Boeing’s Deadly Sin: Making Basic Safety Features Optional – Taking A Page Out of Bad Old GM’s Playbook

I’ve written numerous articles about bad old GM’s Deadly Sins, including such transgressions as making the most basic safety items optional, such as disc brakes on the new FWD 1967 Eldorado (and Toronado), their standard drum brakes being grossly deficient as well as making improvements to the 1960 Corvair’s deficient standard rear suspension optional.  Thanks to increased regulatory standards and the public’s demands for safety, these kind of deficiencies are now (mostly) in the remote past. But this morning I read in the New York Times that Boeing charges extra for two very simple and basic monitoring displays/alerts that would have made it very obvious to the pilots just what was triggering the MCAS software to push their Boeing Max 737s into deadly dives. And not surprisingly, the two planes that went down both lacked them.

This whole affair has been deeply shocking, but to find out that Boeing treats a wide range of safety items as optional extras with which to pad the bottom line has left me deeply dismayed. What is it that makes management and our oversight (FAA) willing to treat safety so cavalierly?

As an aviation buff, I’ve been following the issues with the MCAS system. In a nutshell, it is an automatic system that puts the plane in a nose down attitude when it receives input from the angle of attack sensor that the plane is too far nose up, an intrinsic tendency caused by the larger more efficient engines used on the Max. These sensors are mounted on the outside of the plane, and work quite basically in sensing the angle of the air stream in relation to the fuselage.

It’s well known there was a problem with the sensor on the Lion Air 737 that went down. But there’s two of them, one on each side of the plane. Yet inexplicably, the MCAS system only uses input from one of them. Ever since reading about it initially, I have wondered why, as these sensors are prone to damage or malfunction. That huge flaw in the software is what Boeing is now going to fix as quickly as possible, to make MCAS use input from both sensors. Seems mighty obvious.

But there were two optional devices that would have made this issue evident to the pilots. One is an angle of attack indicator, which gives a readout of both sensors. The other is a disagree light, which activates when the sensors are at odds with each other, as was undoubtedly the case in both these crashes.

These are a simple display and indicator light. And having the light come on would have instantly made it clear that there was an issue with one of the sensors, which would make it obvious to the pilot just why the MCAS system was misbehaving.

There’s no absolute assurance it would have kept these two crashes from occurring, but it’s been documented in the case of the Lion air cockpit recorder that one of the pilots was desperately searching through the airplane’s documentation to understand what was going on.

“They’re critical, and cost almost nothing for the airlines to install,” said Bjorn Fehrm, an analyst at the aviation consultancy Leeham. “Boeing charges for them because it can. But they’re vital for safety.”

Redundancy is a key issue in aviation safety. After the Air France Flight 447 crash in 2009, which was caused by another critical sensor, the air speed sensor pitot tubes icing over, an additional third pitot tube from a different manufacturer was added to the Airbus planes in question.

And it’s not just these two displays either.

Boeing charges extra, for example, for a backup fire extinguisher in the cargo hold. Past incidents have shown that a single extinguishing system may not be enough to put out flames that spread rapidly through the plane. Regulators in Japan require airlines there to install backup fire extinguishing systems, but the F.A.A. does not.

“There are so many things that should not be optional, and many airlines want the cheapest airplane you can get,” said Mark H. Goodrich, an aviation lawyer and former engineering test pilot. “And Boeing is able to say, ‘Hey, it was available.’”

But what Boeing doesn’t say, he added, is that it has become “a great profit center” for the manufacturer.

What’s really odd about all of this is that Boeing and the airlines go to great lengths to keep these options (and their prices) out of public view, presumably because the flying public (rightfully) would be concerned about any airline not having the full available complement.

Airlines frequently redact details of the features they opt to pay for — or exclude — from their filings with financial regulators. Boeing declined to disclose the full menu of safety features it offers as options on the 737 Max, or how much they cost.

But one unredacted filing from 2003 for a previous version of the 737 shows that Gol Airlines, a Brazilian carrier, paid $6,700 extra for oxygen masks for its crew, and $11,900 for an advanced weather radar system control panel. Gol did not immediately respond to a request for comment.

Oxygen masks for the crew are an optional extra? And advanced weather radar? Hard to believe.

So what did the three US airlines do when it came to optioning their 737 Max fleets? American Airlines bought both the display and the disagree light. Southwest bought the disagree light, and had a angle of attack display of a different type mounted over the pilots’ head, which they are now moving down on the main display screen. And United…passed on both. A United spokesman said the airline does not include the features because its pilots use other data to fly the plane. No further details on that available.

Meanwhile, Boeing is hard at work in modifying the MCAS software to incorporate data from bot sensors. But that’s still no reason to not display the data and have a warning if there’s a discrepancy.

Incorporating the disagree light and the angle of attack indicators on all planes would be a welcome move, safety experts said, and would alert pilots — as well as maintenance staff who service a plane after a problematic flight — to issues with the sensors.

The alert, especially, would bring attention to a sensor malfunction, and warn pilots they should prepare to shut down the MCAS if it activated erroneously, said Peter Lemme, an avionics and satellite-communications consultant and former Boeing flight controls engineer.

“In the heat of the moment, it certainly would help,” he said.

I’m afraid this whole episode has deeply shaken my faith in Boeing and the FAA, which has allowed Boeing to largely self-certify their new planes. That reminds me way too much of how the EPA allows automakers to self-certify the emissions of their cars. And we’ve seen the results of that.

Update: I just read (at 9 AM PDT) that Boeing is going to make the disagree light standard from now on, but is still going to charge extra for the sensor display.

Related reading:

1960-1963 Corvair: GM’s Deadliest Sin?

1967 Eldorado vs. Renault R-10: An Unfair Comparison Thanks To a GM Deadly Sin

How GM Nickled and Dimed Americans (and Itself) To Death With Undersized Tires