Lax over­sight at FAA led to Boe­ing cri­sis


In the days af­ter the first crash of Boe­ing’s 737 Max, en­gi­neers at the Fed­eral Avi­a­tion Ad­min­is­tra­tion came to a trou­bling re­al­iza­tion: They didn’t fully un­der­stand the au­to­mated sys­tem that helped send the plane into a nose-dive, killing ev­ery­one on board.

En­gi­neers at the agency scoured their files for in­for­ma­tion about the sys­tem de­signed to help avoid stalls. They didn’t find much. Reg­u­la­tors had never in­de­pen­dently as­sessed the risks of the dan­ger­ous soft­ware known as MCAS when they ap­proved the plane in 2017.

More than a dozen cur­rent and for­mer em­ploy­ees at the FAA and Boe­ing who spoke with The New York Times de­scribed a bro­ken reg­u­la­tory process that ef­fec­tively neutered the over­sight au­thor­ity of the agency.

The reg­u­la­tor had been pass­ing off rou­tine tasks to man­u­fac­tur­ers for years, with the goal of free­ing up spe­cial­ists to fo­cus on the most im­por­tant safety con­cerns. But on the Max, the reg­u­la­tor handed nearly com­plete con­trol to Boe­ing, leav­ing some key agency of­fi­cials in the dark about im­por­tant sys­tems like MCAS, ac­cord­ing to the cur­rent and for­mer em­ploy­ees.

While the agency’s flawed over­sight of the Boe­ing 737 Max has at­tracted much scru­tiny since the first crash in Oc­to­ber and a sec­ond one in March, a Times in­ves­ti­ga­tion re­vealed pre­vi­ously un­re­ported de­tails about weak­nesses in the reg­u­la­tory process that com­pro­mised the safety of the plane.

The com­pany per­formed its own as­sess­ments of the sys­tem, which were not stress-tested by the reg­u­la­tor. Turnover at the agency left two rel­a­tively in­ex­pe­ri­enced en­gi­neers over­see­ing Boe­ing’s early work on the sys­tem.

The FAA even­tu­ally handed over re­spon­si­bil­ity for ap­proval of MCAS to the man­u­fac­turer. Af­ter that, Boe­ing didn’t have to share the de­tails of the sys­tem with the two agency en­gi­neers.

Late in the devel­op­ment of the Max, Boe­ing de­cided to ex­pand the use of MCAS. The new, riskier ver­sion re­lied on a sin­gle sen­sor and could push down the nose of the plane by a much larger amount.

Boe­ing did not sub­mit a for­mal re­view of MCAS af­ter the over­haul. It wasn’t re­quired by FAA rules.

The agency ul­ti­mately cer­ti­fied the jet as safe, re­quired lit­tle train­ing for pi­lots and al­lowed the plane to keep fly­ing un­til a sec­ond deadly Max crash, less than five months af­ter the first.

The FAA and Boe­ing have de­fended the plane’s cer­ti­fi­ca­tion, say­ing they fol­lowed proper pro­ce­dures and ad­hered to the high­est stan­dards.

“The 737 Max cer­ti­fi­ca­tion pro­gram in­volved 110,000 hours of work on the part of FAA per­son­nel, in­clud­ing fly­ing or sup­port­ing 297 test flights,” the agency said.

Boe­ing said that “the 737 Max met the FAA’s strin­gent stan­dards and re­quire­ments as it was cer­ti­fied through the FAA’s pro­cesses.”

Boe­ing needed the ap­proval process on the Max to go swiftly. Months be­hind its ri­val Air­bus, the com­pany was rac­ing to fin­ish the plane.

The reg­u­la­tor’s hand­soff ap­proach was piv­otal. At crucial mo­ments in the Max’s devel­op­ment, the agency op­er­ated in the back­ground, mainly mon­i­tor­ing Boe­ing’s progress and check­ing pa­per­work. The na­tion’s largest aerospace man­u­fac­turer, Boe­ing was treated as a client, with FAA of­fi­cials mak­ing de­ci­sions based on the com­pany’s dead­lines and bud­get.

Dur­ing the Max cer­ti­fi­ca­tion, se­nior FAA lead­ers some­times over­ruled their own staff mem­bers’ rec­om­men­da­tions af­ter Boe­ing pushed back.

Af­ter the crash of the Lion Air plane in Oc­to­ber, FAA en­gi­neers were shocked to dis­cover they didn’t have a com­plete anal­y­sis of MCAS. The safety re­view in their files didn’t men­tion that the sys­tem could ag­gres­sively push down the nose of the plane and trigger re­peat­edly, mak­ing it dif­fi­cult to re­gain con­trol of the air­craft.

De­spite their hazy un­der­stand­ing of the sys­tem, FAA of­fi­cials de­cided against ground­ing the 737 Max. In­stead, they pub­lished a no­tice re­mind­ing pi­lots of ex­ist­ing emer­gency pro­ce­dures.

The no­tice didn’t de­scribe how MCAS worked. At the last minute, an FAA man­ager told agency en­gi­neers to re­move the only men­tion of the sys­tem, ac­cord­ing to in­ter­nal agency doc­u­ments and two peo­ple with knowl­edge of the mat­ter.

For decades, the FAA re­lied on en­gi­neers in­side Boe­ing to help cer­tify air­craft. But af­ter in­tense lob­by­ing by in­dus­try, the agency adopted rules in 2005 that would give man­u­fac­tur­ers like Boe­ing even more con­trol. By 2018, the FAA was let­ting the com­pany cer­tify 96% of its own work, ac­cord­ing to an agency of­fi­cial.

In the mid­dle of the Max’s devel­op­ment, two of the most sea­soned en­gi­neers in the FAA’s Boe­ing of­fice left. The en­gi­neers, who had a com­bined 50 years of ex­pe­ri­ence, grew frus­trated with the work, which they saw as mostly pa­per push­ing, ac­cord­ing to two peo­ple with knowl­edge of the staff changes.

In their place, the FAA ap­pointed an en­gi­neer who had lit­tle ex­pe­ri­ence in flight con­trols, and a new hire who had got­ten his master’s de­gree three years ear­lier. Peo­ple who worked with the two en­gi­neers said they seemed ill-equipped to iden­tify any prob­lems in a com­plex sys­tem like MCAS.


A Boe­ing 737 Max at the com­pany’s plant in Ren­ton, Wash., on July 21. Af­ter the first fa­tal crash of a 737 Max, in Oc­to­ber 2018, fed­eral reg­u­la­tors re­al­ized they didn’t un­der­stand the soft­ware sys­tem that made the plane nose­dive.

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.