    [House Hearing, 116 Congress]
    [From the U.S. Government Publishing Office]

             STATUS OF THE BOEING 737 MAX: STAKEHOLDER PERSPECTIVES

    =======================================================================

                                    (116-22)

                                    HEARING

                                   BEFORE THE

                                SUBCOMMITTEE ON
                                    AVIATION

                                     OF THE

                                  COMMITTEE ON
                       TRANSPORTATION AND INFRASTRUCTURE
                            HOUSE OF REPRESENTATIVES

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 JUNE 19, 2019

                                   __________

                           Printed for the use of the
                 Committee on Transportation and Infrastructure

     [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

         Available online at: https://www.govinfo.gov/committee/house-
         transportation?path=/browsecommittee/chamber/house/committee/
                                 transportation

                               ______

                  U.S. GOVERNMENT PUBLISHING OFFICE

    37-467 PDF             WASHINGTON : 2019

                 COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE

                        PETER A. DeFAZIO, Oregon, Chair

    ELEANOR HOLMES NORTON,               SAM GRAVES, Missouri
      District of Columbia               DON YOUNG, Alaska
    EDDIE BERNICE JOHNSON, Texas         ERIC A. ``RICK'' CRAWFORD,
    ELIJAH E. CUMMINGS, Maryland         Arkansas
    RICK LARSEN, Washington              BOB GIBBS, Ohio
    GRACE F. NAPOLITANO, California      DANIEL WEBSTER, Florida
    DANIEL LIPINSKI, Illinois            THOMAS MASSIE, Kentucky
    STEVE COHEN, Tennessee               MARK MEADOWS, North Carolina
    ALBIO SIRES, New Jersey              SCOTT PERRY, Pennsylvania
    JOHN GARAMENDI, California           RODNEY DAVIS, Illinois
    HENRY C. ``HANK'' JOHNSON, Jr.,      ROB WOODALL, Georgia
    Georgia                              JOHN KATKO, New York
    ANDRE CARSON, Indiana                BRIAN BABIN, Texas
    DINA TITUS, Nevada                   GARRET GRAVES, Louisiana
    SEAN PATRICK MALONEY, New York       DAVID ROUZER, North Carolina
    JARED HUFFMAN, California            MIKE BOST, Illinois
    JULIA BROWNLEY, California           RANDY K. WEBER, Sr., Texas
    FREDERICA S. WILSON, Florida         DOUG LaMALFA, California
    DONALD M. PAYNE, Jr., New Jersey     BRUCE WESTERMAN, Arkansas
    ALAN S. LOWENTHAL, California        LLOYD SMUCKER, Pennsylvania
    MARK DeSAULNIER, California          PAUL MITCHELL, Michigan
    STACEY E. PLASKETT, Virgin Islands   BRIAN J. MAST, Florida
    STEPHEN F. LYNCH, Massachusetts      MIKE GALLAGHER, Wisconsin
    SALUD O. CARBAJAL, California, Vice  GARY J. PALMER, Alabama
    Chair                                BRIAN K. FITZPATRICK, Pennsylvania
    ANTHONY G. BROWN, Maryland           JENNIFFER GONZALEZ-COLON,
    ADRIANO ESPAILLAT, New York            Puerto Rico
    TOM MALINOWSKI, New Jersey           TROY BALDERSON, Ohio
    GREG STANTON, Arizona                ROSS SPANO, Florida
    DEBBIE MUCARSEL-POWELL, Florida      PETE STAUBER, Minnesota
    LIZZIE FLETCHER, Texas               CAROL D. MILLER, West Virginia
    COLIN Z. ALLRED, Texas               GREG PENCE, Indiana
    SHARICE DAVIDS, Kansas
    ABBY FINKENAUER, Iowa
    JESUS G. ``CHUY'' GARCIA, Illinois
    ANTONIO DELGADO, New York
    CHRIS PAPPAS, New Hampshire
    ANGIE CRAIG, Minnesota
    HARLEY ROUDA, California

                                      (ii)

                            Subcommittee on Aviation

                         RICK LARSEN, Washington, Chair

    ANDRE CARSON, Indiana                GARRET GRAVES, Louisiana
    STACEY E. PLASKETT, Virgin Islands   DON YOUNG, Alaska
    STEPHEN F. LYNCH, Massachusetts      DANIEL WEBSTER, Florida
    ELEANOR HOLMES NORTON,               THOMAS MASSIE, Kentucky
      District of Columbia               SCOTT PERRY, Pennsylvania
    DANIEL LIPINSKI, Illinois            ROB WOODALL, Georgia
    STEVE COHEN, Tennessee               JOHN KATKO, New York
    HENRY C. ``HANK'' JOHNSON, Jr.,      DAVID ROUZER, North Carolina
    Georgia                              LLOYD SMUCKER, Pennsylvania
    DINA TITUS, Nevada                   PAUL MITCHELL, Michigan
    JULIA BROWNLEY, California           BRIAN J. MAST, Florida
    ANTHONY G. BROWN, Maryland           MIKE GALLAGHER, Wisconsin
    GREG STANTON, Arizona                BRIAN K. FITZPATRICK, Pennsylvania
    COLIN Z. ALLRED, Texas               TROY BALDERSON, Ohio
    JESUS G. ``CHUY'' GARCIA, Illinois   ROSS SPANO, Florida
    EDDIE BERNICE JOHNSON, Texas         PETE STAUBER, Minnesota
    SEAN PATRICK MALONEY, New York       SAM GRAVES, Missouri (Ex Officio)
    DONALD M. PAYNE, Jr., New Jersey
    SHARICE DAVIDS, Kansas, Vice Chair
    ANGIE CRAIG, Minnesota
    GRACE F. NAPOLITANO, California
    SALUD O. CARBAJAL, California
    PETER A. DeFAZIO, Oregon (Ex
    Officio)

                                     (iii)

                                    CONTENTS

                                                                       Page

    Summary of Subject Matter........................................   vii

                       STATEMENTS OF MEMBERS OF CONGRESS

    Hon. Rick Larsen, a Representative in Congress from the State of
      Washington, and Chair, Subcommittee on Aviation, opening
      statement......................................................     1
    Hon. Garret Graves, a Representative in Congress from the State
      of Louisiana, and Ranking Member, Subcommittee on Aviation:

        Opening statement............................................     3
        Prepared statement...........................................     5
    Hon. Peter A. DeFazio, a Representative in Congress from the
      State of Oregon, and Chair, Committee on Transportation and
      Infrastructure, opening statement..............................     7
    Hon. Sam Graves, a Representative in Congress from the State of
      Missouri, and Ranking Member, Committee on Transportation and
      Infrastructure:

        Opening statement............................................     9
        Prepared statement...........................................    11

                                   WITNESSES

    Sharon Pinkerton, Senior Vice President, Legislative and
      Regulatory Policy, Airlines for America:

        Oral statement...............................................    12
        Prepared statement...........................................    14
    Captain Daniel Carey, President, Allied Pilots Association:

        Oral statement...............................................    18
        Prepared statement...........................................    19
    Captain Chesley B. ``Sully'' Sullenberger III, Pilot, US Airways
      (Retired):

        Oral statement...............................................    21
        Prepared statement...........................................    22
    Sara Nelson, International President, Association of Flight
      Attendants--CWA, AFL-CIO:

        Oral statement...............................................    26
        Prepared statement...........................................    27
    Hon. J. Randolph Babbitt, Former Administrator, Federal Aviation
      Administration:

        Oral statement...............................................    34
        Prepared statement...........................................    36

                           SUBMISSIONS FOR THE RECORD

    Letter from Nadia Milleron and Michael Stumo, Submitted for the
      Record by Hon. Larsen..........................................     6
    Statement of Lori L. Bassani, National President, Association of
      Professional Flight Attendants, Submitted for the Record by
      Hon. Larsen....................................................     6
    Prepared Statement of Paul Hudson, President, FlyersRights.org,
      Submitted for the Record by Hon. Larsen........................    73
    Photos of 89 of the 157 Victims of the Ethiopian Airlines Flight
      302 Crash, Submitted for the Record by Hon. Larsen.............    74

                                    APPENDIX

    Responses from the following witnesses to questions for the
      record from Hon. Garret Graves:

        Sharon Pinkerton, Senior Vice President, Legislative and
          Regulatory Policy, Airlines for America....................    75
        Captain Chesley B. ``Sully'' Sullenberger III, Pilot, US
          Airways (Retired)..........................................    76
        Hon. J. Randolph Babbitt, Former Administrator, Federal
          Aviation Administration....................................    77

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                 June 14, 2019

        SUMMARY OF SUBJECT MATTER

        TO:       Members, Subcommittee on Aviation
        FROM:   Staff, Subcommittee on Aviation
        RE:       Subcommittee Hearing on ``Status of the Boeing 737
        MAX: Stakeholder Perspectives''

                                    PURPOSE

        The Subcommittee on Aviation will meet on Wednesday, June
    19, 2019, at 10:00 a.m. in 2167 Rayburn House Office Building
    to hold an hearing titled, ``Status of the Boeing 737 MAX:
    Stakeholder Perspectives.'' The hearing is intended to gather
    views and perspectives from aviation stakeholders regarding the
    Lion Air Flight 610 and Ethiopian Airlines Flight 302
    accidents, the resulting international grounding of the Boeing
    737 MAX aircraft, and actions needed to ensure the safety of
    the aircraft before returning them to service. The Subcommittee
    will hear testimony from Airlines for America, Allied Pilots
    Association, Association of Flight Attendants--CWA, Captain
    Chesley (``Sully'') Sullenberger, and Randy Babbitt.

                                   BACKGROUND

        The Federal Aviation Administration's (FAA) mission is to
    provide the safest, most efficient aerospace system in the
    world. According to the FAA, the risk of a fatal commercial
    aviation accident in the United States has been cut by 95
    percent since 1997. There has only been one commercial airline
    passenger fatality in the United States in more than 90 million
    flights in the past decade.\1\ Prior to that single passenger
    fatality in April 2018, the last fatal domestic commercial
    airline accident occurred in February 2009, when Colgan Air
    Flight 3407 crashed near Buffalo, New York, killing all 49
    onboard and one person on the ground.\2\ However, in a span of
    five months, there have been two fatal commercial airline
    accidents involving the new U.S.-designed and manufactured
    Boeing 737 MAX aircraft operated by foreign air carriers
    outside the United States, raising safety concerns. According
    to the Flight Safety Foundation, worldwide, there were more
    than 50 fatal airline accidents each year through the early and
    mid-1990s, claiming more than 1,000 lives annually.\3\
    Fatalities dropped from 1,844 in 1996 to just 59 in 2017, then
    rose to 561 last year and 209 already this year (primarily due
    to the two 737 MAX accidents).\4\
    ---------------------------------------------------------------------------
        \1\ On April 17, 2018, Southwest Airlines Flight 1380 experienced
    an engine failure, resulting in loss of an engine inlet and cowling.
    Fragments struck the airplane's fuselage and damaged a cabin window,
    killing one passenger onboard.
        \2\ NTSB, Loss of Control on Approach, Colgan Air, Inc., Operating
    as Continental Connection Flight 3407, Bombardier DHC 8 400, N200WQ,
    https://www.ntsb.gov/investigations/AccidentReports/Pages/AAR1001.aspx.
        \3\ David Koenig and Tom Krisher, Recent Airline Crashes Run
    Against Trend Toward Safer Flying, U.S. News and World Reports and
    Associated Press, May 6, 2019, available at https://www.usnews.com/
    news/business/articles/2019-05-06/recent-airline-crashes-run-against-
    trend-toward-safer-flying/.
        \4\ Id.
    ---------------------------------------------------------------------------

         I. FOREIGN AIR CARRIER ACCIDENTS INVOLVING THE BOEING 737 MAX

    A. LION AIR FLIGHT 610

        On October 29, 2018, Lion Air Flight 610 (JT610)--a Boeing
    737 MAX--an Indonesian domestic flight en route to Pangkal
    Pinang from Jakarta, crashed into the Java Sea at 450 miles per
    hour approximately 11 minutes after takeoff, killing all 189 on
    board (184 passengers and 5 crew).
        According to the preliminary accident report by Indonesia's
    Komite Nasional Keselamatan Transportasi (KNKT),\5\ prior to
    departure, the aircraft's left and right angle of attack (AoA)
    sensors, which measure the angle between the airplane's wings
    and the oncoming air, provided the pilots inaccurate readings
    (a 20-degree difference between left and right sensors). This
    faulty data made the accident aircraft believe it was in a
    stall and therefore activated a Boeing system on the 737 MAX
    called the ``maneuvering characteristics augmentation system''
    (MCAS). The MCAS was designed to adjust the handling of the
    aircraft so that it operates similarly to previous 737 models
    by pushing the nose of the aircraft down based on certain data
    inputs. However, due to erroneous AoA data, the MCAS on JT610
    activated (i.e., pushed the nose of the aircraft down) more
    than two dozen times during the 11-minute flight. The pilots'
    manual attempts to counter the MCAS were ultimately
    unsuccessful.
        The preliminary report provides information on the flight
    crew, including: \6\
    ---------------------------------------------------------------------------
        \5\ Translated means ``Transportation Safety National Committee''
    or ``National Transportation Safety Committee.''
        \6\ Lion Air 601 Preliminary Report available at https://
    reports.aviation-safety.net/2018/20181029-0_B38M_PK-
    LQP_PRELIMINARY.pdf.
    ---------------------------------------------------------------------------
          Pilot in Command: 6,028 hours (including 5,176
    hours in the Boeing 737; the number of hours in the Boeing 737
    MAX is not provided).
          First Officer: 5,174 hours (including 4,286 hours
    in the Boeing 737; the number of hours in the Boeing 737 MAX is
    not provided).
        According to the preliminary report, there were problems
    reported by flight crews operating the aircraft on October 26,
    27, and 28. The pilots of the flight immediately preceding the
    accident flight (on October 28) experienced similar problems to
    the accident flight on October 29. On the October 28 flight,
    despite experiencing problems, the pilots continued flying with
    manual trim, with the stick shaker activated, and without auto-
    pilot until safely landing at Jakarta more than one hour later.
    They reported certain problems to the airline but not the stick
    shaker activation. The aircraft was serviced, tested, and
    determined ready for flight.
        On November 7, 2019, the FAA issued an Emergency
    Airworthiness Directive (AD) requiring operators of the 737 MAX
    to ``revise their flight manuals to reinforce to flight crews
    how to recognize and respond to uncommanded stabilizer trim
    movement and MCAS events.'' \7\ Specifically, the AD stated
    that in the event of an ``erroneously high [AoA] sensor input .
    . . there is a potential for repeated nose-down trim commands
    of the horizontal stabilizer. This condition, if not addressed,
    could cause the flight crew to have difficulty controlling the
    airplane, and lead to excessive nose-down attitude, significant
    altitude loss, and possible impact with terrain.'' \8\ The AD
    identified existing flight crew procedures to be used in such
    circumstances.
    ---------------------------------------------------------------------------
        \7\ Daniel K. Elwell, FAA, Testimony before for the Senate Commerce
    Committee, Aviation and Space Subcommittee, hearing on State of Airline
    Safety: Federal Oversight of Commercial Aviation, at 7 (Mar. 27, 2019).
        \8\ FAA Emergency Airworthiness Directive, AD 2018-23-51 (Nov. 7,
    2018), available at http://rgl.faa.gov/Regulatory_and_Guidance_Library/
    rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-
    51_Emergency.pdf.
    ---------------------------------------------------------------------------
        Indonesia's KNKT is leading the ongoing accident
    investigation. As mentioned previously, on November 27, 2018,
    the KNKT issued a preliminary report on the Lion Air crash. The
    preliminary report was compiled prior to the recovery of the
    cockpit voice recorder and does not contain analysis. The final
    report, which will include the probable cause(s) of the
    accident, is expected later this year. The National
    Transportation Safety Board (NTSB) is assisting with this
    investigation.

    B. ETHIOPIAN AIRLINES FLIGHT 302

        On March 10, 2019, Ethiopian Airlines Flight 302 (ET302)--a
    Boeing 737 MAX--en route from Bole International Airport in
    Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed approximately
    six minutes after takeoff. The accident resulted in the death
    of all 157 people on board (149 passengers and 8 crew members).
        According to the Ethiopian Ministry of Transport's
    preliminary accident report, erroneous AoA data from one sensor
    triggered the MCAS during flight, pulling the nose of the
    aircraft down, before it ultimately crashed into terrain.
    Unlike the Lion Air pilots, the Ethiopian Airline pilots hit
    the ``STAB TRIM CUTOUT'' switches (disconnecting the electric
    portion of the plane's stabilizer), in accordance with Boeing's
    emergency checklist described in the FAA's Emergency AD issued
    months prior. The pilots did not reduce the throttle after
    takeoff and the aircraft accelerated to between 450 and 500
    knots. The maximum design speed of the aircraft is 340 knots.
    As depicted in the image included in Appendix 1, using the
    manual trim wheel at excessive airspeed can be difficult or
    nearly impossible due to the downward force on the plane's
    tail. According to the preliminary accident report, the pilots
    reactivated the motor on the stabilizer, allowing MCAS to push
    the nose down again. The pilots were unable to recover.
        The preliminary report provides information on the flight
    crew, including \9\:
    ---------------------------------------------------------------------------
        \9\ ET302 Preliminary Report available at http://www.ecaa.gov.et/
    documents/20435/0/Preliminary+Report+B737-800MAX+%2C%28ET-AVJ%29.pdf/
    4c65422d-5e4f-4689-9c58-d7af1ee17f3e.
    ---------------------------------------------------------------------------
          Pilot in Command: 8,122 flight hours (including
    1,417 hours in the Boeing 737, and 103 hours in the Boeing 737
    MAX).
          First Officer: 361 flight hours (including 207
    hours in the Boeing 737, and 56 hours in the Boeing 737 MAX).
        Immediately following the accident, foreign civil aviation
    authorities began grounding the Boeing 737 MAX planes. On March
    11, 2019, the FAA issued a Continuous Airworthiness
    Notification to the International Community (CANIC) for 737 MAX
    operators, describing the FAA's activities following the Lion
    Air accident in support of continued operational safety of the
    737 MAX fleet. On March 13, two days later, the FAA ordered a
    temporary grounding of the fleet operated by U.S. airlines or
    in U.S. territory. The Boeing 737 MAX remains grounded today.
        The Ethiopian government is leading the accident
    investigation. As mentioned previously, on April 4, 2019,
    Ethiopia's Ministry of Transport's Aircraft Accident
    Investigation Bureau issued a preliminary report on the
    Ethiopian Airlines crash. A final report detailing probable
    cause(s) of the accident is expected within the year. The NTSB
    is assisting with this investigation as well.

    C. ISSUES TO BE CONSIDERED IN 737 MAX ACCIDENT INVESTIGATIONS

        An aviation accident rarely has one probable cause. Rather,
    accident investigators consider a number of factors, including:
    operations, weather, human performance, survival factors, and
    aircraft structures, power plants, and systems, to name a few.
        In terms of the two 737 MAX accidents, as the United States
    is the state of design and manufacture of the accident
    aircraft, the FAA and NTSB are serving as technical experts to
    examine aircraft design and certification. In accordance with
    Annex 13 to the U.N. Chicago Convention of the International
    Civil Aviation Organization (ICAO), Indonesia and Ethiopia will
    (respectively) be responsible for examining a number of
    factors, including: pilot experience, pilot training,
    operational factors, and aircraft maintenance.
        International Pilot Training Standards. According to ICAO
    Standards and Recommended Practices, the pilot-in-command
    requires an Airline Transport Pilot License (ATP). An ATP
    requires a pilot have ``completed not less than 1,500 hours of
    flight time.'' Further, ``[t]he Licensing Authority shall
    determine whether experience as a pilot under instruction in a
    flight simulation training device is acceptable as part of the
    total flight time of 1,500 hours. Credit for such experience
    shall be limited to a maximum of 100 hours, of which not more
    than 25 hours shall have been acquired in a flight procedure
    trainer or a basic instrument flight trainer.'' \10\
    ---------------------------------------------------------------------------
        \10\ See ICAO Annex 1, Personnel Licensing, at section 2.6
    (regarding airline transport pilot (ATP) license).
    ---------------------------------------------------------------------------
        ICAO also provides standards to obtain a Multi-Crew Pilot
    License (MPL), which ``allows a pilot to exercise the
    privileges of a co-pilot in a commercial air transportation on
    multi-crew aeroplanes.'' \11\ ICAO Standards for an MPL are set
    at a minimum of 240 hours ``as the minimum number of actual and
    simulated flight hours performing the functions of the pilot
    flying and the pilot non-flying.'' \12\ The ICAO Standard
    ``does not specify the breakdown between actual and simulated
    flight hours and thus allow part of the training curriculum
    that was traditionally conducted on aeroplane to be done on
    flight simulation training devices.'' \13\ The applicant pilot
    is required to meet ``all the actual flying time for a private
    pilot license plus additional actual flying time in instrument,
    night flying and upset recovery.''
    ---------------------------------------------------------------------------
        \11\ See ICAO, Multi-Crew Pilot License, https://www.icao.int/
    safety/airnavigation/Pages/peltrgFAQ.aspx#anchor24.
        \12\ Id.
        \13\ Id.
    ---------------------------------------------------------------------------
        FAA Certification and Delegation of Authority. All aircraft
    and aviation products are subject to FAA certification prior to
    their sale and use in the United States. The FAA is responsible
    for regulating aviation safety, which includes approving the
    design and manufacture of new aircraft and aviation products
    before they enter the National Airspace System (NAS).\14\
    Therefore, the FAA will need to review and approve any software
    fix proposed by Boeing and determine whether changes to the 737
    MAX training program are needed to get the aircraft back into
    commercial service.
    ---------------------------------------------------------------------------
        \14\ See 49 U.S.C. Sec. Sec.  44702, 44704; GAO, Aviation
    Manufacturing: Status of FAA's Efforts to Improve Certification and
    Regulatory Consistency (July 31, 2014), GAO-14-829T, at 1.
    ---------------------------------------------------------------------------
        Since even before the FAA was formed over 60 years ago, the
    Federal government has delegated some safety certification
    responsibilities to technical experts in the industry. As
    airplanes, engines, and their constituent systems became
    increasingly complex, Congress authorized the FAA to leverage
    the product-specific knowledge among appropriately-qualified
    employees of manufacturers to determine a new product's
    compliance with the applicable provisions of the Federal
    Aviation Regulations. A designee may receive authority to
    examine, inspect, and test aircraft and persons for the purpose
    of issuing certificates.\15\
    ---------------------------------------------------------------------------
        \15\ GAO-14-829T at 4.
    ---------------------------------------------------------------------------
        The delegation program allows the FAA to leverage limited
    resources to focus on the areas of highest-risk and make timely
    certification decisions. According to the Government
    Accountability Office (GAO), in terms of the breadth or scope
    of activities performed by FAA designees, designees perform
    more than 90 percent of FAA's certification activities.\16\
    However, the FAA has ultimate responsibility to ensure
    appropriate oversight is taken and aircraft are certified in a
    safe manner.
    ---------------------------------------------------------------------------
        \16\ GAO, Aviation Safety: FAA Efforts Have Improved Safety, but
    Challenges Remain in Key Areas (Apr. 16, 2013), GAO-13-442T, at 3-4. In
    a May 7, 2019, email to Committee staff, the GAO clarified that the 90
    percent number refers to the breadth or scope of FAA activities on
    which designees can do rather than the amount of certification work
    done by designees.
    ---------------------------------------------------------------------------
        Since the original 737 aircraft was certified in the 1960s,
    there have been more than a dozen new models of the aircraft
    approved for flight. The 737 MAX is the latest version of the
    737 aircraft. With regard to the FAA certification of the 737
    MAX, the process to issue a type-certificate, from initial
    application to final certification, took five years, according
    to the FAA.\17\ The process included 297 certification flight
    tests, including tests of the MCAS functions. The final type
    certificate was issued in March 2017. The FAA reports it was
    ``directly involved'' in the System Safety Review of the
    MCAS.\18\
    ---------------------------------------------------------------------------
        \17\ See Koenig, supra note 3 at 6.
        \18\ Id.
    ---------------------------------------------------------------------------

                       II. REVIEWS OF THE BOEING 737 MAX

        Subsequent to the two fatal foreign airline Boeing 737 MAX
    accidents, the U.S. Department of Transportation (DOT), FAA,
    and Boeing have stood up various panels, including those
    explained below.

    A. SAFETY OVERSIGHT AND CERTIFICATION ADVISORY COMMITTEE (SOCAC)

        On March 25, 2019, as mandated by Congress in the FAA
    Reauthorization Act of 2018, DOT announced it will stand up the
    Safety Oversight and Certification Advisory Committee. The
    SOCAC is required to advise the Transportation Secretary on
    policy-level issues related to FAA safety certification and
    oversight programs, including efforts to streamline aircraft
    and flight standards certification processes, utilization of
    delegation authorities, risk-based oversight efforts, and
    training programs. The SOCAC will develop training and
    continuing education objectives for FAA engineers and safety
    inspectors. While not directly tasked with Boeing
    certification, aircraft certification is a key tasking of the
    committee.

    B. SAFETY OVERSIGHT AND CERTIFICATION ADVISORY COMMITTEE SPECIAL
                        COMMITTEE

        On March 25, 2019, DOT announced it would create a Special
    Committee to review the FAA's Aircraft Certification Process
    (Special Committee) within the structure of the SOCAC,
    described previously.\19\ The Special Committee is tasked with
    reviewing the procedures of the FAA for the certification of
    new aircraft, including the Boeing 737 MAX.\20\ The Special
    Committee's review of the certification process includes the
    ``FAA certification process workplan, process timeline,
    Organization Designation Authorization, Designated Engineering
    Representatives Authorization/Certification, Authorized
    Representation Certification and oversight thereof.'' \21\ The
    Special Committee will focus primarily on the Boeing 737 MAX 8
    certification process from 2012 to 2017 and make
    recommendations for how the process could be improved.\22\ Its
    findings and recommendations will then be presented directly to
    the DOT Secretary and the FAA Administrator for their
    consideration.\23\
    ---------------------------------------------------------------------------
        \19\ FAA, DOT Announces Special Committee to Review FAA's Aircraft
    Certification Process (2019), available at https://
    www.transportation.gov/briefing-room/dot1619.
        \20\ Id.
        \21\ DOT, Letter to General McDew (2019), available at https://
    www.transportation.gov/sites/dot.gov/files/docs/briefing-room/337281/
    gen-darren-mcdew.pdf.
        \22\ Id.
        \23\ Id.
    ---------------------------------------------------------------------------

    C. JOINT AUTHORITIES TECHNICAL REVIEW

        On April 2, 2019, the FAA established a Joint Authorities
    Technical Review (JATR) \24\ to conduct a comprehensive review
    of the certification of the automated flight control system
    (MCAS) on the Boeing 737 Max, including evaluating aspects of
    its design and pilots' interaction with the system, determining
    its compliance with all applicable regulations and identifying
    future enhancements that might be needed.\25\
    ---------------------------------------------------------------------------
        \24\ FAA, FAA Updates on the Boeing 737 MAX: FAA Establishes Joint
    Authorities Technical Review (JATR) for Boeing 737 MAX (2019),
    available at https://www.faa.gov/news/updates/?newsId=93206.
        \25\ On March 26, 2019, Chair of the House Committee on
    Transportation and Infrastructure Peter DeFazio (D-OR) and Chair of the
    Subcommittee on Aviation Rick Larsen (D-WA) sent a letter to FAA Acting
    Administrator Daniel K. Elwell, urging the agency to engage an
    independent, third-party review composed of individuals with the
    technical skills and expertise to objectively assess the corrective
    measures proposed for the 737 MAX by Boeing.
    ---------------------------------------------------------------------------
        The JATR is chaired by former NTSB Chairman Chris Hart and
    comprised of a team of experts from the FAA, National
    Aeronautics and Space Administration (NASA), and international
    aviation authorities, including China, Indonesia, Australia,
    Brazil, Canada, Singapore, the United Arab Emirates (UAE), and
    the European Union Aviation Safety Agency (EASA).\26\ The JATR
    had its first meeting on April 29, 2019, and is expected to
    last three months from the date it was established.\27\ The
    JATR is not tied to the FAA's decision for return to service of
    the 737 MAX. That decision will be based upon FAA's assessment
    of the sufficiency of the proposed software updates and pilot
    training to address known issues for grounding the aircraft.
    ---------------------------------------------------------------------------
        \26\ FAA Establishes JATR, supra note 24.
        \27\ Id.
    ---------------------------------------------------------------------------

    D. TECHNICAL ADVISORY BOARD

        On May 6, 2019, the FAA launched the Technical Advisory
    Board (TAB). The TAB is tasked with conducting an independent
    review of Boeing's proposed software change and its integration
    into the 737 MAX flight control system. The review, which will
    run parallel to FAA's software reviews and flight tests, will
    include experts from the FAA, U.S. Air Force, the Volpe
    National Transportation Systems Center and NASA. The TAB is
    distinct from the JATR, in that the JATR focuses broadly on the
    earlier certification of the automated flight control system.

    E. BOEING BOARD OF DIRECTORS REVIEW COMMITTEE

        On April 5, 2019, Boeing announced it was creating a panel
    that will examine the design and development of its
    aircraft.\28\ According to Boeing's statement, the panel will
    examine ``company-wide policies and processes for the design
    and development of its aircraft'' and will also ``confirm the
    effectiveness of [its] policies and processes for assuring the
    highest level of safety on the 737-MAX program, as well as
    [its] other airplane programs, and recommend improvements to
    [its] policies and procedures.'' \29\
    ---------------------------------------------------------------------------
        \28\ Boeing, Statement from Boeing CEO Dennis Muilenburg: We Own
    Safety--737 MAX Software, Production and Process Update (2019),
    available at https://boeing.mediaroom.com/2019-04-05-Statement-from-
    Boeing-CEO-Dennis-Muilenburg-We-Own-Safety-737-MAX-Software-Production-
    and-Process-Update.
        \29\ Id.
    ---------------------------------------------------------------------------

                          III. ONGOING INVESTIGATIONS

    A. U.S. HOUSE OF REPRESENTATIVES COMMITTEE ON TRANSPORTATION AND
                        INFRASTRUCTURE

        On March 13, 2019, Chairman Peter A. DeFazio and
    Subcommittee on Aviation Chairman Rick Larsen launched an
    investigation by the Committee on Transportation and
    Infrastructure into the certification of the Boeing 737 MAX.

    B. DOT INSPECTOR GENERAL

        On March 19, 2019, Secretary of Transportation Elaine Chao
    requested the DOT Inspector General (DOT IG) conduct an audit
    ``to compile an objective and detailed factual history of the
    activities that resulted in the certification of the Boeing
    737-MAX 8 aircraft.'' \30\
    ---------------------------------------------------------------------------
        \30\ The DOT IG reports similar audit requests from the Chairman
    and Ranking Member of the Senate Committee on Appropriations,
    Subcommittee on Transportation, Housing and Urban Development, and
    Related Agencies; and Senator Richard Blumenthal (D-CT). See DOT OIG,
    Audit Announcement: FAA's Oversight of Boeing 737 MAX Certification,
    available at https://www.oig.dot.gov/sites/default/files/
    Audit%20Annoucement%20-%20FAA%27s%20Oversight
    %20of%20the%20Boeing%20737%20MAX%20Certification.pdf.
    ---------------------------------------------------------------------------
        On March 19, 2019, Chairman DeFazio and Aviation
    Subcommittee Chairman Rick Larsen asked DOT IG to investigate
    the certification process for the Boeing 737 MAX, including how
    each of the new features on the plane, including the AoA
    sensors and the MCAS, were tested and certified. The request
    also seeks investigation of the FAA's decision not to revise
    pilot training programs and manuals to reflect flight critical
    automation systems; how new features of the aircraft were
    communicated to airline customers, pilots and foreign civil
    aviation authorities; whether ODA authority contributed to any
    of the factors FAA considered in its decision-making; and a
    status report on how corrective actions have been implemented
    since the Lion Air crash in October 2018.
        On March 29, 2019, Chairman DeFazio, Ranking Member Sam
    Graves, Aviation Subcommittee Chair Larsen, and Aviation
    Subcommittee Ranking Member Garrett Graves requested that the
    DOT IG launch an investigation of international pilot training
    standards and training for commercial pilots operating outside
    of the United States, including training for the Boeing 737
    MAX.

    C. U.S. DEPARTMENT OF JUSTICE

        According to multiple news sources, it was reported that
    the U.S. Department of Justice (DOJ) is conducting a criminal
    investigation into the FAA's certification of the Boeing 737
    MAX.\31\ Reports indicate the investigation began after the
    October 2018 Lion Air crash and is primarily focusing on the
    certification process.\32\ According to news reports, the FBI
    Seattle Office and the Justice Department's criminal division
    in Washington State are leading the investigation.\33\ The
    Justice Department has declined to comment.
    ---------------------------------------------------------------------------
        \31\ See Steve Miletich, FBI Joining Criminal Investigation into
    Certification of Boeing 737 MAX, The Seattle Times (Mar. 20, 2019),
    available at https://www.seattletimes.com/business/boeing-aerospace/
    fbi-joining-criminal-investigation-into-certification-of-boeing-737-
    max/; Evan Perez and Shimon Prokupecz, Justice Department Issues
    Subpoenas in Criminal Investigation of Boeing, CNN (Mar. 21, 2019),
    available at https://www.cnn.com/2019/03/20/business/boeing-justice-
    department-subpoenas/index.html.
        \32\ Id.
        \33\ Id.
    ---------------------------------------------------------------------------

    D. U.S. SECURITIES AND EXCHANGE COMMISSION

        According to multiple news sources, it was reported that
    the Securities and Exchange Commission (SEC) is investigating
    whether Boeing ``was adequately forthcoming to shareholders
    about material problems with the [Boeing 737 MAX]'' and whether
    the company's ``financial statements have appropriately
    reflected potential impacts from the problems.'' \34\ The SEC
    has declined to comment.\35\
    ---------------------------------------------------------------------------
        \34\ Bloomberg, Boeing Faces SEC Probe into Disclosures about 737
    MAX Troubles (May 24, 2019), https://www.bloomberg.com/news/articles/
    2019-05-24/boeing-faces-sec-probe-into-disclosures-about-737-max-
    troubles.
        \35\ Id.
    ---------------------------------------------------------------------------

                  IV. NEXT STEPS AND IMPACTS OF THE GROUNDING

        Returning to Service in the United States. After the
    October 2018 Lion Air crash, Boeing announced that the company
    is working on a design change to implement a software patch for
    the MCAS. Boeing continues to work on the certification
    documentation required to certify the MCAS software enhancement
    and the associated pilot training material. The FAA is
    responsible for reviewing and approving this and any other
    design changes to the 737 MAX. According to the FAA, the ``737
    MAX will return to service for U.S. carriers and in U.S.
    airspace only when the FAA's analysis of the facts and
    technical data indicate that it is appropriate.'' \36\ Boeing
    CEO Dennis Muilenburg expects the 737 MAX to return to service
    by the end of 2019,\37\ although the FAA has not committed to a
    timeline.\38\
    ---------------------------------------------------------------------------
        \36\ Elwell, supra note 7, at 9.
        \37\ CNBC, Boeing CEO Says Troubled 737 MAX Jets Should be Flying
    by the End of the Year (June 3, 2019).
        \38\ NBCDFW, FAA Meets with International Regulators Over Boeing
    737 MAX (May 23, 2019), https://www.nbcdfw.com/news/local/FAA-Meets-
    With-International-Regulators-Over-Boeing-737-Max-510341841.html.
    ---------------------------------------------------------------------------
        International Input. On May 23, 2019, the FAA convened
    foreign civil aviation authorities from around the world in
    Fort Worth, Texas, to explain the agency's plan and approach to
    evaluating Boeing's forthcoming changes to the 737 MAX.\39\ As
    stated by Acting FAA Administrator Dan Elwell,
    ``Internationally, each country has to make its own decisions,
    but the FAA will make available to [its] counterparts all that
    [it has] learned, all that [it has] done, and all of [its]
    assistance under [U.S.] International Civil Aviation
    Organization commitments.'' \40\ The European Union (EU) has
    stated it will require four conditions before allowing the 737
    MAX to fly again in its skies, including that the European
    Aviation Safety Agency (the EU's equivalent of the FAA)
    approves Boeing's updates to the aircraft separate from the FAA
    determination.\41\
    ---------------------------------------------------------------------------
        \39\ FAA Acting Administrator Dan Elwell's Opening and Closing
    Remarks at Directorates General Meeting, May 22 & 23 2019, https://
    www.faa.gov/news/updates/?newsId=93206
    &omniRss=news_updatesAoc&cid=101_N_U.
        \40\ Id.
        \41\ POLITICO, Shadow of Global Mistrust Colors FAA's 737 MAX
    Gathering (May 22, 2019).
    ---------------------------------------------------------------------------
        Impacts on Airlines and their Customers. There are more
    than 370 Boeing 737 MAX aircraft worldwide,\42\ and, according
    to news reports, there are fewer than 100 operated by U.S.
    airlines and grounded at this time.\43\ Southwest Airlines is
    the top 737 MAX operator in the United States. Airlines have
    cancelled thousands of flights as a result of the international
    grounding of the 737 MAX aircraft and have made schedule and
    fleet adjustments to best accommodate passengers.\44\ According
    to news reports, United Airlines alone has cancelled more than
    3,000 flights and has removed its 14 MAX aircraft from
    scheduled service through August 3, 2019,\45\ and American
    Airlines has removed its 24 MAX aircraft from scheduled service
    through September 3, 2019.\46\ It is reported that even after
    the 737 MAX returns to service, airlines recognize potential
    difficulty in getting passengers comfortable flying in the
    aircraft again.\47\ Media reports indicate that at least one
    airline has cancelled its contract with Boeing for new 737 MAX
    aircraft altogether.\48\
    ---------------------------------------------------------------------------
        \42\ See Boeing, 737 MAX Updates, https://www.boeing.com/
    commercial/737max/737-max-contacts.page.
        \43\ CNBC, U.S. Grounds Boeing 737 MAX Planes, Citing Links Between
    2 Fatal Crashes (Mar. 13, 2019), https://www.cnbc.com/2019/03/13/
    boeing-shares-fall-after-report-says-us-expected-to-ground-737-max-
    fleet.html.
        \44\ See American Airlines statement, June 9, 2019, http://
    news.aa.com/news/news-details/2019/The-Latest-Information-About-737-
    MAX-Operations/default.aspx; Statement of Gary Kelly, Southwest
    Airlines, April 26, 2019, https://www.southwest.com/html/air/737-MAX-
    8.html?clk=737MAX8_190408; and CNBC, United CEO Says He's Not Sure
    Travelers Will Want to Fly a Boeing 737 MAX--Even After a Fix (May 30,
    2019).
        \45\ United CEO, supra note 44.
        \46\ CNBC, American Airlines Extends Cancellations from Grounded
    Boeing 737 Max to Sept. 3 (June 9, 2019), https://www.cnbc.com/2019/06/
    09/american-airlines-extends-boeing-737-max-to-september.html.
        \47\ Id.
        \48\ See e.g., Reuters, Azerbaijan Cancels $1 Billion Contract with
    Boeing for Safety Reasons (June 3, 2019), https://www.reuters.com/
    article/us-boeing-azerbaijan/azerbaijan-cancels-1-billion-contract-
    with-boeing-for-safety-reasons-idUSKCN1T413D.
    ---------------------------------------------------------------------------

                                   WITNESSES

          Sharon Pinkerton, Senior Vice President,
    Legislative and Regulatory Policy, Airlines for America
          Captain Daniel Carey, President, Allied Pilots
    Association
          Captain Chesley Sullenberger, Pilot, US Airways
    (Retired)
          Sara Nelson, International President, Association
    of Flight Attendants--CWA
          The Honorable Randy Babbitt, Former
    Administrator, Federal Aviation Administration

                                  APPENDIX 1.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

     Seattle Times, ``Why Boeing's emergency directives may have failed to
               save 737 MAX,'' by Dominic Gates on April 3, 2019.

             STATUS OF THE BOEING 737 MAX: STAKEHOLDER PERSPECTIVES

                                  ----------

                            WEDNESDAY, JUNE 19, 2019

                      House of Representatives,
                              Subcommittee on Aviation,
                Committee on Transportation and Infrastructure,
                                                        Washington, DC.
        The subcommittee met, pursuant to call, at 10:03 a.m., in
    room 2167, Rayburn House Office Building, Hon. Rick Larsen
    (Chairman of the subcommittee) presiding.
        Mr. Larsen. The subcommittee will come to order. I ask
    unanimous consent the chair be authorized to declare recesses
    at today's hearing. Without objection, so ordered.
        I also ask unanimous consent members not on the
    subcommittee be permitted to sit with the subcommittee at
    today's hearing and ask questions. Without objection, so
    ordered.
        Good morning. And I want to thank today's witnesses for
    joining the subcommittee's ongoing discussion on the status of
    the Boeing 737 MAX. Today's hearing is the second in a series
    investigating the tragic Boeing 737 MAX accidents. The purpose
    of today's hearing is to hear from people who fly the airplanes
    and from the people who fly in the airplanes, and those who
    represent them.
        A total of 346 people have died in the Lion Air and
    Ethiopian Airlines accidents, and their loved ones deserve
    answers. The traveling public's confidence in U.S. aviation is
    shaken. Congress, the administration, and industry must work
    together to restore confidence in air travel. The foundation of
    this committee's investigation into the Boeing 737 MAX is
    ensuring safety.
        As I have said before, if the public does not feel safe
    about flying, then they won't fly. If they don't fly, airlines
    don't need to buy airplanes. If they don't need to buy
    airplanes, airplanes don't need to be built. And if there is no
    need to build airplanes, there will be no jobs in aviation.
        The foundation of the aviation industry is its safety, and
    today's hearing builds on the committee's ongoing
    investigation. Safety remains this committee's guiding
    principle. In this committee we use all tools to reduce the
    likelihood of future tragedies.
        I want to start by updating subcommittee members and the
    public on the committee's work since last month's hearing.
        Chair DeFazio and I continue to engage with the Federal
    Aviation Administration, the NTSB, Boeing, pilots, aviation
    stakeholders, and others about these accidents. Second, the
    committee's oversight and investigation team continues to work
    with the FAA and Boeing on securing records that the chair and
    I requested on the certification of the MAX.
        More recently, Chair DeFazio and I have recently wrote to
    Transportation Secretary Chao and FAA Acting Administrator
    Elwell, expressing concerns about the slow pace of the FAA's
    response to our records request. It is my expectation that both
    will cooperate with the committee's investigation in a timely
    manner. Third, we have written to Boeing, United Technologies
    Corporation, and the FAA, requesting a timeline and supporting
    documents related to the awareness of when the angle of attack,
    or the AOA, disagree alert, on some Boeing 737 MAX planes, was
    defective, as well as when the groups notified airlines about
    this defect.
        The committee is aware of information suggesting that
    Boeing decided in November of 2017 to defer a software update
    to correct the AOA disagree alert defect until 2020, 3 years
    after discovering a flaw, and only accelerated its timeline
    after the October 2018 Lion Air accident. This information is
    deeply concerning, and the committee must find out what Boeing
    knew, when the company knew it, and who it informed.
        I also have questions about the decision to not deem the
    AOA disagree alert as safety critical. The information the
    committee is requesting will help us better understand these
    management decisions. And I as well, again, encourage all
    members of the subcommittee to continue personally monitoring
    the situation. Staff continues to be available for any
    questions the subcommittee may have surrounding our
    investigation and can provide you with updates as they become
    available.
        What I hope to hear today from witnesses: More than 300
    Boeing 737 MAX planes have been grounded worldwide since the
    Ethiopian Airlines accident in March, and more than 130 are
    parked. More than 4,500 orders for the MAX worldwide remain
    unfilled since Boeing stopped delivering, that is over a longer
    period of time.
        Today's hearing is an opportunity to gather views and
    perspectives from key users of the aircraft--pilots, flight
    attendants, the industry, and those representing passengers'
    views--on what the FAA, Boeing, and the airlines need to do
    before returning the 737 MAX to service. The committee is not
    here yet to make conclusions as to what caused these accidents,
    that is the NTSB's job, but as with any aviation accident,
    investigators must consider a multitude of factors, including
    aircraft design, aircraft maintenance, weather, and human
    performance, before making a final determination of probable
    cause or causes.
        In the end, there will be a root cause and there will be
    contributing factors. Nevertheless, it is critical the public
    hear from frontline stakeholders as part of our oversight work.
        Captain Carey and Captain Sullenberger, I look forward to
    hearing the pilots' perspective on these accidents, pilots'
    role in the FAA certification process, and associated pilot
    training.
        Ms. Nelson, flight attendants are on the front lines of
    passengers. I am interested in hearing your thoughts of what
    must take place to restore the confidence of the flying public
    and help you perform your important work.
        Ms. Pinkerton, I would like to hear more about the impact
    of the grounding on the airlines, airlines' engagement with the
    FAA and Boeing on certification of the aircraft and related
    fixes, and next steps to ensure safety.
        And, Mr. Babbitt, as a former FAA Administrator, I look
    forward to your thoughts on the importance of coordination of
    the international aviation community on this issue and how the
    FAA can regain its credibility and restore the public's trust.
        And I hope today's testimony will help this committee
    better understand what is needed to restore the trust of the
    flying public and show this committee's commitment to safety by
    asking all the appropriate questions.
        As Congress seeks answers during the Lion Air and the
    Ethiopian Airlines accidents, this committee must also work to
    restore the public confidence in the MAX and the FAA's mission,
    importantly, to maintain the safety of U.S. aviation in
    aerospace. The committee will continue its thorough
    investigation until it fully understands all the issues
    surrounding the 737 MAX accidents.
        And I will continue to work with Chair DeFazio and my
    colleagues, Representative Graves and Representative Graves in
    the full committee, as well as FAA, NTSB, Boeing, aviation
    stakeholders, and the families of victims throughout this
    process.
        So, again, I want to thank today's witnesses. I look
    forward to hearing your insights, and I turn to Representative
    Graves of Louisiana for an opening statement.
        Mr. Graves of Louisiana. Thank you, Mr. Chairman. I don't
    know why you keep mispronouncing my name and pronouncing his
    the right way.
        I want to thank you all for being here today. And I think
    the most important thing that we all need to stay focused on is
    the families and the victims. I am, once again, very, very
    sorry for your loss. Anything we do that loses sight that this
    is about people, it is about lives lost, it is about safety, is
    a distraction. And throughout this process, we need to stay 100
    percent focused on lessons learned, on safety, and making sure
    that this does not happen again.
        In light of that, I want to go through and reference some
    of the different committees and efforts that are underway right
    now to ensure that we do extract every lesson learned from
    these disasters and make sure that other families don't have to
    go through the devastating situation that these families are
    going through today.
        Right now, the special committee on Safety Oversight and
    Certification Advisory Committee, a DOT-initiated group, is
    going through studying this process, lessons learned, from the
    disasters. The Safety Oversight Certification Advisory
    Committee that, once again, DOT has established, is going
    through and evaluating the lessons learned here. Joint
    Authorities Technical Review is an FAA-initiated group that is
    looking at this. The Boeing board of directors has a review
    committee that Boeing initiated. The Technical Advisory Board,
    FAA initiated. There are various Department of Transportation
    inspector general investigations that are underway right now.
    And as I recently became aware, this committee is doing an
    investigation and has hired investigators to look at this as
    well. So there are numerous efforts that are underway right now
    to ensure that we chart a better path forward.
        I want to thank all the witnesses for being here today.
    Thank you to every single one of you. And I did have a chance
    to review your testimony.
        Ms. Nelson, you make a really important point in your
    testimony talking about how we need to ensure that we don't
    allow this to erode the United States sort of standing in the
    international aviation community. And you are exactly right
    about that, we need to ensure we do that.
        Captain Sullenberger, thank you for being here. In your
    testimony, you talk about the chain of events, and I think you
    used the term ``causal chain of events'' that contributed to
    this. We need to make sure, and a lot of people are focused on
    one single aspect of this, but I think it is important, your
    testimony is exactly right, that we do need to look at every
    aspect, not just one. Certainly, the MCAS system has been a
    focus of this and it needs to continue to be, but we need to
    make sure we look at every other step in the process as well to
    make sure that we don't fix one thing and don't recognize
    perhaps the failures or challenges associated with other
    aspects of this. And I appreciate that.
        Mr. Babbitt, thank you for your testimony. And you talked
    about your confidence in the FAA certification system, and yet
    I think you said in your testimony that it is not perfect. But
    one of the things that you do have faith in, and don't let me
    put words in your mouth, but I will leave it in your testimony,
    you talked about how the certification process may be
    imperfect, but you do have a lot of faith in our ability to
    adapt and fix it.
        One of the things in reviewing all of your testimony, that
    comes to mind, we are becoming more heavily reliant upon
    technology. We know it in everything that we do. And I have got
    my old car that I drive that has virtually no technology, and
    if I get in somebody who has got a newer car, and all of the
    different sensors that are out there, and the rearview mirrors
    when you are changing lanes, when you are fading off, when you
    are going too fast, it is somewhat overwhelming and it is very
    different. Is it making us become more complacent in driving,
    in flying planes? And if so, how do we challenge that? How do
    we challenge that--us becoming more complacent and ensuring
    that we stay as alive as on top of what we are doing and don't
    become too dependent upon this technology.
        How does that technology challenge the certification
    process? How does the certification process need to adapt to
    the fact that we are becoming more reliant upon technology to
    ensure, once again, that we are staying alive, that we are
    paying attention to what is happening?
        Look, at the end of the day, I am going to circle back to
    where I started. This is about safety and it is about people.
    And there have been many efforts that we have seen over the
    past few months to make this a partisan effort, and I cannot
    disagree with that more. I think it is a huge mistake to do
    that. There is nothing that is partisan about this. Every
    single one of us that are here today in this room, every one of
    us that is on this dais, we all need to stay singularly focused
    on the fact this is about safety and people.
        And I want to thank you, Mr. Chairman, for having this
    second hearing today, and I am looking forward to the
    witnesses. I do want to make note, we have a markup in another
    committee, four bills that are very much related to the State
    that I represent, and I am going to have to run in and out. I
    think we have 80 amendments over there.
        So I yield back.
        [Mr. Graves of Louisiana's prepared statement follows:]

    Prepared Statement of Hon. Garret Graves, a Representative in Congress
       from the State of Louisiana, and Ranking Member, Subcommittee on
                                    Aviation
        Thank you, Mr. Chairman, for calling today's hearing.
        I also want to express my condolences to the families and friends
    of those lost in the two accidents, some of whom are with us today.
    This is the second hearing that the Subcommittee has held on the Boeing
    737 MAX, and we are closely following open investigations and the FAA
    and NTSB process for making key fixes. Throughout this process we must
    stay focused on lessons learned, safety, and ensuring that this tragedy
    never repeats itself.
        As has been said before, the United States has the strongest
    aviation safety record in the world. The reason we have such a safe
    system is that past Congresses and administrations of both parties have
    pushed partisanship aside and worked together to improve the safety of
    our system.
        When accidents happen, we must ask hard questions and demand that
    aviation stakeholders do the same.
        The FAA is asking itself hard questions, as is Boeing. We would be
    remiss if we didn't expect airlines and pilot organizations to ask
    themselves similarly hard questions.
        In addition to design and potential certification deficiencies, we
    have to understand why pilots facing similar challenging circumstances
    react in very different ways. We have to take a look at industry
    assumptions on pilot responses and human-computer interfaces. And we
    have to figure out whether global pilot training requirements
    adequately prepare pilots for all situations they may face,
    particularly when automated systems fail.
        If we don't work to understand these factors, we are not doing
    everything we can to keep the flying public safe.
        We are all committed to ensuring that automated aircraft systems
    provide the safety benefits they are supposed to. But when automation
    fails, a well-trained pilot must be prepared to respond. By looking
    into all these issues, we can seek to avoid accidents relating to
    automation failures on other aircraft too.
        At some point, the Boeing 737 MAX will fly again. The FAA has laid
    out a rigorous and uncompromising process for the aircraft to go
    through before its return to service. Based on what we know currently,
    we believe it will involve changes to the MCAS system and changes to
    training requirements.
        We can all be confident that the FAA will only unground the 737 MAX
    when it is certain that Boeing has addressed any identified issue and
    that the aircraft is completely safe to fly.
        I believe that Congress must be at least as meticulous and
    deliberative as the FAA in our efforts to figure out what went wrong
    and determine what our next steps are.
        Thank you again, Mr. Chairman, for holding today's hearing.

        Mr. Larsen. Thank you, Representative Graves. And it is
    fair for you to make sure you make your votes and your markup.
    We appreciate that.
        Before I turn to Chair DeFazio for an opening statement, I
    just ask unanimous consent the following be entered into the
    record of today's hearing: A June 12 letter from Ms. Nadia
    Milleron and Mr. Michael Stumo to Chair DeFazio, and the
    written testimony from the Association of Professional Flight
    Attendants.
        Hearing no objection, so ordered.
        [The information follows:]

    Letter from Nadia Milleron and Michael Stumo, Submitted for the Record
                                 by Hon. Larsen

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

       Statement of Lori L. Bassani, National President, Association of
    Professional Flight Attendants, Submitted for the Record by Hon. Larsen
        On behalf of the National President of the Association of
    Professional Flight Attendants (APFA), I am submitting this testimony
    to the Committee on Transportation and Infrastructure. APFA is the
    largest mainline Flight Attendant Union in the world and represents the
    28,000 plus Flight Attendants of American Airlines. First and foremost,
    APFA grieves for our professional colleagues, the 12 Flight Attendants
    who lost their lives in the Lion Air and Ethiopia Airlines crashes, as
    well as for the 330 passengers and 4 pilots who perished. These people
    expected the Boeing 737 MAX 8 planes they were flying on and operating
    to be fit for service. We now know that they were not.
        These accidents account for a massive loss of life. In the wake of
    this loss, we are left with a dire commitment to fulfill. As safety
    professionals, we in the aviation industry must ensure that accidents
    like these never happen again. We need our investigative agencies to
    set aside all political interests to uncover exactly what happened with
    the MAX 8 and why it happened. We need our agencies to spare no
    expense, or time, to ensure that when the 737 MAX returns to the air it
    is 100% airworthy.
        The members of APFA are and will be on the forefront of the issues
    surrounding the MAX 8. Aside from Southwest, American Airlines flies
    the largest fleet of the MAX 8 among all airlines. The 24 planes in our
    fleet have been pulled from service and this has affected over 100
    flights a day. The flying public and schedules of flight crew have been
    impacted.
        Though various parties will be involved in determining the timeline
    to get the MAX 8 in operation again, as Flight Attendants, we will be
    the ones fielding the questions and concerns of passengers when the
    plane is reintroduced. Our Flight Attendants must be included every
    step of the way as they must be 100 percent comfortable and confident
    in the aircraft's airworthiness to transport customers and crew.
        Let me state that we have the highest regard for our pilots,
    members of our brother union, the Allied Pilots Association, which
    represents American Airlines' pilots. We stand in solidarity with APA
    as they continue to advocate for what they need to feel confident in
    the aircraft they are flying. Recently, it was reported that our flight
    deck crewmembers were denied access to a 737 MAX simulator. APA wanted
    their own safety experts to test this full-motion simulator that has
    integrated the new fixes for the Boeing MCAS before it went through the
    FAA certification process. Our pilots expected to be able to test these
    new systems prior to certification so that their input would have real
    bearing on the final solution. In a statement last week, Jason
    Goldberg, a spokesperson for APA said, ``We really have no idea why
    this stance would be taken towards our participation. We can't
    understand why.'' We don't either. This is not acceptable. The pilots
    who fly the 737 MAX every day must be involved, like the Flight
    Attendants at every step in the reintroduction.
        I would like to point out one key issue that must be addressed
    prior to the 737 MAX going back into service. The overriding question
    or issue is one of trust. Does the public, and do our Flight Attendants
    and pilots, trust our management, the FAA, and Boeing to make their
    decisions solely based on safety?
        Let me be clear. While we understand management's position that the
    grounding of the 737 MAX has created a hardship during the busy summer
    travel season, financial considerations should never trump safety. We
    applaud Mr. Ali Bahrami, the FAA's Associate Administrator for Safety,
    who recently stated that although the FAA is ``under a lot of
    pressure,'' the MAX would be returned to service only after design
    reviews, flight testing and the other safety checks are successfully
    completed. While Mr. Bahrami was reluctant to give a date, he agreed
    with Boeing's estimate of a return by the end of 2019. We believe the
    public gets mixed messages when members of AA management make arbitrary
    statements that the MAX will be ``ready to go'' by mid-August. Let me
    assure you that as cabin crew, we spend the greatest amount of time
    with the traveling public and they rely on us to reaffirm that we have,
    and will continue to have, the safest aviation system in the world. As
    Flight Attendant safety professionals, our top priority is safety,
    period.
        To underscore the trust deficit that our regulators and
    manufacturers have developed, NPR recently polled its listeners and out
    of 1,600 respondents, over 1,000 said that they would not fly the MAX
    when it is returned to service.
        Again, I have raised the issue of trust because it is the Flight
    Attendants who will be on the front line when this plane goes back in
    the air. If the public does not believe that the process of returning
    the 737 MAX 8 to service is not the result of a thorough, rigorous, and
    transparent safety-driven process, then this aircraft will likely be
    forever tainted.
        The Transportation and Infrastructure Committee must continue to
    exercise its constitutionally mandated responsibility to conduct
    oversight of executive branch agencies. I congratulate Chairman DeFazio
    and Chairman Larsen for conducting this important hearing. I look
    forward to future hearings once the FAA approval software and training
    fixes are announced. Congress must continue its oversight functions on
    behalf of all people, airline passengers and crew.

        Mr. Larsen. And with that, I will turn to Chair DeFazio for
    an opening statement.
        Mr. DeFazio. Thank you, Mr. Chairman.
        This is, of course, our second hearing. I don't think we
    should be here today. I don't think 346 people should have
    died, and I believe that this was preventable.
        We have family here today who lost a daughter, and we will
    hear from them at a future meeting. But there are a lot of
    questions that still remain unanswered, and we are pressing
    forward with this as a very comprehensive investigation. A lot
    of it leads back to the Organizational Designation
    Authorization process, certification process.
        The question about the role of engineers in this process
    versus that of operators, pilots, and other safety
    professionals who work on those planes. It is inexplicable to
    me, and I asked--in the first hearing, I asked the Acting
    Administrator, I said, is this a safety critical system, MCAS?
    And he said, yes. And my question then was: How could we allow
    a safety critical system with a single point of failure? We do
    not allow that in the aviation industry. Well, the answer from
    Boeing, at an early meeting after Lion Air was, well, the
    pilots were the backup system. The pilots didn't know it
    existed.
        And the original system was relatively mild, .6 degrees of
    deflection, you know, not repeated overrides of the pilot's
    command, and, you know, that was in the manual. But then the
    Boeing engineers changed it to 2\1/2\ degrees repeated
    overriding the pilot's decision, and asked the FAA to take it
    out of the manual. Now, that to me is shocking. It is in the
    first manual when it is a relatively mild system that kind of
    is similar to what we are going to--they are proposing with
    their fix, except it will have two angle-of-attack sensors
    input and other modifications.
        So how could the FAA agree to that? Did they understand
    what it did? Did anybody understand what this would do? I don't
    think the implications were fully known.
        There have been 14 versions of this plane since 1967. It
    has been an incredible workhorse airplane. You know, I have
    flown on one, I am sure, thousands of times. I have flown 6
    million miles since I have been in Congress, so many, many,
    many times. But at some point, you got to think there is a
    cutoff, where this is a new plane and it is different than the
    one from 1967. And it shouldn't just be an amended-type
    certificate, it has to go through recertification. Now, of
    course, that is a longer process. It is more expensive, it
    might require pilot retraining. And the question is, why didn't
    we get to that point with this plane? And that also goes for
    the longer term looking at the certification ODA process.
        Further, we discovered that the disagree light was
    inoperable in many of the planes, the ones that hadn't bought
    the extra package, apparently inadvertently, according to
    engineers. But this was not reported to FAA for a year. And
    until it became public, Boeing had no intention of fixing that
    till 2020. Could that have played a role in helping to prevent
    these tragedies? Well, we will never quite know that, will we?
    You know, that is unacceptable.
        And we have been in touch with both Boeing itself and
    United Technologies Corporation, who designed that software, to
    ask for a timeline and some explanation of how they think that
    is a proper procedure. You know, we are going to hear today
    from a number of people who are going to provide compelling
    testimony. I won't go through the list again, others have
    mentioned it. But I want to thank you for being here today.
        We have now begun to receive substantial numbers of
    documents from both Boeing and the FAA, and I have the
    oversight staff and the aviation staff going through those
    documents. And we will, I expect, fully expect, at a future
    hearing have the FAA back in and have Boeing in to this
    committee once we have the documentation digested that we need
    to ask the meaningful, very pointed questions we will ask.
        With that, I yield back the balance of my time.
        Mr. Larsen. Thank you, Chair DeFazio.
        I recognize the ranking member of the full committee,
    Representative Graves of Missouri.
        Mr. Graves of Missouri. Thank you, Mr. Chairman. And thank
    you and Ranking Republican Graves for having this hearing. And
    I also want to express my condolences to the families and
    friends of the accident victims.
        You know, today's hearing is going to focus on how to
    safely return the 737 MAX back to service. And this process, it
    has to be careful, it has to be deliberative, and all involved
    have to be absolutely laser focused on safety. I believe
    everyone at the FAA and at Boeing understand that to do
    anything less than that is absolutely unacceptable. We owe it
    to all of those who tragically lost their lives to get it
    right.
        As this process moves forward, input from the stakeholders,
    both in the United States and around the world, is going to be
    very important. And today, the subcommittee is going to hear
    from some of those stakeholders.
        As many of you know, I am extremely proud of our aviation
    system here in the United States, and much of that pride stems
    from how safe our system has been. And knowing how imperative
    it is that we maintain this record and reputation, for that
    matter, I want to share some of my thoughts on safely
    ungrounding the 737 MAX.
        First, the FAA's process to certify the 737 MAX--to certify
    the fix on the MAX, it has to be and will be a very intensive
    process. The FAA is going to conduct technical and operational
    reviews and assessments, simulator and flight testing. There is
    going to be evaluations and reevaluations and reevaluations on
    top of that. And they are also going to share information with
    and consider the comments and recommendations from the
    stakeholders that are out there. And ultimately, I anticipate
    that the FAA is going to issue multiple notices and multiple
    directives and orders.
        In addition, the Technical Advisory Board, or the TAB, and
    we will hear a lot of about that with experts on there from the
    FAA, from the U.S. Air Force, from NASA, from the Volpe
    National Transportation Systems Center, they are all going to
    conduct parallel and an independent review, and the FAA is
    going to consider their recommendations in this process.
        Boeing is going to need to demonstrate compliance with
    safety regulations and with the FAA directives. U.S. airlines
    are also going to have to demonstrate compliance with all FAA
    directives, and they will need to implement the required
    training across their fleets.
        Internationally, each country is going to have to make its
    own ungrounding decision. The FAA is going to share
    information, and they are going to provide assistance as it is
    requested. And I am glad that the FAA is working with the
    international regulators towards finding consensus regarding
    the certification and return to service the 737 MAX.
        The second thing is the FAA is working with Boeing, they
    are working with the airlines, they are working with pilots and
    international regulators, and they are going to determine what
    training is going to be required both prior to the ungrounding
    and as recurrent training obviously moves forward in this
    process. And I believe it is critically important that we avoid
    focusing primarily just on pilot training on the old MCAS
    system and what occurred in the two MAX accidents. Because
    there is real concern that training to the old system could
    result in negative training by unintentionally introducing or
    reinforcing outdated information or inapplicable concepts which
    could actually decrease safety, and they could, they could
    actually decrease safety.
        The third thing is, I think it is vitally important that we
    allow for the various investigations and reviews to run their
    full course before we take any legislative action. To act
    preemptively would only be--it is only going to be for optics.
    And for people to be able to say that we did something, that is
    what that would only be about, rather than solving what I think
    is an identifiable problem in our system. Aviation accidents
    rarely have one contributing factor. Those of us who fly, we
    know that. There is always a number of investigations, and
    there are a number of investigations that are looking at the
    certification of the 737 MAX. And if problems are found, I do
    believe that they have to be addressed.
        But in reading the preliminary accident reports as well as
    obviously many others with a lot of flying experience, many
    have raised concerns with the pilot training, with pilot
    experience, with aircraft maintenance, and definitely with
    airline operations. And all of these issues have to be
    investigated and they have to be reviewed. To ignore any
    possible factor or to jump to any predetermined conclusions
    about those factors, it creates the risk of future accidents
    that could have been prevented by full and thorough
    investigations.
        And my final thing is we have to avoid politicizing our
    aviation system. Safety is what the core--it is absolutely at
    the core of what every pilot, every flight attendant, every air
    traffic controller, engineer, repairman, manufacturer, every
    inspector, every operator, and every regulator strives for each
    and every day. It is the reason why in the last decade here in
    the United States there have been nearly 7 billion passengers
    on 90 million commercial flights with 1 fatality. That is a
    heck of a record for the FAA and the aviation community in the
    United States, and it is a heck of a record to be very proud
    of.
        And certainly, one loss of life is one too many. But that
    unprecedented safety record is due to the safety culture of the
    aviation industry, which includes a collaborative and
    nonpunitive approach to certification and safety oversight. And
    we must uphold that strong safety culture and that reputation.
        Over the next few months, the FAA and Boeing are going to
    work hard at ensuring that the safe return of the 737 MAX, that
    it is safely returned to service. And their progress is
    obviously going to be very closely monitored, not only by this
    committee, but by the entire world. But I can say without any
    hesitation that I believe that the Acting Administrator of the
    FAA, that I believe him when he said that the FAA will return
    the 737 MAX to service in the United States only--only when it
    determines, based on the facts and technical data, that it is
    safe to do so. Only then will it happen.
        So, again, I want to thank you, Chairman, for having this
    hearing, and I would yield back the balance.
        [Mr. Graves of Missouri's prepared statement follows:]

      Prepared Statement of Hon. Sam Graves, a Representative in Congress
         from the State of Missouri, and Ranking Member, Committee on
                       Transportation and Infrastructure
        Thank you, Chairman Larsen and Ranking Member Graves, for holding
    this hearing.
        I would also like to again express my condolences to the friends
    and families of the accident victims.
        The focus of today's hearing is how to safely return the 737 MAX to
    service. This process must be careful and deliberative, and all
    involved must be laser-focused on safety. I believe everyone at the FAA
    and Boeing understand that to do anything less is absolutely
    unacceptable.
        We owe it to all those who tragically lost their lives to get this
    right.
        As this process moves forward, input from stakeholders, both in the
    United States and around the world, is very important. Today the
    Subcommittee will hear from some of those stakeholders.
        As many of you know, as a pilot I am extremely proud of our
    aviation system in the U.S., and much of that pride stems from how safe
    our system has been. Knowing how imperative it is that we maintain this
    record and reputation, I want to share some of my thoughts on safely
    ungrounding the 737 MAX.
        First, the FAA's process to certify the 737 MAX fix must be--and
    will be--intensive. The FAA will conduct technical and operational
    reviews and assessments, simulator and flight testing, and evaluations
    and reevaluations. They will also share information with, and consider
    comments and recommendations from, stakeholders. Ultimately, I
    anticipate that the FAA will issue multiple notices, directives, and
    orders.
        In addition, the Technical Advisory Board (TAB), with experts from
    the FAA, the U.S. Air Force, NASA, and the Volpe National
    Transportation Systems Center will conduct a parallel and independent
    review, and the FAA will consider their recommendations.
        Boeing will need to demonstrate compliance with safety regulations
    and FAA directives. U.S. airlines will also have to demonstrate
    compliance with FAA directives, and they will need to implement
    required training across their fleets.
        Internationally, each country will make its own ungrounding
    decision, and the FAA will share information and provide assistance as
    requested.
        I am glad that the FAA is working with international regulators
    towards finding consensus regarding the certification and return to
    service of the 737 MAX.
        Second, the FAA is working with Boeing, airlines, pilots, and
    international regulators, and will determine what training will be
    required, both prior to the ungrounding and as recurrent training going
    forward.
        I believe it is critically important that we avoid focusing pilot
    training on the old MCAS system and what occurred in the two MAX
    accidents. There is a real concern that training to the old system
    could result in negative training by unintentionally introducing or
    reinforcing outdated information or inapplicable concepts, which could
    actually decrease safety.
        Third, it is vitally important that we allow the various
    investigations and reviews to run their course before we take
    legislative action. To act preemptively would only be for optics--for
    people to be able to say we did something--rather than solving an
    identifiable problem in our system.
        Aviation accidents rarely have one contributing factor. There are a
    number of investigations looking at the certification of the 737 MAX,
    and if problems are found they must be addressed. But, in reading the
    preliminary accident reports I, as well as many others with flying
    experience, have also raised concerns with pilot training, pilot
    experience, aircraft maintenance, and airline operations. All of these
    issues must also be investigated and reviewed.
        To ignore any possible factor or to jump to predetermined
    conclusions about those factors creates the risks of future accidents
    that could have been prevented by full and thorough investigations.
        Finally, we must avoid politicizing aviation safety. Safety is at
    the core of what every pilot, flight attendant, controller, engineer,
    repairman, manufacturer, inspector, operator, and regulator strives for
    each and every day. It is the reason that in the last decade in the
    United States, there have been nearly 7 billion passengers on 90
    million commercial flights, with only one fatality. That is a heck of a
    record for the FAA and aviation community in the U.S. to be proud of.
    Certainly, one life lost is one too many, but that unprecedented safety
    record is due to the safety culture of the aviation industry, which
    includes the collaborative, non-punitive approach to certification and
    safety oversight. We must uphold that strong safety culture.
        Over the next few months, the FAA and Boeing will be hard at work
    ensuring the safe return to service of the 737 MAX. Their progress will
    be closely monitored not only by this committee but by the world. But I
    can say without any hesitation that I believe the Acting Administrator
    of the FAA when he said, ``the FAA will return the 737 MAX to service
    in the United States only when [it] determine[s], based on facts and
    technical data, that it is safe to do so.''
        Thank you again for holding today's hearing.

        Mr. Larsen. Thank you, Representative Graves.
        I want to now welcome our witnesses. I am not going to read
    titles and biographies, but we will have Sharon Pinkerton from
    A4A; Captain Dan Carey of Allied Pilots; Captain Chesley
    Sullenberger, retired pilot; Sara Nelson from the AFA-CWA; and
    Honorable Randy Babbitt, former Administrator, FAA.
        And I recognize each of you for 5 minutes. Without
    objection, though, our witnesses' full statements will be
    included in the record. Since it has been made part of the
    record, we request you limit your oral testimony to 5 minutes.
        And first, we will recognize Sharon Pinkerton for 5
    minutes.

         TESTIMONY OF SHARON PINKERTON, SENIOR VICE PRESIDENT,
       LEGISLATIVE AND REGULATORY POLICY, AIRLINES FOR AMERICA;
      CAPTAIN DANIEL CAREY, PRESIDENT, ALLIED PILOTS ASSOCIATION;
       CAPTAIN CHESLEY B. ``SULLY'' SULLENBERGER III, PILOT, US
       AIRWAYS (RETIRED); SARA NELSON, INTERNATIONAL PRESIDENT,
      ASSOCIATION OF FLIGHT ATTENDANTS--CWA, AFL-CIO; AND HON. J.
       RANDOLPH BABBITT, FORMER ADMINISTRATOR, FEDERAL AVIATION
                             ADMINISTRATION

        Ms. Pinkerton. Good morning. Chairman DeFazio, Ranking
    Member Graves, Chairman Larsen, Ranking Member Graves, thank
    you for having this hearing today. My name is Sharon Pinkerton.
    I am the senior vice president for policy at Airlines for
    America. It is an honor and privilege to be here today to talk
    about aviation safety. Nothing is more fundamental to this
    industry than a commitment to safety.
        U.S. carriers have led the world in aviation safety for
    decades, and we are very proud of that record, but the events
    that are bringing us here today have humbled us. These are
    sobering tragedies. And as an industry, as Americans, as human
    beings, we mourn the lost lives on Lion Air flight 610 and
    Ethiopian Airlines flight 302.
        I want to convey, not just our condolences, but also our
    industry's commitment to support policies and actions that are
    going to help ensure the highest level of aviation safety.
        Our industry doesn't simply shrug off failures like this;
    we fixate on root and proximate causes in order to learn from
    what happened, and take that knowledge to better ensure the
    safety of our passengers and crew.
        As an industry, we are constantly challenging ourselves to
    meet and exceed the highest levels of safety. It has to be said
    that travel on U.S. passenger carriers remains exceptionally
    safe, as the committee knows, because you have played a role in
    shaping this system. We have flown almost 8 billion people on
    94 million flights over the last 10 years. And in that time,
    there was one fatality, and although that is too many, our
    record is remarkable.
        Commercial aviation remains the safest mode of
    transportation by a wide margin, but we cannot and we will not
    rest on the status quo, and that is our promise to you and to
    the families that are here.
        As you know, several authorities are still reviewing the
    two overseas accidents. It is important to allow those
    investigations to conclude before rendering final judgment. But
    we know from experience that there are usually several factors,
    not just one, that contribute to any accident. While we wait
    for the findings and recommendations, Boeing has taken
    responsibility and pledged to make improvements by updating the
    flight control software. Our response must be deliberate, rely
    on facts and data, before we form recommendations, which is how
    the FAA is approaching these accidents.
        The FAA's safety and regulatory framework is the gold
    standard in the world, and our safety record is the proof of
    that. We have a culture of collaboration in aviation where
    everyone throughout the system, public and private employees,
    manufacturers, carriers, everyone is encouraged to speak up and
    speak out if they see a potential safety issue.
        The industry does work closely with the FAA, and we believe
    that a transparent and collaborative relationship is critical
    to making the safest aviation system in the world even safer.
        Our safety record is the result of deliberate and systemic
    improvements over many years. We have moved from an early 1990s
    very forensic approach, looking back to determine what
    happened, to a very proactive and predictive data-driven
    approach to determine that anticipates and prevents accidents
    before they occur.
        It was really in the mid-1990s that the industry and the
    FAA started to rely more on data: data from the plane, data
    from our employees, data from the controllers. The Commercial
    Aviation Safety Team, or CAST, was formed to give all of the
    players, labor unions, operators in the FAA, manufacturers, a
    seat at the table to share information. And the 1996 FAA bill
    provided protection to entities to help create a safe
    environment for that information sharing. The Aviation Safety
    Information Analysis and Sharing program, otherwise known as
    ASIAS, represents the overarching program that connects all of
    the FAA's safety programs and shares data from across those
    programs and uses that information to identify risk and develop
    mitigation strategies.
        What is extraordinary about how this industry approaches
    data sharing, it is unique to the aviation mode. Aviation data
    is not proprietary. We don't compete. We communicate and we
    collaborate when it comes to safety.
        With respect to the impacts of the grounding of the MAX on
    passengers, there were three U.S. carriers that were operating
    the MAX when the aircraft was grounded in March; those carriers
    immediately began reassigning existing resources to minimize
    disruption passengers. Fortunately, carriers were able to
    accommodate over 99 percent of impacted travelers through
    rebooking and rerouting.
        Of course, the question still remains, when will the MAX be
    returned to service? And the answer is, not before the FAA,
    working with our pilots, certifies that it is safe, and not
    before adequate training is performed.
        The FAA, working closely with our pilots unions, our
    technical experts----
        Mr. Larsen. Ms. Pinkerton, I am going to have to ask you to
    wrap up.
        Ms. Pinkerton [continuing]. And Boeing, is engaging in a
    rigorous process.
        I will close by saying safety is something not that our
    industry doesn't take for granted, and we never will. For us in
    the aviation community, our hearts break for the family
    members. However, we take solace in the fact that there are
    dedicated professionals, both public and private, that will do
    everything they can to maintain our tremendous safety record
    and build on it moving forward.
        Thank you.
        [Ms. Pinkerton's prepared statement follows:]

        Prepared Statement of Sharon Pinkerton, Senior Vice President,
            Legislative and Regulatory Policy, Airlines for America
        Chairman Larsen, Ranking Member Graves, Members of the Committee,
        Before I begin, on behalf of our industry, I would like to offer
    both profound and heartfelt condolences to the families, friends and
    loved ones of the passengers and crew members aboard both Lion Air 610
    and Ethiopian Airlines 302 as well as our commitment to actions and
    policies to help ensure the highest level of aviation safety. Our
    hearts and thoughts are with them.
        My name is Sharon Pinkerton and I am the Senior Vice President of
    Legislative and Regulatory Policy for Airlines for America (A4A). Thank
    you for the opportunity to testify. We welcome and appreciate the
    opportunity to discuss our most important and paramount priority,
    aviation safety.
        Nothing is more foundational to our industry than our deep
    commitment to safety; it is an ingrained second nature that touches
    every aspect of our global industry. The entire aviation community
    understands that safety is the bedrock upon which consumer confidence
    is built. When it comes to safety, our baseline is perfection. When
    perfection is not attained, it is critical we undertake a methodical
    and deliberate review of all the components of our extremely complex
    and technical system to make sure we isolate problems and identify the
    fixes necessary to make our system better. As an industry, we look
    forward to playing a constructive role in building upon and improving
    the tremendous safety record we have all worked so hard to achieve.
    That's why the flying public can have tremendous confidence in the U.S.
    airline industry today. We have an unparalleled safety record that any
    other industry--let alone any other mode of transportation--should
    envy. We must not lose sight of the fact that aviation is THE safest
    mode of transportation by any measure.
                         aviation safety--facts matter
        Safety of our passengers and employees is at the core of U.S.
    airline operations and everything we do. The unprecedented safety
    record of U.S. carriers has been the result of deliberate and systemic
    improvements over many years. We've moved from a forensic approach of
    determining what happened in aviation accidents to a proactive, data-
    driven approach which identifies risks and hazards aimed at preventing
    accidents before they occur.
        The nation's impressive commercial aviation safety record is due in
    large part to the aviation industry and government voluntarily
    investing in calculated safety enhancements to further reduce the
    nearly infinitesimal fatality risk in U.S. commercial air travel. For
    example, the work of the Commercial Aviation Safety Team (CAST) data
    driven regulations, and other industry safety activities, contributed
    to reducing the fatality risk for commercial aviation in the U.S. by 83
    percent from 1998 to 2008. Today, the CAST aims to reduce the remaining
    risk (50 percent) by 2025 by further leveraging industry data and
    analytical tools from the Aviation Safety Information Analysis and
    Sharing Program (ASIAS). These efforts and others like them have helped
    the U.S. achieve the safest period in its history.
        Because there are few commercial aviation accidents and no common
    causes, more data points are needed. Voluntary programs such as the
    Aviation Safety Action Program (ASAP), Flight Operational Quality
    Assurance (FOQA) program and Air Traffic Safety Action Program (ATSAP)
    give air carriers and the government insight into millions of
    operations so potential systemic safety issues and trends can be
    identified.
        Together with our industry partners, the FAA and labor, we identify
    and manage risk through several collective efforts and those voluntary
    programs. For example, the ASAP encourages voluntary reporting of
    safety issues and events that come to the attention of pilots, cabin
    crew, mechanics and dispatchers. ASAP is based on a safety partnership
    that includes the FAA, the certificate holder and employee labor
    organizations. Employees report instances of noncompliance and safety
    concerns without fear of recrimination. ASAP reports are analyzed and
    evaluated, and corrective measure are taken by the industry to address
    the safety concerns raised.
        Similarly, CAST and ASIAS represent long-standing commitments to
    building safety partnerships between government and industry that focus
    on pursuing safety improvements in a collaborative and proactive
    manner. ASIAS connects a wide variety of voluntarily provided safety
    data from airline aircraft performance data and safety reports as well
    as other information sources from across industry. The ASIAS program
    works closely with a variety of integrated safety teams to analyze
    safety data, identify risks and develop mitigation strategies. The
    program continues to evolve but has matured to the point that it now
    incorporates voluntarily provided safety data from operators that
    represent 99 percent of U.S. air carrier operations in the National
    Airspace System (NAS).
        While any loss of any life is tragic, the odds of suffering a
    fatality are far greater as a pedestrian, riding a bike, being a
    passenger in a car or even being struck by lightning, based on data
    from the collaborative efforts between government and industry to
    improve aviation safety.
        We strongly believe the FAA's safety and regulatory framework is
    the gold standard in the world, and our U.S. safety record demonstrates
    its success. As an industry, we will continue to adapt to change;
    identify new risks and hazards; collectively and collaboratively
    analyze risk; develop mitigation strategies; and continue to make the
    safest airspace system in the world even safer. Our continued success
    depends on these strong partnerships built on trust.
                    industry impact, assessment and response
        For A4A member airlines that operated the 737 MAX, the FAA decision
    to ground the aircraft created several immediate operational
    challenges. These challenges were most acute at the onset of the
    grounding as carriers were forced to make quick operational decisions
    to accommodate passengers and adjust schedules. The extent of the
    necessary adjustments varied based on overall fleet size, segments
    operated, available spare aircraft and other factors. Below is a table
    showing the 737 MAX aircraft in U.S. airline fleets as of March 31,
    2019:

    ------------------------------------------------------------------------
                 U.S. Airline                 737 MAX Fleet as of 3/31/19
    ------------------------------------------------------------------------
    Southwest                              34
    American                               24
    United                                 14
    ------------------------------------------------------------------------
      Subtotal USA                         72
    ------------------------------------------------------------------------

        Impacted carriers immediately started a process of forensically
    analyzing their individual operations for available aircraft to cover
    flight segments in order to minimize customer disruption as much as
    possible. While each carrier dealt with the situation in a manner
    consistent with their respective business, in general, the industry
    employed an array of mechanisms to cope with the disruptions, including
    but not limited to:
          Trimmed 2019 capacity growth;
          Incorporated spare aircraft into the active schedule;
          Increased daily utilization of other aircraft types;
          Deferred some painting, Wi-Fi installation/upgrades, and
    selected other discretionary enhancements;
          Reduced frequency on longer routes where alternative
    routings were practicable;
          Temporarily suspended lighter routes;
          Leveraged automated rebooking tools (99 percent of
    passengers rebooked within 24 hours); and
          Consideration of leasing additional aircraft or deferring
    retirements.
        In the initial days after the grounding, it was unclear how long
    the aircraft would remain grounded. Given the uncertainty, carriers
    made schedule adjustments in order to accommodate the loss of the
    aircraft for three- to four-week periods. Many of those short-term
    plans have now been extended for months. The lack of certainty remains
    to this day, which means carriers will have to continuously revisit
    schedules and operational plans as the situation progresses. The bottom
    line is that impacted air carriers will do everything they can to make
    sure customers are accommodated.
        Fleet management is a continual challenge. As the Committee knows,
    U.S. airlines have been making significant upgrades to their fleets
    over the past decade, which means new aircraft are coming on-line every
    day, including several 737 MAX. In addition to the scheduling
    accommodations made for existing aircraft, carriers have had to adjust
    flight schedules and service plans based on the unknown delivery
    schedule. Following is a table of 737 MAX orders for A4A members as of
    March 31, 2019:

    ------------------------------------------------------------------------
        A4A Member Airline                On Order as of 3/31/2019
    ------------------------------------------------------------------------
    Southwest                   268 (44 in the remainder of 2019)
    American                    76 (16 in the remainder of 2019)
    United                      171 (16 in the remainder of 2019)
    Alaska                      32 (3 in the remainder of 2019)
    ------------------------------------------------------------------------
      Subtotal USA              515 (76 in the remainder of 2019)
    ------------------------------------------------------------------------
    Air Canada                  37 (12 in the remainder of 2019)
    ------------------------------------------------------------------------

        As indicated, several dozen 737 MAX aircraft were slated for
    delivery between the date of the grounding and the remainder of the
    year, and the return of the aircraft is generally not expected in time
    for the peak summer travel season. In fact, A4A has projected summer
    2019 air travel on U.S. airlines to rise for the tenth consecutive year
    to an all-time high of 257.4 million passengers (2.8 million per day).
    The more 737 MAX time is built into the schedule, the more aircraft
    time is needed to cover lost availability. A4A estimates 737 MAX-
    related summer flying reductions of approximately 250 daily flights and
    43,000 daily seats for American, Southwest and United alone. This
    pulldown in capacity is likely to put upward pressure on load factors.
        The high load factors and use of spare aircraft for active flying--
    to partially offset the void left by the grounded MAX fleet--will make
    irregular operations caused by severe weather or other factors more
    difficult to mitigate. Carriers are preparing accordingly and will
    continue to be as nimble as possible to provide a seamless operation,
    capitalizing on investments in equipment, staff and training made over
    the past several years.
                   airworthiness--return to service decision
        As noted, there is currently significant uncertainty related to the
    timeline upon which the 737 MAX will be approved to return to service.
    However, we recognize and agree that a full and robust process of
    analyzing and testing any software design and training requirements is
    of the utmost importance and the first step toward re-establishing
    public confidence. Boeing has indicated they have put the software
    update through hundreds of hours of analysis, laboratory testing,
    verification in a simulator, and test flights. As the industry
    continues to await guidance from Boeing and the FAA on the impending
    737 MAX software enhancements and training requirements, we are
    encouraged by the reported progress and proposed path forward for
    returning the aircraft to service. We are confident that, once
    certified by the FAA, the proposed enhancements will support the safe
    operation of the MAX--making the aircraft one of the safest in the sky.
    We are confident in our employees, procedures, airplanes, training,
    maintenance, and performance monitoring systems. Boeing has said that
    the software update will provide another layer of safety to the
    operation of the MAX aircraft. We look forward to the FAA's final
    guidance and will fully comply with any modifications and additional
    training requirements to strengthen the reliability of the 737 MAX.
        We fully expect the 737 MAX eventually will be deemed airworthy and
    will return to service. When that decision is made, each carrier will
    take specific steps based on its operations, maintenance and training
    programs. In fact, much of the planning has been on-going since the
    initial removal from service. Multiple departments at the airlines
    including aircraft maintenance, training, crew planning and scheduling
    as well as network planning and scheduling have roles in returning the
    aircraft to service. While specific timing may vary, generally, once
    the 737 MAX is approved for return to service several steps will be
    taken, including but not limited to:
          Necessary modifications to software and/or physical
    installations resulting from the Maneuvering Characteristics
    Augmentation System (MCAS) review must be implemented, completed and
    inspected;
            While A4A members who operate the 737 MAX support the
    findings of the FAA Flight Standards Board (FSB) for Level B training
    and checking for the MCAS system, we are awaiting a release of training
    guidance and will review and comment once that training guidance has
    been issued.
          Assurance that aircraft are in compliance with all
    current Airworthiness Directives that may have been issued or that
    became due during the out-of-service period;
          Assurance that any calendar-scheduled maintenance tasks
    are accomplished;
          Accomplish all pre-flight service checks per applicable
    maintenance manuals;
          Review the aircraft's Maintenance Logbook and execute an
    Airworthiness Release for flight; and
          Execute any required maintenance flight tests.
        We are confident that the collaborative global process the FAA has
    undertaken will eventually lead to a decision that will be supported by
    manufacturers, operators, pilots and foreign regulatory bodies as well
    as the flying public. The FAA has been transparent with international
    regulators throughout this process by sharing their safety response to
    these accidents as well as their data and testing. Make no mistake, it
    will take a significant amount of work, but a collaborative message and
    understanding will go a long way toward building public confidence in
    the aircraft. We look forward to playing a constructive role in that
    process.
                                 recommendation
        We believe it is more important than ever that we make fact-based
    data-driven decisions when it comes to policy toward our aviation
    safety system. Our industry has learned over the decades to wait for
    ongoing investigations to conclude before rushing to judgment. Our
    aviation system is safer than ever, and the U.S. commercial aviation
    safety record is second to none.
        Our safety record has evolved over decades with collaboration
    between the FAA, manufacturers, air traffic controllers, pilots,
    operators and many others. An open culture of effective collaboration
    should not be misconstrued with coziness. There is no doubt or
    disagreement that a balance is needed when it comes to a regulator and
    the industry it oversees, but factual assessment of the results
    achieved by that relationship should weigh heavily on the minds of
    those so anxious to change it. Airlines do not compete when it comes to
    safety. Safety is simply not something anyone in our industry takes for
    granted, and it never will.
        Mr. Chairman, I would be remiss not to take the opportunity to
    thank you for your work on H.R. 1108, the Aviation Funding Stability
    Act of 2019. We sincerely appreciate the Committee's leadership and
    focus on practical solutions to mitigate federal shutdown impacts. As
    you know, the impact of government shutdowns is particularly acute on
    the aviation industry. With a robust FAA Airport and Airway Trust Fund
    balance there is absolutely no reason that thousands upon thousands of
    people should be forced to work without pay. As we look down the barrel
    of yet another controversial budget and funding season--we will
    continue to support your efforts. The systemic approach to improving
    aviation safety means you fixate on and reduce risk across all
    components. I think we can all agree, taking government shutdowns out
    of the picture will certainly improve our system.
        Thank you for the opportunity to testify. I look forward to your
    questions.

        Mr. Larsen. Thank you.
        Captain Carey, 5 minutes as well. Be sure, everyone, that
    you are pulling the microphone right up to your mouth.
        Captain Carey, 5 minutes. Thank you.
        Mr. Carey. Good morning, Chairman Larsen, Ranking Member
    Mr. Graves of Missouri, Chairman DeFazio, Ranking Member Mr.
    Graves of Louisiana, honorable members of this committee. My
    name is Captain Daniel Carey. I am a 35-year career pilot at
    American Airlines. I am also president of the Allied Pilots
    Association, the largest independent airline pilots union in
    the world.
        I also serve as a member of the board of the Coalition of
    Airline Pilots Associations here in Washington, a trade group
    representing 32,000 professional airline pilots whose concern
    is safety and security of the traveling public.
        The piloting profession is in my family. My father and two
    uncles were fighter pilots in World War II, one of whom lost
    his life in the service of our Nation. My father was an early
    pioneer with Trans World Airlines, and my daughter pursues a
    professional career as a commercial pilot today.
        I would also like to recognize the family of Samya Stumo,
    who is here today. God bless you all. Samya was a young woman
    as well, pursuing her career and young life, and tragically
    lost her life on ET 302.
        Mr. Chairman and members of the committee, what brings us
    together today is the tragic accidents of two Boeing MAX
    aircraft. We owe it to those 346 souls and the flying public
    around the world to make sure these kinds of events never
    happen again.
        In my 35-year career at American Airlines, I have operated
    as captain on five different types of airplanes, 28 years on
    Boeing aircraft. I am here to tell you, Boeing designs and
    engineers and manufactures superb aircraft.
        Unfortunately, in the case of the MAX, I will have to agree
    with the Boeing CEO, they let the traveling public down in a
    fatal and catastrophic way. As said here earlier by some of the
    speakers, we will await the conclusion of the several
    investigations underway around the world before we determine
    the final judgment of the MAX disasters.
        There are a few facts we do know. The MAX was designed to
    provide the same aircraft feel as the 737. This was intended to
    minimize costs to Boeing's customers by allowing the MAX to be
    certified as a 737 typed aircraft. This led Boeing engineers to
    add the MCAS system. Many mistakes were subsequently made by
    Boeing, as the MCAS was designed as a federated, not an
    integrated aircraft system.
        As a single port of failure, this design meant that the
    redundancy of the system went back to the captain and first
    officer of the aircraft. The huge error of omission was the
    fact that Boeing failed to disclose the existence of the MCAS
    system to the pilot community around the world. The final fatal
    mistake was, therefore, the absence of robust pilot training in
    the event of an MCAS failure.
        The most important issue now is the question of the
    airworthiness of the MAX aircraft. I believe the Boeing
    engineers have indeed found the problems to the software
    problems--issues facing the MAX. And, therefore, the
    redundancies are now embedded in the aircraft in the event of a
    misfiring of the MCAS going forward. However, at APA, we remain
    concerned about whether the new training protocol, materials,
    and methods of instruction suggested by Boeing are adequate to
    ensure that pilots across the Nation and around the world can
    operate the MAX fleet with absolute and complete safety.
        In fact, during a meeting with the FAA in April, the FAA
    officials highlighted a critical checklist that Boeing directed
    pilots to use to recover the MAX after an MCAS firing. The FAA
    officials stated that this critical checklist had not been
    validated since 1967. This is an example of why the APA has
    integrated into the flight standardization board comments,
    calling for the review, improvement, and training of critical
    MCAS misfire recovery checklists.
        I don't have all the answers today, nobody does, but I do
    have some questions. First, is the FAA sufficiently independent
    of the manufacturers as to provide legitimately rigorous audit
    of manufacturing design and engineering? Second, should a
    federated system, which may lead to an unrecoverable event, be
    certified ever by the FAA? Third, should the FAA aircraft
    certification, as for example, a 737 designation from 1967,
    have a timeline or a sunset date? Finally, is the FAA
    sufficiently equipped to ensure that pilot training protocols
    are vigorous and robust as aircraft become more and more
    sophisticated?
        Mr. Chairman, these are among the questions that I hope
    this committee examines, and of course, there are many others.
    Unfortunately, as pilots know, improvements in aviation are
    often, too often, written in the blood of the unfortunate
    victims of these airplane accidents. But all of us--pilots,
    flight attendants, airline companies, manufacturers, the
    executive branch of our government, and Congress--owe it to the
    victims at the highest level of diligence to make sure these
    kind of accidents never happen again.
        This is a global aviation crisis of trust and will require
    global solutions to restore and bolster culture and respect----
        Mr. Larsen. I am going to have to ask you to wrap up.
        Mr. Carey. The pilots of the Allied Pilots Association are
    humbled and proud to be part of this noble cause. Thank you,
    and I look forward to your questions.
        [Mr. Carey's prepared statement follows:]

     Prepared Statement of Captain Daniel Carey, President, Allied Pilots
                                  Association
        Good morning, Chairman Larsen and Ranking Member Mr. Graves of
    Louisiana. Good morning, Chairman DeFazio and Ranking Member Mr. Graves
    of Missouri. Good morning to you, Honorable Members of the Committee.
        My name is Daniel Carey. I am a 35-year career captain with
    American Airlines and president of the Allied Pilots Association. The
    Allied Pilots Association is the largest independent pilot union in the
    world. I am not just privileged, but honored to represent the 15,000
    professional men and women pilots of American Airlines. I can tell you
    that they are an outstanding group of professional pilots dedicated to
    ensuring the safe passage of all people who fly on American Airlines in
    our country and around the world. I am also a member of the board of
    the Coalition of Airline Pilots Associations, a trade association
    representing 32,000 professional pilots dedicated to airline safety and
    security.
        The piloting profession is in my DNA. My father and two uncles were
    distinguished World War II fighter pilots who served our nation, one of
    whom gave his life. My father was also an early pilot pioneer for Trans
    World Airlines. My daughter, his granddaughter, continues the family
    tradition as a commercial pilot.
        Mr. Chairman and Members of the Committee, what brings us together
    today are the tragic accidents involving two Boeing 737 MAX aircraft.
    The hearts of all our 15,000 American Airlines pilots go out to the
    families, friends and associates of the 346 souls lost in the Lion Air
    and Ethiopian Air crashes. We owe it to those lost souls and to the
    flying public, worldwide, to make sure these kinds of events never
    happen again.
        In my 35-year career at American Airlines, I have flown as Captain
    in five models of American's aircraft with more than 28 years on Boeing
    aircraft. My professional view is that the Boeing Corporation has
    manufactured superbly engineered and designed aircraft over many
    decades. Unfortunately, in the matter of the 737 MAX, I completely
    agree with the Boeing CEO's assessment that the company let down the
    public with catastrophic consequences.
        As professional pilots, we understand that the ultimate conclusion
    regarding the causes of these accidents must await the final findings
    of the exhaustive investigations underway.
        There are certain facts we know:
        1.  The 737 MAX was designed to provide the same aircraft feel to
    the pilots as the 737. This was intended to minimize the operating cost
    to Boeing's customers by allowing the MAX to be certified by the FAA as
    a 737. The point was to provide Boeing's customers with a new advanced
    aircraft while minimizing the training cost associated with a different
    aircraft certification. This led Boeing's engineers to add the MCAS
    system. Many mistakes were subsequently made by Boeing engineers as
    MCAS was designed as a ``federated'' not ``integrated'' system. As a
    single-point-of-failure design, this meant that any redundancy to the
    system, if it failed, was completely dependent on the Captain and First
    Officer of the aircraft.
        2.  The huge error of omission is that Boeing failed to disclose
    the existence of MCAS to the pilot community.
        3.  The final fatal mistake was, therefore, the absence of robust
    pilot training in the event that the MCAS failed.
        I can tell you that the members of APA are offended by remarks made
    by those who seem to blame the pilots killed in those two crashes. Some
    negative aspersions have appeared in the press relating to the quality
    of pilots trained in Africa. I am here to tell you that I worked in
    Africa and trained African pilots to fly large aircraft. I am very
    familiar with Ethiopian Air's pilot training program and facilities,
    and I can tell you that they are world-class. In fact, while not one
    U.S. airline has a MAX simulator, one non-U.S. airline does--Ethiopian
    Air. To make the claim that these accidents would not happen to U.S.-
    trained pilots is presumptuous and not supported by fact. Vilifying
    non-U.S. pilots is disrespectful and not solution-based, nor is it in
    line with a sorely needed global safety culture that delivers one
    standard of safety and training. Simply put, Boeing does not produce
    aircraft for U.S. pilots vs. pilots from the rest of the world.
        The most important issue now is the question of the airworthiness
    of the 737 MAX fleet. I believe that the Boeing engineers have indeed
    made significant positive changes with the new software fixes, many of
    which our pilots demanded when we met with Boeing officials in November
    2018. There are now redundancies embedded in the aircraft in the event
    of the ``firing'' of MCAS. However, at APA we remained concerned about
    whether the new training protocol, materials and method of instruction
    suggested by Boeing are adequate to ensure that pilots across the globe
    flying the MAX fleet can do so in absolute complete safety.
        In fact, during a meeting with the FAA on April 12, 2019, with U.S.
    airlines and pilot unions, FAA officials highlighted a critical
    checklist that Boeing directed pilots to use to recover the MAX after
    an MCAS misfire. The FAA official stated that this critical checklist
    had not been validated since 1967, noting that the 737 has been
    dramatically modified many times since. The FAA official cited
    potential issues with pilot ``manual trim effort'' required and
    challenging ``elevator loads'' confronting pilots when this checklist
    is executed. This is an example of why APA's comments to the Flight
    Standardization Board include calling for a review, improvement and
    training of critical MCAS misfire recovery checklists.
        With regard to the public policy issues generated by the fatal MAX
    crashes, the foremost and most urgent, in my view, is assessment of the
    adequacy of the FAA aircraft certification process. This is a complex
    subject because the certification process is extremely sophisticated.
    So, I do not have all the answers about ways to improve the FAA
    aircraft certification process, but I do have some questions:
        1.  First, is the FAA sufficiently independent of the manufacturers
    so as to provide a legitimately rigorous audit of the manufacturers'
    design and engineering?
        2.  Second, should a ``federated'' system, which may lead to an
    unrecoverable event, ever be certified by the FAA?
        3.  Third, should an FAA aircraft certification--such as a 737
    designation from 1967--have a date for termination or sunset?
        4.  Finally, is the FAA sufficiently equipped to ensure that pilot
    training protocols are vigorous and robust as aircraft are becoming
    more and more technologically sophisticated?
        Mr. Chairman, these are among the questions that I respectfully
    hope this committee examines. Of course, there are many others as well.
    Unfortunately, as pilots know, improvements in aviation are often
    written in the blood of the unfortunate victims of airplane accidents.
    But all of us--the pilots, flight attendants, airline companies,
    manufacturers, the executive branch of our government, and Congress--
    owe those victims the highest level of diligence to make sure these
    kinds of accidents never happen again.
        This is a global aviation crisis of trust and will require global
    solutions to restore and bolster aviation's global safety culture and
    reputation. As sad and grim as these crashes were, there is an
    opportunity to lead and bring something positive out of this darkness.
    As the last line of defense for our passengers, the members of the
    Allied Pilots Association are humbled and proud to be a part of this
    noble cause.
        Thank you and I look forward to your questions.

        Mr. Larsen. Thank you.
        The Chair now recognizes Captain Chesley B. Sullenberger
    III, for 5 minutes.
        Mr. Sullenberger. Thank you, Chairman Larsen, Ranking
    Member Graves, Chairman DeFazio, Ranking Member Graves, and
    other members of the committee. It is my honor to appear today
    before this Subcommittee on Aviation. Like Americans and many
    others around the world, I am shocked and saddened by these two
    awful tragedies and terrible loss of life.
        I just met the parents of 24-year-old Samya Stumo, and I
    saw in their eyes the incomprehensible immensity of their loss.
    These crashes are demonstrable evidence that our current system
    of aircraft design and certification has failed us. These
    accidents should never have happened. The accident
    investigations of these crashes will be not completed but for
    many months, but some things are clear, accidents are the end
    result of a causal chain of events, but in this case, the chain
    began with decisions that had been made years before to update
    a half-century-old design.
        Boeing added MCAS, but the existence of it was not
    communicated to pilots until after the first crash. Some have
    said that even though MCAS software had flaws, the pilots on
    these flights should have performed better and been able to
    solve the sudden, unanticipated crisis they faced. Boeing has
    said that they did not categorize a failure of MCAS as more
    critical because they assumed that pilot action would be the
    safeguard.
        From my 52 years of flying experience and my many decades
    of safety work, I know that we must consider all the human
    factors of these accidents and how system design determines how
    many and what kinds of errors will be made and how
    consequential they will be. These two recent crashes happened
    in foreign countries. But if we do not address all the
    important issues and factors, they can and will happen here.
        We owe it to everyone who flies, passengers and crews
    alike, to make sure that pilots will be able to handle an
    unexpected emergency and keep their passengers and crew safe,
    but first, we should design aircraft for them to fly that do
    not have inadvertent traps set for them.
        I am one of a relatively small group of people who have
    experienced such a crisis and lived to share what we learned
    about it. I can tell you firsthand that the startle factor is
    real and it is huge. It absolutely interferes with one's
    ability to quickly analyze the crisis and take effective
    action.
        Within seconds, these crews would have been fighting for
    their lives in the fight of their lives. In both 737 MAX
    accidents, the failure of a single angle-of-attack sensor
    quickly caused multiple instrument indication anomalies and
    sudden loud and in some cases false warnings, creating major
    distractions, masking the cause, and would have made it even
    harder to quickly analyze the situation and take effective
    corrective action.
        I recently experienced all these warnings in a 737 MAX
    flight simulator during recreations of the accident flights.
    Even knowing what was going to happen, I could see how crews
    could have run out of time before they could have solved the
    problems.
        Prior to these accidents, I think it is unlikely that any
    U.S. airline pilots were confronted with this scenario in
    simulator training. We must make sure that everyone who
    occupies a pilot seat is fully armed with the information,
    knowledge, training, skill, judgment and experience to be the
    absolute master of the aircraft and all its component systems
    and of the situation simultaneously and continuously throughout
    the flight.
        As aviation has become safer, we can no longer define
    safety solely as the absence of accidents. We must do much more
    than that, we must be more proactive than that. In essence, we
    must investigate accidents before they happen. We should all
    want pilots to experience these challenging situations for the
    first time in a simulator and not in flight with passengers and
    crew on board. And reading about it on an iPad is not even
    close to sufficient. Pilots must experience it physically
    firsthand.
        If we don't learn from these crashes, if we just file the
    findings away on a shelf to gather dust, we will only compound
    these tragedies. We will make the loss of lives in these
    accidents even more tragic if we say that these were just black
    swan events, unlikely to happen again, and decide not to act
    and, instead, just protect the status quo.
        Only by discovering and correcting the ways in which these
    tragedies occurred can we begin to regain the trust of our
    passengers, flight attendants, pilots, and the American people.
        [Mr. Sullenberger's prepared statement follows:]

     Prepared Statement of Captain Chesley B. ``Sully'' Sullenberger III,
                          Pilot, US Airways (Retired)
        Thank you, Chairman Larsen, Ranking Member Graves, Chairman
    DeFazio, Ranking Member Graves, and other members of the committee. It
    is my honor to appear today before the Subcommittee on Aviation.
        We are here because of the tragic crashes within five months of
    Lion Air 610 and Ethiopian 302, two fatal accidents with no survivors
    on a new aircraft type, something that is unprecedented in modern
    aviation history.
        Like most Americans and many others around the world I'm shocked
    and saddened by these two awful tragedies and the terrible loss of
    life. Now we have an obligation to find out why these tragic crashes
    happened, and keep them from ever happening again.
        These crashes are demonstrable evidence that our current system of
    aircraft design and certification has failed us.
        We don't yet know in every way how it has failed us. Multiple
    investigations are ongoing. We owe it to everyone who flies to find out
    where and how the failures occurred, and what changes must be made to
    prevent them from happening in the future.
        It is obvious that grave errors were made that have had grave
    consequences, claiming 346 lives.
        The accident investigations of these crashes will not be completed
    for many months, but some things are already clear.
        Accidents are the end result of a causal chain of events, and in
    the case of the Boeing 737 MAX, the chain began with decisions that had
    been made years before, to update a half-century-old design.
        Late in the flight testing of the 737 MAX, Boeing discovered an
    aircraft handling issue. Because the 737 MAX engines were larger than
    the engines on previous 737 models they had to be mounted higher and
    farther forward for ground clearance, which reduced the aircraft's
    natural aerodynamic stability in certain conditions. Boeing decided to
    address the handling issue by adding a software feature, Maneuvering
    Characteristics Augmentation System (MCAS), to the 737 MAX. MCAS was
    made autonomous, able in certain conditions to move a secondary flight
    control by itself to push the nose down without pilot input.
        In adding MCAS, Boeing added a computer-controlled feature to a
    human-controlled airplane but without also adding to it the integrity,
    reliability and redundancy that a computer-controlled system requires.
        Boeing also designed MCAS to look at data from only one Angle of
    Attack (AOA) sensor, not two. One result of this decision was that it
    allowed false data from a single sensor to wrongly trigger the
    activation of MCAS, thus creating a single point of failure. A single
    point of failure in an aircraft goes against widely held aircraft
    design principles.
        On both accident flights, the triggering event was a failure of an
    AOA sensor. We do not yet know why the AOA sensors on these flights
    generated erroneous information, triggering MCAS, whether they were
    damaged, sheared off after being struck, were improperly maintained or
    repaired, or for some other reason.
        Boeing designers also gave MCAS too much authority, meaning that
    they allowed it to autonomously move the horizontal stabilizer to the
    full nose-down limit.
        And MCAS was allowed to move the stabilizer in large increments,
    rapidly and repeatedly until the limit was reached. Because it moved
    stabilizer trim intermittently, it was more difficult to recognize it
    as a runaway trim situation (an uncommanded and uncontrolled trim
    movement emergency), as appears to have happened in the first crash.
        Though MCAS was intended to enhance aircraft handling, it had the
    potential to have the opposite effect; being able to move the
    stabilizer to its limit could allow the stabilizer to overpower the
    pilots' ability to raise the nose and stop a dive toward the ground.
    Thus it was a trap that was set inadvertently during the aircraft
    design phase that would turn out to have deadly consequences.
        Obviously Boeing did not intend for this to happen. But to make
    matters worse, even the existence of MCAS, much less its operation, was
    not communicated to the pilots who were responsible for safely
    operating the aircraft until after the first crash.
        Also with the MAX, Boeing changed the way pilots can stop
    stabilizer trim from running when it shouldn't. In every previous
    version of the 737, pilots could simply move the control wheel to stop
    the trim from moving, but in the MAX, with MCAS activated, that method
    of stopping trim no longer worked. The logic was that if MCAS
    activated, it had to be because it was needed, and pulling back on the
    control wheel shouldn't stop it.
        It is clear that the original version of MCAS was fatally flawed
    and should never have been approved.
        It has been suggested that even if the MCAS software had flaws, the
    pilots on these flights should have performed better and been able to
    solve the sudden unanticipated crises they faced. Boeing has even said
    that in designing MCAS they did not categorize a failure of MCAS as
    critical because they assumed that pilot action would be the ultimate
    safeguard.
        We owe it to everyone who flies, passengers and crews alike, to do
    much better than to design aircraft with inherent flaws that we intend
    pilots will have to compensate for and overcome.
        Pilots must be able to handle an unexpected emergency and still
    keep their passengers and crew safe, but we should first design
    aircraft for them to fly that do not have inadvertent traps set for
    them.
        We must also consider the human factors of these accidents.
        From my 52 years of flying experience, and my many decades of
    safety work--I know that nothing happens in a vacuum, and we must find
    out how design issues, training, policies, procedures, safety culture,
    pilot experience and other factors affected the pilots' ability to
    handle these sudden emergencies, especially in this global aviation
    industry.
        Dr. Nancy Leveson, of the Massachusetts Institute of Technology,
    has a quote that succinctly encapsulates much of what I have learned
    over many years: ``Human error is a symptom of a system that needs to
    be redesigned.''
        These two recent crashes happened in foreign countries, but if we
    do not address all the important issues and factors, they can and will
    happen here. To suggest otherwise is not only wrong, it's hubris.
        As one of our preeminent human factors scientists, Dr. Key
    Dismukes, now retired as Chief Scientist for Human Factors at the NASA
    Ames Research Center, has said, ``Human performance is variable and it
    is situation-dependent.''
        I'm one of the relatively small group of people who have
    experienced such a sudden crisis--and lived to share what we learned
    about it. I can tell you firsthand that the startle factor is real and
    it is huge--it interferes with one's ability to quickly analyze the
    crisis and take effective action.
        Within seconds, these crews would have been fighting for their
    lives in the fight of their lives.
        These two accidents, as well as Air France 447 which crashed in the
    South Atlantic in June 2009, are also vivid illustrations of the
    growing level of interconnectedness of devices in aircraft. Previously,
    with older aircraft designs, there were mostly stand-alone devices, in
    which a fault or failure was limited to a single device that could
    quickly be determined to be faulty and the fault remain isolated. But
    with integrated cockpits and data being shared and used by many
    devices, a single fault or failure can now have rapidly cascading
    effects through multiple systems, causing multiple cockpit alarms,
    cautions and warnings, which can cause distraction and increase
    workload, creating a situation that can quickly become ambiguous,
    confusing and overwhelming, making it much harder to analyze and solve
    the problem.
        In both 737 MAX accidents, the failure of an AOA sensor quickly
    caused multiple instrument indication anomalies and cockpit warnings.
    And because in this airplane type the AOA sensors provide information
    to airspeed and altitude displays, the failure triggered false warnings
    simultaneously of speed being too low and also of speed being too fast.
    The too slow warning was a `stick-shaker' rapidly and loudly shaking
    the pilot's control wheel. The too fast warning was a `clacker',
    another loud repetitive noise signaling overspeed. These sudden loud
    false warnings would have created major distractions and would have
    made it even harder to quickly analyze the situation and take effective
    corrective action.
        I recently experienced all these warnings in a 737 MAX flight
    simulator during recreations of the accident flights. Even knowing what
    was going to happen, I could see how crews could have run out of time
    and altitude before they could have solved the problems.
        Prior to these accidents, I doubt if any U.S. airline pilots were
    confronted with this scenario in simulator training.
        We must make sure that everyone who occupies a pilot seat is fully
    armed with the information, knowledge, training, skill, experience and
    judgment they need to be able to be the absolute master of the aircraft
    and all its component systems, and of the situation, simultaneously and
    continuously throughout a flight.
        As aviation has become safer, it has become harder to avoid
    complacency. We have made air travel so safe and routine, some have
    assumed that because we haven't had a lot of accidents in recent years
    we must be doing everything right.
        But we can no longer define safety solely as the absence of
    accidents. We must do much more than that; we must be much more
    proactive than that.
        We need to proactively find flaws and risks and mitigate them
    before they lead to harm.
        We must investigate accidents before they happen.
        Each aircraft manufacturer must have a comprehensive safety risk
    assessment system that can review an entire aircraft design
    holistically, looking for risks, not only singly, but in combination.
        We must also look at the human factors and assumptions made about
    human performance in aircraft design and certification, and pilot
    procedure design.
        In addition to fixing MCAS in a way that resolves all the many
    issues with it, including that the AOA Disagree light be made operative
    on all Max aircraft, we must greatly improve the procedures to deal
    with uncommanded trim movement, provide detailed system information to
    pilots that is more complete, give pilots who fly the 737 MAX
    additional Level D full flight simulator training so that they will
    see, hear, feel, experience and understand the challenges associated
    with MCAS, such as Unreliable Airspeed, AOA Disagree, Runaway
    Stabilizer and Manual Trim. They must have the training opportunity to
    understand how higher airspeeds greatly increase the airloads on the
    stabilizer, making it much more difficult to move manually, often
    requiring a pilot to use two hands, or even the efforts of both pilots
    to move it. And in some cases, how it cannot be moved at all unless the
    pilot flying temporarily stops trying to raise the nose and relieves
    some of the airloads by moving the control wheel forward.
        Pilots must develop the muscle memory to be able to quickly and
    effectively respond to a sudden emergency. Reading about it on an iPad
    is not even close to sufficient; pilots must experience it physically,
    firsthand.
        We should all want pilots to experience these challenging
    situations for the first time in a simulator, not in flight with
    passengers and crew on board.
        We must look closely at the certification process. There have been
    concerns about the aircraft certification process for decades. Just a
    brief search revealed 18 reports produced by GAO, DOT OIG, and
    Congressional committees since 1992.
        Many questions remain to be and must be answered:
        Has the Federal Aviation Administration (FAA) outsourced too much
    certification work?
        Should FAA be selecting the manufacturer employees who do
    certification work on behalf of FAA, instead of the employer, as is
    currently the case?
        Did oversight fail to result in accountability?
        Do the Federal Aviation Administration (FAA) employees and Boeing
    employees doing certification work have the independence they need to
    ensure safe designs?
        Was there a failure to identify risks and their implications?
        Was the analysis of failure modes and effects inadequate?
        How was it that critically important information was not
    effectively communicated and shared with airlines and pilots?
        Many other questions must be asked about the role Boeing played in
    these accidents:
        Was there a leadership failure?
        A governance failure?
        An engineering failure?
        A risk analysis failure?
        A safety culture failure?
        Whistle-blower protection must be strong and effective, and if it
    is not strong enough, we must strengthen it.
        Key leaders and members of each safety-critical aviation
    organization must have subject matter expertise; in other words, they
    must be pilots who understand the science of safety. There should be at
    least one person so qualified on each corporate board of directors of
    each aviation company. Top project engineers of aircraft manufacturers
    must also be pilots.
        Airlines worldwide must adhere to the highest standards of aircraft
    maintenance and crew training.
        All the layers of safety must be in place. They are the safety net
    that helps keep air travelers and crews from harm.
        Only by investigating, discovering, and correcting the ways in
    which our design, certification, training and other systems have failed
    us and led to these tragedies can we begin to regain the trust of our
    passengers, flight attendants, pilots and the American people. And, of
    course, in order for passengers to trust that the 737 MAX is safe to
    fly, pilots will have to trust that it is.
        We have a moral obligation to do this.
        If we don't--if we just file the findings away on a shelf to gather
    dust, we will compound these tragedies. What would make the loss of
    lives in these accidents ever more tragic is if we say these were black
    swan events, unlikely to happen again, and decide not act on what we
    learn from them. To protect the status quo.
        The best way to honor the lives tragically lost is to make sure
    that nothing like this ever happens again.

        Mr. Larsen. Thank you, Captain Sullenberger.
        I now recognize Sara Nelson, Ms. Nelson, for 5 minutes.
        Ms. Nelson. Thank you, Chairman DeFazio, Ranking Member
    Graves, Chairman Larsen, Ranking Member Graves, and the entire
    committee, for the opportunity to testify on the issues
    surrounding the Boeing 737 MAX.
        As a 23-year flight attendant and international president
    of the Association of Flight Attendants--CWA, AFL-CIO,
    representing nearly 50,000 of aviation's first responders at 20
    airlines, I am here today because the public looks to flight
    attendants when it comes to aviation safety. We are aviation's
    first responders and last line of defense, and we have more
    public contact and interaction than any other profession within
    aviation, and the public trusts us to look out for their
    interests.
        We are all here today because 346 lives were lost on Lion
    Air flight 610 and Ethiopian Airlines flight 302. This hearing
    room has many people in it who have lost loved ones due to
    tragedy in aviation. We can see their faces, feel the warmth of
    their smiles, and try with all our strength to carry on without
    them. Some days we do this with more success than others.
        But we also know, with certainty, that if there was
    anything at all that we could have done to prevent their lives
    being cut short, we would do it. This reality is inescapable.
    We know that aviation safety and security is written in their
    blood, and we must ensure their sacrifices mean that we fully
    examine the chain of events that led to their death so that
    this is never repeated.
        As I stated on March 13, shortly after the grounding of the
    737 MAX, lives must always come first. But a brand is at stake
    as well, and that brand is not just Boeing, it is America. What
    America means in international aviation and by extension in the
    larger world more generally, that we set the standard for
    safety, competence, and honesty in governance of aviation.
        Under various agreements between the FAA and other
    countries or groups of countries, foreign authorities agree to
    work with the FAA to accept U.S. certification of aircraft and
    manufactured aeronautical products. This system of
    international aircraft certification has been built upon global
    recognition of the FAA and its statutory mandate to maintain
    safety at the highest possible level. This is now under
    question, and it means that the FAA must ensure that it has
    taken all measures to assure the safety of the 737 MAX within
    the U.S. as well as all countries who must also approve the
    aircraft for its return to service.
        Both Boeing and the FAA seem to recognize the need to win
    back public support and the importance of involving
    stakeholders in the process. Over the course of the last
    several months, our union has witnessed a chastened tone from
    Boeing and what appears to be a real desire to regain trust.
    This is critically important if remaining questions are to be
    answered and stakeholders around the world are to be convinced
    that the 737 MAX is safe to fly.
        It is significant that the FAA has formed the Technical
    Advisory Board and that they are engaging the rest of the world
    and conducting a rigorous review of the software fix and full
    accounting of human interaction with the functionality of the
    plane. The fix must be rigorously tested and communicated with
    utmost transparency and required training. And while this is
    not an area of expertise for our union, flight attendants must
    be assured that operators, pilots, regulators, and an
    independent assessment is confident in the safe return to
    flight. We put our own lives on the line when we return to
    flight, and we will do so knowing all has been done to ensure
    safety.
        We are heartened to receive assurance that Acting
    Administrator Elwell is working in close coordination with
    worldwide regulators in returning the MAX to service. Mr.
    Elwell's time in leadership has not been easy, and yet he is
    tasked with securing the confidence of regulators around the
    world and the traveling public, and we need to do all we can to
    help him.
        Questions remain, but we believe that the FAA's engagement
    of all stakeholders is the right leadership approach. We
    encourage both Boeing and regulators to continue efforts with
    stakeholders to answer all the questions and communicate fully
    the lessons learned, along with any necessary changes in
    procedure.
        Flight attendants take our role in aviation seriously. And
    while we are not yet there, we look forward to assuring the
    public that it is safe to return to flight.
        We continue to receive questions from the traveling public
    about the 737 MAX, and there is confusion about the progression
    of the 737 aircraft models. It is common for crew to receive
    questions, when working the 737 NG, about whether or not the
    aircraft is safe. This signals the fundamental question about
    the progression of the 737 aircraft models and whether or not
    the MAX should have been designated as an entirely new aircraft
    type. And this is the type of question that has to be answered
    if we can regain public confidence. I should also note that we
    do not have one question from flight attendants asking when we
    will regain the flight hours that we have lost with the 737
    MAX, because safety is nonnegotiable.
        We believe that we need to take a close look at ODA and the
    process for certification, and we also think that this
    committee's work to ensure a review of cabin aircraft
    certification in the FAA Reauthorization Act of 2018 is
    critically important. We believe that funding and ensuring a
    government shutdown----
        Mr. Larsen. I would ask, Ms. Nelson, to wrap up.
        Ms. Nelson [continuing]. Never happens again is critically
    important, and we support H.R. 1108 to ensure that doesn't
    happen.
        Again, we commend this committee for its diligence in
    promoting aviation safety, and we look forward to the continued
    leadership from Acting Administrator Elwell in promoting a 737
    MAX return to service that inspires confidence among aviation
    workers, our counterparts around the world, and the traveling
    public.
        Thank you.
        [Ms. Nelson's prepared statement follows:]

    Prepared Statement of Sara Nelson, International President, Association
                       of Flight Attendants--CWA, AFL-CIO
        Thank you Chairman DeFazio, Chairman Larsen, Ranking Member Sam
    Graves, and Ranking Member Garret Graves for the opportunity to testify
    on the issues surrounding the Boeing 737 Max. My name is Sara Nelson,
    International President of the Association of Flight Attendants--CWA,
    AFL-CIO (AFA), representing nearly 50,000 of aviation's first
    responders at 20 airlines.
        As I said on March 13th shortly after the U.S. grounding of the
    737Max,
            ``It is good news that the 737 MAX will now get the focus it
            needs to address the concerns of undetermined safety issues. We
            must focus on the needed fix, rather than the uncertainty of
            flight. Lives must come first always. But a brand is at stake
            as well. And that brand is not just Boeing. It's America. What
            America means in international aviation and by extension in the
            larger world more generally--that we set the standard for
            safety, competence, and honesty in governance of aviation.''
        I am here today because the public looks to flight attendants when
    it comes to aviation safety. We are aviation's first responders and
    last line of defense. We have more public interaction than any other
    profession within aviation, and the public trusts us to look out for
    their interests.
        That is why both Boeing and the Federal Aviation Administration
    (FAA) have individually come to our union to engage us in discussions
    about our concerns and the process to return the 737 MAX to service.
        Both Boeing and the FAA deserve credit for recognizing the need to
    win back public support and the importance of involving stakeholders in
    this process. The truth is that these tragic incidents and the
    revelations surrounding them have shaken the public trust in our entire
    aviation system due to the decisions made by Boeing during the original
    certification process, the slow and inadequate response in the wake of
    the loss of Lion Air flight 610 and Ethiopian Airlines flight 302, and
    the questions surrounding FAA oversight throughout.
        Over the course of the last several months our union has witnessed
    a chastened tone from Boeing and what appears to be a real desire to
    regain trust. This is critically important if remaining questions are
    to be answered and stakeholders around the world are to be convinced
    the 737 Max is safe to fly.
        It is significant that the FAA formed the Technical Advisory Board,
    with individuals not involved in any aspect of the Boeing 737 MAX
    certification including NASA, the U.S. Air Force and Volpe National
    Transportation Systems Center, to evaluate Boeing and FAA efforts
    related to Boeing's software update and its integration into the 737
    MAX flight control system. We are also heartened to receive assurance
    from Acting Administrator Elwell that certification of the 737 Max is
    being done in close coordination with world-wide regulators under the
    most conservative approach and all of the time necessary to regain
    public trust around the world.
        Regaining that trust first and foremost requires transparency.
    Congressional oversight is important, and we commend this Committee for
    its diligence in investigating the events surrounding the loss of 346
    lives, and what must be done to ensure this never happens again.
        We recognize the efforts of both Boeing and the FAA for seeking our
    input and help in reassuring the public. Questions remain, but we
    believe this is the right leadership approach. We encourage both Boeing
    and regulators to continue efforts with stakeholders to answer all
    questions and communicate fully the lessons learned along with any
    necessary changes in procedures. Flight Attendants take seriously our
    role in aviation safety. While we are not there yet, we look forward to
    being able to reassure the public when this process is complete.
                                questions remain
        On May 15, 2019, the House Transportation and Infrastructure
    Committee held a hearing on the ``Status of the Boeing 737 MAX.'' In
    their opening remarks,\1\ Committee Chair Peter DeFazio and Aviation
    Subcommittee Chair Rick Larsen addressed the importance of this and
    subsequent hearings and investigations by this Committee and other
    investigative bodies into the two fatal accidents that occurred in a
    five month span of time and involved Boeing 737 MAX airplanes.
    ---------------------------------------------------------------------------
        \1\ House Committee on Transportation and Infrastructure, Chairs
    DeFazio, Larsen Statements from Hearing on ``Status of the Boeing 737
    MAX'', May 15, 2019. https://transportation.house.gov/news/press-
    releases/chairs-defazio-larsen-statements-from-hearing-on-status-of-
    the-boeing-737-max, accessed June 12, 2019.
    ---------------------------------------------------------------------------
        Chair Larsen noted, ``[i]f the public doesn't feel safe about
    flying then they won't fly; if they don't fly, airlines don't need to
    buy airplanes; if they don't need to buy airplanes, then airplanes
    don't need to be built; and if there is no need to build the airplanes,
    then there will be no jobs . . . the foundation of the U.S. aviation
    system is safety.'' Clearly, AFA and the aviation industry agree that
    the ``foundation of the U.S. aviation system is safety.'' Without
    safety, the commercial aviation system our economy is so reliant upon
    today would simply not exist, and neither would tens of thousands jobs
    held by flight attendants, pilots, dispatchers, maintenance
    technicians, baggage handlers, customer service representatives, the
    list goes on and on.
        In his opening remarks on May 15, Chair DeFazio remarked on the
    historical process the Federal Aviation Administration (FAA) has used
    to approve airplane designs, noting that ``[s]ince the 1950s, the FAA
    has relied on a system of delegating certain certification authorities
    to manufacturers. And it has done so safely. However, for years, I have
    raised questions about how the FAA oversees the work of manufacturers
    that have been delegated these responsibilities.'' Some of the
    questions Chair DeFazio asked regarding FAA oversight include the
    following: ``Does the FAA have sufficient resources to oversee the
    delegation program? Does the FAA have enough internal expertise to
    oversee the most sophisticated engineering work in the world? What
    firewalls exist between manufacturers and its FAA-designated
    representatives to ensure proper oversight and that there is no undue
    influence placed on them?''
        Obtaining comprehensive answers to these questions through an open,
    transparent public investigative process will be the first step to
    addressing the concerns of crew members and the traveling public
    regarding the safety of commercial aviation. Equally critical to
    ensuring confidence is the effectiveness of any subsequent legislative
    and regulatory measures taken in response to identified shortcomings.
    This process will be long and resource intensive, but it is absolutely
    critical that it be done right to guarantee that the foundation of the
    U.S. aviation system continues to be safety.
        On March 10, 2019, the Association of Flight Attendants released a
    statement regarding the crash of Ethiopian Airlines Flight 302 and
    called on U.S. airlines to ``work with Boeing, the FAA, and the NTSB to
    address concerns and take steps to ensure confidence for the traveling
    public and working crews.'' In a March 11, 2019 letter addressed to
    Acting FAA Administrator Dan Elwell, AFA recommended a comprehensive,
    public review of all potential issues that may have contributed to the
    two tragic accidents involving Flight 302 and last October's Lion Air
    Flight 610 accidents. We noted at the time that these reviews should
    consider at minimum the ``certification basis, maintenance practices,
    operational procedures, and crew training aspects of the 737 MAX
    program.''
                              certification issues
        The 737 MAX program is not the first recent Boeing aircraft to face
    intense scrutiny of its design certification process following a
    safety-related incident. In January, 2013, an auxiliary power unit
    (APU) lithium-ion battery on a Japan Airlines Boeing 787-8 caught fire,
    which led to the grounding of the U.S. 787 fleet, an investigation by
    the National Transportation Safety Board (NTSB), and modifications to
    the main and APU batteries. In its November, 2014 final report \2\ on
    the 787 APU battery incident, the NTSB noted several safety issues that
    occurred during the design certification process. These issues bear
    troubling similarities to problems that may have occurred during
    certification of the 737 MAX as alleged in recent media reports.
    ---------------------------------------------------------------------------
        \2\ NTSB, Incident Report--Auxiliary Power Unit Battery Fire, Japan
    Airlines Boeing 787-8, JA829J, Boston, Massachusetts, January 7, 2013,
    Adopted November 21, 2014. https://www.ntsb.gov/investigations/
    AccidentReports/Reports/AIR1401.pdf, accessed June 12, 2019.
    ---------------------------------------------------------------------------
        For example, the NTSB stated that the Boeing battery analyses ``did
    not consider the possibility that cascading thermal runaway of the
    battery could occur as a result of a cell internal short circuit.''
    This may have reflected a lack of imagination, with unfortunately
    severe economic consequences for Boeing. A lack of imagination during
    the 737 MAX certification process may have led to far more tragic
    consequences. A June 1, 2019 article in the New York Times \3\ states
    that while some potential failures of the MCAS were flight-tested, the
    one test not conducted was activation of the MCAS ``as a result of a
    faulty angle-of-attack sensor--a problem in the two [Lion Air and
    Ethiopian Airlines] crashes.''
    ---------------------------------------------------------------------------
        \3\ New York Times, Boeing Built Deadly Assumptions Into 737 Max,
    Blind to a Late Design Change, June 1, 2019. https://www.nytimes.com/
    2019/06/01/business/boeing-737-max-crash.html, accessed June 12, 2019.
    ---------------------------------------------------------------------------
        The NTSB report also stated that there was insufficient guidance
    provided in ``determining and justifying key assumptions in safety
    assessments'' for the 787 batteries. Boeing had assumed that ``an
    internal short circuit within a cell would be limited to venting of
    only that cell without fire.'' The NTSB report noted that the
    ``assessment did not explicitly discuss this key assumption or provide
    the engineering rationale and justifications to support the assumption.
    Also, as demonstrated by the circumstances of this incident, Boeing's
    assumption was incorrect, and Boeing's assessment did not consider the
    consequences if the assumption were incorrect or incorporate design
    mitigations to limit the safety effects that could result in such a
    case.'' The June 1, 2019 New York Times article suggests that incorrect
    assumptions by Boeing engineers working on the 737 MAX design may have
    also occurred: ``Current and former employees at Boeing and the Federal
    Aviation Administration who spoke with The New York Times said they had
    assumed the system [MCAS] relied on more sensors and would rarely, if
    ever, activate. Based on those misguided assumptions, many made
    critical decisions, affecting design, certification and training.''
        The NTSB 787 battery report also noted that insufficient guidance
    was provided to FAA certification engineers whose role was to ensure
    compliance with certification requirements: ``Guidance to FAA
    certification staff at the time that Boeing submitted its application
    for the 787 type certificate, including FAA Order 8110.4, `Type
    Certification,' did not clearly indicate how individual special
    conditions should be traced to compliance deliverables (such as test
    procedures, test reports, and safety assessments) in a certification
    plan.'' Similarly, the June 1, 2019 New York Times article appears to
    suggest that insufficient guidance provided to FAA engineers during the
    certification process may have also contributed to the flawed 737 MAX
    safety assessment: ``Regulators didn't conduct a formal safety
    assessment of the new version of MCAS. The current and former
    employees, many of whom spoke on the condition of anonymity because of
    the continuing investigations, said that after the first crash, they
    were stunned to discover MCAS relied on a single sensor. `That's nuts,'
    said an engineer who helped design MCAS. `I'm shocked,' said a safety
    analyst who scrutinized it. `To me, it seems like somebody didn't
    understand what they were doing,'' said an engineer who assessed the
    system's sensors.' ''
        Another issue that may have impacted the 737 MAX certification
    process arises from conflicts of interest due to inappropriate
    relationships between regulator and regulated party. An example of how
    a personal relationship has affected oversight was discussed on March
    27, 2019 by the Department of Transportation (DOT) Inspector General
    (IG) in testimony to Congress.\4\ He made the following points
    regarding the relationship one inspector had with the regulated party,
    an airline: ``FAA guidance recognizes the impact that a single
    inspector can have on safety culture and establishes standards that
    require inspectors to act impartially and avoid the appearance of
    preferential treatment when they perform their official duties.
    Nonetheless, our recent work identified concerns regarding an FAA
    inspector's oversight of [an airline's] flight test program, which is
    used to verify the airworthiness of aircraft following major repairs.
    We found that an inspector had developed a personal relationship with
    the head of the carrier's flight test program and appeared to give the
    carrier preferential treatment when safety concerns were raised. The
    inspector also worked with the carrier to suppress future complaints.
    Ensuring that FAA's inspector workforce meets standards of impartiality
    remains a key oversight challenge for the Agency to strengthen its
    safety culture and effectively identify and mitigate risks.'' Compare
    this to the following from the June 1, 2019 New York Times 737 MAX
    article: ``On March 30, 2016 . . . [the 737 MAX chief technical pilot]
    sent an email to senior F.A.A. officials with a seemingly innocuous
    request: Would it be O.K. to remove MCAS from the pilot's manual? The
    officials, who helped determine pilot training needs, had been briefed
    on the original version of MCAS months earlier. . . . Under the
    impression that the system was relatively benign and rarely used, the
    F.A.A. eventually approved . . . [the] request, the three officials
    said. . . . [The chief technical pilot], a former F.A.A. employee, was
    at the front lines of this effort.''
    ---------------------------------------------------------------------------
        \4\ DOT/OIG, Perspectives on Overseeing the Safety of the U.S. Air
    Transportation System, Statement of Calvin L. Scovel, III, Inspector
    General, U.S. Department of Transportation, Before the Committee on
    Commerce, Science, and Transportation, Subcommittee on Aviation and
    Space, United States Senate, March 27, 2019. https://www.oig.dot.gov/
    sites/default/files/Aviation%20Safety%20Long%20Statement_3-27-
    19_final.pdf, accessed June 12, 2019.
    ---------------------------------------------------------------------------
        The close relationship between the FAA, airplane manufacturers and
    airlines can be seen in how the FAA has changed policy over the years
    regarding design changes and its certification requirement that an
    airplane with a passenger seating capacity of more than 44 seats can be
    evacuated from the airplane to the ground within 90 seconds, often
    referred to as the 90 second rule.
        Design standards are used in the design phase of a project, and can
    be verified while the product, in this case, an airplane, ``is still on
    the drawing board.'' i.e., before the airplane is built. Performance
    standards evaluate the performance of the product, often under the
    influence of factors that cannot be effectively integrated or evaluated
    during the design. Typically, a performance standard involves a test of
    the product after it is built. In the case of a full scale evacuation
    demonstration (a performance standard) of an airplane, the factors that
    must be evaluated are the performance of the passengers and crew.
        Clearly, the original intent of the evacuation demonstration was to
    show the satisfactory accomplishment of emergency evacuation
    procedures. The final rule reinforced this intent and required
    airlines, as a Part 121 operational requirement, to conduct evacuation
    demonstrations. (30 FR 3200, March 9, 1965).
        The following year, FAA Notice 66-26 (31 FR 10275, July 29, 1966)
    proposed to establish comparable requirements for the airplane
    manufacturers. This notice stated that `` . . . traditionally, it has
    been considered sufficient to provide the necessary components for
    emergency evacuation through detailed quantitative requirements
    prescribed in the airworthiness rules. However, experience has shown
    that compliance with these requirements does not ensure that the
    airplane can be evacuated, during an emergency, within an acceptable
    time interval. Differences in the relationships between elements of the
    emergency evacuation system introduce a considerable variation in
    evacuation time, and this variation is expected to be even more marked
    on larger transport aircraft under development.'' Thus, it was
    acknowledged that relationships between the various elements of the
    evacuation system, not just the elements themselves, had a critical
    influence on evacuation time. In other words, the whole was
    considerably more complicated than the sum of its parts. Since the
    manufacturer would be demonstrating the basic capability of a new
    airplane type without regard to crewmember training, operating
    procedures and similar items (such demonstration of procedures was
    still required under Part 121, the operational requirements), this new
    demonstration was not expected to validate the evacuation procedures of
    the air carriers or operators. FAA Notice 66-26 also proposed that once
    a manufacturer had successfully conducted an evacuation demonstration
    for a particular airplane type, the passenger seating capacity could be
    increased by no more than five percent if the manufacturer could
    substantiate, by analysis that all the passengers could be evacuated
    within the prescribed time limit. This appears to be the first proposal
    to suggest the use of ``analysis'' in lieu of full-scale evacuation
    testing. However, this analysis was intended to provide comparison with
    the full-scale evacuation actually conducted on the airplane. These
    proposals were adopted as a final rule (32 FR 13255, September 20,
    1967).
        The tests conducted by operators to show satisfactory
    accomplishment of emergency evacuation procedures and by manufacturers
    to show that the aircraft interior configuration and the relationship
    between the elements of its emergency evacuation system could be
    evacuated within a specified time period were allowed to be satisfied
    under a single test under Amendment 25-46 (43 FR 50578, October 30,
    1978). Under this amendment, the FAA also stated that ``A combination
    of analysis and tests may be used to show that the airplane is capable
    of being evacuated within 90 seconds under the conditions specified in
    25.803(c) of this section if the Administrator finds that the
    combination of analysis and tests will provide data with respect to the
    emergency evacuation capability of the aircraft equivalent to that
    which would be obtained by actual demonstration.'' The FAA recognized
    the problems with this new provision and in its discussion of it
    concluded that: ``Several commentators objected to the proposed
    amendment to 25.803(d) which would allow analysis in showing that the
    airplane is capable of being evacuated within 90 seconds. One
    commentator stated that analysis alone is an incomplete means of
    showing compliance and should not be allowed. Another commentator
    stated that extrapolations based on analytical testing have no
    practical relation to actual conditions which occur in accidents and
    evacuation demonstrations. The FAA agrees that the limitations on the
    use of analytical procedures should be made clear. The requirement that
    the Administrator find the analysis data acceptable was intended to
    preclude approvals which might be based on insufficient test data, such
    as in the case of a completely new model or a model which has major
    changes or a considerably larger passenger capacity than a previously
    approved model'' (Italics ours.)
        Despite this intent, the FAA granted a request from Boeing to
    remove a pair of exits from the B747 airplane in the early 1980's. AFA
    strongly protested this action that would make it more difficult for
    flight attendants to safely evacuate passengers from the airplane.
        In a 1985 hearing before the U.S. House of Representatives
    Subcommittee on Investigations and Oversight of this Committee
    (formerly named Public Works and Transportation Committee) and its
    Chairman, James Oberstar, AFA testified and presented data and past
    accident experience to illustrate our concerns, as well as those of
    passengers, with this emergency exit reduction. The FAA Administrator
    took steps that resulted in no US airline removing exits from their
    747s, and at this hearing, suggested that a reassessment of regulations
    pertaining to emergency evacuation of transport airplanes was
    warranted. Consequently, an Emergency Evacuation Task Force, open to
    the public, for that purpose was established in September, 1985. The
    continued use of full-scale emergency evacuation demonstrations was one
    of the matters considered by that task force. One of the presentations,
    by Boeing, suggested that a rudimentary analytical procedure be used in
    lieu of full scale demonstrations. Basically, the manufacturers favored
    analysis, while the representatives of people who flew on the
    airplanes, either as crewmembers or passengers, opposed analysis. The
    task force was unable to reach consensus on when to accept analysis in
    lieu of a demonstration. A similar process was undertaken by an
    advisory committee to the FAA in the 1990s with the same failure to
    reach consensus.
        The procedures used by the flight attendants in a full scale
    emergency evacuation certification demonstration are intended to become
    the baseline procedures for the aircraft type and model tested. This
    was the reason for the promulgation of the 1965 rule requiring
    operators to conduct full scale emergency evacuation demonstrations.
    These procedures are found in the Flight Standardization Board Report
    for each type and model of aircraft. Yet some demonstrations conducted
    since 1996 have utilized a procedure, with FAA allowance, that makes it
    easier for the manufacturer to pass the test, but it is not a procedure
    that is used by U.S. scheduled operators. The intent of the regulation
    requiring full scale evacuation demonstrations is not being carried out
    by the FAA.
        The analytical method does little more than calculate that, if the
    design standards are met, the aircraft could be evacuated within the
    requirements of the performance standard. Since the design requirements
    were intended to provide an airplane capable of being evacuated within
    the requirements of the performance standard, use of the analytical
    method is redundant.
        Analysis is not a method that can predict failure of an emergency
    evacuation system, unlike a full-scale demonstration utilizing
    appropriate evacuation procedures.
        The result of the FAA's policy and of the currently inadequate
    ``state of the art'' analytical methods accepted under the policy, is
    that the first full scale evacuation of a new airplane will be
    performed by the traveling public under emergency conditions rather
    than by paid test subjects under the controlled test conditions of a
    demonstration. There is no assurance that the evacuation would be
    successful. For this reason, the FAA should be required to rescind its
    policy of allowing the use of analysis in lieu of the full-scale
    demonstration until a scientifically valid method is developed,
    including current demographic changes in the passenger population.
        This close relationship between FAA, airplane manufacturers and
    airlines was further touted and cemented on February 20, 2003 when, in
    her first major speech \5\ after becoming FAA Administrator, Marion
    Blakey referred to those regulated by the FAA as its ``customers.'' She
    said that the FAA needed to be more consistent in responding to ``our
    customers.'' Then Ms. Blakey said:
    ---------------------------------------------------------------------------
        \5\ FAA, Speech--``The Spirit of December 14th'', Marion C. Blakey,
    Washington, DC, February 20, 2003. https://www.faa.gov/news/speeches/
    news_story.cfm?contentKey=2992, accessed June 12, 2019.
    ---------------------------------------------------------------------------
            ``So, I'm announcing today a new customer-service initiative
            that provides written guidance and training to all managers and
            supervisors in our regulation and certification offices
            throughout the country on applying FAA rules and policies in a
            standard and consistent manner. And, we want to know from our
            customers if we're not being consistent. We're going to let
            them know that they have the right to ask for review on any
            inspector's decision on any call that's made in the
            certification process . . . that they can ``buck it up'' to
            first-line supervisors, field office managers, regional
            division managers, or even to Washington if necessary--with no
            fear of retribution. Information on how to do this--names,
            titles, and phone numbers--will be prominently displayed on the
            Web and in all our regional and field offices. We need your
            help to make this program a success.''
        According to a USA Today article's \6\ reference to an April 3,
    2008 hearing before this Committee, ``Inspectors who testified before
    Congress last month and others who spoke in recent interviews said they
    bitterly recalled the introduction of the program. They said it sent a
    not-too-subtle message that the airlines were encouraged to complain
    about them and had the upper hand in any dispute over safety-compliance
    issues.''
    ---------------------------------------------------------------------------
        \6\ USA Today, FAA's Customer Initiative Undercut Safety
    Inspectors, May 30, 2008.
    ---------------------------------------------------------------------------
        In addition to its effect on safety regulation of airlines, the FAA
    ``Customer Service Initiative'' specifically stated that customers
    ``have the right to ask for review on any inspector's decision on any
    call that's made in the certification process'' from all levels
    including FAA Washington.
        On October 13, 2005, the FAA published its final rule \7\
    (Establishment of Organization Designation Authorization Program, 70 FR
    59931) establishing the Organization Designation Authorization (ODA)
    program. This rule expanded the scope of approved tasks, increased the
    number of eligible organizations, and established a systems-based
    approach to managing designated organizations. According to the rule's
    summary, the ``effect of this program will be to increase the
    efficiency with which the FAA appoints and oversees designee
    organizations, and allow the FAA to concentrate its resources on the
    most safety-critical matters.'' Of course, not all who submitted
    comments to this rule agreed; one dissent in particular, from the
    National Air Traffic Controllers Association, was summarized in the
    rule's preamble as arguing that the ``proposed ODA program
    significantly modifies the current regulatory oversight system,
    deteriorating the established technical FAA oversight by going to a
    `systems' oversight approach that would provide less specific and
    technical FAA oversight and would, in time, reduce safety.'' The FAA
    disagreed, asserting that a systems approach will increase safety, as
    more effective delegation programs will free up resources for tasks
    more critical to safety. Unfortunately, the subsequent incidents
    involving the 787 main battery and 737 Max crashes appear to support
    the commenter's prediction that safety will, in fact, be reduced over
    time.
    ---------------------------------------------------------------------------
        \7\ FAA, Establishment of Organization Designation Authorization
    Program, 70 FR 59931, October 13, 2005. https://
    www.federalregister.gov/documents/2005/10/13/05-20470/establishment-of-
    organization-designation-authorization-program, accessed June 12, 2019.
    ---------------------------------------------------------------------------
        Under various agreements between the FAA and other countries or
    groups of countries, foreign authorities agree to work with the FAA to
    enable acceptance of US Type certificated and manufactured aeronautical
    products, including aircraft, engines, propellers, rotorcraft, and
    aeronautical components. In many of these agreements, the FAA is relied
    upon to assist in the certification process of products for the
    aviation authority and country to approve these products. This system
    of international aircraft certification has been built upon global
    recognition of the FAA and its statutory mandate to maintain safety at
    the highest possible level. The loss of this past esteem of FAA
    certification and regulation of US aviation and the profound tragedies
    of two US aircraft crashes within five months, in addition to the other
    safety problems we've discussed, means that the FAA must ensure that it
    has taken all measures to assure the safety of the 737 MAX within the
    U.S. as well as in all countries who must also approve the this
    aircraft for return to service.
        In 2006, the NTSB published the results of a study, Safety Report
    on the Treatment of Safety-Critical Systems in Transport Airplanes.\8\
    This report, which focused on certification of systems critical to
    flight safety and seems as relevant today as then, was prompted by four
    recently-concluded accident investigations involving two Boeing, one
    McDonnell-Douglas, and one Airbus aircraft: USAir flight 427 in 1999;
    TWA flight 800 in 2000; Alaska Airlines flight 261 in 2002; and
    American Airlines flight 587 in 2004. The NTSB suggested improvements
    to the certification process for the following three reasons, quoted
    directly from the report:
    ---------------------------------------------------------------------------
        \8\ NTSB/SR-06/02, Adopted April 25, 2006
    ---------------------------------------------------------------------------
        1.  The process for assessing risks to aircraft systems does not
    adequately address important failure conditions associated with
    structures and with human/system interaction.
        2.  The results of the process for assessing risks to safety-
    critical systems are not adequately preserved to support continued
    airworthiness of certificated airplanes.
        3.  Existing policy, practices, and procedures for the ongoing
    assessment of risks to safety-critical systems do not ensure that the
    underlying assumptions made during design and certification are
    adequately and continuously assessed in light of operational
    experience, lessons learned, and new knowledge.
        The NTSB also concluded that ``a program must be in place, once the
    type certification process is completed, to ensure the ongoing
    assessment of risks to safety-critical systems. Such a program must
    recognize that ongoing decisions about design, operations, maintenance,
    and continued airworthiness must be done in light of operational data,
    service history, lessons learned, and new knowledge, for designs that
    are derivatives of previously certificated airplanes.''
        Given the possibility that problems in the type certification
    process may have contributed to the recent 737 MAX accidents, as well
    as the concerns that have been expressed by Congress, the NTSB, DOT IG,
    and others, a return to the FAA certification processes prior to the
    2005 FAA rule on ODA, footnote 7 supra, with inclusion of learned
    safety enhancements since then may be the best way to prevent a
    certification applicant's pecuniary and market-based interests from
    interfering with ensuring safety of the airplane and related
    requirements directly by the FAA. Such a return to direct FAA
    certification with designated engineering representatives will likely
    require increased FAA personnel and funding, with compensation for
    certification engineers to be more competitive with the private sector.
                       stable funding for aviation safety
        The ``foundation of the U.S. aviation system is safety.'' In the
    case of the Boeing 737 Max we not only need a conservative, transparent
    process for certification--we need to recognize the systemic issues
    that have undermined safety. We need an aviation system that is
    supported by stable, long-term funding and is shielded from political
    cliffs of government funding.
        AFA supports HR 1108, the ``Aviation Funding Stability Act of
    2019,'' introduced by Transportation & Infrastructure Committee
    Chairman Peter DeFazio and Aviation Subcommittee Chairman Rick Larsen.
    Aviation safety is non-negotiable. HR 1108 would authorize the FAA to
    keep all of its programs running and all of its employees working by
    drawing from the Airports and Airways Trust Fund (AATF) during any
    lapse in typical government appropriations. By drawing from the AATF
    during a shutdown, the FAA would ensure that all FAA employees would be
    paid for work during a funding lapse and FAA programs would continue to
    operate. This bill should be acted on with urgency.
        We encourage Congress to give serious attention in all budgeting to
    properly funding the Department of Transportation and the Federal
    Aviation Administration in order to fully support aviation safety.
                                    closing
        Safety is not something ``customers'' buy, it is something we all
    fundamentally expect as a baseline of operation. Regulator oversight
    cannot be put in terms of client/customer relations.
        Again, we commend this Committee for its diligence in promoting
    aviation safety. We look forward to continued leadership from Acting
    Administrator Elwell in promoting a 737 Max return to service that
    inspires confidence among aviation workers, our counterparts around the
    world, and the traveling public.

        Mr. Larsen. Thank you.
        I now recognize Randy Babbitt, former Administrator of FAA,
    for 5 minutes. Good to see you, Randy.
        Mr. Babbitt. Good morning. Pardon me.
        Good morning. Chairman Larsen, Ranking Member Graves,
    Chairman DeFazio, and Ranking Member, also, Graves, and to the
    full members of the committee, thank you for the opportunity to
    come here today and discuss the return to service and
    certification issues surrounding the Boeing 737 MAX.
        I would also like to take a second and offer my
    condolences, heartfelt condolences to the family and the
    friends and the loved ones of the passengers and the crew,
    crewmembers, and all aboard Lion Air 610 as well as the
    Ethiopian flight 302.
        In interest of disclosure, not in my original testimony, I
    have had the opportunity to fly the Boeing simulator yesterday,
    and I flew both scenarios of the old software and the new
    software. Obviously, this came after I turned in my testimony.
        But I have had a pilot's license from the time I soloed in
    1962 to date. I have also been an aviation safety advocate for
    over 40 years, so I do bring some background and, I believe,
    some understanding of accident investigations and changes that
    have been made subsequently to improve aviation safety and
    efficiency over the last 40 years.
        As president of ALPA in the nineties, I championed the One
    Level of Safety, which essentially melded the regulations under
    part 121 into the operations of part 135, and that provided a
    vast improvement of regional carriers airline safety standards.
    And while serving as the FAA's Administrator, the program for
    Aviation Safety Information Analysis and Sharing, known as
    ASIAS, was introduced, and today, provides a collection of data
    that has dramatically improved safety by having stakeholders
    and operators reporting and sharing problems and issues that
    they encounter, operational issues, and they report these
    before they become accidents.
        We also began to purposely focus on collaboration with all
    facets of aviation operations to be more forthcoming with
    mistakes, errors uncovered, and other issues, and we have also
    asked that the FAA consider to be less punitive in order to
    inspire more voluntary disclosures.
        Following the tragic accident in Buffalo, I called on the
    industry and the organizations representing the professional
    airplane pilots of the country together for a call to action
    focused on professionalism. We revisited a lot of past actions
    and then entered into a partnership with the industry to
    actively address concerns raised by the discoveries uncovered
    in the Colgan Air flight 3407 tragedy.
        We identified steps to strengthen and improve pilot
    training, hiring, testing, and all the practices surrounding
    aviation at the regional airlines and major carriers.
    Participants agreed on best practices and changes to them for
    pilot record checks, development of pilot mentoring programs,
    and reassessing rules for pilot fatigue, flight, and duty time,
    and this time based on scientific research about fatigue.
        And we should acknowledge that the FAA's mission is to
    provide the safest and most efficient transportation and
    aerospace system in the world. In an aviation system, data is
    our friend. Ninety million flights, seven billion passengers
    carried over the last decade in the U.S. is the most incredible
    safety record the world has ever seen, and it is also not
    symptomatic of a flawed safety structure.
        In 1970, to take a look back, in 1970, we were losing a
    hull in this country every 6 weeks. Eight accidents a year. And
    looking back today, we haven't lost a hull in 10 years. That is
    quite a dramatic recommendation of the dramatic efforts that
    safety continues--or that continuous safety improvements will
    bring you.
        Our Nation's system of certification of aircraft has been
    evolving also for over 60 years, and it must continue to evolve
    and improve. But as we move forward with increased reliance on
    automation, the linkage and the interface between man and the
    machine must also evolve. It is imperative that pilots have a
    full and complete understanding of the automation of the
    equipment that they operate and the systems designed to protect
    the operational envelope of the aircraft. But of equal
    importance is ensuring that pilots have the full training,
    operational knowledge, and understanding of those operational
    boundaries and the limitations of those systems.
        Automation and training must also keep improving on
    maintaining situational and operational awareness of what
    equipment and automation is actually controlling. Pilots need
    to understand the operational realm in which automation takes
    control of an aircraft and be aware of the situation calling
    for the action, as well as the full range of possibility that
    that action can be.
        No pilot should ever be surprised by an event that takes
    place in an airplane in which they are certified. That includes
    training exposure to all phases of the operational envelope as
    well as the safety protections that are designed to protect the
    operating envelope and protect it from excursions.
        In closing, a retrospective look into the introduction of
    service shows that assumptions were made by Boeing and accepted
    by the FAA and design changes incorporated that should have
    been more rigorously tested and flight crews better educated
    and trained in reaction to a new safety protection system that
    Boeing had introduced.
        History tells us that this is not a new problem, but in
    fact, has been part of aviation history, unfortunately. Going
    back to aircraft such as early jets, like the Comet, and metal
    fatigue, later Douglas DC-10s, Lockheed Electra engine mounts
    had to be redesigned----
        Mr. Larsen. Thank you.
        Mr. Babbitt [continuing]. Douglas pitch trim compensators,
    all of which had to be redesigned, but those aircraft did
    finish out their lives with--successfully after the required
    modifications.
        I am comfortable, in closing, that the FAA and Boeing,
    working together, have rigorously evaluated and reevaluated the
    design, along with revised training requirements that will
    ensure reintroduction----
        Mr. Larsen. I have to ask you to wrap up.
        Mr. Babbitt [continuing]. To service by the 737 MAX.
        Thank you, and I look forward to your questions.
        [Mr. Babbitt's prepared statement follows:]

     Prepared Statement of Hon. J. Randolph Babbitt, Former Administrator,
                        Federal Aviation Administration
        Good morning, Chairman Larsen, Ranking Member Graves, and Members
    of the Subcommittee. Thank you for the opportunity to discuss the
    Status of the Boeing 737 MAX: Stakeholder Perspectives.
        I would also like to offer my most heartfelt condolences to the
    families, friends and loved ones of the passengers and crew members
    aboard both Lion Air 610 and Ethiopian Airlines 302. My thoughts and
    prayers are with them.
                                   background
        I have had a pilot's license from the time I soloed in 1962 to
    date. I have been an aviation safety advocate for over 40 years, so I
    do bring some background and understanding to accident investigations
    and changes that have subsequently been made to improve aviation safety
    and efficiency over the last forty plus years.
        As the President of ALPA I championed ``One Level of Safety'' which
    essentially melded the regulations of Part 121 operations into Part 135
    providing a vast improvement of Regional Carriers safety standards.
    While serving as the FAA's Administrator the program for Aviation
    Safety Information Analysis and Sharing (``ASIAS'') was introduced and
    provides data today that dramatically has improved safety by having
    stakeholders and operators reporting and identifying problems and
    operational issues before they become accidents. We also began to
    purposely focus on collaboration with all facets of aviation operations
    to be more forthcoming with mistakes and errors and at the same time
    moving the FAA to be less punitive to inspire more voluntary
    disclosures.
        Following the tragic accident in Buffalo I called on the industry
    and the organizations representing Professional Airline pilots of the
    country together for a ``Call to Action'' focused on professionalism.
    Safety starts with professionalism and we revisited our past actions
    and then entered into a partnership with the industry to actively
    address concerns raised by the Colgan Air Flight 3407 tragedy. We
    identified immediate steps to strengthen and improve pilot hiring,
    training, and testing practices at airlines that provide regional
    service, as well as at our major air carriers. Participants agreed on
    best practices for pilot record checks, development of pilot mentoring
    programs and reassessing rules for pilot flight and duty time to
    incorporate scientific research about fatigue. Professionalism is not
    something we can regulate, but I am proud to note that Labor
    organizations answered our Call to Action and supported either the
    establishment or expansion of professional standards and ethics
    committees, codes of ethics, and safety risk management meetings
    between FAA and major and regional air carriers. The FAA has worked in
    full cooperation with the industry to raise professional standards and
    improve cockpit discipline. I believe the ``Call to Action'' has proven
    the critical importance of professionalism in aviation safety.
                                     safety
        The FAA's mission is to provide the safest, most efficient
    aerospace system in the world. And in the aviation system, data is our
    friend. 90 million flights and 7 billion passengers carried over the
    last decade in the U.S. is the most incredible safety record the world
    has ever seen and is not symptomatic of a flawed safety structure. But,
    like aviation itself, we must strive to improve and continue to evolve
    in our ever-changing environment of advancing technology and oversight.
    And the evolution and adoption of safety management systems has proven
    success. In 1970 the U.S. was suffering major airline hull losses of
    one every 6 weeks! As noted earlier, we have not lost a domestic
    aircraft in over a decade which reflects the dramatic effect of
    continuous safety improvements.
        Quoting from my own testimony made almost a decade ago, ``Safety
    remains the vital core of the FAA mission. The flying public must have
    confidence that the airplanes they board are properly designed and
    maintained. They must know that their pilots are qualified, trained for
    their mission, and fit for duty. Nothing less is worthy of the FAA
    name, or our responsibility for preserving the lives of the flying
    American public.'' I concluded with the observation that ``The FAA has
    demonstrated a consistent track record of protecting the safety of the
    flying American public. Our successes in aviation safety continue to
    set a global standard of American leadership that is not only
    acknowledged, but also emulated throughout the world.'' I believe those
    statements are equally valid today.
                                 certification
        Our nation's system of Aircraft certification has been evolving for
    over 60 years and must continue to evolve and improve. But as we move
    forward with increased reliance on automation, the linkage or interface
    between man and the machine must evolve as well. It is imperative that
    pilots have a full and complete understating of the automation of the
    equipment they operate. The FAA works with the industry to improve
    Flight deck layout and alert/warning display strategies that influence
    a crew's ability to interface with their airplane. And today's modern
    Aircraft continue to introduce systems that now incorporate even better
    systems to protect the ``operational envelope'' of the aircraft but of
    equal importance is ensuring that pilots have a full training and
    operational knowledge and understanding of those operational boundaries
    and the limitations of those systems. We also must continue to improve
    the operational knowledge and training of our flight crews. And we
    should be fully aware--to quote Chris Hart, former Chairman of the NTSB
    ``Weaknesses in pilot skills are masked by automation when it works but
    amplified when it doesn't''.
        We have made remarkable technological improvements and the current
    safety record is proof positive of their importance. And key to
    continuing our introduction of innovative improvements to tomorrow's
    aircraft operational and safety systems is to ensure that safety
    regulations not stifle innovation, but to ensure that changes and
    innovation have safety and risk assessment as part of the design
    incorporated and built into them.
                             automation & training
        Automation and therefore training must keep improving to maintain
    the man-machine interface. Training should also include maintaining
    situational and operational awareness of what equipment including
    artificial intelligence and automation is controlling. Pilots need to
    understand the operational realm in which automation takes control of
    an aircraft and be appropriately aware of the situation calling for the
    action as well as the full range of possibility of that action.
        Pilots in today's system need to continue improved training to
    operate in today's operational environment. We have the technology to
    expand training with the use of visual reality and high-fidelity
    simulation so that no pilot should ever be surprised by event that
    takes place in an aircraft in which they are certified. That includes
    exposure to all phases of the operational envelope and environment as
    well as the built-in safety protections that are designed to protect
    the operating envelope from excursions.
                                    closing
        A retrospective look into the introduction into service shows that
    assumptions were made, and design changes incorporated that should have
    been more rigorously tested and flight crews better educated and
    trained in reaction to a new safety protection system that Boeing had
    introduced.
        History shows us that this is not a new problem but in fact has
    been part of Aviation history unfortunately. Going back to aircraft
    such as early jets and understanding metal fatigue that occurred in the
    de Havilland Comet. Later, Douglas DC 10 and Lockheed Electra engine
    mounts required redesign and maintenance procedures. Douglas DC-8 Pitch
    Trim compensators, all of which had to be re-designed after
    introduction to service. All of those aircraft finished their aviation
    lives successfully after required modifications.
        And I am quite comfortable that Boeing and the FAA together have
    rigorously reevaluated the redesign along with revised training
    requirements that will ensure the re-introduction to service by the
    Boeing 737 Max will be safe and successful.
        Thank you for the opportunity to testify. I look forward to your
    questions.

        Mr. Larsen. Thank you, Mr. Babbitt. I appreciate it.
        I appreciate everyone's patience with my impatience as
    well. And we now move to Member questions, and we will
    recognize Members for 5 minutes, and I will start by
    recognizing myself.
        My questions are going to largely focus on the training and
    training standard, the training recommendations that will be
    necessary to get to return to service, and I just want to
    explore that.
        Captain Sullenberger, although you weren't specific, you
    were more generalized, is it your position that there ought to
    be required simulator training for pilots on the new--on the--
    for the software fix for the 737 MAX before it is returned to
    service, versus a computer-based simulator training?
        Mr. Sullenberger. Yes. It is critical that we address all
    the issues. It is critical that pilots, as soon as possible,
    experience in a full motion level D simulator and not just a
    part task trainer, all the effects of the MCAS system, and also
    all the other things that likely have not been trained either
    at all or since initial qualification on the airplane, like
    unreliable air speed, manual trim operation, including manual
    trim operation at very high indicated air speeds where it may
    require either two hands or the efforts of two pilots to
    actually move the trim manually, or in some cases it may not be
    possible to move to trim manually until air loads are reduced.
    They need to develop a muscle memory of their experiences so
    that it will be immediately accessible to them in the future,
    even years from now, when they face such a crisis.
        Mr. Larsen. OK. I am just going to ask our staff, and we
    don't need to get into the technical details of what D level
    versus B level training is, but if staff can do a memo for the
    subcommittee members, that is kind of some basic stuff, so we
    don't need to spend time here talking about those differences,
    but if you could do that for the Members so we understand that.
        Captain Carey, do Allied Pilots have a different position
    or the same position as Captain Sullenberger?
        Mr. Carey. Thank you, Chairman Larsen. While Captain
    Sullenberger's recommendations are certainly the best-case
    scenario, logistically, American Airlines has 4,200 pilots on
    the 737 MAX, Southwest would have 9,000 737 pilots, we are in
    favor of the scenario that Captain Sullenberger described in a
    video concept. And we do 9-month training protocols, so our
    pilots would receive a CBT program----
        Mr. Larsen. CBT means what?
        Mr. Carey. Computer-based training.
        Mr. Larsen. OK.
        Mr. Carey. And then the video training program of the
    scenario that Captain Sullenberger suggests. And after that, we
    have a 9-month training program, which would enable every
    American Airlines pilot to go through that simulator scenario
    and that muscle memory exercise within 10 months.
        Mr. Larsen. So it would be----
        Mr. Sullenberger. May I add that a spot scenario might help
    get pilots in the simulator more often and sooner.
        Mr. Larsen. Spot scenario?
        Mr. Sullenberger. I understand that that is a logistical
    matter of great importance, but the point is, there are other
    ways to accommodate more pilots sooner than waiting for their
    recurrent training cycle to occur.
        Mr. Larsen. OK. Ms. Pinkerton, from the airlines'
    perspective, how does this--where do you come down on this
    training issue to get to return to service?
        Ms. Pinkerton. As you know, I am not a pilot, so I don't
    have this kind of expertise, but we are relying on people who
    do have the expertise. The FAA is utilizing the Flight
    Standards Board on this very topic. And we are confident that
    working with those independent experts, involving our pilots'
    unions, they will come to the right decision about what kind of
    training is needed, and we will provide that training.
        Mr. Larsen. So from the airline perspective, you are saying
    that the Flight Standards Board, given the recommendation of
    the FAA, is where this committee should look for advice on how
    we should think about the training necessary to go to return to
    service?
        Ms. Pinkerton. Yes.
        Mr. Larsen. OK. Mr. Babbitt, have you considered this
    decision, and could you give us your views on it?
        Yeah. Have you considered this question, and give us your
    views?
        Mr. Babbitt. Yes. I think that, you know, some training--as
    I said in my testimony, I don't think a pilot should ever be
    surprised by anything that happens in an airplane, and this is
    a pretty substantial piece, and I had the opportunity to see it
    both ways. However, I think it is a very similar maneuver to
    other things that happen in the aircraft.
        My suggestion would be to evaluate it. And quite often, I
    know ALPA was often involved with the FAA and carriers to
    decide what training was needed. And I think a consortium of a
    group like that could make a recommendation, perhaps it is give
    them computer-based training, but maybe the next check--next
    cycle of checks that you should be exposed to it.
        Mr. Larsen. Thanks. And, President Nelson, I have a
    question for you. I just want to affirm what you said. Flight
    attendants are the ones answering the questions from the flying
    public about is this--is this that plane or is this a different
    kind of plane. So I just want to emphasize, the FAA needs to
    continue to include you all in the outreach because you are the
    ones answering the questions of the flying public more so than
    any other group of people.
        Ms. Nelson. I appreciate that. And I think that there has
    been a recognition of that that we have to be fully involved
    for there to be a successful return to flight.
        Mr. Larsen. Thank you.
        I understand, on the Republican side, we are going to go
    with Mr. Mitchell first for 5 minutes.
        Mr. Mitchell. Thank you, Mr. Chair.
        I share the concern, and I can't imagine the pain of the
    families of the victims of both flights. I will meet tomorrow
    with the family of Ms. Stumo to talk about this. They can share
    with me their concerns. Couldn't schedule it today.
        They have a need for answers to the problems, what caused
    this. They have a need for responses sooner than later.
        I am concerned--I talked to Chairman Larsen about the
    delays of the FAA responding to questions that were asked
    several months ago. We haven't had much response from FAA as to
    some simple questions. The design of MCAS. The review of
    certification process of MCAS. What role Boeing had versus what
    roles were undertaken by the FAA. So they need to be reviewed.
        It should be clear to us, however, that what happened in
    both flights were cascading issues, errors, whatever term you
    want to put on it. One fed another. There was a chain of events
    that if any one or more--if a couple of those things hadn't
    happened, we would not have had the outcomes we had. I raised
    at the last hearing that also included in that is the
    qualifications and training of the pilots, both in terms of
    MCAS and in general.
        One thing I think the families deserve is full information.
    Not having bits and pieces wander out or have pieces used for
    political process has been noted.
        Captain Carey, you have made more than a few headlines of
    late by releasing portions of an apparently secret recording
    made in November. I would like to ask you some questions about
    that. First--and I would like your responses also for the
    record if you are unable to respond--who made that recording,
    sir?
        Mr. Carey. I did, Mr. Mitchell.
        Mr. Mitchell. Thank you. Did the board of directors
    authorize that or know in advance you were making a recording?
        Mr. Carey. No, sir.
        Mr. Mitchell. Did you tell Boeing officials you were making
    that recording prior to the meeting or subsequent to that?
        Mr. Carey. No, sir. That is not required under Texas law.
        Mr. Mitchell. I am glad you are aware of that. Are you
    aware that--I am sure you are--that in April, you issued a
    press release fully confident in the Boeing 737 MAX and its
    capabilities? This is your organization, correct?
        Mr. Carey. Yes, sir.
        Mr. Mitchell. Shortly thereafter, and this is deeply
    concerning to me, that then portions of the tape were released
    in the midst of a union campaign, being it is everyone's
    problems, that it is Boeing's fault, they did it. Bits and
    pieces of information.
        What is--what is the value of that to either the system or
    the family in doing that? We don't have complete information
    out yet, so explain to me what warranted that.
        Mr. Carey. Sir, the APA is founded on safety. Safety first
    always, and safety is not for sale. Boeing came to visit us in
    November 27 of 2018. We were ready to record the meeting if we
    thought it was a PR meeting and not a sincere exchange of
    technical data.
        Mr. Mitchell. Stop a second. It wasn't we, because you said
    they were unaware. So you----
        Mr. Carey. We, my team. My subject matter experts at APA,
    my safety committee chairman, and my training committee
    chairman, and our subject matter experts. My team. We decided
    if we thought Boeing was insincere at the meeting, we would
    record the meeting.
        Boeing has a history with the 737 rudder control back in
    the nineties, a USAir accident, which Captain Sullenberger is
    very familiar with, of being dishonest, or less than
    forthright. Talk about honesty, sir. I made FOIA requests on
    November 28, 2018, on all MCAS data between the FAA and Boeing.
    To date, we have not had one piece of data arrive.
        Mr. Mitchell. Well, I have not had a response either to the
    requests I made to the FAA, so I share your frustration.
        Mr. Carey. Thank you, sir.
        Mr. Mitchell. But let me make a point, which is, your board
    supports the equipment, and then shortly thereafter in May, you
    release----
        Mr. Carey. Sir, our initial press release----
        Mr. Mitchell. Let me finish the question, sir. That is the
    way it works.
        You then release portions of a tape, portions of it. I
    would ask you for the record here that you submit the entire
    tape so we can hear it in its entirety.
        Mr. Carey. The entire tape has been submitted to the
    committee, sir. It has been submitted to Chairman DeFazio.
        Mr. Mitchell. Mr. Chairman, do you have it? Mr. DeFazio?
        Mr. Carey. We submitted an entire transcript of the tape to
    Chairman DeFazio and the tape itself.
        Mr. Mitchell. Do we have that?
        OK. I would like to hear that.
        Let me make one final comment because we are almost out of
    time.
        Mr. Carey. We will certainly--APA will certainly supply
    you, sir, with a copy of that written transcript and the tape.
        Mr. Mitchell. I would appreciate that.
        One final comment before I get gaveled out here. I believe,
    as I said earlier, it is a cascade of errors. One of the
    questions I posed in the last hearing, which continues to
    trouble me a great deal, is the pilots of Ethiopian Air, their
    hours give me a great deal of question. The pilot in the right
    seat could not fly under our standards here. We need to look at
    the ICAO standards versus our standards in North America for
    pilot qualifications and training, and reconcile that, along
    with all these other questions, because there are a series of
    them. And until we get those answers, I would respectfully ask
    let's not give up bits and pieces because it is damaging.
        Mr. Larsen. Thank you, Mr. Mitchell.
        I turn to Chair DeFazio for 5 minutes.
        Mr. DeFazio. Captain Carey, it says in your testimony, 737
    MAX does not provide the same aircraft field to the pilots as
    the 737. This was intended to minimize the operating costs to
    Boeing's customers by allowing the MAX to be certified by the
    FAA as a 737.
        And then in Captain Sullenberger's testimony, he mentions
    that it disturbed the engine mounts, disturbed the natural
    aerodynamic stability of the 737 in certain conditions.
        I got a--what are those conditions, and why was this
    necessary? Or was it just about avoiding certification and
    pilot training? What are those conditions? Can either of you
    answer that quickly? We got only 5 minutes.
        Mr. Sullenberger. I would like to know and hear from Boeing
    why MCAS was necessary. Was it to meet a certification standard
    or was it to achieve a common type certificate that would not
    require additional training for pilots and, therefore, for
    airlines?
        Mr. DeFazio. OK. So we don't know the answer to that
    question. That's a pretty critical question.
        Mr. Sullenberger. I do not know the answer.
        Mr. DeFazio. OK. Anybody there know the answer?
        Mr. Carey. Sir, there is some speculation or there is some
    data coming in from Boeing engineers that have contacted us
    that there may be some negative dynamic stabilization problems
    with the aircraft, which required Boeing engineers to add the
    MCAS system to the 737 MAX 8 and 9 design.
        Mr. DeFazio. OK. We really need----
        Mr. Babbitt. If I could comment?
        Mr. DeFazio. We really need to--quickly.
        Mr. Babbitt. If I might comment, Boeing's description to me
    was that the airplane, at high angles of attack, had a softer
    elevator feel than the original aircraft, and they wanted it to
    have more field.
        Mr. DeFazio. Feel. But it wasn't dangerous. So the pilots
    would be trained to deal with that.
        Mr. Babbitt. That is correct, and that is quite common.
        Mr. DeFazio. But if they hadn't experienced it, they
    wouldn't be trained to deal with it.
        Mr. Babbitt. It is quite common in the industry. For
    example, Airbuses, I have flown every Airbus made, and----
        Mr. DeFazio. Well, I don't want anybody, if you could,
    avoiding, you know, things that cost a little bit of money or
    delay the deployment of an aircraft that could lead to pilots
    who are not informed as to all the characteristics of that
    aircraft, which you already said earlier, the MCAS, people
    should be informed of this system.
        Now, there is also, you know, because of the pilot
    discussion, there is in Captain Sullenberger's, he said that
    there were many false warnings simultaneously?
        Mr. Sullenberger. Yes. As opposed to older aircraft designs
    where cockpit instruments were essentially standalone devices
    and information was not shared between them, and a fault in one
    could be easily identified and isolated and disregarded.
        Now, in modern airplanes with higher levels of
    integration--that is, higher levels of electronic
    interconnectedness and sharing of data between devices--it is
    now possible, as happened on these cases and in the June 1,
    2009, crash of Air France 447, where a single errant data bit,
    a single fault, a single failure can now have cascading effects
    rapidly through multiple systems and create a condition of
    multiple warnings, some of them false. It is difficult to sort
    it out because of the startle factor, the workload, the task
    saturation to identify the root cause, and it can be
    contradictory, ambiguous, confusing, and ultimately
    overwhelming.
        Mr. DeFazio. Would a disagree light have helped in that
    situation?
        Mr. Sullenberger. It might. With so much going on, such
    loud warnings, so many other disparate indications, they might
    have missed it, but had they seen it, it might have had been
    that one----
        Mr. DeFazio. Captain Carey, looks like you wanted to say
    something there. Did you, or are you just taking notes?
        Mr. Carey. Yes, sir, I would like to comment. Excuse me,
    Captain Sullenberger.
        The MCAS system is a federated system, which means it is
    not integrated into the control laws and logic of the computers
    on the 73 MAX aircraft. Again, the failure was that Boeing did
    not disclose the existence of MCAS to the pilot community
    around the world. Therefore, robust training was not conducted.
        The last line of defense in the MCAS system--when we asked
    Boeing at the November 27th meeting in Texas what the last line
    of defense was with the MCAS firing and firing and firing till
    the aircraft stabilized was full nose down, they said the
    pilots. Well, they didn't ever tell us the system existed. So,
    therefore, we did not have robust training.
        Mr. Sullenberger. And let me add, I think some false
    assumptions were made about how the system would operate, how
    it would be noticed or become aware of by pilots, and what
    human performance would be in those conditions. I think it was
    a false assumption to think that, before MCAS' existence, much
    less its operation, was even disclosed to pilots, that they
    would interpret this particular scenario----
        Mr. DeFazio. One other quick thing here----
        Mr. Sullenberger [continuing]. As a runaway trim----
        Mr. DeFazio. Thank you. And that leads to some of Ms.
    Nelson's testimony that I wanted to get to, which is
    questioning engineering assumptions. She questions the
    engineering assumptions that went into the battery on the 787.
    They were wrong. She is questioning the engineering assumptions
    that went into the MCAS system as they radically changed it on
    the 737 MAX and didn't disclose it, and then also evacuation
    standards, which will be an ongoing concern of this committee,
    which are only computer simulated. Computers are not humans.
    They are not human factors. They don't anticipate everything.
        With that, I yield back the balance of my time.
        Mr. Larsen. Thank you, Mr. Chair.
        I now recognize for 5 minutes Ranking Member Graves of
    Missouri.
        Mr. Graves of Missouri. I yield back.
        Mr. Larsen. OK. Thank you.
        Then we will go with--I think we have Representative
    Balderson from Ohio.
        Mr. Balderson. Thank you, Mr. Chairman.
        Thank you to the folks here testifying today. I appreciate
    your time.
        My first question is for Ms. Pinkerton. You note that
    following the grounding of the 737 MAX, the airline industry
    employed a variety of mechanisms to cope with the disruptions.
    Southwest has the most 737 MAX air jets in operation of any
    carrier in the United States. Southwest is also the largest
    passenger carrier in central Ohio. Can you discuss how
    Southwest and A4A member carriers have accommodated the loss of
    the 737 with minimal disruptions for service?
        Ms. Pinkerton. Yes. As I mentioned, the A4A carriers that
    had the MAX grounded have done several things: rebooking
    passengers, rerouting. But in addition to that, they have had
    to make systemic changes. They are utilizing spare aircraft.
    They are doing things like delaying optional enhancements like
    souped-up Wi-Fi and painting the aircraft. Unfortunately, we
    have had, our carriers have had to completely eliminate some
    service or take flights on markets that are more likely flown
    and reduce frequencies, but for the most part, carriers have
    been able, like I said, to accommodate 99 percent of folks.
        We are anticipating that, despite the capacity drawdown
    that Southwest, American, and United have had to do, we are
    going to see a 3-percent increase in seats overall this summer,
    and that is with other carriers filling in the capacity and
    different airlines, different aircraft coming online also that
    are providing that capacity.
        Mr. Balderson. OK. Thank you very much.
        My next question is for Captain Carey and Captain
    Sullenberger. You both mentioned the need to ensure pilot
    training protocols are vigorous and robust, especially as
    aircraft are becoming more and more high tech. I agree that
    passenger safety should always be the most important aspect of
    our aviation industry and that our pilots should receive the
    best possible training.
        Are there any obvious or necessary changes you believe
    should be made to licensure requirements or pilot training?
        Mr. Carey. Thank you, Mr. Balderson. I was interested to
    know that Boeing afforded Captain Babbitt, former Captain
    Babbitt, retired Captain Babbitt the opportunity to utilize
    their simulator, their 737 MAX simulator full-motion down in
    Miami yesterday. Boeing invited two of our pilots who are here
    today who have accumulated over 5,000 hours on the Boeing 737
    aircraft to use that simulator on June 5. Shortly before that
    appointment, Boeing rescinded that invitation.
        So it is curious to me, while Boeing is working on this
    fix, they don't want the people who fly it to actually see it.
    So as far as the APA getting behind the software changes and
    the FAA recertification of the 737 MAX return to service, we
    would like our safety committee chairman and our safety
    committee and training experts to be permitted to fly the 737
    MAX simulator. The only one in existence right now in North
    America is in Boeing's facility in Miami. However, there is
    another one. It is in Addis Ababa. It belongs to Ethiopian
    Airlines.
        Mr. Balderson. Captain.
        Mr. Sullenberger. It needs to be a priority for every
    manufacturer, for every airline to provide all pilots and
    flight attendants with all the information that they need to
    operate their equipment safely, to understand it. As complexity
    increases, it makes resilience harder without the proper
    knowledge. And the most important trait that every technology
    must have is that it be intuitive. It has to make sense. It has
    to--it has to be additive to one's training, one's experience,
    and not contrary to it.
        And so especially for things that operate in a surprising
    or counterintuitive way, we must be made aware of it and its
    complications and its implications. We must experience it
    firsthand in the simulator before we face a crisis in flight
    with an airplane full of passengers and crew.
        Mr. Balderson. Thank you both very much.
        I yield back my remaining time, Mr. Chairman.
        Mr. Larsen. Thank you, Representative Balderson.
        Representative Lipinski for 5 minutes.
        Mr. Lipinski. I thank you, Chairman Larsen and Ranking
    Member Graves for holding this hearing.
        It is clear we all know, we all agree, we need to get to
    the bottom of what happened with these two crashes so that we
    can provide answers to the families and friends of the victims,
    but also to do all we can to try to ensure nothing like this
    ever happens again.
        I want to focus my questions on the certification process.
    You know, I had said at the hearing we had a few weeks ago, I
    think that there was something went wrong. We need to figure
    out what that is. We are still waiting for answers and
    investigation here. But I want to ask more general questions
    about the ODA program, and I want to start with Captain
    Sullenberger.
        In your testimony, you pose a lot of important questions
    for Congress to consider with respect to the certification
    process. Do you have any specific recommendations at the moment
    with regards to general reforms of the process?
        Mr. Sullenberger. It is important that oversight include
    accountability or it means nothing. First, it is important that
    FAA be provided the budgets that are sufficient consistently to
    fulfill its responsibilities--the safety of the traveling
    public--in terms of staffing, in terms of providing those who
    oversee certification with the subject matter expertise to be
    able to do their jobs, especially as technology improves and
    especially in this global aviation industry.
        It is often very difficult internationally for FAA to have
    the budget, the staffing, and the subject matter expertise to
    do the oversight that is necessary, in particular for foreign
    manufacturers.
        It is important, as Captain Carey has said and Ms. Nelson
    has said, that the FAA have the independence to do their jobs
    without political or economic influence. It is important that
    whistleblower protections be in place, and that the safety
    culture in our organizations, FAA and manufacturers, be strong
    enough that those who have the integrity and the courage to
    insist on the highest design standards for the safety of the
    public not be overruled by supervisors with other agendas.
        Mr. Lipinski. How do we do those things?
        Mr. Sullenberger. Pardon me?
        Mr. Lipinski. How do we do those?
        Mr. Sullenberger. We start with the organization itself,
    and we start with how the incentives in each organization are
    aligned. Are they aligned for expedience or for economy, or are
    they aligned for consistent application of best practices? Are
    people hired and promoted and receive bonuses based upon
    production numbers or based upon quality safety?
        We get what we measure, we get what we reward. And right
    now, in the important ways, the incentives are not aligned
    toward consistent public good sufficiently in all our
    organizations. Key members and leaders of each safety-critical
    aviation organization must have subject matter expertise, and
    in some cases, they must not be only engineers, they must also
    be pilots, so they understand in a firsthand way the
    implications of design choices.
        Every design involves compromises between strength and
    weight, performance and cost. We need to make sure that these
    decisions are made in a fully informed fashion, in a
    transparent way, and that communication about them is
    communicated effectively at every level so we know what risks
    are and why we are taking them.
        We also must look at faults, not just individually, but in
    combination. I think that may be a part of what happened here,
    that there was not a full appreciation of the magnitude of the
    risk to a single fault to these systems and the lack of
    knowledge among the operators.
        Mr. Lipinski. I want to give Ms. Nelson a chance to address
    this in the last minute I have.
        Thank you.
        Ms. Nelson. OK. So we have talked with engineering experts
    who advised us that a culture of safety would engineer a plane
    from a clean sheet and a software fix is not a fix to a
    manufacturing problem. Now, they have also assured us that
    there can be, it is possible to have a software fix to make the
    737 MAX safe, but starting from a place of the FAA, turning at
    the same time to say that the manufacturers and the airlines or
    their customers, as opposed to providing that direct oversight
    and creating the Organizational Designation Authorization
    program, ODA, there were many warnings that, over time, this
    program would lead to a deterioration of safety. And that is
    because there is not the rigorous oversight throughout the
    process that may have led Boeing, from the very beginning, to
    make very different decisions here because of the oversight
    that would have been involved if we were to return to the FAA
    oversight prior to ODA.
        Mr. Lipinski. Thank you very much.
        I yield back.
        Mr. Larsen. Thank you.
        I now recognize Representative Spano for 5 minutes.
        Mr. Spano. Thank you, Mr. Chairman.
        Thank you, witnesses, for being here. We appreciate it.
        And thank you to the family members for being here. Again,
    I want to as well wish you all the best, and express our
    condolences to you, and tell you that our prayers are with you.
    And so thank you for being here.
        I would like to ask a series of questions to the panel, if
    I may, just have you respond, if you would, by raising your
    hand, all right, then I will acknowledge which one of you--for
    the record, I will indicate which ones of you have answered in
    the affirmative.
        How many of you would describe yourselves as a safety
    advocate?
        Let the record reflect that every single person on the
    panel has raised their hand.
        How many of you are pilots?
        Let the record reflect that Captain Carey, Captain
    Sullenberger, and Mr. Babbitt are pilots.
        How many of you are licensed airline pilots?
        Let the record reflect as well that Captain Carey, Captain
    Sullenberger, and Mr. Babbitt are licensed airline pilots.
        How many of you are aeronautical engineers?
        Let the record reflect that no one on the panel is an
    aeronautical engineer.
        How many of you have designed a commercial transport
    aircraft?
        Let the record reflect that no one on the panel has
    designed a commercial transport aircraft.
        How many of you are software engineers?
        Let the record reflect that no one on the panel is a
    software engineer.
        How many of you have designed software for commercial
    transport aircraft?
        Let the record reflect that no one on the panel has
    designed software for commercial transport aircraft.
        How many of have you certified a commercial transport
    aircraft? How many of you have certified a commercial transport
    aircraft?
        Let the record reflect that Mr. Babbitt has certified a
    commercial transport aircraft.
        And finally, how many of you have conducted an accident
    investigation or been an official party representative to an
    accident investigation?
        Let the record reflect--raise your hand. OK. Let the record
    reflect that Captain Carey, Captain Sullenberger, Ms. Nelson,
    and Mr. Babbitt have been an official party representative to
    an accident investigation.
        Thank you for that. I follow up with a couple of questions.
        First of all, Captain Sullenberger, you indicate in your
    statement that we can, quote/unquote, ``no longer define safety
    solely as the absence of accidents.''
        From a layperson's perspective, to me, safety is preventing
    an accident. So can you unpack that statement for me? Why is it
    that we can no longer define safety as the absence of
    accidents?
        Mr. Sullenberger. The short answer is because we have been
    able to make them much more rare. And if we do only that, we
    are not doing our jobs. We need to look at all the near misses.
    We need to look at all the unresolved systemic risks and latent
    conditions. We need to do a lot more of what we are currently
    doing, doing audits, relying upon self-reporting of safety
    incidents, all the little things that become links in a causal
    chain that might lead to an incident or an accident.
        Mr. Spano. Understood. Thank you.
        Mr. Sullenberger. And to intervene and break that chain, to
    resolve these risks and these conditions before they can lead
    to harm. And then--and we have been doing that for many years.
    We are doing it more and more, but we need to do it even more
    than we are. If we had, we might have been able to avoid these
    two most recent ones.
        Mr. Spano. My next question is for Mr. Babbitt, and then if
    any of you want to follow up with a response as well.
        Can you just briefly speak to the challenge that we face to
    ensure public safety in a global aviation landscape? Like--so,
    for instance, what are the FAA's duties and responsibilities?
    What are our responsibilities as policymakers? What should our
    objectives be? What should the regulatory framework look like
    when we have many variables around the world that we cannot
    control?
        Mr. Babbitt. That is an excellent question, and it presents
    quite a challenge to the FAA or any regulator. And the
    challenge is you have to make assumptions on the base level of
    education that you have for pilots, and if you say, for
    example, two pilots sitting here and you say, do either of
    you--put your hand up if you have an ATP, and we both put our
    hands up. We have got one captain down here who has got, you
    know, 35 years with American Airlines. And the one sitting next
    to me over here has an ATP in a 172.
        Mr. Spano. Could you clarify--could you--let me interject.
    So what is an ATP, just for the record, if you could clarify?
        Mr. Babbitt. I am sorry. Air transport pilot.
        Mr. Spano. Thank you.
        Mr. Babbitt. But you can get an air transport pilot rating
    in a Cessna 172. That doesn't compare to Captain Carey's
    experience or Captain Sully's experience, but yet they both
    have ATPs. So we make these assumptions. We need a little more
    information when we design airplanes to say, well, they have to
    have an ATP. Well, OK. They have an ATP, but we need more than
    that.
        And I agree with Captain Sullenberger that, you know, the
    data mining that we have today, ASIAS--ASIAS, that I mentioned
    in my testimony, is providing incredible data where everyone
    can report, without repercussion, and we use that data to
    prevent accidents. We would rather investigate data today than
    we would accidents. It is that simple. But we also need to have
    a better understanding of the assumptions that the FAA, the
    manufacturers--because the assumptions we make in the United
    States may not be the assumptions made in Germany or France or
    other places.
        Mr. Spano. Thank you. Thank you, sir.
        Mr. Chair, I yield back.
        Mr. Larsen. I recognize Representative Johnson of Georgia
    for 5 minutes.
        Mr. Johnson of Georgia. Thank you, Mr. Chairman. Thank you
    for holding this hearing.
        I want to express my condolences to the friends and
    relatives of the victims of these two air crashes, and thank
    you for your presence today.
        Captain Sullenberger, you, in your testimony, stated
    essentially that this 737 platform which had been around for 50
    years or so was updated with the design of the 737 MAX, which
    pretty much sits on the same platform as the 737 but the 737
    MAX has larger engines. And these larger engines, because of
    ground clearance, those engines on the MAX were required to be
    mounted higher and further forward on the wings. Is that
    correct?
        Mr. Sullenberger. Yes.
        Mr. Johnson of Georgia. And because of that design need,
    the new engines actually reduced the aircraft's aerodynamic
    stability in certain conditions which, therefore, inspired the
    folks at Boeing to address that issue with adding a software
    feature called the Maneuvering Characteristics Augmentation
    System, also known as MCAS. Is that correct?
        Mr. Sullenberger. Yes.
        Mr. Johnson of Georgia. And the MCAS system operated
    automatically, causing the nose of the plane to be pushed down
    without pilot input, if conditions warrant it?
        Mr. Sullenberger. Yes.
        Mr. Johnson of Georgia. And the condition that warranted it
    would derive from the operation of one angle-of-attack sensor.
    That would be something that would happen to the sensor would
    cause the MCAS system to operate and push the nose down without
    pilot input.
        Mr. Sullenberger. Yes.
        Mr. Johnson of Georgia. And if that angle-of-attack sensor
    failed in some way, it could result in a problem in the
    operation of the aircraft. Pushing the nose down, that means
    the plane is going to go down, correct?
        Mr. Sullenberger. Yes. And not just once but repeatedly.
        Mr. Johnson of Georgia. And the MCAS system was not a
    system that was revealed to the airline industry, and thus to
    the pilots, prior to the first aircraft disaster in the
    Philippines.
        Mr. Sullenberger. My understanding is that it may have been
    revealed to some airlines, but to my knowledge, no airline
    pilots around the world knew of its existence before the first
    crash.
        Mr. Johnson of Georgia. No pilot around the world knew that
    the MCAS system could thrust the nose of the plane downward.
    They did not know that, and so, therefore, they had no training
    in terms of how to react to a sudden nosedive by the plane. Is
    that correct?
        Mr. Sullenberger. I am sorry. Would you say that again?
        Mr. Johnson of Georgia. A pilot without knowledge of an
    MCAS system in the plane, flying a 737 MAX, a pilot not knowing
    of this MCAS system and now the plane is suddenly, the nose of
    the plane is headed downward, you are not trained or no pilot
    was trained in how to react to that occurring, prior to the
    crash in the Philippines of the 737 MAX.
        Mr. Sullenberger. That is essentially correct. As I
    understand it, the assumption on the part of Boeing and the
    designers was that pilots, even though they did not know of the
    existence of the MCAS feature, the software, that they would
    somehow interpret this repeated nose-down movement as being a
    runaway stabilizer procedure, which would be something that
    they were familiar with. But it is, as I said, demonstrably
    evident that at least two professional airline crews were
    unable to do that.
        Mr. Johnson of Georgia. Was the FAA notified of the MCAS
    addition to the 737 platform prior to the crashes?
        Mr. Sullenberger. My understanding is that, at some point,
    they were made aware of the feature, but that they were not
    aware of the changes to the operation of the feature prior to
    the first crash; that it had been redesigned to activate with
    greater movement each time it activated, and it would activate
    until the full range of motion that could be achieved was
    achieved. In other words, it would act repeatedly until the
    nose was forced as far down as it could go.
        Mr. Larsen. Thank you, Captain Sullenberger.
        Thank you, Mr. Johnson.
        Mr. Massie is recognized for 5 minutes.
        Mr. Massie. Thank you, Mr. Chairman.
        I want to thank all the witnesses for coming today.
        Captain Sullenberger, do you think that better trained
    pilots or more experienced pilots should have been able to
    handle the situation and the malfunctions in the Lion Air and
    Ethiopian Airlines crashes?
        Mr. Sullenberger. Congressman, the first thing that we have
    to remember is that we are all, as humans, subject to hindsight
    bias, and it makes it very difficult for us to know with
    certainty what one might have done suddenly facing an
    unanticipated situation that we now have knowledge of.
        I think that it is unlikely that other crews would have had
    very different experiences or performed very differently than
    these two crews did on their accident flights, prior to
    knowledge of the system, certainly in the first case, and not
    having practiced it in a simulator since then.
        Mr. Massie. Wasn't there a crew on the same plane on Lion
    Air that experienced a malfunction----
        Mr. Sullenberger. Yes.
        Mr. Massie [continuing]. Prior to the crash?
        Mr. Sullenberger. Yes.
        Mr. Massie. And how did they----
        Mr. Sullenberger. At least one apparently experienced this
    and was successful, but obviously two were not. I don't know
    what the probability of success would be, but some--at least
    one did and at least two did not.
        Mr. Carey. May I comment, sir?
        Mr. Massie. Sure. Let me ask you a question first, Captain
    Carey. Are your members trained on runaway trim procedures,
    U.S. pilots?
        Mr. Carey. It would depend on what aircraft type they have
    been on and how many years they have been with the airline. The
    simple answer would be, yes, at some time in their career they
    were trained on a runaway stabilizer situation, either on the
    aircraft they are flying or previous model.
        What I would like to comment, sir, at your pleasure, the
    Lion Air airplane that did successfully land after the MCAS
    experience was fortunate enough to have a third pilot in the
    jump seat, and that pilot recognized the malfunction and led to
    the safe landing of that aircraft.
        Mr. Massie. If the other pilots had had the same training
    as the third pilot, would they have recognized it?
        Mr. Carey. It may have just been fate that the third pilot
    was there while the--you have to remember, sir, and members of
    the panel, this is a sudden, violent, and terrifying event.
    This airplane is pitching up and down rapidly and violently.
    There's bells, warnings, and clackers sounding. Communication
    is difficult. The third pilot in the jump seat, those stab trim
    wheels are right in front of that observer, and that pilot was
    fortunate enough to recognize the malfunction.
        Mr. Massie. Let's talk about your members and colleagues.
    Would they know how to respond to that situation or how to
    identify and respond to runaway trim?
        Mr. Carey. I would have to completely concur with Captain
    Sullenberger's remarks. In this situation, I believe that some
    crews would have recognized it in time to recover and some
    would not have.
        Mr. Massie. Mr. Babbitt, can you tell us about your
    experience in the simulator in encountering this similar
    situation? What was that like?
        Mr. Babbitt. It was a very educational experience, I will
    say that. I think I would agree with Captain Sullenberger that,
    you know, any of these events, all of us up here have
    experienced different emergencies, and they are very attention
    getting, and sometimes, you know, you might have been focused
    over here.
        I had the advantage, as did Captain Sullenberger, I knew
    what was going to happen. I have read, and I knew what the
    procedures should have been in the old system; I knew what the
    procedures were in the new system. And so I was able to follow
    the procedures, but essentially, I had training. I had been
    briefed as to what the reaction of the airplane was going to
    be, and nevertheless, it is any emergency. When a fire bell
    goes off in the aircraft--I have had engine fires--it is quite
    discerning, and one of the first things you do is stop the
    noise.
        In this case, you can't stop the noise. The stick shaker
    continues to go, and we figured out--I mean, my experience in
    Boeing is we had one going and one not. That would tell you you
    have got an indicator problem. But yes. And then the new
    software fix was, I think, a very good one. It obviously limits
    the amount of authority given to the pitch-down, and it only
    does it once. I mean, you either fix it or you don't, and it is
    a runaway stabilizer trim.
        Mr. Massie. I would like to ask one more question----
        Mr. Babbitt. Sure.
        Mr. Massie [continuing]. Real quick of Captain
    Sullenberger.
        I think you are spot on by, in your statement, that we need
    to--we can no longer define safety solely as the absence of
    accidents. We need to look at the near misses.
        But how do you balance the pilots not wanting somebody
    looking over their shoulder versus going back and looking at
    the near misses?
        And if he could respond, I am done asking questions.
        Mr. Larsen. You have 15 seconds.
        Mr. Sullenberger. The key to that is trust. When pilots
    trust that their professional observations, self-reported, will
    be de-identified and used only for safety purposes, they are
    willing to make those kinds of safety reports, that that can
    only come from them and not from somewhere else.
        Mr. Massie. Thank you.
        Mr. Larsen. Thank you.
        I recognize Representative Titus for 5 minutes, and then
    our side, Mr. Allred will be after Representative Titus.
        Representative Titus, 5 minutes.
        Ms. Titus. Thank you, Mr. Chairman.
        As you all have said, this investigation is very important
    for the future. For the past, maybe it gives some solace to
    those who have family members or friends who are lost, but it
    is not going to bring back those lost lives. So as we think
    about the future, I would wonder if now that you are having
    greater scrutiny by the FAA, now that you are looking into what
    caused these problems, now that you are revisiting the ODA,
    have you discovered any other shortcuts that Boeing or some of
    the airlines might have taken that we don't know about and
    haven't caused accidents yet?
        Mr. Babbitt.
        Mr. Babbitt. No. The ODA process has been around the since
    the beginning of time and airplanes. I mean, the only pilots I
    know that didn't go through it were Orville and Wilbur.
    Everybody else has had to turn over their designs as they
    wanted things certified. And, you know, the process works. I
    mean, you simply don't have the manpower to do all--to
    absolutely, you know, watch every piece of design. Boeing has
    over 40,000 engineers. The FAA has 1,400, and you work hand in
    hand. And the ODA process is the same in the United States as
    it is at EASA, which is the European.
        So I think, you know, what we need to do--one of the things
    that is incumbent upon us now as we move forward with
    increasing technology is understanding and training pilots to
    appreciate more and more of the safety envelope is protected by
    automation, meaning that this is not the only airplane that
    will help you recover. Captain Sullenberger flew the A320. If
    that airplane gets too close to a stall, the airplane pushes up
    its own power. If you get going too fast, it pulls the nose up
    for you. It does a lot of things, and these are all things to
    protect the safety envelope, but the pilots need to have
    absolute training and understanding of what----
        Ms. Titus. I understand all that, we have been through all
    that, but that doesn't answer my question. Have you come up--
    have you discovered any other problems that we just haven't
    made the news because there hasn't been a crash?
        Mr. Babbitt. No. I think----
        Ms. Titus. That is reassuring.
        Mr. Babbitt. Obviously, if I knew what those problems might
    be. I don't anticipate there were any. I think Boeing has done
    a respectably--they have built wonderful airplanes over the
    years, and I have put in my testimony, I think they made a bad
    assumption as to what they needed to tell people. They assumed
    the system was one everyone was familiar with, based on similar
    systems in the aircraft, and they were incorrect.
        Ms. Titus. OK. Thank you. I hope you are right.
        As you--uh-huh. Thank you.
        Mr. Carey. Ms. Titus, thank you.
        I would like to see more FAA oversight of foreign repair
    stations. This is vital to the future of aviation. More and
    more aviation maintenance, heavy maintenance is being
    outsourced overseas to countries like El Salvador, Brazil,
    China. As much as we would like to keep these jobs in the
    United States, and that is certainly our agenda, the economic
    reality is these maintenance facilities are going overseas, and
    we would like to see very robust oversight of these facilities.
        Mr. Sullenberger. May I comment also----
        Ms. Titus. Please.
        Mr. Sullenberger [continuing]. To clarify something that
    Captain Babbitt said?
        ODA is actually a fairly recent revision of the previous
    DER system, and one of the major changes in that is that the
    FAA no longer chooses their designees. They are chosen by the
    manufacturer. And so, again, the incentives are not aligned as
    consistently toward public good with those kinds of choices
    being made and depending upon who their supervisors are.
        Ms. Titus. Uh-huh. Would you like to comment, Ms. Nelson?
        Mr. Babbitt. I think the rationale behind that was, if you
    have 40,000 engineers, you know who the better ones are, you
    know the ones who should have risen to the management of the
    projects. The FAA doesn't know these people at all. They have
    oversight of them and they work in parallel with them. If you
    have been part of a certification team or service--
    certification flights, which I have been, you have an FAA pilot
    in one seat and you have a Boeing pilot in the other putting
    the airplane through the paces. If you look at the records, the
    FAA has flown the airplane just about as much as the Boeing
    pilots have in testing.
        Ms. Titus. I appreciate that, but you say you lack the
    resources to have adequate oversight. I believe that is true,
    from all I have heard from FAA over the last several years, and
    there is going to be a tendency by someone who works for a
    company reviewing what that company is doing to be more
    positive than somebody who is objective and outside. I mean,
    that is just--that is just a fact.
        I would ask very quickly, Ms. Pinkerton, some of the
    airlines are now reconsidering the use of the 787 MAXes. They
    have ordered thousands of them. Some of them are changing out
    their whole fleet because they want to keep the same plane, and
    you understand all the economics of that.
        Have you heard any of the airlines addressing some
    reconsideration of this or how they are taking that into
    account with the grounding of all these planes?
        Ms. Pinkerton. Well, I have certainly seen the reports.
    Some of those are commercial decisions that each carrier is
    going to make.
        Ms. Titus. Thank you, Mr. Chairman.
        Mr. Larsen. Thank you.
        Mr. Allred for 5 minutes.
        Mr. Allred. Thank you, Mr. Chairman.
        I want to first express my deepest condolences to the
    families of those lost in these two crashes. I extend my
    condolences to the families who are here and those that are
    not. I want to do what we can to make sure that something like
    this doesn't happen again, not only with the MAX, but with
    future aircraft and iterations of aircraft.
        To that end, I want to begin with you, Captain Carey. At
    our May 15 hearing, I raised my concerns to Acting
    Administrator Elwell after reading a report in the Dallas
    Morning News regarding your meeting with Boeing that the FAA
    was not made aware of the concerns of your pilots.
        Moving forward, what role do you think pilots should play
    in alerting the FAA of concerns like those that you raised in
    that meeting?
        Mr. Carey. Thank you, Mr. Allred. First of all, I would
    like to thank Acting Administrator Elwell. He has been quite
    progressive in allowing us contact to his office and his
    professionals.
        Going forward, we would like to see our subject matter
    experts, our 737 pilots in our safety and training program at
    the Allied Pilots Association invited to future certification
    proceedings on all future designs. So we have the 777-900
    coming down the chute from Boeing shortly. This will be the
    first commercial aircraft with folding wings. Do we want that
    to be certified on the original Boeing 777 certificate from
    1996 or whenever it was? And this goes back to the timeline or
    the sunset of a certificate as we are speaking. The 737 is
    operating on a 1967 certificate.
        So we absolutely would like the stakeholders, the flight
    attendants, the pilots, the engineers, and the maintenance
    personnel to be involved in future certification with the
    manufacturer and progressively with the administration as these
    designs come to commercial use.
        Mr. Allred. After the designs have already been introduced,
    are you confident in the processes to raise those concerns now?
        Mr. Carey. I believe we--I am confident in the ability to
    raise the concerns through the ASAP program, the safety
    reporting program, the Whistleblower Program, and forums like
    this, public forums that you so graciously put forward.
        I would like to say, to answer a question that was raised
    earlier, the Allied Pilots Association only endorsed the safety
    of the American Airlines version of the MAX, because we were
    one of two airlines in the world to purchase the optional dual
    AOA system. So we professed our confidence in our version of
    the airplane. I called the president of Southwest pilots union
    and said, heads-up, you guys don't have the redundancy that we
    have.
        Mr. Allred. Well, you raised a point I wanted to follow up
    with Captain Sullenberger.
        In your written testimony, you state that, quote,
    ``whistleblower protection must be strong and effective, and if
    it is not strong enough, we must strengthen it.''
        In your experience, do you believe that current protections
    are sufficient? And, if not, what can be done to ensure that
    employees are freely able to come forward with their concerns?
        Mr. Sullenberger. It is apparent to me it is not
    sufficient. I think there are those who need to come forward,
    and they need to feel free of recrimination, in order to make
    sure that the truth is known.
        Mr. Allred. Mr. Babbitt, same question to you.
        Mr. Babbitt. I can tell you at the FAA, when I was there,
    whistleblower reports were taken incredibly seriously. I, in
    fact, established an entire department to ensure that they were
    heard, that they had the protections that were needed, and the
    followups were made. It is a very robust system. And to my
    knowledge, I know of no one who has come forward later after
    leaving or anything and said, geez, I tried to be a
    whistleblower and no one would listen to me. That doesn't
    happen at the FAA, not at least in my tenure there.
        Mr. Carey. I think there may be a problem within the
    manufacturing side, the commercial side. For example, Boeing
    has what they call a Boeing ethics department. So if an
    engineer or an employee raises a vital concern, if it has
    economic impact to the corporation, they may be coached or
    counseled.
        Mr. Allred. Yeah. That is great. Well, I have about 40
    seconds left.
        And, Captain Carey, I just want to ask you one more
    question. From your written testimony, you state that there is
    only one standard of safety and training and that, quote,
    ``simply put, Boeing does not produce aircraft for U.S. pilots
    versus pilots from the rest of the world.''
        Can you elaborate on that?
        Mr. Carey. Absolutely, sir. You know, we have to get away
    from the days of the American pilot machismo in the ``Top Gun''
    movie. Ethiopian Airlines flies a plane into Washington Dulles
    every day from Addis Ababa, and they have been doing it for
    years. They have a proud aviation culture. They were founded by
    TWA in 1945 and managed through 1975. They are very proud of
    the fact that Emperor Selassie was the only head of state from
    Africa to attend JFK's funeral because he had a Boeing aircraft
    that brought him here.
        Mr. Allred. Thank you so much.
        Mr. Larsen. Thank you.
        I now recognize Representative Johnson of Texas, and
    followed by Representative Davids from Kansas.
        Representative Johnson, 5 minutes.
        Ms. Johnson of Texas. Thank you very much, Mr. Chairman.
        And let me express my appreciation for all of the witnesses
    being here and especially the family representatives.
        We care deeply about airline safety. For one thing, all of
    us get on a plane every week, going and coming home, and so we
    are as concerned about American safety as any other safety
    around the world.
        I live in Dallas, Texas, where we have DFW and Love Field,
    and both airports have airlines very involved in this area. And
    it does cross my mind often how aboveboard we are with the
    examination of the planes and the agencies in charge, and
    wonder sometimes if some laxity might cause a little slip-up.
        I know that we have very, very safe aviation activities,
    but I wonder if each of you could tell me anything that would
    give us a little bit more assurance that we are headed in the
    right direction for making sure that safety is the number one
    concern each time a plane is involved.
        This kind of accident gets your attention, and we want to
    be supportive of whatever it takes to ensure more and more
    safety. We have more and more air traffic and more and more
    technology involved. Change does come. So I am very concerned.
    As an old mind who does not move as fast as some young ones, I
    am basically very concerned about safety and aviation. We see
    more and more traffic.
        So each of you will take some time, if you will, to give me
    some of your thoughts of what we need to focus on to ensure
    that.
        Ms. Pinkerton. Congresswoman, I think that you can rest
    assured that our aviation system is the safest in the world. I
    have been an observer of this industry for 20 years. I worked
    on the Hill and did oversight of the FAA. I worked at the FAA,
    and now I represent the airlines. And I can tell you, the
    dedicated people that are at the FAA and that are in the
    airline industry, safety is absolutely our top priority. And
    when accidents like this happen, we take them incredibly
    seriously. We go back, we look, and we try to be better the
    next time.
        So even though we have had a decade of a perfect safety
    record, albeit that one terrible fatality, we recognize that we
    have to be better. And that is why I mentioned in my testimony,
    the types of programs that we have right now, allow us to
    predict and prevent. We identify trends.
        I can assure you that when the FAA, because--and I will
    tell you what the good sign is. I think Sara Nelson mentioned
    she has noticed a chastened attitude and motivation. When
    something like this happens in the aviation community, we
    redouble our efforts. We don't rely on our perfect record from
    the past. We know we have to get better, and we are committed
    to doing that.
        Ms. Johnson of Texas. Thank you.
        Ms. Nelson. I would like to note that I agree
    wholeheartedly with Sharon. And I think that there is no doubt
    that everyone across the industry, whether it is regulators,
    operators, or the frontline personnel who make the airlines
    fly, are absolutely committed to safety, and can tell you
    without a doubt that that is the foremost thought on their
    minds.
        There are some things that we can learn from this, though,
    and things that we can do better. And one of them is fully
    funding FAA personnel and making sure that we are competitive
    with the private sector for the certification engineers who are
    working at the FAA. And I think that we can also make sure that
    the reporting systems that Captain Carey was talking about that
    help us continue to analyze how we are doing, look at near
    misses, look at potential problems where employees had a
    distraction with their safety duties, and they are able to do
    that because they can report these issues without a punitive
    response.
        So that has been under attack in recent years, and in our
    experience, has been diminished somewhat, and we have had to
    fight very hard for the continued programs that ensure a
    nonpunitive reporting system so that all of the employees can
    identify when they see an issue. And I would say that those two
    issues especially could be addressed in this time, both the
    funding and also the continued support of the reporting systems
    that allow us to continue to analyze the safety----
        Mr. Larsen. All right.
        Ms. Nelson [continuing]. Of citizens and keep us safe.
        Mr. Larsen. Thank you, President Nelson.
        Thank you, Representative Johnson.
        I recognize Representative Davids for 5 minutes.
        Ms. Davids. Thank you, Chairman.
        And thank you to all the witnesses who are here today to
    testify, and thank you to the families. My condolences on your
    loss and condolences to those who are not here today.
        The first thing I would like to do is just to acknowledge
    that all of us--we have heard from you, we have heard in
    previous testimony and hearings that we have had--that all of
    us recognize that safety is the underlying most important
    foundational piece of our aviation system, not just in this
    country, but around the world. And as leaders in that space, I
    know that all of the folks here are putting that as a top
    priority. I can tell from your testimony, not just your verbal,
    but also your written testimony, and the meetings that I have
    had with folks who are also part of the FAA.
        And I think that one of the pieces that we have to also
    keep in mind is that pronouncements from anyone, whether it is
    manufacturers, stakeholders, Members of Congress, or other
    people who are performing oversight, about what any causes
    might have been of these accidents are premature until we get
    the results of the investigations. And I have appreciated all
    of you bringing that up and continuing to remind folks of that.
        One of the things I would like to start off with is
    actually a followup from the line of questioning that Mr.
    Balderson was on earlier, which is to ask, Mr. Carey, you
    mentioned that the invitation for the folks from Allied Pilots
    made on June 5 simulator training was canceled. I am curious if
    you could tell us what the reasoning for the cancellation was.
        Mr. Carey. We are still trying to determine that. We
    initially received an invitation to go down to the Boeing
    simulator at Miami, 737 MAX full-motion simulator, and Captains
    Goldberg, behind me, and Captain Tajer, were going to
    participate in a flight review of the MCAS system at Boeing's
    invitation. The invitation was withdrawn. We are trying to get
    some simulator time either at Boeing.
        I mentioned earlier Ethiopian has a simulator we are trying
    to get into to use. And also a correction to my earlier
    statement, there are also two 737 MAX simulators in Canada. So
    if Boeing will not renew their invitation, we will certainly go
    purchase time at one of those other carriers.
        Ms. Davids. So at this point, there hasn't been a
    rescheduling of the invitation?
        Mr. Carey. No. That is somewhat upsetting to us. I mean, we
    are the largest airline in the world, and we would like a fair
    take at reviewing this MCAS scenario, in a muscle memory
    scenario as Captain Sullenberger described earlier.
        Ms. Davids. And then I would like to--Mr. Babbitt, I would
    like to hear your thoughts on the funding question in making
    sure that we are keeping FAA properly funded, both what was
    your experience, and then if you can opine on where we are at
    right now? I am not sure if you feel comfortable doing that
    because you are not currently the Administrator, but I would
    like to hear a little bit about that.
        Mr. Babbitt. Thank goodness for that. Thank you.
        The funding is always an issue. You come in with a robust--
    we have always an enormous amount of things that people would
    like the FAA to undertake and do. You simply don't have the
    funds. And so prioritizing what you need to do. And obviously,
    what is at the fulcrum of that prioritizing is safety.
        And I think in--I didn't get to answer Ms. Johnson's
    question, but I think the biggest fear we have is--and funding
    will help alleviate it, but the biggest fear that I have is
    complacency. We have a system that is incredibly safe and,
    therefore, a lot of people say, well, geez, it is running
    great. Why do we need to do anything else? Well, we need to do
    anything else because we are always breaking new boundaries,
    pioneering new areas, understanding new technology, and we have
    to evaluate those things.
        And remember, the FAA's task is not to design the systems;
    it is to design the safety boundaries that the system has to
    operate in. We--you know, it is sort of like baseball. You
    know, the commissioner set the rules. The players have to play
    by those rules, and that is what we do. That is what the FAA
    does.
        And so prioritizing--and I guess the best thing I could
    suggest is that we make certain that, when the FAA does, in
    fact, prioritize, they share those thoughts with the
    committees, which I know we do.
        Ms. Davids. Thank you.
        And finally, I would just say that the concept of oversight
    is something that is our duty under the Constitution. We also
    have the duty to make sure that we are properly funding all of
    our safety, especially aviation, but all of our safety
    mechanisms in this country. So that is on Congress.
        Thank you.
        Mr. Larsen. Thank you.
        I recognize Representative Craig of Minnesota for 5
    minutes.
        Ms. Craig. Thank you so much, Mr. Chairman.
        Again, as all of us, I want to express my sincere
    condolences to the families and friends of the victims of the
    Boeing 737 crashes. We take this responsibility in this
    Congress incredibly seriously. So thank you all for being here
    with us today.
        Before I came to Congress, I worked in a highly regulated
    space, the medical technology field, where we heeded very
    strict compliance and reporting requirements to disclose
    aftermarket or postmarket issues that were encountered by
    physicians, by hospitals, by many, many stakeholders with our
    devices. It was a government system, the FDA's Adverse Event
    Reporting System, sometimes referred to as the MAUDE database.
        Ms. Pinkerton, I found the voluntary reporting programs you
    mentioned to be incredibly interesting. And I wanted your
    thoughts on whether we should have a more structured approach,
    rather than a voluntary reporting system, so that, as Captain
    Sullenberger said, we resolve these risks before we encounter
    an event. If you would speak to that, and I am going to ask a
    number of you also to speak to whether you think the postmarket
    reporting requirements are adequate from an FAA perspective.
        Ms. Pinkerton. Thank you for the question. And with respect
    to the structure of our safety programs, I think the voluntary
    nature--and it will be great to hear from our union partners on
    that--the voluntary nature of it is part of the beauty of it,
    and Congress has passed statutory protections for voluntarily
    coming forward and, frankly, that has been a linchpin of our
    safety management systems and all of these data-sharing
    programs.
        So I would--you know, I think everything--and we certainly
    welcome any scrutiny of these programs. I think it is always
    good to ask the questions, but those programs are working
    remarkably successfully right now.
        With respect to the FAA standards on parts, I think--again,
    I think they are welcomed scrutiny. And that is the beauty of
    the oversight that you are taking seriously and that you all
    are performing. The IG, the Secretary has asked for oversight.
    Again, I think the scrutiny is welcomed. The standards are
    working very well right now.
        Ms. Craig. Captain Carey or Sullenberger, do you have
    anything to add to that?
        Mr. Carey. Well, we are quite proud of the fact that the
    Allied Pilots Association, in partnership with the FAA and
    American Airlines, established the first aviation safety
    reporting program nearly 25 years ago, it is now known as ASAP,
    and this has been tremendously successful in averting disasters
    over the last 25 years. And this program started with the
    pilots at American Airlines, but now it reaches out to the
    other stakeholder workgroups within the airline industry at
    every airline in the country.
        Mr. Sullenberger. Let me just add that I agree with Captain
    Carey. And as mentioned earlier about some of the maintenance
    issues with foreign repair stations and their oversight, those
    in particular are troubling. More and more, over time,
    airlines, for economic reasons, have outsourced much of their
    heavy maintenance that used to be done in-house by their own
    employees, supervised by their own employees, often there was
    an FAA overseer on the site, now to overseas locations where
    a--if the FAA even has the budget and the staff to make a
    foreign visit, it is virtually impossible for them to arrive
    unannounced.
        There is also a continuing problem within the industry of
    counterfeit parts, people trying to reuse parts or use parts
    without a proper provenance where you know with certainty its
    history from the manufacturer to its delivery onsite and to use
    in an airplane.
        So there still are some ongoing systemic issues that have
    never been resolved.
        Ms. Craig. Ms. Nelson, you mentioned in your testimony the
    2006 NTSB results of a study, ``Safety Report on the Treatment
    of Safety-Critical Systems in Transport Airplanes.'' The NTSB
    concluded that existing decisions made during design and
    certification process practices were not subject to ongoing
    risk assessment and consideration of new information from
    aftermarket operations and maintenance of aircraft.
        Do you believe that this 2006 NTSB recommendation has been
    addressed and implemented by the FAA?
        Ms. Nelson. This has been addressed, I would say, yes. It
    has not been fully implemented. And my assumption for the
    biggest reason that it has not been fully implemented is the
    funding to carry out those recommendations.
        Ms. Craig. It comes back to funding. Thank you so much.
        Mr. Chair, I yield the remainder of my time.
        Mr. Larsen. Thank you.
        I recognize Representative Stanton for 5 minutes.
        Mr. Stanton. Thank you very much, Chair Larsen. I
    appreciate it.
        Thanks for the witnesses for being here and being patient
    with this committee. Sorry we are coming in and out. Obviously,
    we serve on multiple committees.
        My first questions are for former FAA Administrator
    Babbitt. Mr. Babbitt, Captain Carey has questioned whether a
    sunset or termination date for FAA aircraft certification,
    particularly for those like the 737 designation from 1967,
    should be incorporated into the FAA certification process.
        As this committee examines the certification process, with
    your decades of FAA experience and as a pilot yourself, do you
    think this is an idea worth considering?
        Mr. Babbitt. Well, they actually do. Those certifications,
    the original certification in 1967, applied to that airplane
    obviously. And what you look at as, maybe 2 years later, we
    have a new engine we put on that airplane. Do we recertify it?
    Not really. It has maybe the same thrust, and so--and the
    parties work together. The airline, the manufacturer. They say
    this doesn't significantly operate the aircraft differently. It
    doesn't feel any differently. The pilots do need to understand
    what the new engine limitations might be, but that's that.
    Those are--every time there is a significant change made, it is
    evaluated by the FAA.
        I guess the point we should get to for this one is, were
    the changes made to this aircraft substantial enough that it
    should have dictated, wait a minute. It has got a different
    wing. It has got this. It has got that. Maybe we should have
    another type certificate for this airplane.
        And that is a valuable or, you know, something worth
    considering.
        Mr. Stanton. Thank you very much. As you know, Boeing
    advanced the 737 MAX as a fourth generation of the 737. This
    had several benefits for Boeing saving money. It gave them a
    jump-start on their design and engineering work and required
    less pilot training. But most importantly for Boeing, it
    allowed the company to apply for the same common type
    certification, saving considerable time in getting the aircraft
    off the ground.
        In your opinion, should the FAA have considered--under
    these circumstances, should the FAA have considered this a new
    aircraft model rather than a variation of an existing one?
        Mr. Babbitt. They did consider. I am certain that they
    looked at it, and there is an entire matrix of changes that you
    go through, and these are typically shared. I know in the past,
    most of the pilot unions involved get to look at that matrix,
    whether it is certification, minimum equipment, things like
    that. But what is important to remember, I have heard several
    times that if this was a new type certificate, it would be very
    expensive. Not necessarily. If the old airplane simply has one
    new feature and we say, well, we are going to have to give a
    different type rating for this, all you are going to have to
    train in is that difference.
        A great example is in the Airbus aircraft to transition
    from an A320 to an A330, which is a dramatically different
    airplane, it is 4 days of difference in training. If you had
    never flown an A320, it would be a 3- or 4-week course.
        Mr. Stanton. To your knowledge, has the FAA ever denied a
    manufacturer's application to treat an aircraft like a
    variation of an existing aircraft?
        Mr. Babbitt. Yes.
        Mr. Stanton. Thank you. My question is now for Captain
    Sullenberger. Captain, thank you for being here. I want to
    explore with you a question raised in Captain Carey's testimony
    on pilot training. As aircraft become more and technologically
    advanced, is the FAA equipped to make sure that pilot training
    is sufficiently rigorous to handle the potential scenarios that
    could arise?
        Mr. Sullenberger. I have concerns, Congressman, because
    over many years, pilots have been given less and less detailed
    information, especially in the documentation, the manuals that
    we have access to, even online. So it becomes harder and harder
    for those of us who really want to understand in a deep way
    exactly how these machines operate, where the surprises are,
    where the dark corners are, where the counterintuitive features
    are that we have that might bite us, it is a trap for us if we
    are unwary.
        And going back to the certification issue for a moment.
        Mr. Stanton. Please.
        Mr. Sullenberger. I want to address quickly one more, I
    think, unappreciated change that occurred with the MAX, having
    stretched this airplane even more than the previous version.
    The result of that, because of the legacy short landing gear,
    and the geometry that that affords for the nose angle on
    takeoff and landing, the speeds for takeoff and for landing
    have been increased significantly over previous versions, about
    20 knots, I understand, that is 23 miles an hour, which
    slightly increases the risk of a runway overrun.
        And when you are operating at airports like Burbank, like
    Chicago Midway, like LaGuardia that are short runways
    constrained by obstacles, in some cases by water, that becomes
    even more of a consideration, especially if the runways are wet
    or contaminated by snow and ice. And that is yet one more
    compromise that has been made in this latest stretch to the
    original design.
        Mr. Stanton. I thank you, Captain. I have more questions,
    but my time is short, so I will yield back. Thank you.
        Mr. Larsen. Thank you.
        Mr. Carbajal, you are recognized for 5 minutes. And I ask
    that you apologize to Mr. Brown.
        Mr. Carbajal. I apologize to whoever I need to apologize
    to.
        Thank you all for being here, for giving us your time and
    to share your thoughts and testimony with us.
        Captain Carey, thank you for your time again. I know you
    have a very distinguished career as a 35-year captain with
    American Airlines and spent time in Africa training African
    pilots.
        Based on your experience training non-U.S. pilots, why is
    it important for a company like Boeing to create an aircraft
    for pilots around the world and not just U.S. pilots? Are there
    any improvements you think the FAA can make to evaluate pilot
    training?
        Mr. Carey. Boeing is a national treasure. I worked as a kid
    in the machine shop on Long Island making parts for the
    aircraft industry. That is how I paid my way through flight
    training. The pilots in Africa or Europe--America--we are lucky
    here in the United States because we have a robust military,
    and we have a pool of well-trained military pilots. We also
    have a thriving corporate and commuter regional airline
    industry. So, again, we have a constant assembly line of well-
    trained experienced pilots. That doesn't exist in small nations
    around the world, like Greece or Portugal or Ireland or even
    the United Kingdom. They have to use ab initio trainings,
    programs.
        Ethiopia. When I was in Africa in 2012 and 2013, I was
    training the Presidential pilots for the President of
    Equatorial Guinea on their new Boeing 777 aircraft. And I spent
    a year there. And we maintained a relationship to use the
    training and maintenance facilities at Ethiopian. Ethiopian has
    a world-class maintenance and training facility. They can do
    overhauls on Boeing aircraft, just like we do at Tulsa Tech,
    American Airlines' largest maintenance facility in the world.
        Going forward, I would like to see more training. When I
    was hired 35 years ago, we trained every 6 months, recurrent
    training. Captain Sullenberger can attest to that. Now, the FAA
    has given what they call a single visit exemption, where
    airlines can retrain their pilots every 12 months. American
    Airlines happens to do 9-month cycles. I think we should go
    back to more training. More training leads to a safer sky.
        One fatality in seven billion is one more than we need. As
    Captain Sullenberger said earlier, we need to prevent accidents
    from the factory floor to the sky, and we can do it.
        Mr. Carbajal. Thank you. Mr. Babbitt, you oversaw the FAA
    after the crash of the Air France flight 447, and the Colgan
    Air flight 3407. In your testimony, you mention our Nation's
    system of aircraft certification has been evolving for over 60
    years and must continue to evolve to improve.
        What are some of the improvements that FAA can make to the
    current certification process and, two, from your experience,
    are there any lessons learned that we should keep in mind as we
    work through the issues facing the 737 MAX?
        Mr. Babbitt. Thank you for the question. I think that what
    the FAA could do has been mentioned by several people here. You
    are certainly going to need experts in the various areas of new
    technology that we are seeing. You know, we are now seeing
    artificial intelligence induced into decisionmaking an
    aircraft. And the data behind those needs to continue to
    expand, all of that takes money.
        So, you know, in terms of subject matter experts,
    increasing, you know, where we need them, and anticipating that
    is going to be very important. As I said in my testimony, data
    is our friend. You know, what we did coming out of 3407 or the
    Air France, we took that data and made changes based on it.
    Unfortunately, we don't have much data, as of today, for either
    the Lion Air or the Ethiopian accidents. We know the basics of
    what happened, but we don't know, and our own NTSB will
    eventually look at that data and give us more information,
    which will provide a roadmap for us to, OK, we need to expand
    and do a better job in these areas if we are going to take the
    lessons learned from that data.
        Mr. Carbajal. Thank you very much. Thank you both.
        Mr. Chair, I yield back.
        Mr. Larsen. Thank you.
        I recognize Representative Brown for 5 minutes.
        Mr. Brown. Thank you, Mr. Chairman.
        I too want to offer my condolences to the family and
    friends of those who died in the two crashes involving the
    Boeing 737 and MAX 8.
        I want to thank the panel, not only for being here today
    and your testimony, but your work as aviation safety advocates.
        A lot of your testimony, a lot of the questions have
    focused on training, and I don't want to be redundant, so I
    have been able to check off a lot of my questions. I just want
    to clarify a few things.
        The simulators, Captain Sullenberger, you mentioned a level
    D, I think you categorize it as a full feel simulator. I
    understand there is one in the United States, two in Canada,
    one in Ethiopia. Is that accurate?
        Mr. Sullenberger. That is my understanding.
        Mr. Brown. Are there other simulators that either--you
    know, that may not provide full feel, but allow for ample
    training on emergency procedures, system failures, mechanical
    failures----
        Mr. Sullenberger. Captain Carey would know better than I,
    but there are, of course, simulators for previous versions,
    including the 737 NG, the immediate predecessor to the MAX. But
    that, of course, wouldn't be able to replicate the activation
    of MCAS.
        Mr. Carey. That is correct.
        Mr. Brown. Let me--the cockpit is a busy place, even in
    normal flight conditions. And when there is a flight condition
    that triggers an emergency indicated in an instrument or some
    other indicator, it gets really, really busy. I just want to
    sort of explore. I come out of the Army aviation community
    where, you know, I flew back in the 1980s, so we still had sort
    of steam gauges in the OH-58, and I know we have advanced
    considerably in every airframe, rotary wing, and fixed wing,
    but can you give us a sense of--for the 737--how many emergency
    procedures are in the documentation, either a pilot's manual,
    an operator's manual for mechanical or system failures? Give us
    a rough estimate.
        Mr. Carey. I have my 737 subject matter experts behind me.
    They inform me there are hundreds, sir.
        Mr. Brown. There are hundreds. And of those hundreds, is
    there sufficient simulator time to train on those hundreds?
        Mr. Carey. We train--at American, we train every 9 months,
    and we go through the major ones, the ones that would be most
    difficult for a pilot to handle.
        Mr. Brown. And now, of course, the training challenge with
    the MCAS is that we didn't, as Captain Sullenberger mentioned,
    we lacked the information that it was on board. But are there
    other automated systems? And I think this is a followup to a
    question that was asked by Representative Titus. Are there
    other systems that create automated systems----
        Mr. Larsen. Mr. Brown, make sure you are getting in the
    microphone there.
        Mr. Brown. Yeah, I just couldn't see the witnesses beyond
    Mrs. Napolitano. Sorry, Mr. Chairman.
        Are there other automated--it is the design flaw of the
    room, don't worry. No, you are fine.
        Are there other automated systems that present similar
    challenges in terms of--and I am focusing on the simulator--
    that there is adequate simulator time to train on?
        Mr. Carey. Well, as far as the 737 MAX goes, the MCAS is
    the only federated system, which is not integrated into the
    flight control laws and logic. So this would be one that is
    unique in itself. As we talk about this in a static matter, you
    are an aviator yourself, we have to remember that as the pilots
    are trying to regain control of this aircraft, they experience
    +2 positive G forces and -.7 negative G forces. As you know,
    sir, those are extreme forces on the human body while you are
    trying to read a checklist, perform duties, move switches, move
    controls, not to mention the human suffering that was obviously
    heard behind the cockpit door. So this was a terrible situation
    to put an aircrew in.
        Mr. Brown. So, Captain Sullenberger, you mentioned that,
    you know, on the level D, there need to be more simulators or
    certainly more simulator time. Are there any other missing
    components in the training programs? This is a--you know, you
    mentioned simulators. Are there any other missing components?
        Mr. Sullenberger. Yes. And some things we are doing to some
    extent already, but we need to do much more. I have seen in my
    career a huge tsunami of change in technology and in training,
    and I have seen certain trims. One we mentioned already, the
    reduction in the information about their systems and their
    airplanes that is now available to pilots compared to years
    ago.
        Mr. Brown. Let me just jump in because I got 10 seconds.
    Does Congress need to legislate this or is this something that
    it can self-correct in the market or with the FAA?
        Mr. Sullenberger. I think it needs FAA direction. I think
    it needs--the airlines need incentives to do more training, not
    just in what we consider batting practice of one-off events,
    but really in an operational flying scenario. Give them
    multiple challenges that they have never seen before where they
    must have a creative reserve to use what they know, adapt it,
    and apply it in a new way to solve a new problem.
        Mr. Brown. Thank you, Mr. Chairman. I yield back.
        Mr. Carey. I concur.
        Mr. Larsen. Thank you.
        Just so we know, in order of the Members that are here, I
    will begin with Norton next, then Lynch, then Napolitano, and
    then Payne. That is the order that we have right now.
        Representative Norton, 5 minutes.
        Ms. Norton. I appreciate this hearing, but I particularly
    appreciate the families who are here. The least we owe you are
    our condolences.
        Actually, sometimes the committee learns more from the
    newspapers than from anyplace else. And I am looking at a--
    perhaps this is best for the pilots. I am looking at a New York
    Times piece that indicates--I am sorry, it is a Wall Street
    Journal piece, that 25 percent of people who fly airplanes want
    to avoid the MAX, 38 percent said they weren't sure. The flying
    public doesn't know what to do, in other words.
        But the FAA has signaled that it is preparing for flight
    trials for the proposed 737 MAX enhancement as early as this
    week and preparing to take an important step toward returning
    the 737 MAX service by late summer. Now, we know it will
    require the FAA endorsement and, indeed, foreign regulators as
    well. But I need to ask you, is this the pace that you would
    expect, given what Boeing has gone through in the last several
    months? Is this the pace to get back into service?
        Mr. Carey. Thank you, Congresswoman Norton. I would expect
    that Boeing and the FAA have this as their top priority, as do
    the air carriers who have these airplanes on order. We have 24
    MAXes--we had 24 MAXes in service at American Airlines, and now
    I believe there are 6 more that are already off the assembly
    line, and that is just 1 airline. These aircraft are needed.
    They are needed for passenger service. We want them back in
    service.
        Ms. Norton. But you think that this pace is to be expected?
        Mr. Carey. I think that the Boeing Corporation and the FAA
    is capable of getting this airplane back in the sky by the end
    of the summer.
        Ms. Norton. I think the flying public would be very
    pleased, given your expertise, to hear that. But I am now
    interested, I have become more interested again from what I
    read in the press and what happens in the factory.
        Now, the information I have is from the North Charleston
    plant. Now, the 737 MAX was designed and assembled there, but
    the information we have really bewilders me because it is on
    the 737 Dreamers. So the verdict seems to be in on that. And
    that the employees from the plants were whistleblowers, and
    as--5 years ago, the agency did not allow the employees from
    the plants to certify the aircraft to FAA. That is 5 years ago
    for the Dreamers--I am sorry. Yeah, the Dreamers.
        And it bothers me because the MAX is also manufactured
    there. The employees, the whistleblowers, said that they
    believed the strong demand for this other plane, on which the
    information is in, the 787, had pushed Boeing to quickly turn
    out jets as it raced to meet deadlines.
        So I am trying to find whether there is something endemic
    in the culture that we ought to watch out for, given what we
    already know now about the 787 Dreamers. And what do you think,
    therefore, of the pace in light of what we know about the
    Dreamers, which were also manufactured at the south--at the
    south Charleston factory?
        Ms. Pinkerton. Congresswoman, if I can respond. From the
    airline perspective, we have no interest in a rapid pace. We
    want----
        Ms. Norton. Well, you sort of have some interest in it.
    Obviously, Boeing is losing money, it needs to get these planes
    up in the air.
        Ms. Pinkerton. We have much--a much stronger interest in
    the FAA and Boeing working with our pilots union in getting----
        Ms. Norton. I am asking about this plant, which also is a
    plant that produced the MAX. Does anyone have any misgivings
    about that?
        Mr. Sullenberger. Congresswoman, I have seen those same
    reports, and it gives me great concern that with both the 787
    manufacturer and the manufacturer of the Air Force tanker, the
    KC-46, there was some debris left in some bays of the interior
    of the aircraft that could possibly chafe wiring and cause
    future issues, and that Boeing has become aware of this and is
    aggressively trying to get to the root of the problems with the
    manufacturing process so that no foreign objects remain in
    manufactured aircraft.
        Mr. Larsen. Thank you very much.
        I recognize Mr. Lynch for 5 minutes.
        Mr. Lynch. Thank you, Mr. Chairman.
        I want to thank the witnesses for their help this morning.
    And I certainly want to join my colleagues in offering my
    condolences to the families of the victims, and thank you for
    your presence here today.
        Earlier in the hearing, the ranking member mentioned that
    we should avoid politicizing this issue. And I do agree that
    over a long period of time, our aviation system had been
    extremely safe, a stellar record. And as someone who gets on a
    commercial airliner at least a couple of times a week, and as
    someone who has very warm relations with many of the pilots--I
    have been doing this for 20 years, so I have come to know a lot
    of the pilots, flight attendants, machinists, and people who
    work at the airport. My brother-in-law works on the runway at
    Logan Airport in my district. They all take enormous pride in
    that long and stellar safety record.
        On October 29, 2018, that long excellent record was
    severely damaged when Lion Air flight 610, a Boeing 737 MAX,
    crashed into the Java Sea at about 450 miles an hour, killing
    184 passengers and 5 crewmembers on board. That long record of
    excellent safety operations was again damaged 4 months later on
    March 10 of this year when Ethiopian Airlines flight 302,
    again, a Boeing 737 MAX, crashed 6 minutes after takeoff. That
    crash resulted in the deaths of all on board, 149 passengers
    and 8 crewmembers.
        After that crash, I, along with many of my colleagues on
    this committee, signed a letter asking that the 737 MAX be
    grounded. That decision was not political. That decision was
    based on the tragic facts, on the tremendous loss of life. We
    supported the grounding of the 737 MAX because we felt it was
    the right thing to do. It was the right thing to do for the
    pilots. It was the right thing to do for the crew. It was the
    right thing to do for the flight attendants, for the
    passengers, and for the public.
        I represent an area that surrounds Logan Airport. The main
    runways out of Logan take the majority of flights over my
    district, over the homes and schools and neighborhoods of the
    people who live in my district and who I represent. An air
    disaster like Lion Air or Ethiopian Air 302, coming out of
    Logan Airport, crashing minutes after takeoff in a densely
    populated area would be a mass casualty event on the ground in
    my district.
        So it wasn't a political decision to ground the 737 MAX
    after those accidents, and it won't be a political decision to
    put those planes back in the air. It will be based on the
    assurances that we have because of the experts that we have
    here today and the diligence that we will apply to the testing
    of this system that will rule the day on that decision.
        I do want to ask Captain Sullenberger, you know, the
    descriptions of the Lion Air disaster report that because of
    the faulty data on that angle of attack--the angle-of-attack
    data, the MCAS system, forced the nose of the aircraft
    downward, quote, ``more than two dozen times during an 11-
    minute span.'' And there were reports from other pilots who
    have had similar problems that the plane acted like a bucking
    bronco.
        I am just wondering, you know, some people are trying to
    blame the pilots here, and I am just wondering whether with an
    aircraft behaving like that, is it fair to blame--is it fair to
    blame these pilots? Because you would think that if we could
    get the software right, they wouldn't have to deal with an
    aircraft that is acting like a bucking bronco. I just don't
    want to take the easy path and blame the pilots.
        Mr. Sullenberger. I think asking--well, first, we shouldn't
    be blaming dead pilots. We need to do much more than that. But
    asking whether this was a pilot error or design error doesn't
    really address the right question, because human performance is
    a variable and it is situation dependent, and we must make
    accurate assumptions about what is possible in extreme
    emergencies, given the distractions, the workload, the task
    saturation.
        You are right, we shouldn't expect pilots to have to
    compensate for flawed designs. But we have to realize that
    everything we do, our entire system, the aircraft designs, the
    way we train pilots, the culture we have, the knowledge we give
    them, the information we give them or withhold from them
    determines three important things. How many errors----
        Mr. Larsen. Captain Sullenberger, I am sorry. You are going
    to have to get it in writing. Those three issues will have to
    be in writing to the committee.
        Mr. Sullenberger. I am sorry, what was that?
        Mr. Larsen. I am moving on to Mr. Payne. We will have to
    take it for the record.
        Mr. Sullenberger. I am sorry.
        Mr. Larsen. Thank you.
        Representative Payne for 5 minutes.
        Mr. Payne. Thank you, Mr. Chairman.
        And I too want to express my condolences to the family and
    friends who have suffered from this tragic event.
        But, Captain Carey, based on your experiences, what, if
    any, improvements can be made by the process that the FAA uses
    to evaluate what pilot training is required on new aircraft?
        Mr. Carey. Well, I would like the Administration to look
    into future designs. For example, the Boeing 777-900 will be in
    production in the near future. I would like to see pilot
    involvement, just like they do in the shipping industry or the
    United States Navy, where the crews are involved in the
    development of the airplane or the ship from when they lay the
    keel.
        I think that we have the subject matter experts at American
    Airlines management aviation side and the aviation side of the
    Allied Pilots Association to put significant input into the
    design and development of modern jet aircraft. I believe that
    if any of our pilots would have seen the MCAS system early on,
    that it would not have slipped through the cracks and not have
    entered service without robust training.
        Mr. Payne. Thank you. And that doesn't happen at this point
    now?
        Mr. Carey. No, sir.
        Mr. Payne. Thank you. Ms. Pinkerton, as you are aware, many
    airlines have canceled flights because of the grounding of the
    737 MAX causing immediate operational challenges and other
    issues. What are the long-term effects of a continued grounding
    on your carriers and the flying public?
        Ms. Pinkerton. Congressman, as I mentioned in my opening
    statement, carriers have been able to adapt. They are doing
    things like utilizing spare planes. They are postponing doing
    optional things like painting planes or putting on Wi-Fi. So
    they are taking a number of steps to ensure that we have the
    needed capacity in the system. And in fact, for the busy travel
    season, we are going to be up as an industry, up an overall 3-
    percent increase in capacity. So these are challenges. I don't
    mean to make it sound easy, but we are managing it to really
    mitigate the impact on passengers.
        Mr. Payne. OK. And, Mr. Chairman, I will be kind and yield
    back.
        Mr. Larsen. You are my favorite Member today.
        So that covers committee members, and I will now recognize
    Representative DeSaulnier for 5 minutes.
        Mr. DeSaulnier. Thank you, Mr. Chairman. I always wanted to
    be on this subcommittee, so I will try to be your second
    favorite. That will be a challenge.
        To the family members here, I couldn't help but think--
    search my memory from high school, the Arthur Miller play ``All
    My Sons,'' if you remember that, about people who built
    military aircraft in World War II and cut corners. And the
    ending of the play was by the person who was involved in
    cutting corners, and I am not saying that this was the case in
    this instance, said, I should have thought of all of those
    pilots as my children. And I think there is a good analogy here
    that we all should think of any loss of life should--although
    they weren't our children, we should think of it that way.
        Captain Sullenberger, nice to see you.
        Mr. Sullenberger. Good to see you, Congressman.
        Mr. DeSaulnier. For the chair and others, Captain
    Sullenberger has had the good wisdom to live in my district
    from time to time, so we have gotten to be friends, and I have
    great respect. We are working on a bill on safe landings, as a
    consequence of the Air Canada near miss at SFO. And I want to
    thank the committee staff and the chair for helping with that.
        We spent a lot of time, you and I, talking about human
    factors, and you talked about it in your comments, and, Captain
    Carey, maybe you can jump in here, and your comment that we can
    no longer define safety as the absence of accidents I think was
    very well put.
        So I look at the aviation industry. My perspective is you
    have got these issues on technology and human factors that we
    see in the chemical industry, the refining industry, the
    healthcare industry, and we are learning more and more about
    neuroscience and how we can help with that.
        So being able to do that is important, but you also have,
    in my view, the coming consequences for the aviation industry
    on climate change, how we are going to deal with that. I have
    an amendment put in Appropriations that the Academy of Sciences
    would look at that and look at all transportation, because we
    are going to have more disruptions, and pilots are going to
    have--and aircraft controllers, more challenges, and I
    anecdotally can see that.
        And then lastly is, what is a reasonable rate of return for
    the shareholders, knowing that you want private investors, but
    when they can move their investments around, there is pressure
    sometimes to cut corners. And sometimes to some people that is
    a euphemism for efficiency.
        So when it comes to human factors in the blending
    particularly of new technology, both of you have been eloquent,
    but could you add a little bit more to that that we could
    institutionalize it? Because I am afraid we are becoming
    complacent in this field because of our great safety record.
        Mr. Sullenberger. Well, first of all, I want to
    congratulate you for including in your bill much more emphasis
    on and funding for study of human factors. And as we use more
    and more technology, that human machine interface is going to
    become even more important.
        I would say that, talking about the federated versus
    integrated system where Boeing as a fix for this lately
    discovered instability issue with the MAX, they have appended
    to a conventional airplane a computer control system but
    without giving it the integrity, the reliability, the
    redundancy that it should have had.
        And so that needs to be part and parcel of everything that
    we do going forward, making sure that when we have any device
    or feature in an airplane that can autonomously move flight
    controls, in this case, a secondary flight control or a change
    engine thrust, it needs to be built to those highest standards
    and certified to those high standards.
        Mr. DeSaulnier. Captain Carey, do you have anything to add
    before I yield the balance of my time?
        Mr. Carey. I will leave you some time left, sir. I just
    have a quick comment about the near miss at San Francisco. And
    we talk about one level of safety all the time. The Canadian
    pilots have much more liberal flight time, duty time
    regulations than the U.S. pilots have. And I think maybe future
    panels should look into requiring overseas carriers to operate
    into our country under our rules and regulations.
        Mr. DeSaulnier. I am going to yield back the balance of my
    time, and thank the chairman for letting me sit on this
    hearing.
        Mr. Larsen. That is fine. Thank you, Representative
    DeSaulnier.
        So I understand there are no other questions from other
    Members. I do have one set of questions for the full panel.
        First off, for Captain Sullenberger, those three elements
    that you were going to cover for Mr. Lynch, what are they?
        Mr. Sullenberger. The design of our systems in which we
    operate determine how many errors will be made, what kinds of
    errors will be made, and how consequential those errors will
    be. And the safer we make our system, the fewer errors there
    will be, the less serious they will be, and the better the
    consequences of the inevitable human errors that are made.
        Mr. Larsen. Thank you.
        For all the members of the panel, is there one area of
    inquiry that you think this subcommittee should pursue? What
    would, in your view, the next step for the subcommittee be?
        Start here. If you have one now, then we will take it. If
    not, we will take it for the record.
        Ms. Pinkerton. I will think on that and provide you
    something for the record.
        Mr. Larsen. Thank you very much.
        Captain Carey?
        Mr. Carey. A critical checklist. For example, the MCAS--the
    airworthiness directive after the Lion Air crash that came out
    on the MCAS system. The manual trim, we learned after
    Ethiopian, that it was almost humanly not possible later stages
    in the event for a person to move the manual trim wheel. So we
    not only have to devise checklists, we have to make sure those
    checklists are able to be performed by a flight crew in that
    situation.
        Mr. Larsen. Thanks.
        Captain Sullenberger?
        Mr. Sullenberger. I would love to add two thoughts. First,
    that each aircraft manufacturer must have a systemic, a
    comprehensive way of safety risk assessment that can review
    holistically entire aircraft designs looking for risks, not
    singly, but in combination. And the second thought I would have
    is that leadership starts at the top, quality and safety start
    at the top, and it starts with governance at the board level of
    our aviation manufacturing companies.
        I would love to see more people with--men and women--with
    subject matter expertise and who understand the science of
    safety, and that means engineering expertise, someone needs to
    be a pilot on the board who understands the implication of
    design choices.
        Mr. Larsen. Interesting. Thank you.
        President Nelson?
        Ms. Nelson. In terms of getting the MAX back up in the air,
    there just simply needs to be transparency in the process and a
    full explanation to all the stakeholders and continued
    involvement. But what I think that this committee needs to
    really look at is the relationship between the FAA and the
    manufacturers and the airlines and this issue of client and
    customer relationship as opposed to governance and oversight
    from the FAA and proper funding to get that done.
        Mr. Larsen. Thank you.
        Mr. Babbitt?
        Mr. Babbitt. Yes, sir. I think the FAA, with committee
    oversight, and manufacturers as well need to devote a little
    more energy to understanding what is coming in the future with
    this relationship between the man and the machine and the
    interface. I have quoted in my written testimony, I didn't give
    it here, but in my written testimony, I quoted Chris Hart,
    former Chairman of the NTSB, who said, you know, automation
    does a wonderful job of masking weaknesses in human
    performance. But it is amplified when that automation fails,
    and I think we need to understand better what we could do to
    protect that from happening.
        Mr. Larsen. Thank you.
        Well, I want to thank the panel of witnesses for coming
    today, for responding to our request to be here, for helping
    the subcommittee understand better what the flying public
    thinks we ought to be doing, as opposed to what the FAA thinks
    or the industry thinks, and it is very helpful and appreciated.
        And before I gavel out, I do as well want to recognize the
    families, relatives, and friends of the men and women who were
    the victims of the two crashes. Thank you for coming, again,
    for being vocal in your efforts to ensure that this
    subcommittee stays accountable to the families and relatives
    and to the flying public here in the U.S.
        With that, there are no further questions. I ask unanimous
    consent the record of today's hearing remain open until such
    time as our witnesses have provided answers to any questions
    that may be submitted to them in writing. And unanimous consent
    that the record remain open for 15 days for any additional
    comments and information submitted by Members or witnesses to
    be included in the record of today's hearing. Without
    objection, so ordered.
        And if no other Members have anything to add, the
    subcommittee stands adjourned.
        [Whereupon, at 12:48 p.m., the subcommittee was adjourned.]

                           Submissions for the Record

                                  ----------

        Prepared Statement of Paul Hudson, President, FlyersRights.org,
                    Submitted for the Record by Hon. Larsen
        FlyersRights.org is the largest airline passenger organization with
    60,000 member/supporters and represents airline passengers on the FAA
    Aviation Rulemaking Advisory Committee (ARAC) on air safety issues.
    Paul Hudson has represented airline passengers and the general public
    on ARAC since 1993.
        As such we are a stakeholder with an abiding interest in the safety
    of the now grounded Boeing 737 MAX after two crashes in six months
    ended the lives of 346 passengers, crew, devastated several thousand
    family members and shocked the world aviation community and the general
    public.
        This is not the first time, FlyersRights.org has called for the
    grounding or limiting routes of Boeing airliners for safety reasons. In
    2013, we filed a petition for intervention with the NTSB with the
    support of three battery experts after battery fires caused the
    grounding of the Boeing 787 Dreamliner for six weeks. We have also
    criticized the safe use of this two engine aircraft by the FAA
    authorizing flights of five hours or more from the nearest emergency
    landing facility.
        We have also expressed concerns about the use of the two engine 737
    MAX for long distance over ocean flights to Hawaii and the North
    Atlantic, without several years of trouble-free operations which has
    been the traditional under FAA ETOPS certification standards.
        In early December 2018 we directly asked Boeing why it had not
    grounded the MAX based on the preliminary report of the Lion Air
    disaster and concerns by a pilot member familiar with Lion Air.
        The subject hearing has now exposed a slew of new and existing
    safety problems, plus a damning review of the MAX and its FAA
    certification in testimony by Captains Sullenberger, Carey and Babbitt,
    three of the most experienced commercial pilots and air safety experts
    in the US and the world.
        In our view this requires that the Boeing 737 MAX certainly not be
    ungrounded in the next 6-9 months, and that serious consideration be
    given to permanent revocation of its certification to offer air travel
    services to the general public. Some mistakes in its design are
    unfixable without a complete redesign to produce new aircraft that is
    inherently stable and safe for the public to fly.
        These likely unfixable safety problems include a design that is
    inherently unstable unlike any other airliner currently in service in
    US airspace, an MCAS automation system that is both needed to keep the
    plane from being unflyable or even crashing but that is subject to
    multiple failures requiring heroic efforts by pilots at best, to
    impossible ones at worst. Pilots must deal with about 100 emergency
    conditions already documented in flight manuals.
        On top of unfixable safety problems, the flying public, most
    aviation authorities and many pilots and flight attendants have lost
    confidence in both the MAX and its primary safety regulator the FAA. In
    a recent survey of our members, 70% said that they would not fly the
    MAX if it is ungrounded, 20% said they would and 10% responded other.
    Other surveys have shown before many of the revelations the past two
    months that 20-50% would not fly the MAX.
        Ultimately it is the flying public that will have the last word on
    whether this aircraft is commercially viable. Any airline that makes
    the current version of the 737 a major part of its fleet will be
    operating at a competitive disadvantage. And should a third crash occur
    it would threaten the viability of the Boeing Corporation, and the
    international leadership of the US commercial aviation industry with
    its 2 million jobs and the number one US goods export.
        History tells us that the public has little tolerance for mass
    fatality transportation disasters, be it the British ``unsinkable''
    Titanic, the German dirigible Hindenburg, the UK Comet as first
    jetliner (3 crashes in one year). In each case the public lost
    confidence and the companies failed, and the sponsoring nations lost
    their leadership in that form of mass transportation.

     Photos of 89 of the 157 Victims of the Ethiopian Airlines Flight 302
                 Crash, Submitted for the Record by Hon. Larsen

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                    Appendix

                                  ----------

      Questions from Hon. Garret Graves for Sharon Pinkerton, Senior Vice
       President, Legislative and Regulatory Policy, Airlines for America

        Question 1. There has been substantial focus on the quality and
    methodology of training at the major U.S. carriers. What training do
    U.S. carriers conduct to prevent an inflight loss of control accident?
        Answer. The FAA is extensively involved in virtually all aspects of
    Part 121 Carrier training of Pilots, Flight Attendants, and Mechanics.
    This includes not only the actual substance of the required training,
    but nearly every aspect of a Part 121 Carrier's training program,
    ranging from the adequacy of its facilities to the qualifications of
    its instructors.
        Requirements focused on preventing loss of control accidents--
    specifically the manual handling maneuvers most critical to stall and
    upset prevention--are mandated within the ``extended envelope''
    provisions of 24 CFR 121.423. This training consists of Extended
    Envelope Training (EET) and Upset Prevention and Recovery Training
    (UPRT), and as of March 12, 2019, is required of each pilot to be
    qualified to serve as either pilot in command or second in command for
    a Part 121 Air Carrier. Recurrent training follows on an annual basis.
    These two programs are typically required to be delivered in a Level C
    or higher full flight simulator and are intended to assure pilots gain
    confidence in their abilities and the capabilities of their aircraft in
    very dynamic conditions (ex. aircraft stall, upset, bounced landing).
    Both of these FAA mandated programs help ensure our Part 121 carriers
    are among the best trained aircrews in the world.

        Question 2. We heard comments/criticism that the B737 has been
    modified many times, yet pilots have been allowed to fly the various
    versions with little to no training. Can you comment on the role of the
    FAA regarding their oversight of Part 121 carriers and the operation of
    multiple models of the same aircraft type?
        Answer. As a routine part of the certification process, the FAA, in
    collaboration with the manufacturer, and operators, directs manual
    construction, training tables, and even limitations on the number of
    distinct models of an aircraft type an individual pilot can be deemed
    qualified to operate. For instance, when one U.S. airline began
    operating the B737 MAX aircraft, per FAA-imposed limitations, a pilot
    could maintain currency and qualification on only two variants of the
    B737. The FAA gave the airline a choice: its pilots could fly the B737
    Classic and the B737 Next Gen, or its pilots could fly the B737 Next
    Gen and the B737 MAX--but no pilot would be allowed to operate all
    three variants of the B737.

        Question 3. We have heard the term ``Advanced Qualification
    Program'' or AQP used regarding air carrier training. What does AQP
    refer to?
        Answer. An AQP is a training syllabus that seeks to integrate
    training and evaluation at each stage of a curriculum. For pass/fail
    purposes, pilots must demonstrate proficiency in scenarios that test
    both technical and crew resource management skills together. Air
    carriers participating in the AQP must design and implement data
    collection strategies which are diagnostic of cognitive and technical
    skills critical to their operations. In addition, they must implement
    procedures for refining curricula content based on quality control
    data. Thus, air carriers have a data informed, individual job task-
    centered training program. The items that are trained change as the
    carrier uses assurance data gathered through its Safety Management
    System (SMS) to identify areas within the operation where performance
    can be improved.

        Question 4. Recent statements by a number of aviation professionals
    seem to call into question the value of training materials on an iPad.
    Do you care to comment on these statements?
        Answer. Our member carriers training curricula includes, but is not
    limited to, simulator training in the areas of; Extended Envelope
    Training (FAR 121.423, AC 120-109A), Upset Prevention and Recovery
    Training (AC 120-111), Unreliable Airspeed Training, Manual Flight (to
    include Pitch, Power and Trim), and Automation Management. As mentioned
    earlier, an AQP uses data to inform a carrier of particular areas it
    needs to train. AQP actually incorporates a taxonomy to determine the
    appropriate medium for training for the tasks that need emphasis.
        Utilizing computer based training for items that require specific
    understanding or items that need emphasis has become a much-relied upon
    method for training delivery across all industry and has proven not
    only efficient but extremely effective, especially given an
    individual's relative ease of access to computer delivery. Tablets
    (i.e. Ipads) allow a pilot to effectively focus their attention on a
    specific area of emphasis, not only when required, but additionally,
    whenever and wherever they choose.

       Question from Hon. Garret Graves for Captain Chesley B. ``Sully''
                 Sullenberger III, Pilot, US Airways (Retired)

        Question 1. Having had the opportunity to participate in flight
    simulations of both the Lion Air and Ethiopian Airlines accidents, can
    you comment on your observations and experience?
        Answer. Within seconds, the crews of the Lion Air and Ethiopian
    flights would have been fighting for their lives in the fight of their
    lives.
        These two accidents, as well as Air France 447 which crashed in the
    South Atlantic in June 2009, are also vivid illustrations of the
    growing level of interconnectedness of devices in aircraft. Previously,
    with older aircraft designs, there were mostly stand-alone devices, in
    which a fault or failure was limited to a single device that could
    quickly be determined to be faulty and the fault remain isolated. But
    with integrated cockpits and data being shared and used by many
    devices, a single fault or failure can now have rapidly cascading
    effects through multiple systems, causing multiple cockpit alarms,
    cautions and warnings, which can cause distraction and increase
    workload, creating a situation that can quickly become ambiguous,
    confusing and overwhelming, making it much harder to analyze and solve
    the problem.
        MCAS was software that was designed to autonomously move flight
    controls (in this case a secondary flight control) and that was
    essentially a fly-by-wire system, but it was not designed with the
    integrity, reliability and redundancy that a fly-by-wire system
    requires.
        And the fact that MCAS was appended to a conventionally controlled
    airplane meant that it was federated and not integrated into it, thus
    it lacked appropriate protections.
        In both 737 MAX accidents, the failure of an AOA sensor quickly
    caused multiple instrument indication anomalies and cockpit warnings.
    And because in this airplane type the AOA sensors provide information
    to airspeed and altitude displays, the failure triggered warnings
    simultaneously of speed falsely being too low and also of speed being
    too high. The false too slow warning was a `stick-shaker' rapidly and
    loudly shaking the pilot's control wheel. The too fast warning was a
    `clacker', another loud repetitive noise signaling overspeed. These
    sudden loud warnings would have created major distractions and would
    have masked the cause and made it even harder to quickly analyze the
    situation and take effective corrective action.
        I recently experienced all these warnings and indications and more
    in a full motion Level D Boeing 737 MAX flight simulator during
    recreations of the accident flights. Even knowing what was going to
    happen, I could see how crews could have run out of time and altitude
    before they could have solved the problems.
        First, the startle factor of a sudden confusing emergency is real
    and huge. I know from personal experience on US Airways 1549 that it
    absolutely interferes with one's ability to respond effectively. One's
    pulse and blood pressure suddenly increase, and one can feel it
    happening. The sudden stress of a life-threatening crisis causes tunnel
    vision, a severe narrowing of focus.
        The fact that with MCAS active, simply pulling back on the controls
    would NOT stop MCAS from running the pitch trim nose down robbed the
    pilots of the single most effective and intuitive tool that pilots have
    in a situation like this, because MCAS inhibits the control column trim
    cutout switches. And the most insidious aspect of MCAS was that it kept
    repeatedly lowering the nose very rapidly. It was maniacal.
        The many loud, and in some cases, false warnings would have created
    a high workload, leading to task saturation, as the pilots tried to
    keep the nose of the aircraft from repeatedly being lowered by MCAS,
    and completely explain how it was that crews were not able to realize
    that thrust was causing rapid acceleration.
        And the fact that MCAS kept running the trim nose down in
    intermittent spurts made it much harder for these crews to recognize
    the emergency as a traditional runaway trim scenario.
        And I also experienced firsthand how difficult it was to move the
    pitch trim wheels manually, at high airspeeds requiring both hands or
    the efforts of both pilots, and at very high airspeeds, it may not be
    possible to move the trim manually until the control wheel is moved
    forward, further lowering the nose to reduce the very high airloads on
    the horizontal stabilizer.

    Questions from Hon. Garret Graves for Hon. J. Randolph Babbitt, Former
                 Administrator, Federal Aviation Administration

        Question 1. Mr. Babbitt, when an aircraft like the 737 MAX receives
    an amended type certificate, is it certified based on current
    certification standards or under the standards the original type
    certificate was issued? Is there something inherently unsafe in using
    an amended type certificate to certify an aircraft?
        Answer. Before issuing an amended type certificate, the FAA reviews
    the new design to determine which design standards must be met. When
    the design changes are significant, the new design will be required to
    meet the latest standards. For some elements of the design where the
    safety of that design has been well established, changes to the
    standard may not be required. If the design includes new or novel
    design features for which there is no current design standard, a new
    standard will be established. The process for establishing the safety
    standards for the new design is a thorough and time-consuming review
    for the FAA and the manufacturer. These processes assure that the newly
    amended type certificate meets the appropriate safety standards.

        Question 2. One of your key safety initiatives was making sure
    pilots did not fall too reliant on automotive systems. How can we
    better train pilots to not become reliant on automation and equip them
    with the skills necessary to deal with system malfunction?
        Answer. Pilots in today's airspace system need to continue
    receiving advanced training to operate in today's operational
    environment. We should utilize the new technology available today to
    expand training with the use of visual reality and high-fidelity
    simulation so that no pilot should ever be surprised by events that
    take place in an aircraft in which they are certified. That includes
    exposure to all phases of the operational envelope and environment as
    well as the built-in safety protections and automation that is designed
    to protect the operating envelope from excursions. Pilot training
    should also require a full understanding of all possible control inputs
    produced by automation as well as the logic driving the automation
    actions.
        Additionally, training and line operation should include
    requirements and demonstrations of manually flying aircraft to confirm
    pilot skills are being maintained to guarantee safe operations when
    automation is not available or has failed for any reason.

        Question 3. Having had the opportunity to participate in flight
    simulations of both the Lion Air and Ethiopian Airlines accidents, can
    you comment on your observations and experience?
        Answer. The simulator session which I operated from the left seat
    as the pilot in command included both versions of the Max 8 software
    and both scenarios were flown with the Captain's Angle of Attack
    (``AOA'') sensor failed. On take-off, at rotation, the ``Stick Shaker''
    warning went off, so I used the ``Failed Airspeed Indication''
    procedures and proceeded to retract the flaps to ``clean''.
        Once the flaps retracted the MCAS became armed and began to trim
    the aircraft to a nose down (``AND'') attitude and I instinctively
    trimmed the nose back up to a neutral control column position and
    turned off the trim system, which is both instinctive and standard
    procedure in all Boeing Aircraft for a ``runaway stabilizer trim
    emergency''.
        The Boeing pilot asked me to repeat the same event but asked that I
    not turn off the trim switches nor trim the aircraft. The control
    column forces got fairly heavy as the MCAS trimmed and when back
    pressure on the control column was relaxed, MCAS again trimmed the nose
    down further. I allowed the MCAS to trim a third time and then
    electrically trimmed the aircraft back to ``neutral control column
    pressure'', turned the Stabilizer Trim Switches off and flew the
    aircraft to a normal landing using manual trim.
        Repeating with the upgraded software change the main difference was
    that MCAS only trimmed once and even without nose up trimming to
    neutral, the control column pressure to maintain level flight was very
    manageable and then later, by turning off the Stabilizer Trim switches,
    we returned to a normal landing again using manual trim.
        My overall impression was the original software was a bit
    aggressive and in retrospect could have had more background information
    for pilots in their initial training. Seeing the new software and the
    requirement for dual input from angle of attack indications for all
    practical purposes eliminates the potential for an accidental
    triggering of the MCAS system. Additionally, when the system does call
    for MCAS input, it is less aggressive and restricted to only one input
    occurrence.