The software at issue in two deadly crashes of Boeing 737 Max jetliners runs on two identical computer processors tucked inside a small metal box the size of a toaster.
Boeing designed that software, known as the Maneuvering Characteristics Augmentation System (MCAS). But the lines of code underpinning this system and the physical box it runs on were programmed and built to Boeing’s specifications by a lesser-known company called Rockwell Collins, one of the hundreds of partners that Boeing relies on to assemble the 737 Max.
Boeing is mired in legal risk as investigators home in on MCAS as a key factor in two plane crashes that killed a total of 346 people in Ethiopia and Indonesia. This week, Boeing CEO Dennis Muilenburg acknowledged it was “apparent” that MCAS had been activated in both crashes after being fed erroneous data from sensors. The company said Friday that it would decrease its 737 Max production rate from 52 aircraft per month to 42.
Boeing’s 737 Max planes are the subject of congressional inquiries, a federal audit and a criminal probe by the Justice Department.
The scrutiny is already spilling over to Boeing’s wide network of supply chain partners. Rosemount Aerospace, the maker of a sensor on the 737 Max, this week was sued by the family of an American victim of the Ethiopia crash, claiming the company was negligent. Both Rosemount and Rockwell Collins are owned by United Technologies, a U.S. manufacturing giant.
“These parts are screwed together from all over the world,” said Mike Boyd, an aviation analyst with Boyd Group International. “You better believe that anybody who has so much as a fingerprint on this MCAS issue is getting a lawsuit.”
A list of more than 900 companies that contribute to the 737 Max was included in a settlement that Indonesian airline Lion Air offered to families of the victims of the October 2018 crash, according to documents reviewed by The Washington Post. The airline offered about $91,000 in exchange for waiving the right to sue any of those firms, which included Boeing, engine-makers GE and Safran, and smaller makers of parts like LED lights and electromechanical switches.
Rockwell Collins was on the list. (It was acquired by United Technologies last year for more than $30 billion and is now known as Collins Aerospace.) According to communications between Boeing and 737 customers reviewed by The Post, Collins built the 737 Max flight-control computer and wrote the software code that contains MCAS, among other components of the plane.
United Technologies repeatedly declined to answer questions about Rockwell Collins and Rosemount for this story.
Boeing spokesman Peter Pedraza said Collins “has a deep legacy of expertise” in aircraft electronics.
“The aerospace industry globally functions by bringing expert suppliers of structures, systems and services together to develop and produce aircraft,” he said.
Boeing is preparing a software fix that is designed to address the underlying problems with MCAS and has said it expects to have a solution ready “in the coming weeks.”
As more aspects of commercial jets have become automated, Boeing and other manufacturers have come to rely more on companies that build the computers and software that power autopilot functions. On a typical passenger flight, pilots manually taxi the jet and perform the takeoff, then turn over the physical control of the plane to the computer.
Rockwell Collins won the contract to produce the flight-control computer for 737 models in 2003, a coup over its primary rival in the aviation electronics business, Honeywell. Collins tasked hundreds of employees, including hardware and software engineers, with designing a new computer based on specifications provided by Boeing, according to two former Collins employees who worked on flight controls.
The computer this team created, used in several 737 models since then, relies on a “dual dual system,” which means it has two computers — each the size of a large toaster — housing two processors apiece. The design is meant to ensure that if one processor malfunctions, the plane can seamlessly shift to another one with the exact same functions.
The hardware and software for a new plane’s computers can take more than three years to develop, the former Collins employees said. Boeing may spend roughly $200,000 for a flight-control computer on a single new plane, estimates Chris Brady, a former 737 pilot who catalogues aircraft features and adaptations on his website, the Boeing 737 Technical Site.
Boeing is known to work closely with its software partners on flight-control systems. Employees of Rockwell Collins, based in Cedar Rapids, Iowa, used to hold all of their internal meetings before 10 a.m. local time because that’s when Boeing managers in Seattle would usually start calling to check their progress on the 737 computer, said one of the former employees.
It’s unclear how much direction Boeing gave Collins in the specific design of MCAS and whether anyone at Collins raised concerns about the safety of the system. Typically, Boeing handles the process of certifying flight controls with regulators like the Federal Aviation Administration after they are completed and added to the plane.
Collins has also provided free software upgrades to 737 owners — similar to Apple’s or Android’s periodic updates to smartphone operating systems. Notably, Collins issued a software update to 737 Max flight-control systems on Jan. 25, designed to change MCAS functionality to improve its safety “when flap position failures are detected,” according to a notice Boeing sent customers about the changes.
This software update, which has not been previously reported, came three months after the Lion Air crash and about six weeks before the crash of Ethiopian Airlines Flight 302, raising questions about whether Boeing and Collins attempted to change the MCAS software as a result of the first accident and whether they obtained approval from regulators to do so.
Separately, Boeing submitted a proposed fix to MCAS to the FAA on Jan. 21, the agency’s acting administrator said in a Senate hearing last week. It’s unclear how the proposed fix may have differed from the software changes made available to customers a few days later.
Pedraza, the Boeing spokesman, said the two software updates were unrelated, and he referred to the Jan. 25 changes as a “standard service bulletin” to 737 operators.
A spokesman for Ethiopian Airlines declined to comment on whether the plane that crashed in March had received the Jan. 25 software update.
While United Technologies is confronted with questions about Collins, it already faces a lawsuit against Rosemount, its aircraft sensor subsidiary.
The family of Samya Stumo, an American woman killed in the Ethiopia crash, filed a lawsuit against Boeing and Rosemount in U.S. District Court in Northern Illinois on Thursday. The legal complaint alleges that Boeing designed and installed a “defective flight control system” on its planes and accuses Rosemount of negligently developing defective angle-of-attack sensors.
A preliminary report on the Ethiopian Airlines accident, released Thursday, found that the sensors began registering erroneous readings less than a minute after takeoff. Sensors on alternate sides of the plane showed wildly divergent measurements for airspeed and altitude.
Investigators of the Lion Air crash also said Rosemount’s sensors fed the wrong signals to the flight-control computer, causing the MCAS feature to repeatedly push the plane’s nose down.
“The way product liability law works is that component part manufacturers have liability, just like the general manufacturer,” said Brian Kabateck, a lawyer representing victims of the Lion Air crash in a lawsuit against Boeing. If Boeing believes that any suppliers are at fault, it typically would file a counterclaim against those suppliers to force them to share liability, Kabateck said.
Others say Boeing should bear full responsibility for weeding out potential flaws in the aircraft systems it buys.
“At the end of the day, it was Boeing’s responsibility to integrate this box into the plane and to integrate the external sensors,” said Richard Aboulafia, a Teal Group aerospace analyst. “There might be individual factors that played a role. But responsibility for coordinating all of the technology and the onboard inputs falls to Boeing.”