How the Deadly 737 Crashes Are Raising Major Questions About Boeing and the FAA’s Safety Practices

Last May, Congress obtained a worrying internal memo written by the inspector general of the U.S. Department of Transportation. The IG’s investigators had been probing the safety records of two airlines, but as the officials dug in, they found a broader issue that affected the manufacture and daily operations of most of America’s airplanes.

The Federal Aviation Administration (FAA), which since 1958 has ensured the safety of the U.S. aviation industry, had in recent years shifted its “oversight strategy,” the IG reported. Instead of “emphasizing enforcement actions,” the IG wrote, the FAA was taking an ever more hands-off approach, working with private industry “to address the root causes for noncompliance of safety regulations.”

In the wake of the two Boeing 737 Max 8 crashes in Indonesia and Ethiopia that killed 346 people in less than five months, last May’s IG memo reads like the latest in a series of missed red flags. Thanks to the FAA’s “oversight strategy,” some industry players are doing virtually all of their own safety checks: one manufacturer “approved about 90% of the design decisions for all of its own aircraft,” according to a recent Department of Transportation audit. And in the fall of 2017–as Boeing scrambled to catch up with its prime competitor, Airbus, which had just introduced a more efficient model for the short-haul market that the 737 served–the aerospace giant reportedly took several liberties with its self-certification.

Those liberties, according to a Seattle Times investigation published March 17, included understating the extent to which a new software program could control flight, downplaying the danger that a failure of the program might pose and minimizing pilot training on the new software.

Now multiple law-enforcement and watchdog bodies are looking into whether the same software program may have contributed to the deadly 737 Max crashes. They’re also looking at Boeing’s handling of the aircraft’s production and the FAA’s oversight. On March 11, a grand jury in Washington, D.C., issued a subpoena on behalf of a federal prosecutor from the Justice Department’s criminal division relating to the development of the 737 Max, according to the Wall Street Journal. Representative Peter DeFazio, the top Democrat on the House Transportation and Infrastructure Committee, has called for an investigation into the FAA’s approach to certifying the 737 Max. “There will be a great discovery effort to find out if the plane was rushed through to compete with Airbus,” says attorney Mary Schiavo, a former Transportation Department inspector general who now represents the victims of airline accidents.

The FAA grounded the 737 Max on March 13, and Boeing promised a software fix by April to address potential problems with its planes. Boeing has overcome tough challenges before, and there’s little doubt among pilots, industry analysts and aviation insiders that the aerospace giant will fix the problem. “Once Boeing carries out what needs to be done,” says former U.S. Transportation Secretary Ray LaHood, “the American people should feel 100% sure that the planes are safe.”

In some ways, the collaborative approach between FAA and the companies it regulates was to be expected. In the years following 9/11, the FAA was stretched thin by new responsibilities. At the same time, the complexity of computer and automated flight systems had made the job of oversight much harder. Unable to double-check engineering in every corner of the sprawling civil-aviation industry, the FAA had chosen to delegate some responsibility for certifying plane safety to makers and carriers. And Congress itself required the agency to cede safety certification to the industry.

It’s also true that the U.S. commercial-aviation accident rate is the lowest it’s ever been. But the two crashes in rapid succession raise troubling questions about just how far the outsourcing of safety has gone in a time of rapid technological change.

Boeing had made its name on long-haul planes that could fly passengers across the Atlantic and Pacific oceans. But in the ’60s, market demand for smaller, short-haul jets increased, and Boeing responded with the twin-engine 737, nicknamed the Baby Boeing. The jet, which now seats about 190, ultimately became the backbone of short-haul fleets worldwide. Boeing has delivered more than 10,000 of the planes, making it the world’s best-selling commercial jet-aircraft model.

Just like the smartphone in your pocket, the 737 has been continually updated. The company has long flirted with a new design to replace the 737. But those plans were shelved more than a decade ago when Airbus announced an upgraded version of its direct competitor to the 737, the A320neo. At the time, the market share of single-aisle planes like the 737 was nearly 70% of new aircraft deliveries. Boeing estimated that market would be worth some $2.5 trillion over the next 20 years, and was not going to cede it.

Enter the 737 Max. Featuring new engines and aerodynamic changes, the grownup Baby Boeing promised carriers up to 20% better fuel efficiency and lower operating costs. There were challenges in the new design. The model’s new LEAP-1B engines, for instance, are 20 in. larger than the original engines. So Boeing redesigned the 737’s pylons, which hold the engines to the wing, and moved them farther forward. But the more powerful engines in a different location could pitch the jet’s nose upward, creating the conditions for a midair stall.

To prevent the stall, Boeing created an automated-flight-control feature called the Maneuvering Characteristics Augmentation System (MCAS). When MCAS sensors detected the nose of the plane pitching up, the software controlling the tail’s horizontal stabilizer would automatically push the nose back down. It was a novel fix to a nagging design problem.

But Boeing took a number of steps that blunted the scrutiny the feature could draw from safety regulators at the FAA. In an early report to the FAA that certified the plane as safe to fly, Boeing understated how much the system could move the horizontal tail, according to the Seattle Times. “When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document,” the Times reported. Also, Boeing failed to account for how “the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward.” And Boeing said MCAS should not be activated if it received data gathered from just one of two sensors–“and yet that’s how it was designed,” the Times reported.

Just as it understated the extent to which MCAS might take automated control of the plane, Boeing, with the support of regulators, decided against extensive training for pilots on the 737 Max, including in how to disable the software. Boeing said additional flight-simulator training for pilots–which costs airlines time and money, and therefore could have dampened 737 Max sales–weren’t necessary. Boeing acknowledged that training guidelines for the 737 Max didn’t mention MCAS. These moves got the 737 Max to market faster, allowing Boeing to offer it just nine months after Airbus introduced its single-aisle, fuel-efficient competitor, the A320neo. The Max was an immediate hit, garnering more than 5,000 orders from more than 100 customers worldwide. It received FAA certification in March 2017, and regulators around the world followed suit. Two months later, Boeing began deliveries.

Much of the certification of the aircraft took place under an FAA program known as Organization Designation Authorization (ODA). In-house inspectors directly managed by Boeing reviewed designs and oversaw testing to ensure industry standards and proper certification.

The ODA program was first introduced in 2005 as a way to streamline FAA procedures. FAA officials were struggling to enforce regulations across the sprawling industry, which encompasses more than 200,000 aircraft, 1,600 manufacturers and 5,400 airlines and operators. Backed by industry groups, the program provided a way to quickly resolve technical issues at different stages of the certification process.

The logic was simple: manufacturers have heavy incentives to build a safe airplane, not least because accidents can significantly harm their bottom line and perhaps even put them out of business. That argument, propounded by lobbyists, carried the day in D.C. The program was fully implemented in 2009, and by 2018 Congress had mandated the FAA to “delegate fully” safety functions to industry.

Federal watchdogs were critical of the FAA’s oversight of the ODA program throughout its implementation. The Department of Transportation’s inspector general wrote a report in 2011 instructing the FAA to better assess the program’s risks. In 2015, the inspector general again warned the FAA about insufficient oversight. “Delegation is an essential part of meeting FAA’s certification goals,” the report said. “However, robust FAA oversight that is systems-based and targeted to high-risk areas is necessary to ensure that ODA companies maintain high standards and comply with FAA safety regulations.”

It is not an easy problem. Technology and automation are making oversight harder, and regulators have been spread thin since 9/11. Overseas competitors are pushing U.S. industry to move fast. European aviation authorities have also outsourced safety certification to private contractors. And decades of deregulatory zeal in both parties created a welcome environment for outsourcing safety. Jeff Guzzetti, recently retired director of the FAA’s Accident Investigation Division, who audited the ODA program when he was with the Transportation Department’s office of inspector general, says there’s risk anytime the FAA moves further from direct oversight. But he also acknowledged that the delegation of responsibility is needed now that aircraft are increasingly technologically complex. “No one knows the airplane better than the manufacturer, and the FAA just doesn’t have the resources, or the speed or the expertise, to keep up with the modern airplane technologies,” he says. Ultimately, he says, “There has to be some trust in the manufacturer to ensure their product is safe.”

Since the latest crash, Boeing has appointed a new vice president of engineering and dedicated a top executive to the company’s aircraft investigations. The planemaker has said the FAA concluded that MCAS “met all certification and regulatory requirements.” According to the FAA, the 737 Max’s certification followed agency standards and took approximately five years. The FAA, for its part, said it received no whistle-blower complaints or any reports alleging pressure to speed up certification. “The long-standing collaborative engagement between the FAA, Boeing, its customers and industry partners has created the safest transportation system in the world,” says Boeing spokesman Paul Bergman.

It will take months for investigators to uncover the causes of the crashes, and months more for them to determine if the FAA or Boeing played a role in the disasters. Even if they conclude that one or both did, the battle to reimpose strict regulatory oversight on the aviation industry may be just beginning. After all, it was Congress itself, prodded by its big-spending friends in the aviation lobby, that mandated safety outsourcing at the FAA in the first place.

–With reporting by ALANA ABRAMSON, HALEY SWEETLAND EDWARDS, ABBY VESOULIS and JOHN WALCOTT/WASHINGTON