In 2016, as Boeing raced to get the 737 MAX certified by the Federal Aviation Administration (FAA), a senior company engineer whose job was to act on behalf of the FAA balked at Boeing management demands for less stringent testing of the fire-suppression system around the jet’s new LEAP engines.
That June he convened a meeting of all the certification engineers in his unit, who collectively agreed with his assessment. Management initially rejected their position, and only after another senior engineer from outside the MAX program intervened did managers finally agree to beef up the testing to a level the engineer could accept, according to two people familiar with the matter.
But his insistence on a higher level of safety scrutiny cost Boeing time and money.
Less than a month after his peers had backed him, Boeing abruptly removed him from the program even before conducting the testing he’d advocated.
The episode underscores what The Seattle Times found after a review of documents and interviews with more than a dozen current and former Boeing engineers who have been involved in airplane certification in recent years, including on the 737 MAX: Many engineers, employed by Boeing while officially designated to be the FAA’s eyes and ears, faced heavy pressure from Boeing managers to limit safety analysis and testing so the company could meet its schedule and keep down costs.
That pressure increased when the FAA stopped dealing directly with those designated employees — called “Authorized Representatives” or ARs — and let Boeing managers determine what was presented to the regulatory agency.
“The ARs have nobody supporting them. Nobody has their backs,” said one former Authorized Representative who worked on the 737 MAX and who provided details of the engineer’s removal from the program. “The system is absolutely broken.”
FAA-designated oversight engineers are supposed to enjoy protection from management pressure. Removing one who proves a stickler for safety regulations will inevitably produce a chilling effect on others who see the consequences of being too rigid about safety concerns, said John Goglia, former member of the National Transportation Safety Board (NTSB).
“It negates the whole system,” said Goglia. “The FAA should have come down on that really hard.”
Following two deadly 737 MAX crashes off the coast of Indonesia and in Ethiopia that killed 346 people, and the subsequent grounding of the airplane worldwide, the certification of the jet has come under intense scrutiny, including a slew of lawsuits, congressional hearings and a criminal investigation.
None of the people interviewed were involved in certifying the Maneuvering Characteristics Augmentation System, the flight-control software implicated in the two crashes. But one area of scrutiny is sure to be the delegated system under which Boeing employees, paid by the company but acting as FAA designees, did the detailed certification work. It may slow down plans by the FAA and Boeing for a future certification regimen that would further erode the FAA’s oversight.
Boeing, in a statement responding to Seattle Times questions, said that FAA procedures, including regular, FAA-mandated training, “ensure Boeing employees serving in this capacity act independently on behalf of the FAA.”
It added that “there are processes in place to carefully evaluate any concerns regarding the AR’s ability to act independently.” The company declined to comment on individual cases cited in this story.
Yet as the FAA has increasingly delegated certification tasks to Boeing itself, it’s also made changes to the reporting structure that leave its designees to fend for themselves inside the company.
While a few former employees involved in certifications said they handled the pressure as a regular part of the job, others described the work environment as hostile, focused on achieving FAA approval within schedule and cost targets. Some of those workers spoke on condition of anonymity to protect professional relationships or for fear of retribution.
This echoes the findings of a Seattle Times investigation in March of what happened on the FAA side of the MAX certification. Within the FAA, its safety engineers worked under constant pressure from their managers to delegate more and more work to Boeing itself, and to speedily approve the safety assessments the Boeing designees came up with.
On the Boeing side of that process, the removal of the senior engineer acting as an FAA Authorized Rep was an extreme example that highlights the broader negative impact of two changes: The FAA no longer appoints its own ARs, instead leaving that to Boeing. And these designees now rarely interact with the FAA directly, according to former Boeing ARs interviewed by The Times.
They said these changes have stripped them of protection and given managers more opportunity to push for shortcuts.
In a statement, the FAA said it oversees the Boeing certification system “to ensure procedures are followed.” The agency also said it has “received no whistleblower complaints or any other reports … alleging pressure to speed up 737 MAX certification.”
Boeing managers are supposed to undergo “undue pressure” training to ensure that they aren’t crossing boundaries with the FAA’s representatives. And some ARs said that, despite some tensions, their managers were respectful of the role.
Fred Stong, an AR who worked on electrical systems at Boeing, said his experience was that everyone works through differences to reach common ground. He said he was always assertive in his role and didn’t face any problems.
“At no time in my career would anybody dare to pressure me,” Stong said.
Yet the former AR on the MAX said managers overseeing that jet’s certification were “extremely aggressive” about anything that affected the program cost or schedule.
“Managers were pounding on the ARs to get what the company needs in terms of reduced testing,” he said. “If it costs the company time and money, they’d pound on you to change the test design.”
The radical shift from DERs to ARs
Before 2004, those Boeing technical employees who worked safety on behalf of the FAA were called “Designated Engineering Representatives,” or DERs. Though paid by Boeing, they were appointed by the FAA and reported directly to their technical counterparts at the FAA.
What changed since 2004 is that safety engineers, now called Authorized Representatives, are appointed by and report to Boeing managers.
The opaque bureaucratic name for this new structure — Organization Designation Authorization (ODA) — masks the significant change: Instead of having individual Boeing employees authorized as FAA reps, Boeing now has an entire organization within the company so authorized. The individual FAA Authorized Reps — Boeing engineers — report up the chain to their Boeing managers, not the FAA.
A veteran aviation-safety engineer who over the decades worked for long stints as a DER at Boeing and later as a Boeing AR on a variety of projects including the MAX, said there’s “nothing inherently wrong” with the FAA delegating safety certification — provided it retains oversight.
This consultant asked for anonymity to protect his current livelihood doing certification work for multiple aviation companies.
Working as a DER with smaller aviation companies that don’t have an ODA designation, it’s his job to ensure their products comply with all safety regulations. On those projects, he can consult directly with FAA technical people if any problem arises or if he needs advice on what exactly may be required to demonstrate compliance.
“If I need guidance, I call my FAA adviser,” he said. “I’m overseen directly by the FAA. And every year there is a pretty robust audit of my activity before the FAA will delegate me for the following year.”
His experience working as an AR at Boeing and other companies was quite different.
“Under ODA, the FAA no longer manages the people making the compliance findings,” he said. “They never even talk to them.”
And because Boeing appoints the representatives, he said, accountability is severely curtailed. “If the company is happy with their decisions, obviously, they’ll be kept in their jobs.”
Under the old system, “we knew we’d lose our livelihood if we didn’t maintain the integrity of making decisions the way the FAA would do it,” the consultant said. “That check is no longer there.”
The FAA, contradicting the accounts of the former Authorized Representatives interviewed, said that ARs “have frequent interaction and access to FAA personnel to communicate concerns directly.”
However, a copy of one version of the Boeing ODA manual, an internal document labeled proprietary but obtained by The Times, told ARs with concerns about their workload or pressure from managers to first report them to the AR administrator, who is a higher level Boeing manager.
The manual also states that AR performance will be judged in part by whether they are “completing their duties in a timely and cooperative manner.”
It’s a Boeing manager who determines if an individual representative’s performance is sufficiently cooperative, as evidenced by the experience of Mike Levenson, who has worked as an FAA representative at several companies and served in an AR role at Boeing for five years until 2013.
He said that while there’s always a pressure on FAA representatives in an aviation world full of deadlines and cost considerations, most industry managers are able to find a balance to ensure the ARs have independence. He said he didn’t find that to be the case at Boeing.
Levenson worked on certifying aircraft repairs at Boeing and said he certified more than 500 in his time there, though he did not work on the MAX. On three occasions, he declined to certify repairs. The first two times, Levenson said, he got called into a supervisor’s office.
On the third occasion, in June 2013, a proposed repair clearly did not meet all FAA requirements, he said. After he declined to approve it, Levenson said, his manager “told me to go back and find compliance or my contract would not be extended.”
Levenson agreed to do additional work and consulted with other colleagues but still couldn’t certify the repair’s compliance.
“When I reported this to my manager, I was told this was unacceptable and was summarily dismissed the following day,” Levenson said.
The FAA said it has no record of Levenson filing a complaint. Levenson said he talked to the agency but didn’t file anything formally.
MAX inherits 737 legacy issues
The removal from the MAX program of the FAA’s Authorized Rep who insisted upon stricter engine fire-suppression testing is briefly summarized in a February 2017 report obtained by The Seattle Times. The report does not name the engineer, and the two people who described what happened spoke on condition that he not be named.
In the report, prepared by the three unions that represent FAA technical staff, the incident was listed among a long series of problematic decisions made under the current system of delegating FAA certification and oversight to Boeing.
The engineer removed from the program had more than two decades of experience at Boeing doing certification work on behalf of the FAA. Managers transferred him to Boeing’s “Central Engineering” unit, with no particular job description, and appointed as his replacement on the MAX team an engineer with relatively little experience in certification.
Four additional concerns specific to the 737 MAX were listed in the 2017 report. All were related to certification of legacy systems inherited from the earliest 737 models that were found by FAA technical staff to be noncompliant with the latest safety regulations.
These involved a lack of redundancy in the rudder cables; a too-high surface temperature allowed in the fuel tank; insufficient fireproofing around the plane’s auxiliary power unit in the tail; and using high-power wiring to connect to a switch inside the fuel tank.
All these issues were flagged by safety engineers working at the FAA as requiring fixes before the MAX could be certified.
The MAX won certification anyway after managers on the Boeing side of certification insisted that these were non-issues and managers on the FAA side agreed to let it move ahead with these shortcomings unaddressed.
All were waved through by the Boeing ODA and signed off by FAA management, according to the union report.
The FAA, in its statement to The Times, said it ordered the findings to be investigated at the time but said it wouldn’t address the specific items “because of the ongoing investigations into the aircraft’s certification.”
A better oversight structure
When Acting FAA Administrator Dan Elwell appeared before the U.S. Senate subcommittee on aviation in March, he was asked if the FAA could pull the oversight of air safety back in-house instead of delegating it to Boeing and other manufacturers.
“It would require roughly 10,000 more employees and another $1.8 billion for our certification office,” Elwell told the senators.
But that’s assuming the FAA would end delegation of oversight completely and take back all the certification work for a new airplane. That’s impractical, not only for the lack of resources, but also because all the leading-edge technological expertise needed is concentrated inside Boeing and its suppliers.
Many of the FAA’s safety engineers formerly worked for Boeing. But when they leave industry to work for the government, after a few years they inevitably lose touch with the latest innovations.
As the former NTSB member Goglia puts it: “You can’t stay on the pointy end of the arrow and work for the government.”
The former Boeing Authorized Rep who described the current system as “broken” agrees.
“It’s impossible for someone sitting at a desk at the FAA to keep up with the technology,” he said. “Once you step out, it will bypass you really fast.”
Still, he said, there’s no need to contemplate a wholesale removal of delegation from industry. Instead, he said, what’s needed is to have the same Boeing engineers continue to do the safety evaluations, but to have them chosen by and reporting to the FAA — in other words, to revert to the old DER structure of oversight.
The former AR said that worked well because the FAA “was able to see into the design process from the beginning and have direct input as it was developed.”
“I’m not asking for the FAA to add 10,000 engineers,” he said. “Keep the same ARs as today. Just change who they report to, who is overseeing them. That doesn’t mean transferring the work to the FAA.”
John Cox, chief executive of Safety Operating Systems and formerly the top safety official for the Air Line Pilots Association, said that following the accidents and questions raised about how the errant flight control system on the MAX was certified, “there probably needs to be a review of the ODA system.”
“The (older) DER approach worked extremely effectively,” Cox said. “If engineers are working on behalf of the FAA, they should have a direct technical liaison with the FAA.”
And Goglia, the former NTSB member, said the AR system, with these engineers appointed by and reporting to Boeing, may need to be adjusted.
“I like the older system better than Boeing, or any manufacturer, having that kind of control,” Goglia said.
Moving toward complete self-certification
Yet before the MAX crashes, the FAA was heading in exactly the opposite direction: toward more delegation of oversight, with FAA participation reduced to a bare minimum.
A 2012 report to the FAA by a committee co-chaired by a Boeing representative and the FAA’s top aviation safety official, Ali Bahrami, recommended increased delegation of oversight to industry, working toward a “future state” beyond ODA with another deliberately obscure bureaucratic name: Certified Design Organization, or CDO.
If Boeing were to achieve CDO status, its employees could certify their own designs. Employees doing the certification work would not be designees technically working on behalf of the FAA, just Boeing engineers working for Boeing.
This would be true self-certification, but has not yet been implemented.
Levenson said such a shift would increase safety risks for the industry.
“It’s a horrible idea,” Levenson said. “There’s not enough oversight as it is now. That would remove almost all oversight.”
The former AR on the MAX who provided details of the engineer’s removal said he spoke to The Seattle Times because he hopes for action to reverse the industry’s direction.
He said the two crashes that claimed so many lives in Indonesia and Ethiopia starkly emphasize the need to force the FAA to go back to a DER-style structure, where those working at Boeing on behalf of the FAA are directly overseen by agency technical experts.
“Unfortunately, in our industry, the pendulum swings when people die,” he said. “Let those people’s deaths mean something.”
Seattle Times researcher Miyoko Wolf contributed to this story.
The opinions expressed in reader comments are those of the author only and do not reflect the opinions of The Seattle Times.