WASHINGTON—A U.S. Congressional report on the Boeing 737 MAX reveals that while Boeing learned during the model’s development that pilots might not quickly diagnose the malfunction that led to two fatal MAX accidents, it did not modify either the aircraft’s design or pilot training to address the issue. 

The report also suggests the FAA became concerned about the issue weeks after the first accident but did not take action. 

The House Transportation and Infrastructure (T&I) committee report, released Sept. 16, reiterates numerous, previously reported failings by both the manufacturer and the FAA that contributed to the accidents and the model’s ongoing grounding. New information about early MAX simulator sessions re-frames when Boeing knew that pilots may have problems diagnosing malfunctions, suggesting shortcomings cited as lessons learned from both accidents were evident long before the first one. 

A November 2012 email between two unidentified Boeing employees—and just made public by the committee—showed that, in at least one simulator session, Boeing pilots took more than 10 sec. to react to a runaway stabilizer caused by an errant maneuvering characteristics augmentation system (MCAS) activation. 

“Do you think that with pilot training/knowledge, of the system there will be a sufficiently quick response to the [stabilizer] runaway ...?” one employee wrote. The second employee, who flew one of the simulator sessions but reacted more quickly to the MCAS malfunction, responded that more analysis was needed. 

The simulator tests were used to help Boeing justify how to categorize an MCAS-related hazard assessment, and the 10 sec. figure is key. Certain failures that require at least 10 sec. for pilots to counter are considered “catastrophic” in certification terms and require specific design safeguards. Boeing eventually determined that pilots could react to the MCAS-driven runaway stabilizer in 4 sec. or less, one of the factors that put the failure in the less-severe “major” category.  

The FAA was not told about the early simulator trials, even as the MCAS was refined and expanded later in the MAX’s development. Boeing also failed to re-run safety assessments on updated MCAS logic, which both increased the amount of stabilizer input the system could have and enabled it to operate in more flight conditions. 

“Multiple Boeing [employees] failed to inform the FAA that Boeing had discovered early on in the MAX program that it took one of its own test pilots more than 10 sec. to respond to an uncommanded activation of MCAS in a flight simulator, a condition the pilot found to be ‘catastrophic,’” the report said. “This should have called into question Boeing’s assumptions about pilot response times. It did not. Multiple Boeing [employees] were aware of this critical Boeing test data and never shared it with the FAA, because there was no specific requirement to do so.” 

Each MAX accident, Lion Air Flight 610 (JT610) in October 2018 and Ethiopian Airlines Flight 302 (ET302) in March 2019, happened because a single faulty angle-of-attack (AOA) sensor activated the MCAS and triggered unneeded, repeated automatic nose-down horizontal stabilizer inputs. Contrary to Boeing’s assumptions, the pilots did not quickly diagnose the problem as runaway stabilizer, which would have meant directing the nose up, and then toggling cutout switches that would prevent the trim motors from moving the stabilizer, effectively disabling MCAS.  

Instead, pilots battled the nose-down movements by pulling back on their control yokes and countering with electric trim inputs. The ET302 crew toggled the cutout switches for a short time and attempted to manually adjust the trim. Aerodynamic loads on the mis-trimmed aircraft made the trim wheel hard to turn, however, and the crew re-engaged the stabilizer motors in an attempt to direct the nose back up.

In both cases, the MCAS software kept functioning as designed, pushing the aircraft’s nose down because an AOA sensor signaled it was too high. The confused flight crew failed to maintain control, leading to fatal dives.

Boeing’s 4-sec. pilot-reaction assumption and related requirements followed accepted FAA certification standards. But analysis done in the wake of both accidents, including by NTSB experts, have called them into question, arguing that regulators and aircraft manufacturers need more real-world data to support them.  

The committee report also suggests that FAA experts developed concerns about Boeing’s MCAS-related pilot-reaction assumptions before the ET302 accident. Days after the first accident—and prompted by Boeing’s concerns that an MCAS-related malfunction had played a role—the FAA issued an emergency airworthiness directive (AD) that reiterated procedures for managing a runaway stabilizer, or “uncommanded horizontal stabilizer trim movement.” 

The AD reiterated established procedures—many of which depend on pilot-reaction assumptions now considered inadequate—for managing the emergencies but did not recommend any new ones or call attention to potentially faulty assumptions. It also did not discuss MCAS by name.  

Meanwhile, Boeing and the FAA had determined that the MCAS software needed modifications, but the risk to the operational fleet was not high enough to warrant additional action beyond the AD. 

In January 2019, an FAA office began a review of MCAS, including Boeing’s submissions, safety assessment assumptions, and the agency’s work on certifying the system. A draft report prepared by the office found Boeing complied with all certification requirements, but “implied that these ‘assumptions’ by both Boeing and the FAA regarding pilot reaction time, for instance, were faulty,” the T&I report said. 

A draft of the MCAS report was being reviewed by FAA sensor management when ET302 crashed, and it was never finalized. The committee said it reviewed the draft report “remotely” earlier in 2020, but the FAA, citing the report’s unfinished status, declined to provide a copy. The committee’s final report does not detail what the FAA’s draft findings said about Boeing’s pilot-reaction assumptions.  

The FAA declined to discuss the draft report, but pointed to the November 2018 AD as evidence of its pilot-response concerns right after the JT610 accident.

"The FAA acted immediately following the first accident, based on all the information available, to issue an emergency AD," the agency said. "The AD specifically reemphasized the correct procedure for flight crews to follow if they encountered uncommanded horizontal stabilizer trim movement."

T&I’s 238-page report cites Boeing’s “disturbing pattern of technical miscalculations and troubling management misjudgments” as well as “numerous oversight lapses and accountability gaps by the FAA” as playing a “significant” role in the two MAX accidents. The pilot-response issue is part of a long list that includes designing the MCAS to be activated based on one sensor’s input and deciding, with FAA’s approval, to keep any discussion of MCAS out of the pilot flight manuals. 

Boeing is addressing the MAX’s technical and training issues as part of changes designed to win regulatory approval for the model’s return to service. The T&I committee has introduced legislation that targets changes to the FAA product-approvals process, including how much reliance the agency can place on applicants to conduct tests and other certification work.  

“Our report lays out disturbing revelations about how Boeing ... escaped scrutiny from the FAA, withheld critical information from pilots, and ultimately put planes into service that killed 346 innocent people,” said committee chair Pete DeFazio (D-Oregon). “What’s particularly infuriating is how Boeing and FAA both gambled with public safety in the critical time period between the two crashes.” 

The FAA said it “looks forward to working with the Committee to implement improvements identified in its report. We are already undertaking important initiatives based on what we have learned from our own internal reviews as well as independent reviews of the Lion Air and Ethiopian Airlines accidents.” 
 

Editor's note: an earlier version of this story cited an incorrect hazard assessment category for an MCAS-related runaway stabilizer failure. This has been corrected.