CHICAGO (NYTIMES) - Pilots start some new Boeing planes by turning a knob and flipping two switches.
The Boeing 737 Max, the newest passenger jet on the market, works differently. Pilots follow roughly the same seven steps used on the first 737 nearly 52 years ago: Shut off the cabin's air-conditioning, redirect the air flow, switch on the engine, start the flow of fuel, revert the air flow, turn back on the air-conditioning, and turn on a generator.
The 737 Max is a legacy of its past, built on decades-old systems, many of which date back to the original version. The strategy, to keep updating the plane rather than starting from scratch, offered competitive advantages. Pilots were comfortable flying it, while airlines did not have to invest in costly new training for their pilots and mechanics. For Boeing, it was also faster and cheaper to redesign and recertify than starting anew.
But the strategy has now left the company in crisis, after two deadly crashes in less than five months. The Max stretched the 737 design, creating a patchwork plane that left pilots without some safety features that could be important in a crisis - ones that have been offered for years on other planes. It is the only modern Boeing jet without an electronic alert system that explains what is malfunctioning and how to resolve it. Instead pilots have to check a manual.
The Max also required makeshift solutions to keep the plane flying like its ancestors, workarounds that may have compromised safety. While the findings are not final, investigators suspect that one workaround, an anti-stall system designed to compensate for the larger engines, was central to the crash last month in Ethiopia and an earlier one in Indonesia.
The Max "ain't your father's Buick", said Dennis Tajer, a spokesman for the American Airlines pilots' union who has flown the 737 for a decade. He added that "it's not lost on us that the foundation of this aircraft is from the '60s".
The Max, Boeing's best-selling model, with more than 5,000 orders, is suddenly a reputational hazard. It could be weeks or months before regulators around the world lift their ban on the plane, after Boeing's expected software fix was delayed. Southwest Airlines and American Airlines have cancelled some flights through May because of the Max grounding.
The company has slowed production of the plane, putting pressure on its profits, and some buyers are reconsidering their orders. Shares of the company fell over 4 per cent on Monday, and are down 11 per cent since the Ethiopia crash.
"It was state of the art at the time, but that was 50 years ago," said Rick Ludtke, a former Boeing engineer who helped design the Max's cockpit. "It's not a good airplane for the current environment."
The 737 has long been a reliable aircraft, flying for decades with relatively few issues. Gordon Johndroe, a Boeing spokesman, defended the development of the Max, saying that airlines wanted an updated 737 over a new single-aisle plane and that pilots were involved in its design.
"Listening to pilots is an important aspect of our work. Their experienced input is front and centre in our mind when we develop airplanes," he said in a statement. "We share a common priority - safety - and we listen carefully to their feedback."
Boeing's chief executive, Dennis Muilenburg, said in a statement last Friday (April 5) that the crashes in Indonesia and Ethiopia appeared to have been caused by the Max's new anti-stall system. "We have the responsibility to eliminate this risk, and we know how to do it," he said.
At a factory near Seattle on Jan 17, 1967, flight attendants christened the first Boeing 737, smashing sparkling wine bottles over its wing. Boeing pitched the plane as a smaller alternative to its larger jets, earning it the nickname the "Baby Boeing". Early on, sales lagged Boeing's biggest competitor, McDonnell Douglas. In 1972, Boeing had delivered just 14 of the jets, and it considered selling the programme to a Japanese manufacturer, said Peter Morton, the 737 marketing manager in the early 1970s. "We had to decide if we were going to end it or invest in it," Morton said.
Ultimately, Boeing invested. The 737 eventually began to sell, bolstered by airline deregulation in 1978. Six years later, Boeing updated the 737 with its "classic" series, followed by the "next generation" in 1997, and the Max in 2017. Now nearly 1 in every 3 domestic flights in the United States is on a 737, more than any other line of aircraft.
Each of the three redesigns came with a new engine, updates to the cabin and other changes. But Boeing avoided overhauling the jet in order to appease airlines, according to current and former Boeing executives, pilots and engineers, some of whom spoke on the condition of anonymity because of the open investigations. Airlines wanted new 737s to match their predecessors so pilots could skip expensive training in flight simulators and easily transition to new jets.
Boeing's strategy worked. The Federal Aviation Administration never required simulator training for pilots switching from one 737 to the next.
"Airlines don't want Boeing to give them a fancy new product if it requires them to retrain their pilots," said Matthew Menza, a former 737 Max test pilot for Boeing. "So you iterate off a design that's 50 years old. The old adage is: If it's not broke, don't fix it." It did require engineering ingenuity, to ensure a decades-old jet handled mostly the same. In doing so, some of the jet's one-time selling points became challenges.
For instance, in the early years of the 737, jet travel was rapidly expanding across the world. The plane's low-slung frame was a benefit for airlines and airports in developing countries. Workers there could load bags by hand without a conveyor belt and maintain the engines without a lift, Morton said. In the decades that followed, the low frame repeatedly complicated efforts to fit bigger engines under the wing.
By 2011, Boeing executives were starting to question whether the 737 design had run its course. The company wanted to create an entirely new single-aisle jet. Then Boeing's rival Airbus added a new fuel-efficient engine to its line of single-aisle planes, the A320, and Boeing quickly decided to update the jet again.
"We all rolled our eyes. The idea that, 'Here we go. The 737 again,'" said Ludtke, the former 737 Max cockpit designer who spent 19 years at Boeing.
"Nobody was quite perhaps willing to say it was unsafe, but we really felt like the limits were being bumped up against," he added.
Some engineers were frustrated they would have to again spend years updating the same jet, taking care to limit any changes, instead of starting fresh and incorporating significant technological advances, the current and former engineers and pilots said. The Max still has roughly the original layout of the cockpit and the hydraulic system of cables and pulleys to control the plane, which are not used in modern designs. The onboard computers have the processing power of 1990s home computers. A Boeing spokesman said the aircraft was designed with an appropriate level of technology to ensure safety.
When engineers did make changes, it sometimes created knock-on effects for how the plane handled, forcing Boeing to get creative. The company added a new system that moves plates on the wing in part to reduce stress on the plane from its added weight. Boeing re-created the decades-old physical gauges on digital screens.
As Boeing pushed its engineers to figure out how to accommodate bigger, more fuel-efficient engines, height was again an issue. Simply lengthening the landing gear to make the plane taller could have violated rules for exiting the plane in an emergency.
Instead, engineers were able to add just a few inches to the front landing gear and shift the engines farther forward on the wing. The engines fit, but the Max sat at a slightly uneven angle when parked.
While that design solved one problem, it created another. The larger size and new location of the engines gave the Max the tendency to tilt up during certain flight maneuvers, potentially to a dangerous angle.
To compensate, Boeing engineers created the automated anti-stall system, called MCAS, that pushed the jet's nose down if it was lifting too high. The software was intended to operate in the background so that the Max flew just like its predecessor. Boeing did not mention the system in its training materials for the Max.
Boeing also designed the system to rely on a single sensor - a rarity in aviation, where redundancy is common. Several former Boeing engineers who were not directly involved in the system's design said their colleagues most likely opted for such an approach since relying on two sensors could still create issues. If one of two sensors malfunctioned, the system could struggle to know which was right.
Airbus addressed this potential problem on some of its planes by installing three or more such sensors. Former Max engineers, including one who worked on the sensors, said adding a third sensor to the Max was a non-starter. Previous 737s, they said, had used two, and managers wanted to limit changes.
"They wanted to A, save money and B, to minimise the certification and flight-test costs," said Mike Renzelmann, an engineer who worked on the Max's flight controls. "Any changes are going to require recertification." Renzelmann was not involved in discussions about the sensors.
The Max also lacked more modern safety features.
Most new Boeing jets have electronic systems that take pilots through their preflight checklists, ensuring they do not skip a step and potentially miss a malfunctioning part. On the Max, pilots still complete those checklists manually in a book.
A second electronic system found on other Boeing jets also alerts pilots to unusual or hazardous situations during flight and lays out recommended steps to resolve them.
On 737s, a light typically indicates the problem and pilots have to flip through their paper manuals to find next steps. In the doomed Indonesia flight, as the Lion Air pilots struggled with MCAS for control, the pilots consulted the manual moments before the jet plummeted into the Java Sea, killing all 189 people aboard.
"Meanwhile, I'm flying the jet," said Tajer, the American Airlines 737 captain. "Versus, pop, it's on your screen. It tells you: This is the problem, and here's the checklist that's recommended." Boeing decided against adding it to the Max because it could have prompted regulators to require new pilot training, according to two former Boeing employees involved in the decision.
The Max also runs on a complex web of cables and pulleys that, when pilots pull back on the controls, transfer that movement to the tail. By comparison, Airbus jets and Boeing's more modern aircraft, such as the 777 and 787, are "fly-by-wire", meaning pilots' movement of the flight controls is fed to a computer that directs the plane. The design allows for far more automation, including systems that prevent the jet from entering dangerous situations, such as flying too fast or too low. Some 737 pilots said they preferred the cable-and-pulley system to fly-by-wire because they believed it gave them more control.
In the recent crashes, investigators believe the MCAS malfunctioned and moved a tail flap called the stabiliser, tilting the plane towards the ground. On the doomed Ethiopian Airlines flight, the pilots tried to combat the system by cutting power to the stabiliser's motor, according to the preliminary crash report.
Once the power was cut, the pilots tried to regain control manually by turning a wheel next to their seat. The 737 is the last modern Boeing jet that uses a manual wheel as its backup system. But Boeing has long known that turning the wheel is difficult at high speeds, and may have required two pilots to work together.
In the final moments of the Ethiopia Airlines flight, the first officer said the method was not working, according to the preliminary crash report. About 1 minute and 49 seconds later, the plane crashed, killing 157 people.