By Dominic Gates
, Steve Miletich
and Lewis Kamb
Seattle Times staff reporters
Seven weeks after the second fatal crash of a 737 MAX in March, a Boeing engineer submitted a scathing internal ethics complaint alleging that management — determined to keep down costs for airline customers — had blocked significant safety improvements during the jet’s development.
The ethics charge, filed by 33-year-old engineer Curtis Ewbank, whose job involved studying past crashes and using that information to make new planes safer, describes how around 2014 his group presented to managers and senior executives a proposal to add various safety upgrades to the MAX.
The complaint, a copy of which was reviewed by The Seattle Times, suggests that one of the proposed systems could have potentially prevented the crashes in Indonesia and Ethiopia that killed 346 people. Three of Ewbank’s former colleagues interviewed for this story concurred.
The details revealed in the ethics complaint raise new questions about the culture at Boeing and whether the long-held imperative that safety must be the overarching priority was compromised on the MAX by business considerations and management’s focus on schedule and cost.
Managers twice rejected adding the new system on the basis of “cost and potential (pilot) training impact,” the complaint states. It was then raised a third time in a meeting with 737 MAX chief project engineer, Michael Teal, who cited the same objections as he killed the proposal.
737 MAX crisis | Complete coverage »
Boeing made erroneous assumptions on pilots’ response to alerts in 737 MAX, NTSB says
Boeing’s board calls for better internal safety oversight in wake of 737 MAX crashes
Boeing CEO sees ‘endgame’ in effort to lift grounding of 737 MAX
More
A version of the proposed system, called synthetic airspeed, was already installed on the 787 Dreamliner.
It was not directly related to the flight-control system — the Maneuvering Characteristics Augmentation System (MCAS) — that contributed to both crashes. But it would have detected the false angle of attack signal that initiated events in both accidents, and so potentially could have stopped MCAS from activating and repeatedly pushing down the nose of each jet.
But installing it in the MAX would likely have meant 737 pilots needed extra training in flight simulators. Running thousands of pilots through simulator sessions would have delayed the jet’s entry into service and added substantial costs for Boeing’s airline customers, damaging the MAX’s competitive edge against the rival Airbus A320neo.
Ewbank’s complaint goes further than the decision not to install this one new system. He describes management as “more concerned with cost and schedule than safety and quality.” And he alleges that in one instance Boeing hid inflight safety incident data from the European Union Aviation Safety Agency (EASA).
As first reported in The Seattle Times, Boeing did an inadequate system safety assessment that missed flaws in the design of MCAS that were central to the two MAX disasters. And Boeing engineers were under pressure to limit safety testing to certify the MAX. These fresh allegations from inside Boeing indicate that the problems with jetmaker’s safety culture may go deeper than MCAS.
Sticking out from the side of a 737 MAX, two pitot tubes for measuring air pressure sit above an angle of attack vane. A new system was proposed for the MAX, but never approved, that would have allowed these different sensors to cross-check each other. That could have enabled detection of a faulty angle-of-attack signal such as those linked to the two fatal crashes of 737 MAX jets. (Mike Siegel / The Seattle Times)
Sticking out from the side of a 737 MAX, two pitot tubes for measuring air pressure sit above an angle of attack vane. A new system was proposed for the... (Mike Siegel / The Seattle Times) More
Submitted via Boeing’s internal whistleblower system, Ewbank’s complaint alleges that MAX program managers, concerned with avoiding higher costs and more pilot training, were intent on “shutting down trade studies that attempted to modernize the airplane and avoiding awareness of known issues encountered in historical 737 operation.”
Federal investigators
The FBI has interviewed at least two Boeing employees about the complaint. It’s unclear how the Boeing document reached the agency, but federal investigators are known to have issued subpoenas to the company.
Department of Justice prosecutors, Department of Transportation inspectors and Securities and Exchange Commission (SEC) officials are all involved in a wide-ranging federal investigation into possible wrongdoing at Boeing during certification of the MAX that was already under way before the engineer filed his internal complaint in April.
Boeing declined to comment on the details of the ethics complaint. Teal, 737 MAX chief project engineer, could not be reached for comment. The Department of Justice also declined to comment. The Seattle Times is not naming the employees who have been questioned by the FBI to protect the identity of the source of that information.
Ewbanks declined to be interviewed. The Seattle Times is naming him because he identified himself in his complaint to Boeing.
Sign up for Evening Brief
Delivered weeknights, this email newsletter gives you a quick recap of the day's top stories and need-to-know news, as well as intriguing photos and topics to spark conversation as you wind down from your day.
The MAX has been grounded worldwide for almost seven months as Boeing works on a comprehensive fix to its flight-control systems that will satisfy air safety regulators around the globe. The final updates to the systems are expected to be submitted to the Federal Aviation Administration (FAA) this month, and Boeing anticipates clearance to return the jet to the sky in November.
Meanwhile, multiple investigations and reviews, internal and external, are examining what caused the deadly crashes. Last week, Boeing’s board announced a revamp of the company’s reporting structures aimed at producing better internal safety oversight. On Monday, Boeing chairman and chief executive Dennis Muilenburg said he’s “taking immediate steps” to implement those recommendations.
The engineer
Ewbank’s ethics complaint expressed concern about the possible personal consequences of stepping forward inside the company.
“Given the nature of this complaint, the fear of retaliation is high, despite all official assurances that this should not be the case,” he wrote. “There is a suppressive cultural attitude towards criticism of corporate policy — especially if that criticism comes as a result of fatal accidents.”
Ewbank wrote that co-workers told him in private they are afraid to speak up about similar safety concerns out of “fear for their jobs.”
In a statement responding to requests for comment this week, Boeing said it “has rigorous processes in place, both to ensure that such complaints receive thorough consideration and to protect the confidentiality of employees who make them.”
“Accordingly, Boeing does not comment on the substance or existence of such internal complaints,” the statement added.
Ewbank’s LinkedIn profile shows he graduated from Embry-Riddle Aeronautical University in 2008 with a degree in aeronautical engineering, then got a master’s at Purdue. After college, he took a job as rocket scientist, doing launch site design engineering at the Kennedy Space Center in Florida with United Space Alliance, the joint venture between Boeing and Lockheed Martin.
He was hired by Boeing in 2010 to work on designing commercial airplane flight deck systems, including the MAX. He now works on airplane systems integration for the 777X program.
However, dissatisfied with his experience on the MAX program, he took a break from Boeing. LinkedIn shows he left the company in April 2015 and returned to work on the 777X only last November. The reason for the career break is cited in the ethics complaint: his feeling that Boeing management was “squeezing the engineering budget for new programs … more concerned with cost and schedule than safety and quality.”
In his first stint at Boeing, he worked on the safety of flight deck systems across multiple jet programs. It put him at the center of what has become one focus of the investigations into the crashes: The systems that tell pilots how their plane is performing in flight and alert them to anything going wrong.
Ewbank’s complaint says his job included “designing appropriate crew alerting and crew procedures based on expected (system) failures.”
Last week, a National Transportation Safety Board (NTSB) report called for improvements to such systems and criticized Boeing’s testing of the MAX for failing to simulate the possible barrage of system failures and warnings the pilots on the crashed flights faced.
The memo
The proposal for system upgrades that Ewbank discusses in his complaint emerged from work he did alongside several veteran employees in Boeing’s Aviation Safety department “to analyze Loss of Control inflight accidents and design flight deck features that would work to break the accident chain of events.”
One was Associate Technical Fellow Randy Mumaw, a cognitive psychologist and “human factors” expert in how pilots react to an airplane’s instruments. Mumaw, who left Boeing in 2015, said that as a non-engineer he can’t assess the technicalities of the synthetic airspeed system. But he said he knew Ewbank as “highly respected and bright.”
The Seattle Times interviewed four former Boeing employees who were involved in the work of assessing the proposed safety upgrades.
Rick Ludtke, a former flight deck integration engineer, worked alongside Ewbank and was a key participant in the proposal, which was presented in an engineering memo titled “Boeing Commercial Airplanes Strategy for Reducing the Risk of Loss of Control Events.”
Ludtke said the purpose of the memo, which Ewbank cites in his complaint, was to “capture the approval” of executives and to try to get a list of six system improvements accepted across Boeing’s airplane programs, including the MAX, which was then in early development.
The memo, which was signed off by Todd Zarfos, the Boeing vice president who heads the company’s engineering design centers, recommended that synthetic airspeed be installed on the MAX “with the next appropriate software update.”
Another veteran Boeing engineer and associate technical fellow, Carlo Ruelos, was the early champion of synthetic airspeed at Boeing.
A pilot flying any airplane needs to know the current airspeed — the plane’s speed relative to the air. Depending on the direction of the wind, that can be faster or slower than the groundspeed, the plane’s speed relative to the earth. Too high an airspeed could stress the airframe. Too low an airspeed could stall the plane.
This key piece of data is measured by pitot-static air pressure sensors, little tubes that stick out of the fuselage on both sides under the cockpit. It’s entered into multiple calculations performed by the flight control computer, so an accurate value is important.
Synthetic airspeed is a new system that provides an additional, indirect calculation of airspeed using different sensors, including the plane’s angle-of-attack sensors. The system enters the airplane’s angle of attack, its weight, the position of its control surfaces and other parameters into a proprietary Boeing algorithm to come up with an independently measured airspeed reading.
The independence of the synthetic reading means that if it matches the direct airspeed readings, it verifies the data as highly reliable. If there’s a discrepancy, the air data is rejected and the plane’s automated systems won’t use it.
Ewbank’s complaint cites a study that found air data reliability, and airspeed awareness in particular, as a “dominant theme” in airplane accidents where the pilots lost control.
The only Boeing airplane using synthetic airspeed today is its latest all-new jet, the 787 Dreamliner.
On the MAX, Ruelos saw an opportunity because the jet had a new integrated air data system box installed that had more computational power than that on the previous 737 NG model. That extra capability, Ruelos decided, would make it possible to add a variant of the 787 synthetic airspeed system to the MAX. And if it could be added, he felt it should be — because it would broadly enhance the reliability of the 737’s air data systems.
Ruelos, now 75 and retired, said in an interview that the pitot and static probes used for standard airspeed measurement“stick out of the airplane and can be damaged by a bird strike. Or something can plug the very small hole.”
So, he said, “I firmly believe that as another means of verifying the air data, (synthetic airspeed) is a key element in maintaining the safety of the airplane.”
“We pushed very hard for it, because safety is always the No.1 priority,” he added. With the new air data avionics box on the MAX, he believed the system was “ready to go” on the new jet.
Rescuers work at the scene of an Ethiopian Airlines jet crash south of Addis Ababa, Ethiopia, March 11, 2019. Boeing’s 737 MAX 8 aircraft has been grounded worldwide as a result of this crash and another last October. (Mulugeta Ayene / The Associated Press)
Rescuers work at the scene of an Ethiopian Airlines jet crash south of Addis Ababa, Ethiopia, March 11, 2019. Boeing’s 737 MAX 8 aircraft has been grounded worldwide as a result of this crash and another last October.... More
The crashes
At the time of this proposal, no one had identified MCAS as a concern. Back then, the original design of MCAS was more benign than the final version that went haywire on the two crash flights. It required two sensors to activate — a high angle of attack and and a high G-force —and was less extensive in its ability to push the nose down.
It wasn’t until March 2016 that the MCAS design was changed to depend solely on a single angle-of-attack sensor.
Synthetic airspeed gains significance in the aftermath of the accidents because the system’s cross-check of the independent airspeed readings would raise a red flag if there’s any angle-of-attack sensor fault. If the readings disagree, Ewbank wrote in his complaint, the system as implemented on the 787 is designed to “monitor and detect erroneous angle-of-attack data, and then work to prevent the use of erroneous data by downstream systems.”
While Ewbank prefaces this statement with a careful qualifier — “It is not possible to say for certain that any actual implementation of synthetic airspeed on the 737 MAX would have prevented the accidents” — his implication is clear: Synthetic airspeed might have stopped MCAS from activating in the circumstances of the two crashed flights.
Ludtke and Ruelos agreed.
There’s “a very good chance” that if Boeing had implemented synthetic airspeed on the MAX, it would have prevented the crashes, Ludtke said.
“In our department, we never designed anything without comparators,” meaning monitors that compare independent sensor readings and de-activate the system if they disagree, he said. “Curtis, I know, had several types of comparators in that synthetic airspeed system.”
Asked separately if synthetic airspeed might have prevented the crashes, Ruelos responded: “I think so. The left and right systems do cross checks, and if there is a discrepancy, it won’t let the automatic system take control of the airplane. … It would disengage and the downstream systems wouldn’t use the data.”
The cost concerns
Of course, Boeing could have achieved the same result in simpler ways, for example if MCAS had been designed from the start to compare readings from the two angle-of-attack sensors instead of only one. Still, in hindsight the rejection of synthetic airspeed seems fateful.
In his complaint, Ewbank puts it down to “a corporate culture … of expediency of design-to-market and cost-cutting.”
“The 737 MAX was designed via piecemeal updates to prevent triggering expensive certification and (pilot) training,” his complaint states.
Ludtke agreed. Synthetic airspeed was rejected “probably because of cost,” he said. He said Boeing had promised the airlines that the MAX would be so minimally different from the prior 737 model that no additional pilot certification or flight simulator training would be necessary.
He said his manager told him Boeing promised MAX launch customer Southwest “$1 million per tail” if the FAA were to require expensive simulator training.
“The MAX program leaders had always mandated that, if it’s not required for function or certification, it’s not going on the airplane,” Ludtke said. They looked upon synthetic airspeed as “a good improvement, but just an improvement,” not a necessity.
“We still tried. Because we believed these aircraft need improving for the quality of pilots we are experiencing,” Ludtke added. “In the old days, before the MAX, that’s how we did business. At the launch of a new program, its leaders would be very interested in including all the latest ideas and safety improvements.
“The MAX was different from the very beginning,” he said. “We’re just going to put these new engines on and the minimum change to make that happen. That’s it. We’re not spending money.”
“That concept broke the company,” Ludtke concluded.
Another former Boeing employee, a veteran test pilot also involved in the assessment of the proposed system changes, wasn’t close enough to the technical details of synthetic airspeed to be sure it would have prevented the accidents, yet agreed that any similar system based on angle of attack likely would have cut out MCAS.
“That’s how you would hope the system would work,” said the pilot, who asked for anonymity to preserve relationships at Boeing.
And the pilot agreed with Ludtke that preserving the MAX’s common type rating — certifying it as just a variant of the prior 737 NG model, rather than a new airplane — and ensuring that airline pilots wouldn’t be required to train for the MAX on flight simulators was “such a huge deal” that it blocked potential updates to the avionics systems.
“I couldn’t believe they kept stretching the 737, both literally (with a longer fuselage) and also in terms of cockpit design,” the pilot said.
The culture
Ray Craig, former chief pilot on the 737 MAX until he retired in 2015, had a very different take. He said he worked with Ewbank and knew him as a “very sharp, very dedicated” engineer.
Yet he defended the safety culture at Boeing and around the MAX program.
“Safety was paramount. If there was something we thought was a safety issue, there was no question, it was taken care of,” Craig said. “But it’s not always a black-and-white decision.”
Lacking full technical details, he wouldn’t venture an opinion about whether synthetic airspeed could have prevented the crashes. “I don’t remember it as ready to go. It wasn’t just a simple plug-and-play,” Craig said. “It wasn’t as program-ready as perhaps some of the folks were thinking. But I don’t remember the exact reason it was shot down.”
Talk to us
We continue to seek information on the design, training and certification of the Boeing 737 MAX. If you have insights, please get in touch with aerospace reporter Dominic Gates at 206-464-2963 or
[email protected]. To communicate on a confidential and encrypted channel, follow the options available at
https://st.news/newstips.
Ewbank’s ethics complaint is much broader than the failure to install synthetic airspeed. He attacks the company’s culture around aviation safety and questions Craig’s and Boeing’s assertion that safety is always paramount.
He recounts an episode in his department when he says Boeing hid in-flight safety incidents from Europe’s aviation regulator. This occurred when EASA found five events where 737s experienced a problem with the autothrottle disconnecting on approach and a confusing alert led to an inappropriate pilot response.
EASA asked if Boeing was aware of any other such events and Ewbank was assigned to search the in-service databases. But when he identified five further similar incidents on 737s, his ethics complaint says his manager decided “to not tell EASA about these events” and that instead “we would fix the issue ourselves.”
Ewbank, a relatively young engineer at the start of his career and with less than six years at Boeing over his two employment stints, even goes so far in the complaint as to directly attack CEO Muilenburg.
He cites Muilenburg’s statement on a quarterly earnings teleconference, just four days before Ewbank filed the ethics complaint, denying that the two recent MAX crashes were due to any “technical slip” by Boeing during the jet’s design or certification. Ewbank calls this “a false statement.”
“When CEO Muilenburg and others state that the Max was a safe airplane as designed, they seriously misrepresent what Boeing Engineering has learned about how data and control functions should be treated,” Ewbank wrote.