Boeing boss again defends 737 MAX software design

April 30, 2019
Dennis Muilenburg . Image: CNBC

Boeing chief executive Dennis Muilenburg has again defended the design and approval of the controversial MCAS software on the 737 MAX during a testy press conference after the company’s annual meeting in Chicago.

The Boeing boss fielded a series of questions that looked at issues such as the integrity of the design process, compensation for airlines and how the company would convince passengers the MAX was safe.

And if the reaction of reporters at the CEO’s first media conference since the crisis began was anything to go by, it still has a big job ahead of it.

The event started relatively sedately with a question about how the company would earn back the trust of passengers and ended with Muilenburg leaving the stage as a surprised reporter called out: “Sir, wait a minute, 346 people died — can you answer a few questions here about that?”

READ OUR 737 MAX coverage.

Those 346 people died in two crashes of Boeing 737 MAX 8 aircraft within five months of each other.

The chief executive is limited in what he can say from a legal standpoint — Boeing faces a number of lawsuits — and  by the convention surrounding ongoing aircraft investigations.

Nonetheless, he faces the task of convincing travelers that Boeing is not just another big company attempting to cover its tracks and that the Boeing 737 MAX is safe to fly.

This comes amid a flurry of stories from whistleblowers, some of them also in legal battles with Boeing, claiming production and safety problems at the aerospace giant.

The MAX fleet was grounded because both crashes were linked to new software in the MAX  known as MCAS. MCAS pushed down the noses of both planes after receiving erroneous angle of attack data.

Boeing has been a party to both investigations and Muilenburg said the company had been diligent about respecting the integrity of the investigation process and providing technical support.

“We know that in both accidents there was a chain of events that occurred,’’ he said. “One of the links in that chain was the activation of the MCAS system because of erroneous angle of attack data, that was a common link in both accidents. We know that we can break that link in the chain.

“That is a link that we own. It is our responsibility to eliminate that risk and the software update does exactly that.

“So we’re focused on taking care of that and getting the MAX back up and flying safely. We’re going to be working very closely with our airline customers and with the FAA and with regulatory authorities around the world.

Asked why passengers should trust Boeing’s claims that the MAX would be safe after the upgrade, Muilenburg said the company’s commitment to safety was unwavering and it regretted the impact on passengers.

“We know that we do have work to do to earn and re-earn that trust,’’ he said. “And we will.”

A claim that produces a high level of skepticism — and certainly did from the reporters at the media conference —  is that there was nothing wrong with the design and certification process involved in the original MCAS software.

MCAS has been described as anti-stall software but Muilenburg pointed out that is not the case.

“It’s a system that’s designed to provide handling qualities for the pilot that meet pilot preferences,’’ he said.

“We want the airplane to behave in the air similar to the previous generations of 737s. that’s preferred pilot feel for the airplane, how it feels as they’re flying it.

“And MCAS is designed to provide that kind of handling qualities at high angle of attack.

“So it’s a purposeful design, it’s something that’s designed to be part of how the airplane flies so as part of the certification process, it’s not something that’s a separate procedure or something that needs to be trained on separately.

“It’s fundamentally embedded in the handling qualities of the airplane and so when you train on the airplane you’re being trained on MCAS. It’s not a separate system to be trained on.”

Muilenburg said the planemaker had looked at both accidents involving the MAX as well as the aircraft’s design and certification and was confident MCAS operated according to the original design and certification standards.

He reiterated previous comments that Boeing had “not seen a technical slip or gap” in terms of the fundamental design and certification.

“We’ve done deep assessments of our airplane and the design and we’ve confirmed that the MCAS system as originally designed did meet our design and safety analysis criteria and our certification criteria,’’ he said.

“Those are standard processes that have worked for decades and will continue to work.”

He also noted that the company’s system safety analysis included not just the engineering design but also the actions of pilots as part of a failure scenario.

“That’s all baked into a system end-to-end analysis,’’ he said.

“That all said, going forward we’ve identified a way to improve this to make it a dual sensor feed.

“That is the change that we’re making with the software update and I’m confident again that will create an airplane that’s one of the safest in the air to fly.”

Questioned how a plane that operated as designed repeatedly pushed down the nose to the point of an unrecoverable dive, Muilenburg pointed to the system procedures that should be followed in the case of a failure.

“In the case of an MCAS failure scenario, there’s something called a runaway stabilizer procedure which is a memory item in the cockpit,’’ he said.

“If that kind of scenario occurs and you go through the checklist —  and again that checklist was published as part of the recent Ethiopian preliminary report —  if you look through that checklist it calls out actions that would be taken around power management and pitch management of the airplanes.

“It also refers to the cut-out switches that after an activation that was not pilot induced, that you would hit the cut-off switches. And in some cases, those procedures were not completely followed.”

However, he sidestepped a question about whether the manufacturer was over-confident in the abilities of pilots, particularly given they were unaware of MCAS.

“ As we look at both accidents, and this is common to most airplane accidents that have occurred over history, there’s a  chain of events,’’ he said in reply.

“There are multiple contributing factors. There are factors that we can control in the design and in this case that common link related to the MCAS system and its activation. We’re going to break that link and this will prevent accidents like this from happening again.”

Asked whether the accident would have happened without MCAS, he again pointed to the chain of events but did not directly address the question.

“I think it’s really important that we all focus on letting the investigation process run its due course,’’ he added.

“Our job is to focus on safety, not on speculation. We’re going to continue to support the investigation process and I would suggest that is the right way to handle this in the long run.”

On compensation to airlines,  Muilenburg would not comment on talsk with individual airlines but said the company was actively engaged with its customers.

When called on to admit that the design of MCAS was deeply flawed, Muilenburg returned to the earlier comments that the company in its design, safety analysis and engineering analysis “followed exactly the steps in our design and certification process that consistently produce safe airplanes”.

“We know there are some improvements that we can make to MCAS and we will make those improvements,’’ he said.

“But the reason this industry is safe is that we never stop from making safety improvements. We never claim we have reached the endpoint.

“We are continuously,  across all of our airplane programs, improving safety every day. We always look for opportunities to improve.

“ That culture that’s unafraid to make safety improvements over time, that culture is what has driven this to be an incredibly safe industry.

“That is our commitment, we’re not going to waver from that, we’re not going to step back from that.

“We will continually look for opportunities to improve safety. That’s our responsibility and that’s part of re-earning that trust that I talked about earlier.”

See a video of the press conference on CNBC


  1. MCAS is but one part of this. What caused the Captain’s AOA sensor to read 75 degrees AOA immediately after takeoff from HAAB?