Beware: what you incentivize for will more often than not fail to achieve the outcomes you desire

Incentives are powerful motivator. What many don’t realize is that they can motivate people to behave in ways that are far from what was actually intended.

Take a simple incentive target like minimizing the number of high priority bugs that are open. The outcome desired of improving service quality is clearly desirable. Customers certainly would love to have it. Fewer bugs means less rework and more time for the delivery team to work on new and interesting work.

However, explicit open bug targets backed by incentives to meet them do exactly the opposite. I regularly see teams that, once given incentives to reduce bug counts, deprioritize or close bugs that were both very bad and still present. Having the bugs remain is bad enough, but now the team has intentionally hidden them to meet the target. Organizational situational awareness degrades, customer expectations are missed, and everyone is unhappy.

Having both spoken to contacts at Boeing, along with reading some of the excellent exposés from the New York Times and others, it is clear similarly poorly targeted incentives played a similar role in the fiasco around the 737 MAX.

The Airbus A320neo

The story begins with Airbus’ introduction of the A320neo in 2010. With rising fuel prices, Airbus decided to improve the fuel efficiency of their narrow body A320 line though a series of engine, wing, and airframe improvements. The resulting 20% fuel efficiency improvements were a huge hit. Even longtime Boeing customers like American Airlines began purchasing the model for their fleets.

Boeing was at a crossroads. They had just released the 787 Dreamliner, a project full of delays and cost overruns. They knew they would lose a lot of market share if they repeated the Dreamliner’s 8 years to design and certify a new competitor to the A320neo. Building a new aircraft also does not guarantee that it will sell. It takes a lot of time and effort to convince customers to buy an entirely new aircraft. There is the issue that additional aircraft types reduces airline staffing flexibility. Pilots need to be trained to fly it, mechanics need to be trained how to work on it, and procedures need to be created to work with it. This is why airlines like Ryanair, Southwest, and Easyjet stick to a single aircraft type for their entire fleet.

Boeing’s alternative was to try to dramatically improve the efficiency of their current narrow body platform, the 737. Being already both familiar and popular with airlines, customers would automatically be interested in a more fuel efficient model.

However, there was a problem. The 737 was old. Designed in the 1960s, it had none of the fancy new avionics and controls of modern aircraft. What is more, the aircraft had been designed before jet bridges were common and thus sat closer to the tarmac than the A320. This left little room under the wings for the larger, more fuel efficient engines.

Boeing knew that changing the size of the landing gear, raising the wings, or moving the engines somewhere else on the aircraft would change the flight characteristics of the aircraft to the point where the plane would need to be recertified and pilots retrained. This would not only push out the release date but also reduce airline interest in the plane.

There was also one other important wrinkle to this story. It is one that ultimately cost the lives of 346 people, along with the reputation of Boeing.

Bad Incentives

Boeing was long known as a company of engineers. Boeing has also been known for their long record of putting safety first. Pilots also knew Boeing designed their aircraft around the idea that pilots are often best placed to make the best decisions. Their aircraft were made to aid rather than hinder the pilot.

(Note: I once met the pilot of the Gimli Glider fame who verified this. He told me that if the aircraft he had been flying on that fateful day had been an Airbus rather than a Boeing he and everyone onboard would have likely perished. This was due to Airbus’ approach of preventing pilots from straying too far from what is considered normal flying behavior. This would have prevented him from making the steep landing maneuver he needed to slow the plane enough to land on the truncated runway)

This all changed when McDonnell Douglas and Boeing merged in 1997. The management of Douglas was far more profit driven. As they took over many key roles in the newly merged organization, they brought with them a culture and set of incentive models that supplanted the drive for safety and engineering excellence with one that sought to prioritize profit above all else.

As a result managers aggressively prioritized cutting costs wherever possible. Traditionally most work at Boeing was done in-house, with a focus in the Seattle and Everett, Washington area. As these teams were unionized and expensive, managers sought to outsource significant amounts of aircraft design and production. Flight software was outsourced to India where it was built by software developers making $9 an hour. They also opened a new aircraft assembly facility in South Carolina in order to undercut the unionized labor force.

These changes have played a major role in the ongoing problems with the 787 program. There were regular problems with the fit and quality of supplier parts and software. Aircraft assembled in South Carolina were often so problematic that many customers refused to take delivery of any aircraft from the facility.

This drive to cut costs also encouraged some to cut corners in the name of profit. This tendency doomed the MAX.

Modifying the 737

Boeing decided modifying the 737 was the better approach. In order to work around the recertification problems, it was decided that the engine mounts should be moved further forward on the wings. The hope was this would allow the larger fuel efficient engines to sit in front of the wings where there was more space, all without the need for recertification or retraining. In fact, Boeing was so confident this would work that they agreed to pay Southwest Airlines $1 million rebate per aircraft if the change required pilots to be retrained.

Changing the mount points for the 737 MAX engines seemed like a simple yet genius solution for Boeing. There was, however, a problem. It was found that this, too, changed the flight characteristics of the aircraft. Having the engines in front of the wing caused the engine nacelles at times to act as wings themselves. This created excessive lift that caused the nose of the aircraft to rise above where it needs to.

Extra lift on something that needs to fly might sound good. However, with flying there is such a thing as having too much of a good thing.

As the nose of an aircraft rises, the amount of air over the wings changes. Raise it too much and air stops passing over the wings altogether, causing what is called an aircraft stall. This turns the plane into the equivalent of a large metal rock. Like a rock, the aircraft will suddenly plunge toward the ground.

Such a stall is what caused Air France flight 447 to fall out of the sky and crash into the sea off the coast of west Africa on 1 June 2009.

Boeing needed a way to handle this problem. They could have alerted pilots to it, but that would raise training and certification issues that would slow its introduction to market. It would also trigger the rebate payment to Southwest.

These were all things that management was being incentivized to avoid.

MCAS

Instead, Boeing decided to introduce a piece of software that would try to “smooth out” these variations so that the aircraft would fly just as it always did.

This system was MCAS (Maneuvering Characteristics Augmentation System). Its purpose was to detect when the angle of attack of the plane was too high and automatically adjusted the plane’s stabilizers by 0.6 degrees to lower the nose to prevent a stall. The initial triggers required both the angle of attack as well as G-forces to be well out of what was considered maximally acceptable. It was initially believed that such a stall would only happen in the extremely rare and unusual circumstance of the pilot flying too fast and aggressively.

Unfortunately, on the third test flight the test pilot found that there were similar lift problems at low speeds as well. To rectify this, engineers decided to make a couple of changes to MCAS. As G-forces were negligible at low speeds, it was removed as a requirement for triggering MCAS.

The second change was much more severe. It takes a lot more of a stabilizer adjustment to lower a nose at low speed. The value of 0.6 degrees was increased to 2.5 degrees with each MCAS activation. This was a dramatic change. It also didn’t take into account that MCAS would activate every 3 seconds. This meant multiple large stabilizer changes without direct pilot involvement.

Hiding the Evidence

Worried that the existence of MCAS might trigger calls for recertification and retraining, Boeing management decided to hide its existence where they could, and underplay it where they couldn’t.

The existence of MCAS, what it did, and how to turn it off was intentionally kept out of all manuals, customer paperwork, training and pilot notifications. It is difficult to be concerned about, let alone demand training for, something you do not know and would never imagine existing.

Getting MCAS past the FAA was far more challenging. While they did have to notify the authorities of its existence, they insisted that it would rarely, if ever, be triggered. As the occurrences were so rare, they argued that there was no reason to mention them to pilots or airlines. They then only disclosed the original conditions that MCAS would be triggered, along with the 0.6 degree correction, thereby hiding the later and far more dangerous configuration.

Normally, such an argument would not work. However, for years Boeing had argued successfully that they should be allowed to self-certify large portions of their designs. The idea was that this would streamline the approval process, reducing unnecessary paperwork and expense. Boeing’s past reputation for safety, and the US government’s desire to reduce costs and help a national industry champion, allowed it to happen.

Likewise, the FAA is highly respected globally. Most other air certification authorities have long accepted FAA approval as a green light to approve themselves.

Making a Bad Situation Worse

If secretly rolling out MCAS was not bad enough, the profit motive at Boeing made the situation worse.

Like most aircraft subsystems, engineers believed that the MCAS system would be connected to redundant Angle of Attack (AoA) sensors. The reason for this redundancy is to ensure that one faulty sensor doesn’t cause a problem.

However, to save money, MCAS was only connected to a single AoA sensor. In both the LionAir and Ethiopian crashes MCAS was triggered by a faulty sensor.

Secondly, the cockpit was to have an indicator light that would turn on if there was a disagreement between the various redundant AoA sensors on the aircraft. This would help the pilot know that there was a sensor problem. If they were also aware of MCAS, they could then turn off the automated trim for the stabilizers.

The indicator light and additional sensors were add-on extras that Boeing charged for. To save money, LionAir and Ethiopian did not get them.

Everything Falls Apart

When LionAir Flight 610 crashed into the Java Sea, Boeing initially blamed the LionAir pilots. Despite knowing that MCAS was a likely factor, they claimed that they were insufficiently trained to fly the aircraft. In order to keep MCAS hidden, they sent out a communique to pilots telling them to turn off the automated trim for the stabilizers if they ever encountered unexpected stabilizer problems.

When Ethiopian Flight 302 crashed after take-off with an experienced pilot onboard, Boeing knew they had a problem on their hands. The FAA determined that a 737MAX would likely crash for similar reasons every 18-24 months.

Boeing has since claimed to have changed MCAS in the MAX, and pilots are now required to be retrained in order to deal with the the changed flying characteristics. Much of the goodwill that Boeing once had is gone. The company also still struggles to this day with internal cultural problems. These put at risk the situational awareness that pilots need to safely fly aircraft. It also questions the level of trust for the mental models that once surrounded Boeing and the FAA.