This piece has been updated with information from Boeing.

Ever since a Boeing aircraft operated by Lion Air crashed back in October, and especially since an Ethiopian Airlines crash involving the same aircraft model this month, Boeing has been telling the world that safety is its most important concern. But according to a recent article in the New York Times, the aircraft manufacturer has been charging airlines extra for some features that could make flying safer.

"Safety is our highest priority." This phrase was part of an official statement from Boeing CEO Dennis  Muilenburg on the crashes of two Boeing 737 Max 8 planes in less than six months and the subsequent grounding of all 737 Max planes by U.S. president Donald Trump as well as about 30 other nations. 

It's one of the least surprising statements any executive will ever utter. Just do an internet search on the phrase and you'll quickly find a dozen or more companies that make that claim. Today's search turned up The Carlstar Group, the Pleasant Valley School District in Pennsylvania, and a Six Flags Great America in Gurnee, Illinois, among others. 

What would you expect a company to say, especially in a situation where employees, customers, or the public could be at risk? "We like to keep things safe when we can--but we worry most about our profits and our shareholders. They're what's really important." No company would ever issue such a statement, even if it might be true.

I'm not suggesting that Muilenburg wasn't sincere when he said Boeing prioritizes safety, or in a later statement when he put it even more strongly: "Safety is at the core of who we are at Boeing, and ensuring safe and reliable travel on our airplanes is an enduring value and our absolute commitment to everyone." Maybe he meant what he said. But as the New York Times reported, the way Boeing priced safety features for its planes as "upgrades" appears at odds with that statement. 

If you've been following the investigations into the crashes that brought down a Lion Air flight in Indonesia last fall and an Ethiopian Airlines flight this month, then you already know that suspicion in both events is focused on a Boeing software system called MCAS, (for Maneuvering Characteristics Augmentation System) that was intended to automatically lower the plane's nose if it got too high, which could cause a stall. In fact, after the Lion Air crash, Boeing had already been working on an update to that software which it plans to release next month. The update will make it less likely for pilots to lose control of the plane (as the Lion Air and Ethiopian Airlines pilots apparently did) when sensors reading the plane's flight angle malfunction. 

This underscores a simple truth about these two accidents that doesn't get mentioned often enough: as far as we know, the software itself functioned as intended. The devices that read the plane's orientation in the air, known as angle of attack sensors, apparently started providing false readings. It seems the angle of attack sensors read both planes as pointing too far skyward. Given those readings, the MCAS automatically lowered the nose, and the pilots were unable to correct the problem before the planes went down.

Apparently, those sensors do malfunction now and then. Two U.S. pilots who flew 737 Max aircraft reported the same thing happening to them, but in both cases they were able to disable the automatic pilot system and right the plane manually. As it happens, Boeing offers two cockpit indicators that quickly tell pilots when such a malfunction is happening. One, called the angle of attack indicator, displays the readings from the sensors. That could alert a pilot right away if the sensors read the nose as pointing too far upward when in fact the plane is level. The second, called a disagree alert, lights up if the two angle of attack sensors have different readings, which suggests that at least one of them is malfunctioning.

When Boeing began selling its new 737 Max line, it offered both those safety features as an optional upgrade. Airlines that wanted them had to pay extra for them. They're the kind of item low-cost airlines from poor countries might be tempted to skip and according to the Times, Lion Air and Ethiopian Airlines skipped both. After the Lion Air crash, Boeing announced the disagree alert would be standard on all new 737 Max planes. Until the Ethiopian Airlines crash, the angle of attack indicator remained an option that cost extra.

Since the Times story appeared, Tewolde Gebremariam, the CEO of Ethiopian Airlines, confirmed that the company had not purchased the angle of attack indicator or disagree alert upgrades, but rejected the notion that either or both could have prevented the accident. He also noted that Boeing did not identify these items as mandatory for safety. "The angle of attack indicator was on the optional list along with the inflight entertainment system," he told Reuters.

On Friday, the day after the Times published its story about safety features as upgrades, Boeing's chief engineer John Hamilton released a statement:

"All primary flight information required to safely and efficiently operate the 737 Max is included on the baseline primary flight display. Crew procedures and training for safe and efficient operation of the airplane are focused around airplane roll and pitch attitude, altitude, heading and vertical speed, all of which are integrated on the primary flight display. All 737 Max airplanes display this data in a way that is consistent with pilot training and the fundamental instrument scan pattern that pilots are trained to use." 

He added, "there are no pilot actions or procedures during flight which require knowledge of angle of attack." 

Even so, Boeing says it is now making both these items available on all its 737 Max aircraft at no extra charge. A Boeing representative provided this statement to Inc.:

"Customers have been informed that AOA [angle of attack] disagree alert will become a standard feature on the 737 Max. It can be retrofitted on previously delivered airplanes. With the software update, customers are not charged for the AOA disagree feature. And going forward, there will be no charge for customers who select the AOA indicator option. (Not all customers wish to include this feature on their Primary Flight Display, so it is offered as a customer-selected option.)"

In general, optional upgrades can be good for an aircraft manufacturer's bottom line. According to the Times, airlines could spend up to $2 million on options when ordering a 737. (It's worth noting that Boeing reported more than $10 billion in profit on more than $100 billion revenues for 2018.) But--even leaving aside the angle of attack indicator and disagree alert--some of the options the Times reported on just don't seem like they should be optional. For instance, a backup fire extinguisher in the cargo hold, something that the Japanese government mandates as a safety feature, although the Federal Aviation Administration does not. 

Aircraft manufacturers are predictably reluctant to publicly discuss which safety features cost extra, and airlines are predictably reluctant to reveal which safety features they've declined to buy--often they black this information out in their financial filings. But the Times came across one filing from 2003 for an earlier version of the 737 in which a Brazilian airline paid an extra $6,700 to get oxygen masks for its crew. I don't know about you, but if I'm on a flight and there's a loss of cabin pressure, I want everyone to have an oxygen mask, particularly the crew members whose instructions I'm supposed to be following.

Making the disagree alert standard and the angle of attack indicator available for free was the right decision, but it should have happened before so many lives were lost. And if safety truly is at the core of Boeing, it should stop charging extra for backup fire extinguishers as well. Or anything else we should all have when we're 30,000 above the earth.