An independent report commissioned by the Federal Aviation Administration may influence a crucial, looming decision about Boeing's not-yet-certified-to-fly 737 Max 10.
The previously undisclosed March 2022 report is highly critical of how, during the Max's original certification, the safety agency exempted earlier Max models from the latest standard for pilot-warning systems. On an airliner, the crew-alerting system provides the pilots a series of visual, audio and/or tactile warnings that something has gone wrong.
The Max 10's crew-alerting system has been upgraded from the previous Max models, but still falls short of complying with the current safety regulation. Boeing is likely to need that exemption extended to get the Max 10 certified for passenger service.
The independent report from the MITRE Corp., a federally funded research organization, concludes that exemption from the crew-alerting standard contributed to the two Max crashes that killed 346 people, and also influenced Boeing to suppress information about the new flight control software on the Max — known as the Maneuvering Characteristics Augmentation System, or MCAS — that was the main cause of the crashes.
"The exception granted by the FAA for pilot alerting on the 737 Max was a critical link not only in the chain of events that led to the accidents, but also in Boeing's decision to limit the disclosure of MCAS," the report states.
The FAA has told Boeing the Max 10's certification is unlikely to be completed this year. Congress therefore faces a decision on whether to extend a Dec. 20 deadline in the FAA reform legislation of 2020 so that the same exemption will cover the Max 10.
It's a crucial decision for Boeing.
If Congress insists that the Max 10 crew alerts be updated, then Boeing would either have to abandon the Max 10 program — a drastic step after so much development work and with several hundred of the jets already sold — or modify its cockpit system, making it different from earlier Max models.
Modifying the cockpit would require investment by Boeing and slow the Max 10's entry into service.
And it would mean higher pilot training costs for airlines, as Max 10 pilots would need separate training. Boeing might lose some sales to the Airbus A321neo.
The FAA said it is reviewing the report. It declined to comment on the crew-alerting system, which it certified as safe on earlier Max models.
Instead, the agency indicated the decision on the Max crew-alerting system is Congress' responsibility. The FAA noted that only Congress can change the deadline after which the Max 10 would need to be upgraded.
"Our hands are tied by the wording of the law," an FAA spokesperson said Friday.
But Sen. Maria Cantwell, D-Wash., said Friday she wants the FAA to provide Congress some direction on the pending decision about extending the exemption for the Max 10.
"The FAA must show leadership and tell us what they think is needed for the highest safety standards in light of this report," Cantwell said. "I look forward to their recommendation."
Rep. Peter DeFazio, D-Ore., chair of the House Transportation and Infrastructure Committee, likewise called for the FAA to provide its view of the report's implications.
In a statement Monday, he said the safety of the public demands "the highest quality technical data and analysis."
"I urge the FAA to consider the report's recommendations carefully and issue a detailed response," DeFazio said.
Boeing declined to comment on the report.
Congressional proposals rejected
The Aircraft Certification Safety and Accountability Act passed in 2020 requires the FAA to commission an independent study to assess two proposed reforms in how it certifies derivative airplanes — jets like the Max that are new versions of older planes first certified many years earlier.
One proposal would apply a time limit, so that after a certain number of years any new model would have to undergo an entirely new certification process.
The second proposal would require formal, public documentation of any exception granted a system on a derivative plane that allows it to be certified without meeting the latest safety standard.
The FAA assigned the assessment of these proposals to MITRE, a spinoff from the Massachusetts Institute of Technology that's a nonprofit engineering organization conducting research for government agencies.
MITRE's technical report is an internal document that was not publicly released until The Seattle Times posted it online.
Aside from what it says about the exemption for the Max's crew-alerting system, the report's overall recommendation to Congress is separately important for how it could influence the future approach to airplane certification.
MITRE found that neither of Congress' proposed reforms adds enough to safety to justify the cost.
It found no evidence that jets certified as derivatives have proved less safe than those with an all-new certificate. It calculated that requiring Boeing to do a completely new certification for a derivative airplane would add about $750 million to the cost.
And the MITRE report found that the extra work imposed by the second proposal would require hiring six additional FAA employees, but "was unable to identify any safety benefit."
Instead, MITRE came up with an alternative proposal.
It proposes requiring the FAA to identify safety-critical features in an airplane design and then allow Boeing to negotiate with the FAA how each such feature is treated in certifying a new airplane.
Instead of a hard-and-fast rule, this leaves the outcome to be decided case by case.
One FAA safety engineer, who asked for anonymity because he spoke without authorization, questioned the wisdom of that.
He said that while Congress' proposals "drew a line in the sand," the fuzziness of MITRE's recommendation could ultimately leave critical safety decisions to negotiation between FAA managers and Boeing managers rather than front-line engineers.
Boeing, though, may welcome MITRE's proposal, as it seems to change little from the current approach to certification.
Inadequate crew alerts in 5 crashes
More problematic for Boeing is that the report identifies the crew-alerting system as one of those "safety-critical features" that must be negotiated with the FAA, and delves deeply and scathingly into the specific exemption the agency granted Boeing on the Max.
The modern systems in all Boeing planes besides the 737 have a color-coded hierarchy of alerts for failures, from minor to potentially catastrophic, and alphanumeric messages on a central screen tell the pilot exactly what the problem is.
The older 737 design has a more complicated system with initial warnings lighting up on the glare shield at the top of the instrument panel and further diagnosis provided by clusters of various switches, dials and lights on an overhead panel.
MITRE found the FAA's decision to exempt the Max flight crew-alerting system from the current safety regulation was "inherently flawed."
In a strange argument for the claim that a new crew-alerting system was unnecessary, Boeing had identified three fatal 737 accidents in the previous decade where investigators found the crew-alerting system was a factor — but pointed out that in each case it had made a specific change to fix the problem.
The MITRE analysts were unimpressed.
They concluded that the fixes Boeing retroactively provided in each of those crashes merely "patched the inadequacies of the 737 pilot-warning system rather than proactively implementing better human factor designs and pilot-alerting systems that the company was already installing on other aircraft."
Subsequently, the pilots on the Lion Air and Ethiopian Airlines Max crash flights were confused and distracted by a cacophony of crew alerts that failed to help them understand what was causing the planes to nosedive.
The report said its analysis of the three earlier crashes plus the two Max crashes "strengthens our focus on the need to hold flight deck, crew-alerting, and other safety-critical systems to a higher level of scrutiny."
In addition, Boeing had argued that the cost of complying with the regulation would be colossal, in excess of $10 billion. MITRE's analysts were skeptical, noting that this amount could cover the entire development of a new airplane.
They concluded that Boeing's cost estimate "was not something that could be effectively evaluated by the FAA."
Most tellingly, MITRE's analysts concluded that if only the FAA had insisted on the Max meeting the crew alerting standard, the fatal role of the MCAS software in the crashes might have been avoided.
They argued that an upgrade to the crew alerting system would have triggered additional pilot training on simulators and Boeing would then have had no reason to minimize and hide MCAS as it did to avoid extra pilot training.
If MCAS had been subject to such scrutiny during certification, the report suggests FAA engineers could well have flagged its design flaws.
"The additional training would have likely removed the incentive for Boeing to limit disclosure of the MCAS system, thus making its existence part of the pilot training process and possibly identifying and removing MCAS's dependence on a single angle-of-attack indicator," the report states.
Not a straightforward call
So should Congress force Boeing to upgrade the Max 10? Or change the deadline to wave the Max 10 through like the other models, still not meeting the crew-alerting standard?
It's a complex decision.
After the two Max crashes, Boeing seriously upgraded and strengthened the jet's systems. MCAS specifically has been fixed.
In addition, at the insistence of the European and Canadian aviation authorities, on the Max 10 model Boeing has added more upgrades that specifically improve the crew-alerting system.
First, Boeing added a third measure of the angle of attack for the Max 10, which makes the air data input to every system on the jet more reliable. That makes less likely a cascade of erroneous alerts, such as those that so confused the Lion Air and Ethiopian Airlines pilots.
In addition, Boeing is implementing on the Max 10 a way for the pilot to silence the most distracting of the erroneous alerts on the two crash flights: the stick shaker, which makes the pilot column vibrate forcefully and noisily if the plane is approaching a stall.
Those two changes make the Max 10 crew-alerting system safer and much closer to the latest regulatory standard, though still short of full compliance. Boeing intends to eventually retrofit them to the earlier Max models.
Boeing CEO Dave Calhoun, speaking Friday at a Sanford Bernstein investor conference, said the 737 Max is "one of the safest families of airplanes ever," and that with these changes the Max 10 "just might be the safest."
Calhoun also reiterated Boeing's argument that when the 2020 legislation was written, Congress intended that the rules apply to future new planes and not the Max jet family.
Indeed Congress wrote a two-year buffer into the law in the expectation that all the Maxes would be certified by then — a projection derailed by the FAA's protracted scrutiny of the Max 10.
In a press briefing last month, Al Madar, who heads Boeing's efforts to change its management of safety issues, warned of likely "unintended consequences" of changing the Max 10 system. He said the lack of commonality with other Maxes would introduce risk as pilots moved between planes and found different warning systems.
At that briefing, Boeing's Chief Aerospace Safety Officer Mike Delaney bluntly declared: "I personally have no belief that there's any value in changing the 737."
Some prominent outside experts disagree.
In March, former Boeing flight control engineer Curtis Ewbank and former FAA safety engineer Joe Jacobsen delivered to Cantwell's U.S. Senate committee a technical proposal to upgrade Boeing's 737 Max cockpit to current design standards.
They billed their proposal as a compromise that, while leaving the crew-alerting system short of what's installed in the cockpits of Boeing's more modern jets, does just enough to meet the current regulation.
Still, Boeing would have to deploy heavy investment and resources to design, test and certify the upgrade.
Which path to take? That's the dilemma facing Congress.
