Blind spots: How Canada’s reliance on U.S. aviation policy kept regulators from seeing the fatal flaws in Boeing’s 737 Max planes

Open this photo in gallery:

On Sunday, March 10, as word spread of a deadly plane crash near Addis Ababa, a disturbing picture began to emerge.

Ethiopian Airlines Flight 302 had plummeted to the ground just six minutes after takeoff. The aircraft hit with such force that it tore a crater 10 metres deep, with the plane nearing the speed of sound before impact. All 157 people onboard were killed, 18 of them Canadians.

It was a brand-new plane, a state-of-the-art Boeing 737 Max. Less than five months earlier, the same model had crashed off the coast of Indonesia under eerily similar circumstances, losing control shortly after takeoff. 189 people died. That aircraft was also new.

Nothing was conclusive, but governments around the world were already asking the critical question: Were these two tragic events related? New planes just don’t fall from the sky.

The 737 Max was a highly touted marvel of modern aviation innovation. It quickly became the fastest-selling aircraft in Boeing’s history because it allowed airlines to slash fuel costs by up to 20 per cent compared with previous versions of the plane. By early 2019 it was in heavy use all over the world with a fleet of 387 and growing, including in Canada, where Air Canada, WestJet and Sunwing Airlines flew 41 of them, with more on the way.

But the 737 Max had been airborne less than two years and already two had failed – catastrophically. Statistically, it was now one of the deadliest commercial airliners ever produced, with more casualties in its first 48 months than any other plane in history.

Open this photo in gallery:

In Ottawa, top officials at Transport Canada exchanged notes that Sunday afternoon through e-mail.

“Please follow the tragic news on the Boeing 737 Max crash in Ethiopia,” Transport Minister Marc Garneau wrote to his closest advisers in documents obtained by The Globe and Mail through the Access to Information Act. “I will need an update tomorrow morning.”

The Minister knew he would face questions about a link between this latest disaster and the one five months earlier in Indonesia. “That provoked much discussion as to whether we should ground the Canadian Max fleet,” he reminded his colleagues.

Within hours, governments around the world would soon begin grounding the 737 Max amid deepening questions about the plane. But in Ottawa, Mr. Garneau and other top officials inside Transport Canada deferred.

Canada’s instinct was to wait for signals from the United States before taking any action.

“My sense is that we are monitoring what Boeing and the NTSB will have to say before we make any decisions in Canada,” Mr. Garneau advised.

Historically speaking, it wasn’t that unusual. When it came to aviation oversight, that was how Canada did things. From crafting regulations to approving new aircraft, Ottawa worked hand-in-glove with the Federal Aviation Administration (FAA), the National Transportation Safety Board (NTSB) and by extension – whether Transport Canada acknowledged it or not – with Boeing itself.

It was a system built on “mutual confidence” and “trust,” according to regulatory documents outlining the bilateral arrangement, and it was designed for expediency and pragmatism, creating an aviation sector that operated almost seamlessly between the two neighbouring countries. And it was a system that, for decades, appeared to work.

Until suddenly it didn’t.

The 737 Max disasters have exposed a series of flaws in Canada’s oversight of the sector – blind spots built into the system that went unnoticed until now. From the moment the new plane was conceived at Boeing, Canada had already outsourced much of its regulatory oversight on the matter to the FAA which, in turn, abdicated disturbing amounts of that power to Boeing.

Thousands of pages of documents have emerged in recent months, from official investigations into the crashes to company e-mails and government briefings, that detail what went wrong with the 737 Max. Going over the trail of evidence now, it is possible to see where these blind spots exist for Canada, and why they matter.

Crucial information Canadian regulators needed in order to make a proper determination on the 737 Max – both before it was allowed to fly and after the disasters occurred – was never made available to Transport Canada under this abdication of authority. And in cases in which critical evidence was pro-actively shared with Canadian officials after the first crash, Transport Canada chose to sit on it, deciding instead to follow the lead of the FAA, and keep the plane flying.

By the time Mr. Garneau finally banned the 737 Max, almost four days after the second crash and conspicuously later than much of the world, Canada was one of the last countries still standing with the U.S.

In the aftermath of the 737 Max disasters, Boeing and the FAA have come under scrutiny. But the blind spots exposed by the tragedies are a reckoning for Transport Canada as well. In its endorsement of the deadly plane, the department relied too heavily on those organizations. And several of Transport Canada’s most important decisions – including whether to approve the plane and Mr. Garneau’s conspicuous refusal to ground it out of caution – were premised on bad information, questionable analysis or faulty advice.

“It’s like people talk about with a computer,” said Jim Hall, former chairman of the NTSB in Washington.

“Junk in, junk out.”

THE AGREEMENT

In the summer of 2011, Boeing was under pressure. Its main competitor, Europe’s Airbus, was building a better, more fuel-efficient version of the A320, the rival to Boeing’s best-selling commercial airliner, the 737.

The two single-aisle aircraft were the workhorses of the industry, but Airbus had pulled off an unexpected coup: The revamped A320neo burned about 15 per cent less fuel than its previous incarnation. That revelation made it an immediate hit among airlines, which count fuel costs as one of their greatest expenses.

In six months, Airbus racked up so many orders that the waitlist reached 1,000 planes. It was a spectacular success. The moment of crisis at Boeing came when American Airlines, its oldest customer, ordered 130 new A320s from Airbus, ending Boeing’s exclusivity with the world’s largest carrier.

Boeing had thought of redesigning the 737 for years, but hadn’t decided how. The first 737 was created in 1967, and every model since then was basically a derivative of that original design – the same plane, but with tweaks and updates. The advantage for airlines was that pilots already licenced to fly a 737 did not have to undergo expensive simulator training to be certified on a new plane.

Although Boeing toyed with creating a fuel-efficient airliner from scratch, when Airbus introduced the updated A320, Boeing knew it risked losing customers if it rolled out an entirely new concept. It had to keep training costs down.

If Boeing could make the new design a derivative of the most recent 737, known as the NG model, pilots would only need a short refresher course on a tablet about any updated features. So in August, 2011, the company’s board approved an update to the 737 – the plane’s 19th iteration since its inception.

The stakes were high. Even before it was built, Boeing promised airlines the new plane would not require extra training. To entice Southwest Airlines to place a large order, Boeing promised a $1-million refund for every plane if the eventual design forced pilots to undergo simulator work.

To ensure that didn’t happen, Boeing engineers had to make sure they didn’t run afoul of FAA regulation 21.101-1B, otherwise known as the Changed Product Rule.

According to the rule, changes significant enough to affect the way the whole aircraft operated required the plane to be recertified. But if the alterations were incremental and isolated, they could be grandfathered into the existing certificate. A key element of regulation 21.101-1B was whether the change had a cumulative effect on how the plane flew – that is, does one new part or design alter other areas of the aircraft’s operation?

This regulation had weaknesses though. In a 2001 circular that attempted to clarify the Changed Product Rule, the FAA acknowledged that aircraft designers tended to treat the rule subjectively, leading to “varying interpretations” of when a new certificate was required.

In clarifying the regulation, the FAA thought it had taken care of the problem. It hadn’t.

To boost fuel efficiency, Boeing had to install larger, heavier engines. There was just one hurdle: The original 737 was built for an era when the plane was boarded on the tarmac using a metal staircase. To make that process easier, the 737 was designed lower to the ground – which the airlines liked. The design quirk eventually became irrelevant when airports installed ramps at each gate, and was soon forgotten.

To fit larger engines onto the 737 body, though, Boeing had to alter the design and reposition them on the wing to ensure proper ground clearance. But since changes rarely happen in isolation, this affected how the plane flew, causing the 737 Max to pitch up – or lift its nose – in certain situations.

When a plane rises too sharply it risks aerodynamic stall, where the wings lack sufficient lift from the airflow because of their upturned angle. To counteract this, Boeing engineers wrote software into the plane’s computers to automatically nudge the nose of the plane down if a sensor determined the angle had grown too sharp. This would happen without the pilot needing to do anything, or even knowing how the system operated in the background. Boeing called this the Maneuvering Characteristics Augmentation System – or MCAS.

How Boeing’s MCAS system works

The Boeing 737 Max incorporates the Maneuvering

Characteristics Augmentation System (MCAS) – an

anti-stall feature introduced to compensate for the

heavier engines, which changed the aerodynamics

of the jet, tending to push the nose of the aircraft up

HOW MCAS WORKS

AOA sensor

Winglet aligns

itself with

airflow

Level flight: Normal angle of

attack (AOA) – angle at

which airflow hits aircraft

Aircraft trajectory

Air flow

CFM Leap-1B turbofan

Nose-up flight

A high AOA puts aircraft at risk

of stalling. MCAS is automatically

triggered, moving the horizontal

stabilizer trim counterclockwise,

which pushes the

jet’s nose down

Longitudinal

axis of aircraft

Angle

of attack

Aircraft

trajectory

Air flow

Measured angle of attack

System activates only when plane is being flown

manually, in flaps-up flight, and typically during

steep turns

the globe and mail, Source: graphic news

How Boeing’s MCAS system works

The Boeing 737 Max incorporates the Maneuvering

Characteristics Augmentation System (MCAS) – an

anti-stall feature introduced to compensate for the heavier

engines, which changed the aerodynamics of the jet,

tending to push the nose of the aircraft up

HOW MCAS WORKS

AOA sensor

Winglet aligns

itself with

airflow

Level flight: Normal angle of

attack (AOA) – angle at

which airflow hits aircraft

Aircraft trajectory

Air flow

CFM Leap-1B turbofan

Nose-up flight

A high AOA puts aircraft at risk

of stalling. MCAS is automatically

triggered, moving the horizontal

stabilizer trim counterclockwise,

which pushes the

jet’s nose down

Longitudinal

axis of aircraft

Angle

of attack

Aircraft

trajectory

Air flow

Measured angle of attack

System activates only when plane is being flown

manually, in flaps-up flight, and typically during

steep turns

the globe and mail, Source: graphic news

How Boeing’s MCAS system works

The Boeing 737 Max incorporates the Maneuvering Characteristics Augmentation

System (MCAS) – an anti-stall feature introduced to compensate for the heavier engines,

which changed the aerodynamics of the jet, tending to push the nose of the aircraft up

HOW MCAS WORKS

AOA sensor

Level flight: Normal angle of attack (AOA)

– angle at which airflow hits aircraft

Winglet aligns

itself with

airflow

Aircraft trajectory

Air flow

CFM Leap-1B turbofan

Nose-up flight

A high AOA puts aircraft at risk

of stalling. MCAS is automatically

triggered, moving the horizontal

stabilizer trim counterclockwise,

which pushes the

jet’s nose down

Longitudinal

axis of aircraft

Angle of attack

Aircraft

trajectory

Air flow

Measured angle of attack

System activates only when plane is being flown manually,

in flaps-up flight, and typically during steep turns

the globe and mail, Source: graphic news

The MCAS was a crucial engineering decision. As Indonesian investigators stated in their report on the first crash, “the MCAS was needed in order to make the [737 Max] handling characteristics so similar to the NG versions that no simulator training was needed.”

To avoid triggering the Changed Product Rule, Boeing played down the role of the software to the FAA, making it difficult to recognize the full implications of the MCAS.

To Boeing, it was just a simple software patch. On certification paperwork, Boeing gave the MCAS a hazard rating of “major.” Despite the name, this was one of the lowest classifications. It meant that an MCAS misfire was not likely to result in death or loss of the airplane. With this low rating, the use of backup sensors to prevent the MCAS from malfunctioning weren’t needed.

This was key. The MCAS relied on a single gauge on the left side of the plane known as an Angle of Attack sensor, a small vane that rotates during flight to align itself with the oncoming airflow. The amount of rotation tells the plane’s computer the angle of the wings and warns of a potential aerodynamic stall.

There are two such sensors on every plane, on each side of the cockpit. But Boeing didn’t see the software as critical to the overall operation of the plane, so it only connected the MCAS to the gauge on the left. It was a deadly mistake.

But how did this flaw slip past the FAA and other regulators, such as Transport Canada, who are supposed to oversee the airworthiness of the plane? The answer: delegation.

Frustrated by delays in getting its planes certified and fearing that it was losing ground to Airbus and other rivals, Boeing began arguing to U.S. lawmakers in the 2000s that the government should offload more of those responsibilities to Boeing’s own engineers.

“Boeing came in and made the argument that the government didn’t have the expertise or the resources, and that Congress needed to give them more and more authority,” Mr. Hall said.

The lobbying was effective. Lawmakers granted Boeing the right to choose its own engineers to certify new designs on behalf of the FAA, which would then review their determinations. It was a move toward self-regulation, and it was just the beginning. In a 2012 internal review, the FAA argued that, in order to increase efficiency, it would “maximize delegation to the greatest extent.”

But the process had an obvious weakness. On many of its designs, Boeing effectively controlled what the FAA saw. So when Boeing later decided to make the MCAS more aggressive, increasing its ability to push down the nose by 2.5 degrees each time the software kicked in, compared with the original nudge of 0.6 degrees, the manufacturer didn’t seek permission from the FAA. And when Boeing decided to remove any mention of the MCAS from 737 Max training manuals, it just did so.

The decision to increase the aggressiveness of the MCAS was fateful. The cumulative effects could be deadly: With the ability to push the plane’s nose down by 2.5 degrees each time it fired, as little as two MCAS activations without correction would be enough to put the aircraft in maximum nose-down condition, Indonesian investigators determined. At that point, the pilots would struggle to maintain control.

Open this photo in gallery:

But the FAA wasn’t the only agency evaluating the plane. Why didn’t other countries, such as Canada, discover the fatal flaw in the 737 Max? After all, Transport Canada needed to provide its own endorsement of the plane before it could fly here.

The answer lies in a 74-page document from November, 2016, which details a long-held agreement between Canada and the U.S. The document, an updated version of the pact, sets out an arrangement between Transport Canada’s Civil Aviation department (TCCA) and the FAA. The U.S. regulator certifies the plane first, then Canada verifies the work.

Essentially, Transport Canada checks the FAA’s math, looking at whatever analysis the FAA has done, but not scrutinizing the plane directly itself, unless it has a specific request or concern. It’s a system that’s been used in many countries for decades to expedite plane certifications and reduce work for regulators.

“The FAA and TCCA are committed to the elimination of duplication of work,” the 2016 agreement states. “When a finding is made by one Authority … that finding is given the same validity as if it were made by the other Authority.”

The arrangement never seemed to pose a problem. As the document states, the agreement is “based on the high degree of mutual confidence and trust between the FAA and TCCA.”

Under this verification process, Canada cleared the 737 Max to fly in 2017, based on the material provided by the FAA. When the Canadian regulator received a list of design changes provided by the FAA and Boeing engineers, there were a total of 71 items, which Transport Canada then reviewed before it endorsed the new design.

They included alterations to the landing gear, new switches on the cockpit control panel and updates to the plane’s anti-icing system, according to Transport Canada documents. None required any simulator training.

Of the 71 design changes, there was no mention of the MCAS. The software received no additional scrutiny. Transport Canada was even more blind to the technology than the FAA was.

THE CALCULATION

At the heart of the MCAS rests a flawed assumption.

Boeing assumed that any malfunction of the system would be handled in a matter of four seconds; one second for the pilot to recognize the problem, and three seconds to counteract it.

And in that short window of time, Boeing assumed, it wouldn’t be possible for the MCAS to have very much impact on the trajectory of the plane.

But this four-second assumption was wrongly derived from FAA guidance on pilot simulator training.

During simulator sessions, when pilots could expect to encounter specific challenges for educational purposes, they were told to delay their reaction by one second to account for the time it would take to recognize an unexpected problem in the air. They then had three more seconds to handle the challenge.

Boeing used that assumption in the 737 Max’s design. But as far as actual flying is concerned, this four-second rule has no basis in reality. A study by NASA in 2012 determined that pilot reaction times are, in fact, much longer.

The NASA researchers exposed 18 Boeing pilots to three different abnormal events, such as an aerodynamic stall, to see how they would react.

The crew encountered each situation during routine training, where they could expect the problem to emerge, and at a later time when the same challenge was delivered by surprise.

In situations where the pilots expected the abnormal event, reaction times were easily within the four-second parameter, averaging 1.33 seconds. But when the pilots were given no warning, their reaction times lagged, climbing as high as 19.4 seconds because they needed time to identify what the surprise problem actually was.

Some pilots “were simply puzzled by what they saw,” NASA said, causing a “mis-categorization of the situation.”

Those reactions suggested “a momentary state of confusion associated with the psychological state of surprise or startle.”

This is known as the Startle Effect, when pilots’ stress levels spike from an abnormal event or series of compounding events, hindering their ability to think clearly to address the situation.

It was precisely what happened on the morning of Oct. 29, 2018, when Indonesia’s Lion Air Flight 610, departed from Jakarta.

Less than three minutes into the flight, the plane dipped sharply without input from the pilots, dropping 600 feet in 10 seconds. A faulty Angle of Attack sensor on the left side was telling the plane’s computers that the aircraft was angled sharply upward, even though the right-side sensor indicated nothing unusual.

Using automatic controls, the pilots attempted to pull up, adjusting their horizontal stabilizers – the small wings at the back of the plane that project horizontally from the tail, which rotate to trim the plane up or down.

It didn’t work.

Within seconds, the pilots experienced a “stick shaker” alarm, where the controls vibrate loudly to warn the crew that the plane is rising at too sharp an angle, risking aerodynamic stall. Stick shakers are fairly rare; commercial pilots can go their whole careers without encountering one beyond the simulator. They are also unsettling, with the noise and vibration only compounding the confusion of the moment.

The more the pilots activated the stabilizers, the more the plane fought back. Unknown to them, the MCAS was trying to correct what it thought was a 21-degree upward angle, as indicated by the faulty sensor.

Although Boeing hadn’t detailed for pilots how the MCAS worked, it assumed they would respond to the situation by immediately executing the steps for a situation known as a “runaway stabilizer.” The procedure involved shutting off their electronic controls and, instead, trimming the plane using manual controls.

But in the chaos of the moment, with the stick shaker alarm and other alerts blaring, the pilots misdiagnosed the problem. And because the MCAS could force the plane downward by up to 2.5 degrees every time it kicked in, unless each misfire was countered immediately, the cumulative effect would add up to a veritable nosedive.

The pilots fought the MCAS more than 20 times, and each time the software forced the plane further toward the Earth. A few minutes later, Indonesia’s Lion Air Flight 610 plunged into the sea north of Jakarta, killing everyone aboard.

Open this photo in gallery:

As crash investigators later noted: “The aircraft flight manual and flight crew training did not include information about MCAS.”

Yet, the Lion Air disaster was a warning about the 737 Max that went unheeded.

The FAA issued an Emergency Airworthiness Directive – a notification to 737 Max operators that a deficiency had been found that created the potential for repeated “nose-down” commands, which could result in “possible impact with terrain” – and reminded airlines about the procedure for a “runaway stabilizer.”

But the announcement contained very little detail about the MCAS, and didn’t mention it by name.

While Boeing contemplated a software patch to fix the glitch, aviation regulators, including Transport Canada, instructed pilots flying the 737 Max to commit the steps for a runaway stabilizer to memory, should the plane suddenly pitch downward. Problem solved, they thought.

In order to execute that step properly, though, pilots had to quickly diagnose the situation. But as the 2012 NASA study showed, pilots don’t always respond exactly the way they are expected, or in the manner that they have memorized through rote learning, particularly in situations where the “startle factor” is heightened because of numerous alarms.

If pilots didn’t immediately see the problem for what it was, the MCAS would soon have the upper hand.

Which is what also happened five months later when Ethiopian Airlines Flight 302 departed from Addis Ababa.

Soon after takeoff, several of the plane’s instruments displayed conflicting readings between the pilot and the co-pilot, including the Angle of Attack sensor.

As they scrambled to find the cause of the problem, the cockpit lit up with flashing lights and automated alerts, including a stick shaker warning of an imminent stall. The plane dove. The pilots raced to pull up.

As the seconds ticked by, a loud alarm called a “clacker” signalled the plane was going too fast. The MCAS forced the nose down again, repeatedly. The plane’s automated voice system blared: “Don’t sink! Don’t sink!”

Four minutes into the flight, amid a cascading number of alerts, the pilots correctly diagnosed the problem – a faulty left Angle of Attack sensor, which had possibly been damaged by a bird strike and wrongly indicated the plane was rising at a 74.5-degree angle.

737 Max sensors diverge

in the Ethiopia crash

Shortly after takeoff, the left angle of

attack sensor that feeds data to the plane’s

anti-stall system (MCAS), began to diverge. The

faulty information led to multiple nose-down

incidents by the automated-control system.

Left sensor angle

Right sensor angle

+75˚

AOA sensors

begin to diverge

0˚

Takeoff

at 8:38 a.m.

local time

-75˚

8:37

a.m.

8:38

8:39

8:40

8:41

8:42

8:43

THE GLOBE AND MAIL, SOURCE: Ethiopia

Ministry of Transport Aircraft Accident

Investigation Bureau

737 Max sensors diverge

in the Ethiopia crash

Shortly after takeoff, the left angle of attack sen-

sor that feeds data to the plane’s anti-stall system (MCAS),

began to diverge. The faulty information led to multiple

nose-down incidents by the automated-control system.

Left sensor angle

Right sensor angle

+75˚

AOA sensors

begin to diverge

0˚

Takeoff

at 8:38 a.m.

local time

-75˚

8:37

a.m.

8:38

8:39

8:40

8:41

8:42

8:43

THE GLOBE AND MAIL, SOURCE: Ethiopia Ministry of

Transport Aircraft Accident Investigation Bureau

737 Max sensors diverge in the Ethiopia crash

Shortly after takeoff, the left angle of attack sensor that feeds data to the

plane’s anti-stall system (MCAS), began to diverge. The faulty information led to

multiple nose-down incidents by the automated-control system.

Left sensor angle

Right sensor angle

+75˚

AOA sensors

begin to diverge

0˚

Takeoff

at 8:38 a.m.

local time

-75˚

8:37

a.m.

8:38

8:39

8:40

8:41

8:42

8:43

JOHN SOPINSKI/THE GLOBE AND MAIL, SOURCE: Ethiopia Ministry of Transport

Aircraft Accident Investigation Bureau

The bad data was causing havoc for other instruments, which compounded the crisis. Immediately, the pilots began the emergency procedure recommended by Boeing – trimming the plane using their manual controls. But by then they had run out of time.

With the engines racing toward maximum power, the plane had become too difficult to handle with manual controls. When they switched the electronic trim back on, the MCAS took over, forcing the plane ever downward. For every degree the pilots forced the plane up, the MCAS responded by pushing it down by double that amount.

Before the plane hit the ground, Flight 302 went into a 40-degree nosedive. The impact shattered the aircraft, driving the shards of the fuselage more than nine metres into the ground.

After the two catastrophes, Boeing’s then-chief executive Dennis Muilenburg suggested the accidents were the result of pilot error. But at June hearings in Washington, retired pilot Chesley Sullenberger, who famously managed to land a hobbled A320 in the Hudson River in 2009, told lawmakers pilot failure wasn’t the problem.

Open this photo in gallery:

Mr. Sullenberger – often credited by his profession for one of the greatest examples of airmanship under duress – flew simulations of the two 737 Max disasters and struggled to control the plane each time.

“Even knowing what was going to happen, I could see how crews could have run out of time and altitude before they could have solved the problems," Mr. Sullenberger said.

Grounding a fleet is not an easy decision – removing an aircraft from service results in chaotic upheaval for the travelling public, huge financial losses for the manufacturer and operational uncertainty for the airlines. But internally, Boeing and the FAA were both aware there was a big problem with the 737 Max.

After the Indonesia crash, the FAA completed a statistical study of the 737 Max known as a Transport Aircraft Risk Assessment Methodology.

The methodology was a calculation: a way to quantify unsafe conditions after an aviation accident in order to predict the likelihood of the problem reoccurring.

The report, which the FAA did not make public, predicted that the Max would suffer 15 fatal crashes over its lifespan unless Boeing overhauled the MCAS. That equated to one fatal crash every two or three years.

It was a damning indictment of the plane. But rather than ground the 737 Max, the FAA sat on the information – with at least one known exception.

Three weeks after the first crash, the U.S. regulator shared that calculation with Transport Canada.

In response to questions from The Globe, the department acknowledged this month that it was privy to that calculation.

“Transport Canada discussed the FAA preliminary analysis results on November 22, 2018,” a spokesman for the department confirmed.

Yet, knowing those results, Transport Canada followed suit, adopting the same position as the FAA, and allowed the plane to continue flying. Travellers were never told of the risk.

THE CORRELATION

On March 11, the day after the second 737 Max disaster in Ethiopia, Mr. Garneau was given briefing notes by his advisers. Countries around the world were grounding the 737 Max out of concern for safety, and the number was only expected to increase. But Transport Canada wasn’t convinced.

Like most briefings to ministers, the eight-page document, obtained through Access to Information, had three categories of information. The first was a series of “Suggested Responses” Mr. Garneau was to give if asked in the House of Commons, or by journalists, why Canada wasn’t grounding the 737 Max.

The answer: “Given this is a United States aircraft, Transport Canada officials are actively working with Federal Aviation Administration counterparts to determine if any action is required,” the Minister was to say.

Another suggested response was to point out that the department would take appropriate action, “Should issues that may affect the safety of Canadian travellers be identified.”

The second category of responses, “If Pressed.” contained additional lines at the ready, should the Minister be challenged with follow-up questions. “Transport Canada is aware that some countries have grounded the Boeing 737 Max,” he was to say, adding that the department was monitoring actions being taken both in Ethiopia and by the FAA.

The third category, intended for Mr. Garneau’s own use, listed off important background information: It said Canada was “Working with the FAA” and “assessing what, if any, additional safety action is required.”

It added: “Only a few Canadian air operating crew have raised questions and concerns about flying in the [737 Max] aircraft,” suggesting the problem was, perhaps, not as pressing.

When Mr. Garneau spoke to reporters later that day, he said it would be “premature” to ground the plane, adding he would “without hesitation” fly aboard the 737 Max.

But in its steadfast endorsement of the plane, it was startling how much Transport Canada didn’t know about the 737 Max. In private, Boeing’s own engineers had expressed fears about the aircraft for months, warnings that never made their way up through the U.S. regulatory system.

“Frankly, right now all my internal warning bells are going off,” Ed Pierson, a senior manager at Boeing’s factory in Renton, Wash., said in a 2018 e-mail to his boss, the head of the 737 program. “For the first time in my life, I’m sorry to say that I’m hesitant about putting my family on a Boeing airplane.”

But on Tuesday, March 12, even as Mr. Muilenburg called U.S. President Donald Trump to assure him the 737 Max was not a safety concern, much of the world was moving to ban it. Canada and the U.S. were among the few prominent outliers, and Mr. Garneau said he would “not jump to conclusions.”

These comments appeared to upset some Canadians, who sent a barrage of e-mails to the Minister’s office, begging him to ground the fleet.

More than 360 pages of e-mails, obtained through Access to Information, show varying degrees of anger, fear and bewilderment as to why Canada was not grounding the plane. If anything, the files help explain the anxiety felt by the travelling public in that moment.

“How many more people need to die before you take this seriously enough,” one Canadian wrote to Mr. Garneau. Under privacy laws, names of the people were redacted.

“I urge you to ground these planes,” wrote another. “I sincerely hope that we are not following the U.S. and protecting Boeing.”

Open this photo in gallery:

Dozens of people said they feared flying on a 737 Max.

“If in the next few days you find out there is something wrong with these planes, how do you explain why you didn’t ground them and let Canadians be at risk?”

Several asked what Transport Canada knew that other countries did not:

“I just wanted to know what additional information [Mr. Garneau] has that is making us so confident of the safety of this aircraft?"

“The rest of the world can’t all be wrong,” wrote another.

So what information were dozens of countries around the world potentially using to inform their decision to ground the plane? This was no secret: It came from Stockholm-based FlightRadar24 and other companies like it.

FlightRadar tracks planes around the world, using a network of 21,000 receivers placed all over the planet. The boxes, which are slightly bigger than a smartphone, are known as Automatic Dependent Surveillance-Broadcast (ADS-B) receivers. They collect data from planes as they pass overhead, communicating with antennae on the plane’s fuselage, which make it possible to track the location, speed, altitude and flight mannerisms of the aircraft.

Most of FlightRadar’s receivers are operated by the company, although many are voluntarily installed on rooftops all over the globe by airplane fanatics eager to help build out the network. During the busiest times of the year, as many as 20,000 aircraft feed data into this system at one time.

“We publish the data publicly and make it available to anyone to view and review as they see fit. And it’s available to any authoritative body or investigative body that wishes to make use of it,” said Ian Petchenik, one of FlightRadar’s directors. “We process it on our site within five seconds of receipt.”

When Ethiopian Airlines Flight 302 crashed in March, FlightRadar’s data was immediately parsed all over the world, along with similar ADS-B trackers such as FlightAware. It showed an eerily similar pattern to the Indonesia crash data five months earlier.

Although FlightRadar only captured the first few minutes of the Ethiopian Airlines flight before the plane flew beyond range of its receivers in that area, the data showed a distinctive up-and-down pattern unlike any normal commercial airliner flightpath. At least three sudden dips in altitude were recorded, suggesting the MCAS had repeatedly kicked in.

To some countries, this was enough to show a strong correlation and was cause for serious concern. But Transport Canada waited.

Open this photo in gallery:

When Canada eventually grounded the 737 Max on Wednesday, March 13 – three days and 10 hours after the second crash, and amid growing anger from Canadians – Mr. Garneau said it was because new information had emerged “suggesting a possible, although unproven, similarity” between the two flightpaths.

That data came from a U.S.-based company called Aireon, which is part-owned by Canada’s air-traffic control system, Nav Canada. Aireon also collects ADS-B data from planes, but uses a network of 66 satellites to gather the feed from above, instead of receivers on the ground.

Transport Canada’s use of the Aireon data raised several questions.

Jessie Hillenbrand, a spokeswoman for Aireon, told The Globe that Canadian officials didn’t request information on the crash until the night of Tuesday, March 12, nearly three days after the Ethiopian plane went down. Furthermore, Canada didn’t ask for the data until after FAA moved first. The U.S. regulator requested it Monday, March 11, and had the information a full day before Transport Canada conducted its own analysis.

And despite Mr. Garneau’s assertion that new information had emerged, this was not necessarily the case. FlightRadar and Aireon may use different methods, but the data they collect isn’t materially different.

“It’s not the same kind of data – it is the same data,” Mr. Petchenik said.

In this case, Transport Canada’s blind spot was because of its own actions.

Responding to questions from The Globe last week, Transport Canada said it “does not hesitate to take action – including on a precautionary basis – when safety issues are identified.”

But in refusing to ground the 737 Max immediately after the second crash, Transport Canada ignored one set of crucial data and waited days to examine the other.

“If this happens again, I don’t know that I’d wait for the data,” said Mr. Hall, the former head of the NTSB in Washington, who spent his career overseeing crash investigations.

“The data is 346 dead people. That should be the data [Transport Canada] is concerned about.”

A RECKONING

The 737 Max now has the worst record of any widely used commercial airliner, based on a minimum of 500,000 flights.

With 3.08 deadly crashes per one million flights, its fatality rate is nearly double the next passenger plane on the list, the Dutch-made Fokker F28, which is no longer produced, and five times worse than early 737 models.

top 10 aviation fatality rates

Fatal crash rates per million flights by type

(for aircraft models with at least 500,000 flights*)

Aircraft

Fatality rates

Boeing 737

MAX 7/8/9/10

3.08

1.62

Fokker F28**

Airbus A310**

1.35

Boeing 747-100/200/

300/SP**

1.02

Boeing DC10/MD10**

0.64

0.62

Boeing 737-100/200**

Airbus A300**

0.61

Boeing DC9**

0.58

Boeing 727**

0.5

Lockheed L1011**

0.47

737 family vs. A320 FAMILY

Boeing 737 (all models)

0.23

Boeing 737

MAX 7/8/9/10

3.08

Boeing 737-100/200**

0.62

Boeing 737-300/

400/500**

0.14

Boeing 737-600/700/

800/900

0.06

Airbus A320 family***

0.08

*Concorde had a fatality rate of 11.36 but only 90,000 flights

**Out of production

***A318/319/320/321

JOHN SOPINSKI/THE GLOBE AND MAIL

SOURCE: airsafe.com

top 10 aviation fatality rates

Fatal crash rates per million flights by type

(for aircraft models with at least 500,000 flights*)

Aircraft

Fatality rates

No. flights

Boeing 737 MAX

7/8/9/10

3.08

0.65M

1.62

9.53M

Fokker F28**

Airbus A310**

1.35

4.74M

Boeing 747-100/200/

300/SP**

12.98M

1.02

Boeing DC10/MD10**

0.64

9.30M

0.62

Boeing 737-100/200**

58.29M

Airbus A300**

0.61

6.51M

Boeing DC9**

0.58

62.59M

Boeing 727**

0.5

76.61M

5.40M

Lockheed L1011**

0.47

737 family vs. A320 FAMILY

238.84M

Boeing 737 (all models)

0.23

Boeing 737

MAX 7/8/9/10

0.65M

3.08

58.29M

Boeing 737-100/200**

0.62

Boeing 737-300/

400/500**

79.60M

0.14

Boeing 737-600/700/

800/900

100.3M

0.06

119M

Airbus A320 family***

0.08

*Concorde had a fatality rate of 11.36 but only 90,000 flights

**Out of production

***A318/319/320/321

JOHN SOPINSKI/THE GLOBE AND MAIL, SOURCE: airsafe.com

top 10 aviation fatality rates

Fatal crash rates per million flights by type (for aircraft models with at least 500,000 flights*)

Aircraft

Fatality rates

No. flights

3.08

0.65M

Boeing 737 MAX 7/8/9/10

1.62

9.53M

Fokker F28**

Airbus A310**

1.35

4.74M

12.98M

Boeing 747-100/200/300/SP**

1.02

Boeing DC10/MD10**

0.64

9.30M

0.62

Boeing 737-100/200**

58.29M

Airbus A300**

0.61

6.51M

Boeing DC9**

0.58

62.59M

Boeing 727**

0.5

76.61M

5.40M

Lockheed L1011**

0.47

737 family vs. A320 FAMILY

238.84M

Boeing 737 (all models)

0.23

0.65M

Boeing 737 MAX 7/8/9/10

3.08

58.29M

Boeing 737-100/200**

0.62

79.60M

Boeing 737-300/400/500**

0.14

100.3M

Boeing 737-600/700/800/900

0.06

119M

Airbus A320 family***

0.08

*Concorde had a fatality rate of 11.36 but only 90,000 flights

**Out of production

***A318/319/320/321

JOHN SOPINSKI/THE GLOBE AND MAIL, SOURCE: airsafe.com

But the numbers themselves tell only part of the story behind the 737 Max’s fatal flaws.

In the final moments of Lion Air Flight 610, the cockpit voice recorder picked up a distinctive sound: that of pages turning, presumably as pilots searched for guidance on what to do.

Of course, the information they needed wasn’t there.

In early 2017, a Boeing official working on the development of the 737 Max ordered it removed.

“Delete MCAS,” Boeing’s chief 737 technical pilot Mark Forkner told the FAA in a January, 2017, e-mail instructing the regulator to remove the system from training materials.

The fact that the FAA didn’t know enough about the MCAS, and Boeing was able to keep key aspects of it hidden, is now a reckoning for the U.S. aviation system. The blind spots that left Canada exposed, standing by the FAA in its endorsement of the plane, are too.

For decades, the FAA was the “north star” of aviation regulation, Mr. Hall said. But a steady abdication of power to Boeing has diminished its oversight, and countries such as Canada may be placing too much faith in a regulator that has fundamentally changed, he said.

“People in the past have built their aviation systems around the FAA, because it has been a world leader,” Mr. Hall said. “All that has changed … they gambled all that away.”

Only two large commercial fleets have been grounded in the past decade – both of them Boeing planes. The first was in 2013, when the highly touted 787 Dreamliner experienced problems with its lithium-ion batteries, which caught fire during flight.

That four-month grounding and the continuing ban of the 737 Max have something troubling in common: They are the only new designs Boeing has attempted since it convinced the FAA to delegate more authority over certifications to the company’s own engineers.

“Since the regulatory change, the only two launches that Boeing has had have been disasters,” Mr. Hall said.

For countries such as Canada, which rely so heavily on the U.S. system, the delegation problem may be the most critical blind spot of all, deserving as much scrutiny as the crashes themselves.

Some signs of pushback are starting to emerge. In late November, a Transport Canada official working on a 10-country joint review of the 737 Max sent an e-mail to colleagues at the nine other aviation authorities questioning whether the plane should ever be allowed to fly again without an overhaul.

“I did some thinking the last few days,” wrote Jim Marko, manager of aircraft integration and safety assessment for Transport Canada. “How to get some confidence back to all of us that we as Authorities can sleep at night when that day comes when the Max returns to service.”

“MCAS introduced nasty behaviours that have to be supressed. … Are we all smart enough to think that we have wrapped a net around anything that can go wrong from hereon in?”

“The only way I see moving forward at this point,” he wrote, “is that the MCAS has to go.”

All those early denials from Canada and the U.S., insisting there was nothing wrong with the 737 Max seem to have gone away.

At Senate hearings this fall, Mr. Muilenburg said he now regrets not grounding the plane after the first disaster.

“If we knew everything back then that we know now, we would have made a different decision,” the former Boeing CEO said. Mr. Muilenburg was fired this past week.

Such hindsight is of no comfort to Paul Njoroge. The father from Brampton, Ont. lost his wife, three children, and mother-in-law in the Ethiopian crash. They were some of the 18 Canadians killed on that flight.

“My life has no meaning. It is difficult for me to think of anything else but the horror they must have felt,” Mr. Njoroge said.

“I cannot get it out of my mind.”