A breakdown in the nation’s regulatory system and poor communication from Boeing compromised the safety of the 737 Max jet before it crashed twice in five months and killed 346 people, according to a damning report released Friday.
Boeing did not adequately explain to federal regulators how a crucial new system on the plane worked, the report says. That system was found to have played a role in the accidents in Indonesia last October and Ethiopia in March.
The Federal Aviation Administration relied heavily on Boeing employees to vouch for the safety of the Max and lacked the ability to effectively analyze much of what Boeing did share about the new plane, according to the report by a multiagency task force. The system of delegation is now being scrutinized by lawmakers in the wake of the tragedies.
Boeing employees who worked on behalf of the F.A.A. faced “undue pressures” at times during the plane’s development because of “conflicting priorities,” according to the report.
“This report confirms our very worst fears about a broken system,” Senator Richard Blumenthal, Democrat of Connecticut, said in an interview. “To put the fox in charge of the henhouse never made any sense, and now we see the deeply tragic consequences.”
Hours after the report was released, Boeing’s board stripped the company’s chief executive, Dennis A. Muilenburg, of his chairman title. The move was the most direct response yet from a board that has resisted shaking up the management team before the Max is flying again, even as pressure mounted inside Boeing to hold someone accountable. The Max has been grounded for about seven months.
Removing Mr. Muilenburg from his seat as chairman will give the board more independence from management. The board elevated David L. Calhoun, the lead independent director, to serve as chairman. Mr. Calhoun said in a statement that “the board has full confidence in Dennis as C.E.O.”
Friday’s report, which was put together by representatives of the Federal Aviation Administration, NASA and nine international regulators, provided the first official detailed account of how federal regulators certified the Max. Lawmakers and federal investigators are still conducting their own inquiries into the design and approval of the jet.
The review scrutinized the F.A.A.’s certification of the Max’s flight control system, including the new automated system, MCAS, which played a role in both crashes.
The report found that while the F.A.A. had been made aware of MCAS, “the information and discussions about MCAS were so fragmented and were delivered to disconnected groups” that it “was difficult to recognize the impacts and implications of this system.”
The task force said it believed that if F.A.A. technical staff had been fully aware of the details of MCAS, the agency would probably have required additional scrutiny of the system that might have identified its flaws.
In each crash, pilots struggled as a single damaged sensor sent the plane into an irrecoverable nose-dive within minutes of takeoff. Regulators around the world grounded the Max after the second accident. Boeing is working on a software fix, and there is no timetable for when regulators will allow the aircraft to return to service.
The task force recommended that the F.A.A. review staffing levels at its Boeing office in Seattle and review the Boeing office that allows company employees to perform certification work.
The F.A.A.’s administrator, Steve Dickson, said in a statement that he would “review every recommendation and take appropriate action.”
“We welcome this scrutiny and are confident that our openness to these efforts will further bolster aviation safety worldwide,” he added.
In a statement, the Boeing spokesman Gordon Johndroe said, “Safety is a core value for everyone at Boeing.” The company, he added, “is committed to working with the F.A.A. in reviewing the recommendations and helping to continuously improve the process and approach used to validate and certify airplanes going forward.”
The Joint Authorities Technical Review, which produced the report, was led by Chris Hart, a former chairman of the National Transportation Safety Board, and included aviation regulators from Europe, China, Brazil and other countries. To conduct the review, Mr. Hart and his team were briefed by F.A.A. officials and Boeing executives, and they scrutinized extensive documentation on the certification of the Max.
A broad theme of the report is that the F.A.A. was too focused on the specifics of the new system and did not put sufficient effort into understanding its overall impact on the plane. In certification documents that Boeing submitted to the F.A.A., MCAS was not evaluated as “a complete and integrated function.”
The report also said Boeing had failed to inform the F.A.A. as the design of MCAS changed during the plane’s development. A New York Times investigation revealed that the system changed significantly during that process, making MCAS riskier and more powerful, and that key F.A.A. officials in charge of reviewing it were inexperienced or unaware of the overhaul.
The task force said the certification documents that Boeing had provided to the F.A.A. “were not updated during the certification program to reflect the changes” made to MCAS. It added that two critical documents that describe the potential dangers of a system like MCAS, the system safety assessment and the functional hazard assessment, “were not consistently updated.”
Boeing also failed to thoroughly stress-test the design of MCAS, according to the report, which found that “the design assumptions were not adequately reviewed, updated or validated.”
In addition, the report criticized Boeing for not adequately assessing the extra effort that pilots might have to make to deal with MCAS, and it noted that Boeing had removed mention of MCAS from a draft of the pilot’s manual. As a result of that decision, some key F.A.A. officials were not fully aware of MCAS and were “not in a position to adequately assess training needs,” the report found.
To address some of these shortcomings, the report recommends that the F.A.A. update the certification process to allow the agency to be more involved early on.
The Max was certified in 2017 as the latest version of the 737 family. Because it was based on a well-known design, the F.A.A. allowed it to undergo a less thorough certification process than if it were an entirely new plane.
“Some elements of the design and certification remain rooted in the original 1967 certification of the B737-100,” the review found. But while some modern safety tools have been incorporated into new versions of the 737, others were not included in the Max because they were deemed “impractical,” the review found.
Over all, the report found fault with the process for certifying a new plane based on an old design, saying it “lacks an adequate assessment of how proposed design changes integrate with existing systems.”
It recommended that the F.A.A. confirm that the Max is in fact compliant with regulations having to do with the plane’s flight guidance system, flight manual and stall demonstration.
Those recommendations, which could affect whether the plane is allowed back into service, have already been addressed by the F.A.A., according to a person familiar with the process. The effort to address those issues has contributed to the prolonged grounding of the Max.
In both of the flights that crashed, the pilots had a hard time identifying the cause of the problems and were unable to bring the planes under control.
The review found that the F.A.A. certification process had failed to adequately consider “pilot recognition time and pilot reaction time to failures.” In particular, the review suggested that the F.A.A. question Boeing’s assumption that pilots could react to a malfunction similar to the one caused by MCAS in just four seconds.
One source of the problems with the certification of the Max was the F.A.A. office in Seattle that oversees Boeing, according to the report. It found that the Boeing office had “limited experience and knowledge of key technical aspects” of the Max.
In the end, the F.A.A. was simply unable to effectively assess MCAS, the review found.
“The F.A.A. had inadequate awareness of the MCAS function,” which meant that the agency could not adequately assess Boeing’s certification of the system, the report found.