Wim Hendriksen is a retired software manager.
Ten years ago, Boeing started farming out development of complete subsystems to subcontractors. The aerospace company’s management told their senior engineers that, since building airplanes had become mainstream, external, lower-qualified engineers could deliver the designs cheaper and faster than in-house development teams. A few years later, a lot of these senior engineers have been laid off, causing a huge brain drain in systems knowledge at Boeing.
Years of cumulative knowledge and experience about how to build airplanes walked out the door. Instead, unskilled teams, with a horizon of only their own subsystem, did the work to the best of their abilities. The headcount of central departments at Boeing, like the team that designed cockpits, was cut in half. As basic system-level knowledge on how to build airplanes was lost, this allowed for wrong decisions on reliability to be taken: avoiding single-point failures using doubly or triply redundant subsystems wasn’t implemented in functions where it was badly needed.
Dennis Muilenburg spotted these problems when he became CEO of Boeing in 2015 and started to reverse the trend of farming out subsystem development. Too bad he was too late.
Boeing needed a quick commercial answer to the Airbus A320Neo and decided to upgrade the Boeing 737 to the 737 Max. The original design dates back to 1967 and has since been incrementally upgraded to today’s 737. It’s a mix of old-fashioned mechanical cables and pulleys combined with modern motors and electronics. The airplane’s fuselage is quite close to the ground, to allow the ground crew to throw the suitcases in the airplane by hand instead of using extra equipment.
The new Max needed bigger engines but they would scrape the runway. Boeing’s solution was to place the engines closer to the fuselage. As a result, they also moved more to the front of the plane, which degraded the flight characteristics: the airplane sometimes pitched backward by itself – with the risk of stalling.
To ‘solve’ this nuisance for the pilots, Boeing ordered a box with software to measure the pitch of the airplane and push down the nose when needed. The pitch was measured with one (!) of the two angle-of-attack sensors in the nose. The box changed the angle of the tailplane with a motor to move the airplane back to the desired pitch. This was done every five seconds.
To avoid making pilots nervous, this box wasn’t mentioned in the manual nor in the training nor in the flight simulator. The warning light that blinks when the left and right angle-of-attack sensors measure different values only did so when the customer had an optional package installed.
When this single angle-of-attack sensor malfunctions, all hell breaks loose in the cockpit because the pilots have no idea why the plane does what it does. When you don’t know a box with software is messing around with your tailplane, you don’t know what to do when the airplane wants to dive every five seconds.
387 Boeing 737 Max airplanes have been put into operation since May 2017. In November 2018 and in March 2019, two of them crashed, probably because of this angle-of-attack sensor. The death toll: 346 casualties. When things can go wrong, they will go wrong.
In retrospect, no one at Boeing understands why only one sensor is used and not both. Good thinking, but too late. In the Brainport region, fortunately, we’re much smarter at farming out the development of our high-tech products to subcontractors. What happened at Boeing, of course, won’t happen to us because we’ve learned from the misery of others – right?