‘Why Is This Airplane Still Flying?’ The FAA Missteps That Kept Boeing’s MAX Aloft – The Wall Street Journal

That decision set the stage for a second fatal MAX crash, of Ethiopian Airlines Flight 302, less than five months later.

In a critical misstep, FAA officials relied extensively on Boeing’s initial flight-simulator test results, some of the people said. Boeing largely used its cadre of highly experienced test pilots, an industry practice the FAA and accident investigators later acknowledged wasn’t appropriate to gauge how the other pilots would react in a real emergency.

On Monday, an FAA spokesman said the reminder to pilots “followed a rigorous and well-defined process,” adding that the agency’s overall response met regulatory requirements, was approved by multiple agency officials and reflected widely accepted industrywide standards.

Earl Lawrence,

head of the FAA’s aircraft-certification office, which approves and monitors new airplane models, was fresh in his post and lacked details about the MAX’s original approval to delve deeply into the situation, said people briefed on the deliberations. He and his team followed Boeing’s lead on diagnosing and resolving the crisis, including Boeing’s predictions that a fix could be developed in time to avert another tragedy.

From front-line FAA engineers and midlevel managers to high-ranking officials at agency headquarters, the consensus was that it wasn’t necessary to take drastic action such as grounding the fleet. FAA officials vouched for the safety of the MAX, even though it included the MCAS feature that eventually was implicated in both crashes.

How the FAA decided against a more-aggressive response to the crash hasn’t been reported before in detail.

That stance has prompted a barrage of criticism on Capitol Hill and elsewhere. The FAA’s decisions are expected to feature in Senate and House committee hearings this week. Lawmakers are expected to ask Boeing Chief Executive

Dennis Muilenburg

about the company’s interactions with the FAA, including whether it urged the regulator to avoid taking more-forceful action between the crashes.

As the MAX edges toward service again, probably early next year, European safety authorities have formally shelved the idea of ungrounding the MAX simultaneously with the FAA. They want to perform their own simulator tests and analyze additional safeguards. Other foreign regulators, too, are poised to conduct separate evaluations—something once unthinkable among overseas regulators, who typically followed the FAA in vetting the safety of U.S.-certified planes.

Boeing agreed with the FAA that it was appropriate to reiterate existing pilot procedures before rolling out software changes, a company spokesman said. “The safety of everyone flying on our airplanes was paramount as the analysis was done and the mitigating actions were taken,” he said, adding: “Boeing began work on a potential software update shortly after the Lion Air accident, when MCAS was identified as a potential factor. Boeing agreed to the FAA’s timeline for implementing the software update.”

The FAA spokesman said “There was no regulatory requirement in this instance to use average pilots,” adding that current testing procedures require them. He said Mr. Lawrence “is well-versed in certification standards” even though he wasn’t involved early on with the MAX, and “all meetings and conversations in the immediate aftermath of the Lion Air accident were based on the best information available at the time.”

From the moment that Lion Air Flight 610 nosedived into the Java Sea with 189 people onboard, FAA officials were playing catch-up. The first shock, said people familiar with the details, came when FAA engineers in the Seattle region discovered Boeing hadn’t submitted revised safety assessments detailing the latest changes to MCAS, the automated flight-control system at the heart of the problem.

Agency engineers struggled to understand MCAS’s intricacies. As government and Boeing experts met to discuss responses, Boeing engineers seemed to realize they had underestimated MCAS’s ability to push the plane’s nose down forcefully and repeatedly, and overestimated how pilots would respond, said a person familiar with the FAA’s response.

Days after the Lion Air crash, Rep. Peter DeFazio (D., Ore.), chairman of the House Transportation and Infrastructure Committee, met

Ali Bahrami,

the FAA’s top safety official, for a closed-door briefing. The FAA contingent sought to persuade the lawmaker, an FAA critic, that the crash exposed operational rather than design problems, Mr. DeFazio said in an interview. “We were assured this was one-off” as an event, he said.

The FAA prepared its standard postcrash risk analysis, called Transport Airplane Risk Assessment Methodology, which calculated the potential extent of the problem.

It received a flood of information about pilot and maintenance missteps, and other data from the scene that suggested there were systemic repair and inspection shortcomings at Lion Air. As neither FAA engineers nor most of their bosses fully grasped the intricacies of MCAS, they felt comfortable delving into issues many of them understood better, including how pilots reacted to emergencies with the system, said some of the people briefed on the deliberations. FAA managers worked with U.S. airlines to scour MAX flight records over the more than two years. They didn’t find any event revealing an MCAS malfunction similar to the one in the Lion Air dive.

Flight simulators

Early on, regulators emphasized the results of Boeing’s flight-simulator sessions. Boeing, which conducted tests in an advanced flight simulator near Seattle, told regulators its analysis showed pilots generally starting to respond within several seconds, an acceptable result, despite a cacophony of blaring cockpit alerts and warning lights, said some of the people briefed on the results.

The crews in those simulated emergencies primarily were Boeing pilots far more experienced than typical airline pilots, said the people. In the crush of fast-moving developments, the FAA seemingly didn’t focus on the makeup of the simulator crews, said the people briefed on the results.

With initial information at hand, the FAA focused on an emergency directive. In the dry technical language used for routine maintenance inspections, the FAA reminded pilots to adhere to longstanding procedures when encountering similar emergencies. The directive didn’t fully spell out the harrowing details of an MCAS malfunction, specifically how the system pushed down the plane’s nose over pilot attempts to override it.

The issue of whether to mention MCAS was debated at lower levels of the FAA, making its way to the agency’s acting head,

Daniel Elwell,

who endorsed the decision not to identify the system, said a person with knowledge of the deliberations. Boeing later spelled out MCAS details in a Nov. 10 bulletin to airlines.

The FAA spokesman said MCAS wasn’t mentioned due to concerns that it could have interfered with Indonesian investigators by implying a probable cause of the accident.

FAA officials embraced Boeing’s reassuring message portraying the aircraft’s design as essentially sound and indicating that a relatively swift fix would alleviate concerns. Boeing and agency leaders continued to reiterate the notion the Lion Air crash was primarily due to pilot errors and maintenance lapses, said current and former industry officials, federal regulators and outside safety experts. After accident investigators issued a preliminary report, Boeing issued a statement pointing to potential pilot and maintenance lapses in the document.

Mr. Lawrence, the agency’s new certification chief, relied on recommendations from lower-level staffers who tended to support many of Boeing’s positions, agency officials and safety experts said. He spent minimal time reviewing the directive, one of them said, before the FAA released it about a week after the Lion Air crash.

Around the same time, more than 20 officials in the FAA’s Seattle-area certification office gathered to hash out responses. They discussed accident assessments, the pilots’ apparent failure to disable MCAS and signs of maintenance lapses. The participants agreed the directive was a good step while officials learned more about the MCAS.

Before the gathering’s conclusion, FAA experts realized the emergency reminder to pilots “isn’t going to be enough” and they needed to prod Boeing to devise a long-term software solution, the person close to the deliberations said. Boeing, which had independently come to the same conclusion, got to work.

At FAA headquarters, Mr. Lawrence and his lieutenants felt comfortable they had alleviated the short-term danger. Agency personnel understood the emergency directive wouldn’t eliminate the risk of another accident, according to an FAA official involved in the deliberations, but they believed that it would reduce the danger enough that the planes could safely keep flying while Boeing came up with a permanent fix.

One European pilot-union leader recalls getting into a shouting match with a Boeing official about the extensive use of test pilots in simulators after the Lion Air crash. During a break in a meeting to update the region’s aviators and MAX operators about the status of the software fix, the union official maintained that test pilots in simulators couldn’t be viewed as reliable stand-ins for airline pilots flying planes. The Boeing technical expert, he said, maintained just as strongly that the industry had followed that course for decades, leading to recent record low accident rates.

‘Don’t call it a fix’

Boeing encouraged FAA personnel to call the planned software fix an “enhancement.” Senior agency officials publicly and privately echoed the same line, and dissected crew errors rather than Boeing’s design shortcomings.

At the FAA’s working levels, though, there was some frustration at Boeing’s stance. At one meeting between FAA officials and Boeing personnel not long after the Lion Air crash, the person familiar with the agency’s response said, officials were surprised at Boeing’s emphasis on language.

“Don’t call it a fix,” this person recalls a Boeing official saying. “These are enhancements.”

“Call it whatever you want,” an FAA official snapped, saying the most pressing issue was shoring up MCAS, not quibbling over how to describe it.

By mid-February, the FAA’s decision to forgo a more forceful response appeared to be paying off. Agency officials were weeks from approving a new version of the MAX software, said the FAA official close to the deliberations.

Then Ethiopian Flight 302 plowed into a field near Addis Ababa, killing all 157 on board. The FAA began conducting a fresh risk analysis, seeking to quantify the likelihood of a third such emergency.

Amid signs the MCAS system was central to the second crash, governments around the world ordered fleets grounded. The FAA maintained publicly that the specifics were too unclear to merit such decisive action. Two days after the crash, FAA engineers and managers in the Seattle area concluded immediate grounding was the only option, said people familiar with the details.

“Why is this airplane still flying?” one FAA engineer asked at a meeting, said a person familiar with the gathering. The recommendation was waiting for Mr. Lawrence when he walked into the office March 13, three days after the crash.

Canadian regulators handed over refined satellite-tracking charts that revealed similarities between the two MAX crashes. On March 13, the FAA pulled the trigger on a grounding order.

The FAA’s decision came after every major aviation country already had deemed the MAX unsafe. “We have said all along that…we are a data-driven organization,” the FAA’s Mr. Elwell told reporters. “The data coalesced today and we made the call.”

Write to Andy Pasztor at andy.pasztor@wsj.com and Andrew Tangel at Andrew.Tangel@wsj.com