The Roots of Boeing's 737 Max Crisis: A Regulator Relaxes Its Oversight
After the first fatal crash of the 737 Max, in October 2018, federal regulators realized they didn't fully understand the software system that sent the plane into a nosedive.
SEATTLE - In the days after the first crash of Boeing's 737 Max, engineers at the Federal Aviation Administration came to a troubling realization: They didn't fully understand the automated system that helped send the plane into a nose-dive, killing everyone on board.
Engineers at the agency scoured their files for information about the system designed to help avoid stalls. They didn't find much. Regulators had never independently assessed the risks of the dangerous software known as MCAS when they approved the plane in 2017.
More than a dozen current and former employees at the F.A.A. and Boeing who spoke with The New York Times described a broken regulatory process that effectively neutered the oversight authority of the agency.
The regulator had been passing off routine tasks to manufacturers for years, with the goal of freeing up specialists to focus on the most important safety concerns. But on the Max, the regulator handed nearly complete control to Boeing, leaving some key agency officials in the dark about important systems like MCAS, according to the current and former employees.
While the agency's flawed oversight of the Boeing 737 Max has attracted much scrutiny since the first crash in October and a second one in March, a Times investigation revealed previously unreported details about weaknesses in the regulatory process that compromised the safety of the plane.
The company performed its own assessments of the system, which were not stress-tested by the regulator. Turnover at the agency left two relatively inexperienced engineers overseeing Boeing's early work on the system.
The F.A.A. eventually handed over responsibility for approval of MCAS to the manufacturer. After that, Boeing didn't have to share the details of the system with the two agency engineers. They weren't aware of its intricacies, according to two people with knowledge of the matter.
Late in the development of the Max, Boeing decided to expand the use of MCAS, to ensure the plane flew smoothly. The new, riskier version relied on a single sensor and could push down the nose of the plane by a much larger amount.
Boeing did not submit a formal review of MCAS after the overhaul. It wasn't required by F.A.A. rules. An engineering test pilot at the regulator knew about the changes, according to an agency official. But his job was to evaluate the way the plane flew, not to determine the safety of the system.
The agency ultimately certified the jet as safe, required little training for pilots and allowed the plane to keep flying until a second deadly Max crash, less than five months after the first.
The plane remains grounded as regulators await a fix from Boeing. If the ban persists much longer, Boeing said this past week that it could be forced to halt production.
The F.A.A. and Boeing have defended the plane's certification, saying they followed proper procedures and adhered to the highest standards.
"The agency's certification processes are well-established and have consistently produced safe aircraft designs," the regulator said in a statement Friday. "The 737 Max certification program involved 110,000 hours of work on the part of F.A.A. personnel, including flying or supporting 297 test flights."
Boeing said "the F.A.A.'s rigor and regulatory leadership has driven ever-increasing levels of safety over the decades," adding that "the 737 Max met the F.A.A.'s stringent standards and requirements as it was certified through the F.A.A.'s processes."
[If you have worked at Boeing or the F.A.A. and want to discuss your experience, contact The Times confidentially here.]
While Ali Bahrami was the Federal Aviation Administration’s top official in Seattle, some engineers believed that he had installed managers who would be deferential to Boeing.
Federal prosecutors and lawmakers are now investigating whether the regulatory process is fundamentally flawed. As planes become more technologically advanced, the rules, even when they are followed, may not be enough to ensure safety. The new software played a role in both disasters, involving Lion Air and Ethiopian Airlines, which together killed 346 people.
"Did MCAS get the attention it needed? That's one of the things we're looking at," said Chris Hart, the former chairman of the National Transportation Safety Board, who is now leading a multiagency task force investigating how the Max was approved. "As it evolved from a less robust system to a more powerful system, were the certifiers aware of the changes?"
Boeing needed the approval process on the Max to go swiftly. Months behind its rival Airbus, the company was racing to finish the plane, a more fuel-efficient version of its best-selling 737.
The regulator's hands-off approach was pivotal. At crucial moments in the Max's development, the agency operated in the background, mainly monitoring Boeing's progress and checking paperwork. The nation's largest aerospace manufacturer, Boeing was treated as a client, with F.A.A. officials making decisions based on the company's deadlines and budget.
It has long been a cozy relationship. Top agency officials have shuffled between the government and the industry.
During the Max certification, senior leaders at the F.A.A. sometimes overruled their own staff members' recommendations after Boeing pushed back. For safety reasons, many agency engineers wanted Boeing to redesign a pair of cables, part of a major system unrelated to MCAS. The company resisted, and F.A.A. managers took Boeing's side, according to internal agency documents.
After the crash of the Lion Air plane last October, F.A.A. engineers were shocked to discover they didn't have a complete analysis of MCAS. The safety review in their files didn't mention that the system could aggressively push down the nose of the plane and trigger repeatedly, making it difficult to regain control of the aircraft, as it did on the doomed Lion Air flight.
Despite their hazy understanding of the system, F.A.A. officials decided against grounding the 737 Max. Instead, they published a notice reminding pilots of existing emergency procedures.
The notice didn't describe how MCAS worked. At the last minute, an F.A.A. manager told agency engineers to remove the only mention of the system, according to internal agency documents and two people with knowledge of the matter. Instead, airlines learned about it from Boeing.
'He really wanted abdication.'
The F.A.A. department that oversaw the Max development had such a singular focus that it was named after the company: The Boeing Aviation Safety Oversight Office.
Many F.A.A. veterans came to see the department, created in 2009, as a symbol of the agency's close relationship with the manufacturer. The top official in Seattle at the time, Ali Bahrami, had a tough time persuading employees to join, according to three current and former employees.
Some engineers believed that Mr. Bahrami had installed managers in the office who would defer to Boeing. "He didn't put enough checks and balances in the system," Mike McRae, a former F.A.A. engineer, said of Mr. Bahrami. "He really wanted abdication. He didn't want delegation."
Before the certification of the Max began, Mr. Bahrami called a group of F.A.A. engineers into his office, the current and former employees said, and asked some of them to join the group. Many didn't want to change jobs, according to a complaint filed by the National Air Traffic Controllers Association, the union representing F.A.A. engineers.
"I got dragged kicking and screaming," said Richard Reed, a former systems engineer at the F.A.A. Mr. Reed said he had just left surgery when agency officials called to ask whether he would work in the office. "I always claimed that I was on drugs when I said 'yes.'"
The F.A.A. said in a statement that Mr. Bahrami "dedicated his career to the advancement of aviation safety in both the private and public sectors."
F.A.A. offices in Des Moines, Wash. The way the agency dealt with Boeing left engineers at the agency demoralized, two employees said.
For decades, the F.A.A. relied on engineers inside Boeing to help certify aircraft. But after intense lobbying to Congress by industry, the agency adopted rules in 2005 that would give manufacturers like Boeing even more control. Previously, the agency selected the company engineers to work on its behalf; under the new regulations, Boeing could choose them, though the F.A.A. has veto power.
Many of the agency's top leaders embraced the approach. It would allow the F.A.A. to certify planes more efficiently and stretch its limited resources. The regulator had also been finding it harder to compete for talented engineers, their government salaries unable to keep up with the going rates in the industry.
For Boeing, the changes meant shedding a layer of bureaucracy. "The process was working well," said Tom Heineman, a retired Boeing engineer who worked on the Max. "The F.A.A. was delegating more of the work and the review and the oversight to the manufacturers than it used to."
But some F.A.A. engineers were concerned that they were no longer able to effectively monitor what was happening inside Boeing. In a PowerPoint presentation to agency managers in 2016, union representatives raised concerns about a "brain drain" and the "inability to hire and retain qualified personnel."
By 2018, the F.A.A. was letting the company certify 96 percent of its own work, according to an agency official.
Nicole Potter, an F.A.A. propulsion and fuel systems engineer who worked on the Max, said supervisors repeatedly asked her to give up the right to approve safety documents. She often had to fight to keep the work.
"Leadership was targeting a high level of delegation," Ms. Potter said. When F.A.A. employees didn't have time to approve a critical document, she said, "managers could delegate it back to Boeing."
It was a process Mr. Bahrami championed to lawmakers. After spending more than two decades at the F.A.A., he left the agency in 2013 and took a job at the Aerospace Industries Association, a trade group that represents Boeing and other manufacturers.
"We urge the F.A.A. to allow maximum use of delegation," Mr. Bahrami told Congress in his new lobbying role, arguing it would help American manufacturers compete.
In 2017, Mr. Bahrami returned to the F.A.A. as the head of safety.
An internal battle at the F.A.A.
With Boeing taking more control, F.A.A. engineers found they had little power, even when they did raise concerns.
Early on, engineers at the F.A.A. discovered a problem with one of the most important new features of the Max: its engines. The Max, the latest version of the 50-year-old 737, featured more fuel-efficient engines, with a larger fan and a high-pressure turbine. But the bigger, more complex engines could do more damage if they broke apart midair.
The F.A.A. engineers were particularly concerned about pieces hitting the cables that control the rudder, according to five people with knowledge of the matter and internal agency documents. A cable severed during takeoff would make it difficult for pilots to regain control, potentially bringing down the jet.
The F.A.A. engineers suggested a couple solutions, three of the people said. The company could add a second set of cables or install a computerized system for controlling the rudder.
Boeing did not want to make a change, according to internal F.A.A. documents reviewed by The Times. A redesign could have caused delays. Company engineers argued that it was unlikely that an engine would break apart and shrapnel would hit the rudder cable.
Most of the F.A.A. engineers working on the issue insisted the change was necessary for safety reasons, according to internal agency emails and documents. But their supervisors balked. In a July 2015 meeting, Jeff Duven, who replaced Mr. Bahrami as the head of the F.A.A.'s Seattle operation, sided with Boeing, said two current employees at the agency.
Boeing Max planes in Renton, Wash. The company downplayed the risks of the software, MCAS, to federal officials.
F.A.A. managers conceded that the Max "does not meet" agency guidelines "for protecting flight controls," according to an agency document. But in another document, they added that they had to consider whether any requested changes would interfere with Boeing's timeline. The managers wrote that it would be "impractical at this late point in the program," for the company to resolve the issue. Mr. Duven at the F.A.A. also said the decision was based on the safety record of the plane.
Engineers at the agency were demoralized, the two agency employees said. One engineer submitted an anonymous complaint to an internal F.A.A. safety board, which was reviewed by The Times.
"During meetings regarding this issue the cost to Boeing to upgrade the design was discussed," the engineer wrote. "The comment was made that there may be better places for Boeing to spend their safety dollars."
An F.A.A. panel investigated the complaint. It found managers siding with Boeing had created "an environment of mistrust that hampers the ability of the agency to work effectively," the panel said in a 2017 report, which was reviewed by The Times. The panel cautioned against allowing Boeing to handle this kind of approval, saying "the company has a vested interest in minimizing costs and schedule impact."
By then, the panel's findings were moot. Managers at the agency had already given Boeing the right to approve the cables, and they were installed on the Max.
Playing down risks
In the middle of the Max's development, two of the most seasoned engineers in the F.A.A.'s Boeing office left.
The engineers, who had a combined 50 years of experience, had joined the office at its creation, taking on responsibility for flight control systems, including MCAS. But they both grew frustrated with the work, which they saw as mostly paper pushing, according to two people with knowledge of the staff changes.
In their place, the F.A.A. appointed an engineer who had little experience in flight controls, and a new hire who had gotten his master's degree three years earlier. People who worked with the two engineers said they seemed ill-equipped to identify any problems in a complex system like MCAS.
And Boeing played down the importance of MCAS from the outset.
An early review by the company didn't consider the system risky, and it didn't prompt additional scrutiny from the F.A.A. engineers, according to two agency officials. The review described a system that would activate only in rare situations, when a plane was making a sharp turn at high speeds.
The F.A.A. engineers who had been overseeing MCAS never received another safety assessment. As Boeing raced to finish the Max in 2016, agency managers gave the company the power to approve a batch of safety assessments - some of the most important documents in any certification. They believed the issues were low risk.
One of the managers, Julie Alger, delegated the review of MCAS. Previously, the F.A.A. had the final say over the system.
The F.A.A. said that decision reflected the consensus of the team.
Boeing was in the middle of overhauling MCAS. To help pilots control the plane and avoid a stall, the company allowed MCAS to trigger at low speeds, rather than just at high speeds. The overhauled version would move the stabilizer by as much as 2.5 degrees each time it triggered, significantly pushing down the nose of the plane. The earlier version moved the stabilizer by 0.6 degrees.
When company engineers analyzed the change, they figured that the system had not become any riskier, according to two people familiar with Boeing's discussions on the matter. They assumed that pilots would respond to a malfunction in three seconds, quickly bringing the nose of the plane back up. In their view, any problems would be less dangerous at low speeds.
So the company never submitted an updated safety assessment of those changes to the agency. In several briefings in 2016, an F.A.A. test pilot learned the details of the system from Boeing. But the two F.A.A. engineers didn't understand that MCAS could move the tail as much as 2.5 degrees, according to two people familiar with their thinking.
Under the impression the system was insignificant, officials didn't require Boeing to tell pilots about MCAS. When the company asked to remove mention of MCAS from the pilot's manual, the agency agreed. The F.A.A. also did not mention the software in 30 pages of detailed descriptions noting differences between the Max and the previous iteration of the 737.
Days after the Lion Air crash, the agency invited Boeing executives to the F.A.A.'s Seattle headquarters, according to two people with knowledge of the matter. The officials sat incredulous as Boeing executives explained details about the system that they didn't know.
In the middle of the conversation, an F.A.A. employee, one of the people said, interrupted to ask a question on the minds of several agency engineers: Why hadn't Boeing updated the safety analysis of a system that had become so dangerous?
Boeing reportedly kept the FAA in the dark
about big changes it made to the 737 Max's flight-control software late in its
development
Boeing's 737 Max airplane has been grounded since a fatal crash in March, the second in five months. AP Photo/Elaine Thompson
Boeing's 737 Max airplane has been grounded since a fatal crash in March, the second in five months. AP Photo/Elaine Thompson
- The Federal Aviation
Administration didn't understand the risks of the flight-control system in
Boeing's 737 Max before the first of its fatal accidents last October,
according to a new report in The New York Times.
- The engineers charged with
overseeing the safety of the automated software had little experience with
such systems, according to the report.
- The FAA allowed Boeing to
assess the safety of the system itself, The Times reported.
The Federal Aviation Administration was poorly positioned to oversee the safety of the automated flight system that was to blame for the two deadly crashes of Boeing's 737 Max plane over the last year, The New York Times reported Saturday.
The agency engineers in charge of keeping a watch on the airplane's flight control systems through the latter part of its development had little experience with such software, according to The Times report. And Boeing largely kept them in the dark about the importance of the flight-control system on the 737 Max and a crucial change they made to the software soon before releasing the plane commercially, The Times reported.
The Times did not name the engineers in its report.
In a statement emailed to Business Insider, Boeing spokesman Peter Pedraza said the company actually had informed the FAA about changes it made to the flight-control system, dubbed MCAS, during the 737 Max's development.
"The 737 MAX met the FAA's stringent standards and requirements as it was certified through the FAA's processes," Pedraza said in the statement. "The FAA," he continued, "considered the final configuration and operating parameters for MCAS and concluded it met all certification and regulatory requirements."
FAA spokesman Lynn Lunsford declined to comment on The Times' report. The agency's certification process for the 737 Max is the subject of multiple investigations and reviews, he said in an emailed statement.
"While the agency's certification processes are well-established and have consistently produced safe aircraft designs, we welcome the scrutiny from these experts and look forward to their findings," he said in the statement.
The 737 Max's flight control system, dubbed MCAS, has been at the center of the investigation into the safety of the plane. In certain circumstances, that system can take control of the plane and tilt its nose sharply downward.
The software is believed to have played a role in both of fatal crashes, which together killed 346 people. The FAA grounded the plane after the second crash in March.
Read more: Boeing says it could suspend 737 Max production if grounding continues, putting tens of thousands of jobs at risk
According to The Times report, FAA had two highly experienced engineers overseeing the safety of the Boeing's flight control systems in the agency's Seattle office. But both engineers left the FAA midway through the development of the 737 Max, The Times reported. One of the engineers the FAA named in their place had little flight control experience. The other was a newly hired engineer who graduated from graduate school just three years earlier.
The two "seemed ill-equipped" to be in charge of the safety of the MCAS software, The Times reported, citing unnamed people who had worked with them.
Boeing largely kept the FAA in the dark about the MCAS software
Even if the engineers had been more experienced, they might not have caught the problems with the system, The Times suggested.
Early reviews of the plane's development provided by Boeing to the engineers played down the system's importance and the safety risks it might entail, according to the report. An FAA manager later delegated a safety review of the system to Boeing itself - an increasingly common, albeit controversial, practice by the agency, The Times reported.
As the plane got closer to production, Boeing made a big change to the MCAS system, allowing it to turn on at low speeds and to move the tail stabilizer by as much as 2.5 degrees each time it turned on, according to the report. Previously, the system could only activate at high speeds and could only move the stabilizer by 0.6 degrees a time.
Boeing didn't provide the FAA with an updated safety assessment of the flight-control system after making the changes and the two new agency engineers were unaware that the software could move the tail by 2.5 degrees, according to the report.
After the first crash of the 737 Max last October, FAA officials found they didn't understand and had little documentation about the workings of the MCAS system, The Times reported.
Ryanair boss warns Boeing 737 Max crisis could lead to job cuts
Michael O'Leary also says airline could axe UK domestic routes if there is a no-deal Brexit
The Ryanair boss, Michael O'Leary, has said he cannot rule out making redundancies if the Boeing 737 Max stays grounded for longer than expected while investigations continue into two fatal crashes involving the aircraft.
He also warned that Ryanair could scrap UK domestic routes in the event of a no-deal Brexit.
Speaking as the budget airline's first-quarter profits slumped by 24%, O'Leary bemoaned the impact of delays in the return to service of the 737 Max, a key component of Ryanair's strategy to arrest the recent decline in its financial performance.
Ryanair has 135 of the 737 Max models on order, the first five of which are due for delivery in the autumn, but they will not be able to fly until regulators have declared the plane safe.
O'Leary warned that Ryanair may not have any of the planes ready by next summer unless Boeing "gets its shit together" in making upgrades required for regulators to allow the plane to fly.
The grounding of the global fleet of 737 Max aircraft has already taken its toll on Ryanair, forcing the airline to halve its growth targets for next year as it scrapped 30,000 planned flights and warned it could close bases at airports.
O'Leary warned that redundancies could not be ruled out as a result.
At least one Boeing 737 Max that was due to be delivered to Ryanair has had the name Max dropped from the livery, fuelling speculation that the manufacturer and airlines will seek to rebrand the troubled plane.
O'Leary issued his warning on jobs as the airline reported a 24% drop in quarterly profits, with its 737 woes compounded by price wars in several European markets.
Average summer fares at Europe's largest low-cost carrier will likely fall by 6% compared with last year, as airlines cut prices to stimulate demand, particularly in Germany and the United Kingdom, the airline said.
That helped push pretax profit down to €262m (£236m) for the three months to June 30.
But the company stuck to its annual profit target of between €750m and €950m as passengers continued to spend on onboard extras, which include food, perfume and scratchcards.
Shares in the airline were up 1.5% by mid-morning, having almost halved in value in two years as it grappled with overcapacity, pilot strikes, Brexit uncertainty and the 737 delays.
Ingen kommentarer:
Legg inn en kommentar
Merk: Bare medlemmer av denne bloggen kan legge inn en kommentar.