Both Boeing and the FAA had deemed the now-grounded planes safe as part of a years-long certification process. But the expert panel convened by the FAA, after crashes in Indonesia and Ethiopia together killed 346 people, said that process failed to identify and prevent what turned out to be profound dangers.
“People who needed to know things in order to make informed decisions didn’t know everything they needed to know,” said Christopher Hart, a former chairman of the National Transportation Safety Board, who chaired the panel. “That was the challenge. Then when they found out about it, it was a fait accompli and it was too late. In fact it was, in most cases, after the crash occurred that they found out. ‘Really? I didn’t know that was an issue.’ ”
Among other problems, the panel found that vital information about the automated feature, the Maneuvering Characteristics Augmentation System (MCAS) — including how it was intended to work and its technical underpinnings — was provided in a “fragmented” fashion.
“Although MCAS may have been briefed to some FAA personnel, key aspects of the MCAS function such as intended function description, its interfaces, and architecture, were not directly visible to the FAA in a straightforward manner through the certification deliverable documents,” the panel found.
The panel included experts from the FAA, NASA, and aviation authorities in Australia, Brazil, Canada, China, the European Union, Japan, Indonesia, Singapore and the United Arab Emirates. The FAA experts had not taken part in the certification of the plane, Hart said.
The panel focused on the certification of the Max’s flight control system, including MCAS. Investigators say that before the deadly crashes, faulty information from an external sensor caused MCAS to mistakenly kick in, repeatedly, forcing the planes’ noses down as pilots struggled to regain control.
Initially, MCAS was designed to automatically adjust part of the plane’s horizontal stabilizer by 0.6 degrees and would not repeatedly override a pilot’s commands. The horizontal stabilizer, on the plane’s tail, can make the aircraft ascend or descend.
But Boeing engineers dramatically increased that maximum movement to 2.5 degrees, which gave MCAS much more potency and more power to overtake pilots in the case of an errant sensor reading, congressional officials said.
The panel found that because the FAA knew too little about MCAS’s functions, the agency missed opportunities for closer scrutiny that “would likely have resulted in design changes that would have improved safety.”
The FAA group that oversees Boeing, known as the Boeing Aviation Safety Oversight Office, has a staff of 45 people, according to the report. That’s compared with a team of 1,500 Boeing employees that was given authority by the FAA to handle key certification work on the company’s planes as part of a program called Organization Designation Authorization.
Hart said that “as this process of delegation became more complicated, it resulted in some communication failures,” adding that the FAA should continue to analyze the question: “Was that failure to communicate between the manufacturer and the regulator partially responsible for the MCAS . . . evolving from a relatively benign system to a not-so-benign system without adequate knowledge by the FAA?”
The panel said it wasn’t able to assess the experience and qualifications of the FAA staff but said some engineers may have been entry-level.
FAA Administrator Stephen Dickson thanked Hart and the panel’s members for “their unvarnished and independent review” and said he would “take appropriate action” on the group’s recommendations.
“Today’s unprecedented U.S. safety record was built on the willingness of aviation professionals to embrace hard lessons and to seek continuous improvement. We welcome this scrutiny and are confident that our openness to these efforts will further bolster aviation safety worldwide,” Dickson said in a statement.
Boeing spokesman Peter P. Pedraza said in a statement that the company thanked the review group and would work with the FAA to go over its recommendations.
“Safety is a core value for everyone at Boeing and the safety of the flying public, our customers, and the crews aboard our airplanes is always our top priority,” Pedraza said.
Rep. Peter A. DeFazio (D-Ore.), chairman of the House Transportation and Infrastructure Committee, said the report’s findings match what his staff is learning in its own investigation of the crashes about pressure put on FAA and Boeing employees to “get the Max into service as quickly as possible.”
“The JATR report raises new and disturbing questions about the separation between regulator and manufacturer,” DeFazio said.
The Hart panel said there was evidence that Boeing’s certification engineers were subject to “undue pressure.” The group called on the FAA to ensure that company engineers can communicate with the agency’s technical staff “without fear of reprisal.” Hart said he did not have examples of what those pressures were when asked after the report’s release.
The panel’s report said the “undue pressure” may be explained by “conflicting priorities” within Boeing and “an environment that does not support FAA requirements.”
Asked whether FAA managers applied pressure on lower-level agency officials regarding approvals of the Max, Hart said: “We didn’t get any indication that there was pressure from management. We just got the indication that the communications process was sufficiently complicated that it was undermined and didn’t work as well as it needed to. So it wasn’t a matter of pressure from FAA management.”
Hart said that, overall, “the essence of the report is that there were a lot of good people trying to do the right thing in sometimes difficult circumstances. But we did not see that anybody intentionally did anything wrong or was trying to do anything wrong.”
Among those difficult circumstances for the FAA, Hart said, was “not being able to hire and retain the leading engineers in this industry in a rapidly developing, rapidly evolving technological situation.”
At a recent congressional hearing, Deputy FAA Administrator Daniel Elwell said repeatedly that he thought the agency had enough technical staffers and other resources to carry out its mission, although he acknowledged that it was competing for a small supply of engineers.
“We are adequately staffed today, but we are looking forward to the future,” he said.
The Max has been grounded worldwide since shortly after the March crash in Ethiopia.
Hart’s group’s work was separate from FAA efforts to review the Max and get the plane flying again. It’s unclear when operators might get the green light. American Airlines said Thursday that it expects to start flying the jets again Jan. 16, and United Airlines said Friday that it was keeping the Max off its schedule until at least Jan. 6.
The crashes left both the FAA and Boeing under intense scrutiny, and the new findings add to a picture of dysfunction in the design and safety certification of the Max.
Last month the NTSB released separate findings concluding that Boeing didn’t sufficiently consider how pilots would respond to a barrage of cockpit alerts triggered by an MCAS failure. The company also underestimated the risk posed by such a failure and overestimated pilots’ ability to respond, the board concluded.
Those conclusions were broadly shared by Hart’s panel.
The Justice Department’s criminal division is among the entities still looking into the aircraft and questions about its certification.
The union representing Southwest Airlines pilots sued Boeing this week, alleging that the company gave pilots false information about the safety of the new planes. The union alleges that its pilots have lost income because the planes are grounded.
Hart’s panel recommended that the FAA and the aviation industry at large consider whether requiring compliance with specific rules is enough to guarantee safety as aircraft become more complicated.
“As systems become more complex and may interact in unforeseeable ways, the likelihood increases that regulations and standards will not address every conceivable scenario,” Hart wrote.