SEATTLE — In the days after the first crash of Boeing’s 737 Max, engineers at the Federal Aviation Administration came to a troubling realization: They didn’t fully understand the automated system that helped send the plane into a nose-dive, killing everyone on board.
Engineers at the agency scoured their files for information about the system designed to help avoid stalls. They didn’t find much. Regulators had never independently assessed the risks of the dangerous software known as MCAS when they approved the plane in 2017.
More than a dozen current and former employees at the F.A.A. and Boeing who spoke with The New York Times described a broken regulatory process that effectively neutered the oversight authority of the agency.
The regulator had been passing off routine tasks to manufacturers for years, with the goal of freeing up specialists to focus on the most important safety concerns. But on the Max, the regulator handed nearly complete control to Boeing, leaving some key agency officials in the dark about important systems like MCAS, according to the current and former employees.
While the agency’s flawed oversight of the Boeing 737 Max has attracted much scrutiny since the first crash in October and a second one in March, a Times investigation revealed previously unreported details about weaknesses in the regulatory process that compromised the safety of the plane.
The company performed its own assessments of the system, which were not stress-tested by the regulator. Turnover at the agency left two relatively inexperienced engineers overseeing Boeing’s early work on the system.
The F.A.A. eventually handed over responsibility for approval of MCAS to the manufacturer. After that, Boeing didn’t have to share the details of the system with the two agency engineers. They weren’t aware of its intricacies, according to two people with knowledge of the matter.
Late in the development of the Max, Boeing decided to expand the use of MCAS, to ensure the plane flew smoothly. The new, riskier version relied on a single sensor and could push down the nose of the plane by a much larger amount.
Boeing did not submit a formal review of MCAS after the overhaul. It wasn’t required by F.A.A. rules. An engineering test pilot at the regulator knew about the changes, according to an agency official. But his job was to evaluate the way the plane flew, not to determine the safety of the system.
ImageListen to ‘The Daily’: The Origins of Boeing’s 737 Max CrisisA dangerous software system was implicated in two fatal crashes in less than five months. Why was the plane deemed safe to fly?transcriptBack to The Dailybars0:00/27:17-27:17
Listen to ‘The Daily’: The Origins of Boeing’s 737 Max CrisisHosted by Michael Barbaro, produced by Michael Simon Johnson, Jessica Cheung and Clare Toeniskoetter, and edited by Lisa Tobin and Larissa AndersonA dangerous software system was implicated in two fatal crashes in less than five months. Why was the plane deemed safe to fly?michael barbaroFrom The New York Times, I’m Michael Barbaro. This is “The Daily.” Today: The crash of two Boeing 737 Max jets has been linked to a new software system that helped send the planes into a deadly nose-dive. Natalie Kitroeff investigates what federal regulators did and didn’t know about that system. It’s Tuesday, July 30.archived recording 1Breaking news overnight — we begin with the latest on the brand new Lion Air Boeing 737 Max 8 passenger jet that crashed into the sea this morning with 189 people onboard. The mangled wreckage has been found. The Boeing 737 Max 8 aircraft went missing just 13 minutes after takeoff from the Indonesian capital of Jakarta.archived recording 2Boeing facing intense scrutiny after all 157 people onboard, including eight Americans, died yesterday when a plane crashed in Africa.archived recording 3This is the second catastrophic crash involving Boeing’s popular 737 Max 8 aircraft.archived recording 4Concerns, of course, are being raised about the safety systems.archived recording 5This anti-stall system — the MCAS — is being investigated as a possible cause.archived recording 6Why didn’t they — the F.A.A. — stop the airplanes from flying after they knew Lion Air had been caused by the MCAS system?archived recording 7Was the giving too much authority to Boeing to certify its own planes?archived recording 8They’re saying that Boeing and the F.A.A. were in a conspiracy to get this airplane out. Whether that claim can be proven, it remains to be seen.michael barbaroNatalie, it’s been weeks now since we’ve heard any updates on the Boeing story. What have you been up to?natalie kitroeffWe’ve been trying to report out exactly how Boeing 737 Max was developed, how it was certified, and how it ended up with this dangerous new system called MCAS. This is the software that was implicated in both crashes — both crashes, which killed 346 people. And at the heart of this story is the relationship between Boeing and the F.A.A. We were coming to this with an understanding that for years, the F.A.A. has been pushed by Congress to give Boeing more control over the process of approving its own planes. And what we were interested in is understanding exactly how that shift, how that handoff, affected the F.A.A.‘s understanding of this plane and its decision to certify it as safe to fly.michael barbaroAnd, Natalie, why was Congress pushing for that delegation of authority from the F.A.A., which we think of as the kind of guardian of our air safety, to Boeing?natalie kitroeffWell, industry groups had been lobbying for it. You know, aircraft manufacturers like Boeing would like to have more control over this process. And many of the top officials at the F.A.A. actually support this approach. Many of them are saying that they don’t feel as though they have the resources necessary to be as involved in the certification process. They’re also having a tough time recruiting talent. You know, this is a government agency with government salaries, and they’re competing for engineers with companies like Boeing. And so they are trying to do more with less. And the way of doing more with less is to offload as much of the routine certification tasks as possible onto the manufacturer — onto Boeing — and to keep the critical safety items. So you free up the F.A.A. officials that remain to focus on the most important stuff in the certification of an airplane.michael barbaroBut I guess, Natalie, why would you be focused on this shift in relation to the MCAS system, given that it would still fall, I have to imagine, into the category of vital safety checks that are going to be done by the F.A.A., not delegated to Boeing?natalie kitroeffRight. That was the central mystery. This seemed like the kind of critical safety issue that would have remained firmly within the control of the F.A.A. And yet, there was clearly some kind of disconnect here. And so my question was, did this shift toward more reliance on industry have something to do with it?michael barbaroSo how do you answer that question?natalie kitroeffWe are trying our very best to talk to as many people that were involved in the certification of the Max as possible. But they’re not picking up a lot of the time. I mean, we get some people on the phone, but others are telling us to please go away. And eventually, we hit a wall. And so I decided to fly to Seattle and basically show up at people’s doors and see if they would give me the time of day. I must have driven five hours every day, on average — sometimes more.michael barbaroAnd whose doors are you knocking on — Boeing people, F.A.A. people?archived recording (natalie kitroeff)I’m at a former Boeing employee’s house.natalie kitroeffBoth.michael barbaroBoth.natalie kitroeffBoth. Seattle is vast. These folks live in various different parts of the state. And so, you know, it was the kind of thing where I just was really trying to maximize the amount of time that I had there.archived recording (natalie kitroeff)Hi. I want to get in there too.archived recording (a cat)[MEOWS]natalie kitroeffTo just try to catch as many people as possible.michael barbaroAnd for the most part, what was the response when you knocked on people’s doors?archived recording (natalie kitroeff)All right, no one’s here.natalie kitroeffFor the most part, the response was no response.archived recording (natalie kitroeff)Going to try to leave this letter in the door.natalie kitroeffSome people told me to go away.archived recording (natalie kitroeff)Fruitless morning so far.natalie kitroeffBut there were some people that did want to talk.archived recordingYour destination is on the left.archived recording (natalie kitroeff)I am here at Mike McRae’s house. He’s a former Boeing employee, but he knows I’m coming.natalie kitroeffMike McRae is one of them.archived recording (natalie kitroeff)Did you build this house?archived recording (mike mcrae)No. It was built — actually —michael barbaroTell me about that.archived recording (natalie kitroeff)So — and you were at Boeing, remind me the years, just so I can situate myself?archived recording (mike mcrae)I can’t, I mean, I think I went to work there in late ‘77? Hasn’t been important for a while, so it’s not in my head.natalie kitroeffMike is a former Boeing employee and a former F.A.A. employee.archived recording (mike mcrae)I did the 5-7 job, and then I inherited all of the Renton division. So I had inherited —natalie kitroeffHe’s an engineer. He knows a lot about this world. He left the F.A.A. in 2013, and he wasn’t directly involved in the Max’s certification. But he knows a lot of the players involved with creating the group that certified the Max, and he is an expert on Boeing culture and F.A.A. culture. He’s kind of the perfect person, in many ways, to explain the shift.michael barbaroAnd what does Mike tell you about how this shift in certification played out?archived recording (mike mcrae)I mean, everybody has been having to accept more and more delegation. Each manager that came along had to accept more, because they just flat didn’t have the ability to — they didn’t have the money per salary to go out and get senior people, and they didn’t have the authorization to get body count.natalie kitroeffMike says, basically, that the goal was, in many ways, totally understandable.archived recording (mike mcrae)It’s a resource management thing.natalie kitroeffHe agrees that the expertise had kind of thinned out in the F.A.A.archived recording (mike mcrae)Back in the day, the average guy had at least four or five years of industry experience before he came to the agency. But what we started to get was just kids fresh out of school or even coming out of companies that were pipe fitters or whatever.natalie kitroeffHe agrees that there was a need to rely more on Boeing. And he thought that the idea of offloading mundane tasks to the company was totally worthy. That sounded good to him.archived recording (mike mcrae)They had to do better with what they had. They had to work smarter. And they thought that this processing and delegation was a way to do it smarter. And if the company stepped up to do what the agency used to do, sounds fine.natalie kitroeffBut what he says is that it goes beyond its initial intention —archived recording (mike mcrae)The more they trust the company, the less critical a system is, the more they’ll delegate. And that’s kind of gotten to be a runaway freight train, according to people I talked to.natalie kitroeff— and veers into something that comes much closer to a situation in which the agency is ceding control over the certification process.archived recording (mike mcrae)Well, yeah, Ali was definitely one who would trust the industry first.natalie kitroeffAnd Mike identifies one person who is really at the heart of all of this.archived recording (natalie kitroeff)That’s Ali Bahrami?natalie kitroeffIt’s a guy named Ali Bahrami. Bahrami was the head of the F.A.A.‘s Seattle operation for many years. He then left for a period of time to become a lobbyist for an industry group that represented manufacturers, including Boeing. Then he came back to the F.A.A. Now he is the head of safety at the F.A.A. And he has spent his career advocating for more delegation to companies.archived recording (mike mcrae)Ali did not help, that’s for sure. But he was a result of the culture, he wasn’t the cause of the culture.natalie kitroeffAnd Mike is very careful to point out that Ali Bahrami is not the author of this shift towards delegation, but he is a champion of it.archived recording (mike mcrae)He was trying to do a better job with the culture, but he ended up, in my opinion, being kind of the tipping point. Under his management, everything kind of went the other way. And it was intentional. I mean, they were — they couldn’t keep doing detailed work. They didn’t have the staff for it.natalie kitroeffAnd while he’s running the F.A.A.‘s office in Seattle, he is responsible for staffing this new office, which eventually handles the Max certification. And the office has such a singular focus that it is actually named after the company. It’s called the Boeing Aviation Safety Oversight Office.michael barbaroEven though it’s inside the Federal Aviation Administration.natalie kitroeffRight. And several current and former F.A.A. engineers had suggested to me that Ali Bahrami, as he staffed this group, put in place managers who would defer to Boeing. And that prompted a lot of engineers to not want to join this group. They were worried that under these terms, they weren’t going to be able to effectively police the company.archived recording (mike mcrae)You know, is he wrong because of what he was trying to do or was he wrong because of the way he went about doing it? He wasn’t wrong about what he was trying to do. I think he was wrong about the way he went about doing it. And he didn’t put enough checks and balances in the system and keep enough expertise in the agency to be able to call bullshit when they were wrong.michael barbaroAnd so it’s in this context and through this office that you just described that the Max and the MCAS system are being reviewed and people are trying to figure out if it’s safe.natalie kitroeffThat’s right. This is the office that handles the Max certification.michael barbaroAnd so, as best you can piece together, what happens?natalie kitroeffSo I had to talk to a lot of other people to figure that out. Mike left in 2013. So when I get back to New York, we begin to really piece together what is now a fairly complete understanding of how the F.A.A. missed the inherent risks in the MCAS software that contributed to the two crashes. And what we learned was there was a tremendous focus inside this office on delegating as much as possible to Boeing. And in this F.A.A. office, there are two people who are responsible for looking at flight controls, which includes MCAS.michael barbaroTwo people in charge of something as important as MCAS.natalie kitroeffYes, two people with primary responsibility for all flight controls, which is actually much more than MCAS. And what happens is there are two really experienced engineers in that role in the beginning of the Max certification, but they leave midway through. And they leave because they are frustrated with the work in the agency, and they feel like it’s paper pushing. They’re replaced by two engineers who are less experienced in flight controls, and one of them is a brand new hire. And on the question of whether MCAS was this important system, in the beginning, it wasn’t seen as an important system at all. In the very beginning of the development of the Max, MCAS was a system that would be used in very rare scenarios that a passenger plane would almost never encounter — high speed, sharp turns. That’s not something that you will experience on your flight to Seattle. And so when the first safety assessment comes in, a failure of the system is not rated as particularly dangerous. So the Max certification progresses, and as Boeing is racing to complete this plane, late in the process, managers at the F.A.A. delegate the approval of the safety assessment of MCAS back to Boeing. Meaning Boeing now has final say over the safety assessment of this system. The logic here is that this isn’t really a risky system, so the F.A.A. doesn’t have to be, you know, on it in the way that it was in the beginning. But at the same time, it is conducting a major overhaul of MCAS in a way that makes it much more aggressive.michael barbaroHow so?natalie kitroeffSo what happens is there are flight tests in 2016 inside Boeing. And they realize that they need MCAS in more scenarios than that rare one that I mentioned earlier.michael barbaroThat sharp turn at a high speed.natalie kitroeffRight. They actually now need it in low-speed situations in which the plane is approaching a stall.michael barbaroWhy?natalie kitroeffBecause pilots at Boeing find that the Max is not handling — it’s not flying the way that its predecessor, the 737 NG, did in certain dangerous scenarios in low speeds. And so they decide that they need MCAS to operate in that low-speed scenario. So Boeing looks at the potential danger of the changes internally. And what they find is that, actually, these changes don’t make the system any more dangerous. That when MCAS activates in low speeds, they say, it’s going to be less of a big deal than when it activates in high speeds, because lower speeds, less risk.michael barbaroOr so they think.natalie kitroeffWell, that’s what they determine. And they don’t actually submit a new safety review, because one is not required — because they’ve determined that the system has not become any more dangerous. They’re also assuming that pilots are going to intervene within seconds.michael barbaroAnd they get to make this determination because the F.A.A. has delegated the process to Boeing.natalie kitroeffThat’s right.michael barbaroWe’ll be right back. Natalie, once Boeing is in control of certifying the MCAS system, how does the story unfold?natalie kitroeffIn the beginning, when the F.A.A. has control over the approval, when MCAS triggers, it only moves the nose down. It only moves a part of the tail of the plane by 0.6 degrees. It’s because it’s moving in high speeds, right? In order to have that same effect on the plane —michael barbaroAt low speeds.natalie kitroeff— at low speeds, they have to move this part of the tail much more. They have to push the nose down much more for the same effect. And our understanding is that the F.A.A. engineers who were initially responsible for determining is this system safe and for really picking it apart and looking inside it and figuring out how it works from an engineering perspective, they didn’t know that MCAS could move this part of the tail by 2.5 degrees, which is a lot. They didn’t understand the real intricacies of how this system worked.michael barbaroI just want to be sure I understand this. At the beginning of this process, when the F.A.A. is heavily involved in the certification of MCAS, they understand that when triggered, this software can move the plane a certain amount — a pretty modest amount. And when the certification process is delegated to Boeing, unbeknownst to most of the folks at the F.A.A., this system is being triggered in more circumstances, and it’s being triggered in a way that increases what it does. And so that change kind of eludes the F.A.A.natalie kitroeffRight. We know that an engineering test pilot from the F.A.A. is familiar with the change. But because it’s delegated at that point, the engineers who were originally responsible for assessing its safety don’t really understand the specifics of the new system. And the rules say Boeing doesn’t need to make them aware of these changes.michael barbaroSo is it fair, Natalie, to say that Boeing engineers make the MCAS system riskier just as they’re getting complete control over the certification of it?natalie kitroeffYes. And it only becomes clear to key officials in the F.A.A. that they don’t fully understand this system once the first accident happens — when Lion Air Flight 610 crashes into the Java Sea in October. F.A.A. engineers are looking at what happened on that flight, and they eventually get the black box data. And that data suggests that the pilots were fighting to keep the nose of the plane up as it was repeatedly pushed down by a dramatic amount each time. And so these engineers are hearing that the system MCAS was probably involved, and they go and scour their files for any description of this system. And what they find is this early safety assessment that is a review of a version of MCAS that is not capable of such dramatic movement.michael barbaroBasically, it’s a different system.natalie kitroeffIt doesn’t look anything like what they have on file. So the F.A.A. has a bunch of meetings with Boeing executives in the week after the crash, and the F.A.A. engineers, many of them are sitting there incredulous as the company explains how this system works. But still, the F.A.A. decides that they don’t need to ground the plane, partly because when MCAS triggers in a malfunction, it presents a lot like another scenario that pilots should be familiar with. It’s called a runaway stabilizer. And they have a checklist — an emergency checklist for that. So what the F.A.A. believes is sufficient is to publish a notice with that emergency procedure. They say in this notice that the plane has this potential for a repeated nose-down. They do not mention MCAS by name. The agency at this point believes that the emergency procedures are going to be sufficient. But just under five months later, another Max crashed after MCAS activated. Ethiopian Airlines Flight 302 crashed shortly after takeoff when pilots again were battling an MCAS activation. After that crash in March, it took the F.A.A. longer than international regulators, including in Europe and China, to ground the Max, but they eventually do. And in the aftermath, we have seen multiple investigations that are now looking into whether there were flaws in the fundamental system, the regulatory process, and the hands-off approach that gave so much control over the approval of the plane to Boeing.michael barbaroNatalie, from everything you’re saying, it sounds like the crashes of these 737 Max jets and the deaths that resulted, it really can’t be divorced from this regulatory process where the F.A.A. relinquishes its authority over certifying the safety of these Boeing planes back to Boeing.natalie kitroeffIt’s really hard to say. The F.A.A. has said that the goal of delegation is to give away the stuff that doesn’t matter. And this ended up mattering a lot. So clearly, there was a disconnect. The agency, in its own defense, has said that it followed all of the rules and proper procedures. But I think what federal investigators and lawmakers are now looking at is whether following the rules is enough.michael barbaroNatalie, thank you very much.natalie kitroeffThank you.michael barbaroAli Bahrami, who ran the F.A.A. office in Seattle that oversaw Boeing and is now the agency’s head of aviation safety, is scheduled to testify tomorrow before a Senate oversight committee. Bahrami and two of his colleagues are expected to be asked about the certification process for the 737 Max. We’ll be right back. Here’s what else you need to know today. On Monday, President Trump said he would nominate Republican congressman John Ratcliffe of Texas as the next director of national intelligence, despite his lack of experience in national security.archived recording (john ratcliffe)You wrote 180 pages — 180 pages about decisions that weren’t reached, about potential crimes that weren’t charged or decided.michael barbaroRatcliffe, a former U.S. attorney and small-town mayor, is best known for his outspoken defense of Trump, including his questioning last week of former special counsel Robert Mueller.archived recording (john ratcliffe)So Americans need to know this as they listen to the Democrats and socialists on the other side of the aisle as they do dramatic readings from this report — that Volume 2 of this report was not authorized under the law to be written. I agree with the chairman this morning when he said Donald Trump is not above the law. He’s not. But he damn sure shouldn’t be below the law, which is where Volume 2 of this report puts him. If confirmed by the Senate, Ratcliffe would replace Dan Coats, who shielded intelligence agencies from Trump’s criticism of their work, especially their conclusion that Russia interfered in the 2016 election. And —archived recordingThis incident tonight started at about 5:41 p.m. There were reports of shooting on the north side of the Garlic Festival area.michael barbaroAuthorities in Gilroy, California, have identified the victims of last weekend’s mass shooting there at a local food festival.archived recordingOfficers were in that area and engaged the suspect in less than a minute. The suspect was shot and killed.michael barbaroThe shooter, using a legally purchased assault rifle, killed at least four people, including a 6-year-old boy and a 13-year-old girl, and injured at least 12.archived recordingAnd it’s just incredibly sad and disheartening that an event that does so much good for our community has to suffer from a tragedy like this.michael barbaroSo far, the gunman’s motive remains unknown. That’s it for “The Daily.” I’m Michael Barbaro. See you tomorrow.
The agency ultimately certified the jet as safe, required little training for pilots and allowed the plane to keep flying until a second deadly Max crash, less than five months after the first.
The plane remains grounded as regulators await a fix from Boeing. If the ban persists much longer, Boeing said this past week that it could be forced to halt production.
The F.A.A. and Boeing have defended the plane’s certification, saying they followed proper procedures and adhered to the highest standards.
“The agency’s certification processes are well-established and have consistently produced safe aircraft designs,” the regulator said in a statement Friday. “The 737 Max certification program involved 110,000 hours of work on the part of F.A.A. personnel, including flying or supporting 297 test flights.”
Boeing said “the F.A.A.’s rigor and regulatory leadership has driven ever-increasing levels of safety over the decades,” adding that “the 737 Max met the F.A.A.’s stringent standards and requirements as it was certified through the F.A.A.’s processes.”
[If you have worked at Boeing or the F.A.A. and want to discuss your experience, contact The Times confidentially here.]
Federal prosecutors and lawmakers are now investigating whether the regulatory process is fundamentally flawed. As planes become more technologically advanced, the rules, even when they are followed, may not be enough to ensure safety. The new software played a role in both disasters, involving Lion Air and Ethiopian Airlines, which together killed 346 people.
“Did MCAS get the attention it needed? That’s one of the things we’re looking at,” said Chris Hart, the former chairman of the National Transportation Safety Board, who is now leading a multiagency task force investigating how the Max was approved. “As it evolved from a less robust system to a more powerful system, were the certifiers aware of the changes?”
Boeing needed the approval process on the Max to go swiftly. Months behind its rival Airbus, the company was racing to finish the plane, a more fuel-efficient version of its best-selling 737.
The regulator’s hands-off approach was pivotal. At crucial moments in the Max’s development, the agency operated in the background, mainly monitoring Boeing’s progress and checking paperwork. The nation’s largest aerospace manufacturer, Boeing was treated as a client, with F.A.A. officials making decisions based on the company’s deadlines and budget.
It has long been a cozy relationship. Top agency officials have shuffled between the government and the industry.
During the Max certification, senior leaders at the F.A.A. sometimes overruled their own staff members’ recommendations after Boeing pushed back. For safety reasons, many agency engineers wanted Boeing to redesign a pair of cables, part of a major system unrelated to MCAS. The company resisted, and F.A.A. managers took Boeing’s side, according to internal agency documents.
After the crash of the Lion Air plane last October, F.A.A. engineers were shocked to discover they didn’t have a complete analysis of MCAS. The safety review in their files didn’t mention that the system could aggressively push down the nose of the plane and trigger repeatedly, making it difficult to regain control of the aircraft, as it did on the doomed Lion Air flight.
Despite their hazy understanding of the system, F.A.A. officials decided against grounding the 737 Max. Instead, they published a notice reminding pilots of existing emergency procedures.
The notice didn’t describe how MCAS worked. At the last minute, an F.A.A. manager told agency engineers to remove the only mention of the system, according to internal agency documents and two people with knowledge of the matter. Instead, airlines learned about it from Boeing.
‘He really wanted abdication.’
The F.A.A. department that oversaw the Max development had such a singular focus that it was named after the company: The Boeing Aviation Safety Oversight Office.
Many F.A.A. veterans came to see the department, created in 2009, as a symbol of the agency’s close relationship with the manufacturer. The top official in Seattle at the time, Ali Bahrami, had a tough time persuading employees to join, according to three current and former employees.
Some engineers believed that Mr. Bahrami had installed managers in the office who would defer to Boeing. “He didn’t put enough checks and balances in the system,” Mike McRae, a former F.A.A. engineer, said of Mr. Bahrami. “He really wanted abdication. He didn’t want delegation.”
Before the certification of the Max began, Mr. Bahrami called a group of F.A.A. engineers into his office, the current and former employees said, and asked some of them to join the group. Many didn’t want to change jobs, according to a complaint filed by the National Air Traffic Controllers Association, the union representing F.A.A. engineers.
“I got dragged kicking and screaming,” said Richard Reed, a former systems engineer at the F.A.A. Mr. Reed said he had just left surgery when agency officials called to ask whether he would work in the office. “I always claimed that I was on drugs when I said ‘yes.’”
The F.A.A. said in a statement that Mr. Bahrami “dedicated his career to the advancement of aviation safety in both the private and public sectors.”
ImageCreditRuth Fremson/The New York Times
For decades, the F.A.A. relied on engineers inside Boeing to help certify aircraft. But after intense lobbying to Congress by industry, the agency adopted rules in 2005 that would give manufacturers like Boeing even more control. Previously, the agency selected the company engineers to work on its behalf; under the new regulations, Boeing could choose them, though the F.A.A. has veto power.
Many of the agency’s top leaders embraced the approach. It would allow the F.A.A. to certify planes more efficiently and stretch its limited resources. The regulator had also been finding it harder to compete for talented engineers, their government salaries unable to keep up with the going rates in the industry.
For Boeing, the changes meant shedding a layer of bureaucracy. “The process was working well,” said Tom Heineman, a retired Boeing engineer who worked on the Max. “The F.A.A. was delegating more of the work and the review and the oversight to the manufacturers than it used to.”
But some F.A.A. engineers were concerned that they were no longer able to effectively monitor what was happening inside Boeing. In a PowerPoint presentation to agency managers in 2016, union representatives raised concerns about a “brain drain” and the “inability to hire and retain qualified personnel.”
By 2018, the F.A.A. was letting the company certify 96 percent of its own work, according to an agency official.
Nicole Potter, an F.A.A. propulsion and fuel systems engineer who worked on the Max, said supervisors repeatedly asked her to give up the right to approve safety documents. She often had to fight to keep the work.
“Leadership was targeting a high level of delegation,” Ms. Potter said. When F.A.A. employees didn’t have time to approve a critical document, she said, “managers could delegate it back to Boeing.”
It was a process Mr. Bahrami championed to lawmakers. After spending more than two decades at the F.A.A., he left the agency in 2013 and took a job at the Aerospace Industries Association, a trade group that represents Boeing and other manufacturers.
“We urge the F.A.A. to allow maximum use of delegation,” Mr. Bahrami told Congress in his new lobbying role, arguing it would help American manufacturers compete.
In 2017, Mr. Bahrami returned to the F.A.A. as the head of safety.
An internal battle at the F.A.A.
With Boeing taking more control, F.A.A. engineers found they had little power, even when they did raise concerns.
Early on, engineers at the F.A.A. discovered a problem with one of the most important new features of the Max: its engines. The Max, the latest version of the 50-year-old 737, featured more fuel-efficient engines, with a larger fan and a high-pressure turbine. But the bigger, more complex engines could do more damage if they broke apart midair.
The F.A.A. engineers were particularly concerned about pieces hitting the cables that control the rudder, according to five people with knowledge of the matter and internal agency documents. A cable severed during takeoff would make it difficult for pilots to regain control, potentially bringing down the jet.
The F.A.A. engineers suggested a couple solutions, three of the people said. The company could add a second set of cables or install a computerized system for controlling the rudder.
Boeing did not want to make a change, according to internal F.A.A. documents reviewed by The Times. A redesign could have caused delays. Company engineers argued that it was unlikely that an engine would break apart and shrapnel would hit the rudder cable.
Most of the F.A.A. engineers working on the issue insisted the change was necessary for safety reasons, according to internal agency emails and documents. But their supervisors balked. In a July 2015 meeting, Jeff Duven, who replaced Mr. Bahrami as the head of the F.A.A.’s Seattle operation, sided with Boeing, said two current employees at the agency.
ImageCreditRuth Fremson/The New York Times
F.A.A. managers conceded that the Max “does not meet” agency guidelines “for protecting flight controls,” according to an agency document. But in another document, they added that they had to consider whether any requested changes would interfere with Boeing’s timeline. The managers wrote that it would be “impractical at this late point in the program,” for the company to resolve the issue. Mr. Duven at the F.A.A. also said the decision was based on the safety record of the plane.
Engineers at the agency were demoralized, the two agency employees said. One engineer submitted an anonymous complaint to an internal F.A.A. safety board, which was reviewed by The Times.
“During meetings regarding this issue the cost to Boeing to upgrade the design was discussed,” the engineer wrote. “The comment was made that there may be better places for Boeing to spend their safety dollars.”
An F.A.A. panel investigated the complaint. It found managers siding with Boeing had created “an environment of mistrust that hampers the ability of the agency to work effectively,” the panel said in a 2017 report, which was reviewed by The Times. The panel cautioned against allowing Boeing to handle this kind of approval, saying “the company has a vested interest in minimizing costs and schedule impact.”
By then, the panel’s findings were moot. Managers at the agency had already given Boeing the right to approve the cables, and they were installed on the Max.
Playing down risks
In the middle of the Max’s development, two of the most seasoned engineers in the F.A.A.’s Boeing office left.
The engineers, who had a combined 50 years of experience, had joined the office at its creation, taking on responsibility for flight control systems, including MCAS. But they both grew frustrated with the work, which they saw as mostly paper pushing, according to two people with knowledge of the staff changes.
In their place, the F.A.A. appointed an engineer who had little experience in flight controls, and a new hire who had gotten his master’s degree three years earlier. People who worked with the two engineers said they seemed ill-equipped to identify any problems in a complex system like MCAS.
And Boeing played down the importance of MCAS from the outset.
An early review by the company didn’t consider the system risky, and it didn’t prompt additional scrutiny from the F.A.A. engineers, according to two agency officials. The review described a system that would activate only in rare situations, when a plane was making a sharp turn at high speeds.
The F.A.A. engineers who had been overseeing MCAS never received another safety assessment. As Boeing raced to finish the Max in 2016, agency managers gave the company the power to approve a batch of safety assessments — some of the most important documents in any certification. They believed the issues were low risk.
One of the managers, Julie Alger, delegated the review of MCAS. Previously, the F.A.A. had the final say over the system.
The F.A.A. said that decision reflected the consensus of the team.
Boeing was in the middle of overhauling MCAS. To help pilots control the plane and avoid a stall, the company allowed MCAS to trigger at low speeds, rather than just at high speeds. The overhauled version would move the stabilizer by as much as 2.5 degrees each time it triggered, significantly pushing down the nose of the plane. The earlier version moved the stabilizer by 0.6 degrees.
When company engineers analyzed the change, they figured that the system had not become any riskier, according to two people familiar with Boeing’s discussions on the matter. They assumed that pilots would respond to a malfunction in three seconds, quickly bringing the nose of the plane back up. In their view, any problems would be less dangerous at low speeds.
So the company never submitted an updated safety assessment of those changes to the agency. In several briefings in 2016, an F.A.A. test pilot learned the details of the system from Boeing. But the two F.A.A. engineers didn’t understand that MCAS could move the tail as much as 2.5 degrees, according to two people familiar with their thinking.
Under the impression the system was insignificant, officials didn’t require Boeing to tell pilots about MCAS. When the company asked to remove mention of MCAS from the pilot’s manual, the agency agreed. The F.A.A. also did not mention the software in 30 pages of detailed descriptions noting differences between the Max and the previous iteration of the 737.
Days after the Lion Air crash, the agency invited Boeing executives to the F.A.A.’s Seattle headquarters, according to two people with knowledge of the matter. The officials sat incredulous as Boeing executives explained details about the system that they didn’t know.
In the middle of the conversation, an F.A.A. employee, one of the people said, interrupted to ask a question on the minds of several agency engineers: Why hadn’t Boeing updated the safety analysis of a system that had become so dangerous?
KAYNAK : https://www.nytimes.com/2019/07/27/business/boeing-737-max-faa.html