Both the Department of Justice and Transportation Department’s inspector general are investigating the FAA’s approval of the Boeing 737 Max and, in particular, the aircraft’s anti-stall system known as MCAS.

The FAA is supposed to ensure that Boeing aircraft are safe. Investigators want to know:

  • Are the FAA and Boeing too cozy?
  • Is the FAA’s oversight is too lax?
  • Is it true that the FAA didn’t actually certify the Max’s anti-stall system as safe but instead allowed Boeing to certify the system itself? Wouldn’t that be a conflict of interest?

Perhaps the real question is why these questions are being asked only now.

It was almost 10 years ago that the FAA abdicated its certification responsibilities and granted to Boeing the power to certify its own products. I questioned then whether that was in the best interests of safety.

Beginning August 31, the FAA will allow Boeing to self-certify its designs. The FAA will not even do the rubber stamping — Boeing employees will do that too. According to the Seattle Times, “the new system increases the authority of the in-house inspectors directly managed by Boeing, allowing them to review new designs, oversee testing to ensure the products meet all applicable standards, and sign off on certification.”

Then, in 2013, Boeing’s new 787s began to catch fire. The problem seemed to be Boeing’s new batteries. The NTSB investigated, and raised the same questions that I had a few years earlier. NTSB Chair Deborah Hersman hinted that maybe, just maybe, the FAA isn’t doing its job:

This is an issue when you have a regulator with limited resources. . .You can delegate some of the action, but you can’t delegate responsibility.”

No one seemed to listen. In fact, the FAA, for its part, began to allow manufacturers to certify even more of their own products. In fact, by 2017, the FAA outsourced 90% of all aircraft certification work to the manufacturers themselves.

The FAA is supposed to oversee aircraft manufacturers to ensure that the aircraft they produce are safe for the flying public. They can’t do that if they leave it to manufacturers to police themselves. Yet, that’s what they’ve done since 2009.

Is it any wonder that we’re where we are now?

Four years ago, the NTSB questioned whether manufactures like Boeing should be allowed to self-certify that their aircraft designs meet FAA requirements.  The NTSB suggested that “self-certification” may have contributed to the battery fires that were being experienced on Boeing’s 787s.  After all, it’s the FAA’s job to make an independent determination that an aircraft design is safe.  It makes little sense to pass that job to the manufacturer, who is hardly independent.

The FAA’s response was to delegate even more authority to manufacturers.  In fact, the GAO reports that 90% of all aircraft certification work is now outsourced to the manufacturers themselves. 

How is that working out?  Not surprisingly, not so well.  According to documents obtained by the Seattle Times,  through 2015, Boeing was fined $13 million to settle FAA proceedings arising from falsification of certification and repair work.  The Seattle Times noted that one Boeing mechanic told FAA investigators that he had been entering false data into aircraft inspection records for at least seven years.

Air traffic controllers fall asleep on the job.  At least they do occasionally. That came as big news in 2011, when two airliners landed at Washington’s Reagan National Airport without ATC help because the lone controller was snoozing. No injuries there, but in 2006 a Comair regional jet crashed while taking off in Kentucky, killing 49 of the 50 people on board.   The air traffic controller who cleared the plane for takeoff didn’t notice the plane was taking off from the wrong runway.  He had slept only two hours in the previous 24.   

The question then was whether the problem of sleeping or sleep-deprived controllers was an isolated one or instead a significant, pervasive risk to aviation safety. 

The FAA paid NASA $1.2 million to find out. The NASA study’s findings:  the schedules controllers work lead to chronic fatigue and pressure to fall asleep.  In fact, a third of the controllers in the study reported that fatigue was a “high” or “extreme” safety risk.  More alarming was that 6 out of 10 controllers report that they had fallen asleep or experienced a lapse in attention while driving to or from a midnight shift.  If sleepiness is making controllers unsafe to drive, it’s certainly making them unsafe to work.

The study’s conclusion was clear: 

Chronic fatigue may be considered to pose a significant risk to controller alertness, and hence to the safety of the ATC (air traffic control) system.

Perhaps most interesting is that, according to an Associated Press report, the FAA has kept the FAA’s report secret for three years.   Though completed in 2012, the study was released just this week. No explanation from the FAA as to why it has kept the study from the public for all this time.

A few hours ago, USA Today published a lengthy investigative report devoted to small aircraft crashes. The conclusion:  aviation manufacturers have long concealed the fact that their defectively designed products cause aircraft crashes and injures. And the investigating agencies, including the NTSB and FAA, let them get away with it.

The report covers many of the issues we’ve touched upon before on this blog, from defective carburetors, to defective pilot seats, to faulty ice-protection systems. The report also covered a subject we’ve covered on this blog extensively – post crash helicopter fires in otherwise survivable accidents:

One of the most gruesome and long-standing problems has caused scores of people to be burned alive or asphyxiated in fires that erupt after helicopter crashes. Such deaths are notorious because they can occur after minor crashes, hard landings and rollovers that themselves don’t kill or even injure helicopter occupants. The impact can rupture helicopter fuel tanks, sending fuel gushing out, where it ignites into a lethal inferno.

Using autopsy reports and crash records, USA TODAY identified 79 people killed and 28 injured since 1992 by helicopter fires following low-impact crashes. In 36 non-fatal crashes, fire destroyed or substantially damaged helicopters after minor incidents such as rollovers, crash reports show.

The report didn’t mention the most recent Robinson fire that killed the R44’s pilot at Birchwood Airport in Alaska just two weeks ago.

Pilot error?

I’ve been saying for years that many crashes that the NTSB attributes to "pilot error" simply aren’t. The USA Today report backs that up.  The report discussed the fatal crash of a single engine Piper following engine failure.  The NTSB chalked up the engine failure to pilot error.  But, as it turns out, the crash was caused by a defective carburetor float. The judge handling the case noted that the carburetor manufacturer had received more than 100 warranty claims for similar problems before the crash. Yet none of that product history made it into the NSTB report.

Ruling against Lycoming  [the engine manufacturer] and Precision [the carburetor manufacturer], Philadelphia Judge Matthew Carrafiello found evidence both might be culpable. Precision received more than 100 warranty claims concerning carburetor defects, the judge said, and Lycoming continued to use the carburetors even though it "knew of ongoing problems" with the carburetors "and of numerous plane crashes resulting from such problems.

None of that information was included in the NTSB investigation, which was aided by Lycoming and Precision and blamed Andy Bryan, the pilot, for "failure to abort the takeoff" and "failure to maintain adequate airspeed during takeoff."

According to the report, many of the crashes that the NTSB concludes are due to pilot error are actually due to defectively designed aircraft.

Federal accident investigators repeatedly overlooked defects and other dangers of private aviation as they blamed individual pilots for the overwhelming number of crashes of small airplanes and helicopters . . . The failure of crash investigators to find defective parts, dangerous aircraft designs, inadequate safety features and weak government oversight helped allow hidden hazards to persist for decades, killing or injuring thousands of pilots and passengers . . .

Manufacturers mislead the FAA

Part of the problem is that the NTSB does not travel to the site of many small airplane crashes, leaving the on-scene investigation to the FAA. Unfortunately, according to a former NTSB investigator, the FAA personnel don’t have the same investigative experience as the NTSB investigators and are easily duped by the manufacturers.

Many times what happens now is that when the accident occurs, the technical rep of the (manufacturing) company will call the NTSB and say we’ll be party (to the investigation), we’ll go out there and let you know what we see … the only people on scene would be perhaps an FAA guy and the field rep of the manufacturer," said Douglas Herlihy, a former NTSB investigator who now reconstructs crashes, often for plaintiffs in lawsuits against manufacturers.

"If you (the NTSB) are not there, you’ve got the representative from the company at the scene. His job is to skew the facts, to ignore the product difficulties and to remove the question of liability," Herlihy said.

The FAA allows Boeing to certify its own design work.  That means that, at least to some extent,  Boeing now regulates itself.  That never seemed like such a great idea to me.  Afte787 batteries - melted down (left) and undamaged (right)r all, isn’t it the FAA’s job to make an independent determination that an aircraft design is safe?  Does it make sense for the FAA to allow Boeing — or any manufacturer — to grant FAA certification to itself?

Now, the NTSB seems to agree.  In discussing whether the FAA’s "self-certification" policy played a role in Boeing’s 787 battery problems, NTSB Chair Deborah Hersman hinted that maybe the FAA isn’t doing its job:

This is an issue when you have a regulator with limited resources. . .You can delegate some of the action, but you can’t delegate responsibility.”

A regulator that allows a manufacturer to certify its own designs isn’t a regulator at all.  

American Airlines Flight 587 encountered wake turbulence. The pilot countered with rudder inputs. The rudder inputs were excessive, the tail assembly failed, and the aircraft crashed, killing 265 people.

The NTSB determined that the Airbus’ rudder controls are unduly sensitive and make it easy for a pilot to overstress the aircraft’s structure, causing a catastrophic failure.  Now, eleven years after that crash,the FAA has issued an Airworthiness Directive against the A300 Airbus to remedy what it considers to be a problem with the aircraft’s design. 

Originally, the FAA was going to require that all the A300’s be modified to limit the rudder pedals’ travel.  The FAA felt that such a modification would make it much more difficult for a pilot to overstress the aircraft. That modification would have cost about $200,000 per aircraft. But Airbus convinced the FAA to allow a cheaper fix.  So for about half of that cost, the FAA will allow the A300’s simply to be equipped with a warning light on the glareshield directly in front of each pilot and an associated "stop rudder inputs" aural warning.

A Warning is a Last Resort

Any engineer will tell you that when a hazard is discovered, the best option is to design out the hazard. If that can’t be done, then the hazard should be guarded against. If that isn’t feasible, the last resort is to warn against the hazard. That’s what’s known as the engineer’s “Safety Hierarchy.”

Here, there was a feasible way to change the design to eliminate the hazard – limit the travel Stress Performance Curveof the rudder pedals. Thus, a warning is the wrong way to go.

A Warning Is Not Always Appropriate.

Warnings work well in some situations. A warning system that alerts a pilot to low fuel is great. A warning system that alerts the pilot that some system is overheating is also useful. But warning systems that activate in emergency situations are often useless.

The problem is that under stressful situations, a pilot’s performance can degrade rapidly. The pilot is unable to comprehend a warning’s meaning in an emergency and respond appropriately. That’s what the BEA (Europe’s NTSB) concluded happened to Air France Flight  447. Confronted with an emergency, the crew could not comprehend and react to the Airbus’ aural warnings. As summed up by Paul Marks:

Despite a stall warning sounding continually, it was ignored and the pilot kept the plane’s nose pointing upward – while the plane was in fact plummeting toward the ocean. All the crew needed to do was push the nose down to regain lift – but they didn’t.

In the first minute after the autopilot disconnection, the failure of the attempt to understand the situation and the disruption of crew cooperation had a multiplying effect, inducing total loss of cognitive control of the situation," the BEA says.

The combination of the [Airbus] warning system ergonomics, and the conditions under which [Air France] pilots are trained and exposed to stalls during their professional and recurrent training, did not result in reasonably reliable expected behaviour patterns," the BEA adds with massive understatement.

Stress Performance Curve

Why would a trained crew essentially ignore the aircraft’s warning systems in an emergency? A little stress helps people focus, and they tend to perform better.  But after a point, stress makes it difficult, if not impossible, to think.  A Vietnam fighter pilot used to tell me: “The first thing that happens in an emergency is your IQ gauge goes to zero.” 

The Airbus’ rudder pedals can be feasibly redesigned to eliminate the hazard. That makes a warning system the wrong solution.

Why doesn’t the FAA do a better job of promoting aviation safety?

1. The FAA’s Inherent Conflict of Interest.  When the FAA was created, it was charged with bothFAA regulating aviation and promoting it. But most aviation regulations don’t promote aviation — they constrain it. The FAA’s inherent conflict of interest explains why the FAA so often ignores the NTSB’s aviation safety recommendations.

2. The Problem of the Captive Regulator.  Putting aside the inherent conflict of interest, the FAA is simply too close to the industry it regulates to do an effective job. This problem is not unique to aviation.   For example, the drug industry has tremendous influence over its regulating agency, the FDA.  We saw that play out most recently last year, when we learned that a number of the FDA committee members who voted against requiring stronger warnings on a drug’s label had economic ties with the drug’s manufacturer. In California, we learned that the Public Utilities Commission was too cozy with the gas utility it was supposed to regulate. It let the utility slide again and again until September 2010 when a gas explosion in San Bruno killed 8 and damaged or destroyed more than 40 homes.

3. Bureaucratic Incompetence.  Sometimes, it seems that bureaucratic incompetence is the simplest reason for the FAA’s failure to act in the face of a known ongoing hazard. What else explains the night vision goggle debacle?

Stephen Stock, an investigative reporter for NBC, talks about the hazards posed by night vision goggles improperly installed in much of the nation’s EMS helicopter fleet. I was happy to offer Stock my thoughts. The FAA refused to comment on camera.

Imagine how difficult it must be for Rand Foster to go to work each day.



In 2008, a safety inspector determined that nearly half of the nation’s EMS helicopter fleet–about 300 aircraft–have improperly installed night vision systems. As installed, the systems are a hazard to the air ambulance crews and the patients they carry. The inspector felt the aircraft should be grounded until they were fixed. The FAA initially agreed, but then changed its mind. Apparently, the FAA decided to look the other way because of the "negative publicity" a grounding would generate.

Pretty alarming.  Ultimately, the United States Office of Special Counsel became involved, taking the unusual step of writing to President Obama.

[The United States Office of Special Counsel] found a substantial likelihood that FAA officials and employees engaged in violation of law, rule or regulation, gross mismanagement and an abuse of authority, all of which contributed to a substantial and specific danger to public safety.

It’s been three years, but the White House has done very little.  So now the OSC has written the President again.

The OSC continues to be concerned about the improperly installed night vision goggle systems that plague the nation’s EMS helicopter fleet.  But it is also concerned about a litany of other whistleblower complaints against the FAA that the OSC has received, investigated and substantiated.  The complaints range from FAA personnel allowing Delta Airlines to perform improper maintenance to air traffic controllers sleeping on the job.  The FAA is aware of the complaints, but has done little about them.

One senses a bit of frustration in the Special Counsel’s latest letter:

This transmittal is the final chapter in OSC’s formal oversight process. . .additional enforcement action rests with Congress or the White House.  Given the recurring and serious nature of these concerns, I write with a strong recommendation that more rigorous oversight measures be put in place at DOT and FAA to ensure a higher standard for aviation safety. 

OSC Letter FAA 2012