How Boeing’s responsibility in a 2009 crash “got buried”
After a Boeing 737 crashed near Amsterdam more than a decade ago, Dutch investigators focused blame on the pilots for failing to react properly when an automated system malfunctioned and caused the plane to plummet into a field, killing nine people.
The fault was hardly the crew’s alone, however. Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the Turkish Airlines accident. But the Dutch Safety Board either excluded or played down criticisms of the manufacturer in its final report after pushback from a team of Americans who included Boeing and federal safety officials, documents and interviews show.
The crash, in February 2009, involved a predecessor to Boeing’s 737 Max, the plane that was grounded last year after accidents in Indonesia and Ethiopia killed 346 people and hurled the company into the worst crisis in its history.
A review by The New York Times of evidence from the 2009 accident, some of it previously confidential, reveals striking parallels with the recent crashes — and resistance by the team of Americans to a full airing of findings that later proved relevant to the Max.
In the 2009 and Max accidents, for example, the failure of a single sensor caused systems to misfire, with catastrophic results, and Boeing had not provided pilots with information that could have helped them react to the malfunction. The earlier
accident “represents such a sentinel event that was never taken seriously,” said Sidney Dekker, an aviation safety expert who was commissioned by the Dutch Safety Board to analyze the crash.
Dekker’s study accused Boeing of trying to deflect attention from its own “design shortcomings” and other mistakes with “hardly credible” statements that admonished pilots to be more vigilant, according to a copy reviewed by The Times.
The study was never made public. The Dutch board backed away from plans to publish it, according to Dekker and another person with knowledge of its handling. A spokeswoman for the Dutch board said it was not common to publish expert studies and the decision on Dekker’s was made solely by the board.
At the same time, the Dutch board deleted or amended findings in its own accident report about issues with the plane when the same American team weighed in. The board also inserted statements, some nearly verbatim and without attribution, written by the Americans, who said that certain pilot errors had not been “properly emphasized.”
The muted criticism of Boeing after the 2009 accident fits within a broader pattern, brought to light since the Max tragedies, of the company benefiting from a light-touch approach by safety officials.
References to Dekker’s findings in the final report were brief, not clearly written and not sufficiently highlighted, according to multiple aviation safety experts.
One of them, David Woods, a professor at Ohio State University who has served as a technical adviser to the Federal Aviation
Administration, said the Turkish Airlines crash “should have woken everybody up.”
Some of the parallels between that accident and the more recent ones are particularly noteworthy. Boeing’s design decisions on both the Max and the plane involved in the 2009 crash — the 737 NG, or Next Generation — allowed a powerful computer command to be triggered by a single faulty sensor, even though each plane was equipped with two sensors, as Bloomberg reported last year. In the two Max accidents, a sensor measuring the plane’s angle to the wind prompted a flight control computer to push its nose down after takeoff; on the Turkish Airlines flight, an altitude sensor caused a different computer to cut the plane’s speed just before landing.
Boeing had determined before 2009 that if the sensor malfunctioned, the crew would quickly recognize the problem and prevent the plane from stalling — much the same assumption about pilot behavior made with the Max.
And as with the more recent crashes, Boeing had not included information in the NG operations manual that could have helped the pilots respond when the sensor failed.
Even a fix now proposed for the Max has similarities with the past: After the crash near Amsterdam, the FAA required airlines to install a software update for the NG that compared data from the plane’s two sensors, rather than relying on just one. The software change Boeing has developed for the Max also compares data from two sensors.
Critically, in the case of the NG, Boeing had already developed the software fix well before the Turkish Airlines crash, including it on new planes starting in 2006 and offering it as an optional update on hundreds of other aircraft. But for some older jets, including the one that crashed near Amsterdam, the update would not work, and Boeing did not develop a compatible version until after the accident.
The Dutch investigators deemed it “remarkable” that Boeing left airlines without an option to obtain the safeguard for some older planes. But in reviewing the draft accident report, the Americans objected to the statement, according to the final version’s appendix, writing that a software modification had been unnecessary because “no unacceptable risk had been identified.” GE Aviation, which had bought the company that made the computers for the older jets, also suggested deleting or changing the sentence.
The Dutch board removed the statement, but did criticize Boeing for not doing more to alert pilots about the sensor problem.
Woods, who was Dekker’s doctoral adviser, said the decision to exclude or underplay the study’s principal findings enabled Boeing and its U.S. regulators to carry out “the narrowest possible changes.”
The problem with the single sensor, he said, should have dissuaded Boeing from using a similar design in the Max. Instead,
“the issue got buried.”
Boeing declined to address detailed questions from The Times. In a statement, the company pointed to differences between the 2009 accident and the Max crashes.
“These accidents involved fundamentally different system inputs and phases of flight,” the company said.
Asked about its involvement with the Dutch accident report, Boeing said it was “typical and critical to successful investigations for Boeing and other manufacturers to work collaboratively with the investigating authorities.”
Woods, the Ohio State professor who has advised the FAA, wrote an email to colleagues shortly after the first 737 Max crash, in October 2018, of Lion Air Flight 610, which killed 189 people just minutes after taking off from Jakarta, Indonesia. The initial details, he wrote, indicated it was an automation-triggered disaster of the sort that he and others had studied for almost 30 years. He cited research from the 1990s and pointed to the Turkish Airlines crash.
“That this situation has continued on for so long without major action is not how engineering is supposed to work,” he wrote.
After the second Max crash — in March 2019, of Ethiopian Airlines Flight 302, killing all 157 people on board shortly after takeoff from Addis Ababa — Woods said in an interview, “I was appalled.”
“This is such of a failure of responsibility,” he said. “We’re not supposed to let this happen.”