How Boeing's responsibility in a deadly crash 'got buried'

Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the accident on the Turkish Airlines flight. PHOTO: AFP

NEW YORK (NYTIMES) - After a Boeing 737 crashed near Amsterdam more than a decade ago, Dutch investigators focused blame on the pilots for failing to react properly when an automated system malfunctioned and caused the plane to plummet into a field, killing nine people.

The fault was hardly the crew's alone, however. Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the accident on the Turkish Airlines flight.

But the Dutch Safety Board either excluded or played down criticisms of the manufacturer in its final report after pushback from a team of Americans that included Boeing and federal safety officials, documents and interviews show.

The crash, in February 2009, involved a predecessor to Boeing's 737 Max, the plane that was grounded last year after accidents in Indonesia and Ethiopia killed 346 people.

A review by The New York Times of evidence from the 2009 accident, some of it previously confidential, reveals striking parallels with the recent crashes - and resistance by the team of Americans to a full airing of findings that later proved relevant to the Max.

In the 2009 and Max accidents, for example, the failure of a single sensor caused systems to misfire, with catastrophic results, and Boeing had not provided pilots with information that could have helped them react to the malfunction.

The earlier accident "represents such a sentinel event that was never taken seriously," said Sidney Dekker, an aviation safety expert who was commissioned by the Dutch Safety Board to analyse the crash.

Dekker's study accused Boeing of trying to deflect attention from its own "design shortcomings" and other mistakes with "hardly credible" statements that admonished pilots to be more vigilant, according to a copy reviewed by The Times.

The study was never made public. The Dutch board backed away from plans to publish it, according to Dekker and another person with knowledge of its handling. A spokeswoman for the Dutch board said it was not common to publish expert studies and the decision on Dekker's was made solely by the board.

At the same time, the Dutch board deleted or amended findings in its own accident report about issues with the plane when the same American team weighed in. The board also inserted statements, some nearly verbatim and without attribution, written by the Americans, who said that certain pilot errors had not been "properly emphasised."

References to Dekker's findings in the final report were brief, not clearly written and not sufficiently highlighted, according to multiple aviation safety experts with experience in crash investigations who read both documents.

One of them, David Woods, a professor at Ohio State University who has served as a technical adviser to the Federal Aviation Administration, said the Turkish Airlines crash "should have woken everybody up."

Some of the parallels between that accident and the more recent ones are particularly noteworthy. Boeing's design decisions on both the Max and the plane involved in the 2009 crash - the 737 NG, or Next Generation - allowed a powerful computer command to be triggered by a single faulty sensor, even though each plane was equipped with two sensors, as Bloomberg reported last year.

Boeing had determined before 2009 that if the sensor malfunctioned, the crew would quickly recognise the problem and prevent the plane from stalling - much the same assumption about pilot behavior made with the Max.

And as with the more recent crashes, Boeing had not included information in the NG operations manual that could have helped the pilots respond when the sensor failed.

Even a fix now proposed for the Max has similarities with the past: After the crash near Amsterdam, the FAA required airlines to install a software update for the NG that compared data from the plane's two sensors, rather than relying on just one. The software change Boeing has developed for the Max also compares data from two sensors.

Critically, in the case of the NG, Boeing had already developed the software fix well before the Turkish Airlines crash, including it on new planes starting in 2006 and offering it as an optional update on hundreds of other aircraft. But for some older jets, including the one that crashed near Amsterdam, the update would not work, and Boeing did not develop a compatible version until after the accident.

The Dutch investigators deemed it "remarkable" that Boeing left airlines without an option to obtain the safeguard for some older planes. But in reviewing the draft accident report, the Americans objected to the statement, writing that a software modification had been unnecessary because "no unacceptable risk had been identified."

The Dutch board removed the statement, but did criticize Boeing for not doing more to alert pilots about the sensor problem.

Woods, who was Dekker's doctoral adviser, said the decision to exclude or underplay the study's principal findings enabled Boeing and its US regulators to carry out "the narrowest possible changes."

The problem with the single sensor, he said, should have dissuaded Boeing from using a similar design in the Max. Instead, "the issue got buried." Boeing declined to address detailed questions from The Times.

In a statement, the company pointed to differences between the 2009 accident and the Max crashes. "These accidents involved fundamentally different system inputs and phases of flight," the company said.

Asked about its involvement with the Dutch accident report, Boeing said it was "typical and critical to successful investigations for Boeing and other manufacturers to work collaboratively with the investigating authorities."

Joe Sedor, the National Transportation Safety Board official who led the American team working on the Turkish Airlines investigation, said it was not unusual for investigating bodies to make changes to a report after receiving feedback, or for US safety officials to jointly submit their comments with Boeing.

Sedor acknowledged that reliance on a single sensor was a contributing factor in both cases but cautioned against focusing on it.

"Each of these accidents were complex and dynamic events with many contributing factors," he said.

The FAA, in a statement, also emphasized the "unique set of circumstances" surrounding each accident. "Drawing broad connections between accidents involving different types of emergencies oversimplifies what is, by definition, a complex science," it said.

A spokeswoman for the Dutch board, Sara Vernooij, said it was common practice to amend draft reports in response to outside comments, but she declined to address the specific changes.

Vernooij said the Dutch agency regarded the Dekker study as confidential. "The parts considered relevant by the board were used while writing the final report," she said.

Join ST's Telegram channel and get the latest breaking news delivered to you.