A report set to be released Wednesday by the Inspector General of the U.S. Department of Transportation concludes that Boeing deliberately played down the details of the flight control system that later helped bring down two 737 MAX jets so that the Federal Aviation Administration (FAA), responsible for certifying the new system, entirely missed its significance and danger.
The system was the now-notorious Maneuvering Characteristics Augmentation System (MCAS) that activated erroneously and caused the deaths of 346 people in two crashes. On the two fatal MAX flights — Lion Air JT610 and Ethiopian Airlines ET302 — the pilots struggled in vain against MCAS when it repeatedly pushed down the nose of each jet.
More than two months after the Lion Air crash, in January 2019, the FAA initiated an internal review of the original MCAS certification process and for the first time performed its own detailed analysis of the system.
“According to several FAA certification engineers, it was also the first time that they were presented with a full picture of how MCAS worked,” the Inspector General (IG) report states.
The IG report, a copy of which was obtained by the Seattle Times, lays out a detailed timeline of how the FAA and Boeing certified the 737 MAX.
It notes that as the regulatory approval process progressed, the FAA handed over to Boeing itself more and more of the certification tasks until at the end, it had given all of them to Boeing for final approval — enabling virtual self-certification.
According to the minutes of an internal company meeting in June 2013, early in the certification process, Boeing officials made the decision to portray MCAS as merely a modification to an existing system — not as anything new — in order to make sure it didn’t spur the FAA to require more pilot training.
The meeting “represents an example of how Boeing presented the system to FAA and other regulators in order to meet program goals,” according to the IG report.
In the earliest meetings with the FAA, MCAS “was presented briefly with limited details.” Afterwards, as certification work proceeded, Boeing consistently underplayed MCAS, in part — as that meeting indicates — through a deliberate veiling of the details that comes close to deception.
The FAA caught unawares
But during the original certification process, MCAS was never highlighted to the FAA safety engineers tasked with oversight of the MAX systems, and they weren’t told of changes Boeing made late in the game that greatly increased the system’s ability to push the jet’s nose down.
FAA flight test pilots who flew the plane in the final months of certification were made aware of that change, which was made so as to cover low-speed stalls in addition to the previously anticipated high-speed stalls.
However, “the FAA engineer who reviewed the system safety assessment stated that he was not aware of (the increased power of the system) when he recommended approval” of Boeing’s request to have oversight of the system delegated to the jetmaker, the IG report states.
A failure probability analysis of the MAX systems completed earlier that year also never made it to the FAA.
That analysis identified a failure of an angle-of-attack sensor — which later triggered MCAS erroneously in both crashes — as potentially “catastrophic,” but determined this was acceptable because it was an extremely remote possibility.
Boeing considered this “an internal document only and did not submit it as a required certification deliverable,” the report states. “Therefore, Boeing did not provide it to FAA, nor did FAA have to review or approve it.”
In 2016, after MCAS was made more powerful, a revised hazard assessment concluded that “if a pilot’s reaction time was greater than 10 seconds, the event would be classified as catastrophic due to the pilot’s inability to regain control of the aircraft.”
However, Boeing’s assumption was that pilots would respond within four seconds. And despite the change to the power of MCAS, Boeing kept the revised hazard assessment documents close and “did not submit them to FAA for review or acceptance.”
According to the report, the FAA in late 2013 had delegated to Boeing only 28 out of 87 detailed certification projects on the MAX, retaining the rest.
But three years later, it had delegated 79 of the now 91 projects and by March 2017, the “FAA eventually delegated all 91 certification plans to Boeing.”
Pressure to resist pilot training
Ultimately Boeing, through chief technical pilot Mark Forkner, had all mention of MCAS completely removed from the MAX flight manual, to ensure it escaped deeper scrutiny that could have potentially triggered a requirement for pilot training in a simulator.
One program goal was to meet the demand of key launch customer Southwest Airlines that its pilots, who were experienced flying earlier 737 models, wouldn’t need simulator training to fly the MAX.
Citing testimony by an FAA official and an internal Boeing email, the IG report states that Boeing aimed “to keep a common type rating for the aircraft — which would minimize additional training requirements for 737 MAX pilots … and to avoid the need for 737 MAX pilots to train in simulators, which can add costs for airlines.”
The report states that the FAA official who agreed to remove mention of MCAS from the flight manual was unaware that the system’s power had significantly increased. Boeing hadn’t told him.
The FAA official “based the decision on the understanding that MCAS was still as originally designed,” the report states.
According to the IG, the fact that the FAA test pilots knew about the late change made to MCAS, but the FAA safety engineers assessing it did not, “demonstrates a lack of consistent and transparent communication both between Boeing and FAA, as well as within FAA.”
The IG separately details an earlier 2015 report of a survey it conducted in the middle of the MAX certification process, which found that many Boeing engineers who worked on behalf of the FAA during airplane certification felt they were subject to “undue pressure” from managers.
In a memo offered as an appendix, Department of Transportation General Counsel Steven Bradbury writes a preliminary response to the IG report.
The IG review “makes clear that FAA’s certification of the 737 MAX was hampered by a lack of effective communication … which led to an incomplete understanding of the scope and potential safety impacts of changes to the flight control system,” Bradbury wrote.
“FAA’s certification process relies on receiving complete, candid information from manufacturers,” he added. “The agency will be taking further steps to ensure integrity and transparency.”
