Written by David Gelles and Thomas Kaplan
As regulators at the Federal Aviation Administration reviewed designs for Boeing’s newest passenger jet, they paid extra attention to several features, including the lithium-ion batteries, the pressure fueling system and the inflatable safety slides.
One feature that did not receive exceptional scrutiny: a new software system intended to prevent stalls.
That same software is suspected of playing a role in two deadly crashes involving the same jet, the Boeing 737 Max. Authorities around the world are now taking a closer look at the jet’s approval by the FAA, a process that relies heavily on Boeing employees to certify the safety of the plane.
The 737 Max was one of the first commercial jets approved under new rules, which delegated more authority to Boeing than had been the case when most previous planes were certified. And the software system did not raise warnings during the approval process. Top FAA officials, who are briefed on significant safety issues, were not aware of the software system, according to two people with knowledge of the process.
The US transportation secretary, Elaine Chao, on Tuesday called for her agency’s internal watchdog to open an inquiry into the process, saying that “safety is the top priority of the department.” Lawmakers in the United States are similarly pushing for a review, while Canada is looking into its approval of the plane’s US certification.
The scrutiny adds to the pressure at Boeing, an aerospace giant with a strong safety record. The 737 Max, its best-selling jet, has more than 4,600 pending orders, which are expected to bring in hundreds of billions of dollars in the coming years.
The plane is grounded as the company races to come up with a fix to the software. It is unclear when the jet will start flying again.
A Boeing spokesman said the manufacturer would cooperate with the audit by the Department of Transportation. It has defended the certification process for the jet, saying that “the 737 Max was certified in accordance with the identical FAA requirements and processes that have governed certification of all previous new airplanes and derivatives.”
The FAA’s response to the crisis has also come under scrutiny. As authorities in other countries moved quickly to ban the plane after the crash in Ethiopia this month, the US regulator held off.
The FAA has been run by an acting administrator, Daniel Elwell, since January 2018. President Donald Trump on Tuesday picked a former Delta Air Lines executive, Stephen Dickson, to become the permanent head of the agency.
Before a new plane can fly, the FAA, in partnership with manufacturers, assesses the technology, design and components of the jet. They look for potential safety issues that could affect the airworthiness of the plane.
The investigations into the crashes are ongoing, but the similarities between the two doomed flights suggest potential problems with the new software system, known as MCAS. In the case of a Lion Air crash in October, the automated system may have engaged based on erroneous data, creating a struggle for the pilots who were trying to maintain control.
But the software — powerful as it was — did not emerge as a major focus for the FAA regulators who certified the Max as safe to fly in 2017, according to the people involved in the effort who were not authorized to speak publicly about the process.
The software did not set off what is known as a special condition, usually applied to a novel feature that requires additional regulations before it can be certified as safe. The plane’s nonrechargeable lithium batteries, for example, fell into that category.
To Boeing and regulators, the MCAS software was not a technological breakthrough. Rather, it was viewed as part of the existing flight control software, according to one of the people.
The system was intended as a safety feature to make the 737 Max, which boasted other significant design features, fly like earlier models.
The new, more efficient engines on the 737 Max were larger and placed in a different location than previous generations. To compensate for the new aerodynamics, Boeing installed the software, which would force the nose of the plane down in certain circumstances. The goal was to help avoid a stall.
The FAA, in its approval of the plane, did not require training on the software, a sign that regulators did not see the system as critical for pilots to understand. Nor did the FAA require pilots who could fly the predecessor 737 to train on a simulator in order to fly the Max. Most pilots did not know about MCAS until after the Lion Air crash.
The regulators also approved the software to be triggered after receiving data from only one so-called angle-of-attack sensor. The decision allowed for the system to have a single point of failure, a rarity in aviation safety.
Most important safety systems include redundancy. The coming software fix by Boeing will require data from both of the plane’s angle-of-attack sensors, among other changes, according to pilots and lawmakers.
Certifying the 737 Max was a collaborative effort between the FAA and Boeing. The regulator for decades has relied on employees at aircraft manufacturers to assist in the review process.
In 2005, the FAA delegated more authority to companies, allowing manufacturers like Boeing to select their own employees who would help with certification work. And the 737 Max, which started going through certification process in 2012, was one of the first passenger jets to be approved under this new program.
In regards to the FAA inquiry, a spokesman for the Transportation Department’s Office of Inspector General said the office was “developing the scope and objectives of our review and expect to formally announce and begin our audit work as soon as possible.”
The FAA declined to comment Tuesday. The agency has said that its “aircraft certification processes are well established and have consistently produced safe aircraft designs,” and that the certification of the Max “followed the FAA’s standard certification process.”
For regulators, outsourcing part of the review process was a way to stretch their resources. For U.S. plane manufacturers like Boeing, it was a critical for speeding up the regulatory process, as they try compete with foreign rivals.
“People want oversight when something goes wrong,” said Peter Goelz, a former managing director of the National Transportation Safety Board, which investigates aviation accidents. “But at the same time, they do not want these companies tied up in knots and not able to produce products for the marketplace.”
Ali Bahrami, the FAA’s top safety official, used to be an executive at the Aerospace Industries Association, a trade group whose members include Boeing as well as many other companies in the aviation industry. In 2013, he urged the FAA to “allow maximum use of delegation.”
“With the worldwide market shifting to Asia and the developing world, it would be detrimental to our competitiveness if foreign manufacturers are able to move improved products into the marketplace more quickly,” he said in prepared testimony for a congressional hearing.
But the relationship between Boeing and the FAA prompted concern even before the 737 Max crashes.
In 2012, an investigation by the Transportation Department’s Office of Inspector General found that FAA managers had not always been supportive of efforts by agency employees to “hold Boeing accountable.” FAA employees viewed their managers as “having too close a relationship with Boeing officials,” according to a report from the inspector general’s office.
A 2015 report by the inspector general’s office expressed concern about the certification process. “During our review, industry representatives expressed concern that FAA’s focus was often on paperwork — not on safety-critical items,” the report said.
The same year, a Boeing executive at a congressional hearing described the arrangement as effectively having an “arm of the FAA within the Boeing Co.” Some 1,000 employees, the executive said, were part of the program.
“Boeing and the FAA have had an almost symbiotic relationship,” said Michael Dreikorn, an aviation safety expert who previously worked in a safety oversight roles at the FAA. “The relationship is too cozy.”