The Federal Aviation Administration's November 2018 internal analysis, released during a House committee hearing Wednesday, projected that without the agency's intervention the MAX could have averaged one fatal crash about every two or three years. That amounts to a substantially greater safety risk than either Boeing or the agency indicated publicly at the time.
In the wake of the analysis, which came the month after the Lion Air crash in Indonesia, the FAA took steps to put short-term and permanent measures in place to address hazards.
Lawmakers challenged the agency and some of its decisions at Wednesday's hearing.
"Despite its own calculations, the FAA rolled the dice on the safety of the traveling public and let the 737 MAX continue to fly," said Rep. Peter DeFazio (D., Ore.), chairman of the House Transportation Committee.
The FAA's intervention didn't prevent a second fatal MAX crash, in Ethiopia in March, that led to the global grounding of the fleet and sparked an international controversy over the agency's safety oversight.
Mr. DeFazio said more than 500,000 documents gathered by his panel from the FAA and Boeing, combined with emails and interviews, have "uncovered a broken safety culture within" the company and the agency.
"The FAA failed to ask the right questions and failed to adequately question the answers that agency staff received from Boeing," he said. "Our investigation has revealed that many of the FAA's own technical experts and safety inspectors believe FAA's management often sides with Boeing rather than standing up for the safety of the public."
FAA chief Steve Dickson said at the hearing that he would review the procedures used to certify the MAX originally and left open the possibility of further enforcement actions holding Boeing accountable for inadequate information-sharing related to design decisions and for various production lapses.
"I reserve the right to take further action," Mr. Dickson said.
But, while acknowledging agency missteps, he defended FAA personnel. "The system is not broken," he told the panel.
An FAA spokesman said in advance of the hearing that the agency's analysis after the first crash provided information that was useful "in helping determine the mitigation action." The spokesman said such analyses tend to overstate risk in part because they take the most conservative approach.
A Boeing spokesman declined to comment.
The FAA analysis projected as many as 15 similar catastrophic accidents globally over the life of the MAX fleet -- spanning 30 to 45 years -- unless fixes were made to the automated flight-control system implicated in the October 2018 crash.
The analysis characterized the MAX, before changes to the system's software, as potentially more prone to crash than several earlier Boeing models, according to a Wall Street Journal review.
The projected crash total, according to the Journal's calculations, was roughly comparable to all fatal passenger accidents over the previous three decades -- from any cause -- involving Boeing's 757, 767, 777, 787 and latest 747 models. The MAX fleet was expected to eventually number nearly 5,000 jets world-wide; the other fleets together total slightly more than 3,800 aircraft.
The potential for 15 projected crashes "would be an unacceptable number in the modern aviation-safety world," said Alan Diehl, a retired FAA and Pentagon air-safety official, who hasn't had any involvement in the MAX crisis.
The FAA's analysis relied on technical and statistical principles widely used by the agency after airliner crashes or serious incidents, and it was only part of the process of deciding whether to let the MAX keep flying. The FAA also took into account such factors as pilots' emergency-reaction times and how quickly design changes could be implemented. Both industry and government safety experts have described the numerical risk assessment as a core element of the FAA's deliberations.
FAA leaders decided to permit the MAX to remain in service with two important safeguards, according to another agency document, from December 2018, interviews with FAA officials and information the agency recently provided to the House Transportation Committee.
The FAA document anticipated that within roughly seven months, Boeing would test and with the agency approval install revised software for MCAS, the suspect stall-prevention system that led to the Indonesia crash.
Meanwhile, the FAA said, airline crews world-wide should be briefed about the possibility of a similar MCAS misfire. If crews were aware of the risk and knew how to respond, the FAA determined it was acceptable to keep the planes in service until a permanent design change was in place.
After the first crash, the FAA shared with Boeing the report, which stated that the agency's analysis found the "risk is sufficiently low to allow continued growth of the fleet and operations until the changes to the system are retrofitted," according to a person close to the manufacturer.
The FAA and foreign regulators are now testing changes to the MAX's flight-control computers intended to eliminate design problems that led to the crashes. The planes aren't expected to return to service until the first quarter of next year.
Boeing said after the Lion Air crash that it and the FAA "both agreed, based on the results of their respective rigorous safety processes, that the initial action of reinforcing existing pilot procedures...and then the development and fielding of a software update, were the appropriate actions."
The assumptions by Boeing and the FAA fell apart in less than five months when a MAX operated by Ethiopian Airlines crashed as a result of an MCAS problem similar to the one that caused the Lion Air crash. The dual tragedies, which took 346 lives, have sparked the biggest corporate crisis in Boeing's modern history.
The November 2018 analysis is known as a Taram, which stands for Transport Airplane Risk Assessment Methodology, and some aspects of the Taram were reported by the Journal in July. The document was drafted during "an incredibly important period," Mr. DeFazio said in an interview before the hearing.
The MAX's safety record when it was grounded, after two years in service, amounted roughly to two catastrophic accidents for every one million flights, according to estimates by industry officials relying on unofficial data. By contrast, the 737 model that preceded the MAX has suffered one fatal crash for every 10 million flights, according to data from Boeing.
The 2018 global accident rate for all scheduled Western-built jetliners -- including those made by Europe's Airbus SE as well as regional passenger planes from Canadian, Brazilian and other manufacturers -- was one fatal crash per approximately three million flights.
After the hearing, Mr. DeFazio told reporters the FAA's analysis far exceeded the agency's safety threshold for a potential catastrophic accident.
Pressed on whether the FAA took sufficient action following the agency's internal risk analysis, Mr. Dickson said Wednesday that was "something that we need to look at very closely," adding the "result is not satisfactory."
Mr. Dickson said he didn't want to second-guess decisions made following the first accident, but that based on what he knows today he would have grounded the aircraft then.