Boeing’s defense of 737 MAX flight-control system in wake of pilot messages stands up, sources say

SEATTLE -- After the release Friday of an instant message chat between two senior Boeing pilots, the jet maker faced skepticism when, two days later, it denied it had suppressed what seemed like early evidence that its 737 MAX flight control system had “run rampant” during simulator testing in 2016.

But Boeing's defense stands up, according to three sources who spoke to the Seattle Times on Monday -- two citing direct knowledge of inside information about the matter and the third an expert pilot from outside the company analyzing the flight details in the chat.

The bottom line is that the erratic behavior described in the 2016 chat by 737 MAX chief technical pilot Mark Forkner revealed a software bug in the MAX flight simulator he was using, a pilot training machine that he and his colleagues were then fine-tuning to get it ready for the MAX's entry into service.

It was not evidence of the flaws that later showed up on the real airplane's new flight-control system -- known as the Maneuvering Characteristics Augmentation System (MCAS) -- that caused the fatal crashes of the jets in Indonesia and Ethiopia.

The question is important because the release of the messages sparked a furor with members of Congress and regulators, raising new doubts about Boeing's integrity and transparency just as it prepares to seek approval to put the long-grounded MAX back into commercial service.

A former senior pilot at Boeing, who worked with Forkner in a similar role and who has direct knowledge of the type of simulator evaluations that Forkner was preparing at that time, said that the flight parameters mentioned in the chat indicate clearly that MCAS could not possibly have been engaging, even though the simulator faults made it seem so.

Furthermore, he added, it would have been impossible for Forkner to have been flying in the simulator any pattern similar to the accident flights, in both of which MCAS was triggered by a faulty angle of attack signal.

"I can tell you 100%, he couldn't have been flying the scenario that occurred on the accident airplanes, because there was no physical way in that simulator to shut off one angle of attack sensor," said the senior pilot, who spoke on condition of anonymity because he doesn't wish to be drawn into the Department of Justice's ongoing criminal investigation of the 737 MAX.

Bjorn Fehrm, an aerospace engineer and former fighter pilot who now is an analyst with Leeham.net and who has publicly criticized the MCAS design, concurred that the altitude and airspeed Forkner cited when the simulator flight controls went haywire rule out a real engagement of MCAS and indicate instead a glitch in the simulator.

"He was in normal flight. What's wrong with the original MCAS design is not apparent when flying normally," said Fehrm. "That said to me, this is just a simulator implementation issue."

The problem Forkner identified in the simulator "was logged contemporaneously" apart from his chat messages, according to a third source familiar with the relevant documents, and Boeing afterward fixed the simulator software.

"The issue was not experienced in later sessions," said this source, who also asked for anonymity because he's involved in one of the MAX investigations. "The issue could not be re-created in mid-December."

PR disaster

Boeing faced an epic public-relations disaster last Friday when a congressional committee released the text of the chat, in which Forkner described to his colleague Patrik Gustavsson a MAX simulator session that day in mid-November 2016 when MCAS started pushing the nose down, or "trimming" the jet.

"It's running rampant in the sim on me," Forkner wrote. "I'm levelling off at like 4000 ft, 230 knots and the plane is trimming itself like craxy (sic). I'm like, WHAT?"

"Granted, I suck at flying, but even this was egregious," Forkner added.

Forkner also stated that since MCAS had evolved from its initial design and now --"Shocker AlerT," as he put it -- activates at low speed as well as in the originally intended high-speed scenarios, he "basically lied to the regulators (unknowingly)."

The disclosure understandably drew outrage from members of Congress, airline pilot unions and aviation experts who interpreted it as clear evidence that Boeing knew before the MAX entered passenger service that MCAS could behave erratically and dangerously.

The Federal Aviation Administration (FAA) had not been informed of the document, which Boeing had provided to the Department of Justice last February, the month before the second MAX crash. On Friday, FAA Administrator Steve Dickson sent an angry letter to Boeing CEO Dennis Muilenburg demanding an explanation.

Both Fehrm and the former senior Boeing pilot also initially reacted with dismay, until they read the transcript of the chat. Then their knowledge of flying and of the way simulators are developed led both to a different conclusion.

Technical pilots versus test pilots

Forkner was chief technical pilot on the 737, managing pilots in a group called Flight Technical and Safety within Boeing's customer services division. This is a separate group from the test pilots who fly the planes under development, who are part of a different corporate division: Boeing Test and Evaluation.

As Forkner's chat makes clear, the two don't necessarily communicate well. "The test pilots have kept us out of the loop," Gustavsson complains at one point.

The job of the technical pilots is to develop the pilot training simulators and manuals that airlines will use when the plane is in service. They typically don't fly, but work in flight simulators.

Full flight simulators are complex machines, essentially an airplane cockpit re-created inside a closed box sitting on hydraulic jacks. The buttons and switches and control column inside are just like on the real airplane, but all are connected to multimillion-dollar computers that attempt to simulate what happens in a real airplane.

For this to work, engineers must enter reams of flight data, developed first from wind tunnel tests and computer simulations and then in the final stages from actual flight tests. Forkner's exchange with Gustavsson indicates that new data related to the design change to MCAS had only then been fed into the simulator system.

It's only toward the end of flight testing that all this data can be finalized to make the simulator a true mirror of the behavior of the real airplane. At the time of the chat, Forkner was working to develop the first MAX simulator at Boeing's facility in Miami. It was manufactured by TRU, a Canadian-American simulator maker, a subsidiary of Textron headquartered in Goose Creek, S.C.

Like pilots, who must pass a test to be qualified to fly any specific airplane, simulators are also inspected and tested before they are qualified to be used by airlines. The FAA sends out inspectors every year to retest all the qualified simulators and make sure they are still working as they should.

According to the former Boeing senior pilot, the first MAX sim was not yet qualified and TRU personnel were working nonstop alongside Boeing software engineers to get the machine properly calibrated and the software finalized.

Still, "there were a lot of discrepancy reports. The sim was not performing as specified," he said. In the chat, Forkner mentions signing some DRs, or Discrepancy Reports.

Ferhm believes that what happened in Forkner's simulator on Nov. 15 was just another simulator discrepancy, something wrong with the coding.

He notes that Forkner says he was flying level at a low 4,000 feet altitude and at 230 knots. This is an appropriate speed for that altitude and he calculates the angle of attack could have been no more than about 5 degrees.

The design of MCAS would have required at least twice as high an angle to be triggered. And to get to such an angle, Forkner would have had to pull back the controls creating a severe force of around 2 Gs, the sort of extreme maneuver an airline pilot would never execute unless in a sudden emergency like pulling up to avoid a mountain.

Fehrm said that it's clear from the chat Forkner wasn't trying any such extreme maneuver, and so when he complains about MCAS kicking in, he's referring to a crazy activation in the simulator that isn't behaving as it would in a real airplane.

Fehrm has harshly criticized Boeing's original design of MCAS and says that he has "a real problem with Boeing's culture."

"I'm all for criticizing when it's due," he said. "But you have to be fair."

The former Boeing pilot concurs about the flight pattern not remotely fitting an activation of MCAS. He notes that Gustavsson says he experienced something similar in the simulator "on approach," meaning coming in to land.

But when a plane is on approach, the flaps on the wings are extended, which automatically disables MCAS.

In addition, the former Boeing pilot points out that the MAX simulator at that time was set up so that the operator could push a button on a console to simulate various standard emergencies such as an engine failure. But there was no such button to simulate an angle of attack vane going wrong. There was no physical way to make that happen on the simulator, he said.

His conclusion was that the problems Forkner described were glitches that simply revealed the shortcomings of the simulator ahead of final qualification and "don't relate to the MAX accident scenarios."

"I have no loyalty to Boeing or to Mark Forkner," he emphasized. "I have loyalty to the truth."

Boeing last Friday offered no real evidence in its defense. On Sunday, it offered weak evidence: just a general statement by Forkner's lawyer. Forkner is refusing to talk or to provide information under his Fifth Amendment right against self-incrimination.

In addition, the second part of Boeing's defense on Sunday -- its claim that the FAA knew all about the changes it made to MCAS -- is questionable.

Multiple reports, initially in the Seattle Times, and most recently in the report by a team of international regulators, show that though some within the FAA may have been aware of some changes to MCAS, the FAA safety engineers tasked with analyzing its safety did not.

And Forkner's statement that he basically lied to the FAA seems to stem from the disconcerting fact that the redesign of MCAS, made in March 2016, had only just filtered down to him.

However, Monday's analysis of Boeing's 2016 simulator issues suggests that the stories published over the weekend -- including by the Seattle Times -- reporting on the message exchange between the pilots were indeed misinterpretations, as Boeing claimed Sunday.

It doesn't change the conclusion that MCAS as originally designed did lead to the accidents and the deaths of 346 people.

However, it means that these messages aren’t evidence that Boeing misled the world in 2016 and hid early evidence that MCAS was a death trap.