◆Part 1: The Crashes
On 29 October 2018 Lion Air flight 610 departed Jakarta for Pangkal Pinang. Thirteen minutes after takeoff the Boeing 737 MAX crashed into the Java Sea. All 189 passengers and crew died.
Less than five months later, on 10 March 2019, Ethiopian Airlines flight 302 departed Addis Ababa for Nairobi. Six minutes after takeoff the Boeing 737 MAX crashed. All 157 passengers and crew died.
The U.S. House Committee on Transportation and Infrastructure Final Committee Report of September 2020 states that the two crashes resulted in the preventable deaths of 346 people. Both crashes involved Boeing 737 MAX airplanes.
On 8 March 2017 the Federal Aviation Administration granted an amended type certificate to Boeing for the 737 8, the first of the 737 MAX family. In May 2017 the 737 MAX entered revenue passenger service. Seventeen months later it suffered its first fatal crash.
◆Part 2: The System
The 737 MAX contained a new feature in its flight control computer: the Maneuvering Characteristics Augmentation System, or MCAS. The Committee report states that MCAS could trigger flight control movements the pilots did not command and could place the airplane into a dangerous nose down attitude.
MCAS operated on input from one of the two angle of attack sensors mounted on either side of the fuselage. The Committee found that Boeing permitted MCAS to activate on input from a single angle of attack sensor.
On the day before the Lion Air crash, a mechanic replaced the left angle of attack sensor on the accident airplane. On the flight to Jakarta, MCAS activated on an erroneous reading from that sensor and commanded the horizontal stabilizer to push the nose down. A third pilot on the flight deck recognized the condition. The crew used the stabilizer trim cutout switches and landed safely in Jakarta.
The captain logged cautions from that flight. He did not report the use of the stabilizer trim cutout switches. On 29 October 2018 the same airplane flew as Lion Air flight 610. Erroneous angle of attack data again triggered MCAS. The Committee report records that this occurred more than 20 times as the pilots fought the system. They did not recover.
On Ethiopian Airlines flight 302 a faulty angle of attack sensor again triggered MCAS. Over about six minutes airborne, MCAS triggered four times. The pilots did not recover.
◆Part 3: The Plan
In June 2013 Boeing employees formulated a plan to avoid increased cost and greater certification and training impact for the 737 MAX by describing MCAS as an addition to the existing Speed Trim system. Meeting minutes warned that if Boeing emphasized MCAS as a new function there may be a greater certification and training impact. A Boeing Authorized Representative concurred with the plan. The Committee found no evidence that the Authorized Representative shared that information with the FAA.
Both Boeing and the FAA failed to designate MCAS a safety critical system. In May 2019 then Acting FAA Administrator Dan Elwell acknowledged that point at a Committee hearing.
In 2015 a Boeing Authorized Representative raised the question of whether MCAS was vulnerable to single angle of attack sensor failures. The aircraft was delivered with MCAS dependent on a single angle of attack sensor.
◆Part 4: The Manual
In March 2016 Keith Leverkuhn, General Manager of the 737 MAX program, and Michael Teal, Chief Project Engineer on the 737 MAX program, approved a redesign of MCAS to increase its authority to move the stabilizer at low speed.
Hours after that approval, Boeing sought and the FAA approved the removal of references to MCAS from the Flight Crew Operations Manual. That manual provides procedures, performance, and systems information to flight crews. As a result, 737 MAX pilots were precluded from knowing of the existence of MCAS and its potential effect on aircraft handling without pilot command.
The FAA officials who authorized the removal remained unaware of the MCAS redesign until after the Lion Air crash.
In a transcribed interview with Committee staff, Michael Teal acknowledged that when he approved the MCAS redesign in March 2016 he was unaware of three facts. First, that MCAS operated from a single angle of attack sensor. Second, that MCAS could activate repeatedly. Third, that Boeing had internal test data showing that one of its own test pilots took more than 10 seconds to react to uncommanded MCAS activation in a flight simulator and described the results as catastrophic.
Teal was the program Chief Project Engineer responsible for signing off key design decisions. He did not supervise the engineers. He told Committee staff that none of them worked for him but all of them worked for him.
◆Part 5: Ten Seconds
In November 2012 it took a Boeing test pilot more than 10 seconds to respond to uncommanded MCAS activation in a flight simulator. The condition was found to be catastrophic. Federal guidelines assume pilots will respond to this condition within four seconds.
The Committee found that Boeing Authorized Representatives who knew of that 2012 test data did not inform the FAA.
After Boeing redesigned MCAS in 2016 to increase its authority at lower speeds, Boeing failed to reevaluate the system or perform single or multiple failure analyses of MCAS.
In June 2016, after a test flight, a Boeing Authorized Representative raised concerns about MCAS countering the pilot attempts to trim and about vulnerability from faulty angle of attack readings. Those concerns were discounted by Boeing colleagues. After the same test flight, another Boeing engineer asked if repetitive MCAS activation was a safety issue. A colleague answered that it was not safety, other than that the pilot could fight the MCAS input and over time find themselves in a large mistrim.
In both MAX crashes the pilots struggled against repetitive MCAS activations that forced the airplanes into a nose down configuration from which they could not recover.
◆Part 6: The Alert
The Angle of Attack Disagree alert was intended to notify the crew if the two angle of attack sensor readings disagreed. It was supposed to be standard on all 737 MAX aircraft.
A software issue tied the alert to an optional Angle of Attack Indicator display. The result was that the alert was inoperable on more than 80 percent of the MAX fleet. Boeing tested the software in July 2015 and failed to detect the problem. In August 2017, five months after FAA certification and three months after revenue service began, Boeing issued a problem report that the alert was not functioning on the vast majority of the fleet.
Boeing did not immediately inform the FAA or its customers. A Boeing Authorized Representative consented to postponing the software fix. Boeing delivered aircraft knowing the alert was inoperable. Then Acting FAA Administrator Dan Elwell stated that Boeing was required to deliver airplanes with functioning Angle of Attack Disagree alerts because they were part of the approved type design.
Boeing provided Lion Air a Flight Crew Operations Manual dated 16 August 2018 that explained how the alert was intended to work and gave no indication that Boeing knew the alert on that airplane was inoperable.
◆Part 7: Level B
Boeing made obtaining Level B differences training from the FAA a design objective for the 737 MAX. Level B means training without a full flight simulator. Michael Teal told Committee staff that obtaining Level B pilot training requirements was a design objective of the airplane.
In August 2016 the FAA granted provisional approval for Level B differences training for the 737 MAX. Boeing employees later received a company award for developing the MAX Level B differences training.
In March 2017, the month the FAA certified the 737 MAX, Boeing 737 Chief Technical Pilot wrote to colleagues about the prospect of 737 MAX simulator training: Boeing will not allow that to happen. We will go face to face with any regulator who tries to make that a requirement.
In December 2017 the Chief Technical Pilot, referring to efforts to talk airlines out of simulator training, wrote to a Boeing colleague: I save this company a sick amount of money.
After the Lion Air crash Boeing maintained that its rationale for removing MCAS from the training manual was still valid and asserted that the addition of MCAS did not affect pilot knowledge, skills, abilities, or flight safety. Boeing recommended that the FAA require only Level A training on MCAS, the level with the fewest obligations. On 1 March 2019 the FAA reminded Boeing that the original differences training level proposed in 2016 was Level B and that software changes to MCAS may not meet Level A. Nine days later Ethiopian Airlines flight 302 crashed.
◆Part 8: The Record
The Committee concluded that technical design flaws, faulty assumptions about pilot responses, and management failures by both Boeing and the FAA played instrumental and causative roles in the chain of errors that led to the two crashes.
The crashes were not the result of a singular failure. They were the culmination of faulty technical assumptions by Boeing engineers, a lack of transparency by Boeing management, and insufficient oversight by the FAA.
After the Lion Air crash, Boeing and the FAA issued advisories for 737 MAX pilots that failed to mention MCAS by name. The FAA acknowledged it had drafted and then deleted a reference to MCAS from a draft Emergency Airworthiness Directive. Less than five months later 157 more people died on Ethiopian Airlines flight 302.
MCAS depended on a single angle of attack sensor. Pilots were not told it existed. A test pilot needed more than 10 seconds when the assumption was four. The alert meant to show disagreeing sensors was dark on most of the fleet. Level B training was the goal. The airplanes were certified. Then 346 people died.
Final Committee Report. The Design, Development and Certification of the Boeing 737 MAX. Prepared for Chair Peter A. DeFazio and Subcommittee on Aviation Chair Rick Larsen by majority staff of the U.S. House Committee on Transportation and Infrastructure. September 2020.