An internal risk analysis after the first of two Boeing 737 MAX airliner crashes showed the likelihood was high of a similar cockpit emergency within months, according to a Federal Aviation Administration official familiar with the details and others briefed on the matter.
The regulator’s analysis, not previously reported, showed that it “didn’t take that much” for a malfunction like the one confronted by the pilots of the Lion Air flight that crashed into the Java Sea last year to occur, one of the people briefed on the analysis said.
Based on the findings, the regulator decided it was sufficient to inform pilots about the hazards of an onboard sensor malfunction that led to a flight-control system pushing down the plane’s nose. The belief was that if pilots were aware of the risk and knew how to respond, it was acceptable to give Boeing and regulators time to design and approve a permanent software fix to MCAS, the flight-control system implicated in the crash, according to the agency official and people briefed on the findings.
The FAA’s early goal, one of these people added, was: “Get something out immediately and then mandate something more permanent.”
Specifically, the FAA’s analysis suggested that a warning to pilots would be enough to provide Boeing about 10 months to design and implement changes to MCAS, according to a person close to the manufacturer. Boeing had been planning to complete the changes by April, within the 10-month period, this person said.
Boeing and the FAA’s risk projections faced a real-world crisis in less than five months. Ethiopian Airlines Flight 302 went down on March 10 in a similar nosedive prompted by the same type of automated MCAS commands pilots couldn’t overcome. The dual crashes took a total of 346 lives.
Investigators quickly focused on the central role of MCAS, and regulators around the world grounded the aircraft.
Share Your Thoughts
What do you think of how the FAA assessed and responded to the Boeing 737 MAX’s safety risks after the Lion Air accident? Join the conversation below.
The FAA has said it doesn’t have a deadline for approving the final package of fixes but won’t allow the planes back in the air until all safety issues are resolved.
A Boeing spokesman said: “Boeing and the FAA both agreed, based on the results of their respective rigorous safety processes, that the initial action of reinforcing existing pilot procedures…and then the development and fielding of a software update, were the appropriate actions.”
He added: “The safety of everyone flying our airplanes was paramount as the analysis was done and the actions were taken.”
The FAA’s internal analysis, prepared in the days immediately following the Oct. 29 Lion Air crash, is called a TARAM, an acronym that stands for Transport Airplane Risk Assessment Methodology. It essentially involves a spreadsheet with formulas that consider a number of factors—such as fleet size, probability that sensors will fail, passenger counts—and aims to predict how many people could die over a certain period because of potential hazards, according to people familiar with the process.
The Maneuvering Characteristics Augmentation System (MCAS) was installed in the new Boeing 737 MAX to compensate for the extra pitch up produced by its larger engines at elevated angle-of-attack (AOA).
The system kicks in when an AOA vane provides data that shows the plane is at risk of stalling, losing lift.
MCAS automatically pushes the nose down by moving the horizontal stabilizer.
In the two 737 MAX crashes, investigators believe faulty AOA data caused MCAS to misfire, repeatedly activating the system even though the airplane’s nose wasn’t rising.
Source: Boeing and UTC Aerospace Systems
There is also a subjective analysis that, along with the TARAM’s numerical forecasts, informs FAA managers and engineers about what types of actions to take and when—for major but also less-serious air-safety issues. “It’s kind of a cold way of looking at it,” the person briefed on the analysis said, adding: “It’s not foolproof. It’s a tool.”
The analysis determined that the underlying risks from the MCAS design were unacceptably high without at least some FAA action, that they exceeded internal FAA safety standards and that the likelihood of another emergency or even accident “was over our threshold,” according to the FAA official. “We decided…it was not an acceptable situation,” the official said.
A Step-By-Step Blueprint For Making Money Online, That Is 100% Dummy Proof!
GET EASY FREE TRAFFIC + AFFILIATE OFFER = COMMI$$IONSGet The Simple Traffic Blueprint Now!
The directive to pilots essentially reiterated that cockpit crews should counteract and then disable an MCAS misfire by following long-established emergency procedures for a related flight-control problem that can similarly push down an aircraft’s nose.
When the FAA determines an aircraft poses an unacceptably high safety risk, it typically mandates targeted equipment changes, inspections or training to alleviate the hazard. It is unusual for the agency to conclude that reiterating cockpit emergency procedures or tweaking manuals will suffice.
The FAA’s Nov. 7 emergency directive, described as an “interim action,” didn’t mandate design or operational changes. Because it reminded pilots how to swiftly and correctly respond to such an MCAS malfunction, that approach “wasn’t removing the risk,” the FAA official said Tuesday, but rather “making it acceptable for a period based on the data we had.”
In a report shared with Boeing in late 2018, after the FAA’s directive, the agency said its analysis found the “risk is sufficiently low…until the changes to the system are retrofitted,” according to the person close to the manufacturer.
Grounding wasn’t seriously discussed but “that’s always on the table” after a deadly crash, the person briefed on the analysis said. As FAA officials learned of MCAS’s design issues, they also learned of other problems that could have contributed to the accident, including maintenance and pilot missteps, this person said.
At a subcommittee hearing Wednesday, senators pressed the FAA’s top safety official on why the agency didn’t disclose sooner that it believed the MCAS system needed to be modified.
Sen. Susan Collins, a Republican from Maine, referring to The Wall Street Journal’s story, said: “What troubles me about this is if the agency’s own analysis found MCAS to be an unacceptable risk, why did the FAA not take immediate action to address those risks?”
Ali Bahrami, the FAA’s associate administrator for aviation safety, said it is routine for the FAA to take interim actions while undertaking longer term measures to fix problems.
“From the safety perspective, we felt strongly that what we did was adequate,” he said. “We felt we had sufficient time to be able to do the modification and get the final fix,” he added later. Mr. Bahrami said that based on pending outside reviews, the agency plans to reassess whether it handled the safety issues appropriately.
Senior FAA officials also faced broad questions from lawmakers about how the MAX was certified and whether the agency was overly deferential to Boeing, along with other air safety issues. Officials defended the certification process and said they have not sacrificed safety.
Boeing said it began working on changes to MCAS shortly after the Lion Air crash. The first software fix package was formally presented for FAA approval in December, but was still being tested and analyzed when the Ethiopian crash occurred in March.
Between the two crashes, FAA engineering teams continued to assess data and fold details of the Lion Air probe into their safety assessments. “We continued asking questions,” the FAA official said, adding that historical safety information from U.S. operators of the MAX indicated that “we weren’t getting data” revealing pilots wouldn’t react appropriately to MCAS emergencies.
In the end, the FAA’s statistical predictions didn’t anticipate another accident would happen as soon as it did. “Statistically, the calculations just didn’t work out,” said the person briefed on the analysis. “You can’t predict randomness.”
It isn’t clear why Boeing took longer to finish MCAS changes than some industry and FAA officials had expected. At a late March briefing in Renton, Wash., a Boeing official said the plane maker took care to fine-tune the revised software and test it. “We didn’t rush it because rushing is the wrong thing to do in a situation like this,” the Boeing official said.
FAA engineers and safety experts prepared a separate TARAM risk analysis in the wake of the Ethiopian crash, according to the FAA official and others familiar with the matter. The full assessment was completed two days after the crash, the official recalled, and was presented to senior policy makers at headquarters the next day. That same morning, the FAA received new satellite data more directly implicating MCAS, prompting the agency to become the last major aviation regulator to ground the MAX fleet.
Boeing has since experienced more delays amid subsequent company reviews, questions from the FAA and flight test results—including simulator sessions with FAA pilots—revealing a series of technical problems.
—Alison Sider, Elisa Cho and Jim Oberman contributed to this article.
Copyright ©2019 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
Free Gift With Our Newsletter
We hate SPAM and promise to keep your email address safe