How Boeing's responsibility in a deadly crash 'got buried'

After a Boeing 737 crashed near Amsterdam more than a decade ago, Dutch investigators focused blame on the pilots for failing to react properly when an automated system malfunctioned and caused the plane to plummet into a field, killing nine people.

The fault was hardly the crew's alone, however. Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the accident on the Turkish Airlines flight. But the Dutch Safety Board either excluded or played down criticisms of the manufacturer in its final report after pushback from a team of Americans that included Boeing and federal safety officials, documents and interviews show.

The crash, in February 2009, involved a predecessor to Boeing's 737 Max, the plane that was grounded last year after accidents in Indonesia and Ethiopia killed 346 people and hurled the company into the worst crisis in its history.

A review by The New York Times of evidence from the 2009 accident, some of it previously confidential, reveals striking parallels with the recent crashes — and resistance by the team of Americans to a full airing of findings that later proved relevant to the Max.

In the 2009 and Max accidents, for example, the failure of a single sensor caused systems to misfire, with catastrophic results, and Boeing had not provided pilots with information that could have helped them react to the malfunction. The earlier accident "represents such a sentinel event that was never taken seriously," said Sidney Dekker, an aviation safety expert who was commissioned by the Dutch Safety Board to analyze the crash.

Dekker's study accused Boeing of trying to deflect attention from its own "design shortcomings" and other mistakes with "hardly credible" statements that admonished pilots to be more vigilant, according to a copy reviewed by The Times.

The study was never made public. The Dutch board backed away from plans to publish it, according to Dekker and another person with knowledge of its handling. A spokeswoman for the Dutch board said it was not common to publish expert studies and the decision on Dekker's was made solely by the board.

At the same time, the Dutch board deleted or amended findings in its own accident report about issues with the plane when the same American team weighed in. The board also inserted statements, some nearly verbatim and without attribution, written by the Americans, who said that certain pilot errors had not been "properly emphasised."

The muted criticism of Boeing after the 2009 accident fits within a broader pattern, brought to light since the Max tragedies, of the company benefiting from a light-touch approach by safety officials.

References to Dekker's findings in the final report were brief, not clearly written and not sufficiently highlighted, according to multiple aviation safety experts with experience in crash investigations who read both documents.

One of them, David Woods, a professor at Ohio State University who has served as a technical adviser to the Federal Aviation Administration, said the Turkish Airlines crash "should have woken everybody up."

Some of the parallels between that accident and the more recent ones are particularly noteworthy. Boeing's design decisions on both the Max and the plane involved in the 2009 crash — the 737 NG, or Next Generation — allowed a powerful computer command to be triggered by a single faulty sensor, even though each plane was equipped with two sensors, as Bloomberg reported last year. In the two Max accidents, a sensor measuring the plane's angle to the wind prompted a flight control computer to push its nose down after takeoff; on the Turkish Airlines flight, an altitude sensor caused a different computer to cut the plane's speed just before landing.

A Boeing cockpit simulator. Both the model in the 2009 crash, the 737 NG, and those involved in more recent accidents, the 737 Max, had issues with faulty sensors and computer systems. Photo /Getty

Boeing had determined before 2009 that if the sensor malfunctioned, the crew would quickly recognise the problem and prevent the plane from stalling — much the same assumption about pilot behaviour made with the Max.

And as with the more recent crashes, Boeing had not included information in the NG operations manual that could have helped the pilots respond when the sensor failed.

Even a fix now proposed for the Max has similarities with the past: After the crash near Amsterdam, the FAA required airlines to install a software update for the NG that compared data from the plane's two sensors, rather than relying on just one. The software change Boeing has developed for the Max also compares data from two sensors.

Critically, in the case of the NG, Boeing had already developed the software fix well before the Turkish Airlines crash, including it on new planes starting in 2006 and offering it as an optional update on hundreds of other aircraft. But for some older jets, including the one that crashed near Amsterdam, the update would not work, and Boeing did not develop a compatible version until after the accident.

The Dutch investigators deemed it "remarkable" that Boeing left airlines without an option to obtain the safeguard for some older planes. But in reviewing the draft accident report, the Americans objected to the statement, according to the final version's appendix, writing that a software modification had been unnecessary because "no unacceptable risk had been identified." GE Aviation, which had bought the company that made the computers for the older jets, also suggested deleting or changing the sentence.

The Dutch board removed the statement, but did criticise Boeing for not doing more to alert pilots about the sensor problem.

Woods, who was Dekker's doctoral adviser, said the decision to exclude or underplay the study's principal findings enabled Boeing and its US regulators to carry out "the narrowest possible changes."

The problem with the single sensor, he said, should have dissuaded Boeing from using a similar design in the Max. Instead, "the issue got buried."

Boeing declined to address detailed questions from The Times. In a statement, the company pointed to differences between the 2009 accident and the Max crashes.

"These accidents involved fundamentally different system inputs and phases of flight," the company said.

Asked about its involvement with the Dutch accident report, Boeing said it was "typical and critical to successful investigations for Boeing and other manufacturers to work collaboratively with the investigating authorities."

Joe Sedor, the National Transportation Safety Board official who led the American team working on the Turkish Airlines investigation, said it was not unusual for investigating bodies to make changes to a report after receiving feedback, or for US safety officials to jointly submit their comments with Boeing.

Sedor is now overseeing the NTSB's work on the Max crashes. He acknowledged that reliance on a single sensor was a contributing factor in both cases but cautioned against focusing on it.

"Each of these accidents were complex and dynamic events with many contributing factors," he said. "Boiling them down simply to the number of inputs ignores the many, many more issues that differentiate them."

The FAA, in a statement, also emphasised the "unique set of circumstances" surrounding each accident. "Drawing broad connections between accidents involving different types of emergencies oversimplifies what is, by definition, a complex science," it said.

The agency, also part of the American team in the Dutch investigation, declined to say whether the lessons from the Turkish Airlines crash factored into its decision to certify the Max — which was approved to fly in 2017 and became the fastest-selling plane in Boeing's history.

But a senior FAA official, who was not authorized to speak publicly, praised Dekker's study and said it identified important issues that had not received enough public attention. The official pointed to the similarities — such as the reliance on a single sensor — between the Turkish Airlines crash and the Max accidents.

A spokeswoman for the Dutch board, Sara Vernooij, said it was common practice to amend draft reports in response to outside comments, but she declined to address the specific changes. Other companies and government bodies involved in the investigation, such as the French firm that made the sensors and that country's aviation safety board, also submitted comments, but the American submission was the most extensive.

Vernooij said the Dutch agency regarded the Dekker study as confidential.

"The parts considered relevant by the board were used while writing the final report," she said.

Focus on the pilots

On the morning of February 25, 2009, Turkish Airlines Flight 1951 approached Amsterdam, carrying 128 passengers from Istanbul. The first officer guided the plane toward Runway 18R, calling out changes to its speed and direction. He was new to the Boeing jet, so the crew included a third pilot in addition to the captain, who was a former Turkish air force officer with about 13 years of experience flying the aircraft.

Because of instructions from air traffic control, the crew had to execute a maneuver that could be challenging: slowing while descending more rapidly than normal. They engaged a computer that controlled engine thrust, known as an autothrottle, to help regulate the drop in speed.

As the plane dipped to 1,000 feet (304 metres), the pilots had not yet completed their landing checklist. Strict adherence to airline procedure would have meant circling around for another try, but violations were commonplace at the busy runway, investigators later determined.

About a minute later, with the plane at about 450 feet (137 metres), the pilots' control sticks began shaking, warning of an impending stall. The jet had slowed too much. Immediately, one of the pilots pushed the thrust lever forward to gain speed, but when he let go, the computer commanded it to idle.

A relative of the pilot Hasan Tahsin Arisan mourns over his coffin during a ceremony outside the Turkish Airlines headquarters in Istanbul on February 28, 2009. Photo / AP

The captain intervened, disabling the autothrottle and setting the thrust levers to their maximum. Nine seconds had elapsed since the stall warning. By then, it was too late. The jet plunged into a field less than a mile from the airport.

The three pilots, another crew member and five passengers were killed.

Dutch investigators determined that the cause of the malfunction was a sensor on the plane's exterior measuring altitude. The sensor had mistakenly indicated that the plane was just moments from touchdown, prompting the computer to idle the engines.

For 70 seconds, the autothrottle had done what the crew intended: steadily cut the plane's speed. But the pilots failed to notice that the computer did not then maintain the target speed when it was reached; instead, it continued to slow the plane down. The pilots realized what had happened only when the control stick began vibrating.

Losing track of airspeed is considered a grave error. The pilots, who investigators believe were preoccupied with the landing checklist, also missed multiple warnings that the autothrottle was acting up. The Dutch board's conclusions focused on the decision not to abort the landing, the failure to recognize the dangerous drop in speed and the incorrect response to the shaking control stick, possibly because of inadequate training.

At the request of the American team led by the NTSB, the Dutch added comments that further emphasized the pilots' culpability. The final report, for example, included a new statement that scolded the captain, saying he could have used the situation to teach the first officer a "lesson" on following protocol.

Boeing and American officials emphasised pilot error as a factor in the 2009 crash rather than design flaws. Photo / Ruth Fremson, The New York Times

In their comments, reflected largely in an appendix, the Americans addressed criticism of Boeing in the draft report. A description of the company's procedures for monitoring and correcting potential safety problems was "technically incorrect, incomplete and overly" simplistic, they wrote. In response, the board inserted a description of Boeing's safety program written by the Americans and a statement that Boeing's approach was more rigorous than FAA requirements.

The draft had also referred to studies that found it was common for complex automation to confuse pilots and suggested design and training improvements. The studies, the draft said, included research by "Boeing itself."

The Americans objected, saying the statements "misrepresent and oversimplify the research results." In its final report, the board deleted the Boeing reference.

When the Dutch board announced its conclusions during a news conference, its chairman said, "The pilots could have prevented this."

Missing information

The Dutch Safety Board had also commissioned Dekker's analysis of the accident, which applied an engineering discipline known as human factors. As planes have come to rely on complex computer systems, researchers and investigators have identified design and training practices that can make pilot error less likely.

Dekker, then a professor in Sweden who had investigated other serious crashes and had worked part time flying a 737, acknowledged fatal mistakes by the Turkish Airlines pilots in his 129-page study.

But he also found that Boeing bore significant responsibility.

While his study was never made public, copies circulated among some researchers and pilots. And his role in the investigation was cited in an appendix to the board's report. He is now a professor in Australia and the Netherlands.

In the study, Dekker chastised Boeing for designing the autothrottle to rely on just one of two sensors measuring altitude. That decision, he wrote, left "a single-failure pathway in place," raising the risk that a single error could lead to catastrophe.

Five years before the Turkish Airlines crash, Boeing was aware that a sensor malfunction could idle the engines improperly, but the company decided it was not a safety concern, the Dutch investigators wrote. After receiving reports about autothrottle misfires that did not lead to accidents, a Boeing review board determined that if a malfunction occurred, pilots would recognize it and intervene.

In the meantime, Boeing developed a software update that allowed the autothrottle to compare the readings from the two altitude sensors. If they differed by more than 20 feet, the autothrottle would not be able to improperly idle the engines.

The safeguard was available in 2006, but the change would not work on some 737 NG models, like the Turkish Airlines plane, that used an autothrottle computer made by a different company. After the 2009 crash, Boeing developed a version of the update compatible with those computers, and the FAA required airlines to install it.

The Dekker study found that another decision by Boeing — to leave important information out of the operations manual — had also hampered the Turkish Airlines pilots.

Pieter van Vollenhoven, head of the Dutch Safety Board, spoke with a survivor of the Turkish Airlines crash. Photo / AP

The 737 NG has two parallel sets of computers and sensors, one on the left side of the plane and one on the right. Most of the time, only one set is in control.

On the Turkish Airlines flight, the system on the right was in control. The pilots recognized the inaccurate altitude readings and noted that they were coming from the sensor on the left. This would have led them to conclude that the bad data coming from the left did not matter because the autothrottle was getting the correct data from the right, Dekker found.

What the pilots could not have known was that the computer controlling the engine thrust always relied on the left sensor, even when the controls on the right were flying the plane. That critical information was nowhere to be found in the Boeing pilots' manual, Dekker learned.

Erik van der Lely, a 737 NG pilot and instructor for a European airline who studied under Dekker, told The Times that he had not known about this design peculiarity until he read a copy of the study.

"I'm pretty sure none or almost none of the 737 pilots knew that," he said.

When the draft report criticized Boeing for not giving pilots information that might have helped prevent the accident, the Americans disagreed, citing general directions from the training manual and writing, "Boeing did provide appropriate guidance to flight crews." The plane was "easily recoverable" if the pilots had followed the proper procedures, they said.

In its final report, the board retained its general conclusion but softened some language.

Boeing later made a similar assessment on the 737 Max. The company did not inform pilots of a new automated system that contributed to both deadly crashes, hindering their ability to counteract its erroneous commands, investigators have determined.

Overall, the final report by the Dutch Safety Board did mention some of Dekker's conclusions, but the aviation safety experts who read his study said the systemic issues he raised received too little emphasis.

For example, while the report noted the design quirk not included in the manual, it did so only briefly amid other technical documentation, and the significance of it was unclear. Dekker estimated that the board included the equivalent of about one page of information from his study in its report, which was 90 pages in addition to appendices.

"Failure of responsibility"

Today, faced with a public outcry over the Max crashes and demands for reforms, Boeing and the FAA have agreed that more attention should be paid to the engineering discipline Dekker applied in his study.

Both the NTSB and a panel of international experts found that Boeing and the FAA had not sufficiently incorporated lessons from this human-factors research when developing and certifying the Max.

But even though the research has been around for decades — an FAA study recommended in 1996 that the industry and regulators embrace the approach more readily — accident investigations have tended to focus on pilot errors while minimizing or ignoring systemic factors, such as design and training problems, experts said.

Relatives sprinkle flowers for the victims of the crashed Lion Air flight in 2018. The plane, a 737 Max, crashed after taking off in Indonesia, killing 189. Photo / AP

"It's really easy to blame it on the dead pilots and say it has nothing to do with our improperly designed system," said Shawn Pruchnicki, who teaches at Ohio State and has worked on accident investigations for the Air Line Pilots Association.

Pruchnicki, who studied under Dekker, said he had participated in numerous investigations in which human-factors experts were largely ignored.

"It just gets frustrating because we keep having the same types of accidents," he said.

Woods, the Ohio State professor who has advised the FAA, wrote an email to colleagues shortly after the first 737 Max crash, in October 2018, of Lion Air Flight 610, which killed 189 people just minutes after taking off from Jakarta, Indonesia. The initial details, he wrote, indicated it was an automation-triggered disaster of the sort that he and others had studied for almost 30 years. He cited research from the 1990s and pointed to the Turkish Airlines crash.

"That this situation has continued on for so long without major action is not how engineering is supposed to work," he wrote.

After the second Max crash — in March 2019, of Ethiopian Airlines Flight 302, killing all 157 people on board shortly after takeoff from Addis Ababa — Woods said in an interview, "I was appalled."

"This is such of a failure of responsibility," he said. "We're not supposed to let this happen."

Written by: Chris Hamby
Photographs by: Ruth Fremson
© 2020 THE NEW YORK TIMES