that a software modification had been unnecessary because “no unacceptable risk had been identified.” GE Aviation, which had bought the company that made the computers for the older jets, also suggested deleting or changing the sentence.

The Dutch board removed the statement, but did criticize Boeing for not doing more to alert pilots about the sensor problem.

Dr. Woods, who was Dr. Dekker’s Ph.D. adviser, said the decision to exclude or underplay the study’s principal findings enabled Boeing and its American regulators to carry out “the narrowest possible changes.”

The problem with the single sensor, he said, should have dissuaded Boeing from using a similar design in the Max. Instead, “the issue got buried.”

Boeing declined to address detailed questions from The Times. In a statement, the company pointed to differences between the 2009 accident and the Max crashes. “These accidents involved fundamentally different system inputs and phases of flight,” the company said.

Asked about its involvement with the Dutch accident report, Boeing said it was “typical and critical to successful investigations for Boeing and other manufacturers to work collaboratively with the investigating authorities.”

Joe Sedor, the N.T.S.B. official who led the American team working on the Turkish Airlines investigation, said it was not unusual for investigating bodies to make changes to a report after receiving feedback, or for American safety officials to jointly submit their comments with Boeing.

Mr. Sedor is now overseeing the N.T.S.B.’s work on the Max crashes. He acknowledged that reliance on a single sensor was a contributing factor in both cases but cautioned against focusing on it.

“Each of these accidents were complex and dynamic events with many contributing factors,” he said. “Boiling them down simply to the number of inputs ignores the many, many more issues that differentiate them.”

The F.A.A., in a statement, also emphasized the “unique set of circumstances” surrounding each accident. “Drawing broad connections between accidents involving different types of emergencies oversimplifies what is, by definition, a complex science,” it said.

The agency, also part of the American team in the Dutch investigation, declined to say whether the lessons from the Turkish Airlines crash factored into its decision to certify the Max — which was approved to fly in 2017 and became the fastest-selling plane in Boeing’s history.

But a senior F.A.A. official, who was not authorized to speak publicly, praised Dr. Dekker’s study and said it identified important issues that had not received enough public attention. The official pointed to the similarities — such as the reliance on a single sensor — between the Turkish Airlines crash and the Max accidents.

A spokeswoman for the Dutch board, Sara Vernooij, said it was common practice to amend draft reports in response to outside comments, but she declined to address the specific changes. Other companies and government bodies involved in the investigation, such as the French firm that made the sensors and that country’s aviation safety board, also submitted comments, but the American submission was the most extensive.

Ms. Vernooij said the Dutch agency regarded the Dekker study as confidential. “The parts considered relevant by the board were used while writing the final report,” she said.

On the morning of Feb. 25, 2009, Turkish Airlines Flight 1951 approached Amsterdam, carrying 128 passengers from Istanbul. The first officer guided the plane toward Runway 18R, calling out changes to its speed and direction. He was new to the Boeing jet, so the crew included a third pilot in addition to the captain, who was a former Turkish Air Force officer with about 13 years of experience flying the aircraft.

Because of instructions from air traffic control, the crew had to execute a maneuver that could be challenging: slowing while descending more rapidly than normal. They engaged a computer that controlled engine thrust, known as an autothrottle, to help regulate the drop in speed.

As the plane dipped to 1,000 feet, the pilots had not yet completed their landing checklist. Strict adherence to airline procedure would have meant circling around for another try, but violations were commonplace at the busy runway, investigators later determined.

About a minute later, with the plane at about 450 feet, the pilots’ control sticks began shaking, warning of an impending stall. The jet had slowed too much. Immediately, one of the pilots pushed the thrust lever forward to gain speed, but when he let go, the computer commanded it to idle.

The captain intervened, disabling the autothrottle and setting the thrust levers to their maximum. Nine seconds had elapsed since the stall warning. By then, it was too late. The jet plunged into a field less than a mile from the airport.

The three pilots, another crew member and five passengers were killed.

Dutch investigators determined that the cause of the malfunction was a sensor on the plane’s exterior measuring altitude. The sensor had mistakenly indicated that the plane was just moments from touchdown, prompting the computer to idle the engines.

For 70 seconds, the autothrottle had done what the crew intended: steadily cut the plane’s speed. But the pilots failed to notice that the computer did not then maintain the target speed when it was reached; instead, it continued to slow the plane down. The pilots realized what had happened only when the control stick began vibrating.

Losing track of airspeed is considered a grave error. The pilots, who investigators believe were preoccupied with the landing checklist, also missed multiple warnings that the autothrottle was acting up. The Dutch board’s conclusions focused on the decision not to abort the landing, the failure to recognize the dangerous drop in speed and the incorrect response to the shaking control stick, possibly because of inadequate training.

At the request of the American team led by the N.T.S.B., the Dutch added comments that further emphasized the pilots’ culpability. The final report, for example, included a new statement that scolded the captain, saying he could have used the situation to teach the first officer a “lesson” on following protocol.

In their comments, reflected largely in an appendix, the Americans addressed criticism of Boeing in the draft report. A description of the company’s procedures for monitoring and correcting potential safety problems was “technically incorrect, incomplete and overly” simplistic, they wrote. In response, the board inserted a description of Boeing’s safety program written by the Americans and a statement that Boeing’s approach was more rigorous than F.A.A. requirements.

The draft had also referred to studies that found it was common for complex automation to confuse pilots and suggested design and training improvements. The studies, the draft said, included research by “Boeing itself.”

The Americans objected, saying the statements “misrepresent and oversimplify the research results.” In its final report, the board deleted the Boeing reference.

When the Dutch board announced its conclusions during a news conference, its chairman said, “The pilots could have prevented this.”

The Dutch Safety Board had also commissioned Dr. Dekker’s analysis of the accident, which applied an engineering discipline known as human factors. As planes have come to rely on complex computer systems, researchers and investigators have identified design and training practices that can make pilot error less likely.

Dr. Dekker, then a professor in Sweden who had investigated other serious crashes and had worked part time flying a 737, acknowledged fatal mistakes by the Turkish Airlines pilots in his 129-page study.

But he also found that Boeing bore significant responsibility.

While his study was never made public, copies circulated among some researchers and pilots. And his role in the investigation was cited in an appendix to the board’s report. He is now a professor in Australia and the Netherlands.

In the study, Dr. Dekker chastised Boeing for designing the autothrottle to rely on just one of two sensors measuring altitude. That decision, he wrote, left “a single-failure pathway in place,” raising the risk that a single error could lead to catastrophe.

Five years before the Turkish Airlines crash, Boeing was aware that a sensor malfunction could idle the engines improperly, but the company decided it wasn’t a safety concern, the Dutch investigators wrote. After receiving reports about autothrottle misfires that did not lead to accidents, a Boeing review board determined that if a malfunction occurred, pilots would recognize it and intervene.

In the meantime, Boeing developed a software update that allowed the autothrottle to compare the readings from the two altitude sensors. If they differed by more than 20 feet, the autothrottle wouldn’t be able to improperly idle the engines.

The safeguard was available in 2006, but the change wouldn’t work on some 737 NG models, like the Turkish Airlines plane, that used an autothrottle computer made by a different company. After the 2009 crash, Boeing developed a version of the update compatible with those computers, and the F.A.A. required airlines to install it.

The Dekker study found that another decision by Boeing — to leave important information out of the operations manual — had also hampered the Turkish Airlines pilots.

The 737 NG has two parallel sets of computers and sensors, one on the left side of the plane and one on the right. Most of the time, only one set is in control.

On the Turkish Airlines flight, the system on the right was in control. The pilots recognized the inaccurate altitude readings and noted that they were coming from the sensor on the left. This would have led them to conclude that the bad data coming from the left didn’t matter because the autothrottle was getting the correct data from the right, Dr. Dekker found.

What the pilots couldn’t have known was that the computer controlling the engine thrust always relied on the left sensor, even when the controls on the right were flying the plane. That critical information was nowhere to be found in the Boeing pilots’ manual, Dr. Dekker learned.

Erik van der Lely, a 737 NG pilot and instructor for a European airline who studied under Dr. Dekker, told The Times that he had not known about this design peculiarity until he read a copy of the study. “I’m pretty sure none or almost none of the 737 pilots knew that,” he said.

When the draft report criticized Boeing for not giving pilots information that might have helped prevent the accident, the Americans disagreed, citing general directions from the training manual and writing, “Boeing did provide appropriate guidance to flight crews.” The plane was “easily recoverable” if the pilots had followed the proper procedures, they said.

In its final report, the board retained its general conclusion but softened some language.

Boeing later made a similar assessment on the 737 Max. The company did not inform pilots of a new automated system that contributed to both deadly crashes, hindering their ability to counteract its erroneous commands, investigators have determined.

Over all, the final report by the Dutch Safety Board did mention some of Dr. Dekker’s conclusions, but the aviation safety experts who read his study said the systemic issues he raised received too little emphasis.

For example, while the report noted the design quirk not included in the manual, it did so only briefly amid other technical documentation, and the significance of it was unclear. Dr. Dekker estimated that the board included the equivalent of about one page of information from his study in its report, which was 90 pages in addition to appendices.

Today, faced with a public outcry over the Max crashes and demands for reforms, Boeing and the F.A.A. have agreed that more attention should be paid to the engineering discipline Dr. Dekker applied in his study.

Both the N.T.S.B. and a panel of international experts found that Boeing and the F.A.A. had not sufficiently incorporated lessons from this human-factors research when developing and certifying the Max.



Source link Nytimes.com

Get more stuff like this

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Leave a Reply

Your email address will not be published. Required fields are marked *

Get more stuff like this
in your inbox

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.