Blue Chip Catastrophes

What do the 393 grounded Boeing 737 MAX aircraft have in common with BP’s “Deepwater Horizon” fire and uncontrolled oil release, or with Volkswagen’s (VW) “cheat technology” that ensured its diesel engine cars could pass stringent U.S. and European emissions test standards?

All three situations cost their respective companies tens of billions of dollars. Two of them concerned the development of in-house software that caused more self-inflicted damage to the company’s balance sheet than any corporate hit from an external cyberattack. And all three highlight defective risk management and regulation.

Volkswagen Group, BP and Boeing are all world class companies: ranked #18, #24 and #49 globally in the recently published Forbes Global 2000. For investors these are “blue chip” stocks: “… the stalwarts of industry – safe, stable, profitable and long-lasting companies, they represent safe, low volatility investments.” Investors might prefer to return to the original definition of “blue chip” in poker-playing, where it designates the highest value token but says nothing about the risk.

Boeing’s 737 Fix

With the Federal Aviation Authority (FAA) – the U.S. transport regulator, recently declaring that there is no schedule in place for re-certifying the 737 MAX, it is worth looking back at the origins of this plane. Back in 2010, when up against powerful competition from the Airbus A320, Boeing needed a more fuel-efficient version of the most successful airplane ever: the 737.

The company costed up its options. Modifications to make a new fuel-conserving 737 were priced at US$2-3 billion including new engine development. It would cost US$10-12 billion to develop a completely new airframe. The decision was taken to modify the 737 and the pressure was on to get it launched. First delivered in the middle of 2017, by January 2019 the 737 MAX had more than 5,000 orders.

The 737 sat low on the runway. To achieve enough ground clearance to mount the larger diameter, fuel efficient engines, the engineers had to position them higher and further forward on the wings. In flight, this shift tended to lift the nose of the plane, meaning the plane could potentially stall. To counteract that tendency, software was written (the Maneuvering Characteristic Augmentation System: MCAS) to take over flying the plane, pointing the nose back down to pick up speed. However, the MCAS was triggered by two sensors that could deliver contradictory data. Once the automatic system was operating to point the nose down, it was not easy for the pilot to wrest back control, especially if the sensors indicated falsely the plane was still climbing.   

On October 29, 2018, a 737 MAX 8 aircraft (Lion Air Flight 610) crashed into the sea twelve minutes after take off from Jakarta killing all 189 on board. Then on March 10, 2019, the 737 MAX 8 Ethiopian Airlines Flight 302 from Addis Ababa crashed six minutes after take off killing 157 people.

A preliminary report from Indonesian air safety investigators identified that the Lion Air flight crashed after a faulty sensor indicated that the plane was stalling, triggering the MCAS to point the aircraft’s nose down to gain speed. Initial indicators suggested a similar fate for Ethiopian Airlines Flight 302 where the MCAS system was found to be engaged at the moment the plane crashed.

As evidence accumulated that the fate of these two short flights had much in common, a day after the Ethiopian Airlines crash, China grounded all 737 MAX aircraft, followed by Europe on March 12. Despite an appeal by Boeing’s CEO to the U.S. President, the U.S. also joined the call for action, and remarkably, the FAA was the last major aviation regulator to call for action on March 13. All 393 Boeing 737 MAX aircraft already in service were grounded worldwide.

It turns out a number of pilots flying the new plane had previously reported their shock at the MCAS system unexpectedly kicking in, causing a sudden descent, a situation for which they had not been trained. As an optional extra Boeing had offered a warning light to indicate if the sensors that triggered the MCAS were giving inconsistent information, but this option was not chosen by either of the airlines whose flights crashed.

As the investigations got underway, information emerged about how the operations of the MCAS software had been handled through the plane’s certification. Bloomberg reported that a dozen whistleblowers who currently work or had worked at the FAA or Boeing had got in touch with U.S. aviation and congressional officials.

According to a report in the Seattle Times, the approval process for the new planes was rushed and potentially compromised. Understaffed, the FAA asked Boeing to produce the safety assessments themselves so that the aircraft manufacturer would not be delayed. The U.S. Department of Transportation and the FBI are currently investigating the process by which Boeing achieved the 737 Max 8 certification. European pilots have criticized the FAA. The Washington Post reported that the European Cockpit Association said that it was “extremely worrying” that “… the manufacturer and the authorities are difficult to distinguish” in the FAA’s certification system

Boeing also convinced the regulator that pilots who had already flown the 737 would not require additional training, itself a significant cost saving. On the Lion Air flight, the pilots had desperately searched the plane’s manual in the minutes before the crash, the plane intact on impact with the sea and the engines still running. In some airlines, pilots were being taught the features of the new plane on an iPad. At United Airlines, a thirteen page pilot guide to the 737 MAX 8 did not mention the MCAS.

BP

In April 2010, BP was the lead in a joint venture exploration play in 1,500 meters water depth in the Gulf of Mexico at the toe of the Mississippi River delta. Drilling was from the Deepwater Horizon semi-submersible platform, valued at US$560 million. The well was drilled to a depth of more than five kilometers, encountering several over-pressured oil and gas accumulations. A team of contractors injected a cement lining in the well, planning to cap it at the sea floor for later return.

Initial tests showed problems with the integrity of the cement lining, but short of rig time, the operator agreed to proceed. As the heavy drilling mud in the well was being replaced with sea water, there was a blowout, of first gas and then oil. Unable to get the sea bed “blowout preventer” to cut off the well, or to detach the riser, the blowout brought explosions and a fire that sunk the platform. Over the following three months 4.9 million barrels of oil flowed into the Gulf of Mexico.

Volkswagen

Unable to satisfy U.S. and European emissions standards for nitrous oxide emissions from “green” diesel cars, software was fitted to a total of eleven million VW vehicles, designed to recognize when an emissions test was underway. The software was sophisticated, with ten separate profiles to identify alternative testing environments. A total of 964 versions of the Engine Control Unit code were found across different makes and models, in 400 of which the “defeat device” was included. The facility was only detected when three researchers from the University of West Virginia came to California to test the emissions from VW rental cars on the open road, and discovered emissions twenty to forty times those measured in the garage. VW admitted the existence of the cheat software in October 2015. There were 600,000 of the diesel cars fitted with the software in the U.S., but 8.5 million in Europe.

The Costs

The total cost to BP of the Deepwater Horizon incident including clean-up costs, fines and compensation has exceeded US$65 billion. The total cost to Volkswagen is in excess of €30 billion. For Boeing the loss in share value so far has been US$36 billion, and at least another US$1 billion reported increase in costs.

Although BP did not purchase insurance, the platform owner, contractors and partner oil companies had in total US$4-6 billion of insurance cover which paid out on the disaster.

For Boeing, the presence of eight Americans among the thirty-five nationalities killed in the Ethiopian Airlines crash, as well as the potential culpability of the manufacturer, means passenger liability costs are likely to be set at a high level. The grounded airplanes alone are estimated to cost their operators (according to aerospace consultancy IBA) US$150,000 per aircraft per day. There are 393 aircraft grounded altogether costing US$59 million per day or US$1.76 billion per month. Airlines will want to recover these costs from Boeing.

Boeing has a grounding liability insurance coverage with a sublimit cap of US$500 million, which together with hull and passenger liability are expected to pay out at least US$1 billion. If Boeing’s systems are found to have caused the crashes insurers will try to pass on their payouts for hull, passenger liability and grounding costs to Boeing’s product liability insurance, understood to have a limit of US$2.5 billion.

Boeing is clearly hoping the situation can be fixed through changes in software, warning systems and training, but it is also possible that the 737 MAX is acknowledged to have a design flaw. Many of the airlines that previously had orders for the aircraft might then cancel or switch their order to a different plane.

For VW, as the problems had been caused by sanctioned illegal activities, the company could not claim from any of its insurance policies.

The Role of the Regulator

The official investigation of the Deepwater Horizon incident identified “… the lack of a strong safety culture resulting from a deficient overall systems approach to safety.” The regulator, the Minerals Management Service of the U.S. Department of the Interior, had suffered static or reduced funding through a period of dramatic expansion of deepwater exploration and production. Industry was left to decide what to reveal to the regulator. BP had not asked for any review of evidence for the integrity of the concrete casing at the Macondo well.

VW had cynically decided to bypass the function of the regulator, with software designed to recognize when emissions were being tested.

The role of the FAA in the situation at Boeing will take some time to be revealed, but it is clear the organization was under-resourced and undervalued.

Blue Chip Catastrophe Risks

In each of these three cases, did the company appreciate the magnitude of the bet they were taking? For BP the consequences would emerge in hours, for Boeing years, while for VW it took a decade. In each case the bet was that everything would turn out well, but no one seems to have estimated the probability and consequences of the bet going sour. In each case the downside has had a very expensive tail.

All three situations have involved some of the largest companies up against timid regulators. Powerful well-funded regulators are typically only found where there has already been a catastrophic incident. Before Deepwater Horizon, the regulation of the oil industry was much tougher in the North Sea than in the Gulf of Mexico because of the 1980s record of high casualty accidents. After Deepwater Horizon, regulation is now well resourced in the Gulf of Mexico. Strong regulation in the financial sector has followed the financial crisis. In evaluating the probability of future “Blue Chip Catastrophes” we can examine where the risk-taking is highest and the regulation is weakest.

For insurers “Blue Chip Catastrophes” present special challenges. The same companies may be found in both investment and underwriting portfolios.