U.S. Reviewing Boeing’s Safety Self-Assessments During Max 8 Development

Boeing Co. fell on heightened scrutiny by regulators and prosecutors over whether the approval process for the company’s 737 Max jetliner was flawed.

A person familiar with the matter on Sunday said that the U.S. Transportation Department’s Inspector General was examining the plane’s design certification before the second of two deadly crashes of the almost brand-new aircraft.

Separately, the Wall Street Journal reported that a grand jury in Washington, D.C., on March 11 issued a subpoena to at least one person involved in the development process of the Max. And a Seattle Times investigation found that U.S. regulators delegated much of the plane’s safety assessment to Boeing and that the company in turn delivered an analysis with crucial flaws.

Boeing dropped 2.6 percent to $369.03 at 9:45 a.m. Monday in New York, heading toward a new low since the deadly crash of Ethiopian Airlines Flight 302 on March 10. Ethiopia’s transport minister said Sunday that flight-data recorders showed “clear similarities” between the crashes of that plane and Lion Air Flight 610 last October.

Read more: Q&A on Boeing’s 737 Max crisis

U.S. Federal Aviation Administration employees warned as early as seven years ago that Boeing had too much sway over safety approvals of new aircraft, prompting an investigation by Transportation Department auditors who confirmed the agency hadn’t done enough to “hold Boeing accountable.”

The 2012 investigation also found that discord over Boeing’s treatment had created a “negative work environment” among FAA employees who approve new and modified aircraft designs, with many of them saying they’d faced retaliation for speaking up. Their concerns pre-dated the 737 Max development.

In recent years, the FAA has shifted more authority over the approval of new aircraft to the manufacturer itself, even allowing Boeing to choose many of the personnel who oversee tests and vouch for safety. Just in the past few months, Congress expanded the outsourcing arrangement even further.

“It raises for me the question of whether the agency is properly funded, properly staffed and whether there has been enough independent oversight,” said Jim Hall, who was chairman of the National Transportation Safety Board from 1994 to 2001 and is now an aviation-safety consultant.

Outsourcing Safety

At least a portion of the flight-control software suspected in the 737 Max crashes was certified by one or more Boeing employees who worked in the outsourcing arrangement, according to one person familiar with the work who wasn’t authorized to speak about the matter.

The Wall Street Journal first reported the inspector general’s latest inquiry. The watchdog is trying to assess whether the FAA used appropriate design standards and engineering analysis in approving the 737 Max’s anti-stall system, the newspaper said.

Both Boeing and the Transportation Department declined to comment about that inquiry.

In a statement on Sunday, the agency said its “aircraft certification processes are well established and have consistently produced safe aircraft designs,” adding that the “737 Max certification program followed the FAA’s standard certification process.”

The Ethiopian Airlines plane crashed minutes after it took off from Addis Ababa, killing all 157 people on board. The accident prompted most of the world to ground Boeing’s 737 Max 8 aircraft on safety concerns, coming on the heels of the October crash of a Max 8 operated by Indonesia’s Lion Air that killed 189 people. Much of the attention focused on a flight-control system that can automatically push a plane into a catastrophic nose dive if it malfunctions and pilots don’t react properly.

In one of the most detailed descriptions yet of the relationship between Boeing and the FAA during the 737 Max’s certification, the Seattle Times quoted unnamed engineers who said the planemaker had understated the power of the flight-control software in a System Safety Analysis submitted to the FAA. The newspaper said the analysis also failed to account for how the system could reset itself each time a pilot responded — in essence, gradually ratcheting the horizontal stabilizer into a dive position.

Software Fix

Boeing told the newspaper in a statement that the FAA had reviewed the company’s data and concluded the aircraft “met all certification and regulatory requirements.” The company, which is based in Chicago but designs and builds commercial jets in the Seattle area, said there are “some significant mischaracterizations” in the engineers’ comments.

In a separate statement Sunday, Boeing Chief Executive Officer Dennis Muilenburg reiterated the company’s sympathies for the affected families and support for the investigation into the flight-control system, known as the Maneuvering Characteristics Augmentation System.

“While investigators continue to work to establish definitive conclusions, Boeing is finalizing its development of a previously announced software update and pilot training revision that will address the MCAS flight-control law’s behavior in response to erroneous sensor inputs,” Muilenburg said.

The newspaper also quoted unnamed FAA technical experts who said managers prodded them to speed up the certification process as development of the Max was nine months behind that of rival Airbus SE’s A320neo.

The FAA has let technical experts at aircraft makers act as its representatives to perform certain tests and approve some parts for decades. The FAA expanded the scope of that program in 2005 to address concerns about adequately keeping pace with its workload. Known as Organization Designation Authorization, or ODA, it let Boeing and other manufacturers choose the employees who approve design work on the agency’s behalf.

Previously, the FAA approved each appointment. Under the new approach, which was fully implemented in 2009, the ODA representatives are still under U.S. legal requirements and the FAA has the authority to oversee them and request that their management be changed.

Anonymous Faxes

In 2012, a special investigator of the Office of Inspector General at the Department of Transportation sent a memo to the FAA’s audit chief warning him of concerns voiced by agency employees about the new process. Some allegations were made in anonymous faxes sent to the inspector general’s office, and the office followed up by interviewing employees in the FAA’s Transport Airplane Directorate.

“Our investigation substantiated employee allegations that TAD and FAA headquarters managers have not always supported TAD employee efforts to hold Boeing accountable and this has created a negative atmosphere within the TAD,” according to the June 22, 2012, report sent to the FAA. (The memo was made available later in a public records request and appears now on a website operated by governmentattic.org, which warehouses government documents. A spokesman for the inspector general’s office confirmed its authenticity.)

The employees told the investigators that managers had overturned a recommendation by staff to remove the administrator Boeing had chosen for the program and “had not adequately addressed employees’ concerns” about potential conflicts of interest, the memo said. The employees, it said, viewed this as evidence of management having “too close a relationship with Boeing officials.”

Despite those concerns, as well as others raised in a subsequent report by the inspector general, Congress has embraced the program as a way to improve the FAA’s efficiency.

President Donald Trump signed into law a change on Oct. 5. It allows manufacturers to request that the FAA eliminate limitations on how company representatives certify “low and medium risk” items, giving them even more authority over their own products.

The agency doesn’t have the budget to do every test, and “the use of designees is absolutely necessary,” said Steve Wallace, the former head of accident investigations at the FAA. “For the most part, it works extremely well. There is a very high degree of integrity in the system.”

Dreamliner Fires

But the program was also at issue in the FAA’s 2013 grounding of Boeing’s 787 Dreamliner after two fires of battery packs. Boeing’s designated engineering representatives oversaw tests of the battery packs.

A 2015 report by the Department of Transportation’s inspector general, requested by U.S. Representative Peter DeFazio, found the FAA lacked “an effective staffing model” and “risk-based oversight process” over the ODA program.

DeFazio, an Oregon Democrat, now heads the House transportation and infrastructure committee, and has said he will conduct a “rigorous investigation” to make sure the FAA is protecting safety.

Hall, the former NTSB chairman, said the agency’s move to shift power to the manufacturers contributed to the unusual situation in which two of Boeing’s newly introduced aircraft were grounded in a period of six years. Before the Dreamliner, the FAA hadn’t grounded a model since 1979.

“When I was chairman of the NTSB, my single most important job was who we hired,” Hall said. “Do we have in the federal government the level of funding and expertise we need? Are we attracting the kind of young, smart minds that continue to uphold our reputation in the aviation area?”

As the investigation continues, mourners marched in the hundreds past the Library of Parliament in Addis Ababa to Selassie Cathedral for a funeral service Sunday, wearing black or the sea-green uniforms of Ethiopian Airlines and carrying photos of the dead. After a priest read the victims’ names aloud, people carried empty coffins from the cathedral to a graveyard. All that was heard was sobbing, wailing and chanting.