Boeing 737 MAX groundings

• March 2016, The General Manager of Boeing’s 737 MAX program, and the former Chief Project Engineer on the 737 MAX program, both approved a redesign of MCAS to increase its authority to move the aircraft’s stabilizer at low speed, in order to address “stall characteristics” requirements necessary for FAA certification. Just hours after the approval for MCAS’s redesign was granted, Boeing sought, and the FAA approved, the removal of references to MCAS from Boeing’s FCOM. The FAA officials who authorized this request remained unaware of the redesign of MCAS until after the crash of the Lion Air flight.[6]

• January 10, The Operational Evaluation Report of the National Civil Aviation Agency of Brazil (ANAC) mentions the MCAS.[7] The FAA had approved Boeing's request to remove MCAS from differences tables and QRH;[8][9] The Operational Evaluation Report prepared by Transport Canada contained the same table as ANAC's, except the reference to MCAS.[7]
• October 29, a 737 MAX 8 operating Lion Air Flight 610 crashed after take-off from Jakarta, killing all 189 on board. Boeing started redesigning the MCAS system right after the accident.[10]
• November 6, Boeing issued an Operations Manual Bulletin (OMB),[11] describing a MAX-specific feature of the pitch trim system, warning that with "erroneous AoA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds" which "can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after" and instructed pilots to counteract it by running the Runaway stabilizer and manual trim procedure.[12] The background introduction of the bulletin states: "This bulletin directs flight crews to existing procedures to address this condition", and reminds operators to use the "existing procedures in the Runaway Stabilizer NNC [Non-Normal Conditions]" when the MAX reacts to a false stall detection.[13] This was Boeing's first public announcement about MCAS, albeit not by name.[14]
• November 7, the FAA issued an Emergency airworthiness directive to owners and operators,[15] requiring revising the aircraft flight manual (AFM) "to provide the flight crew with runaway horizontal stabilizer trim procedures" when "repeated nose-down trim commands" are caused by "an erroneously high single AoA sensor",[12] reinforcing the Boeing bulletin.[16] The FAA directive warned that the problem was an "unsafe condition" that could result in "impact with terrain".[17] The directive informs pilots of a new function specific to MAX models : "Note: The 737-8/-9 uses a Flight Control Computer command of pitch trim to improve longitudinal handling characteristics. In the event of erroneous Angle of Attack (AOA) input, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds." The FAA had removed reference to MCAS from its draft EAD.[18]
• November 10, Boeing referred publicly for the first time to the MCAS by name in a Multi Operator Message to operators.[19][20][21] The MCAS control law, a few lines of software code in the FCC, could autonomously command nosedives, when even a single sensor failure resulted in bad data; MCAS was omitted from aircraft manuals and training,[22] therefore flight crews had no knowledge of its existence or functioning until Boeing published a bulletin on November 6.
• November 27, the Allied Pilots Association of American Airlines had a meeting with Boeing to express concerns with the MCAS effectiveness, and was unnerved by the airframer's responses. Union president Daniel Carey later said, "The huge error of omission is that Boeing failed to disclose the existence of MCAS to the pilot community. The final fatal mistake was, therefore, the absence of robust pilot training in the event that the MCAS failed".[23] The Boeing officials acknowledged, that they were considering some changes, for example preventing MCAS’s repetitive activation to ensure that it only triggers once.[24]
• December 3, the FAA Seattle Certification Office reviewed an unpublished quantitative risk assessment analysis of the MAX, prepared using the "Transport Aircraft Risk Assessment Methodology” (TARAM). The U.S. House Committee on Transportation and Infrastructure made the report public just over a year later, on December 11, 2019. In the committee's words, the report concluded that "if left uncorrected, the MCAS design flaw in the 737 MAX could result in as many as 15 future fatal crashes over the life of the fleet”, predicting 2900 deaths over 30 years.[25]
• December 17, in a presentation to the FAA, Boeing deflected blame and continued to assert that appropriate crew action would save the aircraft.[26]

• March 10, another 737 MAX 8 operating Ethiopian Airlines Flight 302 crashed shortly after take-off from Addis Ababa airport, killing all 157 on board, due to a similar faulty MCAS, initiating a worldwide flight ban for the aircraft, starting with China.
• March 13, the U.S. FAA was among the last to order the grounding of the 737 MAX, after claiming there was no reason: China had the most aircraft in service, 96, followed by the U.S. with 72, Canada with 39 and India with 21. The FAA issued an Emergency Order of Prohibition grounding Boeing 737 MAX airplanes, followed by a CANIC.[27]
• March 20, EASA and Transport Canada indicated that they would conduct their own reviews of Boeing's proposed software update.[28]
• March 27, Boeing unveiled a software update to avoid MCAS errors, already developed and tested it in-flight, to be certified.
• April 5, Boeing announced it was cutting 737 production by almost a fifth, to 42 aircraft monthly, anticipating a prolonged grounding, and had formed an internal design review committee.
• May 13, Republican Congressman Sam Graves at the House Aviation subcommittee hearing, blamed the 737 MAX crashes on poor training of the Indonesian and Ethiopian pilots; he stated that "pilots trained in the U.S. would have been successful" in handling the emergencies on both jets.[29][30]
• June 18, IAG signed a letter of intent for 200 737 MAXs at the Paris air show, followed by Turkish SunExpress and Air Astana later in the year.
• June 26, flight tests for the FAA uncovered a data processing issue affecting the pilots' ability to perform the "runaway stabiliser" procedure to respond to MCAS errors.
• October 30, Boeing CEO Dennis Muilenburg testified before U.S. Congress committees, defending Boeing's safety culture and denying knowledge of internal messages in which Boeing's former chief technical pilot said he had unknowingly lied to regulators, and voiced its concerns on MCAS.
• November 22, Boeing unveiled the first 737 MAX 10 flight-test aircraft.[22]
• November 26, the FAA revoked Boeing's Organization Designation Authorization to issue airworthiness certificates for individual MAX airplanes.[31]
• December 17, Boeing confirmed the suspension of 737 MAX production from January 2020.
• December 23, Dennis Muilenburg resigned, to be replaced by board chairman David Calhoun.[22]

• January 7, Boeing recommended "simulator training in addition to computer based training".[32]
• January 9, Boeing released previous messages in which it claimed no flight simulator time was needed for pilots, and distanced itself from emails mocking airlines and the FAA, and criticising the 737 MAX design.
• January 13, David Calhoun became CEO, pledging to improve Boeing's commitment to safety and transparency, and estimating the return to service in mid-2020.
• January 21, Boeing estimated the ungrounding could begin in mid-2020.[22]
• May 27, Boeing resumed production of the MAX at a "very gradual pace".[33]
• June 28 to July 1, the FAA conducted flight tests with a view to recertification of the 737 MAX.[34]
• September 16, the U.S. House of Representatives releases its concluding report, blaming Boeing and the FAA for lapses in the design, construction and certification.[35]
• September 30, a Boeing 737 MAX test aircraft was flown by FAA administrator Stephen Dickson.[36]
• October 16, Patrick Ky, the executive director of the European Union Aviation Safety Agency, claimed that the updated 737 Max reached the level of safety "high enough" for EASA.[37]
• November 18, the FAA issued a CANIC, subject to mandatory updates on each individual aircraft[lower-alpha 1].[38] Other regulators are expected to follow.[3][39]
• December 9, Brazilian low-cost carrier Gol Transportes Aéreos was the first airline to resume passenger service.[40]
• December 29, American Airlines is the First US airline to resume commercial operations.[41]

• January 7, Boeing settled to pay over $2.5 billion after being charged with fraud over the company's hiding of information from safety regulators: a criminal monetary penalty of $243.6 million, $1.77 billion of damages to airline customers, and a $500 million crash-victim beneficiaries fund.[42][43]
• January 18, Transport Canada authorized the MAX to resume flights in Canadian airspace.[44] Canadian operators must modify the aircraft to enable pilots to disable the stick shaker when it is erroneously activated, if they are certain that they understand the underlying cause.[45]
• January 27, EASA cleared the MAX to resume service in Europe, subject to additional restrictions similar to those mandated by Transport Canada.[46] Certain approaches requiring precision navigation are however not yet approved as EASA is awaiting data from Boeing as to the aircraft's ability to maintain the required performance in the event of sensor failures.[47]

PK-LQP, the aircraft involved in the crash of Flight 610

Preliminary investigations revealed serious flight control problems that traumatized passengers and crew on the aircraft's previous flight, as well as signs of angle-of-attack (AoA) sensor and other instrument failures on that and previous flights, tied to a design flaw involving the Maneuvering Characteristics Augmentation System (MCAS) of the 737 MAX series. The aircraft maintenance records indicated that the AoA Sensor was just replaced before the accident flight.[55] The report tentatively attributed the accident to the erroneous angle-of-attack (AoA) data and automatic nose-down trim commanded by MCAS.[56][57]

The NTSC final report, published on October 23, 2019 was prepared with assistance from the U.S. NTSB. NTSC's investigator Nurcahyo Utomo identified nine factors to the accident, saying:

"The nine factors are the root problem; they cannot be separated. Not one is contributing more than the other. Unlike NTSB reports that identify the primary cause of accidents and then list contributing issues determined to be less significant, Indonesia is following a convention used by many foreign regulators of listing causal factors without ranking them".[58][59]

The final report has been shared with families of Lion Air Flight 610, then published on October 25, 2019.[60][61][62][63]

ET-AVJ, the Ethiopian Airlines aircraft that crashed as Flight 302

The initial reports for Flight 302 found that the pilots struggled to control the airplane in a manner similar to the Lion Air flight 610 crash.[64] On March 13, 2019, the FAA announced that evidence from the crash site and satellite data on Flight 302 suggested that it might have suffered from the same problem as Lion Air Flight 610 in that the jackscrew controlling the pitch of the horizontal stabilizer of the crashed Flight 302, was found to be set in the full "nose down" position, similar to Lion Air Flight 610.[65] This further implicated MCAS as contributory to the crash.[66][67][68]

Ethiopian Airlines spokesman Biniyam Demssie said that the procedures for disabling MCAS had just been incorporated into pilot training. "All the pilots flying the MAX received the training after the Indonesia crash," he said. "There was a directive by Boeing, so they took that training."[69] Despite following the procedure, the pilots could not recover.[70]

The Ethiopian Civil Aviation Authority (ECAA) is leading investigations for Flight 302. The United States Federal Aviation Administration will also assist in the investigation.[71] Both flight recorders (voice and data) were recovered from the crash site on March 11, 2019.[72] The French aviation accident investigation agency BEA announced that it would analyze the flight recorders from the flight.[73] BEA received the flight recorders on March 14, 2019.[74]

On March 17, 2019, Dagmawit Moges, Ethiopia's transport minister, announced that the black box had been found and downloaded, and that the preliminary data retrieved from the flight data recorder show a "clear similarity" with those of Lion Air Flight 610 which crashed off Indonesia.[75][76] Due to this finding, some experts in Indonesia suggested that the NTSC should cooperate with Flight 302's investigation team.[77] Later on the evening, the NTSC offered assistance to Flight 302's investigation team, stating that the committee and the Indonesian Transportation Ministry would send investigators and representatives from the government to assist with the investigation of the crash.[78]

The Ethiopian Civil Aviation Authority published an interim report on March 9, 2020, one day before the March 10 anniversary of the crash.[79] Investigators have tentatively concluded that the crash was caused by the aircraft's design.[80][81]

The vertical airspeeds of the Boeing 737 MAX 8s involved in the JT 610 and ET 302 crashes

On November 6, 2018, four days before it identified MCAS by name, Boeing published a supplementary service bulletin prompted by the first crash. The bulletin describes warnings triggered by erroneous AoA data, and referred pilots to a "non-normal runaway trim" procedure as resolution, specifying a narrow window of a few seconds before the system would reactivate and pitch the nose down again.[82] The FAA issued an emergency airworthiness directive, 2018-23-51, on November 7, 2018 requiring the bulletin's inclusion in the flight manuals, and that pilots immediately review the new information provided.[83][84] On March 11, FAA defended the aircraft against groundings citing these emergency procedures (Continued Airworthiness Notification to the International Community) for operators.

In December 2018, a month after the Lion Air accident, the FAA had conducted an internal safety risk analysis predicted fifteen more crashes with no repairs to MCAS, but that report was not revealed until the U.S. House hearing in December 2019. FAA's administrator, Stephen Dickson, who assumed the position during the accident investigations, said in retrospect that "the result was not satisfactory".

On September 26, 2019, the NTSB released the results of its review of potential lapses in the design and approval of the 737 MAX.[85][86]^(p1)[87] The NTSB report concludes that assumptions "that Boeing used in its functional hazard assessment of uncommanded MCAS function for the 737 MAX did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots' responses to the hazard". When Boeing induced a stabilizer trim input that simulated the stabilizer moving consistent with the MCAS function, "... the specific failure modes that could lead to unintended MCAS activation (such as an erroneous high AOA input to the MCAS) were not simulated as part of these functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not in the stabilizer trim safety assessment report reviewed by the NTSB."[86][88]

The NTSB questioned the long-held industry and FAA practice of assuming the nearly instantaneous responses of highly trained test pilots as opposed to pilots of all levels of experience to verify human factors in aircraft safety.[89] The NTSB expressed concerns that the process used to evaluate the original design needs improvement because that process is still in use to certify current and future aircraft and system designs. The FAA could for example randomly sample pools from the worldwide pilot community to get a more representative assessment of cockpit situations.[90]

ICAO regulations Annex 13, “Aircraft Accident and Incident Investigation”, defines which states may participate in investigations. For the two MAX accidents these are:[91]

1. Indonesia, for Lion Air Flight 610 as state of registration, state of occurrence and state of operator.
2. Ethiopia, for Ethiopian Airlines Flight 302, as state of registration, state of occurrence and state of operator.
3. The United States, as state of manufacturer and issuer of the type certificate.

The participating state or national transportation safety bureaus are the NTSB for the US and the NTSC for Indonesia. Australia and Singapore also offered technical assistance, shortly after the Lion Air accident, regarding data recovery from the new generation flight recorders (FDR). With the exception of Ethiopia, the officially recognised countries are members of the Joint Authorities Technical Review (JATR).