[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]


THE BOEING 737 MAX: EXAMINING THE DESIGN, DEVELOPMENT, AND MARKETING OF 
                              THE AIRCRAFT

=======================================================================

                                (116-40)

                                HEARING

                               BEFORE THE

                              COMMITTEE ON
                   TRANSPORTATION AND INFRASTRUCTURE
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                               __________

                            OCTOBER 30, 2019

                               __________

                       Printed for the use of the
             Committee on Transportation and Infrastructure

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]


     Available online at: https://www.govinfo.gov/committee/house-
     transportation?path=/browsecommittee/chamber/house/committee/
                             transportation
                             
                             
                              __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
38-282 PDF                  WASHINGTON : 2019                     
          
--------------------------------------------------------------------------------------                             
                             
                             
             COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE

                    PETER A. DeFAZIO, Oregon, Chair
ELEANOR HOLMES NORTON,               SAM GRAVES, Missouri
  District of Columbia               DON YOUNG, Alaska
EDDIE BERNICE JOHNSON, Texas         ERIC A. ``RICK'' CRAWFORD, 
RICK LARSEN, Washington                  Arkansas
GRACE F. NAPOLITANO, California      BOB GIBBS, Ohio
DANIEL LIPINSKI, Illinois            DANIEL WEBSTER, Florida
STEVE COHEN, Tennessee               THOMAS MASSIE, Kentucky
ALBIO SIRES, New Jersey              MARK MEADOWS, North Carolina
JOHN GARAMENDI, California           SCOTT PERRY, Pennsylvania
HENRY C. ``HANK'' JOHNSON, Jr.,      RODNEY DAVIS, Illinois
    Georgia                          ROB WOODALL, Georgia
ANDRE CARSON, Indiana                JOHN KATKO, New York
DINA TITUS, Nevada                   BRIAN BABIN, Texas
SEAN PATRICK MALONEY, New York       GARRET GRAVES, Louisiana
JARED HUFFMAN, California            DAVID ROUZER, North Carolina
JULIA BROWNLEY, California           MIKE BOST, Illinois
FREDERICA S. WILSON, Florida         RANDY K. WEBER, Sr., Texas
DONALD M. PAYNE, Jr., New Jersey     DOUG LaMALFA, California
ALAN S. LOWENTHAL, California        BRUCE WESTERMAN, Arkansas
MARK DeSAULNIER, California          LLOYD SMUCKER, Pennsylvania
STACEY E. PLASKETT, Virgin Islands   PAUL MITCHELL, Michigan
STEPHEN F. LYNCH, Massachusetts      BRIAN J. MAST, Florida
SALUD O. CARBAJAL, California, Vice  MIKE GALLAGHER, Wisconsin
    Chair                            GARY J. PALMER, Alabama
ANTHONY G. BROWN, Maryland           BRIAN K. FITZPATRICK, Pennsylvania
ADRIANO ESPAILLAT, New York          JENNIFFER GONZALEZ-COLON,
TOM MALINOWSKI, New Jersey             Puerto Rico
GREG STANTON, Arizona                TROY BALDERSON, Ohio
DEBBIE MUCARSEL-POWELL, Florida      ROSS SPANO, Florida
LIZZIE FLETCHER, Texas               PETE STAUBER, Minnesota
COLIN Z. ALLRED, Texas               CAROL D. MILLER, West Virginia
SHARICE DAVIDS, Kansas               GREG PENCE, Indiana
ABBY FINKENAUER, Iowa
JESUS G. ``CHUY'' GARCIA, Illinois
ANTONIO DELGADO, New York
CHRIS PAPPAS, New Hampshire
ANGIE CRAIG, Minnesota
HARLEY ROUDA, California
Vacancy
                                CONTENTS

                                                                   Page

                   STATEMENTS OF MEMBERS OF CONGRESS

Hon. Peter A. DeFazio, a Representative in Congress from the 
  State of Oregon, and Chair, Committee on Transportation and 
  Infrastructure:

    Opening statement............................................     1
    Prepared statement...........................................     5
Hon. Sam Graves, a Representative in Congress from the State of 
  Missouri, and Ranking Member, Committee on Transportation and 
  Infrastructure:

    Opening statement............................................     7
    Prepared statement...........................................    10
Hon. Rick Larsen, a Representative in Congress from the State of 
  Washington, and Chair, Subcommittee on Aviation:

    Opening statement............................................    12
    Prepared statement...........................................    12
Hon. Garret Graves, a Representative in Congress from the State 
  of Louisiana, and Ranking Member, Subcommittee on Aviation:

    Opening statement............................................    13
    Prepared statement...........................................    14
Hon. Eddie Bernice Johnson, a Representative in Congress from the 
  State of Texas, prepared statement.............................    32

                               WITNESSES

Dennis Muilenburg, President and Chief Executive Officer, The 
  Boeing Company; accompanied by John Hamilton, Chief Engineer, 
  Boeing Commercial Airplanes:

    Oral statement...............................................    15
    Prepared statement...........................................    17

                       SUBMISSIONS FOR THE RECORD

Slides Submitted for the Record by Hon. DeFazio:

    Slide based on Boeing's MCAS ``Preliminary Design Decision 
      Memo,'' Nov. 8, 2012 


    Slide based on Boeing's MCAS ``Coordination Sheet,'' June 11, 
      2018, No. 1................................................    22
    Slide based on Boeing internal email from Aero-Stability and 
      Control group employee, Dec. 17, 2015......................    23
    Slide based on Boeing's ``737 MAX Software Update'' Webpage..    24
    Slide based on Boeing's ``737 MAX, 777X, and 787-9 Executive 
      Review,'' March 4, 2014, No. 1.............................    40
    Slide based on Boeing's ``737 MAX, 777X, and 787-9 Executive 
      Review,'' March 4, 2014, No. 2 


    Two (2) slides based on Boeing PowerPoint presentation to FAA 
      on Dec. 17, 2018...........................................    77
    Slide based on Boeing's MCAS ``Coordination Sheet,'' June 11, 
      2018, No. 2................................................    79
    Two (2) slides based on Boeing's ``737 MAX Training'' 
      brochure, July 20, 2017....................................    87
    Slide based on Boeing internal email, ``Subject: MAX 
      Differences Training approved at Level B!!!!!'' Aug. 16, 
      2016.......................................................    88
    Slide based on Boeing email, from Mark Forkner to individual 
      at FAA, Nov. 3, 2016.......................................    89
    Slide based on undated Boeing PowerPoint presentation from a 
      Boeing manager at Boeing's Commercial Airplanes division, 
      No. 1......................................................   100
    Slide based on undated Boeing PowerPoint presentation from a 
      Boeing manager at Boeing's Commercial Airplanes division, 
      No. 2......................................................   101
    Slide based on Boeing's ``Flight Crew Operations Manual'' for 
      Lion Air, Aug. 16, 2018, No. 1.............................   109
    Slide based on Boeing's ``Flight Crew Operations Manual'' for 
      Lion Air, Aug. 16, 2018, No. 2.............................   110
``Final Aircraft Accident Investigation Report 
  KNKT.18.10.35.04,'' Submitted for the Record by Hon. Crawford..    31
Article entitled, ``FAA Discovers New Safety Concern During 
  Boeing 737 MAX Test,'' Submitted for the Record by Hon. 
  Mucarsel-Powell................................................    83
Flight Crew Operations Manual Bulletin for The Boeing Company, 
  No. TBC-19, Issued Nov. 6, 2018, Submitted for the Record by 
  Hon. Plaskett..................................................    95
List A, Submitted for the Record by Hon. DeFazio:

    MCAS Preliminary Design Memo--TBC-T&I 010920 (p.1), 010926 
      (p.7)......................................................   119
    AOA Sensor email string--TBC-T&I 10584-10586.................   121
    Slide presentation to Ethiopian Air--TBC-T&I 001999-002000; 
      002018.....................................................   124
    Email string on Level B Training Intent--TBC-T&I 048705, 
      048706, 048707, 048708.....................................   127
    PowerPoint on Training Marketing--TBC-T&I 000588 (p.1), 
      000597 (p. 10).............................................   131
    FAA Letter of Dec. 13, 2018--TBC-T&I 297016..................   133
    Boeing Letter of Jan. 30, 2019--TBC-T&I 29017-297018.........   134
    FAA Letter of March 1, 2019--TBC-T&I 297019-297020...........   136
    Email on Level B Training--TBC-T&I 010892-010894.............   138
    FAA Memo of June 30, 2017, from Transport Airplane 
      Directorate to Aircraft Certification Service (AIR) 
      Voluntary Safety Oversight Board...........................   141
    Boeing presentation of Nov. 2016, ``Undue Pressure: Key 
      Learnings and Next Steps''.................................   144
    Letter of Feb. 22, 2019, from FAA Aircraft Certification 
      Service to Boeing..........................................   152
    Letter of March 1, 2019, from FAA Aircraft Certification 
      Service to Boeing..........................................   157
List B, Submitted for the Record by Hon. DeFazio:

    Coordination Sheet--Revision D--TBC-T&I 029160-029166........   159
    Coordination Sheet--Revision G--TBC-T&I 030584-030592........   166
    Flight Crew Operations Manual--TBC-T&I -050498; -050514; -
      051408.....................................................   175
    MCAS Development and Certification Overview--TBC-T&I 130073-
      130074; 130075-130117......................................   178
    Presentation on Stall Characteristics--TBC-T&I 033941-033942, 
      033944-033945, and 033947..................................   202
    Transmittal Letter and Revision O of Certification Plan--TBC-
      T&I 371200-371201, TBC-T&I 371202 (p.1), 321228 (p. 27), 
      371503 (p. 302)............................................   207
    Presentation to EASA--TBC-T&I 371753, 371755, 371758, 371767, 
      and 371768.................................................   212
    Flight Test Certification Report--TBC-T&I 055903-055914......   215
    Email chain and memo on promise of No Simulator training--
      FAA-DeFazio 32883-32890....................................   227
    FAA memo of March 10, 2014, on rudder cable--FAA-T&I 30223-
      30228......................................................   235
    Issue Paper of March 21, 2016, on rudder cable--FAA-DeFazio 
      28872-28888................................................   241
    Safety Review Program Findings and Recommendations--FAA-
      DeFazio 28922-28937........................................   258

                                APPENDIX

Questions from Hon. Peter A. DeFazio for Mr. Muilenburg..........   275
Questions from Hon. Rick Larsen for Mr. Muilenburg...............   280
Questions from Hon. Salud O. Carbajal for Mr. Muilenburg.........   280
Questions from Hon. Sharice Davids for Mr. Muilenburg............   281
Questions from Hon. Sam Graves of Missouri for Mr. Muilenburg....   281
Questions from Hon. Garret Graves of Louisiana for Mr. Muilenburg   282
Questions from Hon. Brian Babin for Mr. Muilenburg...............   287
Questions from Hon. Jenniffer Gonzalez-Colon for Mr. Muilenburg..   288

 
THE BOEING 737 MAX: EXAMINING THE DESIGN, DEVELOPMENT, AND MARKETING OF 
                              THE AIRCRAFT

                              ----------                              


                      WEDNESDAY, OCTOBER 30, 2019

                  House of Representatives,
    Committee on Transportation and Infrastructure,
                                            Washington, DC.
    The committee met, pursuant to notice, at 10:05 a.m. in 
room 2167, Rayburn House Office Building, Hon. Peter A. DeFazio 
(Chairman of the committee) presiding.
    Mr. DeFazio. The Committee on Transportation and 
Infrastructure will come to order.
    I ask unanimous consent that the chair be authorized to 
declare recesses during today's hearing.
    Without objection, so ordered.
    I also ask unanimous consent that the chair and ranking 
member of the full committee be recognized for 10 minutes each 
during the first round of questions.
    Without objection, so ordered.
    Before I begin I want to explain an administrative matter 
regarding some of the documents we may use in today's hearing, 
and that will be entered into the record. I will be making two 
unanimous consent requests in reference to two documents, list 
A and list B.
    First, the documents contained on list B are marked 
``export control.'' We have been advised by the House General 
Counsel that the Constitution provides ample authority for us 
to release these documents and the documents from Boeing. 
Boeing's attorneys agreed to the release of these documents. I 
see nothing that is export-sensitive in these documents. The 
FAA stamped every document they sent us as ``export control.''
    However, to prevent confusion with regards to documents 
with ``export control'' markings on them, I will be making a 
unanimous consent request regarding the release of these 
documents, pursuant to the Export Control Act.
    Second, I will be making a unanimous consent request to 
enter the documents on list A into the hearing record. This 
list includes the export control documents on list B, as well 
as additional documents. The ranking member's staff is aware of 
all these, and has reviewed all these documents that are on 
both lists.
    And with that I ask unanimous consent that the documents on 
list B be disclosed pursuant to 50 U.S. Code, section----
    Mr. Graves of Missouri. Mr. Chairman?
    Mr. DeFazio. Yes?
    Mr. Graves of Missouri. I want to reserve my right to 
object at this point.
    Mr. DeFazio. The gentleman is recognized.
    Mr. Graves of Missouri. The reason for doing that is we 
have had two--at least two, that I can remember--hearings 
noting Chinese infiltration of American industries, and that 
includes rail, maritime, transit, you name it, and they would 
love to have the opportunity to get their hands on technology 
from the aviation industry, as well. And it concerns me in a 
big way.
    We have talked about this and gone over this. These 
documents have all been made available to everybody on the 
committee. Making these documents available to the public, or 
putting them out there in the public domain, I think, is a real 
problem. I do. And I think we are cutting ourselves off at the 
legs when it comes to that technology. It concerns me. It 
concerns me in a big way, and I really want us to think about 
that, moving forward.
    Having said that, I will withdraw my right to object, and 
allow this to move forward, because I do want to get answers. I 
think we can get the answers without these, but I do want to 
get the answers, so will remove that request.
    Mr. DeFazio. Well, I thank the gentleman. And I didn't take 
a back seat to anybody in the issues regarding China. I voted 
against most-favored-nation status, opposed them going into the 
WTO. I have raised concerns for decades about their theft of 
U.S. technology, and their unfair trade practices. So I 
certainly share the gentleman's concerns.
    I have reviewed these documents. I don't think there is 
anything in there that will be of any utility to the Chinese. 
But in any case, I recognize your concerns. So I just have to 
finish reading this list B. It will be disclosed pursuant to 50 
United States Code section 4820(h)2(b)2, because withholding 
such information is contrary to the national interest.
    Without objection, so ordered.
    In addition, I ask unanimous consent to enter all the 
documents on list A into the hearing record.
    Without objection, so ordered.
    [The information follows:]

                                 
      List A and List B, Submitted for the Record by Hon. DeFazio
    List A is on pages 119-158. List B is on pages 159-273.

    Mr. DeFazio. Let's proceed now to the hearing.
    I first want to recognize the families who are here today. 
I have met twice with families. I don't know if have met with 
all of you who are here today. And I want to convey my utmost 
condolences. It is 1 year and 1 day after the Lion Air crash, a 
very somber day. We shouldn't have to be here, but we are. And 
we are going to get to the bottom of this, and we are going to 
fix it, and we are going to see it never happens again.
    With that, I would thank the witnesses for being here, Mr. 
Muilenburg, Mr. Hamilton, this is the fourth hearing the 
committee has held, our first full committee hearing. Given the 
extraordinary interest of members of the committee, I felt it 
best to do it in full committee. I know that Boeing told us 
that they wanted to wait until the airplane was ungrounded, but 
I felt it was very important for them to testify before that 
happened.
    We are here today because 346 people--sons, daughters, 
fathers, mothers--died on two MAX aircraft within a 5-month 
period. Something went drastically wrong.
    As you know, our committee has been conducting a very 
robust investigation for a long time. We have never undertaken 
an investigation of this magnitude, to the best of my 
knowledge, in the history of this committee, which is the 
second oldest committee in the United States Congress.
    And we have received hundreds of thousands of pages of 
documents from Boeing. They have been cooperative in providing 
those documents, and agreeing that we could use those documents 
in the public hearing. And we have received tens of thousands 
of pages from the FAA. We have conducted some interviews with 
FAA employees. We have others we wish to interview, and we have 
requested to interview Boeing employees, but we are told that 
we have to be in line behind the Justice Department. So those 
are still forthcoming.
    There are a lot of unanswered questions that we need to get 
to the bottom of. We know that a new and novel system called 
MCAS took these two planes into an uncontrollable attitude 
after it repeatedly triggered, having to do with a faulty or 
missing sensor. The system was wired to one sensor.
    And in May, then-Acting Administrator Elwell sat there, and 
I asked him, was MCAS a safety-critical system? He said yes. 
Then how could it have been approved to trigger with a single 
point of failure? He had no answer to that. How could the FAA 
approve it? How could the manufacturer do that? He had no good 
answer. We are going to continue to pursue the roots of this 
problem.
    We do know that at one point, Boeing had planned to inform 
pilots about MCAS. In fact, it was in the first version of the 
flight manual when it was a relatively benign system. But when 
it became a radical system which could trigger a catastrophic 
failure, it came out. Some of that was discussed in the Senate 
yesterday and it will be discussed here again today, 
particularly quoting from Boeing's chief test pilot. And his 
instant messages seem inexplicable.
    Secondly, we do know that Boeing engineers actually 
proposed placing a MCAS annunciator in the cockpit. But again, 
that came out in later versions, or in the actual production 
version.
    And then it wasn't until after Lion Air that Boeing 
informed anyone. And still at that point, I think, soft 
peddling MCAS, that it was in the plane. I have talked to a lot 
of pissed off pilots. They said, ``We were the backup system? 
How can we be backup, if we don't know something is going to 
take over our plane?'' There is quite a bit of discontent out 
in the aviation community about that.
    We now know that Boeing and the FAA assume pilots would 
appropriately react in 4 seconds. Four seconds. But Boeing had 
information, which we will get to a little later in this 
hearing, that some pilots might react in 10 seconds or longer. 
And, if that happens, the results would be catastrophic, and 
result in the loss of the aircraft, as happened twice.
    We now know from the very beginning of the plane's 
development Boeing was--they had a phone call. The phone call 
was, hey, major customer, we are going to buy Airbus. They have 
better fuel economy, and the pilots don't need retraining, 
which is very expensive and disruptive of our schedules. So 
Boeing, from day one, had to meet that. Instead of a clean 
sheet airplane, they got the 12th or 13th iteration of the 737 
amended type certificate. That meant big engines mounted 
forward, flies differently.
    Then they had to develop a system to make it fly the same 
as the others, so it wouldn't have to go through pilot training 
or recertification. And that drove the whole process.
    We do know that Boeing offered Southwest Airlines $1 
million per plane rebate if the pilots had to be retrained. 
Imagine what the pressures were from the top on down to mid-
level, low-level engineers. You are saying, ``What? No, no, no. 
Can't have that. It has cost us a million bucks a plane, $300 
million for that one contract.'' Maybe other contracts had the 
same provision. Cost us our marketing advantage. Slow things 
down.
    And then, there has been a lack of candor all through this. 
Boeing learned that the AOA, angle-of-attack, disagree light, 
which was a standard feature on all Boeing 737s, did not work 
on this plane, unless someone bought the upgraded package. We 
were told that was an inadvertent software error in developing 
the upgraded package, but--that may be so.
    But Boeing decided to delay the fix for 3 years, until 
2020. They didn't tell the FAA, they didn't tell the customers, 
and they didn't tell the pilots about this until after the Lion 
Air crash. That is inexplicable. They say, ``Well, it is not 
necessary for safe operation of the MAX,'' but keeping 
everybody in the dark and having that--there it is, it is 
there, it is right in front of the pilot, it is not lighting 
up. Well, it can't light up, even if there is disagreement.
    And it was included in the flight manual, unlike MCAS. Wow. 
So you include something in the manual that doesn't work, but 
something that is going to work and potentially cause 
catastrophic issues is not in the manual. What was that all 
about?
    We know there was the tremendous pressure on production. 
Boeing whistleblowers have contacted us regarding features 
engineers wanted to put on the MAX, but were denied because of 
the rush to get this plane out the door and compete.
    We have from an internal whistleblower a survey conducted 
November 2016 that 39 percent of Boeing employees surveyed, 
they experienced undue pressure. Twenty-nine percent said they 
were concerned about consequences. Consequences? You might lose 
your job, I guess, if they reported these incidents.
    We now know at least one case where a Boeing manager 
implored then-vice president, the general manager of the 737 
program, to shut down the 737 MAX production line because of 
safety concerns several months before the first tragic Lion Air 
crash.
    There is a lot we don't know. We don't know what would 
happen if a different path had been followed here, exactly.
    We don't know, if these pilots had had simulator training 
that replicated this system, what would have happened.
    We don't know why Boeing designed a plane with a safety 
critical system assigned to a single point of failure. 
Inexplicable, inexcusable. And, as far as I know, unprecedented 
in the history of passenger aviation production.
    We do know, and we have seen that pressures from Wall 
Street, market forces, have a way of influencing the decisions 
of the best companies in the worst way, endangering the public, 
jeopardizing the good work of countless, countless hardworking 
employees on the factory lines. And I hope that is not the 
story that is ultimately going to be written about this long-
admired company.
    So we need today, Mr. Muilenburg, Mr. Hamilton, we need 
answers. But we also know that we need reforms on how 
commercial aircraft are certified, and how manufacturers--not 
just Boeing, all--are watched and overseen by the regulators. 
This hearing today and investigation is not just about getting 
answers to our questions, but how to make the system safer and 
prevent future tragedies.
    [Mr. DeFazio's prepared statement follows:]

                                 
   Prepared Statement of Hon. Peter A. DeFazio, a Representative in 
     Congress from the State of Oregon, and Chairman, Committee on 
                   Transportation and Infrastructure
    Thank you, Mr. Muilenburg and Mr. Hamilton, for being at today's 
hearing, ``The Boeing 737 MAX: Examining the Design, Development, and 
Marketing of the Aircraft.'' This is the fourth hearing our committee 
has held on the 737 MAX since May, but the first full committee hearing 
on this subject.
    I know Boeing wanted to wait to testify until after the airplane 
was ungrounded, but I thought it was important you appear before our 
committee before the MAX returned to service.
    You are here today because 346 people--sons, daughters, fathers, 
and mothers--died on two Boeing 737 MAX aircraft in the span of 5 
months. If you need a reminder of the lives that have been devastated 
by these tragedies, you can look to the family members of those on Lion 
Air flight 610 and Ethiopian Airlines flight 302 who are sitting to 
your left. Their lives have been forever changed as a result of these 
two crashes, crashes that could have been avoided.
    Something went drastically wrong, a total of 346 people died, and 
we have a duty to fix it.
    As you know, our committee has been conducting a robust 
investigation of the design, development, and certification of Boeing's 
737 MAX since March. In fact, our investigation is the most extensive 
and important investigation this committee has undertaken during my 
time on the committee.
    Over the last several months, we have received hundreds of 
thousands of pages of documents from Boeing and others, and our staff 
is continuing to review those records. Our investigation is not 
complete, and we will continue to investigate these issues until we 
have clear answers to our questions. The family members of those who 
died, many of whom are here today, deserve answers too.
    There are areas we are exploring that remain murky, and we need to 
bring clarity to those issues. But there is a lot we have learned over 
the past 7 months, and we expect you to answer a number of questions to 
improve our understanding of what happened and why.
                                  mcas
    We now know that a single point of failure triggered a novel flight 
control system that put these two flights into unrecoverable dives. As 
a result of this single point of failure--the angle-of-attack sensor--
the maneuvering characteristics augmentation system (MCAS) led to 
repeated and continuous nose-down trim commands in both accidents, and 
the chain of events that followed and ultimately led to both aircraft 
impacting water or terrain.
    We now know that at one point Boeing had planned to inform pilots 
about MCAS in their flight manuals, but then reversed course and 
removed virtually every reference of MCAS from the pilot operating and 
training manuals. As if it never existed.
    We now know that Boeing engineers proposed placing an MCAS 
annunciator inside the cockpit itself, but that initial decision failed 
to materialize in the final versions of the 737 MAX. It was not until 
after Lion Air flight 610 plunged into the waters off the coast of 
Indonesia 1 year ago that pilots even became aware of MCAS and its 
capabilities. Even after these accidents, Boeing attempted to downplay 
MCAS and its abilities although they knew that a malfunctioning MCAS 
could lead to catastrophe in certain circumstances
    We now know that while Boeing and the Federal Aviation 
Administration (FAA) assumed pilots would appropriately react to an 
MCAS malfunction resulting in stabilizer trim run-away within 4 
seconds, Boeing had information that some pilots might react in 10 
seconds or longer, and that if that happened, the results would be 
catastrophic, resulting in the loss of the aircraft.
                             pilot training
    We now know that from the very beginning of the plane's 
development, Boeing touted the limited training required for pilots to 
switch from flying the older 737 NG to the new 737 MAX--known as 
``differences'' training. Why is that important? Well, limiting pilot 
training translated into key marketing incentives to sell the MAX to 
airlines--it would not only save airlines money on training for their 
pilots, it would help get the plane approved and to market faster.
    We now know that Boeing offered Southwest Airlines a rebate of $1 
million per airplane if pilots ended up needing simulator training in 
order to fly the 737 MAX. By the time of the Lion Air crash, Southwest 
had already ordered nearly 300 of the aircraft. Failure to ensure the 
FAA provided Level B, or nonsimulator, training would have cost Boeing 
hundreds of millions of dollars and given its competitor an advantage.
                             lack of candor
    We now know that in August 2017, Boeing learned that the angle-of-
attack (AOA) disagree alert--a standard, standalone feature on all 737 
MAX aircraft that indicates to pilots when the readings from the left 
and right AOA sensors disagree--did not work on aircraft unless they 
also purchased an optional AOA indicator feature. Despite becoming 
aware of this issue, Boeing decided to delay a fix for 3 years--until 
2020--failing to inform the FAA, its airline customers, and 737 MAX 
pilots about this flaw until after the Lion Air crash.
    Even if the AOA disagree alert is not necessary for safe operation 
of the MAX, as Boeing states, the company kept everyone, including 
regulators, in the dark regarding its inoperability for more than a 
year. And during this time, Boeing continued delivering new aircraft to 
customers with nonfunctioning AOA disagree alerts and did not inform 
airlines or pilots the alerts were not functioning. In fact, the AOA 
disagree alert was included in the 737 MAX flight crew operating 
manual, including the one provided to Lion Air in August 2018. The 
actual fix was relatively simple and a software update could have been 
done quickly, but it wasn't, and it is still unclear why.
                             undue pressure
    We now know that at least one internal Boeing whistleblower said 
Boeing sacrificed safety for cost savings on some features that 
engineers intended to deploy on the MAX during the development process.
    We now know from an internal Boeing survey conducted in November 
2016, provided to the committee from a whistleblower, that 39 percent 
of those Boeing employees surveyed said they experienced undue pressure 
and 29 percent said they were concerned about ``consequences'' if they 
reported these incidents.
    We now know of at least one case where a Boeing manager implored 
the then-Vice President and General Manager of the 737 program to shut 
down the 737 MAX production line because of safety concerns, several 
months before the Lion Air crash in October 2018.
                          unanswered questions
    But there is still a lot that we don't know. We don't know what the 
results would have been if different actions were taken. We don't know 
what would have happened if more information was shared with the FAA. 
We don't know what would have happened if the pilots of these two 
doomed 737 MAX aircraft had been required to undergo simulator training 
prior to flying the MAX.
    We are still unclear about why Boeing designed the 737 MAX to rely 
on a single point of failure that the company knew could potentially be 
catastrophic. This was inexplicable and inexcusable. We may never know 
what key steps could have been taken that would have altered the fate 
of those flights, but we do know that a variety of decisions could have 
made those planes safer and perhaps saved the lives of those on board.
    Mr. Muilenburg, I've worked on consumer and aviation safety issues 
for a long time, in this very room in fact. And I have seen how 
pressures from Wall Street have a way of influencing the decisions of 
the best companies in the worst way, endangering the public and 
jeopardizing the good work of countless workers on the factory lines. I 
hope that's not the story that will be written about your long-admired 
company.
    So we need answers from you today, Mr. Muilenburg, but more 
importantly, I believe the 737 MAX accidents show that we need reforms 
in how commercial aircraft are certified and how manufacturers, like 
Boeing, are watched and overseen by the regulator. Our investigation 
and this hearing are not just about getting answers to our questions, 
but about making the aviation system safer, for all who travel, and 
ensuring tragedies like those in Indonesia and Ethiopia never happen 
again.

    Mr. DeFazio. With that, I yield time to the ranking member.
    Mr. Graves of Missouri. Thank you, Mr. Chairman, for 
holding this hearing.
    I do want to extend my condolences to the families and 
friends of the accident victims. I can't imagine how hard it is 
to you to sit and go through this process.
    I am going to divert from my statement for just a minute 
and associate myself with a couple of comments that the 
chairman made. And I, too, as a pilot, having a piece of 
equipment in an airplane that I don't know about is something 
that concerns me in a big way. And that comment about pilots 
saying, ``What, we are the backup system,'' it does concern me.
    But I do want to point out, though, as well, when it comes 
to Airbus--because it was mentioned, too, that there were 
customers that wanted to look at Airbus as opposed to the 
Boeing product, but in an Airbus aircraft the pilot is the 
backup system. You can't shut it off.
    The same--similar system, I should say, very similar system 
in an Airbus that is in a Boeing MAX, MCAS, you can't shut it 
off. It overrides the pilot. Overrides the pilot, whereas MCAS 
can be shut off, and that is one of the things about, you know, 
when it comes to being a pilot, you want to be able to shut a 
system off that has failed, and be able to fly the airplane. 
And that is what I have harped on and harped on over and over 
and over again.
    And it is my hope that Mr. Muilenburg's testimony today is 
going to help us understand the decisions that Boeing made 
between 2009 and 2017 regarding the design and certification of 
the 737 MAX. Some of those decisions were reviewed and approved 
by the Boeing Organization Designation Authorization, or the 
ODA. We keep using that term, obviously. It is on behalf of the 
FAA. And while the Boeing ODA was authorized to act for the 
FAA, as the regulator of the FAA, they retain the ultimate 
responsibility for overseeing the compliance with all safety 
regulations. It still lies within the FAA.
    And I know the chairman said we have still got a lot of 
other people to hear from. We are hearing from the Boeing 
leadership today. At the time of these decisions, to get a 
complete picture, I would like to hear from the FAA officials 
that were there at the time, between 2012 and 2017, when these 
decisions were being made. And I hope that I can get a 
commitment--and I am sure you don't have any problem with 
that--to do that.
    Mr. DeFazio. I commit that we will be hearing from FAA.
    Mr. Graves of Missouri. Because we have got to hear from 
everybody. That is the bottom line. I have said before, many 
times, the various investigations, they reveal problems.
    If these investigations reveal problems with certification, 
then I think Congress should act to fix those specific and 
identifiable problems. That is going to be the issue, 
identifying what those problems are.
    But in the aftermath of these accidents, we can't address 
safety of the aviation system by focusing on one single factor.
    And there is never one single factor that contributes to an 
accident. I have heard safety experts refer to the swiss cheese 
model of accident causation. In this model, if you use this 
model, you have layers, many layers of accident protection that 
are visual. If you visualize them as slices of cheese with 
holes that represent the weaknesses, some of those weaknesses 
are due to conditions. Others are due to active failures.
    But when an accident occurs, when all of those holes of 
weaknesses, when they line up, that is when you have a 
catastrophic failure. And in the context of the 737 MAX, we 
have to consider all of those layers, all of them, when it 
comes to the protection and safety, when we try to determine 
what weaknesses are out there, and try to figure out what those 
weaknesses are.
    So, as an investigator, the Indonesian Government said 
about the Lion Air accident--and I quote--``If one of those 
nine contributing factors did not happen, the crash would not 
have happened.'' One particular layer, the design and 
certification of the 737 MAX, that is the focus of a number of 
investigations.
    And earlier this year Boeing took responsibility for the 
MCAS design weaknesses, and they have been working on a 
software fix which we are waiting to hear about.
    But other weaknesses, Boeing, with the FAA's oversight--we 
are going to address--they include pilot displays, operation 
manuals, crew training. Today we are going to hear about the 
status of all of those efforts.
    But I want to hear about how these efforts line up with the 
recommendations of the Joint Authorities Technical Review, or 
the JATR. The first completed review of the MAX certification 
by individuals with vast aviation and technical expertise is 
due out--is obviously due soon.
    But while the JATR didn't call for an end to the FAA's 
delegation programs, it did highlight some bureaucratic 
efficiencies in the relationship between Boeing and the FAA, 
and we have to address those. And I know we will.
    The FAA concurred with the JATR's report, and is committed 
to working on these recommendations, which is good. We, 
obviously, have to have oversight to make sure that that 
happens.
    But lastly, Mr. Muilenburg, I want to hear about recently 
shared documents relating to Boeing's former chief technical 
pilot for the 737. And I am sure you are going to do that.
    But other investigations are moving forward, as well. Last 
month the National Transportation Safety Board, they issued a 
recommendation report which largely focused on the assumptions 
that were made during the design and certification process 
related to human factors. Design and certification cannot be 
the sole focus of our efforts, and I have said this before. 
That is only one layer of that cheese model that I talked 
about.
    In the last few months other weaknesses that appear to have 
played a role in these accidents have surfaced. Reports earlier 
this month called into question evidence submitted to the Lion 
Air investigation, which related to the installation, 
calibration, and testing of the faulty angle-of-attack sensor.
    There has also been whistleblower statements and other 
reports raising significant concerns with the Lion Air and 
Ethiopian Airlines operation and maintenance programs.
    The former chief engineer for Ethiopian Airlines filed a 
whistleblower complaint alleging significant problems with that 
airline's maintenance, training, and recordkeeping.
    He also alleges that the air carrier went into the 
maintenance records of the 737 MAX a day after the accident.
    And, unfortunately, operational pressures and lack of 
robust safety culture can negatively impact aviation safety. 
That is another layer of that model that I talked about. The 
NTSB has confirmed that, along with certification, operational 
factors are going to be the focus of its accident 
investigations.
    In addition, along with its own MAX certification review, 
the Department of Transportation--their IG, their inspector 
general, at the request of the committee's leadership--is soon 
going to begin a review of the international training standards 
in the impact of automation, which is another thing that I have 
talked about as a potential problem.
    But I want to be crystal clear in reviewing these areas, 
that this is not an effort to blame the pilots, and I don't 
blame the pilots, and I don't absolve Boeing of its 
responsibility.
    But a September New York Times magazine article described 
the changing nature of the airline industry, and the impact it 
is having on airmanship. And the article refers to a decade-
long transformation of the entire business of flying, in which 
airplanes became so automated and accidents so rare that a 
cheap air travel boom was able to take root around the world. 
And this boom in air travel resulted in the need for more and 
more pilots. But the pool of experienced pilots couldn't keep 
up.
    I remember getting letters from airlines all over the 
world, just simply because I had ATP on my license, getting 
letters, offering me jobs to quit what I was doing and come fly 
for them.
    But I will continue to repeat this. Pilots can master 
cockpit technology. But when the technology fails, they have to 
be able to fly the plane, not just fly the computer. And to be 
clear, none of this is a reflection on Lion Air or Ethiopia's 
pilots' professionalism or character. They were fighting for 
their lives. That is the bottom line.
    But instead, it is a reflection on the broader pressures 
that are present today in the global aviation economy. And it 
is incumbent on the airline whose name is on the side of that 
airplane to ensure that their pilots are properly trained to 
the level that they need to be, and not rushed into the 
cockpits to meet those demands.
    That is where some of this blame lies, in Ethiopia in 
particular. The Government owns the airline, and they put 
pilots in there that--something above their head. It is not the 
pilot's fault. You have to look at who put them in that 
position to be responsible for hundreds of lives.
    So in line with that swiss cheese model and other layers of 
protection, such as pilot actions, airline operations, 
maintenance, training programs, they must also be explored, and 
all of those weaknesses have to be addressed.
    And I still believe that the FAA remains the gold standard 
in aviation safety. And once the agency certifies the fixes to 
the MAX, I will gladly volunteer to be the very first person, 
right alongside Administrator Dickson, in the very first flight 
of the MAX 8.
    In regard to the two 737 MAX accidents, I think all of 
those issues need to be addressed, but only after we have had 
the benefit of various investigative work that has yet to be 
completed. Jumping to conclusions before that work is done only 
risks more harm than good.
    The bottom line is the U.S. safety record speaks for 
itself. And I will stand up to anybody that tries to question 
that. The FAA's proven system has made air travel the safest 
mode of transportation in history.
    And with that, I appreciate the opportunity and the 
deference, Mr. Chairman. And I look forward to today's hearing, 
and yield back anything I have left.
    [Mr. Graves of Missouri's prepared statement follows:]

                                 
  Prepared Statement of Hon. Sam Graves, a Representative in Congress 
     from the State of Missouri, and Ranking Member, Committee on 
                   Transportation and Infrastructure
    Thank you, Mr. Chairman. I want to extend my condolences to the 
families and friends of the accident victims.
    It is my hope that Mr. Muilenberg's testimony today will help us 
understand decisions Boeing made between 2009 and 2017 regarding the 
design and certification of the 737 MAX. For example, as a pilot, I 
would also be concerned about having a piece of equipment or software 
in my cockpit that I didn't know about.
    Some of Boeing's decisions were reviewed and approved by the Boeing 
Organization Designation Authorization, or ODA, Office on behalf of the 
FAA. While the Boeing ODA was authorized to act for the FAA, as the 
regulator the FAA retained ultimate responsibility for overseeing 
compliance with safety regulations.
    Mr. Chairman, today we are hearing from Boeing leadership involved 
at the time of these decisions, but to get a complete picture I hope I 
can get your commitment to hold a committee hearing in the near future 
to receive testimony from the FAA officials in charge between 2012 and 
2017 when decisions related to the 737 MAX certification were made and 
approvals granted.
    As I've said before, if the various investigations reveal problems 
with the certification, Congress should act to fix those specific, 
identifiable problems. But, in the aftermath of these accidents, we 
can't address the safety of the aviation system by focusing on a single 
possible cause.
    Safety experts often refer to the ``Swiss Cheese Model of Accident 
Causation.'' In this model, layers of accident protection are 
visualized as slices of cheese, with holes representing weaknesses. 
Some weaknesses are due to existing conditions, and others are due to 
active failures. An accident occurs when holes or weaknesses in the 
many layers all line up.
    In the context of the 737 MAX, we must consider all layers of 
protection and address all weaknesses discovered. As an investigator 
for the Indonesian Government said about the Lion Air accident, ``If 
one of the nine contributing factors did not happen, the crash would 
not have happened.''
    One particular layer--the design and certification of the 737 MAX--
is the focus of a number of investigations. Earlier this year, Boeing 
took responsibility for MCAS design weaknesses and has been working on 
a software fix. Other weaknesses Boeing, with the FAA's oversight, will 
address include pilot displays, operation manuals, and crew training. 
Today, I look forward to hearing about the status of those efforts.
    I also want to hear about how these efforts line up with the 
recommendations of the Joint Authorities Technical Review (JATR)--the 
first completed review of the MAX's certification by individuals with 
vast aviation and technical expertise.
    While the JATR did not call for an end to the FAA's delegation 
programs, it did highlight ``bureaucratic inefficiencies'' in the 
relationship between Boeing and the FAA. The FAA concurred with the 
JATR's report and has committed to working on the recommendations.
    Lastly, Mr. Muilenburg, I want to hear about recently shared 
documents related to Boeing's former Chief Technical Pilot for the 737.
    Other investigations are also moving forward, and last month the 
National Transportation Safety Board (NTSB) issued a Recommendation 
Report, which largely focused on assumptions made during the design and 
certification process related to human factors. But, design and 
certification cannot be the sole focus of our efforts. That's only one 
layer of the cheese.
    In the last few months, other weaknesses that appear to have played 
a role in the accidents have surfaced.
    Reports earlier this month called into question evidence submitted 
to the Lion Air investigation related to the installation, calibration, 
and testing of a faulty angle-of-attack sensor. There have also been 
whistleblower statements and other reports raising significant concerns 
with Lion Air and Ethiopian Airlines' operations and maintenance 
programs. The former chief engineer for Ethiopian Airlines filed a 
whistleblower complaint alleging significant problems with that 
airline's maintenance, training, and recordkeeping. He also alleges 
that the air carrier went into the maintenance records of the 737 MAX a 
day after it crashed.
    Unfortunately, operational pressures and lack of a robust safety 
culture can negatively impact aviation safety--another layer of the 
cheese. The NTSB has confirmed that, along with certification, 
operational factors will be a focus of its accident investigations.
    In addition, along with its own MAX certification review, the 
Department of Transportation Inspector General, at the request of this 
committee's leadership, will soon begin a review of international 
training standards and the impact of automation.
    I want to be crystal clear that reviewing these areas is not an 
effort to blame pilots or absolve Boeing of its responsibility.
    A September New York Times Magazine article describes the changing 
nature of the airline industry and its impact on airmanship. The 
article refers to ``a decades-long transformation of the whole business 
of flying, in which airplanes became so automated and accidents so rare 
that a cheap air-travel boom was able to take root around the world.'' 
The boom in air travel resulted in a need for more and more pilots, but 
the pool of experienced pilots couldn't keep up with demand. In fact, 
I've gotten letters from airlines offering me jobs because my license 
has an ATP (airline transport pilot) on it.
    I'll continue to repeat this: pilots can master cockpit technology, 
but when that technology fails, they must be able to fly the plane--not 
just fly a computer.
    To be clear, none of this is a reflection on the Lion Air and 
Ethiopian pilots' professionalism or character. Instead, it's a 
reflection on the broader pressures present in today's global aviation 
economy.
    But it is incumbent on the airline whose name is on the side of 
that airplane to ensure their pilots are properly trained and not 
rushed into the cockpit to meet those demands.
    So, in line with the ``Swiss cheese model,'' other layers of 
protection--such as pilot actions, airline operations, maintenance, and 
training programs--must also be explored and any weaknesses must be 
addressed.
    I still believe that the FAA remains the gold standard for safety, 
and once the agency certifies the fixes to the MAX, I would gladly 
volunteer to be on the first flight alongside Administrator Dickson.
    In regard to the two 737 MAX accidents, any issues should be 
addressed, but only after we have the benefit of various investigative 
work yet to be completed. Jumping to conclusions before that work is 
complete risks doing more harm than good.
    Bottom line: the safety record speaks for itself--the FAA's proven 
system has made air travel the safest mode of transportation in 
history.

    Mr. DeFazio. I thank the gentleman. I would now turn to the 
chairman of the subcommittee, Mr. Larsen.
    Mr. Larsen. Thank you, Chair DeFazio. I will be brief, 
because I want to get to the reason why we are here today. That 
is for questions to, and clear and direct answers from, Boeing.
    But yesterday I did release a video opening statement, and 
you can find my full comments there.
    But in summary I want to say this, that the 346 lives lost 
in Lion Air 610 and Ethiopian Airlines 302 crashes are constant 
reminders of the importance of this committee's work and what 
is at stake if we do not address systemic safety issues in U.S. 
aviation today.
    Some of the victims' family members are here with us today. 
Others are watching the livestream. And your presence and 
tireless advocacy are critical to what we are doing today. I 
want to thank you for that. You deserve answers, and you 
rightfully expect Congress to act.
    Following the recent release of recommendations from the 
JATR or the NTSB, the Indonesian authorities, and Boeing 
itself, though, I do want to say I see one undeniable 
conclusion: The process by which the Federal Aviation 
Administration evaluates and certifies aircraft is itself in 
need of repair.
    It is no accident that there are few airplane accidents. It 
makes it all the more tragic when there is one. It makes it 
even worse when there are two.
    So, as the committee's investigation continues, we should 
maintain safety as our guiding principle, and use all the tools 
at our disposal to ensure the safety of the traveling public.
    With that I yield back.
    [Mr. Larsen's prepared statement follows:]

                                 
 Prepared Statement of Hon. Rick Larsen, a Representative in Congress 
  from the State of Washington, and Chairman, Subcommittee on Aviation
    Thank you, Chair DeFazio.
    I will be brief, because I want to get to the reason why we are all 
here: for questions to and clear, direct answers from Boeing.
    Yesterday, I released a video opening statement, where you can find 
my full comments.
    The 346 lives lost in the Lion Air 610 and Ethiopian Airlines 302 
crashes are constant reminders of the importance of this committee's 
work and what is at stake if we do not address the systemic safety 
issues in U.S. aviation today.
    Some of the victims' family members are with us today and others 
are watching the livestream. Your presence and tireless advocacy are 
essential to our process.
    You deserve answers and rightfully expect Congress to act.
    Following the recent release of recommendations from the JATR, 
NTSB, Indonesian authorities and Boeing itself, I see one undeniable 
conclusion: The process by which the Federal Aviation Administration 
evaluates and certifies aircraft is itself in need of repair.
    As the committee's investigation continues, we will maintain safety 
as our guiding principle and use all the tools at our disposal to 
ensure the safety of the traveling public.
    Thank you.

    Mr. DeFazio. I thank the gentleman. I now turn to the 
ranking member on the Subcommittee on Aviation, Mr. Graves from 
Louisiana.
    Mr. Graves of Louisiana. Thank you, Mr. Chairman, and thank 
you for holding this hearing today.
    Yesterday was 1 year since the Lion Air tragedy. And I, 
too, want to join everyone sitting up here in offering our 
condolences to all of the Ethiopian family victims, the 
Indonesian family victims.
    Here we are in Washington. And everybody in this town--
everybody, nearly, in this town, you sit up here and you are 
dealing with billions and trillions of dollars and all these 
crazy acronyms and processes, and none of it often makes sense, 
or fits the common sense test. And oftentimes you see people 
that just forget about objectives. Why are we actually doing 
this? What is the purpose of this whole process that we go 
through, the regulations, the procedures? Why?
    And at the end, it is always about people. That is what we 
are here for. We are here for people, for fellow Americans, 
fellow citizens. And it is amazing to me, just being here, how 
often that is forgotten.
    I am sorry to every one of you, and your pictures are 
incredibly powerful.
    You know, I used to be a rock climbing instructor. And when 
we would go out there, we would have somebody's son or 
daughter, somebody's brother or sister. And when you are out 
there, rock climbing, look, there is no room for error. None. 
You lose somebody on a rock, there is no room for error. Air 
travel is the same thing.
    There is no room for--you can't, ``Oh, we are going to pull 
over to the side of the road and see what is going on. I hear a 
noise coming out of the engine.'' That is not an option. This 
process has got to stay focused on the risks that air travel 
poses, the fact that you can't pull over to the side of the 
road, that you have got to have redundancies.
    And look, there is an awful lot going on right now with all 
of the different reports, investigations that are going on, and 
I am going to run through those in a minute. But there is an 
awful lot going on.
    But, for example, if there truly was one AOA sensor that 
could potentially engage MCAS, that is not the proper 
redundancies. And when you are looking at the risk that is 
posed in this case, it is unacceptable. It is unacceptable.
    A while back I had the chance to represent the State of 
Louisiana in the Deepwater Horizon disaster, and spent a lot of 
time with the families there, and spent many days in the court, 
listening to testimony. And I do believe, and I think that the 
judge found, that there was an inappropriate culture of 
focusing on the wrong objectives. And oftentimes people can be 
looking at stock prices, or economics, or how many people can 
we fit in here, or how fast can this jet travel, or what have 
you. I am going to say it again: This is 100 percent about 
people.
    And I have heard people talk about this whole process and 
say that, well, this process was short-circuited. Well, you 
know, you can look back, and you can look at the 737-6. -7, -8, 
-9, you can look at the A319, A320, A321, the E190, E195, the 
C919, and many versions of those aircraft. And you know what? 
Every single one of those actually was certified or approved in 
a shorter period of time than the MAX. So it is not just about 
how long, it is what we actually do during that process.
    What are we doing during the process to make sure that this 
is a safe aircraft, to make sure that we are not putting folks 
at undue risk?
    Now, I have heard a lot of people talk about a lot of 
different ideas, and solutions, and things that they want to do 
as we move forward, and people posing solutions right now. And 
certainly we need to extract every single lesson learned that 
we can.
    But right now--and I somehow ditched my list--right now we 
have investigations, the Indonesian authorities, the Ethiopian 
authorities, the NTSB, we have the JATR, we have the Technical 
Advisory Board, the TAB. We have the Office of Special Counsel 
that is working with the whistleblower complaint. We have the 
Secretary of Transportation that set up a special committee. 
Boeing is doing an internal investigation. We have so many 
different investigations that are going on.
    One thing that we have got to make sure that we do is focus 
on facts. One thing that I have seen in this body in the 4\1/2\ 
years that I have been here is us responding emotionally to 
things, and not responding to facts. And we will go and do 
something that may make us feel good, but does not--does not--
actually respond to the facts.
    And so, as we move forward--and I am sure I left out some 
of the investigations that are ongoing--but as we move forward, 
we have got to make sure that we are acting on the facts. And 
every single outcome, every single problem that we have 
identified, we have got to make sure that we truly base our 
solutions on those facts to where this doesn't happen again.
    Lastly, Mr. Chairman, the families shared a number of 
concerns that I think are right on. And I do want to ask that 
Boeing get back to us on these. And it was things like fully 
disclosing the MCAS fix before the plane is allowed to fly, if 
it is allowed to fly again; fully defining the role of the MCAS 
system. All right, all right, I will submit----
    Mr. DeFazio. I would suggest----
    Mr. Graves of Louisiana. I will.
    Mr. DeFazio. You could submit those for the record, or you 
could ask during the question period.
    Mr. Graves of Louisiana. Thank you. I yield back.
    [Mr. Graves of Louisiana's prepared statement follows:]

                                 
Prepared Statement of Hon. Garret Graves, a Representative in Congress 
   from the State of Louisiana, and Ranking Member, Subcommittee on 
                                Aviation
    Thank you, Mr. Chairman.
    Yesterday was the anniversary of the Lion Air tragedy, and I want 
to let the families of those lost in that incident and in the Ethiopian 
crash know that I'm keeping their loved ones in mind as I sit here 
today.
    Here in Washington, we all regularly talk about budgets in the 
billions of dollars, and a soup of acronyms, processes, and programs. 
Sometimes it can be easy to forget why we're really here--what all 
these processes and programs are for. This is about people. That's 
truly why we are here, and we can't lose sight of that throughout this 
process.
    So it's thinking of those we lost that motivates me to ensure that 
we, as members of both this committee and of the Congress, are 
thoughtful about our role in the aftermath of these incidents.
    I'm pleased that Boeing is here today to tell us how the 
development of MCAS evolved, and the flaws in that process. We know 
from NTSB's preliminary recommendations that certain incorrect 
assumptions and incomplete reviews of how multiple systems interact 
allowed those flaws to become fatal. We know this from the results of 
some of the expert investigative work that has been completed to date.
    In air travel, there is no room for error, and that's why it's 
critical to have safety redundancies. We are closely reviewing the 
results and recommendations from the investigations which have already 
wrapped: FAA's Joint Authorities Technical Review (JATR); NTSB's, which 
has issued preliminary recommendations; Boeing's internal review, which 
yielded recommendations that are already being implemented; and the 
Indonesian accident report, released late last week.
    It's my hope that the committee will hear from and consider the 
findings of the yet-to-be-concluded certification and accident 
investigations so that we can make sure we know what went wrong and 
leverage those findings and recommendations to ensure something like 
this doesn't happen again.
    I also hope we hear from FAA officials who were in charge of the 
agency when the certification process for this aircraft was conducted 
and its type certificate approved. This information will crucially 
inform the committee on our next steps.
    We certainly need to extract every single lesson learned so far, 
but it's critical that we also take into consideration the many ongoing 
investigations into these accidents when we have their results: the 
Ethiopian accident report, Secretary Chao's special committee, the DOT 
Inspector General's reports, and several other international reviews.
    It is very important that we wait for these experts to complete 
their work and carefully review their findings and recommendations. 
Once we have a better understanding of what happened and all the 
factors involved, we will ask ourselves: what changes do we need to 
make to ensure the highest levels of safety and prevent future 
accidents?
    As Congress, we have to act on facts--not on emotion--to address 
every single problem identified so that this doesn't happen again. But 
acting before we know the whole picture is both a disservice to those 
we lost and dangerous to those who will fly in the future.

    Mr. DeFazio. I thank the gentleman.
    With that we will turn to the witness for an opening 
statement.

 TESTIMONY OF DENNIS MUILENBURG, PRESIDENT AND CHIEF EXECUTIVE 
  OFFICER, THE BOEING COMPANY; ACCOMPANIED BY JOHN HAMILTON, 
          CHIEF ENGINEER, BOEING COMMERCIAL AIRPLANES

    Mr. Muilenburg. Chairman DeFazio, Ranking Member Graves, 
Congressman Larsen, Congressman Graves. Thank you. And to the 
whole committee, we appreciate the opportunity to be here 
today, and we are going to do our best to answer all of your 
questions.
    Before we get started, I too would like to acknowledge the 
families that are here with us today and, again, wanted to tell 
you I am sorry. And I have had the opportunity to talk with 
some of you and hear your stories, and we are deeply, deeply 
sorry, and we will never forget. And I want you to know that. 
And we are committed to making the improvements that we need to 
make. We are committed.
    And I had the chance to hear some of those stories, and see 
the photos, and listen to the personal stories, and it does get 
to a business that is about people. And I think Congressman 
Graves said it well. That is where our hearts will always be. 
And I know all of Boeing, our 150,000 people, feel the same 
way, and they think about this every day. We will carry the 
memories----
    Mr. Lynch. Can you speak a little closer into your 
microphone?
    Mr. Muilenburg. Yes, sir.
    Mr. Lynch. Just so--a little more audible. Thank you.
    Mr. DeFazio. Yes, again, just pull it toward you, Mr. 
Muilenburg.
    Mr. Muilenburg. Is that better? Thank you. Sorry. Please 
know that we carry the memories of these accidents with us, and 
the loved ones, the memories of them, they will never be 
forgotten. And their memories will drive us every day to make 
our airplanes safer and make this industry safer. And we are 
committed to doing that.
    I am grateful to have the opportunity to be here today to 
say this to the families personally. And I want to let you all 
know that we are dedicated to learning. We are learning. We 
still have more to learn. We have work to do to restore the 
public's trust, and we will do everything possible to prevent 
accidents like this from ever happening again.
    Mr. Chairman, I know this committee has many questions 
about the MAX, and we will do our best to answer those today.
    And while investigations are still underway, we note both 
accidents involved the repeated activation of a flight control 
software system called MCAS, which we have already talked 
about. That system responded to erroneous signals from the 
angle-of-attack sensor.
    Based on that, we have enhanced MCAS in three ways. First, 
it will now compare information from both sensors, instead of 
one, before activating. Second, MCAS will only activate a 
single time. And third, MCAS will never provide more input than 
the pilot can counteract using the control column alone. Pilots 
will also continue to have the ability to override MCAS at any 
time.
    We have brought the best of Boeing to this effort. We have 
spent over 100,000 engineering and test hours. We have flown 
more than 800 test flights. And we have conducted simulator 
sessions with 545 participants from 99 customers and 41 global 
regulators. I have flown on a couple of flights myself. This 
has taken longer than expected, but we are committed to getting 
it right.
    During this process we have worked closely with the FAA and 
other regulators. We have provided them with documentation, had 
them fly the simulators, answered their questions. And 
regulators around the world should rigorously scrutinize the 
MAX and only approve its return when they are completely 
satisfied with its safety. The public deserves nothing less.
    Mr. Chairman, today and every day, over 5 million people 
will board a Boeing airplane and fly safely to their 
destination. Decades of cooperation and innovation by industry 
and regulators and the rigorous oversight of this committee 
have reduced accidents by more than 95 percent over the last 20 
years. But no number other than zero accidents is ever 
acceptable. We can and must do better.
    We have been challenged and changed by these accidents. We 
have made mistakes, and we have learned, and we are still 
learning. And we are improving. We established a permanent 
aerospace safety committee for our board. We have stood up a 
new safety organization, and we strengthened our engineering 
organization so that all 50,000 engineers now report up through 
Boeing's chief engineer.
    We are also helping to rebuild the communities and the 
families impacted by these accidents. We have pledged $100 
million to this effort. We have hired renowned experts in this 
area to ensure families can access these funds as quickly as 
possible. No amount of money can bring back what was lost. But 
we can at least help the families meet their financial needs.
    Mr. Chairman, I started at Boeing more than 30 years ago as 
a summer intern in Seattle. I was a junior at Iowa State 
University studying engineering, and I had grown up on a farm 
in Iowa. My parents taught me the value of hard work and 
integrity. I was awestruck to work at the company that brought 
the jet age to the world and helped land a person on the moon. 
Today I am still inspired by what Boeing does, and by the 
remarkable men and women who are committed to continuing its 
legacy. But these heartbreaking accidents and the memories of 
the 346 lives lost are now a part of that legacy. It is our 
solemn duty to learn from them, and we will.
    Recently there has been much criticism of Boeing and our 
culture. We understand and deserve this scrutiny. But I know 
the people of Boeing. They are more than 150,000 of the hardest 
working, most dedicated, honest people you will ever meet. And 
their commitment to safety, quality, and integrity is 
unparalleled, and it is resolute. We will stay true to those 
values because we know our work demands it. It demands the 
utmost excellence.
    So thank you for this opportunity to convey to the world 
that we are committed to changing, and to making sure that 
accidents like these never happen again.
    Mr. Chairman, thank you for listening. And I look forward 
to your questions.
    [Mr. Muilenburg's prepared statement follows:]

                                 
Prepared Statement of Dennis Muilenburg, President and Chief Executive 
                      Officer, The Boeing Company
    Chairman DeFazio, Ranking Member Graves, members of the committee: 
good morning and thank you for inviting me to be here today.
    I'd like to begin by expressing my deepest sympathies to the 
families and loved ones of those who were lost in the Lion Air Flight 
610 and Ethiopian Airlines Flight 302 accidents, including those who 
are here in the room today. I wanted to let you know, on behalf of 
myself and all of the men and women of Boeing, how deeply sorry I am. 
Please know that we carry the memory of these accidents, and of your 
loved ones, with us every day. They will never be forgotten, and these 
tragedies will continue to drive us to do everything we can to make our 
airplanes and our industry safer.
    Mr. Chairman, I know that you and your colleagues have many 
questions about the 737 MAX. My colleague John Hamilton, Chief Engineer 
for Boeing Commercial Airplanes, and I will do our best today to answer 
them. While the Ethiopian Airlines accident is still under 
investigation by authorities in Ethiopia, we know that both accidents 
involved the repeated activation of a flight control software function 
called MCAS, which responded to erroneous signals from a sensor that 
measures the airplane's angle of attack.
    Based on that information, we have developed robust software 
improvements that will, among other things, ensure MCAS cannot be 
activated based on signals from a single sensor, and cannot be 
activated repeatedly. We are also making additional changes to the 737 
MAX's flight control software to eliminate the possibility of even 
extremely unlikely risks that are unrelated to the accidents.
    We have brought the very best of Boeing to this effort. We've 
dedicated all resources necessary to ensure that the improvements to 
the 737 MAX are comprehensive and thoroughly tested. That includes 
spending over 100,000 engineering and test hours on their development. 
We've also flown more than 814 test flights with the updated software 
and conducted numerous simulator sessions with 545 participants from 99 
customers and 41 global regulators. This process has taken longer than 
we originally expected, but we're committed to getting it right, and 
return-to-service timing is completely dependent on answering each and 
every question from the FAA.
    I have flown on two of the demonstration flights myself and seen 
first-hand the expertise and professionalism of our teams. Mr. 
Chairman, I could not be more confident in our solutions--and I could 
not be more grateful to the men and women who have worked so hard to 
develop and test these improvements always with safety at the 
forefront. When the 737 MAX returns to service, it will be one of the 
safest airplanes ever to fly.
    During this process we have been working closely with the FAA and 
other regulators. We've provided documentation, had them fly the 
simulators, and helped them understand our logic and the design for the 
new software. All of their questions are being answered. Regulators 
around the world should approve the return of the MAX to the skies only 
after they have applied the most rigorous scrutiny, and are completely 
satisfied as to the plane's safety. The flying public deserves nothing 
less.
    We know that it's not just regulators that need to be convinced. We 
know the grounding of the MAX is hurting our airline customers, their 
pilots and flight attendants, and most importantly, the people who fly 
on our airplanes. Our airline customers and their pilots have told us 
they don't believe we communicated enough about MCAS--and we've heard 
them. So we have partnered with customers and pilots from around the 
world as we've developed our solutions. We have welcomed and encouraged 
their questions and given them opportunities to test those solutions 
firsthand in simulators. And subject to regulatory approval, additional 
and enhanced training and educational materials will be available for 
pilots who fly the MAX.
    We have learned and are still learning from these accidents, Mr. 
Chairman. We know we made mistakes and got some things wrong. We own 
that, and we are fixing them. We have developed improvements to the 737 
MAX to ensure that accidents like these never happen again. We also are 
learning deeper lessons that will result in improvements in the design 
of future airplanes. As painful as it can be, the process of learning 
from failure, and even from tragedies like these, has been essential to 
the advances in airplane safety since the industry began roughly a 
century ago. And it is one of the reasons that travel on a large 
commercial airplane is the safest form of transportation in human 
history.
    Mr. Chairman, this is something we must not lose sight of. Today 
and every day, over 5 million people will board a Boeing airplane and 
fly safely to their destination. Whether it's their first flight or 
their millionth mile, we want it to be a great experience--and most 
importantly, a safe one. Decades of work and innovation throughout the 
industry, as well as the oversight of the FAA, this committee, and 
regulators around the world have reduced the risks of air travel by 
more than 95 percent over the last twenty years. But no number, other 
than zero accidents, is ever acceptable.
    For 103 years, Boeing has been dedicated to making the world a 
safer and better place. Our founder, Bill Boeing, established our first 
safety council in 1917, the first full year of the company's existence, 
beginning a commitment to safety that we have carried forward as a core 
value ever since. The engineers who design our airplanes, the 
machinists who work in our factories, and the many others who 
contribute to the extraordinarily complex work of building and 
maintaining commercial airplanes do so with pride and honor. Ensuring 
safe and reliable travel is core to who we are. Our customers and the 
traveling public, including our own families, friends, and loved ones, 
depend on us to keep them safe. That's our promise and our purpose.
    But we also know we can and must do better. We have been challenged 
and changed by these accidents, and we are improving as a company 
because of them. We established a permanent aerospace safety committee 
of our Board of Directors; stood up a new Product and Services Safety 
organization that will review all aspects of product safety and provide 
streamlined reporting and elevation of safety concerns; and 
strengthened our Engineering organization by having all engineers in 
the company report up through Boeing's chief engineer. We also are 
investing in advanced research and development in new safety 
technologies and are exploring ways to strengthen not just the safety 
of our company but our industry as a whole. We have a shared bond of 
safety across the entire aerospace community.
    We recognize it is not just our airplanes and our company that 
needs to be supported and strengthened. We also must help rebuild the 
communities and families affected by these accidents. Our first step 
was our pledge of $100 million to them. We hired Ken Feinberg and 
Camille Biros, renowned experts in this area, to ensure families can 
access this money as quickly as possible. Of course, no amount of money 
can bring back what has been lost. But we can at least help families 
meet their financial needs. Our people also have donated more than 
$750,000 of their own money to these funds--a tremendous example of the 
giving spirit our teams consistently display in the communities where 
they live and work across the globe.
    Mr. Chairman, I've worked at Boeing my entire career. It started 
more than 30 years ago when Boeing offered me a job as a summer intern 
in Seattle. I was a junior at Iowa State University studying 
engineering, having grown up on our family farm in Iowa. It's beautiful 
land with rolling hills where my siblings and I milked cows and baled 
hay. Our parents taught us the value of hard work, integrity, and 
respect for others. Back then, I drove my 1982 Monte Carlo from Iowa to 
Boeing's operations in Seattle, crossing the Rocky Mountains for the 
first time. I was awestruck at the opportunities I had to work on 
projects that mattered at the company that brought the Jet Age to the 
world and helped land a person on the moon. I was amazed by the people 
of Boeing. Today, I'm still inspired every day by what Boeing does and 
by the remarkable men and women who are committed to continuing its 
legacy.
    These heartbreaking accidents--and the memories of the 346 lives 
lost--are now part of that legacy as well. It's our solemn duty to 
learn from them and change our company for the better. I can assure you 
that we have learned from this and will continue learning. We have 
changed from this and will continue changing. The importance of our 
work demands it.
    In the months since the accidents, there has been much criticism of 
Boeing and its culture. We understand and deserve this scrutiny. But I 
also know the people of Boeing, the passion we have for our mission, 
and what we stand for. There are over 150,000 dedicated men and women 
working for Boeing around the world--and their commitment to our 
values, including safety, quality, and integrity, is unparalleled and 
resolute. No matter what, we will stay true to those values because we 
know our work demands the utmost excellence.
    Over the last few months, I've had the opportunity to visit many of 
our Boeing teams, talk about our safety culture, and gain ideas for how 
we can be better still. Last week, I saw our team in San Antonio--made 
up of 40 percent veterans--beaming with pride as they support the C-17 
fleet for our men and women in uniform. Earlier, I talked with our 
people in Philadelphia building Chinook helicopters; in St. Louis 
testing F/A-18 Super Hornets; and in Charleston, South Carolina, and El 
Segundo, California, connecting the world with the 787 Dreamliner and 
advanced satellites. I've also met with our people in Huntsville, 
Alabama, and New Orleans, Louisiana, who are building the rocket that 
will return humans to the moon and then travel on to Mars and those at 
Kennedy Space Center, Florida, who are preparing to launch the CST-100 
Starliner that will commercialize space travel. I've spent time also 
with our teams in Everett, Washington, who are testing the new 777X 
long-range jet and in Renton, Washington, where 12,000 amazing people 
pour their hearts into building the 737 MAX. These are the people of 
Boeing. I wish you could all meet them. They change the world. They are 
Boeing.
    I'm here today, honored to serve as the leader of this incredible 
team--talented engineers, machinists and all those who design, build 
and support our products. I want to answer all of your questions and 
convey to the world that we are doing everything in our power to make 
our airplanes and our industry safer and prevent an accident like this 
from ever happening again.
    And, Mr. Chairman, you have my personal commitment that I will do 
everything I can to make sure we live up to that promise.
    Thank you for listening, and I look forward to your questions.

    Mr. DeFazio. I thank the gentleman. As I stated at the 
outset, with consultation with the minority, both myself and 
Mr. Graves will open with 10 minutes, and then we will move to 
other Members for 5 minutes in the usual order.
    Mr. Muilenburg, it is clear, obviously, from everything we 
know, and the Lion Air report now, that MCAS was a major factor 
that contributed. But Boeing's position, at least prior to 
these crashes, was it was an autonomous system and it operated 
in the background. Is that correct?
    Mr. Muilenburg. Mr. Chairman, that was the design approach, 
yes.
    Mr. DeFazio. Yes. So--but the question is, how do we get to 
that?
    And we have a slide. You will be able to see it right in 
front of you.
    Staff?
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. Yes, this was a concept design for the flight 
deck in 2012. And, as you can see in the bottom, right-hand 
corner, there was an MCAS alert indicator. So at least at some 
point some on the engineering and design staff felt it would be 
important to make the pilots aware of the system, and to have 
an indicator light. Do you agree that that was originally 
proposed?
    Mr. Muilenburg. Congressman, understand that was part of an 
early trade study at that point, and very, very common that 
early in the design stage we would evaluate different flight 
deck systems.
    Mr. DeFazio. OK, thank you. So--but obviously, the final 
version did not have that. That light was--I mean there was no 
indication, either in the manual or on the flight deck, of the 
presence of MCAS.
    Mr. Muilenburg. Congressman, John can answer that question.
    Mr. Hamilton. Yes, Chairman. The MCAS light issue pointed 
out, the intent of it was to signal an MCAS failure. It is 
important to note that in these accidents the MCAS system did 
not fail.
    Mr. DeFazio. Right, it triggered.
    Mr. Hamilton. And it would not have lit up.
    Mr. DeFazio. So--but it was----
    Mr. Hamilton. But the functionality of the MCAS light was 
actually--the reason it was deleted was because the 
functionality was incorporated into the speed trim fail light, 
which----
    Mr. DeFazio. Right.
    Mr. Hamilton [continuing]. You can see just adjacent to 
that.
    Mr. DeFazio. Right.
    Mr. Hamilton. The MCAS is a----
    Mr. DeFazio. OK. Thank you.
    Mr. Hamilton [continuing]. Extension of a speed----
    Mr. DeFazio. Thank you. Thank you for that. But when it was 
a relatively benign system, .6 degrees, it was in the manual. 
And then when it went to a repeated 2\1/2\ degrees, it came out 
of the manual. Is that correct?
    I have seen very early versions of the manual that indicate 
that you had MCAS in the manual. Your test pilot asked FAA to 
take it out, and it came out.
    Mr. Muilenburg. Congressman, if I could try to clarify, 
because you are asking questions that span into a couple of 
areas, just if I could clarify----
    Mr. DeFazio. Well----
    Mr. Muilenburg. So there was--the intent--the MCAS 
inclusion in the training manual, that was an iterative process 
that was occurring in parallel to the extension of MCAS to low-
speed operation, which I believe is what you are referring to.
    Mr. DeFazio. Right.
    Mr. Muilenburg. So the extension of MCAS to low-speed 
operation, that was done and flight tested from a period of 
around the middle of 2016----
    Mr. DeFazio. Right. Yes, we understand that, and we 
understand some of the problems in the way it was tested, and 
it wasn't tested with the AOA failure. But that is good for 
now.
    A key assumption was reaction time. And, with the AOA 
failure, the MCAS activates, and it is 2.5 degrees every 10 
seconds, pretty radical. And Boeing assumed it would take 
pilots 4 seconds to recognize and react to runaway stabilizers, 
is that correct?
    Mr. Muilenburg. Mr. Chairman, again, this--we do what we 
call hazard analysis for the airplane design.
    Mr. DeFazio. Four seconds was the assumption.
    Mr. Muilenburg. In this particular case that was the 
assumption. That is a----
    Mr. DeFazio. OK.
    Mr. Muilenburg [continuing]. Longstanding industry 
assumption for systems like this.
    Mr. DeFazio. Right. Lion Air reports--says it took pilots 8 
seconds to react. And then we have information provided to the 
committee by Boeing, which will now be the second slide.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. And it says there a slow reaction time 
scenario, 10 seconds, found the failure to be catastrophic. Do 
you think that was clearly--was this document ever clearly 
communicated to the regulators, that a 10-second delay, which 
doesn't seem like a lot of time to me, particularly when you 
look at the NTSB report and the cacophony going on on the 
flight deck, and particularly in the case of Lion Air, when 
they didn't even know the system existed, did--was the FAA 
aware of this, this document?
    Mr. Muilenburg. Chairman, I can't speak to this specific 
document.
    Mr. DeFazio. OK.
    Mr. Muilenburg. John may be able to.
    But I do think it is important to note that, as part of the 
design process, we use a set of industry standard practices on 
these timelines. This is a common part of our hazard analysis--
--
    Mr. DeFazio. Yes, but you----
    Mr. Muilenburg. That was shared with the FAA----
    Mr. DeFazio. Right. I understand. And I understand what the 
industry standard was. But, I mean, it does cause a little 
concern. Ten seconds. I mean, you can say, ``Gee, really good 
pilots can do it in less than 10 seconds.'' Pilots aren't at 
the top of their game every day, and particularly in the first 
iteration, at least, when they weren't even aware of the 
system. I think that assumption should have rung some alarm 
bells.
    Do you think, in retrospect, it was a mistake to not inform 
pilots of the existence of the MCAS system?
    Mr. Muilenburg. Congressman, a few things on that. And I 
agree, we made some mistakes on MCAS. And as we have gone back 
and taken a look at this, moving from a single sensor to a dual 
sensor feed is an important part of that. Providing additional 
training information----
    Mr. DeFazio. Right.
    Mr. Muilenburg. Which--the feedback we have gotten from the 
pilots, as you noted, is part of that. And then revisiting 
these decades-long industry standards. I think you see a 
similar recommendation out of the----
    Mr. DeFazio. Right. Of course----
    Mr. Muilenburg. We believe----
    Mr. DeFazio. The question would be why was it just 
originally wired to one sensor, which--again, single point of 
failure. As then-Acting Administrator Elwell said in May, a 
safety critical system, that is just not done.
    As the NTSB said, multiple alerts and indication can 
increase pilots' workload. The combination of the alerts and 
indications did not trigger the accident pilots to immediately 
perform the runaway stabilizer functions.
    OK. Mr. Hamilton, are you aware of any other aircraft out 
there that has a safety critical system that is dependent upon 
a single point of failure?
    Mr. Hamilton. Chairman, single-point failures are allowed 
in airplane design. Regulation 25.1309 actually discusses that, 
and talks about different hazard categories. And----
    Mr. DeFazio. And this one----
    Mr. Hamilton. We have----
    Mr. DeFazio. This one was deemed to be catastrophic. I know 
there are three categories. You didn't deem it to be 
catastrophic, although, in looking at the 10 seconds, you said 
it was catastrophic. It was classified as major, as I recall.
    Mr. Hamilton. Yes, catastrophic is one category. And so 
when we test out systems, we do look at their impact on the 
airplane when there are failures. And we did look at 10 
seconds, but we also then took it into the simulator with 
pilots, and the typical reaction time was 4 seconds----
    [Slide]

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. I put up another document. It is right in 
front of you there. And 12-17-2015, I don't know if you are 
aware of this, but this was raised by one of your engineers. 
``Are we vulnerable to single AOA sensor failures with the MCAS 
implementation or is there some checking that occurs?''
    Did you ever receive this communication, and did you 
respond to that engineer?
    Mr. Hamilton. Chairman, I did not actually receive this 
communication, but I am aware of the communication recently as 
it surfaced. In talking with the engineer, I think it 
highlights that our engineers do raise questions in an open 
culture. They question things. But it also followed our 
thorough process, and was determined that the single sensor, 
from a reliability and availability standpoint, met the hazard 
category and the safety----
    Mr. DeFazio. Well, of course, we don't know what happened 
in Ethiopia, but there is some speculation a bird sheared it 
off. They are pretty delicate little things out there, 
actually. I have seen them.
    [Slide]

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. And now, of course--a final slide here is now, 
as you emphasize, flight control will now compare inputs from 
both AOA sensors. And I guess the question is why wasn't it 
that way from day one?
    Mr. Muilenburg. Mr. Chairman?
    Mr. DeFazio. Why wasn't it that way from day one? If you 
can do it now, with an extra wire, or a software fix, or 
whatever, why didn't you do it from day one? Why not have that 
redundancy?
    Mr. Muilenburg. Mr. Chairman, we have asked ourselves that 
same question over and over. And if back then we knew 
everything that we know now, we would have made a different 
decision.
    The original concept, from a safety standpoint, was to 
build the MCAS, extend the current speed trim system on the 
previous generation of 737. That is a system that had about 200 
million safe flight hours on it. So one of our safety 
principles is to take safe systems, and then incrementally 
extend them. That was the safety concept behind the original 
decision.
    Mr. DeFazio. All right. Well, thank you.
    Mr. Muilenburg. We learned since then.
    Mr. DeFazio. Right.
    Mr. Muilenburg. And that is----
    Mr. DeFazio. My time----
    Mr. Muilenburg [continuing]. When we moved to this new 
design.
    Mr. DeFazio. Sure. My time has expired, and I want to turn 
to the ranking member.
    The ranking member, Mr. Graves, is recognized.
    Mr. Graves of Missouri. It is hard to know where to start.
    Now I want to go back to the--just kind of for 
clarification--to that first slide with the MCAS, can we bring 
that up?
    Mr. DeFazio. Just bring that first slide back up, please, 
for Sam, the one that shows the flight deck with the MCAS.
    [Slide]

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. There.
    Mr. Graves of Missouri. The MCAS warning light, to me, 
would be--this is, I guess, more of an editorial comment. Have 
you ever been in your car and the check engine light comes on? 
And we are--``What the heck?'' OK. So what is it? Is it the oil 
pressure? Is it the oil temperature? Is it the vacuum? I don't 
know what it is. It is just a general check engine.
    And the stuff that is more important to me, you know, is 
the stuff that is on the left, because MCAS manifests itself as 
a trim issue. It is a runaway trim issue, which, again, I go 
back to training.
    And you have memory items. Every pilot is--I shouldn't say 
that--in the United States, pilots are taught to have memory 
items. You instantly go through those when you have a failure. 
You start through that checklist in your mind. And we have--
some of them are even goofy little rhymes, or whatever, to help 
you remember. And you go through each one of these processes.
    In the case of Ethiopian Air--I still come back to this, 
too--they never retarded the throttles. They set the throttles 
for takeoff, and they never pulled them back. They went right 
through the maximum certified speed of 736 or 737 MAX 8, right 
on through, right up to 500 miles per hour, way beyond the 
maximum certified speed. That is the reason they can't manually 
trim the airplane, is because it is going so fast.
    And I have used that analogy, too. Go down the road at 70 
miles an hour. Try opening the door. See if you can open the 
door, and see what the pressures are against the door of your 
car. The more pressure there is, the faster you are going, the 
more pressure there is, and the harder it is to try to reverse 
those pressures.
    But you go through those memory items, and you immediately 
start ticking down. And the chairman is right, in terms of, 
what is the average, you know? Is it 4 seconds to react, 10 
seconds to react?
    And I guess that is one of the flaws that we need to be 
thinking about is, I guess we are going to have to start 
building airplanes to the least common denominator in terms 
of--and that is a poor choice of words, I guess you might say, 
but the least common denominator in terms of, internationally, 
we have got to start thinking about--if we are going to export, 
we are going to have to start thinking about international 
training standards.
    And I know that is one of the things that is being looked 
at, in how they train. Did they have those memory items? Could 
they tick them off? Most pilots will sit there, and they will 
do it in the shower. You go through your memory items. I do it 
all the time in the shower, just sit there and tick through my 
memory items on engine failure, trim failure, whatever those 
might be.
    But I guess we are making assumptions, and the FAA is 
making assumptions, manufacturers are making assumptions about 
pilot training experience. And in the aftermath of these two 
accidents--and I am going to--this question is for Mr. 
Muilenburg--do you believe that these assumptions, particularly 
for aircraft that are going to be operated outside of the 
United States, do we need to revisit those assumptions?
    Mr. Muilenburg. Congressman, we believe we need to go take 
a look at those longstanding industry assumptions. As you well 
point out, those are used across manufacturers, not just 
Boeing. And these are things that have produced safe airplanes 
for decades. But we do believe that it is appropriate to go 
take a hard look at those. We may need to make some revisions.
    I think the JATR report has identified the same thing, and 
we think that would be a good area for us all to look at on 
behalf of aviation safety. We are committed to doing that and 
supporting that study.
    And one of the areas for the future that we are investing 
in is we think about pilot-machine interface, and how to do 
that most effectively. And, as you pointed out earlier, a large 
generation of new pilots will be needed over the next 20 years, 
and we need to be thinking about designing our airplanes for 
that next generation.
    Mr. Graves of Missouri. With the benefit--and it is always 
dangerous to--because hindsight is always 20/20, but knowing 
what you know now, would the Boeing Company have done things 
differently? Would you have done things differently, in terms 
of certification of the 737 Max?
    Mr. Muilenburg. Congressman, yes, we would have. We have 
learned, as I mentioned earlier, we made some mistakes. We 
discovered some things we didn't get right. And we own that. We 
are responsible for our airplanes. Any accident with one of our 
airplanes is unacceptable. And that is our responsibility. We 
own it. We are going to fix it. We know what needs to be done. 
And that is where we are focused, going forward.
    Mr. Graves of Missouri. I am going to make a comment here, 
and this is--it is as a result of this. And the unfortunate 
part is we lost life. We lost loved ones, friends, and life was 
lost as a result of these accidents. And, you hope that it is 
never going to happen again. The unfortunate reality is one of 
these days it will happen again.
    But I have harped on this, and this is something that 
concerns me. And I have talked, too, about the difference in 
the United States in pilot training, and pilot training in 
other countries. But something that concerns me, and I want 
everybody to hear this. In the United States, what I am afraid 
of is we are going down the same direction that we are seeing 
in other countries when it comes to getting pilots to the point 
where they can fly.
    No matter what, we can build the most perfect airplane that 
is never going to cause a problem, or it is never going to get 
itself into a bad situation. And sure enough, sooner or later, 
it is going to get into a bad situation, and it is going to 
require a pilot to figure out what is wrong, and then to come 
back and fly that airplane.
    But here in the United States, I think we are dumbing down. 
And again, this is a criticism of our system, because this is 
what I am afraid we are going to. And I want to think about 
this as we move forward, because I think it needs to be 
addressed. But in the United States, we taught spin training 
and stall training in your basic piloting skills for your 
private pilot's license. Before you get commercial, before you 
get your airline transport rating, you are taught--or you were 
taught--basic stall characteristics and how to get out of a 
spin.
    Today you can't do that. An instructor is not allowed to 
let a stall fully develop. At the first warning--this is what 
it states in the book--at the first warning of a stall, they 
have to recover or they fail their check ride immediately. That 
means if the light comes on, or if the buzzer goes off, they 
have to recover immediately. They can't let that stall develop.
    So we're teaching them how to--and this is happening in 
other countries, because many countries do base their system 
off our system, as well, but sooner or later you are going to 
get an airplane into a stall. But we are not teaching anybody 
how to get out of that stall and how to recognize it. We are 
teaching them how to not get into it. Well, that is never going 
to happen. Sooner or later, you are going to get into a 
problem.
    And this concerns me because we have changed. We have 
rewritten our--and I have got a problem with the FAA allowing 
this, but we have rewritten our instruction manuals to not 
allow this to happen, to not allow these items that will 
ultimately happen. We aren't teaching pilots how to fix them, 
how to correct them, how to get out of them, how to save the 
people that are in the plane with them, heaven forbid that 
should happen. Again, that is me harping because it concerns 
me, and it concerns me in a big way. The United States is 
behind other countries in, ultimately, going down that road. 
And I think we have to get back to basic piloting.
    And there is nothing wrong with technology. I think 
technology is great. But the most important safety component in 
any airplane is a pilot that can fly the damn plane, and not 
just fly the computer.
    I think I have got a minute left. Actually, I will just 
yield back.
    Mr. DeFazio. OK, I thank the gentleman. I now recognize 
the--how do we do this, in order of--OK. We do this in order of 
seniority and appearance. And so first would be Ms. Norton.
    Ms. Norton. Thank you very much, Chairman DeFazio. I can't 
say enough about the importance of this hearing.
    I appreciate you, Mr. Muilenburg, being here. Ranking 
Member Graves asked had you flown--I think you even said in 
your testimony that you had flown on the 737 MAX since the 
fixes or corrections have been made. That is your testimony?
    Mr. Muilenburg. Ma'am, yes. I have flown on a couple of 
test flights as part of that----
    Ms. Norton. Test flights. I understood those to be test 
flights.
    But the chairman mentioned that we are trying to get to the 
roots of the problem so it doesn't happen again, so the FAA--so 
that airlines like Boeing--and so my questions really go to 
penalties, whether they have made any difference, penalties 
paid or outstanding--essentially, to compliance, so the 
Congress can decide what, if anything, it can do. Everybody has 
an obligation here. Boeing, to be sure, but so does Congress.
    So the record I have--and I ask you, Mr. Muilenburg, did 
Boeing enter into a settlement agreement with FAA in an effort 
to resolve what were then multiple enforcement cases against 
Boeing that were either pending or under investigation? That 
was in 2015.
    Mr. Muilenburg. Congresswoman, I am not familiar with the 
details of that, although I am aware----
    Ms. Norton. I simply asked did you enter into settlement 
agreements. Surely you know whether you entered into settlement 
agreements.
    Mr. Muilenburg. John, you----
    Ms. Norton. I didn't ask you about the details.
    Mr. Hamilton. Congresswoman, that is correct. We did enter 
a settlement agreement in 2015.
    Ms. Norton. Thank you. Is it also true that Boeing had to 
immediately pay $12 million into the U.S. Treasury as a result?
    Mr. Hamilton. That is correct.
    Ms. Norton. Continuing, is it true that Boeing faced up to 
$24 million in additional penalties through 2020, if certain 
conditions were not met?
    Mr. Hamilton. Yes, Congresswoman. In working with the FAA, 
they were really looking for creating a longstanding agreement 
with us to build a good foundation on elevating compliance----
    Ms. Norton. I am just asking you about the $24 million.
    Mr. Hamilton. And----
    Ms. Norton. My time is limited--in additional penalties 
through 2020 if the conditions were not met.
    Mr. Hamilton. There was----
    Ms. Norton. Wasn't that the agreement, the understanding?
    Mr. Hamilton. There was a--yes, there was a deferred 
penalty.
    Ms. Norton. Now I am just going to list quickly the 
obligations: improve management and accountability, internal 
auditing, supplier management, more stringent quality and 
timeliness of regulatory submissions, simplify specifications. 
I could go on. Surely, you understood that that was the 
agreement, those were the agreement.
    Yet in designing and developing and manufacturing the 737 
MAX, Boeing has run into issues, problems--characterize them as 
you will--in meeting the obligations in most of these 
categories. Would you agree, Mr. Muilenburg?
    Mr. Muilenburg. Congresswoman, we have identified many of 
those challenges through the MAX development program, and some 
of those are in the areas that----
    Ms. Norton. And you have had issues in meeting them. Some 
of this has resulted in the problems that bring us here today.
    Mr. Muilenburg. Congresswoman, I can't give you any 
specific examples that link the two.
    I don't know, John, if you have got any----
    Ms. Norton. I didn't ask you that.
    Mr. Muilenburg [continuing]. Thoughts on that?
    Mr. Hamilton. Yes, the--some of these agreements were 
agreements that you would make over the course of the 5 years. 
Each year we provide a progress report to the FAA on our 
progress on that. And there is still----
    Ms. Norton. Yes. And so you--I am not saying you are not 
making progress. I am saying the issues----
    Mr. Hamilton. There are still----
    Ms. Norton [continuing]. As you say, are in black and 
white.
    Mr. Hamilton. There is still opportunity in the time 
remaining to meet all obligations of the settlement agreement.
    Ms. Norton. Within the last decade Boeing has had two 
worldwide groundings of relatively new airplanes, the 787 
Dreamliner, the 737 MAX, and encountered many compliance issues 
in the time since Boeing paid that $12 million settlement 
payment. And I am assuming it was paid.
    Has the FAA assessed any additional financial penalties on 
Boeing to the 2015 agreement?
    Mr. Hamilton. No, we are not aware of any additional 
penalties.
    Mr. DeFazio. OK. The time of the gentlelady has expired. It 
would be, first, Mr. Crawford.
    Mr. Crawford. Thank you, Mr. Chairman.
    Mr. Muilenburg, are you aware of any aviation accident that 
can be attributed to a single factor?
    Mr. Muilenburg. Congressman, no. I think the history of 
aviation shows that these accidents are very--and they are very 
unfortunate, but in many cases they involve multiple factors.
    Mr. Crawford. Mr. Hamilton, do you agree with that?
    Mr. Hamilton. Yes. As Ranking Member Graves pointed out, 
James Reason's swiss cheese model, all accidents are typically 
due to a number of contributing causes.
    Mr. Crawford. The Indonesian National Transportation Safety 
Committee recently issued its final report into the Lion Air 
610 flight, finding nine contributing factors for the crash. 
Other than the design of the aircraft, those factors include 
the miscalibration of sensors during repairs, a lack of flight 
and maintenance documentation, and failure by the flight crew 
to appropriately respond to an emergency situation. To quote 
one of the Indonesian flight investigators, ``The nine factors 
have to happen together. If one of these nine contributing 
factors did not happen, the crash would not have happened.''
    Mr. Chairman, I have a copy of that report here, and I ask 
for unanimous consent that it be included in the record.
    Mr. DeFazio. Without objection.
    [The information follows:]

                                 
  ``Final Aircraft Accident Investigation Report KNKT.18.10.35.04,'' 
               Submitted for the Record by Hon. Crawford

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]


    The document is retained in the committee files and available at: 
https://www.flightradar24.com/blog/wp-content/uploads/2019/10/JT610-PK-
LQP-Final-Report.pdf

    Mr. Crawford. Thank you, Mr. Chairman, and I will yield 
back.
    Mr. DeFazio. I thank the gentleman. Next on our side would 
be Representative Eddie Bernice Johnson.
    Ms. Johnson. Thank you, Mr. Chairman. And thank our 
witnesses for being here.
    I would like to ask unanimous consent to put an opening 
statement in the record.
    Mr. DeFazio. Without objection.
    [Ms. Johnson's prepared statement follows:]

                                 
 Prepared Statement of Hon. Eddie Bernice Johnson, a Representative in 
                    Congress from the State of Texas
    I thank the chairman and ranking member for having this hearing 
today, as it allows us to examine the current priorities and critical 
concerns with the Boeing 737 MAX aircraft. I am eager to hear from Mr. 
Muilenburg, the president and CEO of the Boeing Company.
    My interests are specific as to how we as a legislative body can 
adequately address the promotion of aviation safety; potential avenues 
of reform in the agency certification processes; and long-term 
influences on consumer flight experiences.
    As to safety, the Boeing 737 MAX was marketed as a safe, 
modernairplane; however, after two major failures and hundreds of 
people losing their lives, we now know that the 737 MAX is not a safe 
plane and consequently has been grounded.
    As to the agency certification process, we must ensure that the 
planes that are certified to fly go through the most comprehensive 
certification process modernly available, so that we may avoid these 
tragic failures in flight. We are experiencing a serious crisis of 
trust in aviation safety. The importance of an appropriate 
certification process for large aircraft in the United States is now 
more pertinent than ever. If the safety certification process merits 
reexamination and reform, we must advocate for transparency. This will 
avert not only the reduction of the United States position of authority 
on aviation safety, but also the endangerment of hundreds of lives in 
preventable accidents.
    My district in Texas is a major hub for aviation, and with the 
significance of this industry and the jobs that the airline industry 
provides, I am dedicated to addressing the imminent and long-term 
concerns regarding the grounding and ensuing safety concerns of the 737 
MAX aircraft. This is of significant concern to me, as both American 
Airlines and Southwest Airlines are prominent entities at the Dallas 
Fort Worth International Airport and the Dallas Love Field Airport and 
had previously employed a significant number of this aircraft model.
    Therefore, the operational implications of the grounding and safety 
certification of the Boeing 737 MAX are literally a matter of life and 
death.
    Again, I look forward to the testimony of Mr. Muilenburg and the 
answers to my questions. With this hearing, I join the efforts of my 
colleagues in Congress to meaningfully and comprehensively address 
these urgent concerns on both the national and global scale.

    Ms. Johnson. Mr. Muilenburg, Mr. Mark Forkner's position as 
chief technical pilot on the 737 MAX was in place at the time 
of the accident. Who did he report to?
    Mr. Muilenburg. Congresswoman, he was an engineer in our 
Commercial Airplanes division. I am not sure who he reported to 
directly, but he reported up through our engineering team.
    John, if you----
    Mr. Hamilton. Actually, he was in the training department, 
so he worked through the training organization.
    Ms. Johnson. OK. So there was a chain of command in some 
way?
    Mr. Muilenburg. Yes.
    Mr. Hamilton. Yes.
    Ms. Johnson. OK. In March of 2016 he asked the FAA if it 
was OK to remove all references to the MCAS in the flight crew 
operations manual and training materials. When he made this 
request, was he acting on his own, outside the scope of what he 
was supposed to be doing as the chief technical pilot?
    Mr. Muilenburg. Congresswoman, part of Mr. Forkner's 
responsibility included discussions on training with the FAA, 
but that is more than a single individual. There is a large 
team that does that work, together with the FAA and other 
stakeholders. And typically, they will discuss the contents of 
the training manual and make iterations on that manual over 
time to try to optimize it for the pilots.
    Ms. Johnson. Was there some way that it was called to his 
attention, this request was made? And what was the inside 
discussion?
    Mr. Muilenburg. Congresswoman, I apologize, I could not 
hear your question.
    Ms. Johnson. The first question you responded to, which is 
related to the second one, and that is when he made the request 
to remove all references to the MCAS and the flight crew 
operations manual and training materials, when he made that 
request, was he acting on his own? And you said that it was a 
number of people.
    So I am saying was he just--talked a--did he have any 
reprimand in any way for this request being made, or was it a 
group request?
    Mr. Muilenburg. Congresswoman, part of that discussion on 
whether to include MCAS in the training manual, that was an 
iterative process over several years, and included many people 
beyond Mr. Forkner.
    And typically, what we do is we want to include in the 
training manuals the items that the pilots need to fly the 
airplane. I think Ranking Member Graves described it well 
earlier. We don't want to put more information in the training 
manual than required. We want to focus on the information that 
is needed to fly the airplane.
    And so, typically, over a multiyear timeframe, we will make 
decisions on whether to include things or not, depending on 
whether they meet our criteria for what is beneficial to the 
pilots.
    Ms. Johnson. Was he or anybody else in Boeing rewarded in 
any financial way for removing this requirement, and making it 
simpler for you?
    Mr. Muilenburg. Congresswoman, no. That is part of our 
obligation. Our responsibility is to provide the best training 
manuals we can.
    I know the discussion around MCAS has included a--there has 
been a lot of discussion about whether to include it or not. 
But again, our focus has been on providing the information the 
pilot needs to fly the airplane, rather than the information 
that would be used to diagnose a failure. And that difference 
between flying the airplane and diagnosing a failure is a 
really important safety concept in our training manuals.
    Ms. Johnson. Well, do you recall any discussion that was 
made around anybody objecting to this decision to remove this 
MCAS from pilot training materials?
    Mr. Muilenburg. Congresswoman, I can't point you to a 
specific document, but I know there were discussions, debates 
on whether to include MCAS or not. That is part of our healthy 
engineering culture. We bring up ideas, we debate. We encourage 
that open discussion. That is how we ultimately optimized the 
content of the training manual.
    Ms. Johnson. Have you reconsidered the removal of this 
material from your training manual, operational manual?
    [No response.]
    Ms. Johnson. Have you had any discussion to reconsider 
removal of that material?
    Mr. Muilenburg. There were discussions and debates amongst 
the team. Again, that was happening during that multiyear 
timeframe as MAX was being developed.
    I don't know, John, if you want to add to that.
    Mr. Hamilton. No, I agree. But I would say, since these 
accidents, we understand that pilots do want more information, 
and we are going to incorporate that in our flight crew 
training manual and flight crew operations manual.
    Mr. Muilenburg. That has been----
    Ms. Johnson. Thank you. My time----
    Mr. Muilenburg [continuing]. One of our key learnings----
    Mr. DeFazio. The time of the gentlelady has expired. Just a 
quick interjection in reference to the single point of failure.
    I mean there was Turkish Airlines flight 981, where a DC-10 
went down because the rear cargo door blew out. There was USAir 
flight 427, the rudder problem that we had, which was the 
subject of hearings in this committee. It was ultimately 
determined that the rudder hardovers--we had two of those 
single point of failure. And then we had the jack screw on the 
Alaska flight. You know, the--so there have been a number. And 
in this case MCAS was a major factor. It wasn't the only 
factor.
    With that, Representative Gibbs.
    Mr. Gibbs. Thank you, Chairman. My condolences to the 
families, too, prayers as you struggle through this very 
difficult time.
    On the MCAS, the sensor--and my understanding is on the 
angle-of-attack sensors there is actually two sensors, but only 
one was tied into the MCAS system. Is that correct?
    Mr. Muilenburg. Congressman, that is correct. Depending on 
sequencing of the flight control computers, one sensor would 
feed MCAS. But on different flights it could be either sensor. 
But one sensor at a time.
    Mr. Gibbs. OK, because--one thing, I am not a pilot. I fly, 
obviously, frequently. But, you know, when my friend down here, 
Garret Graves, talks about how important it is, you can't just 
pull off to the side of the road--redundancy.
    So I don't know what you guys were thinking, because 
sensors, I know from my background in agriculture, a lot of 
times when we have problems, it is usually a sensor failure 
that, you know, shuts the system down, because the sensor is 
failing. Just an analogy. And an airplane, I think redundancies 
really would be key.
    And so I think we have all learned a lesson there, that we 
are going to not just depend on one sensor. Correct? You have 
learned that?
    Mr. Muilenburg. Congressman, that is one of the lessons 
learned here. We tried to rely on a previous architecture. We 
have learned, and we are moving to a two-sensor architecture.
    Mr. Gibbs. Now, the MCAS system, I am old school, I guess. 
Maybe my kids and my grandkids might see it different. But 
every once in a while on stuff that I operate--on your phone or 
whatever, you got to reboot it. And so I have to agree with, I 
believe, the chairman, but definitely Ranking Member Graves 
talks about make sure we have the pilots be able to fly the 
plane. I know these systems have added safety, overall, we have 
less issues and tragedies because of the systems. But we have 
got to make sure humans have to be able to override it.
    So that is really concerning to me, when I heard that the 
Airbus doesn't have that ability to override. I think that is 
something the FAA ought to be looking at. I don't know. That 
just raises a question with me.
    But pilot training, testing. And I know we talked about 
these two catastrophic accidents happened in Lion Air and 
Indonesia and Ethiopia. And my understanding is--nothing 
against the pilots, I know they were trying to save their lives 
and everything, that is no doubt. But their training maybe 
wasn't what it should have been, reports I have read.
    I guess, if I was Boeing, a large manufacturer of very 
sophisticated pieces of equipment, aircraft--what was Boeing's 
plan in the future--you sell these sophisticated aircraft 
around the world--to make sure, other than just relying on 
their Government regulators--because I think I want to make 
sure that the people that are maintaining them, the people that 
are flying them have the training and the knowledge and the 
ability, continuing training.
    Moving forward, because this is one area I think we can 
make sure we prevent things like this happening, and not rely 
totally on the infrastructure itself, the asset itself, the 
technology itself, but make sure we got the human technology, 
the human behind that.
    So I guess I would hear your comments on what, going 
forward, what is Boeing going to do when they make these sales, 
to make sure that you are confident that the people that 
maintain the aircraft and fly the aircraft have the training 
and the ability--what Boeing's role would be, moving forward.
    Mr. Muilenburg. Congressman, I think you raise a very good 
point. And that broader area of comprehensive global aviation 
safety is an area where we are going to make additional 
investments, going forward. An element of that is helping to 
build the talent pipeline. By most estimates, the world will 
need about 44,000 new commercial airplanes over the next 20 
years, and about 1.5 million new pilots and aviation 
technicians. So we have a responsibility to help build that 
talent pipeline.
    We are also going to take a look at the pilot machine 
interface on our airplanes, and designing that for the next 
generation, as technology is rapidly evolving. We are investing 
heavily in that area, future flight deck design.
    We are also investing in additional simulation 
infrastructure around the world to provide additional training 
capacity, working with airline customers around the world.
    Those are just a few examples of what we are doing.
    Mr. Gibbs. I am just curious on the case of the two cases 
here, the Ethiopian and Lion Air, you know, the two cases, did 
you have simulators over there, training? Or how has that 
worked here in the past? What has been the involvement of 
Boeing?
    Mr. Muilenburg. John, are you aware of exactly what 
training capacity they have?
    Mr. Hamilton. I am not specifically aware of what Ethiopia 
has, from a simulator standpoint.
    Mr. Muilenburg. Congressman, if we could take that 
question, we will follow up with the details there. I know we 
have a team that is locally engaged with both airlines, and we 
will follow up with the details on simulation infrastructure--
--
    Mr. Gibbs. Yes, I appreciate that, because I think, moving 
forward, we rely too much on our computers and our--all that. 
And we know that machines do break, too.
    So I yield back. Thank you, Mr. Chairman.
    Mr. DeFazio. I now turn to the chair of the subcommittee, 
Mr. Larsen.
    Mr. Larsen. Thank you, Mr. Chair.
    Mr. Muilenburg, as we are looking forward prospectively, we 
need to do our job looking retrospectively a little bit to 
understand the certification process. That has been the focus 
of this committee's long-term investigation since March. And so 
I want to touch on that a little bit.
    You said today and you said yesterday at the Senate hearing 
that ``We,'' that is Boeing, ``We have made mistakes and we got 
some things wrong.'' Can you name three specific mistakes 
Boeing made in this process?
    Mr. Muilenburg. Congressman, I would point out 
implementation of the angle-of-attack disagree alert. We got 
that wrong, upfront. The implementation was a mistake, and we 
have subsequently fixed that, going forward.
    Mr. Larsen. Second?
    Mr. Muilenburg. Secondly, we have learned about the MCAS 
architecture, the changes that we have already talked about. 
Clearly, we have some areas to improve there.
    Mr. Larsen. And third?
    Mr. Muilenburg. And thirdly, I would say, in the broader 
area of communication, documentation across all of the 
stakeholders, and doing that in an efficient and comprehensive 
manner, we have identified some improvements we need to make 
there.
    Mr. Larsen. Can you identify individuals, then, who made 
these mistakes within Boeing?
    Mr. Muilenburg. Congressman, across all three of those 
areas, these are large teams that work together across our 
company, our supply chain. We have about 900 supplier companies 
that work in our 737 supply chain alone: the FAA, other global 
regulators, airlines. So in each of these three areas, there 
are broad, integrated teams. There is no one individual that 
makes decisions within these. These generally are engineering 
teams that build consensus with all of the stakeholders.
    Mr. Larsen. So does that make this an organizational or 
cultural problem, as opposed to an individual problem and that 
led to these mistakes?
    Mr. Muilenburg. Congressman, I think it is important, from 
an accountability standpoint--you know, my company and I are 
accountable. That accountability starts with me. And our board 
recently took some actions regarding my position.
    Mr. Larsen. I was going to ask.
    Mr. Muilenburg. Yes.
    Mr. Larsen. How have you been held accountable through 
this?
    Mr. Muilenburg. Yes. So, Congressman, to your question, our 
board has recently taken some actions on my position, and I 
fully support that. That will allow me again to focus even more 
on safety in our internal operations. And these decisions are 
directed at safety.
    I have also taken some management actions. We know there 
are still a number of other reviews underway. And as those 
reviews are completed, if we need to take additional actions, 
we will. And those will be firm. And in some cases, they are 
not individual actions, but to--as you pointed out, they are 
organizational or structural actions. And these are equally 
important.
    And we have recently announced changes to our safety review 
board structures to elevate them and make them more 
transparent. I now receive weekly data reports, very detailed 
level, on our safety review boards. We stood up a new safety 
organization under Beth Pasztor. She now reports directly to 
our chief engineer, who reports to me, instead of being down in 
the businesses.
    Our board has set up a new aerospace safety committee that 
is chaired by Admiral Giambastiani. Just Friday we announced 
the addition of Admiral Richardson, who has a deep, deep 
background in safety. He will be a member of that committee.
    And then we have also realigned our entire engineering 
organization, roughly 50,000 engineers now all report directly 
to our chief engineer, who reports to me. And again, this will 
create additional transparency, visibility, and independence, 
all with a focus on safety.
    Mr. Larsen. So I can't help but think, when I hear that, 
and when I read the JATR report, and read the NTSB 
recommendations from September, and read the Indonesian 
accident investigation report, that there are changes that we 
need in how we certify aircraft and components in the FAA 
process, that what we have now went too far, and that we don't 
have a handle.
    We hold the FAA accountable. The FAA is supposed to then 
hold the OEMs, the original equipment manufacturers, 
accountable. I am not convinced, based on reading these reports 
and looking at Boeing's own actions, that that is being done 
adequately. And I would like to hear your view on what--well, 
do you agree with me or not?
    Mr. Muilenburg. Congressman, we believe there are also 
improvements we can make to that process. And as you are very, 
very familiar with the delegated authority process, that 
process, we do think, is very important to fundamental safety. 
It broadly--it contributes to the 95-percent improvement in 
safety we have seen over the last two decades. But we need to 
make sure we have the balance right, and we support the reviews 
that have been announced on that. I think that----
    Mr. Larsen. Well, if I could just--and I will finish here, 
Mr. Chair--if the bookends on this are what former--well, 
Acting Administrator Elwell said at one time it would be $2 
billion and 10,000 more inspectors. If that is one bookend, and 
the other bookend is what we have today, I think that we ought 
to be pulling out a book somewhere between those two bookends. 
And right now we are--we have gone too far.
    And with that I yield back.
    Mr. DeFazio. I thank the gentleman. Representative Davis?
    Mr. Davis. Thank you, Mr. Chair. And, as a matter of fact, 
I want to kind of add to what my colleague from the State of 
Washington was asking about, and it is about the certification 
process.
    As he just asked, there is one bookend of what the FAA 
actually believes could be done with billions more dollars in 
inspectors. We have the current certification process. I don't 
want to see a knee-jerk reaction here.
    Look, it breaks my heart, and everybody's heart in this 
room, to look over and see those pictures. And I know it does 
yours, too. These are real people who were affected by tragic 
accidents that we are here to get answers for. But we also want 
to make sure that we don't see any more in rooms like this.
    I have many of my constituents who work at your facilities 
in St. Louis and in Mascoutah, Illinois. I know every one of 
those constituents that put on that Boeing uniform and go to 
work every day, it breaks their heart when they see accidents 
and tragedies like we have witnessed. They want to do the best 
job they can to put a safe plane in the air. They want to make 
sure no one cuts corners.
    So this certification process, tell us, so we don't have 
that knee-jerk reaction, what do you think the sweet spot is 
from those bookends that Mr. Larsen was talking about?
    Mr. Muilenburg. Congressman, I applaud the focus on safety 
and people. As you point out, we always have to remember what 
we are doing here is providing safe travel for people around 
the globe, and lives depend on what we do. So we have to get it 
right.
    I think the certification system that we have today is a 
solid system that has been built up over decades. We have seen 
very significant improvements in safe travel over the last two 
decades--as I mentioned, about a 95-percent improvement. That 
is a result of the current certification system. So we need to 
maintain what is good in that current system. There is, 
clearly, a lot of goodness.
    I think we have identified a couple of areas where we could 
look at refinements. And one of the areas we talked about is 
standards, these longstanding industry standards around pilot-
machine interface, and the assumptions behind that. I think we 
are all eager to take a look at that as a potential area of 
reform.
    And I think, as John has well pointed out, there are some 
aged regulations on the books that could be updated to 
represent current technology, and that would also be 
beneficial.
    Mr. Davis. Well, that is good to hear. And I certainly hope 
all of us here, we as policymakers, can ensure that we don't 
have that knee-jerk reaction. Because we all have the same 
goal. And there is probably not many more in the country that 
fly as much as we do. So we understand the safety of the 
aviation industry. But it is those instances where safety might 
have been compromised, which is why you are here.
    And I appreciate Boeing, and I appreciate you admitting 
mistakes and talking about the administrative decisions that 
you are making as a team at Boeing to ensure that those 
mistakes aren't made in the future.
    We have seen some disturbing whistleblower complaints, 
complaints from former Boeing executives and workers about 
processes and the culture that may exist at certain facilities. 
What are you doing to address some of those to ensure that the 
culture at Boeing, at all of their facilities, is up to par 
with the facilities that I know my constituents work at in St. 
Louis and in Mascoutah?
    Mr. Muilenburg. Yes. Well, Congressman, you raise a very 
good point. And we want our employees to speak up. When they 
have concerns, issues, we want a culture where they are willing 
to speak up. So I encourage those reports. We want to hear what 
our employees' concerns are.
    We conduct surveys to bring those up, as well, and we 
provide reporting channels where, if employees want to bring up 
anonymous concerns, they can. And those get immediate followup 
action. And I think it is important, when you take a look at 
those--the whistleblower complaints, other points that you have 
brought up, this is part of our culture of providing visibility 
on issues. That is how we get better, as a company.
    And I can also tell you, as you know, I know the 150,000 
people of Boeing. You know them from St. Louis and Mascoutah. I 
know them, as you do. These are honest, hardworking, dedicated 
people that know the work they do directly affects lives. And 
they want to do it right, and they want to do it with 
excellence. And we want a culture where people can bring up 
concerns.
    And my commitment, the culture of our company--I know John 
shares this, as does the rest of my team--is to be responsive 
to those inputs, to hear our employees, to take action, and to 
do that consistent with our values.
    Mr. Davis. Well, I hope the message you take from today's 
hearing when you go back is thank you for the good job that 
many of your employees do on a daily basis, but we also expect 
results. And we want to see those results in all of your 
facilities.
    And my time is up. I yield back, and I thank you both for 
being here.
    Mr. DeFazio. I thank the gentleman. The Representative from 
California, Mrs. Napolitano.
    Mrs. Napolitano. Thank you, Mr. Chairman. Our collective 
prayers are with the families on their tremendous loss, and I 
am glad you are here, showing us--keeping us aware of it.
    Mr. Muilenburg, my question is regarding FAA's organization 
delegation authority, known as ODA, that allows your company to 
oversee certain FAA certification activities. The FAA's Boeing 
Aviation Safety Oversight Office, or BASOO, not only oversees 
the Boeing 737 MAX program, but it also oversees other Boeing 
commercial transport aircraft programs, including the 777 and 
the 787 Dreamliner.
    There are approximately 45 FAA employees that work in 
BASOO, but there are 1,500 Boeing employees that work in the 
organization, ODA, program. These Boeing employees have a dual 
role of working for Boeing and representing the Government's 
interests through the FAA.
    Mr. Muilenburg, do you believe that having 45 FAA employees 
overseeing all of the critical safety decisions Boeing makes 
every day regarding commercial aircraft is adequate? Yes or no?
    Mr. Muilenburg. Congresswoman, I can't give you what would 
be the exact right number. We do respect the FAA's oversight 
authority. We think----
    Mr. DeFazio. Well, she didn't--sir, she did ask for a yes-
or-no answer. Do you believe that is an adequate number, given 
the scope of their duties?
    Mr. Muilenburg. Mr. Chairman, I can't answer that 
specifically.
    Mr. DeFazio. OK, all right.
    Mr. Muilenburg. I think that is the FAA's call. All I want 
to say is we fully support the FAA's oversight. We think strong 
oversight----
    Mrs. Napolitano. Thank you, sir.
    Mr. Muilenburg [continuing]. Is part of what makes the 
system safe.
    Mrs. Napolitano. Thank you. I think the tragedy of Boeing 
737 MAX doesn't just highlight cultural problems at Boeing 
regarding production and Boeing's commitment to safety, but I 
think also highlighted a failure by the FAA to provide 
appropriate oversight of critical issues that impacted safety 
and ultimately led to the accidents of both Lion Air and 
Ethiopian Airlines.
    I think the current oversight structure is a critical--very 
critical--issue, and one that Congress is going to have to need 
to evaluate in the wake of these accidents.
    Thank you, Mr. Chairman. I yield the remaining time to you.
    Mr. DeFazio. Thank you, Mrs. Napolitano.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. I want to return to the market pressures, the 
fact that you had to design a plane that was more economical 
and couldn't require pilot training, and I would, you know, 
refer to--the first slide here is during an executive review 
of, unfortunately, it is an Ethiopian Airlines plane, talking 
about the MAX advantage. And it was just relentless pressure.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. And the next slide, which is, you know, no 
flight simulator required. We have had questions about the 
communications of your test pilot, and we have the polling from 
your own employees about the pressures.
    There is going to be, ultimately, a determination whether 
you directly concealed, inadvertently concealed, provided in a 
fragmented manner the full MCAS in its radical form, 
information to the regulators, and that is something we are 
also going to pursue with the regulators, what their 
understanding was.
    Let me just ask a quick question.
    I know you know why we are here today: 346 people died on 2 
of your airplanes in 5 months. And you are helping us to try 
and delve into what we need to fix, because we need to change 
the law.
    But part of this process, really, is taking full 
accountability for what went wrong, for the death of 346 
innocent people on two 737 MAX flights. So my question is a 
simple one, and I hope you can give me a direct response.
    Who bears the principal responsibility at Boeing for the 
cascading events that resulted in the crash of Lion Air flight 
610 and Ethiopian Airlines flight 302?
    I know that you have lost your board chair. You are still 
CEO, you still serve on the board. I did happen to look at your 
compensation last year. You received after that crash a $15 
million bonus.
    What are the consequences? Who is taking principal 
responsibility? Who is going to be held accountable, fully 
accountable? I know you fired one person.
    Mr. Muilenburg. Mr. Chairman, my company and I are 
responsible. We are responsible for our airplanes. And we know 
there are things we need to improve. We own that. We are going 
to fix it, and we are responsible. I am responsible.
    Mr. DeFazio. OK.
    Mr. Muilenburg. I am also accountable.
    Mr. DeFazio. All right.
    Mr. Muilenburg. And I described the actions that we took 
earlier. And, as additional reviews are completed, as 
additional studies are completed, we will take additional 
action.
    But I am accountable, my company is accountable. The flying 
public deserves safe airplanes. That is our business.
    Mr. DeFazio. Thank you.
    Mr. Woodall?
    Mr. Woodall. Thank you, Mr. Chairman. I wanted to pick up 
where the chairman left off with the no flight simulator 
required slide.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Woodall. I am a lawyer, I am not an engineer. But I 
don't understand the regulatory distinction between a 
derivative type and a new type.
    Is the requirement of a new flight simulator a disqualifier 
to fit in under a derivative certificate?
    Mr. Hamilton. No, let me explain. The 737 is a family of 
airplanes. It is one of the safest family of airplanes flying 
in the world today. And many pilots will fly an NG first flight 
in the morning, they could fly a MAX as the second flight of 
the day, back in the NG on the third flight of the day.
    And so one of the market requirements the customers want is 
to be able to make it a seamless transition from an NG to a 
MAX.
    Mr. Woodall. Well, let me go back, then, because the New 
York Times reported in 2011, as competition grew with Airbus, 
that it was Boeing's position that we didn't want a derivative 
type, that it was a brandnew, clean-sheet design that is what 
customers wanted.
    And so, was the presumption at that time that you were 
going to do a brandnew, clean-sheet design, going to create a 
brandnew type certificate, and no new flight simulator was 
going to be required?
    Mr. Hamilton. Congressman, I was actually the chief 
engineer of the 737 at that time, and we had actually had 
product studies, as we normally do, looking at reengining, 
since 2007.
    We also had a product development organization that was 
looking at a new airplane. And just like any good company, we 
were looking at both options, and competing them internally 
about what made sense to bring to the market. At the end of the 
day, what the customers really wanted was to have an airplane 
they could seamlessly transition from their 737s into this 
future airplane. They----
    Mr. Woodall. Well, when we talk about who takes 
responsibility, candidly, I am concerned that we may have 
created a regulatory environment that makes it so difficult for 
you to get a new type certificate that you try to stuff all of 
these changes that should never be stuffed in under a 
derivative certificate.
    But what you are telling me is, no, it is your customers 
who demand that you get derivative certificates, and we, from a 
regulatory perspective, are not complicit in making it too hard 
to declare that new model.
    Mr. Hamilton. I would say that a derivative type cert is 
not necessarily any easier than a new type cert. I think, as 
someone alluded to, we took over 5 years to do the derivative 
type cert, which is very consistent with what we do for a new 
type cert.
    So they are actually very complementary. And if you look at 
the MAX's certification, it was very comprehensive.
    Mr. Woodall. All right. So when we go back to the IG's 
report that quotes an FAA official as saying, ``The 737 MAX is 
not a simple derivative of its previous models, it is a very 
complex modification incorporating many new and novel features. 
Boeing is doing everything it can to be exempt from the new 
certification rules and keep the aircraft the same type rating 
with minimal training differences,'' that has nothing to do 
with the length of the approval process, that has everything to 
do with the economic pressures Boeing is under to meet customer 
demand of pilot similarity in a continuing model?
    Mr. Hamilton. Yes, the MAX was--with technology we 
determined that we could get the same amount of fuel 
efficiency, the same amount of carbon dioxide reductions, the 
same amount of noise reductions that we pretty much could with 
a new type--a new airplane. And it was a desire from the 
customers.
    So, yes, that informed some of the decisions we made, but 
it wasn't about--how we approached certification. It was about 
design choices we made.
    Mr. Woodall. Let's go back to the FAA partnership, then, 
because I--and I appreciate what you said yesterday in your 
Senate testimony, Mr. Muilenburg, about ODA making American 
aviation and world aviation safer. I believe that to be true, 
and I very much worry that, in every tragedy, that the tendency 
is to swing the pendulum back too far the other direction.
    When an FAA official says the MAX is not a simple 
derivative, it is a very complex modification, it does 
incorporate new and novel features, what role does Boeing have 
in requiring the FAA to go ahead and sign off on that 
derivative type, instead of saying, ``No, we have now looked at 
your engineering, this is not a derivative type, you must go 
back and begin this process again''?
    Is ODA implemented in FAA's decision of whether to certify 
a new type or not?
    Mr. Hamilton. Congressman, I used to run the ODA, and I was 
actually leading the ODA at the time. This is not an ODA 
function at all.
    This is Boeing as--the applicant, the OEM, we go discuss 
with the FAA what the certification basis should be for the 
airplane. And it is--ultimately, it is the FAA's decision. They 
set the requirement, they set the cert basis. And then we, as a 
company, as the applicant, we have to follow that. It is not an 
ODA function at all in establishing the cert basis.
    Mr. Woodall. I hope we will bring those FAA officials in, 
Mr. Chairman, so that we can ask that question, because that is 
the point of failure, if there is a point of failure in this 
regulatory process.
    Mr. DeFazio. OK.
    Mr. Woodall. I yield back.
    Mr. DeFazio. I thank the gentleman. Mr. Lipinski is next.
    Mr. Lipinski. This is not a court, and this is not a 
criminal hearing, but 346 people died in 2 crashes of Boeing 
737 MAX planes that should not have been certified to fly by 
the FAA.
    I said at a hearing earlier this year, ``Something went 
wrong in the certification process of this plane. Either the 
FAA certification process itself is at fault, Boeing is at 
fault in their role in the process, or both.'' After I made 
this statement, I was upbraided by some in the industry for 
questioning the process.
    But this committee has a responsibility to get to the 
bottom of what went wrong in the certification process for the 
737 MAX so we can make changes to that process and assure the 
public, especially those in this audience and everyone who lost 
loved ones, assure them that they will not be flying in unsafe 
planes again.
    Now, sitting here, we heard about accountability. I am not 
sure what accountability means if accountability means, Mr. 
Muilenburg, you received a $15 million bonus after these planes 
crashed. I am not sure who has been held accountable here for 
this.
    Two planes crashed. Even after the first plane crashed, I 
still don't really understand how you have--I am an engineer, 
but I am asking a lot of questions back here. People who are 
more expert than me--I don't understand how you have this 
single point of failure. Chairman DeFazio went through that, 
but it was raised, as the chairman mentioned.
    There is also another case. There was an internal ethics 
complaint that alleged that an engineer recommended the 
synthetic airspeed system be put in, which is in the 787 
Dreamliner, and was rebuffed because of ``cost and potential 
pilot training impact.''
    There is a lot of reasons mistakes are made. The problem, 
the bigger problem, is if mistakes were made for financial 
reasons. And there are a lot of things that seem to point to 
that in this whole process, and that is what is so concerning. 
And how did that happen in Boeing? How did Boeing allow that to 
happen? How did the certification process allow that to happen?
    In order to get a new type certificate, it takes, 
generally, a longer amount of time. I think most people will 
agree, Mr. Hamilton, it takes a longer amount of time. It also 
risks having--most likely you are going to have to require 
pilot training.
    So all these point back to ways of saving money, and that 
is a big problem. How do we stop that?
    Now, I want to ask--the JATR team found that MCAS was not 
evaluated--and this is something--I was listening to the Senate 
testimony yesterday, Mr. Muilenburg, and you didn't seem to 
agree with this. And I want to get your--what you say here: The 
JATR team found that MCAS was not evaluated as a complete and 
integrated function in the certification documents that were 
submitted to the FAA. Is that true?
    Mr. Muilenburg. Congressman, the MCAS system was certified 
with the FAA.
    Mr. Lipinski. Was it evaluated as a complete and integrated 
function, or was it step by step without ever having FAA look 
at it as a complete and integrated system? Because that is what 
is the important piece of this.
    Mr. Muilenburg. Yes, I think what the JATR report points 
out--and this is an area where we support further looks, as 
well--is when we think about what we call a cross-system 
integration, and how we do certification of that.
    So, for example, a multiple failure mode analysis, high 
pilot workload conditions, we do think that is an area where we 
want to look more deeply.
    The MCAS system and the MAX were certified to our current 
standards for how we do those analyses. But, as the JATR points 
out----
    Mr. Lipinski. Well, it was a completely--it was a very 
different system. I think that is very, very important, and 
that is something that FAA should have required, and I think it 
should have been provided.
    But in my last few seconds here I want to ask. As the 737 
MAX reenters service, will Boeing require airlines to conduct 
similar training on MCAS for all pilots?
    Mr. Muilenburg. Congressman, those decisions are the 
purview of the regulatory authorities around the world. And we 
will respect their----
    Mr. Lipinski. Will Boeing lose----
    Mr. Muilenburg [continuing]. Their decisions.
    Mr. Lipinski. Will Boeing have to give money back to any of 
the airlines if that is the case?
    Mr. Muilenburg. Congressman, money doesn't factor into this 
decision. It is about safety. So we----
    Mr. Lipinski. But if it is in the contract, that is a 
question.
    My time is up.
    Mr. DeFazio. I thank the gentleman. Representative Katko?
    Mr. Katko. Thank you, Mr. Chairman. And I thank all of my 
colleagues for all these questions today.
    In my previous life I was an organized crime prosecutor, 
and routinely had to sit with victims--and victims' families, 
more often. And the pain I see on your faces is exactly the 
pain I saw on those victims' faces. So I just want to recognize 
that, and recognize that--I hope you understand we are taking 
this very, very seriously.
    And I understand, Mr. Muilenburg, last night they had an 
opportunity to meet with the victims' families. I would like 
to--I know what--it always had a huge impact on me and how I 
carried out my cases, and it motivated me to do better, and to 
get to the bottom of the problem. So I want to hear what it was 
like for you, and what was discussed.
    Mr. Muilenburg. Congressman, I want to respect the privacy 
of the families, but I can perhaps, if you will allow me, just 
broadly describe our discussion.
    We wanted to listen. And each of the families told us the 
stories about the lives that were lost. And those were 
heartbreaking. I will never forget that.
    So we talked about their stories, we listened. And we, 
further into the conversation, you know, talked about safety, 
talked about changes, talked about what my company has learned, 
what I have learned. We talked about our commitment to never 
letting this happen again, to preventing any future accidents 
like this. You know, it was--one thing I wanted to convey to 
the families.
    But, you know, these stories, they are always going to be 
with us. And I wish we could change that. And all we could do 
is--we have to remember these people. It brought me back to 
remembering that, you know, lives literally depend on what we 
do at the Boeing Company. That is why I came to this company as 
a farm kid from Iowa, right? That is what I wanted to work on. 
And these stories brought that all back.
    Mr. Katko. Well----
    Mr. Muilenburg. So we are never going to forget that, and 
the commitments we shared with the families, and working in 
their communities going forward, that is very important to us. 
And we are going to follow up.
    Mr. Katko. I can tell you I never forgot any of those 
conversations with the victims of--murder victims, and what 
have you, their families. I can remember it like it was 
yesterday. And I hope you remember that, and it motivates you 
and your company, going forward, to do better than you have 
done.
    Mr. Hamilton, from an engineering standpoint, I want to 
switch gears a bit. My colleagues have done a terrific job of 
asking about this particular issue. But I am concerned about 
other things with respect to air safety, as well.
    And with my work on the Committee on Homeland Security, I 
am--and my chairmanship on the Subcommittee on Cybersecurity, 
Infrastructure, Protection, and Innovation, very, very, very 
concerned about supply chain anywhere in public transit. We 
have made a lot of noise in this committee about what New York 
City was doing with their subway systems, and we made noise 
with Metro here, as well. And so I am concerned that, you know, 
what you are doing to ensure that the supply chain is good, and 
is sound, and you are not getting it from bad actors?
    And also, what you are doing to ensure that the ever-
spreading and ever-metastasizing cybersecurity problem doesn't 
infect the airlines themselves.
    Mr. Hamilton. Certainly. You know, we do have a global 
supply chain, and we carefully do audits of our suppliers to 
determine, first of all, should we get something from that 
supplier or not, and then we have robust followup processes, 
both looking at their quality controls, their producibility, 
and oversight of our supply chain. And this is one of the 
things that the FAA has asked us to strengthen. And we are 
doing that. We have taken some actions on that, as well.
    And every day we get reports in on how the suppliers are 
doing, and whether or not we need to invest and put more 
actions to improve their operations.
    Do you want to talk cybersecurity, overall?
    Mr. Muilenburg. Yes.
    Mr. Hamilton. Yes.
    Mr. Muilenburg. In addition to that, as John well pointed 
out, we have got about 12,000 companies in our supply chain 
here in the U.S., mostly mid- and small-sized businesses. So, 
in many cases, we assist them with their cybersecurity 
infrastructure, as well. That is a very important 
infrastructure to us across our Boeing enterprise. And my CIO, 
who reports directly to me, is responsible for that.
    We also have a continuous effort on the cybersecurity of 
not only our systems, but our products. So cyber-hardening our 
airplanes for the future, ensuring that nobody can gain access 
to those airplanes, is a very important safety design principle 
for us. And our engineering team spends time on that every day.
    Mr. Katko. Thank you very much. I am out of time.
    I yield back, Mr. Chairman.
    Mr. DeFazio. I thank the gentleman. With that I recognize 
Representative Cohen.
    Mr. Cohen. Thank you, Mr. Chair.
    Mr. Hamilton, on the 30th of March in 2016, Boeing asked 
the FAA if it was OK to remove all references to MCAS from the 
flight crew operations manual and training material. That 
request was based, in part, on Boeing's representation that 
MCAS ``only operates way outside of the normal operating 
envelope.'' Is that not true?
    Mr. Hamilton. I believe that is true, that we--I can't 
verify the date, but I believe----
    Mr. Cohen. Right.
    Mr. Hamilton [continuing]. What you are saying is true.
    Mr. Cohen. So let me suggest this to you, or ask you. On 
March the 30th, the same day, Boeing's chief technical pilot at 
the time, Mark Forkner, emailed the FAA with the following 
request, ``Are you OK with us removing all reference to MCAS 
from the operating manual and the training as we discussed, as 
it's completely transparent to the flight crew and only 
operates way outside of the normal operating envelope?'' The 
``normal operating envelope'' being the term the flight 
conditions a commercial airline passenger might reasonably 
experience. Is that correct?
    Mr. Hamilton. As Mr. Muilenburg has discussed, it is an 
iterative process that we go back and forth with the FAA on 
what needs to be in the training manual and what doesn't. And 
collectively, the FAA and Boeing reached an agreement that the 
description of the MCAS did not need to be in the training 
manual.
    Mr. Cohen. And Mr. Forkner requested that. Is that correct?
    Mr. Hamilton. Yes, and Mr. Forkner's role, as chief 
technical pilot, would be the prime interface with the FAA on 
that.
    Mr. Cohen. So he said it was way outside the normal 
operating envelope, talking about conditions or airplane 
maneuvers that are beyond what a commercial airline passenger 
would normally experience. Right?
    That is right, isn't it, Mr. Hamilton, that Mr. Forkner 
said that it was outside the normal procedures, you normally 
wouldn't have that occur on a commercial airline.
    Mr. Muilenburg. Referring to the MCAS envelope being 
outside?
    Mr. Hamilton. Yes, MCAS should have been transparent to the 
pilots and assist them only as they approached what we refer to 
as high alpha, or high attitude-type conditions.
    Mr. Cohen. All right. MCAS didn't activate outside the 
normal operating envelope on Lion Air. In fact, MCAS activated 
within the normal operating envelope on that flight. Is that 
not correct?
    Mr. Hamilton. Yes, MCAS reacted to a faulty sensor input, 
and operated as it was designed, yes.
    Mr. Cohen. So Captain Forkner repeated this representation 
to the FAA as late as January of 2017 after Boeing had changed 
MCAS to operate at lower speeds, and just a few short months 
before the FAA finally certified the plane.
    In a recently released email exchange in which he was 
discussing changes that were needed for MAX pilot training, he 
reminded the FAA, ``Delete MCAS, recall we decided we weren't 
going to cover it in the flight crew operating manual or the 
CBT, since it's way outside the normal operating envelope.'' 
Let's get it out of the flight crew operations manual and 
outside the computer-based training.
    In hindsight, would you not agree that Captain Forkner 
either, one, did not understand; two, downplayed; or, at worst, 
three, concealed the fact that, under a scenario that--known to 
Boeing, the failure of a single angle-of-attack sensor, MCAS 
could activate within the normal operating envelope?
    Mr. Hamilton. Again, I was not part of those conversations. 
You know, I think that was part of the--was leading up to the 
fleet standardization board meeting, and understanding what 
needed to be presented in that meeting.
    Mr. Cohen. You might not have been part of it, but you are 
an expert. You are an engineer. You are a vice president of 
Boeing.
    Mr. Hamilton. That is correct.
    Mr. Cohen. Would you not agree, in hindsight, that Forkner 
either did not understand; downplayed it; or concealed a fact 
that, under a scenario known to Boeing, failed to tell--to talk 
to--MCAS to--acted about what would go on?
    Mr. Muilenburg. Congressman----
    Mr. Cohen. Mr. Hamilton, would you answer my question?
    Mr. Hamilton. Absolutely. Congressman, you know, I don't 
know what was going through Captain Forkner's mind, what he 
knew, what he didn't know, I don't want to speculate on that.
    Mr. Cohen. Mr. Muilenburg, do you want to respond?
    Mr. Muilenburg. Congressman, the only point I was adding is 
that the MCAS is originally designed--the idea is for it to 
operate outside the normal envelope. And then the extension to 
the low-speed envelope, which I think you are referring to, 
again, that was something that was tested and certified with 
the FAA from roughly mid-2016 to early 2017.
    Mr. Cohen. Let me ask you this, Mr. Muilenburg. You said 
you are accountable. What does accountability mean? Are you 
taking a cut in pay? Are you working for free from now on until 
you can cure this problem?
    These people's relatives are not coming back. They are 
gone.
    Mr. Muilenburg. Yes.
    Mr. Cohen. Your salary is still on. Is anybody at Boeing 
taking a cut, or working for free to try to rectify this 
problem, like the Japanese would do?
    Mr. Muilenburg. Congressman, it is not about the money for 
me. That is not why I came to Boeing----
    Mr. Cohen. Are you giving up any money?
    Mr. Muilenburg. Congressman, my board will conduct a 
comprehensive review. That----
    Mr. Cohen. So you are saying you are not giving up any 
compensation at all. You are continuing to work and make $30 
million a year after this horrific two accidents that caused 
all of these people's relatives to go, to disappear, to die? 
You are not taking a cut in pay at all?
    Mr. Muilenburg. Congressman, again, our board will make 
those determinations----
    Mr. Cohen. You are not accountable, then. You are saying 
the board is accountable.
    Mr. Muilenburg. Congressman, I am accountable, sir.
    Mr. DeFazio. The gentleman's time has expired. With that we 
would turn to Representative Graves.
    Mr. Graves of Louisiana. Mr. Muilenburg, did you fly on a 
737 MAX prior to these disasters?
    Mr. Muilenburg. Congressman, I don't recall flying on a MAX 
prior to, no.
    Mr. Graves of Louisiana. Mr. Hamilton?
    Mr. Hamilton. Yes.
    Mr. Graves of Louisiana. Do you have any idea how many 
times?
    Mr. Hamilton. I don't recall the exact number, no.
    Mr. Graves of Louisiana. Once? Ten times? Any ballpark?
    Mr. Hamilton. Yes, it was probably--I could count on one 
hand.
    Mr. Graves of Louisiana. I flew on one. I don't know how 
many times, but I know at least once before.
    My point is that I am--there are all sorts of things that 
have come out, including the text messages and other things 
that some folks have said, ``This is a smoking gun.'' I am 
going to assume that you all wouldn't have ridden on an 
airplane if you believed that something was wrong. Is that a 
safe assumption?
    Mr. Hamilton. Yes.
    Mr. Graves of Louisiana. All right. So here is where I want 
to transition, all right?
    So I talked earlier about all the reports that I did from 
memory. I think the only one I left out was the Department of 
Transportation's inspector general report. We have got outcomes 
of a number of reports, including NTSB, Indonesian accident 
report. We have got the Boeing board and others that have come 
out.
    How do we know that this new process is actually going to 
have the integrity to where you don't just feel it is right, 
FAA doesn't just feel it is right, that it actually is right? 
Does that question make sense?
    Mr. Muilenburg. When you say ``new process,'' Congressman--
--
    Mr. Graves of Louisiana. So my point is that, before, you 
flew. I flew.
    Mr. Muilenburg. Yes.
    Mr. Graves of Louisiana. We all believed that it was right. 
Now we are potentially going to unground this craft at some 
point. How do we know that this new process is actually going 
to work and yield the right outcome?
    Mr. Hamilton. You know, I would say that, number one, the 
software changes we are making are going to prevent our pilots 
from ever being in this condition again.
    But also, the FAA is doing a very robust, thorough review 
of all our documentation, of all our testing, and that is 
partially why it is taking this long.
    But I feel that, very confidently, that when we get through 
this, the FAA will clearly say that this airplane is safe.
    Mr. Graves of Louisiana. As I mentioned, you have got 
outcomes, at least preliminary outcomes, from NTSB, Indonesia, 
from the Boeing board and others. Based on what you have seen 
so far, are there any of these expert recommendations that you 
disagree with?
    Mr. Hamilton. You know, I think the NTSB recommendations, 
the JATR recommendations, they are all--and even the 
Indonesians' recommendations, I think, you know, we are still 
reviewing all of them.
    But I would say, after my initial look at them, I think 
there are some very good recommendations, and we are looking 
forward to working with the FAA and the industry to address 
those, yes.
    Mr. Graves of Louisiana. Are you implementing those 
recommendations now on your efforts on the 777X as it goes 
through certification?
    Mr. Hamilton. I would say absolutely, based on the lessons 
learned coming out of the MAX, we are absolutely applying those 
to the 777-9.
    Some of the recommendations, though, we need to work with 
the FAA on how they want to respond to some of those.
    Mr. Graves of Louisiana. I would appreciate if you could 
come back to the committee after looking through some of the 
recommendations of NTSB and others and advise us of any 
recommendations that you do not concur with.
    Secondly, if you could provide the committee and follow up 
with--just helping us to better understand what changes Boeing 
is making. And, look, I understand you are part of the system. 
The airlines play an important role, the FAA plays an important 
role, and others. But what changes you are making to where--you 
felt it was right, OK, before--and making sure that there are 
changes.
    Lastly, I was going through five recommendations from some 
of the families, and I want to ask that you follow back up with 
us: publicly disclose the MCAS fix; clearly define the utility 
of MCAS; address the concern of the culture within Boeing that 
might have been prioritizing the wrong things; ensuring that 
there were not efforts to conceal the MCAS and its role, which 
I think goes back to defining; and also ensuring that the 
entire plane is viewed as an integrated system, as opposed to 
components, individually, that may not recognize their role in 
the larger system.
    Mr. Muilenburg. Congressman, we will follow up on all 
those.
    Mr. Graves of Louisiana. Thank you very much. I yield back.
    Mr. DeFazio. I thank the gentleman. We are going to 
recognize--what? Yes, one more Member, and then the panel has 
requested a break, which I think is quite reasonable, of 15 
minutes.
    So I will recognize Representative Sires, and then we will 
have a 15-minute break, and then we will return.
    Mr. Sires. Chairman, thank you for holding this hearing. It 
is very important.
    Mr. Muilenburg, in the spring and summer of 2018, did the 
former general manager of the 737 program ever raise safety 
concerns with you about production pressure on Boeing's 
employees who were involved in the final assembly of the 737 
MAX at Boeing's Renton, Washington, facility? Yes or no?
    Mr. Muilenburg. Congressman, yes, I am aware of some 
concerns that were raised----
    Mr. Sires. So yes?
    Mr. Muilenburg [continuing]. In that time period.
    Mr. Sires. OK. I would like to read from an email that was 
sent to the general manager of the 737 program in June 2018, 4 
months before the Lion crash, and 2 months before the plane was 
delivered to Lion Air.
    The email comes from a senior manager on the final assembly 
team for the 737 MAX, and it reads like this: ``I have some 
safety concerns that I need to share with you, as the leader of 
the 737 program,'' he wrote. . . . ``Today we have 38 
unfinished airplanes located outside the factory. The following 
concerns are based on my own observations and 30 years''--30 
years--``of aviation safety experience. . . .
    ``My first concern,'' he states, ``is that our workforce is 
exhausted. Employees are fatigued from having to work at a very 
high pace for an extended period of time. . . . Fatigued 
employees make mistakes. . . .
    ``My second concern is schedule pressure is creating a 
culture where employees are either deliberately or 
unconsciously circumventing established processes. These 
process breakdowns come in a variety of forms adversely 
impacting quality. . . .
    ``Frankly, right now all my internal warning bells are 
going off. And for the first time in my life, I'm sorry to say 
that I'm hesitant about putting my family on a Boeing 
airplane.''
    The employee was so concerned that he recommended shutting 
down the production. And he states, ``I don't make this 
recommendation lightly,'' he wrote. ``I know this would take a 
lot of planning, but the alternative of rushing the build is 
far riskier.
    ``Nothing we do is so important that it is worth hurting 
someone.''
    Mr. Muilenburg, I know this employee also wrote to you, 
personally, in December 2018, after the Lion Air crash, as he 
spoke with Boeing's assistant general counsel several times 
after that.
    My question is what have you done to ensure the safety 
issues Boeing employees raised are properly addressed?
    I mean you went through before a whole litany of what you 
do with employees. It seems that this one must have escaped 
somewhere.
    Mr. Muilenburg. Yes, Congressman, I am familiar with that 
last communication that you referenced, where the employee 
sent--or I believe he was a previous employee, a retired 
employee----
    Mr. Sires. He is retired, yes.
    Mr. Muilenburg. I will double check that.
    Mr. Sires. He went on to retire after 30 years.
    Mr. Muilenburg. He--I recall his email. And we did have 
several followup sessions with him. I told him I appreciated 
the fact that he brought up those issues and concerns.
    We do know that our team, who, at that point, was running a 
production line that was operating at 52 737s a month--it was a 
high-rate line at that point, as we had been ramping up 
production from 42 to 47----
    Mr. Sires. So what did you do about it?
    Mr. Muilenburg. We took a number of actions on taking a 
look at each of the work locations within the factory, each of 
the production stops. We implemented some additional quality 
checkpoints in the process.
    We also just took a look at his concerns, because he was 
not actually in the factory at that point, but he raised some 
good concerns, so we went back and took a look at his concerns. 
And in some cases we identified areas where we thought his 
issues had already been addressed, and we provided that 
information back to him.
    But this is part of our continuous process in our 
factories. It is very, very important that we set up a culture 
where, again, safety is first in the factories. And that comes 
with quality, as you well pointed out. And safe work is also 
work that is done in position. And that is one of the big focus 
areas for us.
    What happens in high-rate factories like ours, if--in the 
production factory, if they have work that gets behind, and it 
gets out of position, that is when injuries can happen. So our 
objective is to make sure work can happen in position. That is 
a safer work environment. And that is an area where we have 
been very, very focused in our safety efforts, and we will 
continue to be.
    So we take those inputs seriously. We evaluated them, we 
responded, and we are continuing to take action.
    Mr. Sires. My time is up, and I thank you.
    Mr. DeFazio. Just one quick followup. Did you reduce the 
rate of production at that point in time, given his concerns, 
from 52?
    Mr. Muilenburg. Congressman, we are currently running the 
737----
    Mr. DeFazio. No, at that time. I mean at that time. Did you 
reduce it----
    Mr. Muilenburg. Sir----
    Mr. DeFazio [continuing]. Given the concerns he expressed?
    Mr. Muilenburg. Sir, we did not change the production rate.
    Mr. DeFazio. OK, all right, thank you.
    Mr. Muilenburg. Again, I think it is very important that, 
when you change a production rate in a line like ours, any 
change up or down----
    Mr. DeFazio. Sure, I understand there is a whole supply 
chain. That is good.
    Mr. Muilenburg. Stability is preferred.
    Mr. DeFazio. If you want your 15 minutes we are going to 
have to break now. So we will recess the committee for 15 
minutes.
    [Recess.]
    Mr. DeFazio. OK, the committee will come back to order. 
Which side are we on? We are on this side, right?
    So Representative Babin?
    Dr. Babin. Yes, sir, Mr. Chairman. Thank you very much.
    I would like to join the others in acknowledging those in 
attendance here today who lost loved ones in the accidents, and 
offer my very sincerest condolences to you, and thank you for 
being here today.
    In the interest of time, I would like to get right to it. 
Instead of directing my questions to one of you, specifically, 
I would like to address these to both of you, and let you 
decide who is best fit to answer.
    I think there is a feeling out there that, after the Lion 
Air crash in Indonesia, Boeing sat back and did nothing in 
terms of addressing the causes of the accident. And since the 
second crash in Ethiopia, we have heard a lot from Boeing and 
the rest of the industry about how the information gleaned from 
these tragic accidents helped to ensure that they are not 
repeated.
    With that in mind, what did Boeing do after the Lion Air 
crash to ensure that those circumstances were not repeated? And 
do you have any specific examples of lessons learned that you 
can share with all of us that have positively impacted the 
entire commercial aviation arena beyond just Boeing or the MAX, 
specifically?
    If you can, give that to me, one of you, as quickly as 
possible.
    Mr. Muilenburg. Yes, Congressman, I am going to ask Mr. 
Hamilton to answer that.
    Dr. Babin. OK.
    Mr. Muilenburg. But if I could, just very quickly, I also 
need to correct a statement I made on a question from 
Congressman Sires, where he referenced a concern that had been 
brought up by a retired employee. I responded to a question 
about whether the vice president, GM, of the program, had 
talked to me. And I said yes to that. That was incorrect.
    My initial reception of that input was direct from the 
employee, and I just wanted to clarify that to make sure it was 
right. We did follow up, and I referenced several actions that 
were ongoing in our factory concurrently. And the letter from 
the employee addressed several of those topic areas, but I just 
wanted to clarify that was separate from the actions that we 
were taking. And----
    Dr. Babin. OK, thank you. Just very, very quickly, Mr. 
Hamilton, because I have got some other things I want to say.
    Mr. Hamilton. Certainly. In the--so I--in my previous role 
I led our accident investigation teams to some of the accident 
sites, including some of the ones that the chairman announced 
earlier, and I have led the corrective actions.
    In the hours following the Lion Air accident, we convened a 
group of experts from around the company and started 
postulating on what possibly could have happened, given the 
limited data that was available. We quickly identified that 
this MCAS activation could have been a scenario. We started 
running that through our labs, running scenario planning. And 
once the flight data recorder came up later in the week, and it 
verified what we had, we went--started working on a software 
change immediately to start working that.
    Dr. Babin. OK.
    Mr. Hamilton. And separately, convened a safety board and 
determined that that was not enough, just a software change, to 
mitigate the risk. And we determined that, while the crew--the 
captain of Lion Air was trimming out the airplane as it was 
getting MCAS when he handed over the control, it didn't quite 
follow the assumptions that we had based the design on. So we 
knew we needed to put an operation manual bulletin out to 
remind crews----
    Dr. Babin. OK, let me interrupt you because I have got some 
other----
    Mr. Hamilton. OK.
    Dr. Babin [continuing]. Other things I want to have, but I 
think I will just submit those for the record.
    But I do want to use my remaining time to be perfectly 
clear about something. As unfortunate as these tragedies are, 
systems sometimes fail. And we will continue to learn from them 
until they don't fail. In the meantime, we need highly trained 
humans in the loop to make judgment calls when things go awry. 
That means ensuring that the operators of these complex systems 
know how to triage problems in order to put a plane safely on 
the ground in the case of an emergency.
    The day before the Lion Air crash, when the identical 
problem occurred, an off-duty pilot riding in the cockpit 
correctly identified the problem and guided the crew to disable 
the MCAS and save the airplane. Let me be clear: This plane 
absolutely should not have been in the air on October the 29th 
in 2018, another human error.
    But this is an indicator that a well-trained crew 
potentially could have averted this disaster, and all that to 
say that there are plenty of things that Boeing should have 
done better. Also, human errors.
    And I am sorry to say that even on this committee there are 
those who claim that Boeing's decisions are made only with the 
almighty dollar in mind. Are we under the illusion that Boeing 
makes money when tragedies like these occur? Hard to imagine 
that Boeing would intentionally suppress information that would 
make the public safer and their product ultimately better.
    We should be using these opportunities to seek out 
solutions, not trying to hang blame on a company that has as 
much desire to keep their passengers safe as we do. Let's not 
forget that more than 5 million people fly safely on Boeing 
planes every single day.
    We must be very careful not to erode American leadership 
when it comes to safety in aviation. America is unquestionably 
the gold standard when it comes to commercial aviation, and 
Boeing has played a major role in getting us to that point.
    And, just for the record, I serve no parochial interest in 
Boeing's commercial aviation program in my District 36 in the 
State of Texas.
    So I would yield back, and I will submit my questions--
further questions, then. Thank you, Mr. Chairman.
    Mr. DeFazio. I thank the gentleman.
    Mr. Muilenburg, since you just made a clarification about 
your response to Representative Sires, I just want to get this 
straight. You heard directly from this individual, the 
individual who, 4 months before Lion Air, said that he was 
hesitant about putting his family on a Boeing airplane after he 
complained about schedule pressure, exhaustive workforce, et 
cetera? He corresponded with you directly?
    Mr. Muilenburg. Congressman, as I recall, the--it was via a 
letter that I received. I am not sure if it was electronic or 
physical, but it was via a letter from him. I did talk to him--
--
    Mr. DeFazio. Right. And in response to my followup you said 
you didn't reduce production at that point in time, despite 
having an exhausted workforce, despite all the other concerns 
he raised. You didn't reduce production because you were 
concerned about your supply chain.
    Now, this--just reflect on this for a second. You talked 
about your upbringing, modest upbringing. But now, you know, 
you are a very highly paid CEO of a vaunted American 
institution, the Boeing Company. And as Mr. Cohen pointed out, 
and I pointed out at the beginning, after Lion Air you get a 
$15 million bonus. And you say people are being held 
accountable.
    This gentleman quit the company after 30 years in the 
industry because his concerns weren't being addressed. But you 
are leading us to believe that they were significantly 
addressed. I am sorry, I just don't buy that.
    And with that I recognize Mr. Mitchell.
    Mr. Garamendi? John, sorry.
    Mr. Garamendi. No need. You were carrying on a line of 
questions that I want to pursue.
    Mr. Muilenburg, you are the chief executive officer. Do you 
set the pace for the company? Do you set the standards? Do you 
set the purpose and goal for the company?
    Mr. Muilenburg. Congressman, that is part of my 
responsibility.
    Mr. Garamendi. So the answer is yes, you do those things?
    Mr. Muilenburg. Yes, sir.
    Mr. Garamendi. Good. And as the chairman just said, did you 
receive a $30 million remuneration from the company in 2018? 
Stock, wages, et cetera?
    Mr. Muilenburg. Congressman, I recall my salary was roughly 
$23 million that year.
    Mr. Garamendi. Then I suppose this is incorrect. It came 
from Seattle Times. It says $30 million.
    You have at least three employees that have left the 
company--Adam Dickson, Rick Ludtke, and also a whistleblower in 
Charlotte--all of which said the company's goal is profit over 
quality. Are they correct?
    Mr. Muilenburg. Those comments are not accurate.
    Mr. Garamendi. Then what is the company's standard for 
quality over profit?
    Mr. Muilenburg. Our core values as a company, top of that 
list: safety, quality, and integrity.
    Mr. Garamendi. I see. So in 2016, when Boeing started 
asking for time and cost reductions as part of a manager's 
performance evaluation, the gentleman that said that, Mr. 
Dickson, is he incorrect? That is not what happened in 2016?
    Mr. Muilenburg. Congressman, I am not familiar with the 
specific communication, but it is true that we incentivize our 
team to perform from a cost and schedule standpoint, as well.
    Mr. Garamendi. Is that contrary to quality and safety?
    Mr. Muilenburg. Congressman, no, it is not.
    Mr. Garamendi. So which is most important?
    Mr. Muilenburg. Most important, clearly, safety comes 
first.
    Mr. Garamendi. And we have the----
    Mr. Muilenburg. And quality.
    Mr. Garamendi [continuing]. 737 MAX to prove that that is 
incorrect.
    Mr. Muilenburg. Congressman, I disagree with that premise, 
respectfully.
    It is very true that we operate in a competitive 
environment around the world. We are the last remaining big, 
commercial airplane builder in the U.S. It is a competitive 
environment.
    Mr. Garamendi. And you are the most recent to have lost 2 
airplanes and 346 people dying as a result of a problem with 
your quality and your airplane. Is that correct?
    Mr. Muilenburg. Congressman----
    Mr. Garamendi. It is correct.
    Mr. Muilenburg. As I said, safety and quality are our top 
priorities.
    Mr. Garamendi. I see.
    Mr. Muilenburg. And safety and quality go hand in hand with 
operational----
    Mr. Garamendi. Would you like to talk to me about the 
quality of the KC-46? Would you like to go into detail about 
the abject lack of quality in an airplane that the U.S. 
Government is purchasing, or wants to purchase from you, the 
KC-46? You want to talk about the boom? You want to talk about 
the inability to keep cargo in place? Shall we talk about the 
quality there?
    Or would you like to talk about the quality of the 
Dreamliner?
    Mr. Muilenburg. Congressman, I agree that we have----
    Mr. Garamendi. You got a problem.
    Mr. Muilenburg. We have had some improvements to make on 
quality.
    Mr. Garamendi. You have a systemic problem in your company. 
You are reaching for profit, which, incidentally, was very, 
very significant in 2018. Was it not? Fifteen billion dollars 
of cash, plus a significant increase in the profit.
    You are driving profit, you are not driving quality, and 
you sure as heck are not driving safety.
    Mr. Muilenburg. Congressman----
    Mr. Garamendi. I just gave you three examples.
    Mr. Muilenburg. Congressman, I disagree with your premise. 
Our business model is safe airplanes. That is the only 
sustainable business model for Boeing. We work in a long-cycle 
business. It takes 5 to 10 years to bring a new product to the 
market. When those products come to market, they are typically 
used by our customers for decades, both military and commercial 
customers. The only sustainable business model for our company 
is safety. That is what we are built on. That is why we have 
lasted 103 years.
    Mr. Garamendi. Yes, well----
    Mr. Muilenburg. That is why we are the only U.S. builder of 
big, commercial airplanes remaining today.
    Mr. Garamendi. Three of your principal product lines--the 
MAX, 737 MAX; the KC-46; and the Dreamliner--all have quality 
issues. They certainly all--certainly the case of the MAX, they 
have a serious safety issue. And I would posit the reality that 
you are pushing profits over quality and safety.
    And those three examples of three of your main product 
lines--and I see I am out of time, so I have to yield back.
    Mr. DeFazio. I thank the gentleman. And now I would turn to 
Mr. Mitchell.
    Mr. Mitchell. Thank you, Mr. Chair. We are talking about 
346 lives here. And we refer to it as an accident. It is not an 
accident. It reflects a failure. It reflects multiple failures. 
And I think we need to stop talking about accidents. It is a 
tragedy. Accidents are mistakes on the road that people make, a 
bad choice, and it is a fender-bender. This is far from that.
    Safety begins at design. That is where it starts. I met 
individually with the FAA, the safety people there. I have met 
with some of your folks, as you are well aware. And here is one 
of the things that troubles me. The word ``assume'' was used 
way too often for my comfort level.
    I was CEO of a business much smaller than yours. We didn't 
build aircraft. Making assumptions, we know the old saying 
about assume--I won't use it here, but we know what it means.
    You talk about changing your culture. I challenge the FAA 
to change how they approach thinand when they are dealing with 
assumptions, they have a separate team, what I will refer to as 
a red team, or something, to test the assumptions. The worst 
thing in the world are assumptions.
    You have talked about restructuring your team and what you 
are doing with safety. Who is going to test assumptions in your 
organization, given the assumptions killed people?
    Mr. Muilenburg. Congressman, that is a responsibility that 
I count on for--what we call our engineering function. So, as 
we have recently announced, we have realigned all of our 
engineers to report directly to chief engineer, as opposed to 
the programs----
    Mr. Mitchell. Let me stop you, because time is limited. I 
appreciate it.
    But you are--unless you have a separate group doing that 
independently, outside of the other decisionmaking--you--
literally, there is pollution there. There is impact on that. 
They have got to do it totally independently. How are you doing 
that? Or are you doing that?
    Mr. Muilenburg. Congressman, in addition to the realignment 
internally, typically, in all of our design programs we bring 
in external experts. We often bring in senior advisory groups. 
We will bring in what we call nonadvocate groups. Sometimes we 
will tap a team from another part of Boeing to do what we call 
a nonadvocate review of other parts of Boeing to get cross 
checks. So we use resources from a number of different areas.
    Mr. Mitchell. I would ask, if you would, that, for the sake 
of the committee here, that you explain how it is you are going 
to go forward with testing your assumptions under--given--in 
light of where we are at now, not how it has been in the past--
what are we going to do about it? Because we have to look 
forward. We have to look forward, based upon the experience you 
have had.
    And I would challenge that assumptions in the FAA, they 
assumed MCAS--said MCAS was going to operate in the background. 
Well, it certainly didn't when things went awry. And in this 
circumstance we had, it wasn't in the background. It was pretty 
much in the foreground.
    A question for you, an additional question real quickly, if 
I can.
    The March 4, 2014, slide that was shown earlier about the 
commonality between the NG and the MAX, it said 2 days or less 
of training would be required. The problem with that is that 
MCAS wasn't referenced in the training manual. So it just 
didn't matter. Right? It wasn't in the training----
    Mr. Muilenburg. Congressman, again, the training was 
focused on trying to respond to the effects of a failed MCAS, 
which is what we call a runaway stabilizer----
    Mr. Mitchell. But that is what we got.
    Mr. Muilenburg [continuing]. Training, and that is what is 
included in the training, is how the pilot will respond to a 
runaway stabilizer.
    Mr. Mitchell. Well, that wasn't in the manual, nor was it--
based on talking with a variety of the pilots--was it covered 
prior to the Lion Air crash.
    So, in fact, they didn't know it was there. How do you 
train on something you don't know is there, that hasn't said 
upfront, ``Here is what is going to happen under these 
circumstances''? How do you train for that? You don't.
    Mr. Muilenburg. Congressman, as I mentioned, we--one of the 
things we have learned is we need to provide more MCAS 
documentation, which we are doing. The intent was that the 
training for MCAS was to train on the failure mode, runaway 
stabilizer, as opposed to training on--diagnosing the system 
itself.
    But we have learned that we need to provide more 
information on MCAS, and that is what we are doing, going 
forward.
    Mr. Mitchell. Let me in the last 50 seconds or so I have--I 
am not operating on the basis--or I am not--that profit is 
somehow evil. I was a CEO of a for-profit company. I don't 
believe that that incentivized Boeing to do things that are 
adverse. I think you had competitive pressures you were dealing 
with from Airbus, and it had impact.
    I don't care about your or any of your management team's 
bonuses. What you are compensated is up to your board. I will 
say, again, it was a much smaller company I was CEO of, but if 
I was CEO of a company that I led into--I was responsible for 
that was mine, and in this set of circumstances, and I owned 38 
percent of the company, I would be submitting my letter of 
resignation to the board of directors. Because I am responsible 
for it, ultimately.
    So one last question. This is a simple yes or no, Mr. 
Muilenburg. Have you submitted or offered your letter of 
resignation to your board of directors?
    Mr. Muilenburg. Congressman, I have not. I am responsible. 
These two accidents happened on my watch. I feel responsible to 
see this through.
    As I mentioned earlier, I grew up on a farm in Iowa. My dad 
taught me that you don't run away from challenges. And this is 
a challenging situation. My responsibility is to stick to it, 
and to help our team work through it, and to get Boeing ready 
for the future. I feel a keen sense of responsibility to do 
that. And I am confident that that is what we are going to do, 
as a company.
    Mr. Mitchell. Thank you.
    Mr. DeFazio. Mr. Johnson would be next.
    Mr. Johnson. Thank you, Mr. Chairman. I would like to 
extend my heartfelt condolences to the families affected by 
these two tragedies. Looking at the faces of the deceased, 
their lively, smiling faces, I am deeply saddened that they are 
no longer with you. But my sadness can in no way match the 
grief that you must feel. And thank you all for being here.
    Mr. Muilenburg, I trust you would agree that the crews of 
Lion Air flight 610 and Ethiopian Airlines flight 302 were 
faced with multiple alerts and indications during the accident 
sequences, correct?
    Mr. Muilenburg. Congressman, my understanding of the 
accidents is that is correct.
    Mr. Johnson. And you would agree that they received air 
speed disagree indicators, correct?
    Mr. Muilenburg. Congressman, I believe, from what we 
understand, they had air speed disagree, as well as other----
    Mr. Johnson. Altitude----
    Mr. Muilenburg [continuing]. Flight deck alerts occurring.
    Mr. Johnson. Altitude disagree indications, correct?
    Mr. Muilenburg. That, and also, I believe, stick shaker 
alerts, as well.
    Mr. Johnson. And you would agree that they received various 
other cautions and warnings during that period, correct?
    Mr. Muilenburg. Congressman, that is my understanding, yes.
    Mr. Johnson. The National Transportation Safety Board 
reported in October, in reference to these tragedies, that 
``multiple alerts and indications can increase pilots' 
workload.'' Do you agree with that statement?
    Mr. Muilenburg. Congressman, yes, that statement makes 
sense. Yes.
    Mr. Johnson. And the NTSB further observed that ``industry 
experts generally recognize that an aircraft system should be 
designed such that the consequences of any human error are 
limited.'' Do you agree with that statement, as well?
    Mr. Muilenburg. Congressman, I believe that is consistent 
with our design approaches, yes.
    Mr. Johnson. And the NTSB went on to note that ``the 
industry challenge is to develop airplanes and procedures that 
are less likely to result in operator error, and that are more 
tolerant of operator errors when they do occur.'' Do you agree 
with that statement?
    Mr. Muilenburg. Congressman, I think that is one area where 
we have learned from both of these accidents, is an area that 
we need to revisit some of our longstanding principles and 
design guidelines around that. I believe that is an important 
area for us to address, going forward.
    Mr. Johnson. So you would agree that, in terms of the 
design of the 737 MAX and the 730 MAX, MCAS and angle-of-attack 
sensing systems were not designed such that the consequences of 
human error were limited. You would agree with that, correct?
    Mr. Muilenburg. Congressman, on the MCAS, as we said, we 
have identified some areas where we need to improve. And it is 
related----
    Mr. Johnson. That is one of them, correct?
    Mr. Muilenburg [continuing]. To pilot workload.
    Mr. Johnson. That is one of them, correct, the sequence 
that was not designed to accommodate--well, let me put it like 
this.
    In other words, you would agree that the 737 MAX's MCAS and 
angle-of-attack sensing systems were not designed such that the 
consequences of any human error were limited. You would have to 
agree with that statement.
    Mr. Muilenburg. Congressman, again, from that standpoint, 
we designed the system to longstanding industry standards. But 
one of the----
    Mr. Johnson. But it was----
    Mr. Muilenburg [continuing]. Things we have learned from 
these accidents is we need to change----
    Mr. Johnson. This one was not designed so as to accommodate 
the possibility of human error, in terms of dealing with the 
MCAS system.
    But let me move on. The company has indicated in court 
filings that you intend to try to stop all litigation in the 
United States, and ensure that, as far as the Indonesian crash. 
Any litigation would be confined to Indonesia, and not in the 
court system of the United States. Correct?
    Mr. Muilenburg. Congressman, I can't comment on that. I am 
just not familiar with the details of that.
    Mr. Johnson. Well, so are you here to say that your company 
would not take efforts to protect itself from the U.S. court 
system, insofar as the victims of these air crashes are 
concerned? You trying----
    Mr. Muilenburg. Congressman, if I could take that question, 
we will get back to you. I don't know the answer.
    Mr. Johnson. Well, you are attempting to settle things out 
of court with a $100 million fund available for claimants. 
Correct?
    Mr. Muilenburg. Congressman, I believe the $100 million 
fund that you are referring to is one that we recently set up 
that is completely separate from any legal proceedings. And it 
is being administered by Mr. Feinberg. That is intended to be 
completely separate from any legal proceedings, with the idea 
that we can more quickly assist the families and communities. 
So I believe----
    Mr. Johnson. Participation in that system caused the 
aggrieved individual's family, next of kin, to then waive their 
ability to go to court later?
    Mr. Muilenburg. Congressman, the $100 million fund that you 
are referring to, if I am understanding what you are referring 
to----
    Mr. Johnson. Yes.
    Mr. Muilenburg [continuing]. Is completely separate from 
any legal proceeding.
    Mr. Johnson. Participating in the $100 million fund would 
not bar them litigation thereafter?
    Mr. Muilenburg. That is correct. They are completely 
separate.
    Mr. Johnson. Thank you.
    Mr. DeFazio. However, I will say, Mr. Muilenburg, I am 
incredulous that you don't know whether or not your company is 
attempting to avoid the U.S. courts for liability regarding 
Lion Air. Seriously? You don't know that, as a fact? You know 
nothing about that? You know nothing--that would seem to me it 
would be a pretty damn big thing. Like, U.S. courts--oh, let's 
go over to Indonesia.
    We go through this with the maritime industry, where 
mariners on these foreign-flagged ships aren't allowed access 
to U.S. courts. And you are telling me that this--you are not 
aware of your legal strategy regarding Indonesia? You really 
aren't?
    Mr. Muilenburg. Congressman, I am not familiar with that 
strategy. I do have a legal team with the responsibility----
    Mr. DeFazio. Well, I----
    Mr. Muilenburg. Congressman, my focus has been on safety.
    Mr. DeFazio. Yes. Well, we will get back to that.
    With that, Mr. Palmer.
    Mr. Palmer. Thank you, Mr. Chairman.
    Mr. Muilenburg--and, Mr. Hamilton, you may want to comment 
on this--but the Indonesian Government's final accident report 
identified nine contributing factors that resulted in the crash 
of Lion Air flight 610. One of those factors was the absence of 
guidance on the MCAS, or more detailed use of trim in the 
flight manuals and the flight crew training that made it 
difficult for the flight crews to properly respond to the 
uncommanded MCAS.
    And I bring this up in the context that it was reported 
that, after the initial certification--and I guess this was 
discovered, obviously, after the plane was certified--that the 
adjustment in the horizontal tail was greater by a factor of 4 
than what was certified. Can either of you address that?
    Mr. Hamilton. I think you are referring to the MCAS 
authority with low speed versus the high speed. So originally, 
we did wind tunnel testing back in 2011, and determined we were 
going to need to do something for the handling characteristics 
for high-speed windup turns. And that is where we developed the 
original MCAS.
    During flight testing in 2016 we identified that there was 
some additional work we had to do to satisfy for low speed. And 
that is where we used the MCAS, to address that.
    There is a difference in the authority, but that is 
partially because, when you are going low speed, you need to 
move the stabilizer a little bit more to get the pitching 
moment you need to address the handling quality.
    Mr. Palmer. Well, my----
    Mr. Hamilton. But that was all part----
    Mr. Palmer. My question here is, in the training--according 
to what the Indonesian Government found--was the training based 
on the original certification, or did it take into account both 
certifications?
    Mr. Hamilton. So----
    Mr. Palmer. Were the flight manuals and the crew training 
adequate to address both situations?
    Mr. Hamilton. Yes, sir. We were open and transparent with 
the FAA on the authority between the high speed and the low 
speed, all the way through the certification development. And 
they understood that prior to certification. And the decision 
on----
    Mr. Palmer. That is not the question. The question is did 
you provide adequate, detailed instructions for both situations 
for----
    Mr. Hamilton. When we were having conversations with the 
FAA about what should be in the training manual, we were 
accounting for both the high speed and low speed, yes.
    Mr. Palmer. But was it adequate?
    Mr. Hamilton. We believed it was sufficient, as Mr. 
Muilenburg has said, because we wanted to train pilots on how 
to react to the behavior of the airplane, regardless of what is 
causing it. And a runaway stabilizer is a memory item that we 
expected crews would be able to react to and take action.
    We have learned since these accidents that we need to take 
further action.
    Mr. Palmer. There is also some criticism that has been 
reported about the fact that Boeing tends to use the same 
design for planes, rather than build a new plane. And in the 
case of the 737 MAX, you were basically using an old design 
and--that required the MCAS system, because you used larger 
engines and moved them more forward on a plane. Is that also 
accurate?
    Mr. Hamilton. We evolved the 737 family through the years, 
but we have also updated the safety requirements that it is 
certified to through the years.
    And it is not uncommon, as you are developing a new type 
design airplane, that you find things in flight tests and have 
to make a software change, or some other control law change to 
address that.
    Mr. Palmer. Yes. But more specifically, you were in the 
process of a totally new design. And these were on parallel 
paths, weren't they, for this 737 MAX? You--I mean it--that is 
what has been reported, I believe.
    Mr. Muilenburg. John, you referenced the early trade 
studies?
    Mr. Hamilton. Yes, the early trade studies were--we were 
looking back in 2007 of reengining, and also looking at a 
brandnew airplane. And those were both being developed and 
looked at, and we made a decision back in 2011 to proceed 
forward with the----
    Mr. Palmer. OK. Was the decision based on what is the best, 
safest design, or based on what you could get to market?
    Mr. Hamilton. You know----
    Mr. Palmer. In a timely manner.
    Mr. Hamilton. Safety guided the decision. And, you know, 
pilots fly the family of airplanes. And, from a safety 
standpoint, it is important that crews are able to transition 
from one airplane to the next without having to think about 
``Am I in a MAX or an NG?'' They want them to feel and operate 
the same way. And that is----
    Mr. Palmer. Well, that is a matter of time.
    Mr. Hamilton [continuing]. The highest safety issue.
    Mr. Palmer. And training. That is a matter of time and 
training.
    I want to say this, that--hearing some of the questions 
that have been directed toward you today, I do not think that 
Boeing in any way intends to produce an unsafe product. I do 
think, though, having worked in engineering, mistakes are made. 
I think sometimes people make decisions that have very bad 
outcomes. And I think that might be an issue here.
    I have children who fly. I fly every week. And I think 
everybody in this room probably flies in a Boeing product. And 
when they put on that seatbelt, they want to know the plane is 
going to take off safely, fly safely, and land safely. And that 
ought to be the sole point of this hearing. Retribution and any 
other thing that comes after that, I think, will be handled in 
the courts of law. But from the perspective of transportation 
safety, we want safe planes.
    I yield back.
    Mr. DeFazio. I thank the gentleman.
    Mr. Muilenburg, this took me 30 seconds with a Google 
search. June 10th, Business Insider: ``The company is arguing 
for the cases to be moved from the U.S. to Indonesia.'' And you 
would have us believe that you are not aware that your legal 
team--they are so far distant from you, you don't talk to them, 
this hasn't been discussed on the board?
    You know, my wife was the risk manager for the city of 
Eugene, Oregon, for a long time. She had to pay the claims. 
When a big claim came, just a couple of million bucks, against 
the city, she was involved, the city manager was involved, the 
legal team was involved, everybody was involved.
    You are looking at hundreds of millions, billions of 
dollars of claims you are trying to move to a country, and this 
expert says having a trial in another country with a different 
legal--less scope for close scrutiny of Boeing would render the 
cases worthless. And you don't know that that is happening, 
that you are making that pleading?
    Mr. Muilenburg. Congressman, I am aware of those articles. 
But as I stated earlier----
    Mr. DeFazio. OK.
    Mr. Muilenburg. I am not----
    Mr. DeFazio. Would you then please----
    Mr. Muilenburg. I am not----
    Mr. DeFazio [continuing]. Tell us--would you please respond 
to the committee after you consult with your lawyers? Have they 
filed to move these cases to Indonesia in any court in the 
United States, or do they intend to?
    Mr. Muilenburg. Mr. Chairman, we will follow up with that 
information.
    Mr. DeFazio. Thank you.
    Ms. Titus?
    Ms. Titus. Thank you, Mr. Chairman. Well, like my 
colleagues, I have been concerned about some of the text 
messages and emails that have come out in the documents for 
this case, especially some of those by your chief technical 
pilot. I believe his name is Mark Forkner. So let me ask you 
about those.
    As I understand it, Boeing has nearly 5,000 737 MAX orders 
pending. Is that correct?
    Mr. Muilenburg. Congresswoman, I believe we have 4,400 
aircraft in backlog.
    Ms. Titus. And many of those are to airlines that operate 
outside the United States.
    Mr. Muilenburg. The majority of the backlog is outside of 
the United States, yes.
    Ms. Titus. Well, I want my constituents to feel safe, 
whether they are getting on one of your planes in Las Vegas or 
Las Palmas. So let me ask you about some of these emails that 
Captain Forkner sent.
    We know that he sent these at the same time that he was 
discussing some of the concerns about the MCAS system. He talks 
about flying around the world--and this is a quote--``Jedi 
mind-tricking'' foreign customers into purchasing your 
aircraft. I am not quite sure what Jedi mind-tricking is, but 
he uses it frequently.
    In one of the emails he says, ``It is 6:30 a.m. here. Just 
getting ready to hit breakfast, then try and Jedi mind-trick 
these people into buying some airplanes!''
    Here is another one: ``No, I have been working to certify 
the new 737-8 MAX with all the regulators all over the world, 
led by the AEG. It was a huge deal, but I got what I wanted, at 
least so far. You know me, I usually get what I want.''
    Then a little later he says, ``Things are calming down a 
bit for my airplane cert, at least for now. I am doing a bunch 
of traveling through the next few months, simulator 
validations, Jedi mind-tricking regulators into accepting the 
training that I got accepted by FAA.''
    So I would ask you what Jedi mind-tricking is, and, if--
given these comments, would it be fair to state that your 
company misled foreign regulators to get your aircraft 
certified?
    Mr. Muilenburg. Congresswoman, I am not quite sure what Mr. 
Forkner meant in those emails. We haven't been able to talk to 
him, given he has departed the company and has legal 
representation. But any thought that we would try to trick 
customers or deceive customers is just not consistent with our 
values. And that would not be tolerated.
    So I am not sure what he meant, but that is not our 
approach.
    Ms. Titus. Well, what is your approach when it comes to 
international customers? What do you think is your 
responsibility, especially those that have less stringent pilot 
training requirements, when you sell a new aircraft abroad?
    Mr. Muilenburg. Congresswoman, we work with regulatory 
authorities around the world. So typically, those decisions are 
made by the authority in that jurisdiction. And we, with the 
FAA and other regulators, support that.
    We also work with the airlines in those other countries. 
And together we work on training standards. Ultimately, those 
are decisions that are made by the regulatory authority in that 
jurisdiction.
    Ms. Titus. Well, since that captain is no longer with you, 
have you kind of changed or modified in any way your engagement 
with foreign regulators, or are you still just using the Jedi 
mind-tricking approach?
    Mr. Muilenburg. Congresswoman, I appreciate your question. 
I can tell you, again, I am not quite sure what Mr. Forkner 
meant, but that does not represent the people of Boeing. It 
does not represent the people who work with our international 
regulators.
    Ms. Titus. And you are not trying to Jedi mind-trick us 
here today on this committee?
    Mr. Muilenburg. Congresswoman, I am telling you the truth.
    Ms. Titus. Thank you. I yield back my time to the chairman.
    Mr. DeFazio. I thank the gentlelady. There is little time 
remaining. I am a ``Star Wars'' fan, so I know what Jedi mind-
tricking means. Perhaps you watched ``Star Wars,'' too.
    But here is one other observation I would like to make. We 
have brought up your $15 million bonus after the Lion Air 
tragedy, and Boeing has established a fund of $100 million. And 
I just did the math. That means that each of the 436 families 
would receive 1 percent of your compensation that you got last 
year. You know, that does not seem to be--you know, and--but 
you are telling us there have been consequences, you are 
responsible. And yet, these families will get 1 percent of what 
you got paid.
    And you talk a lot about your upbringing as a farm boy. I 
appreciate that. I grew up a little different. My dad was a 
teacher. He ran a camp for inner-city kids in the summer. I 
carried golf clubs for rich people. You are no longer an Iowa 
farm boy. You are the CEO of the largest aircraft manufacturer 
in the world. You are earning a heck of a lot of money. And so 
far the consequence to you has been, oh, you are not chairman 
of the board any more. I don't know what extra bonus the 
chairman gets. I know the members of the board get one-quarter-
million bucks a year.
    So I haven't seen, convincingly, that there have been 
consequences, except one guy got fired and the chief, the 
leader of the 737 program, retired in disgust because he 
wouldn't want to put his family on the airplane.
    With that, who am I recognizing? Mrs. Miller.
    Mrs. Miller. Thank you, Chairman DeFazio. And to all of 
you, my heart absolutely goes out to you. Having lost a family 
member in a horrible crash, while it was not an airplane, I do 
know the consequences to children that don't have a parent, and 
spouses that are missing their loved ones. And it is so hard. 
And my heart does go out to you.
    Also, I think it is very important that safety and quality 
should always be the highest priority for airline 
manufacturers. We need to be prepared if technology fails us. 
With the new technological advancements in all of our 
industries, it is a possibility that one day there might be a 
time when we have to decide whether to put our faith in our 
training and our intuition, or on a machine. Millions of people 
fly every day. And while there is new technology in the 
aviation industry, it is critical that pilots be prepared if a 
mechanical problem occurs.
    With that being said, as we move forward into the future, 
it is of the utmost importance that we continue to advance and 
perfect technology before introducing new equipment into the 
market. We can support innovating and new technology as an 
added benefit, but we also cannot overlook safety, efficiency, 
or quality in the aviation industry.
    Restoring confidence in air travel is not a political 
issue. It is a societal issue. Our world has become so much 
smaller, once we were able to fly. And it is imperative that 
the airline manufacturers perfect new technology and guarantee 
safe, flawless, and exceptional airplanes.
    Mr. Muilenburg, can you quickly walk us through the safety 
assessment evaluation Boeing conducted for the MCAS?
    Mr. Muilenburg. Congresswoman, I will attempt to do that. 
John will be more familiar with the details.
    Mrs. Miller. Well, do it together, if you need to.
    Mr. Muilenburg. We conducted our typical safety review 
boards and safety system analyses as part of that development. 
So safety is one of the core parameters that we look at 
throughout the design, test, and certification process. And 
that ultimately leads to the certification by the FAA. So that 
was a very disciplined process, consistent with our normal 
procedures.
    I don't know, John, if you want to add detail to that.
    Mr. Hamilton. Any time we bring forward a new system or 
something to that effect we do a failure effects analysis of, 
when something is going to fail, what is the effect of that.
    We separately then do a fault hazard assessment, where we 
then look at all the different faults, and we make an 
assessment based on what is the hazard category, per 
regulations.
    Then we build a fault tree, which is a top-down look at 
what is the probability of these events happening. And, again, 
this is all built to meet regulations.
    And then we put together a system safety assessment, which 
culminates all the information from these different actions, 
and that is the compliance deliverable that we submit to the 
FAA for----
    Mrs. Miller. Did Boeing evaluate pilot response to 
erroneous MCAS activation?
    Mr. Hamilton. Yes, we evaluated, if the MCAS operated 
uncommanded, what the pilot response would be.
    Mrs. Miller. Did it also show if it could trigger other 
alarms?
    Mr. Hamilton. We considered that in the analysis.
    Mrs. Miller. OK. In your testimony, Mr. Muilenburg, you 
mentioned your dedication to safety and culture, and the time 
you spent traveling to visit different Boeing teams. How can we 
restore confidence in our air travel, and guarantee industry 
transparency and communication from top to bottom?
    Mr. Muilenburg. Congresswoman, I believe those changes 
start with us: my company, myself, and our structure. I 
mentioned a number of changes we have made internally around 
safety structures: a new safety organization, a new board, 
safety committee, realigning our engineering workforce. Those 
are all actions we are taking to increase focus on safety, and 
increase transparency. And I believe that is part of rebuilding 
confidence.
    We are also paying close attention to all the independent 
reviews that are being done, the Government reviews, any other 
actions we might take together to improve the certification 
process. I think those are actions that will help, as well.
    And then, frankly, we still have a lot of work to do to 
rebuild the public's trust. And we are going to make sure that 
the changes we are making to the MAX today will prevent 
accidents like this from ever happening again. That is our 
focus. And it is going to take time to rebuild the public's 
confidence, once we get the airplane back up for the fleets. 
And we are going to be working side by side with our airline 
customers, and side by side with the flying public to help 
rebuild that confidence.
    Mrs. Miller. Thank you. I yield back my time.
    Mr. DeFazio. I thank the gentlelady.
    Mr. Lowenthal?
    Mr. Lowenthal. Thank you, Mr. Chair. And I, too, join with 
my colleagues in offering our sympathy and our concern. And, as 
Representative Graves said right at the beginning of this 
hearing, this is all about you, the people. I can't imagine 
what you are going through, but I am so glad you are here to 
keep us focused that it is all about the people who have been 
impacted.
    So my questions, or my concerns, Mr. Muilenburg, really 
have to do with the certification process. You know, the JATR, 
that report, the technical review, found that, despite 
significant advances being made since the MAX was originally 
certificated in 1967, these advances, which have led to 
significant improvements in the safety of air transportation, 
the MAX failed to incorporate many of these designs and 
technology advancements, as they were deemed impractical.
    What is the reason Boeing failed to include the latest 
safety features in the MAX, like those Boeing included in other 
aircrafts like the 787 Dreamliner?
    Mr. Hamilton. Congressman, I want to take an attempt at 
that.
    So, as we are developing a product--and again, I want to go 
back to--one of the biggest ways we can have safety is--the 
pilots to be able to transition from one airplane to the next 
and not have to have a big difference. Whether it is the crew 
alerting system, or how the systems operate----
    Mr. Lowenthal. So what you are--excuse me. So what you are 
saying is you did not include these improvements because it was 
difficult for the pilots to transition?
    Mr. Hamilton. It is not a question of if it is difficult. 
It is we want the crews to not have to think about which model 
they are in, so that they are--the training that they have gone 
through applies to either model, and they handle each airplane 
exactly--because the--when you walk on the airplane, you want 
the pilots to be comfortable flying that product.
    Mr. Lowenthal. So the question is, then, as you point out, 
this is an aircraft that was originally certificated--certified 
in 1967, has not had a full certification since, and the reason 
had to do with the ease in which pilots could move between 
different aircrafts of the same family.
    I want to go on. The JATR report found that there were no 
Federal criteria for determining ``when the core attributes of 
an existing design make it fundamentally incapable of 
supporting the safety advancements introduced by the latest 
amendments to airworthiness standards.''
    So for the FAA, they don't have a Federal criteria when you 
have to go to a full assessment versus this. What criteria does 
Boeing use to decide when it is time to upgrade the original 
design and have a recertification?
    Mr. Hamilton. So, Congressman, there is actually 
regulations in part 21 of the FARs that defines when you need 
to do a new type cert, versus an amended type cert. And we 
follow that process. We have conversations with the FAA about--
--
    Mr. Lowenthal. Well, the FAA has no specific standard. You 
are saying Boeing just follows that the FAA--what the FAA--
there is no specific criteria that you use, independent of the 
lack of standards that the FAA actually specifies?
    Mr. Hamilton. We follow the FAA regulations on new types 
of----
    Mr. Muilenburg. The standard you just mentioned.
    Mr. Hamilton. Yes.
    Mr. Lowenthal. OK. Last question. So I am very unclear on 
what that answer means.
    The JATR report also found that the requirements of an 
amended type certificate certification process, like the MAX 
went through, focuses only on change and areas affected by the 
change, which may fail to recognize the whole aircraft system 
which could be affected by seemingly small changes. Do you 
agree with the assessment by the JATR report?
    Mr. Muilenburg. Congressman, we are taking a look at all of 
the recommendations from that report. I believe there are 12 
recommendations that are being considered. And one of those 
areas is this systemwide analysis----
    Mr. Lowenthal. Right.
    Mr. Muilenburg [continuing]. Failure mode analysis. And we 
have identified that as a potential area for improvement, going 
forward. So that is an action that we look forward to 
supporting, and making appropriate changes. I think it is an 
area worth looking at.
    Mr. Lowenthal. So your--you have not--or you are looking at 
the report--decided how in the future aircraft designs that 
seek to fall under an amended type certificate, rather than a 
new type certification--you are discussing, and you will be 
looking at when an amended type or a full certification is 
going to be needed?
    Mr. Hamilton. We look forward to working with the FAA and 
the rest of the industry on any changes that may be required to 
part 21 on when you apply for one, versus the other.
    But you know, the amended type cert is still--you upgrade 
to the later amendments, later safety requirements, as you make 
changes to the airplane. So I just want to imply that, you 
know, the MAX--the requirements that the MAX is certified to, 
even though it is an amended type cert, it is meeting some 
later safety requirements than earlier versions of the 737.
    Mr. Lowenthal. And--thank you, and I yield back.
    Mr. DeFazio. Oh, well--Mr. Brown?
    Mr. Brown. Thank you, Mr. Chairman. First, let me offer 
my----
    Mr. DeFazio. I don't know.
    Mr. Brown [continuing]. My condolences to the families, 
friends, the communities of the 346 men, women, and children 
who lost their lives in this tragedy.
    Mr. Muilenburg, I believe that you are sincerely sorry, as 
well. I also know that you wake up every day with the 
responsibility and the accountability for a large organization. 
And while your values may be on safety, often in a large 
organization there are interests like profits, and production 
rates, promoting that product, and also personal incompetence 
among the 150,000 people. Not all of them are the most 
proficient and competent. And those factors can eat away at 
times at your ability to achieve that most important value of 
safety.
    Mr. Muilenburg, according to the Indonesia Air report, 
during discussions and communications with the FAA beginning in 
March 2016, Boeing proposed removing MCAS from the flight crew 
operator's manual and differences tables, and you have been 
asked about that. That has been brought to your attention.
    I too am a pilot. I flew in the Army. A much simpler 
airframe, never a commercial aircraft. And what I valued was 
information, the operator's manual, even technical manuals. My 
emergency checklist, which is a quick reference handout. It is 
all important information. Sometimes I would look and I would 
say, ``It is a lot of information,'' but I knew it was my 
professional responsibility to prioritize that information.
    And my concern here is that Boeing did not give the pilots 
the information that they needed. And what makes it 
particularly troubling is sort of like the environment in which 
this is happening. And a lot of this has already been raised 
and brought to your attention.
    An environment in which your chief technical pilot talks 
about Jedi mind tricks to convince regulators to accept a lower 
level of training, I don't know what a Jedi mind trick is, but 
I know what a trick is. And it is particularly troubling when 
Boeing has the expertise, you have the data, far superior to 
what the regulators have, and the chief guy on your team that 
is interfacing with the regulator is playing tricks to 
negotiate down training levels, coupled with the fact that--and 
as the chairman put on the screen, your promotional material as 
you build your 737 MAX fleet.
    Millions of dollars will be saved because of the 
commonality with the next generation 737, rebates and contracts 
with Southwest. If you don't have to use a simulator, which is 
much more expensive to train a pilot, if you have to use a 
simulator, a $1 million rebate on the airframe. So this is the 
environment that we are observing in Boeing, and it questions 
whether or not that profit and promotion is undermining safety.
    I want to ask you this question. Mr. Cohen was asking you 
about--from the same line--Indonesia Air report: ``Boeing also 
considered that the procedure required to respond to any MCAS 
function was no different than the existing procedures and that 
crews were not expected to encounter MCAS in normal 
operation.'' I don't want to ask you about the normal 
operation; Mr. Cohen did.
    Existing procedures, that is the runaway----
    Mr. Hamilton. Runaway stabilizer.
    Mr. Brown [continuing]. Stabilizer trim.
    Mr. Hamilton. Yes.
    Mr. Brown. But they are not the same procedure, are they?
    Mr. Hamilton. No, it is a common procedure between the NG 
and the MAX.
    Mr. Brown. When you have an MCAS failure, it is not really 
a failure. But when the MCAS is defective, it is not the same 
emergency procedure as a runaway stabilizer trim.
    Mr. Hamilton. Actually, when it--when the MCAS were to 
fail, or if a motor were to fail, there is various causes of 
runaway stabilizer----
    Mr. Brown. OK, let me ask you this. Stabilizer trim fails. 
I can use a manual trim button, or I can control the column. 
And if it is a true runaway stabilizer trim, I won't be able to 
disrupt that failure. Is that correct?
    Mr. Hamilton. No. With a runaway stabilizer, you can--as 
you say, you can counter it with the----
    Mr. Brown. If I counter it, and I don't get the result that 
I want, then I go to the cutoff. Is that correct?
    Mr. Hamilton. You go to the cutoff procedure.
    Mr. Brown. Right.
    Mr. Hamilton. Yes.
    Mr. Brown. However, with the MCAS failure, I can actually 
interrupt the stabilizer trim failure. Isn't that correct?
    Mr. Hamilton. That is true.
    Mr. Brown. Because it happened 15-plus times in the 
Indonesia Air, didn't it?
    Mr. Hamilton. Yes, the----
    Mr. Brown. Right. So you are saying that you don't put it 
in the documentation because the emergency procedure is the 
same. But, in fact, it is not.
    And what I am wondering is, when you look particularly at 
the Indonesia Air, the very first time that the MCAS fails is 
when the flaps go to zero, full retraction. And you provided no 
information in any of these manuals that said, hey, you know 
what, when you go to full flap retraction, you are activating 
this new system.
    Isn't that right, that there is nothing in the manuals that 
tells a pilot when they have activated the system? Is that 
right?
    Mr. Hamilton. That was correct, and we are making changes 
now to add that material to the training manual and the 
operations manual----
    Mr. Brown. And the MCAS was probably the first computer, 
right, software system that manipulated a primary flight 
control in the 737. Isn't that right? The first--not a pilot-
induced flight control, change in a flight control, the first 
computer software system that actually manipulated a primary 
flight control. That is MCAS, isn't it?
    Mr. Hamilton. Well, actually, the auto pilot that----
    Mr. Brown. OK, OK, OK. Everyone knows the auto pilot. Aside 
from the auto pilot, right? Isn't that right? MCAS was the very 
first computer software that actually manipulated primary 
flight control?
    [No response.]
    Mr. Brown. Yes or no? Or you don't know? Chief engineer?
    Mr. Hamilton. I guess, with the words you are using, I 
would say that the auto pilot does satisfy that.
    Mr. Brown. OK. Second, then, would be--the MCAS would be 
the second one, right?
    Mr. Hamilton. There is a yaw damper function on the rudder 
that moves independent of the pilots.
    Mr. Brown. Do you have--in the quick reference handbook, do 
you have a procedure for addressing a failure in that?
    Mr. Hamilton. I----
    Mr. Brown. You probably do.
    Mr. Hamilton. I would have----
    Mr. Brown. You probably do. But you don't have it for the 
MCAS. That is the--as a pilot, you didn't give them the 
information they needed.
    Mr. Muilenburg. Congressman, as we said, that is one area 
where we have learned, and we are coming back, and we are 
adding that information to the manual.
    Mr. Brown. Thank you, Mr. Chairman.
    Mr. DeFazio. Mr. Mitchell?
    Mr. Mitchell. Thank you, Mr. Chair. Boeing and Boeing 
aircraft is an iconic brand in this country. I have been asked 
by a number of constituents and people, ``Will you fly the 737 
MAX? Will you take that flight?''
    I will say publicly I will--given the scrutiny, I will fly 
it as soon as it is allowed to go back in the air, because I 
believe it will be the most scrutinized aircraft in the history 
of this country.
    I do want to talk to you a little bit about some of the 
continuing questions that Mr. Garamendi had. Boeing's tanker 
they are supplying to the military, it has some significant 
issues. However, when a similar system was put on it to the 
MCAS, the Pentagon required that it fire only once. Only once.
    Why on the 737 MAX was another approach taken, where it 
could--and did--fire repeatedly? As my colleague says, 
significantly, what was the--why the difference in approach, 
given a similar issue with the aircraft, or similar concern 
with the aircraft?
    Mr. Hamilton. So the MCAS was--again, it was designed for--
as you approached a stall. When pilots do fly into stall, 
oftentimes they may overcorrect and fly back into a stall. But 
it was intended that, if you were in a stall condition, and----
    Mr. Mitchell. Let me stop you. I understand stall. I am--
had flight instruction, I understand. But you haven't answered 
my question.
    Why the difference between the tanker, where the Pentagon 
required it only fire once--that was the criteria put forth as 
they are going through the--taking that aircraft--and the 
commercial aircraft had a repeated and, in fact, accentuated--
you changed the standard on it, it went to a more powerful 
motion. Ultimately, why the difference? What motivated that?
    Mr. Hamilton. Well, the Air Force set some of the 
requirements for the tanker that we followed.
    Mr. Muilenburg. Congressman, if I could just add----
    Mr. Mitchell. Sure, please.
    Mr. Muilenburg [continuing]. Add a bit to that. John is 
correct. The concept behind MCAS on the tanker was for a 
different purpose, a different part of the flight envelope, as 
I understand it. We can provide additional details on that, but 
the reason the design requirements are different is that it was 
designed for a different part of the flight envelope, and for a 
different handling qualities purpose. But we will----
    Mr. Mitchell. I appreciate that----
    Mr. Muilenburg. If we could follow up with the details, we 
will.
    Mr. Mitchell. I would appreciate that. But I think, just to 
be honest about it, I think we may--we, collectively, the FAA 
and Boeing, made an error in understanding where it would apply 
in the flight envelope, in terms of the MCAS, because it 
clearly occurred within the flight envelope, and it occurred 
catastrophically. So we are back to my earlier question about 
assumptions, because they failed.
    Question two for you. When doing the simulator testing, I 
saw some documentation that it wasn't possible to simulate no 
angle-of-attack data or flawed angle-of-attack data to test 
pilot response, that, in fact, it wasn't included as part of 
the simulator. So, therefore, there was no way to figure out 
whether 4 seconds would work, or 10 seconds, never mind all the 
other things that may happen.
    Can you shed some light on that?
    Mr. Hamilton. Yes. When we evaluated the MCAS failure, we 
did not actually input a faulty AOA sensor input, because the 
simulators didn't--couldn't simulate that. But we simulated the 
actual MCAS failure.
    Mr. Mitchell. Well, let me ask you a question.
    Mr. Hamilton. We have subsequently----
    Mr. Mitchell. I understand----
    Mr. Hamilton [continuing]. Gone forward and actually 
updated the----
    Mr. Mitchell. Let me ask you a question. You have got how 
many other sensors on the aircraft? Are there any others that 
you didn't simulate in order to test the--what would happen, in 
terms of aircraft performance or pilot response?
    Mr. Hamilton. I can't answer that question off the top, but 
we could follow up with you on that.
    Mr. Mitchell. I would like you to answer for the committee, 
because I am astonished, not only with information which I have 
raised, as well, to the pilots, training requirements for the 
pilots regarding MCAS.
    Then, in fact, in your--it appears to me in your testing 
process you didn't test whether or not flawed data from a 
single AOA would, in fact, cause catastrophic problems, which, 
in fact, it did. They couldn't test it on a simulator. They 
didn't see it, because they didn't have it. They had other 
problems, but they didn't see that, your pilots, which are more 
experienced than some that are flying this aircraft. So I would 
appreciate that information.
    I will yield back. Thank you, Mr. Chair.
    Mr. DeFazio. I thank the gentleman. Just--you did raise a 
point that Mr. Hamilton responded to about why the repeated 
actuation at a very radical angle, and he said, ``Well, 
sometimes pilots tend to overcorrect, and they can fall back 
into a stall again.''
    Well, that kind of contradicts your whole reasoning that 
they are going to figure this all out in 4 seconds and fly 
perfectly. I mean I think you have just created something that 
goes back to your other study, which said if it takes as long 
as 10 seconds, the plane is going in.
    With that I would recognize Mr. Espaillat and then 
Malinowski.
    Mr. Espaillat. Thank you, Mr. Chairman. I first want to 
extend my condolences to the families that are here today. My 
district suffered a similar tragedy with flight 587 back in 
2001, which, unfortunately, went down in Rockaway of New York 
City, and I know the kind of hurt that many of you are going 
through. So my heart goes out to you, my condolences and 
sympathies to you all.
    Mr. Muilenburg, the National Transportation Safety Board 
recommended that the Federal Aviation Administration develop 
standards for improved aircraft system diagnostic tools to help 
the pilots better identify and respond to the kind of failures 
they met. Will you provide this committee with your absolute 
assurance that any future Boeing airplane will include such a 
system?
    Mr. Muilenburg. Congressman, I am not exactly sure what 
system you are referring to. I am familiar with the NTSB 
recommendation, and it is one that we are taking a look at. But 
there are many----
    Mr. Espaillat. And are you committed to following those 
recommendations provided by the NTSB to upgrade and improve 
your Boeings so that in the future you will not have these 
kinds of tragedies?
    Mr. Muilenburg. Congressman, we are currently evaluating 
those recommendations. We think that topic area is certainly 
one we want to look at. We will get into the details, but we--
--
    Mr. Espaillat. You cannot give us any assurance whatsoever 
that any of those recommendations that are given by NTSB you, 
as of today, you are completely sure that you will include them 
in any future Boeing production?
    Mr. Muilenburg. Congressman, our intent here is to evaluate 
all of those recommendations. We haven't completed those 
evaluations yet, but any opportunity we have there to improve 
safety is certainly----
    Mr. Espaillat. And what is the timeline for the evaluation? 
When do you think you will be completed with those evaluations?
    Mr. Hamilton. Congressman, those recommendations are made 
to the FAA. So we will have to work with the FAA on how they 
want to move forward with adopting those recommendations.
    Mr. Espaillat. There is--from this entire horrible 
experience there is not one modification, there is not one 
single meritorious change that you will make in the production 
of a Boeing as of today, right now?
    Mr. Hamilton. Well, I think, as a result of these 
accidents, we are making changes to the software of the 
airplane, we are making changes to the training, to the 
procedures.
    Mr. Espaillat. What kind of changes have you made for the 
airplanes?
    Mr. Hamilton. For the airplanes?
    Mr. Espaillat. Yes.
    Mr. Hamilton. So we are making three changes to the 
software that address the MCAS issue. We are making additional 
changes that further address pilots flying towards stall, and 
addressing some of those issues, as well.
    Mr. Espaillat. Are any of those changes included in these 
recommendations by the National Transportation Safety Board?
    Mr. Hamilton. I think, when you look at the first 
recommendation that talks about the MAX, I think it does 
address that first one, yes.
    Mr. Espaillat. OK, thank you. My next question, really 
quickly, is, Mr. Muilenburg, the Joint Authorities Technical 
Review report states that the MCAS ``used the stabilize trim to 
change the column force feel, not trim the aircraft . . . and 
that this is a case of using the control surface in a new way 
that the regulations never accounted for.''
    While I understand that you personally maintain that the 
MAX was designed and certified to the company's standards, will 
you agree that this is an example of where the regulations have 
not kept pace with changes in the industry?
    Mr. Muilenburg. Congressman, I don't know if I would 
characterize it as not keeping pace. It is true that the MCAS 
implementation is new and different, and we are evaluating what 
lessons learned we have from that.
    So again, all of the JATR recommendations are currently 
being evaluated, and we are going to take a hard look at all of 
them.
    Mr. Espaillat. Just let me conclude by saying that I know 
that all of this has to be assessed. I remember back when we 
had flight 587, the length of time that it took. But there are 
particular changes that could be adopted immediately that are 
no-brainers, and that these families, I think, deserve to hear 
from you with regards to what kind of improvements you will 
make.
    As passengers may consider getting on a Boeing in the 
future, I think it is incumbent upon you to give responses to 
these families, and this Congress.
    Mr. Hamilton. Yes, so we are making a number of software 
changes, as I mentioned, that will prevent the pilots from ever 
getting into this situation ever again.
    But also, I would tell you that, as the FAA is diligently 
going through all the documentation, they are taking lessons 
learned from these accidents and applying criteria to us that 
goes above and beyond what the current guidance and regulatory 
standards are. And so I would say we are working to a higher 
level of standard already with that.
    Mr. Espaillat. Thank you to both of you.
    Thank you, Mr. Chairman. I yield.
    Mr. DeFazio. The gentleman--Mr. Balderson is recognized.
    Mr. Balderson. Thank you, Mr. Chairman.
    First I want to thank the families and loved ones of the 
victims that are in attendance today. Your strength does not go 
unnoticed by everyone in this room and those watching on TV. So 
my thoughts and prayers are with all of you, and thank you so 
much for being here.
    Mr. Muilenburg, thank you for being here. Following the 
grounding of 737 MAX, Boeing stated in a CBS news report, 
``Safety and quality are absolutely at the core of Boeing's 
values. Speaking up is a cornerstone of that safety culture, 
and we look into all issues that are raised.''
    When the 737 MAX was being certified, what procedures were 
in place to ensure the safety concerns from designers, 
engineers, test pilots, or mechanics were properly investigated 
and addressed by Boeing?
    Mr. Muilenburg. Congressman, in addition to the specific 
updates that John well described on software and training, 
which are an important part of that answer, we are also making 
significant restructuring of how we do our work. We have set up 
a new safety organization that will report to a new vice 
president, reporting to our chief engineer, creating a direct 
line of communication back to me.
    We have restructured all of our safety review boards within 
the company, so that they are elevated and, again, provide more 
ready access, detailed access to safety data. Any safety 
concerns that our employees might raise will also come through 
this new organization.
    That includes setting up an updated anonymous reporting 
system. So if we have any employees that have a safety concern, 
if they wish to remain anonymous, they can report it up through 
that system. That will come directly to me, and it will also 
independently go to our aerospace safety committee inside of 
our board of directors to make sure all of those get the right 
response.
    Mr. Balderson. Thank you. My followup would be did Boeing 
have a process to ensure these safety concerns or whistleblower 
reports were made available to the FAA during its certification 
of the plane?
    Mr. Muilenburg. Congressman, yes. Our intent is to share 
this information. Again, as we gather data, safety concerns are 
raised, our intent is always to try to share information with 
the FAA. That is----
    Mr. Balderson. And I know you have answered some of that, 
so thank you.
    You have discussed some recent actions from Boeing to 
enhance safety. These include having all Boeing engineers 
report to Boeing's chief engineer, as well as new anonymous 
reporting systems. You just talked about that. Can you provide 
more information on how this anonymous reporting system will 
work?
    Mr. Muilenburg. Congressman, I will be happy to follow up 
with the information. It will be modeled after our existing 
ethics hotline structure, which has proven to be very 
effective. And our intent is to have a similar model here.
    Mr. Balderson. OK.
    Mr. Muilenburg. And, if helpful, we can provide additional 
details on how it is structured and how it works.
    Mr. Balderson. Yes, please, thank you very much.
    Do you believe it should be mandatory for aircraft 
manufacturers like Boeing to immediately provide the FAA with 
safety reports or safety concerns that have been filed through 
the company's internal channels?
    Mr. Muilenburg. John, you could comment on that.
    Mr. Hamilton. So we actually have a bulletin board, an 
electronic bulletin board, where we take all the fleet data 
that comes in, anything that meets the criteria that the FAA 
established on reporting to them. We post it to that, they have 
total visibility of that.
    If we have potential safety issues that--we can post those 
to the board, as well. So the FAA then can do an independent 
review of that.
    Mr. Balderson. OK. Thank you, Mr. Hamilton.
    Mr. Chairman, I yield back my remaining time. Thank you 
very much.
    Mr. DeFazio. I thank the gentleman. Now Mr. Malinowski.
    Mr. Malinowski. Thank you, Mr. Chairman.
    Mr. Muilenburg, we have been over a lot of this, but just 
to be clear, it is fair to say that Boeing pushed the FAA and 
regulatory agencies around the world to not require simulator 
training to fly the MAX.
    Mr. Muilenburg. Congressman, our design objective was level 
B training.
    Mr. Malinowski. Understood. And, of course, we have been 
over the issues with the manual not including information on 
the MCAS system.
    With all of that in mind, let me ask you, just very simply, 
was Boeing aware that MCAS could pose, under realistic, real-
world circumstances, a catastrophic risk?
    Mr. Muilenburg. Congressman, as part of that broader hazard 
analysis that John described earlier, we evaluate a broad set 
of scenarios. And that is included in that system safety 
assessment document.
    John, is that----
    Mr. Hamilton. FHA, FHA.
    Mr. Muilenburg. In the FHA?
    Mr. Hamilton. Yes.
    Mr. Muilenburg. OK.
    Mr. Malinowski. OK. Well, we have another slide, I think, 
that may be worth looking at, if folks could put it up.
    [Slide]

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Malinowski. OK, thank you. This is from a presentation 
that Boeing developed for the FAA in December of 2018, after 
the Lion Air accident, before the Ethiopian Airlines crash. 
And, as you will see, the slide states that if there were the 
loss of one angle-of-attack sensor, and the other received a 
bad reading, the situation was ``potentially catastrophic 
before crew recognition of issue.''
    And underneath it states, ``Crew training supports 
recognition and appropriate flight crew action.'' And so it 
does appear from this and other evidence we have seen that 
Boeing understood how important crew training would be to 
prevent these kinds of crashes within a month of the first 
crash.
    And given how quickly Boeing came to that answer, and 
before many details of the first crash were available, I have 
to assume that you were aware before the first crash, as well. 
And yet you actively worked against simulator training. Do you 
have an explanation for this?
    Mr. Muilenburg. Congressman, I will try to answer that.
    And I don't know, John, if you have--you want to jump in on 
that?
    Mr. Hamilton. So----
    Mr. Muilenburg. Go ahead.
    Mr. Hamilton. The training that we recognize on this is--
when you transition from an NG to a MAX--you do simulator 
training in the original NG training. And that same basic 
training would apply here.
    If you were new to the MAX, there would be simulator 
training that would be required as part of that. And so that is 
how that item got addressed.
    Mr. Malinowski. Let me also ask you this. Going back a 
little bit in time, did Boeing lobby for the provisions in the 
2003 aviation bill that established this ODA program, which has 
delegated so many of these basic decisions about whether a 
plane is safe to fly to industry? Did Boeing lobby for those 
provisions?
    Mr. Muilenburg. Congressman, I am not familiar with the 
details back in that timeframe. But you know, Boeing has been 
engaged in the ODA process and discussions over that time 
period.
    Mr. Malinowski. And it is probably--is it fair to say that, 
since that time period, Boeing has vigorously lobbied the FAA, 
and lobbied Congress to lobby the FAA to speed up the 
certification process?
    Mr. Muilenburg. Congressman, we have advocated efficiency 
in certification, and trying to do things efficiently across 
all the stakeholders where we can provide better interfaces and 
exchange of data. So----
    Mr. Malinowski. Well, that is----
    Mr. Muilenburg. Efficiency in the process has been----
    Mr. Malinowski. Very bureaucratic language, but I think 
that means yes. And I think it is something worth reflecting 
on, because I think this is--there is a larger story here. 
There is a reflexive tendency among corporate lobbyists in this 
town to always lobby for streamlined and faster provisions, and 
less regulation.
    And here we have a case--because they see it as in the 
company's interest. And here we have a case where 346 people 
died, number one, most important. And in terms of the company's 
interest, how much money did Boeing lose in the second quarter 
of 2019?
    Mr. Muilenburg. Congressman, we wrote off billions of 
dollars.
    Mr. Malinowski. Yes. Can you reflect a little bit on this? 
Is this one of the lessons you have learned, that perhaps this 
reflexive pattern of lobbying for faster and faster procedures 
to make it easier for you to get planes to market is not 
necessarily in the company's best interest?
    Mr. Muilenburg. Congressman, I have to disagree with the 
premise under the question. We never lobby for something that 
is going to harm safety. If there are places where we can gain 
efficiency, the idea is to always enhance the safety of the 
regulatory system. That is our intent. We have no desire to 
reduce safety. Our business model is about safe airplanes. And 
that is the only sustainable approach.
    So I understand the point you are making, but our intent is 
to try to be part of the regulatory system that drives safety.
    Mr. Malinowski. I yield back.
    Mr. DeFazio. I thank the gentleman. We would now go to 
Representative Stanton.
    Mr. Stanton. Thank you very much, Mr. Chairman.
    It is clear that during your tenure, Mr. Muilenburg, the 
top brass at Boeing too often put shareholders before safety, 
profit before people's lives. And, as a result of the singular 
focus in getting the MAX to market as quickly as possible, and 
the actions that were taken, and many that were not taken, 346 
innocent people lost their lives.
    Today we have heard a lot about the MCAS and its role in 
these tragedies. The evidence our committee has outlined today 
and in the months leading up to this hearing shows that Boeing 
did not even follow its own design requirements when it created 
this MCAS system and put it on the MAX.
    Here is what deeply troubles me: Not only did you fail to 
follow your own design requirements for MCAS, but you also went 
to great lengths to hide the existence of MCAS from your 
customers, and even from pilots, who are absolutely vital to 
the safe operation of the MAX.
    Mr. Hamilton, you are Boeing's chief engineer. It is your 
job to make sure MCAS works properly. I want to ask you a few 
questions about Boeing's internal MCAS requirements. Those 
design requirements were described in detail in Boeing's own 
coordination sheets.
    These coordination sheets were updated as MCAS moved 
through the design process. But two sheets--one from March 
2016, one from June 2018--did not change. Even after Boeing 
started using a newer, more powerful version of MCAS, these two 
sheets were never changed. Even more than a year after the 737 
MAX entered service, there were still no changes.
    First slide, please.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Stanton. I would like to focus on this slide on two 
specific design requirements of MCAS.
    Design requirement number 4--and you can see it highlighted 
on the screen--states, ``MCAS shall not have any objectionable 
interaction with the piloting of the airplane.''
    My time is short, so I need yes-or-no answers, Mr. 
Hamilton. Did MCAS affect the piloting of Lion Air flight 610?
    Mr. Hamilton. The crew has always had the ability to 
override MCAS with the trim switches on the wheel.
    Mr. Stanton. Let me ask it another way. Did the pilots in 
the Lion Air flight struggle to counteract the activation of 
the MCAS system?
    Mr. Hamilton. As the captain was flying the airplane, as 
you look at the flight data recorder, the captain continually 
trimmed out the MCAS inputs for multiple times.
    Mr. Stanton. Did MCAS affect the piloting of Ethiopian 
Airlines flight number 302?
    Mr. Hamilton. That accident is still under investigation. I 
think we will need to----
    Mr. Stanton. Mr. Muilenburg, you are the CEO. The buck 
stops with you. You are ultimately responsible for making sure 
that you adhere to your design requirements. That didn't happen 
here, did it?
    Mr. Muilenburg. Congressman, again, we have learned some 
things from these accidents. We are coming back and we are 
updating the MCAS design and the training materials.
    As we went through our process, we, at each step, tried to 
make the decisions that are consistent with our process and the 
data we had. But clearly, we didn't get it all right.
    Mr. Stanton. Mr. Muilenburg, are you willing to give a yes-
or-no answer to that direct question? You didn't--that didn't 
happen here, did it?
    That is really a yes-or-no question. It is a tough 
question, but it deserves a fair and direct response.
    Mr. Muilenburg. Congressman, I tried to give you my direct 
response. It is a complicated question with a----
    Mr. Stanton. Thank you.
    Mr. Muilenburg [continuing]. An answer that we----
    Mr. Stanton. Reclaiming my time, Mr. Hamilton, design 
requirement number 11--you can also see it on this slide--it 
says, ``MCAS shall not interfere with dive recovery.'' Did MCAS 
affect the dive recovery of Lion Air Flight number 610?
    Mr. Hamilton. Ultimately, after multiple MCAS inputs that--
--
    Mr. Stanton. That was really intended as a yes-or-no 
question. You have had plenty of time--it is a tough one, but 
it deserves a yes-or-no answer. Did MCAS affect in any way the 
dive recovery of Lion Air flight number 610?
    Mr. Hamilton. When the MCAS wasn't trimmed out, as we 
assumed it would be, it caused the airplane to go into a dive 
that the crews were not able to recover from.
    Mr. Stanton. Mr. Hamilton, was MCAS a contributing factor 
into the dive, as noted in the final accident report released 
by Indonesian investigators?
    Mr. Hamilton. Yes.
    Mr. Stanton. Did MCAS affect the dive recovery of Ethiopian 
Airlines flight number 302?
    Mr. Hamilton. Yes.
    Mr. Stanton. Mr. Muilenburg, as CEO, I am going to ask you 
the same question. Did MCAS affect the dive recovery of Lion 
Air flight number 610 and Ethiopian flight number 302?
    Mr. Muilenburg. Congressman, we know MCAS was a factor in 
both accidents, and there were a number of things occurring in 
both accidents. We know MCAS was a contributing factor, and we 
know we need to make some updates to it, and that is what we 
are doing.
    Mr. Stanton. Mr. Hamilton, I appreciate your direct answer 
to that question.
    Did you--this is back to Mr. Muilenburg.
    Did Boeing fail to meet your own design requirements, as it 
relates to MCAS?
    Mr. Muilenburg. Congressman, we are still evaluating 
everything we have learned from those accidents. I think what 
you see here is that there are cases where we have implemented 
against a requirement set where we have learned we need to make 
some improvements. And that is what we are doing with the 
updates.
    Mr. Stanton. It is clear that the design to the MCAS 
stabilization system was fundamentally and tragically fatally 
flawed. The Lion Air and Ethiopian Airlines tragedies don't 
just show the fault of the MCAS design, they also show that the 
system did not even meet Boeing's own design criteria.
    It is crystal clear to me, through the course of this 
investigation, that relinquishing approval of MCAS by the FAA 
was a grave mistake with severe consequences.
    Safety must be our top priority, and Congress must act. We 
owe nothing less to the victims and their families. I yield 
back.
    Mr. DeFazio. We will now move on to Ms. Mucarsel-Powell.
    Ms. Mucarsel-Powell. Thank you, Mr. Chairman. I have been 
sitting here, listening to the testimony, and I think that it 
is clear to me that so much of what we have heard today, and 
also some of the testimony from yesterday, is that, to a large 
extent, this is a story about a company cutting corners, taking 
shortcuts, sacrificing safety to achieve maximum profits.
    And at the end, what is it that we have to show for it? 
Three hundred and forty-six lives were lost, due to the 
negligence of what happened in those two flights.
    Mr. Muilenburg, for me it is very important to focus on the 
families of the victims that, as you see, are sitting right 
here. I know that the company started the Boeing financial 
assistance fund, which provides $50 million in financial 
assistance to the families of the victims, and $50 million to 
support education and economic empowerment. So, by my 
calculation, that comes out to $144,500 to each of the families 
of the 346 people that were killed in those two flights.
    My question, my first question, have you--did you ever 
reach out to the families before Boeing made this announcement 
in July, Mr. Muilenburg?
    Mr. Muilenburg. Congresswoman, I did not reach out 
personally before that----
    Ms. Mucarsel-Powell. Thank you. How did you communicate 
about this fund with the families, that you had created this 
fund for them?
    Mr. Muilenburg. Congresswoman, our reach out to the 
families is an area where I think we clearly needed to improve. 
I feel terrible about these two accidents. And having spent 
time talking with the families the last----
    Ms. Mucarsel-Powell. But my question is how did----
    Mr. Muilenburg [continuing]. Couple of days----
    Ms. Mucarsel-Powell. How did you do that? How did you 
communicate with the families about this fund?
    Mr. Muilenburg. Our Boeing global engagement team reached 
out. We had connections back into the--into both the--Ethiopia 
and Indonesia, working with our airline customers----
    Ms. Mucarsel-Powell. So you never personally reached out to 
any of the families.
    Mr. Muilenburg. I did not personally. And again, that is 
something I regret, and I wish I had done----
    Ms. Mucarsel-Powell. Mm-hmm, thank you.
    Mr. Muilenburg [continuing]. I had done that earlier.
    Ms. Mucarsel-Powell. How did you and how are you now 
working with the families to determine the best way to use 
these funds?
    Mr. Muilenburg. Congresswoman, a couple of things. One, for 
the first $50 million that you identified, we have asked Mr. 
Ken Feinberg, an expert in this area, to administer that fund. 
So he is already, you know, making progress with many of the 
families. We will continue that.
    On the second $50 million----
    Ms. Mucarsel-Powell. And----
    Mr. Muilenburg [continuing]. We have engaged with the 
families. That was one of the topics of discussion at our 
meeting last evening, and we are going to continue that, going 
forward----
    Ms. Mucarsel-Powell. Thank you, Mr. Muilenburg. And it was 
reported in this article that--by CNBC--that the families of 
the 737 MAX have only until December 31st, 2019, to file a 
claim with Boeing, with the Boeing compensation fund. Is that 
correct?
    Mr. Muilenburg. Congresswoman, I am not sure if that is the 
deadline. But my expectation is that it----
    Ms. Mucarsel-Powell. Why put a deadline?
    Mr. Muilenburg. Congresswoman, it is not something that I 
have----
    Ms. Mucarsel-Powell. I mean there are so many families----
    Mr. Muilenburg [continuing]. Established----
    Ms. Mucarsel-Powell [continuing]. That are here, just 
trying to seek basic justice. I want you to take a look at 
them, just for 1 second, because, obviously, you haven't spoken 
to them.
    Mr. Muilenburg. Well, Congresswoman, I----
    Ms. Mucarsel-Powell. So I am going to continue, thank you, 
Mr. Muilenburg.
    Can you assure us today that if these families accept these 
funds, they will not in any way hinder anybody's ability to sue 
or take any legal action against the company?
    Mr. Muilenburg. Yes, Congresswoman. This fund is completely 
separate from any legal activities.
    Ms. Mucarsel-Powell. So you give me that assurance today?
    Mr. Muilenburg. Yes.
    Ms. Mucarsel-Powell. Thank you. Now I want to ask for 
unanimous consent to introduce this article that I found, ``FAA 
Discovers New Safety Concern During Boeing 737 MAX Test.''
    Mr. DeFazio. Without objection.
    [The information follows:]

                                 
Article entitled, ``FAA Discovers New Safety Concern During Boeing 737 
      MAX Test,'' Submitted for the Record by Hon. Mucarsel-Powell
https://www.washingtonpost.com/local/trafficandcommuting/faa-discovers-
new-safety-concern-during-boeing-737-max-test/2019/06/26/6ebfacf2-9868-
11e9-830a-21b9b36b64ad_story.html
      faa discovers new safety concern during boeing 737 max test
By Michael Laris
June 26, 2019 at 7:57 p.m. EDT
    The Federal Aviation Administration has discovered a potential 
problem connected to the flight control computer on Boeing's 737 Max 
jets that, in rare circumstances, could force the plane to dive in a 
dangerous, uncontrolled fashion.
    Highly experienced FAA test pilots were concerned that they could 
not ``quickly and easily follow the required recovery procedures,'' 
according to a person familiar with the testing who spoke on the 
condition of anonymity to discuss the findings Wednesday.
    The problem is not the same as the faulty data issue that 
investigators say contributed to the crashes of 737 Max planes in 
Indonesia and Ethiopia.
    In each of those two crashes, investigators say bad information 
from an external sensor caused an automated feature known as the 
Maneuvering Characteristics Augmentation System (MCAS) to automatically 
push the planes' noses down.
    In the latest case, the problem ``was traced to how data is being 
processed by the flight control computer'' itself, according to the 
person familiar with the findings.
    The aircraft has been grounded since March.
    ``The FAA recently found a potential risk that Boeing must 
mitigate,'' the agency said in a statement. ``The FAA will lift the 
aircraft's prohibition order when we deem it is safe to do so.''
    The FAA made the discovery during simulator sessions meant to test 
the plane's overall flight control software and Boeing's proposed fixes 
to its MCAS feature. Its testing procedures are designed to find and 
``highlight potential risks,'' the FAA said.
    ``Boeing agrees with the FAA's decision and request, and is working 
on the required software,'' the company said in a statement.
    A company spokesman declined to answer questions about how long it 
will take to address the new issue or why Boeing itself had not 
discovered the risk earlier.
    Boeing said addressing the issue ``will reduce pilot workload by 
accounting for a potential source of uncommanded stabilizer motion.''
    ``Uncommanded stabilizer motion'' is a reference to an automatic 
adjustment in the position of the horizontal stabilizer on the plane's 
tail, which can make the aircraft ascend or descend.
    The person familiar with the testing said the FAA pilots were 
unable to quickly follow the steps Boeing and the FAA have described 
when pilots experience a ``runaway'' horizontal stabilizer.
    The FAA discovery raises the potential for a lengthy delay if 
Boeing is unable to address the problem by making software changes and 
instead has to consider hardware upgrades. The agency has instructed 
Boeing to come up with a plan for fixing the issue, which it will 
evaluate.
    Boeing has been working on a fix to its MCAS software for eight 
months, the company said. That update makes the MCAS system reliant on 
two external sensors, rather than just one, and prevents the feature 
from firing repeatedly, as occurred in the two crashes, which killed 
more than 300 people.
    ``Boeing will not offer the 737 Max for certification by the FAA 
until we have satisfied all requirements for certification of the Max 
and its safe return to service,'' the company said in its statement.

    Ms. Mucarsel-Powell. Thank you. Changing subjects for a 
second, are you expecting this aircraft, the 737 MAX, to fly 
any time in the near future?
    Mr. Muilenburg. Congresswoman, we are working with the FAA 
on that. We have currently set a baseline for----
    Ms. Mucarsel-Powell. When----
    Mr. Muilenburg [continuing]. Our purposes of----
    Ms. Mucarsel-Powell. When is that date expected?
    Mr. Muilenburg. The fourth quarter, this----
    Ms. Mucarsel-Powell. So----
    Mr. Muilenburg. Before the end of the year.
    Ms. Mucarsel-Powell. So soon? So you are going to feel--
because I have lost all confidence, Mr. Muilenburg. I sit on 
the Transportation and Infrastructure Committee. I have been 
listening to your testimony and heard some of your testimony 
yesterday, and I think many of the families have asked for your 
resignation.
    And I have thought for a long time I don't want to blame 
you. But at some point you have to take full responsibility of 
the negligence of these two flights. And I want to ask you. Are 
you going to be stepping down as CEO of Boeing?
    Mr. Muilenburg. Congresswoman, I--no.
    Ms. Mucarsel-Powell. No?
    Mr. Muilenburg. Congresswoman----
    Ms. Mucarsel-Powell. It doesn't surprise me.
    Mr. Muilenburg. It is important----
    Ms. Mucarsel-Powell. Because I saw something else. Boeing 
increases CEO's pay 27 percent to $23.4 million last year. This 
was last year.
    Mr. Muilenburg. Congresswoman----
    Ms. Mucarsel-Powell. So, obviously, you don't want to step 
down.
    Mr. Muilenburg. My company----
    Ms. Mucarsel-Powell. But I think that, at some point, to 
build trust and confidence in your company--because I do agree 
with you there are thousands of employees that work in this 
company that don't deserve to be put through this. But it is 
you, as the CEO, that takes full responsibility for what 
happened. And I have not heard you doing that.
    Mr. Muilenburg. Congresswoman----
    Ms. Mucarsel-Powell. And with that, thank you, I yield back 
my time.
    Mr. Muilenburg. Congresswoman, if I could respond to that, 
I am responsible. I take responsibility for these two accidents 
that occurred on my watch. I feel responsible to carry that 
through.
    As I mentioned earlier, I grew up on a farm in Iowa. My dad 
taught me responsibility, and he asked--what he told me is to--
when they are faced with challenges, to carry through. And I 
don't want to run away from challenges. My intent is to see 
this through. I think that is part of my responsibility----
    Ms. Mucarsel-Powell. Mr. Muilenburg, if you had an ounce of 
integrity you would know that the right thing to do is to step 
down.
    Mr. DeFazio. OK, the gentlelady's time has expired. I would 
now recognize the ranking member, Mr. Graves.
    Mr. Graves of Missouri. Would you like to finish what you 
were saying?
    Mr. Muilenburg. Well, Congressman, thank you. Again, I 
understand the congresswoman's view here, and I respect those 
inputs. But, as I said, the way I was brought up, when faced 
with a tough challenge like this, something that occurred on my 
watch, I have a keen sense of responsibility to see it through. 
And I think that is part of what I owe to these families, and 
to their memories. And I am committed to doing that.
    To me this is about being responsible and ensuring safe 
travel for the future. That is my focus.
    Mr. Graves of Missouri. Thank you. I yield back.
    Mr. DeFazio. Mr. Allred?
    Mr. Allred. Thank you, Mr. Chairman. I want to begin by 
offering my sincerest condolences to the families who are here 
today. As the father of an 8-month-old child, I am particularly 
devastated to see the babies in these pictures.
    I do believe that Boeing is a great American company, and 
that is part of why I am so frustrated that we are here today.
    I also want to say that the FAA has failed in its duty to 
make sure that we fix--and we must ensure in this committee 
that we fix--this process to make sure that this never happens 
again.
    Industry capture of safety regulation in any area is not 
only dangerous to the public, it is bad business. This has cost 
Boeing dearly, and it has cost our airlines dearly. That is why 
it is so important that we get this right.
    Mr. Muilenburg, I hope that you are gathering from today's 
hearing that our concern isn't with the mistakes that were 
made. We are certainly concerned about that, but we understand 
that mistakes happen. Even the greatest companies make 
mistakes. It is the concealment, it is the purposeful 
concealment that bothers so many of us, with an obvious 
financial drive behind it.
    That the pilots didn't know about this is unacceptable. 
That you implemented this new system and had airlines rely on 
you to deliver a safe and reliable aircraft, and you did not do 
that, it is unacceptable.
    And that we in this committee only are finding out some of 
this information last month, you come here and you are telling 
us how sorry you are about what has happened, but yet we have 
to have whistleblowers tell us some of this information about 
what is going on inside Boeing. We only got some of this 
information on October 18th about these texts that are going on 
with some of your people. You have not fully complied with us. 
We have had to fight and scratch for all the information that 
we have to try and fix this system. And that makes me angry, 
and it makes me feel like your use of the word 
``accountability'' has a very different meaning than mine.
    Now, this is not about pilot error. I have heard some of my 
colleagues mention pilot error. This is about catastrophic 
design flaw, and regulatory failure that has caused us to lose 
hundreds of lives. Two of your aircraft, sir, have gone down.
    In Dallas, where I represent, we have two airlines, 
Southwest Airlines and American Airlines, both of which have 
extensive hubs in my area. They have invested heavily in your 
aircraft. This grounding and these catastrophes have cost them 
over $1 billion. They have canceled 9,500 flights in the last 
quarter alone--that is American, alone. And their hardworking 
employees are feeling the financial effects of your negligence.
    Now, when the 737 MAX flies again, after it has gone 
through the needed changes that are just now being done, which 
I think some of this process has shown that you knew should 
have been done in the first place, it will be a profitable 
aircraft for your company.
    And so, my question to you is how will you compensate the 
airlines and their employees who have lost so much due to your 
negligence?
    Mr. Muilenburg. Congressman, we have been working with a 
number of airlines, including American and Southwest. As you 
might have seen in our last quarterly report, we took charge of 
several billion dollars associated with what we call customer 
compensation. Those discussions with those two airlines and 
many others around the country and around the world are 
ongoing. And our intent is to make things right with our 
customers.
    We feel terrible about the impact it has had. We know the 
flying public has been affected, we know these airlines have 
been affected. We know their communities have been affected. 
And we have a deliberate engagement approach with each and 
every airline, and we are working our way through that. And we 
have set aside a financial impact associated with that that you 
have seen in our public reports.
    Mr. Allred. Well, we are going to be following this 
closely, because there are hardworking employees of both these 
airlines who have no role in this, who are doing their best, 
who have been impacted by this.
    I fly Southwest twice a week. Every time I get on a plane 
someone asks one of the flight attendants whether or not it is 
a MAX. You have a lot of work to do, sir.
    I yield back.
    Mr. DeFazio. Ms. Davids would be next, the vice chair of 
the subcommittee.
    Ms. Davids. Thank you. Well, first I would like to again 
extend my condolences to the families that are here. And I 
appreciate your continued willingness to show up and be a part 
of this process.
    Aviation is extremely important to Kansas, the State that I 
hail from. And our State has a strong aviation history, and it 
is vital to my State's economy. And it is vital to the U.S. 
economy. I think you know that already.
    Mr. Muilenburg, to piggy-back off of so much of the 
questioning we have heard today, and what we heard from you 
today, and what we heard from you yesterday in the Senate, you 
have reiterated time and time again Boeing's commitment to 
safety and pilot training. But we have seen a number of 
documents, the committee has reviewed a number of documents 
with an emphasis on an effort to minimize pilot training 
requirements for the 737 MAX.
    My interest is having you provide some clarity on the 
apparent inconsistencies that we are hearing and seeing. Would 
you agree that pilot training is important to Boeing?
    Mr. Muilenburg. Yes.
    Ms. Davids. And when Boeing marketed the MAX to potential 
airline customers, did they assure the customers that, if they 
purchased the MAX, it would be unlikely that they would need to 
put their pilots through timely and costly simulator training?
    Mr. Muilenburg. One of our design requirements that we 
worked with our airline customers was to do what we call level 
B training, computer-based training, as a design objective.
    Ms. Davids. OK. I have some slides.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. So this--I have a PowerPoint presentation from 
a 737 MAX training that one of the marketing officials provided 
from July 2017, which was a few months after the FAA certified 
the MAX.
    Can you go to the second slide, please?
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. This graphic shows a quote, if you will look in 
the box here. ``We had marketed 2 days previously. A 3- to 4-
hour course has now been approved.''
    Mr. Muilenburg, after FAA's 2017 certification, did 
Boeing's marketing representatives emphasize to potential 
customers that FAA had reduced the length of pilot training 
that Boeing had originally expected?
    Mr. Muilenburg. Congresswoman, I am not familiar with those 
discussions.
    I don't know, John, if you have any awareness----
    Mr. Hamilton. No, I do not.
    Mr. Muilenburg. We can certainly follow up on that 
question.
    Ms. Davids. OK. Well, it is clear from this slide that 
Boeing had expected a different number of days of training than 
what it ultimately ended up with.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. So this slide here contains text from an email 
chain on August 2016 from chief technical pilot Mark Forkner, 
which announces to a large group at Boeing that the FAA 
approved the level B training, and that it was--first of all, 
it--the entire email contains a lot of exclamation points. He 
was very enthusiastic. And he noted that, ``This culminates 
more than 3 years of tireless and collaborative efforts across 
many business units.'' You can see the rest of the text here.
    Mr. Muilenburg, level B designation means the 737 MAX was 
subject to computer-based pilot training requirements, and not 
more extensive simulator requirements, correct?
    Mr. Muilenburg. Congresswoman, that is correct for the 
differences training between the models. The baseline training 
for the 737 MAX is a 20-plus-day training program that includes 
significant simulator time.
    Ms. Davids. So, in a separate email chain--can you bring up 
the next slide, please?
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. We are very familiar with this quote by this 
time in the day. Mr. Forkner, in November 2016, tells an FAA 
official that he was working on ``Jedi mind-tricking regulators 
into accepting the training'' that he got accepted by the FAA.
    Mr. Muilenburg, the push across Boeing to limit cost of 
pilot training requirements on the MAX, despite the company's 
commitment to safety and pilot training, is clear. From the 
questions we have heard today, the slides we have heard, what 
is up here right now, this is your chance to provide some 
clarity on how you mesh all of this information with your 
continued statements about commitment to safety.
    Mr. Muilenburg. Yes. Congresswoman, I think it is a very 
good question. And the idea here is that incremental training 
adds to safety.
    We don't make training decisions based on economics. We try 
to make training decisions based on safety. And as John pointed 
out earlier----
    Ms. Davids. If it wasn't based on economics, what was it 
based on, that you were trying to push to reduce----
    Mr. Muilenburg. On safe operations for our airlines.
    So many of our airline customers who received the 737 MAX, 
they also fly 737 NGs. And a typical pilot, in a given day, may 
have a flight on an NG and a flight on a MAX. And it is----
    Ms. Davids. What you are saying right now sounds 
inconsistent with the information that we have been seeing, 
that you are committed to safety, and that you are not taking 
into account the economic impacts of the pilot training that 
people would have to do.
    Mr. Muilenburg. Could----
    Ms. Davids. The last thing I want to say is, based on what 
Congresswoman Mucarsel-Powell said, can you tell us right now, 
if this article is correct in that December 31st, 2019, is the 
last chance that families are able to file a claim for the 
Boeing compensation fund, that you will extend that? Because 
that is only 2 months from now, and that seems completely 
ridiculous, that people only have until December 2019.
    Mr. Muilenburg. So, Congresswoman, I--until that was 
mentioned earlier, I just hadn't recalled that deadline. But I 
can tell you that is something that we can extend, and I would 
be--I will give my team that direction. If----
    Ms. Davids. Thank you.
    Mr. Muilenburg. If there are families that we can help, and 
more time is needed, we will take the time. Our commitment here 
is to try to help the families. And I know, you know, monetary 
help never relieves the pain, it never will, but hopefully we 
can help in the communities.
    And I don't want to put any kind of artificial timeline on 
that. So if that is the constraint, we will remove it.
    Ms. Davids. Thank you. I yield back.
    Mr. DeFazio. Mr. Garcia?
    Mr. Garcia. Yes. Thank you, Mr. Chairman. To the families 
and friends of those who perished, thank you for bearing 
witness to what was really lost in the catastrophes.
    I would like to explore with you, Mr. Muilenburg, some of 
the financial forces that may have contributed to the 
catastrophe, as it relates to the corporation. If you would, 
answer some simple questions in a yes-or-no format.
    One of your primary duties as CEO is to focus on increasing 
the price of the company's stock. Is that right? One of your 
duties?
    Mr. Muilenburg. Congressman, one of our objectives----
    Mr. Garcia. OK.
    Mr. Muilenburg [continuing]. Is to increase the 
shareholders value, yes.
    Mr. Garcia. I will take that as a yes. Is your total 
compensation or realized gains tied to Boeing's stock 
performing well?
    Mr. Muilenburg. That is one component of it, yes.
    Mr. Garcia. OK. Mr. Muilenburg, do you know what the stock 
price was when you became CEO?
    Mr. Muilenburg. Congressman, I do not.
    Mr. Garcia. It was $140 a share. That is a June 5, 2015, 
number.
    What was the stock price at the last trading day before the 
Ethiopian Air accident this year, would you know that?
    Mr. Muilenburg. I don't know.
    Mr. Garcia. Let me help you. It was $422 a share on March 
8.
    So in a little over 4 years your company's stock rose. It 
tripled. From 1999 to 2009 it went from $42 to $49 a share. But 
from 2015 to 2019 it tripled, from $140 per share to $422 a 
share. Very significant.
    In fact, you and your board authorized a $20 billion stock 
buyback program in December of 2018, 2 months after the Lion 
Air incident, that helped drive up the price of Boeing stock.
    You own shares of company stock, correct?
    Mr. Muilenburg. That is correct.
    Mr. Garcia. So, in short, you benefitted personally from 
increasing the stock price. In fact, a report from the American 
Prospect, shows you made over $95 million from 2015 to 2018. 
You were pocketing almost $2 million a month, almost half from 
stock dividends.
    The way I see it, your relentless focus on stock price and 
your company's bottom line may have negatively affected 
employee performance. Would you agree?
    Mr. Muilenburg. Congressman, I don't agree with that. Our 
business model is about safe airplanes. It is a----
    Mr. Garcia. So you don't think that----
    Mr. Muilenburg [continuing]. Long-cycle business.
    Mr. Garcia. You don't think that employees felt pressured 
to perform?
    Mr. Muilenburg. Congressman, the realities of the 
competitive environment, the pressure to perform, is there. But 
that is never----
    Mr. Garcia. Well----
    Mr. Muilenburg [continuing]. Equal to safety. Safety----
    Mr. Garcia. But in November----
    Mr. Muilenburg [continuing]. Is very----
    Mr. Garcia [continuing]. Of 2016 Boeing conducted an 
internal survey which--in which over 40 percent of employees 
stated they felt undue pressure.
    Curtis Ewbank, a Boeing employee, said, ``Boeing management 
was more concerned with cost and schedule than safety and 
quality.''
    Another, Adam Dickson, said--a Boeing engineer said his 
managers warned in ``very directly and threatening ways'' that 
pay was at risk if targets weren't met.
    It is pretty clear there has been a culture of greed and 
compromising safety at Boeing.
    Mr. Muilenburg, you did everything to drive profits over 
safety. You skirted recertification requirements or regulators 
at every corner, and your employees even admit to lying to the 
FAA.
    There are basically two ways that this plays out. You 
either truly didn't realize you had a defective plane, which 
demonstrates gross incompetence and/or negligence, or you did 
know you had a defective plane, but still tried to push it to 
market, in which case it is just clear corruption. Either way, 
Mr. Muilenburg, you are the captain of this ship. A culture of 
negligence, incompetence, or corruption starts at the top, and 
it starts with you. You padded your personal finances by 
putting profit over safety. And now 346 people, including 8 
Americans, are dead on your watch.
    Today you said you made mistakes and you are accountable. 
If Ex-Im Bank isn't reauthorized and the MAX is left grounded, 
you might be asking us for a bailout. That bill--the Ex-Im Bank 
is before the Financial Services Committee. I think it is time 
that you submitted your resignation, don't you?
    Mr. Muilenburg. Congressman, I respectfully disagree with 
your premise on what drives our company.
    Mr. Garcia. OK. Well, whether or not you or your colleagues 
are incriminated in the ongoing criminal investigation, the 
facts remain. It was either gross negligence, incompetence, or 
corruption. You are at the top. I think it is pretty clear to 
me, to the families of the victims, and the American public 
that you should resign and do it immediately.
    I yield back, Mr. Chairman.
    Mr. DeFazio. Next would be Mrs. Fletcher.
    Mrs. Fletcher. Thank you, Mr. Chairman. Thank you very much 
for being here today, and thank you for holding this very 
important hearing. I join my colleagues in expressing my 
deepest condolences to the families and the friends who are 
here with us today, and those who can't be here with us. And, 
of course, they are in our minds and--as are the victims. And I 
think that that really needs to remain our focus as we are here 
today.
    We convened this hearing to get the facts and to understand 
better what we can do, as Members of Congress, to prevent a 
tragedy like this from ever happening again. And we understand 
that these are real people whose lives have been affected, 
lives have been lost, and lives have been forever changed. And 
so I remain aware of that. And we want to do what we can.
    And so, one of the things that has been an issue that we 
have touched on a little bit earlier today, but I want to 
follow up on, is this delegation of certification authority. I 
think this is a critical place where Congress really needs to 
reassess whether this is a program that should continue.
    And I understand--and there have been questions about this 
earlier--that Boeing was really able to avoid installing some 
of the latest safety features by using this amended 
certification. And I think both Boeing and the FAA failed to 
evaluate the impacts of the MCAS on the whole aircraft system 
because of this.
    So, Mr. Muilenburg, my question is for you, first. The JATR 
recommends that the FAA needs to ensure that engineers have 
open lines of communication to the FAA certification engineers 
without fear of punitive action or process violations. Do you 
agree with that recommendation?
    Mr. Muilenburg. Congresswoman, we agree with having those 
open communications, yes.
    Mrs. Fletcher. And what changes, if any, has Boeing made to 
improve the relationship and ensure that Boeing employees have 
the access they need to make safety determinations?
    Mr. Muilenburg. Congresswoman, one of the big changes we 
announced roughly 2 weeks ago now was a standup of a new safety 
organization. It is centralized within Boeing, a direct 
reporting line to our chief engineer, who reports to me. That 
will include our ODA representatives, the delegated authority 
representatives. I think that will enhance transparency, 
directness of communication lines with the FAA, and also 
increase independence from our airplane programs to create that 
functional strength.
    So those are changes we have announced, and are now 
implementing.
    Mrs. Fletcher. And are other changes under consideration, 
or is that the extent of your recommendation at this time?
    Mr. Muilenburg. We have multiple recommendations or actions 
that are underway. That includes the standup of a new aerospace 
safety committee for our board that is headed up by Admiral 
Giambastiani that includes a restructuring of all of our safety 
review boards across the company, so they now are integrated, 
companywide.
    We are standing up a new design requirements organization 
that, as technology continues to evolve, we can do a better job 
of sharing those technologies and requirements across the 
company.
    And we have realigned our engineering organization 
structure so all--roughly 50,000 Boeing engineers now report 
directly to our chief engineer.
    Mrs. Fletcher. OK, thank you.
    Mr. Muilenburg. There are additional actions underway, and 
investments for the future. So that list I just gave you is----
    Mrs. Fletcher. OK, sure.
    Mr. Muilenburg. Consider that a set of initial actions with 
more to follow.
    Mrs. Fletcher. Thank you. I want to move on to a couple 
more things before my time expires.
    Were any Boeing employees subject to punitive action during 
the development of the 737 MAX for reporting issues to FAA 
staff?
    Mr. Muilenburg. Congresswoman, I am not aware of any such 
cases. If there were cases like that, we don't accept 
retaliation. There is no tolerance for retaliation. So I can't 
personally say I am aware of any. But let me check the records 
to see if there are any there.
    Mrs. Fletcher. Thank you, I would appreciate that.
    Mr. Muilenburg. But I can tell you, from a policy 
standpoint, we do not tolerate retaliation.
    Mrs. Fletcher. I would appreciate if you could get back to 
the committee on whether any employees were subjected to 
punitive action. I understand that you don't know that, sitting 
here today, for a fact.
    Another recommendation is that the JATR recommends 
increased FAA involvement in safety critical areas that are 
currently delegated to Boeing. I understand Boeing has 
implemented these changes to internal processes. Have you 
identified any changes to the delegation process that Congress 
can help with, as we evaluate these issues?
    Mr. Muilenburg. Congresswoman, we are starting to evaluate 
those opportunities. So discussions are ongoing with the FAA 
and others. We think the area of human-machine interface, and 
how we set those industry standards and the requirements for 
how pilots operate in a high-workload environment, that is a 
place where we can work together on new standards.
    There are also some older regulations that are currently on 
the books that could be updated to take advantage of new 
technologies, and we are identifying a specific list in that 
area.
    So those are two examples. And I would anticipate there 
will be more.
    Mrs. Fletcher. Thank you. I see I have exceeded my time. 
But if you could send those recommendations to this committee, 
that would be much appreciated. Thank you.
    And I yield back.
    Mr. DeFazio. The gentlelady, Delegate Plaskett.
    Ms. Plaskett. Thank you very much.
    Good afternoon, everyone, and thank you all for your 
patience in being here today to hear some of the answers from 
Boeing. Thank you, those of you who are in the audience, and 
condolences to your families, as well as to those, I guess, and 
others in the airline industry who are really looking very 
closely at what we all have here to say.
    Mr. Muilenburg, I wanted to ask you some questions 
particularly about MCAS.
    Following the Lion Air flight 610 accident last year, 
Boeing issued a bulletin for the 737 MAX. The subject concerned 
``Uncommanded nose down stabilizer trim due to erroneous angle 
of attack (AOA) during manual flight.'' While this bulletin 
describes in detail what can occur during an AOA failure, 
including nose down trim in increments lasting up to 10 
seconds, and that ``repetitive cycles . . . continue to occur 
unless the stabilizer trim system is deactivated,'' I note that 
not once does the bulletin mention by name what, in fact, 
causes such a nose down command, which is MCAS.
    And I have a copy of a Boeing flight crew operations manual 
bulletin number TBC-19, page 51. I would ask that this be 
entered into the record.
    Mr. DeFazio. Without objection.
    [The information follows:]
                                 
Flight Crew Operations Manual Bulletin for The Boeing Company, No. TBC-
   19, Issued Nov. 6, 2018, Submitted for the Record by Hon. Plaskett
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    Ms. Plaskett. Thank you.
    Sir, why was MCAS not mentioned in the November 6 bulletin?
    Mr. Muilenburg. Congresswoman, I am going to ask John to 
add to this one, but it is--what we were attempting to do with 
that bulletin was to, again, remind pilots of that existing 
emergency procedure around runaway stabilizer. And the 
reference to multiple inputs is the behavior that you would 
expect the airplane to see as a result of MCAS.
    So the idea is, again, provide the pilots information about 
the behavior of the airplane, as opposed to diagnosing the 
specific system. So that was the intent----
    Ms. Plaskett. So you--the intent was which one?
    Mr. Muilenburg. The intent was to inform them of the 
failure mode that MCAS could cause.
    Ms. Plaskett. OK.
    Mr. Muilenburg. Rather than try to provide details on MCAS.
    Since then, again, feedback from the pilots, we know we 
need to provide more information on MCAS itself, in addition to 
the effects of MCAS, and that is part of the update we are 
making to the training manual.
    Ms. Plaskett. In providing the effects of MCAS, would it 
have been easier--or to summarize it by using the term 
``MCAS''?
    Mr. Muilenburg. It perhaps could have. I think that is one 
of the things we have learned now, is the pilots would like to 
have additional information on just the definition of MCAS, 
itself, in addition to the effects of its failure modes.
    Again, our goal is to optimize what is in the training 
manual, so we don't add more information than what is useful 
for the pilots. Clearly----
    Ms. Plaskett. How large are your training manuals?
    Mr. Muilenburg [continuing]. We could have done better 
here.
    Ms. Plaskett. How large are the training manuals?
    Mr. Muilenburg. I can't comment on that. I don't know, 
John, have you got a----
    Ms. Plaskett. They are pretty substantive, aren't they?
    Mr. Hamilton. They are very substantive, yes.
    Ms. Plaskett. So why would that have been any more of a 
difference to add that?
    I saw you nodding your head, sir. Did you want to add 
anything?
    Mr. Hamilton. Well, they are very substantial in size. But 
we do go through a process of trying to evaluate what is the 
right level of information to be in there. We can incorporate 
all kinds of information.
    In hindsight, you know, and in response to the pilots' 
requests, we are going to put the material in the training 
manuals on MCAS. We are going to tell them exactly what the 
need--we are going to have a lot more information there to 
address this.
    Ms. Plaskett. So is that the decision as to why it was 
ultimately excluded, because it was seen as, what, not 
something that the pilots would have----
    Mr. Muilenburg. Again, our intent was to provide 
information on how to fly the airplane, not necessarily 
diagnose the system failures. And that is always a balance that 
we try to get in our training materials.
    And clearly, here, we need to provide more information for 
the pilots----
    Ms. Plaskett. So the reference to MCAS was excluded. Was 
the reference to MCAS excluded in order to not bring attention 
to the system--pilots were unaware about it? No?
    Mr. Muilenburg. Congresswoman, the intent was to provide 
the training materials that the pilots would need to fly the 
airplane, rather than try to educate them on the system 
details.
    And again, that is an area where we fell short, and we need 
to provide additional information. And we are going to----
    Ms. Plaskett. So in that same bulletin, just very quickly, 
Boeing describes how erroneous AOA can cause, potentially, many 
indications, and as many as four different alerts or lights: 
IAS disagree, ALT disagree, et cetera.
    Do you believe, if several of these indications went off 
simultaneous in a cockpit, a pilot would be confused about how 
to respond?
    Mr. Hamilton. So, Congresswoman, when you have an AOA--in 
the case of Lion Air, where it was miscalibrated, once it got 
to a certain threshold, and you--you had a difference in 
altitude, then it would trigger that altitude disagree. When it 
got to a certain airspeed disagree, then--so they would--they 
might not come all on at the same time, but they are probably 
fairly closely linked together on that.
    Ms. Plaskett. OK, so the question was would a pilot be 
confused on how to respond. And then I yield back.
    Mr. Hamilton. Yes. So the OMB was really about, if you have 
an AOA issue, it can trigger a number of different indications 
on the flight deck, and--to help you identify what could be 
going on. And if you have the stabilizer moving, then perform 
the runaway stabilizer procedure.
    We subsequently went out, at the request of our customers, 
with a detailed message about MCAS, and explained what it was.
    Mr. DeFazio. Mr. Carbajal?
    Mr. Carbajal. Thank you, Mr. Chair. And I want to start by 
also offering my condolences to the families that are here, and 
those that--loved ones that have been mourning all of those 
that were lost in these unfortunate tragedies.
    Mr. Muilenburg, I want to dispense with a lot of what my 
colleagues have already touched on, and just dive into some 
really poignant, specific questions. So a very brief answer is 
what I am looking for.
    Boeing did not consider erroneous MCAS activation to 
present a catastrophic risk, correct?
    [No response.]
    Mr. Carbajal. Let me repeat that. Boeing did not consider 
erroneous MCAS activation to present a catastrophic risk. 
Correct?
    Mr. Muilenburg. Congressman, I believe the hazard analysis, 
if that is what you are referring to, we--John, help me out.
    Mr. Hamilton. Yes, that is correct.
    Mr. Muilenburg. We had a----
    Mr. Hamilton. A single MCAS event----
    Mr. Carbajal. So is that correct or not?
    Mr. Hamilton. A single MCAS event was not considered, I 
think you used the word, ``catastrophic''?
    Mr. Carbajal. Yes.
    Mr. Hamilton. Yes, that is correct.
    Mr. Carbajal. Thank you. And as a result of that lower 
classification of risk, Boeing did not perform detailed 
evaluations--failure modes, effect analysis, and fault tree 
analysis--to fully understand the effects of erroneous MCAS 
activation, correct?
    [No response.]
    Mr. Carbajal. I am just looking for yes or no.
    Mr. Hamilton. We did a thorough analysis of it using our 
processes that we have used, and we did consider multiple 
inputs into MCAS.
    Mr. Carbajal. But did you do the failure modes and effect 
analysis and the fault tree analysis? Yes or no?
    Mr. Hamilton. No.
    Mr. Carbajal. Thank you. In fact, in simulator tests, 
Boeing didn't even simulate erroneous MCAS activation to the 
full 2.5 degrees of stabilizer motion, correct?
    Mr. Hamilton. Congressman, I think I will have to follow up 
with you, because I believe we did go to beyond 2.5. I think we 
went to 3.0.
    Mr. Carbajal. If you could follow up, that would be great.
    Boeing didn't consider repetitive, erroneous MCAS 
activations in those tests, did it?
    Mr. Hamilton. Could you----
    Mr. Carbajal. Boeing didn't consider repetitive, erroneous 
MCAS activations in these tests.
    Mr. Hamilton. We did consider multiple MCAS inputs.
    Mr. Carbajal. Did Boeing assume pilots would be the 
redundancy to save the airplane during an erroneous MCAS 
activation?
    Mr. Hamilton. We assumed that pilots could recognize it and 
trim it out, and----
    Mr. Carbajal. So is that a yes?
    Mr. Hamilton. Yes.
    Mr. Carbajal. In retrospect, given that the erroneous 
activation of MCAS played a critical role in both 737 MAX 
crashes, would you agree that this was a flawed assumption that 
the pilots were the backup?
    Mr. Hamilton. We used an industry standard that has been 
around for a long time, and--around pilots' actions. And in 
these cases, that assumption did not play out in these 
accidents----
    Mr. Carbajal. So is that a yes or a no?
    Mr. Hamilton. It is an assumption that didn't play out, and 
I think it is one of the things that we need to address, going 
forward.
    Mr. Carbajal. So that would be a yes.
    Mr. Hamilton. If you could restate your question, I will--
--
    Mr. Carbajal. In retrospect, given the erroneous activation 
of MCAS played a critical role in both 737 MAX crashes, would 
you agree that this was a flawed assumption that the pilots 
were the backup?
    Mr. Hamilton. Yes, I would say that the assumption needs to 
be addressed.
    Mr. Carbajal. So yes?
    Mr. Hamilton. Yes.
    Mr. Carbajal. Thank you.
    Mr. Hamilton. Yes.
    Mr. Carbajal. Mr. Chair, I yield back.
    Mr. DeFazio. I thank the gentleman. We begin what will 
hopefully be a brief second round. I appreciate the witnesses 
and the members of the committee who have hung in here.
    Mr. Muilenburg, do you know how many 737 MAX aircraft 
Southwest Airlines had ordered from Boeing, prior to the Lion 
Air crash?
    Mr. Muilenburg. Congressman, I don't know the exact 
number----
    Mr. DeFazio. OK.
    Mr. Muilenburg [continuing]. But we can find it for you.
    Mr. DeFazio. Well, we were told it was 280. And do you 
contest the fact that Southwest Airlines would have gotten a $1 
million rebate per plane, had the pilots had to go through a 
simulator training?
    Mr. Muilenburg. Chairman, I believe that was part of the 
contract structure----
    Mr. DeFazio. OK.
    Mr. Muilenburg [continuing]. We had with Southwest.
    Mr. DeFazio. Did you have contracts like that with other 
customers?
    Mr. Muilenburg. Congressman, I don't know if there are any 
other customers with that specific clause, but it is not 
uncommon for us to have incentive clauses in these----
    Mr. DeFazio. Right.
    Mr. Muilenburg [continuing]. Contracts.
    Mr. DeFazio. So that would have totaled, obviously, $280 
million that would have had to have been paid. Because I think 
a real key issue is how we got to this point, and how MCAS was 
not in the manual. That has been my question since way back 
when.
    Let's move on to undue pressure, key learnings, and next 
steps. Slide?
    [Pause.]
    Mr. DeFazio. Slide?
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. There it goes. This was a survey, which was 
provided to us by a whistleblower. It was in 2016.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio. If we go to the next slide, ``I am concerned 
about consequences if I report potential undue pressure, 29 
percent.''
    Then, if we go to the next slide, ``When these engineers 
are also ARs, lines are frequently blurred between when the 
engineer is acting in an applicant SME role and when they are 
in an AR role.'' That was 2016.
    And I will give you, in a minute, a chance to respond, but 
it seems like you didn't pay much attention to the survey and 
the undue pressure because we then have--and I may have read it 
improperly before, but he says he was the leader of the 737 
program. He was writing to the general manager. He talks about 
workforce exhausted, schedule pressure. ``I am sorry to say I 
am hesitant about putting my family on a Boeing airplane.'' 
That is 2 years later.
    It doesn't seem like anything was done to relieve the undue 
pressure in this culture where people were afraid for their 
jobs, and there was confusion, you know, which also points to 
why we need to change this process between, you know, SMEs and 
ARs and--wait, wait a minute, which hat do I have on, and they 
are switching hats.
    In 2003 I said I don't understand how this is going to work 
when I voted against this process. I said so someone works for 
Boeing, gets paid from Boeing, and then someone else works for 
Boeing and is paid from Boeing, but this person is totally 
stovepiped over here, and firewalled. They are not responsive 
to Boeing, they are just responsive to the regulator, but that 
is not true, because apparently they go back and forth between 
being a development engineer or being, you know, the AR.
    I mean what happened between 2016 and 2018? Apparently not 
much. Can you point to any significant steps that were taken to 
change the culture and relieve this undue pressure?
    Mr. Muilenburg. Congressman, I can. And John will feel free 
to add in, as well.
    Mr. Hamilton. Yes.
    Mr. Muilenburg. First of all, this survey is a survey that 
we proactively do with our ODA team. The goal here is to 
identify any sources of undue pressure.
    So, in this case, these are the survey results that we 
proactively sought. We gathered all of these results. We have 
shared them with the FAA, and we have taken followup actions 
associated with these inputs.
    Mr. DeFazio. But then----
    Mr. Muilenburg. The----
    Mr. DeFazio. That is good, but I am asking for, like, 
really concrete examples. When you have the leader of the 737 
team, 2 years later, workforce exhausted, schedule pressure, it 
doesn't sound like those things were effective.
    Mr. Muilenburg. Yes, Congressman, if I could, I am 
attempting to answer the question, and I----
    Mr. DeFazio. Yes, go ahead.
    Mr. Muilenburg. A very important topic.
    Mr. DeFazio. Sure.
    Mr. Muilenburg. You will also see on this survey data here 
that over 90 percent of our employees are comfortable raising 
issues. And I think the number is 97 percent understand the 
process for doing so. Those are very high scores. We would 
still want them higher. But we try to create a culture where 
employees can speak up and raise issues, so we can take action 
in response. So that is the culture we are trying to 
incentivize.
    Now, I will say it is true that we have competitive 
pressures every day. We operate in a tough, globally 
competitive world. But that never, never takes priority over 
safety.
    And I know we have had this discussion, but I could tell 
you our culture, as a company, the only long-term sustained 
business model is safety. And that is because our airplanes 
last for decades. And having a culture where people are willing 
to speak up, including the people that responded to this 
survey, is part of creating that culture.
    Now, John, you might be able to comment on specific actions 
we have taken.
    Mr. Hamilton. Yes, I think there are actually two separate 
things.
    So this was actually looking at the ARs, and the undue 
pressure. And that is a defined area that the FAA has us act 
on. We do do recurrent training with the managers in 
engineering, manufacturing, and quality about how they deal 
with ARs, and how they need to be treated, and what is undue 
pressure. And we do take followup actions.
    We do audits, and the FAA has come in and actually audited 
what we did, and they have agreed with what actions were taken.
    I think, you know, the other pressures that were alluded to 
later, 2 years later, it was not an AR, to my understanding. 
And I think that just--it talks about more the pressures that--
--
    Mr. DeFazio. Well, the----
    Mr. Muilenburg. Yes, and again, as I mentioned earlier, I 
did receive a letter from that individual. And I think he 
raised some good points, things that we want our people to 
raise.
    We, subsequent to that, evaluated those. We talked to our 
737 team----
    Mr. DeFazio. But you didn't reduce the production rate, as 
you said earlier. You stated----
    Mr. Muilenburg. Yes.
    Mr. DeFazio. If I could--I don't want to prolong this too 
much----
    Mr. Muilenburg. Well, production rate stability, again, 
sir, is actually better for safety. Consistency in the factory 
is safer for our workers.
    Mr. DeFazio. Unless it is moving a little too quick.
    So just to go back to the issue of how this all happened, 
and it started with a phone call in 2011. I brought that out at 
the beginning. You had an exclusive Boeing customer who called 
and said, ``Can't match Airbus fuel economy and no pilot 
retraining necessary. We are buying all Airbus.''
    And then you--you know, I mean, the story is that we didn't 
rush, except you were looking at--I mean you have a 50-year-old 
airframe here, some of which--some of the reasons--the problems 
we had and, you know, why you had to develop MCAS, as opposed 
to a more stable platform, was because we are dealing with a 
50-year-old airframe.
    You have still got hydraulic controls. In the newer planes, 
my understanding is, when you have something serious going on, 
you actually get prioritization in a more visible way. The 
disagree light didn't even work.
    But we are being told that safety was always paramount, 
people didn't feel pressure, things weren't rushed. I just 
don't buy that. And instead of building a clean-sheet design, 
you might have lost market share for a year or two to Airbus, 
but then you would have come along with a fabulous, 21st-
century airplane that probably would have been better than the 
Airbus, and you wouldn't be going through what you are going 
through today.
    That was a critical mistake that was made back then, and I 
believe it exerted pressure throughout the organization from 
the top down, and it is going to be very hard--very hard--to 
restore confidence.
    And again, when you have the guy who was the leader of the 
737 program saying, ``I am sorry to say I am hesitant of 
putting my family on a Boeing airplane,'' that is a very sad 
comment on what has happened to the culture of the company.
    With that, Representative Brown?
    Mr. Brown. Thank you, Mr. Chairman. I just want to ask a 
question to clarify my question about computer software. You 
may recall that question.
    I do want to preface first by saying that, look, I know the 
difference between hindsight and at-the-moment. In hindsight, 
everything is clear. Today we see MCAS as a much more 
significant part of the flight control system.
    But I still believe that MCAS, at the moment, while you 
were designing, developing, and promoting it, I think it was a 
big deal that you actually just underappreciated. So let me 
just ask this question here.
    So you have the flight control system, a number of 
components are in it: flight control surfaces, like the 
stabilizer, and controls, right, cockpit controls, like the 
yoke or the control arm. You have linkages between the two.
    On the 737, all of the flight control surfaces operate by a 
cockpit control, input by a crew.
    The MCAS, as I understand it, is the only computer software 
that actually operates a flight control surface without crew 
input. Is that true?
    Mr. Hamilton. No, sir.
    Mr. Brown. You say yes or no?
    Mr. Hamilton. I said no, sir.
    Mr. Brown. OK.
    Mr. Hamilton. As I mentioned earlier, the yaw damper is--
operates independent of the crew, and it moves the rudder 
surface in response to wind gusts. And so--up to 3 degrees. And 
so crews don't put any input on that, it just happens 
automatically, based on----
    Mr. Brown. OK. Fair enough, and I appreciate that 
clarification.
    The emergency procedures. I am--you know, and I think, Mr. 
Muilenburg, you have mentioned this in testimony, I have heard 
it before from Boeing, and even when Mr. Carbajal was asking 
questions. The emergency procedure for a runaway stabilizer, 
first of all, the condition is an uncommanded stabilizer trim 
movement occurs continuously, which means--let's say the 
stabilizer goes down, which means the nose is going to go down. 
You try to make the correction, either the trim button or the 
yoke, and you are not getting any relief, right? That is a 
runaway stabilizer trim, right?
    Mr. Hamilton. To do----
    Mr. Brown. Yes or no?
    Mr. Hamilton. That could be a--how it might behave.
    Mr. Brown. Uncommanded stabilizer trim movement occurs 
continuously. Stabilizer goes down, the nose goes down, right?
    Mr. Hamilton. Right.
    Mr. Brown. Right, OK. So now, if it is continuous, which 
means I do the control--either the trim button or the control 
yoke--I don't get any relief, and then the quick reaction 
handbook says do the runaway cutoff, right?
    Mr. Hamilton. Well, when you say you don't get any relief 
from the----
    Mr. Brown. Which means if I do either the trim button or 
the control column, and I were to take my hands off, it would 
still be going down.
    Mr. Hamilton. So then that sounds like you have multiple 
failures going on. You have something that is driving the 
stabilizer in the initial spot, and now you have something else 
that is causing----
    Mr. Brown. No, I am talking about an uncommanded stabilizer 
trim movement occurs continuously, and that trim movement 
causes a nose down.
    Mr. Muilenburg. In which case you trim with the thumb----
    Mr. Brown. Right, but if I trim and nothing happens, that 
is a runaway stabilizer trim, isn't it?
    Mr. Hamilton. That would be a runaway stabilizer trim, but 
I am saying that is two different failures that could 
potentially----
    Mr. Brown. OK. So if I have a runaway stabilizer trim, OK, 
it is continuous. But with the MCAS activation, it is not 
continuous.
    Mr. Hamilton. Correct. It moves to a certain position and 
it stops.
    Mr. Brown. It stops, and I can do some correction, like 
they did on Lion Air. And then 5 seconds later on Lion Air, 
MCAS activated again.
    So the concern I have is when you say that the emergency 
procedure should be the same, but the conditions are different. 
One is continuous and one is intermittent. It happens, it stops 
when I provide input, and then it kicks in again.
    And I know you have got litigation pending, and maybe that 
is why you don't want to answer the question. But that is----
    Mr. Muilenburg. Congressman, let me try. And John can----
    Mr. Brown. Yes.
    Mr. Muilenburg [continuing]. Help me here, but--so the 
runaway stabilizer procedure, whether it is caused by MCAS or 
some other failure mode, the procedure is to trim the airplane, 
manage your power, and then hit the cutout switch if it 
continues. So----
    Mr. Brown. But as a pilot, don't you recognize it because, 
like it says in the QRH, it is continuous?
    Mr. Muilenburg. So----
    Mr. Brown. Right? Is that right?
    Mr. Muilenburg. I think----
    Mr. Brown. It is continuous?
    Mr. Muilenburg. I think the difference you are pointing out 
is that there is some runaway stabilizer modes where it is one 
continuous----
    Mr. Brown. Right.
    Mr. Muilenburg. And in the case of MCAS, it is still a 
continuous movement, but it can happen multiple times.
    Mr. Brown. Right. And----
    Mr. Muilenburg. But----
    Mr. Brown. And here is the point. Here is the point.
    Mr. Muilenburg [continuing]. Multiple time----
    Mr. Brown. There is nothing in the documentation, though, 
that says to the pilot what continuous is. The pilot is 
thinking, like, hey, continuous means I try to change it and it 
ain't changing. That is continuous. But if it changes, but then 
comes back, that is not really continuous. That is 
intermittent.
    Mr. Hamilton. Yes, I think----
    Mr. Brown. And this is where--and so, with the Lion--you 
said you are making changes in documentation.
    Mr. Hamilton. Yes.
    Mr. Muilenburg. Yes, sir.
    Mr. Brown. I really hope that you are looking at an 
emergency procedure, a quick reaction procedure, OK, that 
expressly addresses MCAS and the intermittent nature of MCAS, 
if it continues to be intermittent.
    Mr. Muilenburg. And, Congressman, to that point, that is 
one of the software changes we made. It is no longer 
intermittent. It can only operate once.
    Mr. Brown. Got it.
    Mr. Hamilton. Yes.
    Mr. Brown. Thank you, Mr. Chairman. I yield back.
    Mr. DeFazio. Mr. Larsen?
    Mr. Larsen. Thank you.
    Mr. Muilenburg, yesterday, in response to some media 
reports and a question about them, you denied media reports 
that say that there were significant changes to MCAS low-speed 
extension that were not fully vetted by the FAA. You said they 
were fully vetted.
    But the Indonesian accident authorities found FAA's 
response to the revised system safety assessment was simply to 
accept the submission. It seems to me there is a difference 
between the FAA accepting the submission, versus the FAA fully 
vetting the changes.
    So if that was the case, do you--and this gets to the--kind 
of the heart of some of these certification questions, on 
whether enough or too much has been given through the authority 
to Boeing, or to any other manufacturer.
    Can you help me score that circle, what ``fully vetted'' by 
FAA means, versus what simply----
    Mr. Muilenburg. Yes, sir.
    Mr. Larsen [continuing]. ``Accepting the submission'' 
means? Because it seems like there is no way to score that 
circle.
    Mr. Muilenburg. Congressman, let me try. And then, John, if 
you want to----
    Mr. Hamilton. OK.
    Mr. Muilenburg. Or do you have a comment you wanted to----
    Mr. Hamilton. Yes, Congressman. I think, you know, there 
has been some implications here about the ODA and what the role 
was.
    The system safety assessment, the certification 
deliverable, was retained by the FAA. It was not delegated to 
the ODA until the very end, after the FAA had reviewed it and 
provided comments back to the ODA and said, ``If these comments 
are incorporated in the system safety assessment, then the AR 
is delegated to fly in compliance.'' But the FAA had reviewed 
that document for several months.
    Mr. Muilenburg. And Congressman, if I could just add in, 
just to try to square this off with the comments you heard 
yesterday, what I was referring to is that, during that time 
period from--it was mid-2016 to early 2017--the fact that we 
extended MCAS to the low-speed operation----
    Mr. Larsen. Right.
    Mr. Muilenburg [continuing]. Envelope, that was discussed 
with the FAA in many ways. We conducted multiple flight tests. 
Some of those included FAA pilots on board the aircraft. And 
that ultimately led to the certification of the airplane with 
the MCAS software, including the extension to low-speed 
operations.
    And that--we are talking about two ends of the same 
equation there.
    Mr. Larsen. Yes. So--and I appreciate that. I know you 
won't mind, though, that we are going to continue to go through 
the documents you have provided us, and go through FAA 
documents, as well, to clear that up from our end of things.
    Mr. Muilenburg. And Congressman, I do think we have also 
identified some areas where we need to improve the 
documentation in some cases, recording of decisions and making 
sure those were communicated----
    Mr. Larsen. Yes.
    Mr. Muilenburg [continuing]. To all parties. And that is 
one of the areas of improvement that we have also identified, 
and working that jointly with the FAA.
    Mr. Larsen. And related to that, sort of the paper trail 
side of things, Mr. Hamilton, in October, on October 20th a 
statement from Boeing referenced that--back to Mr. Forkner--his 
comments in these text message exchanges reflected a reaction 
to a simulator program that wasn't functioning properly, as 
opposed to how many of us read it, that being an MCAS not 
functioning, and then him making his comments that it did.
    However, if it is only--from my understanding, if it was--
does it matter if it was just a simulator problem, or if it was 
deeper MCAS?
    There is no paper trail that I am aware of yet that tells 
me anything was fixed, whether it was an MCAS problem that was 
fixed, or if it was a simulator problem that was supposed to be 
fixed. If we are using the simulators that are supposed to be 
fixed in order to test the--a 737 MAX, I don't feel any better 
about that, either.
    Mr. Muilenburg. OK----
    Mr. Larsen. So is there a paper trail? To whom did Forkner 
report this? Who is ultimately responsible for fixing the 
simulator, if that, in fact, is what it was? And can we--and I 
hope that we can get those documents.
    As well I am going to ask--I want to ask the FAA the same 
thing, not just how far up the ladder did he have to report, 
but across to the FAA, and letting them know about the 
simulator.
    Mr. Muilenburg. Congressman, again, we are not completely 
sure what he meant in that message----
    Mr. Larsen. Well, join the crowd.
    Mr. Muilenburg [continuing]. That he talked about, but it 
appears he was working on a simulator, and he is referencing 
the low-speed extension of MCAS.
    Mr. Larsen. Right.
    Mr. Muilenburg. We need to confirm that. We do know that he 
was working at that time on a simulator. At least our best 
understanding is that he was at that time working on what we 
call an unqualified simulator. So it was a newer simulator that 
was being brought up to standard. It was not yet at a position 
where it fully represented the airplane, itself. And----
    Mr. Larsen. Would he have known that? Was he supposed to 
have known that?
    Mr. Muilenburg. He----
    Mr. Larsen. Why----
    Mr. Muilenburg. Yes----
    Mr. Larsen. And why was he----
    Mr. Muilenburg. He knew that he was----
    Mr. Larsen. Why was----
    Mr. Muilenburg [continuing]. He was operating--again, our 
understanding here; we haven't talked directly to him--our 
understanding is that he was in a simulator development 
process. And it appears from his comments that he was surprised 
about some feature. Having spent some time in simulators, it is 
not uncommon for us to have to work on the software to get it 
to be fully representative of the airplane, over time.
    Now, regarding the paper trail on that simulator, I don't 
know if we have any details on that, but we can follow up.
    Mr. Larsen. And we will follow up. I am over my time, and 
there are other Members. We will follow up with that.
    Mr. Muilenburg. I----
    Mr. Larsen. So thank you. I got to say thanks.
    Mr. DeFazio. I would like to recognize----
    Ms. Davids. Thank you, Chairman.
    Mr. Muilenburg, I would like to talk to you about the AOA 
disagree alert, and that Boeing recently admitted that the AOA 
disagree alert on the 737 MAX that was supposed to be a 
standard feature on all MAX planes was inoperable on MAXes 
where they didn't purchase the optional AOA indicator.
    And it seems as though about 20 percent of the MAX 
airplanes purchased, the AOA indicator--so the AOA disagree 
alert was inoperable on 80 percent of the aircrafts. Does that 
sound right to you?
    Mr. Muilenburg. Congresswoman, I can't give you the exact 
number, but it was correct that it was not implemented 
correctly. We made a mistake on that, and we discovered that. 
Our engineers discovered it, and we have subsequently----
    Ms. Davids. OK, that is----
    Mr. Muilenburg [continuing]. Made that fix.
    Ms. Davids. That is good for now.
    Mr. Muilenburg. And all our airplanes will have that 
standard, going forward----
    Ms. Davids. When did Boeing learn that the AOA disagree 
alert wasn't operable on that 80 percent of the aircrafts?
    Mr. Muilenburg. Congresswoman, I can get back to you with 
the exact timelines, but it was--I don't want to guess on the 
exact timelines, but it was----
    Ms. Davids. OK, when did you personally----
    Mr. Muilenburg [continuing]. Discovered by our engineers, 
and then it was----
    Ms. Davids. When did you personally learn about it?
    Mr. Muilenburg. I just don't recall the exact timelines. I 
do know that there was a lag between our discovery and it being 
reported to the FAA. And again, that is----
    Ms. Davids. Was there a lag between the discovery and your 
finding out, and then the FAA finding out?
    Mr. Muilenburg. Congresswoman, the communication timeline 
on the AOA disagree alert was too long. The communications were 
not done the way we should have done them. And that is one of 
the reasons we have revised our review board structures.
    Ms. Davids. So--I agree with you, that it was too long.
    I also want to just note the issue of candor that 
Congressman Allred brought up as it relates to the 
communications that Boeing had with the regulators and its 
customers and, thus, the flying public.
    So it was only after the Lion Air accident, as I understand 
it, when Boeing learned of the defect. It waited 3 years--you 
waited 3 years, until 2020, to actually fix the problem.
    Mr. Hamilton. So, Congresswoman, in 2017 is when we 
identified the discrepancy. We immediately convened a review 
board to understand whether or not it was a safety issue or 
not. We analyzed it, and determined it was not critical for 
safety of flight. We notified the FAA just after, I believe, 
the Lion Air accident. The FAA independently convened their own 
safety board, and----
    Ms. Davids. So before you--you continued to manufacture the 
MAX and distribute it to the customers. Did you--at that time 
were you providing these MAX aircraft to--with a known defect 
to your customers without telling them that?
    Mr. Hamilton. Congresswoman, yes, the airplane did not 
conform to the spec that--the disagree was not working. I am 
not sure why we didn't notify the customers of that. But we----
    Ms. Davids. Who would have been the one to decide not to 
notify the customers?
    Mr. Hamilton. The----
    Ms. Davids. Was it your marketing team?
    Mr. Hamilton. No, it would have been----
    Ms. Davids. Was it----
    Mr. Hamilton. It probably would have been somebody on the 
engineering team on the 737 program.
    Ms. Davids. OK. So it might not be a safety critical thing, 
according to you, but this certainly raises ethical issues, I 
would say, and issues of candor, which we have been talking 
about.
    And I want to bring up--I think we have got a couple of 
slides here.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. OK, so this is the cover of the flight crew 
operations manual, or FCOM--lots of acronyms here--delivered to 
Lion Air in August of 2018. I want to note that this is 1 full 
year after Boeing learned that the AOA disagree alert on the 
737 MAX airplanes--that it didn't--which they didn't purchase 
the AOA indicator on, that it wasn't fully functioning, and 
that Lion Air didn't purchase the indicator on the disagree--I 
think I need the next slide.
    [Slide]

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Ms. Davids. The disagree alert was inoperative. So this 
shows the August 2017--that Boeing became aware that the 
disagree alert wasn't working. And it wasn't until after the 
Lion Air crash in October 2018 that they let the FAA know.
    I guess, regardless of whether or not you classify the AOA 
disagree alert as a safety feature or--a critical safety 
feature, it was required on the aircraft, was it not?
    Mr. Hamilton. It was part of our configuration spec. But 
there was no crew action associated when you get the disagree 
message. So it was for crew awareness.
    Ms. Davids. So you are saying it--so it was part of your 
what?
    Mr. Muilenburg. Congresswoman, it was part of the airplane 
baseline. It should have been implemented on the airplanes. It 
was not correctly implemented. We made a mistake.
    A sister safety review board was brought together, as John 
described. They came to the conclusion that they could 
implement that in the 2020 timeframe, in the next software 
cycle, as you referenced.
    Ms. Davids. How do you decide----
    Mr. Muilenburg. That did not get----
    Ms. Davids. How do you decide which things are baseline 
that you are not going to adhere to, and which ones you are?
    Mr. Muilenburg. Yes, Congresswoman, we missed on this one. 
We made a mistake. We made a mistake. And we have owned up to 
that. We need to fix it.
    Ms. Davids. OK.
    Mr. Muilenburg. One of the reasons----
    Ms. Davids. My time has expired. Hopefully we will get to 
ask you another question, because we, at some point, need to 
get to how we make sure, as legislators, that this doesn't 
happen again.
    I yield back.
    Mr. DeFazio. Representative Fletcher?
    Mrs. Fletcher. Thank you, Chairman DeFazio. I want to 
circle back to another topic that is related to information 
given to the operators, which is the pilot training following 
the Lion Air crash once there was a determination to work on 
the fix to the MCAS system.
    There is an ongoing conversation about what additional 
pilot training, if any, would be required. So I just want to 
make sure that I understand. I have a couple quick questions.
    Following the Lion Air crash, Boeing began developing a 
software update for MCAS, correct?
    Mr. Hamilton. Correct.
    Mrs. Fletcher. OK. And, as part of the software update 
process, does Boeing need approval of associated pilot training 
standards by the FAA's flight standard service?
    Mr. Hamilton. Not necessarily for that specific change at 
the time.
    Mrs. Fletcher. Well, it is my understanding that in 
December of 2018 Boeing met with the FAA's transport aircraft 
evaluation group to discuss and plan, evaluate, and validate--
--
    Mr. Hamilton. That was----
    Mrs. Fletcher [continuing]. The MAX, the system 
enhancements, correct?
    Mr. Hamilton. That was subsequent, yes.
    Mrs. Fletcher. And part of that conversation was that the 
FAA tasked Boeing with proposing pilot training related to the 
MCAS software fix that would be evaluated and documented in the 
FAA's flight standardization board report.
    What level of pilot training did Boeing propose to the FAA?
    Mr. Hamilton. That would have been level B training, which 
is a classroom or CBT, computer-based training, training.
    Mrs. Fletcher. Would it surprise you to learn that Boeing 
recommended level A training at that time?
    Mr. Hamilton. I am not aware of that.
    Mrs. Fletcher. You are not aware that Boeing recommended 
level A pilot training, instead of level B?
    Mr. Hamilton. No, I am not aware.
    Mrs. Fletcher. OK. Mr. Muilenburg, are you aware that 
Boeing recommended level A training instead of level B?
    Mr. Muilenburg. No, I am not aware of that.
    Mrs. Fletcher. Well, according to a letter from Boeing to 
the FAA, Boeing represented that, for the MCAS enhancement, 
level A training would only be required. And Boeing stated in 
the letter that its position, which--I have the letter here in 
front of me, and I am happy to present to you all--that Boeing 
believes that the rationale for the original recommendation was 
still applicable, and that Boeing believes there isn't a 
difference relating to the MCAS flight control law doesn't 
affect pilot knowledge, skills, abilities, or flight safety.
    Do you still believe that statement is true?
    Mr. Hamilton. With the software changes being made, it was 
going to prevent the MCAS from operating like it did in the 
accident flight. So yes.
    Mrs. Fletcher. You still believe that level A training 
would be the appropriate level of training?
    Mr. Hamilton. It--the software changes will prevent the 
pilots from ever seeing that type of condition again.
    Mrs. Fletcher. Do you understand that the FAA responded to 
that by saying that they didn't--they cautioned Boeing that 
level A training might not be the appropriate level of 
training, and that, while they were willing to evaluate the 
proposal, that Boeing was proceeding at its own risk?
    Mr. Hamilton. I am not familiar with that.
    Mrs. Fletcher. Mr. Muilenburg, are you familiar with that 
recommendation from the FAA, that to proceed with only level A 
training, Boeing would be proceeding at its own risk?
    Mr. Muilenburg. Congresswoman, I am not. But we can 
certainly follow up on that, and we will.
    Mrs. Fletcher. Thank you. It is my understanding that, 
following that exchange between the FAA and Boeing, that the 
FAA said that it would be OK to proceed with scheduled flight 
simulation tests.
    Are you aware of that part of the process, that flight 
simulator tests were scheduled?
    And do you know when those were, earlier this year?
    Mr. Hamilton. What timeframe are you referring to?
    Mrs. Fletcher. Well, the simulator tests were scheduled for 
March 13th, 2019. Are you familiar with those tests?
    Mr. Hamilton. I recall that there were some simulator tests 
done in Miami around that time, yes.
    Mrs. Fletcher. And what date did the Ethiopian Airlines 
crash take place?
    Mr. Hamilton. It was March--it was in March of----
    Mrs. Fletcher. March 10th, 2019, before the simulator 
tests.
    Thank you, Mr. Chairman. I yield back.
    Mr. DeFazio. I thank the gentlelady.
    I just want to--in response to a previous question I 
believe Mr. Hamilton said that the FAA was completely aware of 
the much-enhanced MCAS system.
    But the finding of the JATR was finding F2.7-A, ``The FAA 
was not completely unaware of MCAS; however, because the 
information and discussions about MCAS were so fragmented and 
were delivered to disconnected groups within the process, it 
was difficult to recognize the impacts and implications of this 
system. If the FAA technical staff had been fully aware of the 
details of the MCAS function, the JATR team,'' an independent 
group, ``believes the agency likely would have required an 
issue paper for using the stabilizer in a way that it had not 
been previously used. MCAS used the stabilizer to change the 
column force feel, not trim the aircraft. This is a case of 
using the control surface in a new way that the regulations 
never accounted for and should have required an issue paper for 
further analysis by the FAA. If an issue paper had been 
required, the JATR team believes it likely would have 
identified the potential for the stabilizer to overpower the 
elevator.''
    So there is a breakdown there, and we have just got to 
determine whether it was intentional, unintentional, how much 
of it lays on Boeing, and how much of it lays on the FAA. But 
in this case, they seem to be laying a lot of it on Boeing, and 
the communications.
    Mr. Brown had a quick clarification.
    Mr. Brown. Thank you, Mr. Chairman, I really appreciate it.
    Mr. Hamilton, again, you know, in my response to the 
questions about the flight control systems and the role of 
computer software, you offered up two examples: one is the yaw 
damper and the other is the auto pilot.
    These systems, both of them, as you know, are engaged by 
switches on the flight deck by the pilot. The switches and the 
operations are clearly documented in flight and training 
manuals. The crew knows when they are activated. In fact, I 
know that, at least in the case of the yaw damper, and maybe 
even the auto pilot, there is a warning light when it fails. 
Those systems are not in the same category as MCAS, which 
operates behind the scene.
    So I will just conclude by saying, at the moment, during 
the design, development, and promotion of MCAS, MCAS was the 
only computer software that operated the flight control systems 
without knowledge from the pilots or pilot input. And, for me, 
as a pilot, that is a big deal, and not just in hindsight, but 
at the moment, during the design, development, and promotion. 
It should have been a big deal to everybody involved.
    Thank you, Mr. Chairman. I yield back.
    Mr. DeFazio. I thank the gentleman, and I recognize the 
ranking member, Mr. Graves.
    Mr. Graves of Missouri. Thanks. I want to--just a point of 
clarification, as well, because there has been a lot of 
emphasis put on the AOA indicators in the cockpit, whether they 
should be in the cockpit or not in the cockpit.
    And there is a difference between an AOA indicator and an 
AOA sensor. And the AOA sensors in disagreement, obviously, had 
an impact on the MCAS system. But the AOA indicator in the 
cockpit--an AOA indicator isn't a primary flight system. It is 
not even a secondary flight system. In fact, in all my 
thousands of hours of flying, I don't think I have ever been in 
an airplane that has an AOA indicator in it.
    And there is a--there has been a lot of emphasis placed on 
these AOA indicators in the cockpit. And it is a little 
frustrating, because, to be quite honest with you, it--those 
are more for a maintenance reference than they are for--they 
are not a flight instrument, by any stretch.
    But with that, Chairman, I appreciate this hearing.
    Mr. DeFazio. I thank the gentleman. I am told that Ms. 
Davids has a brief question.
    Ms. Davids?
    Ms. Davids. Thank you, Chairman.
    So the certification process is my primary concern here, as 
a legislator, as a Member of Congress who sits on the T&I 
Committee. Our job is to create the framework under which 
regulations will be promulgated, that are going to be the 
things that keep the flying public safe.
    And I think that--the first thing I want to say is that 
this might be the first time in Boeing's history that we are 
facing a situation where the culture of the company's top 
management was controlled more by a profit motive because of 
short-term concerns than by the long-term business model that 
you keep bringing up of safety.
    Based on all of the things that we have seen here today, I 
am interested in figuring out how we make sure that, as we come 
up with that framework that might need to be reevaluated, 
whether it is the type certification, amended type 
certification, or, when we drill down into it, what gets into a 
manual or not, and how much pilot training is required.
    I have heard you say a number of times the system can be 
improved. And I am wondering if you have some specific areas 
that we, as legislators, need to be looking at.
    Mr. Muilenburg. Congresswoman, I appreciate that question. 
And while we have had some challenging questions today, I think 
we have a shared objective around safety of the aviation 
system.
    We believe there are several areas where we can work 
together. Some are on the regulatory front.
    We have discussed earlier things around design guidelines. 
Some of the longstanding industry standards, I think, need to 
be revisited.
    There are some regulations on the books that could be 
updated to take advantage of new technology.
    We believe pilot----
    Ms. Davids. What are those longstanding industry standards?
    Mr. Muilenburg. Pardon?
    Ms. Davids. What are the--what is a longstanding industry 
standard that you--
    Mr. Muilenburg. A good example are----
    Ms. Davids [continuing]. Specifically think that we need to 
look at----
    Mr. Muilenburg [continuing]. Are assumptions around pilot 
reaction times in various failure modes and scenarios.
    So, again, it gets to what we assumed on pilot reaction 
times, for example, in an MCAS failure scenario. We think it is 
time for us to--just to revisit those, from an industry 
standpoint, especially for digitally enhanced airplanes, going 
forward.
    We think there are opportunities for us to work together on 
talent development, the pipeline for future pilots and 
maintenance technicians----
    Ms. Davids. Do any of the longstanding industry standards 
that you think need to be looked at include things that, as a 
manufacturer, you would be in charge of?
    Mr. Muilenburg. Well, the----
    Ms. Davids. Because the two things that you mentioned have 
to do with pilot training.
    Mr. Muilenburg. The first one has to do with--actually, 
with design criteria.
    John, you wanted to----
    Mr. Hamilton. Yes, I think it is both. I think there is 
advisory circulars released by the FAA that should be updated.
    But then there is also our own internal guidelines and 
design guides that need to be updated to reflect what we are 
learning from these two accidents.
    Mr. Muilenburg. We have also updated our design 
requirements organization internally to do better cross-sharing 
across defense and military sectors. I think that is an area 
where the Government can help.
    I think investing in future simulation technology, taking 
advantage of virtual reality and augmented reality technologies 
to enhance pilot training opportunities is another area.
    The science of human factors, and how we----
    Ms. Davids. Do you----
    Mr. Muilenburg [continuing]. How we design for the future, 
another example.
    Ms. Davids. Do you think that--what about when it comes to 
type certification, and the improvements or advancements, 
technologically, that have been made?
    We have spent this whole time talking about the family of 
737s that got the original certification in 1967. Where is 
that--what do you think we need to be doing about making sure 
that, as lots of new technology and an entirely new system is 
being integrated into a aircraft, that we are doing our jobs to 
make sure that this doesn't happen again. Because you are 
talking about a lot of improvements that you are already 
making, but it sounds like we need to be making sure that the 
FAA, as regulators, know about those things before we run into 
a situation like this.
    Mr. Hamilton. Yes, I would recommend--and this is one of 
the JATR recommendations, is that the FAA work with industry on 
part 21, on the change product rule, and look--see if there is 
any enhancements that are required in that area.
    Ms. Davids. I yield back.
    Mr. DeFazio. And I believe this will be the last questions. 
Ms. Craig has not yet had an opportunity to ask questions, and 
I would recognize her.
    Ms. Craig. Thank you, Mr. Chairman. I know it has been a 
long day for the families of the victims here, and I just want 
to say my condolences to each of you, and thank you so much for 
being here.
    I have been in and out of this hearing almost all day 
today, and during a previous iteration of life, when I worked 
in business, you know, my job was in medical technology. And in 
that sector there is something called the MAUDE database. And 
if there is an early warning of an issue, we were required to 
report those things publicly. Our customers were required to 
report those things publicly. And many of the questions I have 
asked, as we have had a number of hearings with the FAA and 
with others, is how do we create, moving forward, a more 
robust, post-market reporting system for issues that occur.
    My first question, really, Mr. Muilenburg, is, in 
hindsight, when should you have grounded this plane?
    Mr. Muilenburg. Congresswoman, we have asked ourselves that 
question many, many times. And if we knew back then what we 
know now, we would have grounded it right after the first 
accident.
    If we could have saved one life, we would have done it. 
That is what we would have done.
    Ms. Craig. Mr. Muilenburg, I spent the last 4 years of my 
business career as the head of global HR for a Fortune 500 
company, and I have seen tough decisions firsthand from the 
inside.
    There has been a lot of conversation today about your 
compensation. And earlier this afternoon you indicated that, 
well, that is up to the board of directors. I pulled up the 
proxy statement from 2019, and did a little back-of-the-
envelope calculation.
    What I want to make sure is that the people who loved those 
who died, sitting in this room today, are assured by you that 
Boeing executives who now regret not acting and making 
decisions understand the pain that they are going through.
    My back-of-the-envelope calculation, just on the number of 
underlying stock options that you still have that are or are 
not vested, is that just in stock options--and I understand 
Boeing moved from stock options to performance-based RSUs and 
restricted stock. Many companies have done that.
    What I want to understand is that you are not going to 
personally benefit and profit over the swings in the stock 
price over this last year. Because if I look at Morgan 
Stanley's report, they expect, once these planes are 
ungrounded, your stock potentially to reach $500 a share. And I 
know that is a long way from there today.
    But you said earlier today that your board of directors 
makes compensation decisions. Back of the envelope, just in 
stock options, up to $500, you would have another $30 million. 
That is based on the price at $75.97 that those options were 
issued at. I understand how this works.
    If your board in February, when they meet to issue your 
performance grants and your restricted stock options, awards 
you stock options for the 2019 time period, will you commit to 
this committee and these family members sitting here today to 
decline those awards?
    Mr. Muilenburg. Congresswoman, we don't issue stock 
options. Just trying to--I want to answer your question.
    But our board will do a comprehensive review. They will 
make their decisions. It is not about the money for me, and it 
is--that is just not why I came to Boeing. And----
    Ms. Craig. That is why I said I understand you don't get 
stock options any more. The ones issued in 2013, you have got 
some that haven't vested. You are still going to get, like, 
millions of dollars from those. But when your board meets they 
could decide to give you performance-based RSUs this cycle, 
this time around. Or they could give you restricted stock 
units.
    Will you commit today to decline those awards if your board 
chooses to give them to you?
    Mr. Muilenburg. Congresswoman, I am anticipating that this 
year's annual bonus cycle is zero. That is not where I am 
focused.
    I didn't come to this company for money. That is not why I 
am here. And I--my board will do their work. But as I believe 
we already announced last week, we expect our annual bonus 
cycle to be a zero payout for our executives this year, and 
that starts with me.
    Ms. Craig. Thank you for being here, and thank you.
    Mr. Chairman, I yield my time.
    Mr. DeFazio. I thank the gentlelady.
    I ask unanimous consent that the record of today's hearing 
remain open until such time as our witnesses have provided 
answers to any questions that may be submitted to them in 
writing.
    And some were submitted here today by various Members, and 
we got a commitment that we would get answers on that. For 
instance, the displacement of any litigation to Indonesia, 
which I asked; questions that Mr. Graves asked; and others.
    I also ask unanimous consent that the record remain open 
for 15 days for any additional comments and information 
submitted by Members or witnesses to be included in the record 
of today's hearing.
    Without objection, so ordered.
    Again, I want to extend my condolences to the families, 
thank the witnesses for their testimony.
    And the committee stands adjourned.
    [Whereupon, at 3:27 p.m., the committee was adjourned.]


                       Submissions for the Record

                              ----------                              
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]


                                Appendix

                              ----------                              

        Questions from Hon. Peter A. DeFazio for Mr. Muilenburg

General Questions

    Question 1. Mr. Muilenburg, the last two new airplanes developed by 
Boeing, the 787 Dreamliner and the 737 MAX, have been the subjects of 
worldwide groundings. Before the 787 grounding, the last airliner type 
to be grounded was the DC-10 in 1979. What efforts has the company 
taken in response to both groundings to ensure future airplane designs 
do not have similar fates?
    Answer. After the 737 MAX grounding, Boeing initiated a review by a 
special board committee. That committee recommended several changes to 
our organization and processes designed to enhance safety culture of 
the company. These changes include:
    (1)  Creating a permanent Aerospace Safety Committee within our 
Board of Directors to oversee and ensure safe design, development, 
manufacture, maintenance, and delivery of our products and services;
    (2)  Creating a Product and Services Safety organization to review 
all aspects of product safety;
    (3)  Realigning the Engineering function within the company, so 
that engineers across Boeing will report directly to the Chief 
Engineer;
    (4)  Establishing a design requirements program to further 
facilitate the incorporation of historical design materials, data and 
information, best practices, lessons learned, and detailed after action 
reports to reinforce Boeing's commitment to continuous improvement;
    (5)  Enhancing our Continued Operational Safety Program to aid 
transparency and visibility of safety related issues; the Continued 
Operational Safety Program now will require the Chief Engineer's review 
of all safety and potential safety reports;
    (6)  To anticipate the needs of future pilot populations, re-
examining assumptions about flight deck design and operation in 
partnership with our airline customers and industry members;
    (7)  Expanding our Safety Promotion Center for employees to learn 
and reflect on our safety culture and renew personal commitments to 
safety;
    (8)  Expanding our anonymous safety reporting system to strengthen 
safety management systems within Boeing and our supply chain;
    (9)  Investing in new capabilities, including enhanced flight 
simulation and computing, and advanced R&D for future flight decks, as 
well as pilot and maintenance technician training and STEM education.

    Question 2. Mr. Muilenburg, the 737 fuselage is based on the 707 
fuselage introduced in 1958. The original 737 itself was type-certified 
in 1967. The trim wheel in the 737 MAX--an important part of the story 
of the 737 MAX crashes--also dates to the 1967 737 version. For more 
than 50 years this aircraft's type certificate has been amended 13 
times. Redesigns may save design and development costs, but they 
present challenges regarding upgrades to the safety of the aircraft. 
What sorts of challenges did re-designing the 737NG into the 737 MAX 
present and when will Boeing decide the 737 has had its day and that 
it's time to develop an entirely new single-aisle airplane?
    Answer. The certification of a derivative model aircraft is not 
necessarily less expensive, or less time consuming, than obtaining a 
new type certificate. For instance, the certification for the MAX took 
more than five years, which is longer than the process for some new 
type certificates. Each aircraft presents its own challenges. However, 
building upon existing, safe designs with a proven track record has 
continuously improved the safety record of the aviation industry for 
decades. As to future new-airplane development decisions, we make such 
decisions deliberately and methodically, after studying the market 
demand and the current state of technology, among many other factors.

FAA Emergency Airworthiness Directive

The day after Boeing issued its November 6, 2018, flight crew 
operations manual bulletin numbered TBC-19, the Federal Aviation 
Administration (FAA) issued its emergency airworthiness directive (AD) 
to owners and operators of 737 MAX airplanes. Like Boeing's bulletin, 
the emergency AD described how erroneously high angle of attack (AOA) 
inputs can cause ``repeated nose-down trim commands,'' with nose down 
trim increments ``lasting up to 10 seconds,'' which, if not addressed, 
could cause control difficulties and ``possible impact with terrain.'' 
As with the bulletin, there was no mention of MCAS whatsoever in this 
document issued to operators across the globe after the Lion Air flight 
610 accident.
    Question 1. Did Boeing work with the FAA to develop the FAA's 
emergency AD issued on November 7, 2018?
    Question 2. Did Boeing have any discussions with the FAA, written 
or oral, specifically about whether MCAS should be mentioned in this 
document?
    Question 2.a. If yes, why was MCAS ultimately excluded?
    Question 2.i. Did Boeing recommend or suggest that MCAS be 
excluded?
    Question 2.ii. If so, why did Boeing suggest MCAS be excluded from 
the FAA's emergency AD?
    Question 2.b. If no, why did you not discuss MCAS with the FAA in 
regard to the emergency AD?
    Answer. Boeing and the FAA worked closely together in developing 
both Boeing's Flight Crew Operations Manual Bulletin (``OMB'') issued 
on November 6, 2018, and the FAA's Emergency Airworthiness Directive 
(``AD'') issued the next day, on November 7, and were in agreement 
about the content of both issuances. Boeing also issued a fleet-wide 
message on November 10 that provided details regarding the MCAS 
function.
    Boeing issued the November 6 OMB to all owners and operators of 737 
MAX planes. The OMB called attention to the airplane effects and flight 
deck indications that could result from erroneous AOA data, including 
nose down stabilizer trim movement, and directed flight crews to 
existing procedures to address the condition. The OMB reinforced that 
implementation of the Runaway Stabilizer Non-normal Checklist, one of 
only a handful of procedures that pilots must commit to memory, was the 
appropriate response to uncommanded nose down stabilizer trim movement. 
The OMB also reminded flight crews of the importance of trimming out 
the airplane before turning off the electric stabilizer trim system, 
noting that ``[i]nitially, higher control forces may be needed to 
overcome any stabilizer nose down trim already applied,'' and that 
electric stabilizer trim can be used to neutralize control column pitch 
forces before moving the STAB TRIM CUTOUT switches to CUTOUT.'' The OMB 
advised operators to insert it into their Flight Crew Operations 
Manual, and provided that the OMB ``remains in effect until Boeing 
provides additional information on system updates that may allow this 
Bulletin to be canceled.''
    The same day Boeing issued the OMB, the FAA issued a Continued 
Airworthiness Notification, which advised that the MAX involved in the 
Lion Air incident ``appears to have experienced anomalies in the angle 
of attack, airspeed, and altitude indications.'' The Notification 
further explained that Boeing had issued the OMB to address the issue, 
and that the FAA was considering mandating the OMB.
    The FAA followed through with this action the next day (November 
7), issuing an Emergency Airworthiness Directive to mandate the 
guidance in Boeing's OMB. The AD required the information in the OMB to 
be added to all 737-8 and 737-9 Airplane Flight Manuals within three 
days. This information included the instruction, almost verbatim from 
the OMB, to follow the existing runaway stabilizer procedure if flight 
crews experience circumstances involving uncommanded downward trim 
commands. Like the OMB, the AD also referenced the possible need for 
flight crews to use electric stabilizer trim to overcome nose down trim 
already applied before activating the stab trim cutout switches. Boeing 
began complying with this AD by including a revised Airplane Flight 
Manual with delivered 737 MAX airplanes, and advised operators on 
November 8 that the revised Manual was available on the Boeing web 
portal.
    On November 10, responding to operator requests for additional 
information about the subject matter of the OMB and AD, Boeing sent a 
fleet-wide message to all 737 NG and MAX customers that provided 
technical details and operational information regarding the MCAS 
function.
    Boeing's interactions with the FAA in connection with the 
preparation and issuance of the OMB and AD reflected the Company's 
commitment to full transparency with the FAA and to acting in close 
coordination with regulatory authorities, and subject to their ultimate 
authority, on safety issues.

Boeing's Response Post-Ethiopian Airlines Flight 302 Accident

Mr. Muilenburg, at an April 29 press conference, you said that the AOA 
Disagree alert, which we learned was inoperative on most 737 MAX 
aircraft, ``is not something that drives pilot action.''
    Question 1. Are you saying that pilots would do nothing if their 
AOA Disagree alert illuminates?
    Question 2. How do you reconcile your comments with the Indonesian 
authorities' report released last month on the Lion Air crash 
indicating that without the alert's enabling, pilots could not document 
the issue, which may have helped maintenance staff identify the mis-
calibrated AOA sensor that triggered MCAS on Lion Air flight 610?
    Answer. Mr. Muilenburg was speaking about the fact that, at the 
time of the accidents, there were no specific pilot actions described 
in the Flight Crew Operations Manual for the situation when the AOA 
DISAGREE alert illuminated. We do not believe that the Lion Air report 
contains any contradictory information.
    At the time of the accidents, and of Mr. Muilenburg's statement, 
references to the AOA DISAGREE alert in flight crew manuals and 
procedures did not direct the crew to take any specific action in 
response to the alert activating, but instead directed the crew to 
other information present on the flight display. Thus, the Boeing 
flight crew manual at the time of the accident included a checklist for 
the AOA DISAGREE alert, which sets forth the procedures that flight 
crew should use in a situation in which the alert activates. That 
checklist did not specify any pilot action, but rather highlighted that 
if the alert is on, ``airspeed errors'' and the ``IAS DISAGREE alert'' 
(airspeed), as well as ``altimeter errors'' and the ``ALT DISAGREE 
alert'' (altitude), ``may occur.''
    These airspeed and altitude alerts are triggered independently of 
the AOA DISAGREE alert, and have their own prominent displays on the 
flight deck. Moreover, they have their own dedicated checklists that, 
unlike the then operative AOA DISAGREE alert checklist, do specify 
responsive crew action.
    When the MAX returns to service, all MAX airplanes will have an 
activated and operable AOA DISAGREE alert as a stand-alone, standard 
feature.

    Question 3. Mr. Muilenburg, at an April 29 press conference, you 
said that MCAS is ``not something that needs to be trained on 
separately. It's fundamentally imbedded in the handling qualities of 
the airplane. And so, when you train on the airplane, you're being 
trained on MCAS.''
    Knowing what you know now, do you stand by your comments?
    Answer. MCAS is an extension of the pre-existing Speed Trim 
function, which helps stabilize airplane speed by commanding stabilizer 
in the direction to oppose a speed change, and which has been used 
safely on 737 series airplanes for decades. As such, MCAS is part of an 
integrated flight control system, and its effects are embedded in the 
handling qualities of the airplane. Going forward, however, as Mr. 
Muilenburg testified, Boeing will provide additional information 
regarding the MCAS system as part of training for the MAX.

    Question 4. Given the two accidents involving unintended MCAS 
activation, do you now believe that pilots should have known about MCAS 
before flying a MAX? If so, why now and not then?
    Answer. In accordance with FAA regulatory guidance, flight training 
for all Boeing airplanes, including the 737 MAX, is designed to give 
pilots the knowledge, skills, and abilities necessary to safely operate 
each model on which they are licensed (or ``type-rated''). Boeing and 
the FAA coordinated closely over the course of several years in 
developing the necessary training requirements and flight manual 
content for the MAX. Since the accidents, the FAA and Boeing have 
worked together to develop additional MAX flight crew training, as well 
as flight manual content, that addresses the updates Boeing has made to 
MCAS. The inclusion of specific training and flight manual content on 
MCAS is consistent with the feedback Boeing has received from pilots 
and its customers, and reflects the additional knowledge and 
understanding that Boeing has gained as a result of these accidents.

    Question 5. Mr. Muilenburg, at an April 29 press conference, you 
stated MCAS was ``designed to provide handling qualities for the pilot 
that meet pilot preferences. We want the airplane to behave in the air 
similar to the previous generation 737's. That's the preferred pilot 
feel for the airplane, how it feels as they're flying it. And MCAS is 
designed to provide those kinds of handling qualities at high angles of 
attack.''
    If that was indeed the goal, would it have been advisable to inform 
pilots of potential MCAS malfunctions that would affect handling 
qualities or the feel for the airplane?
    Answer. In accordance with FAA regulatory guidance, flight training 
for all Boeing airplanes, including the 737 MAX, is designed to give 
pilots the knowledge, skills, and abilities necessary to safely operate 
the airplanes which they are licensed to fly. Boeing and the FAA worked 
together over multiple years to establish the appropriate training 
materials for the MAX. Since the accidents, Boeing and the FAA have 
worked together to develop additional MAX flight crew training, as well 
as flight manual content, that addresses the updates Boeing has made to 
MCAS.

    Question 6. Mr. Muilenburg, immediately after the Ethiopian 
Airlines crash, Boeing made clear it believed that the grounding of the 
737 MAX was unnecessary. In fact, media reports widely circulated your 
disagreement with the idea in your conversation with President Trump, 
and Boeing further stated on March 12 that ``based on the information 
currently available, we do not have any basis to issue new guidance to 
operators.''
    Do you agree with regulators' decisions to ultimately ground the 
737 MAX?
    Answer. Boeing supports the FAA's decision to ground the 737 MAX.

    Question 7. Did Boeing leadership ever consider issuing a service 
bulletin or requesting voluntarily that FAA ground the 737 MAX prior to 
the FAA's official grounding?
    Question 7.a. If Boeing did consider this, please provide 
specifics. When was this issue raised, under what circumstances, and by 
whom? Why was the ultimate decision made not to request that the FAA 
ground the 737 MAX and who at Boeing made that decision?
    Answer. Boeing does not have the authority to ground airplanes. 
Boeing does, however, provide civil aviation authorities and our 
airline customers with any relevant information we may receive or 
develop, so that they can make informed decisions on how to regulate 
aircraft operations.
    In its written response to Question #16 of the Committee's April 1, 
2019 request to Boeing, Boeing provided a detailed timeline of the 
actions taken by the company after the Lion Air accident through the 
date of the 737 MAX grounding, and we refer you to that response.

    Question 8. When did Boeing first learn about the FAA decision to 
ground the 737 MAX in U.S. airspace?
    Answer. Boeing learned about the grounding order on March 13, 2019.

    Question 9. If Boeing felt that the 737 MAX was safe enough to not 
warrant grounding, why was it then pursuing software changes to MCAS 
even before the Ethiopian Airlines crash?
    Answer. On November 6, after a week of intensive efforts to 
understand and analyze the accident sequence, a Boeing Safety Review 
Board (``SRB'')--Boeing's established process for evaluating in-service 
safety issues--determined that the crew workload effects of erroneous 
AOA input leading to activation of the MCAS function presented a safety 
issue, and also determined that appropriate pilot action could 
counteract the condition. That same day, Boeing issued an Operations 
Manual Bulletin (``OMB'') to the fleet calling attention to the 
airplane effects and flight deck indications of the condition, and 
directing flight crews to existing procedures to address it. Boeing 
also moved forward expeditiously to develop an update to the MAX's 
flight control computer software to eliminate the risk of erroneous AOA 
data leading to repeated MCAS activation.
    On November 7, 2018, a day after Boeing issued its OMB, the FAA 
issued an Emergency Airworthiness Directive (``AD'') requiring airlines 
to amend their Airplane Flight Manuals to include the OMB guidance. The 
FAA also convened multiple Corrective Action Review Board (``CARB'') 
meetings--the FAA's analog to Boeing's SRB process--starting in late 
November to evaluate issues relating to the airplane effects of 
erroneous AOA data and MCAS activation. Relying on the FAA's 
independent risk analysis, the CARB process largely concurred with 
Boeing's analysis of the safety issue and proposed risk mitigation 
approach--although the FAA did determine that that Boeing should 
implement the flight control computer software update more quickly than 
Boeing had originally proposed, an accelerated schedule the Company 
accepted. Referencing the FAA's independent risk analysis, an FAA CARB 
concluded in December 2018 that, as development of the software update 
proceeded, the MAX fleet could continue operating until the new 
software was implemented on the FAA-approved schedule.
    Implementing the revisions to the MAX's flight control computer 
software is a complex task, and the Company has been and remains 
committed to proceeding carefully and deliberately. Throughout this 
process, Boeing has closely coordinated with the FAA (and other 
regulators) to ensure that the software update and related issues are 
evaluated thoroughly and comprehensively.

What Boeing Knew Then

You testified repeatedly before our Committee that had Boeing known 
what it knows now, the company would have made different decisions with 
regard to the 737 MAX. Specifically:

        In response to my question about why Boeing didn't design MCAS 
        from day one to use information from both AOA sensors, you 
        said, ``Mr. Chairman, we have asked ourselves that same 
        question over and over. And if back then we knew everything 
        that we know now, we would have made a different decision.''

        In response to Rep. Craig's question about when Boeing should 
        have grounded the plane, you said, ``Congresswoman, we have 
        asked ourselves that question many, many times. And if we knew 
        back then what we know now, we would have grounded it right 
        after the first accident.''

Before the Lion Air accident, Boeing was already aware that MCAS relied 
on just one AOA sensor, and according to documentation made public at 
the hearing, a Boeing engineer as far back as 2015 had already asked, 
``Are we vulnerable to single AOA sensor failure with the MCAS 
implementation or is there some checking that occurs?''

In addition, other documentation made public at the hearing established 
that Boeing was also already well aware, before the Lion Air accident, 
that if a pilot did not react to unintended MCAS activation within 10 
seconds, the result could be catastrophic.
    Question 1. What new information did Boeing learn only after the 
October 2018 Lion Air accident, that it didn't already know previously, 
with regard to the potentially catastrophic risk that a malfunctioning 
AOA sensor could have on the MAX due to its interaction with MCAS?
    Question 2. What new information did Boeing learn only after the 
March 2019 Ethiopian Airlines accident, that it didn't already know 
previously, with regard to the potentially catastrophic risk that a 
malfunctioning AOA sensor could have on the MAX due to its interaction 
with MCAS?
    Answer. In designing MCAS, Boeing relied on well-accepted, 
industry-wide assumptions in evaluating how pilots would react to the 
uncommanded activation of MCAS for any reason, including erroneous AOA. 
Those assumptions proved not to be accurate in these accidents. 
Accordingly, we now know that there is a greater risk from unintended 
activation of MCAS due to erroneous AOA data than we originally 
thought. Our system redesign addresses this issue.

Boeing CEO Bonus Pay

On November 5, 2019, it was reported that you were declining to take 
your bonus in 2019 and opting out of consideration for equity grants 
until the 737 MAX is back in the air. Yet, as of October 26, 2019, 
Boeing had already announced that it would not be paying annual bonuses 
to its management, executives, or unionized engineers and white-collar 
workers.
    Question 1. What 2019 bonus, if any, are you declining to accept 
that Boeing had not already determined that you would not be receiving?
    Answer. Mr. Muilenburg has requested that he not receive any bonus, 
either short- or long-term, for 2019. He has also requested that the 
Board not provide him any equity grants until the MAX returns to 
service globally. Mr. Muilenburg has also committed to donating the 
entire value of any previous equity grants that vest in 2020 to 
charity.

    Question 2. With regard to your opting out of consideration for 
equity grants, are you foregoing consideration for these equity grants 
until the 737 MAX is back in the air, or are you merely deferring 
consideration for these equity grants?
    Answer. Please see the response to the previous question.

    Question 3. How much was your bonus in 2018, the year of the Lion 
Air accident, and how much of it have you offered to return?
    Answer. Mr. Muilenburg's 2018 compensation is publicly available in 
Boeing's annual proxy statement, which can be found at www.boeing.com.

    Question 4. How much did you receive in equity grants in 2018, the 
year of the Lion Air accident, and how much of these grants have you 
offered to return?
    Answer. Mr. Muilenburg's 2018 compensation is publicly available in 
Boeing's annual proxy statement, which can be found at www.boeing.com.

Moving Lawsuits to Indonesia

In May, it was reported that Boeing had indicated in court filings that 
it was likely to request that cases on behalf of the victims of the 
October 2018 Lion Air accident involving the 737 MAX be moved to 
Indonesia. At the hearing, in response to questions from both Rep. Hank 
Johnson and me about whether Boeing plans to seek to move litigation 
filed on behalf of victims of the Lion Air accident from Chicago to 
Indonesia, you stated that you did not know the answer and would get 
back to our Committee with an answer.
    Question 1. Your answer also suggested this was an issue you had 
not been briefed on or involved in, in any way at Boeing. Now that you 
have had time to review records relevant to this question since the 
hearing, did you receive any briefings regarding Boeing's litigation 
strategy regarding the Lion Air accident in Indonesia?
    Question 2. Is Boeing planning to seek to move litigation filed on 
behalf of the families of victims of the Lion Air accident from Chicago 
to Indonesia?
    Question 3. Does Boeing have any reason to believe that if it loses 
this litigation, it will ultimately have to pay less to the plaintiffs 
if the litigation takes place in Indonesia as opposed to in the United 
States?
    Question 4. Are you aware of differences between the Indonesian 
legal system and the one we have in the United States including but not 
limited to the lack of a Seventh Amendment right to a jury trial, a 
right to a cross-examination of witnesses, and a requirement of 
discovery in Indonesia?
    Answer. In response to both MAX accidents, Boeing has offered to 
engage in mediations in the United States to resolve the families' 
claims without the need for any litigation. To facilitate this, Boeing 
arranged for a prominent Chicago mediator, a former Chief Judge of the 
Circuit Court of Cook County, to assist, and is paying the full costs 
of all mediations. Since the middle of July, Boeing has been working 
with the mediator and the families who lost loved ones in the Lion Air 
accident, to settle these cases. We are pleased to have resolved 
approximately one half of the claims filed in the United States on 
terms that we believe fairly compensate the victims' families. We 
remain committed to this mediation process. If, at some point and 
despite Boeing's best efforts, an impasse is reached in the mediation 
process, the litigation may resume. And at that point, well-settled 
U.S. law will give Boeing the option of requesting that the court 
determine whether another jurisdiction is the appropriate venue for 
such cases.
    Boeing is aware that there are differences between the litigation 
procedures available in the U.S. and those available around the world. 
United States courts have routinely found such foreign forums 
appropriate to handle aviation accident litigation in certain 
circumstances. All decisions in this litigation about forum will be 
decided by U.S. courts applying well-settled U.S. law.

           Questions from Hon. Rick Larsen for Mr. Muilenburg

    Question 1. I understand that when Boeing's attorneys met with 
Committee staff regarding Mr. Forkner's Instant Messages, Boeing was in 
the midst of investigating whether his reference to problems with MCAS 
in the simulator were actually problems with MCAS or with the simulator 
itself. Now that Boeing has had time to further investigate these 
issues, please provide the Committee with any supporting records 
indicating the problems that Mr. Forkner referenced were really 
problems with the simulator or conversely issues with MCAS itself.
    Please include a list of Boeing managers or employees and FAA 
managers and employees to whom Mr. Forkner reported these issues, 
whether MCAS- or simulator-related, and the actions taken to remedy the 
issues and provide supporting records to verify this correction.
    Answer. As you note, Boeing provided Committee staff with an 
extensive briefing on this topic. This included providing Committee 
staff with supporting records, including a discrepancy report for the 
simulator that closely matches the conditions described in the instant 
message, and documentation regarding the investigation and resolution 
of that discrepancy report. Our review remains ongoing; we have no 
additional documentation to provide at this time.

        Questions from Hon. Salud O. Carbajal for Mr. Muilenburg

    Question 1. In simulator tests, I understand that Boeing didn't 
even simulate erroneous MCAS activation to the full 2.5 degrees of 
stabilizer motion. Is that correct and if so please explain why that 
sort of simulation did not take place?
    Answer. This is not correct. Among other conditions considered 
during the MAX development process, Boeing simulated uncommanded MCAS 
operation to the maximum nose down stabilizer authority both before and 
after the expansion of MCAS to operate in low speed conditions. In 
early 2016, Boeing conducted simulator testing in an engineering 
simulator known as an eCab involving the uncommanded activation of MCAS 
to 3.0 degrees of nose down stabilizer motion, which at the time was 
the maximum authority at low speed.

         Questions from Hon. Sharice Davids for Mr. Muilenburg

    Question 1. Mr. Muilenburg, when and how did you learn that the AOA 
Disagree Alert on the 737 MAX was only functioning on aircraft that 
purchased the optional AOA Indicator? Please also include who informed 
you of that information and what you did in response.
    Answer. Mr. Muilenburg was not aware of the discrepancy between how 
the AOA DISAGREE alert was intended to function, and how it was 
delivered, until after the Lion Air accident. At that point, the Boeing 
Company took swift action to address this issue. Pursuant to the 
recommendations of a special board committee, the Boeing Company has 
revised its Board structure to ensure issues like this are brought more 
quickly to the attention of senior management.

    Question 2. Has Boeing taken any disciplinary action against any of 
the individual Boeing employees who were aware the AOA Disagree Alert 
was not functioning prior to the Lion Air crash and did not take any 
steps to either inform the FAA or your customers? If so, please 
describe what action Boeing has taken.
    Answer. As Mr. Muilenburg testified, our current focus as a Company 
is on doing everything possible to ensure the safe return of the MAX to 
service. We owe this to our customers and the flying public. That said, 
once the MAX is safely back in service, the time will come to consider 
further questions of accountability. And Boeing will not hesitate to 
hold people accountable, where appropriate.

    Question 3. Boeing's marketing brochures published after the FAA 
certified the 737 MAX in 2017 suggest that Boeing had expected the FAA 
to require more significant pilot training than FAA ultimately required 
for the MAX. Did the FAA's acceptance of Level B non-simulator training 
for the 737 MAX come as a surprise to Boeing?
    Answer. The determination of what training was appropriate for the 
MAX was a multi-year process between Boeing and the FAA. Boeing 
provides input into that process. However, commercial aviation is a 
highly regulated industry, and both manufacturers and customers know 
that the relevant civil aviation authorities ultimately decide what 
training is required.

     Questions from Hon. Sam Graves of Missouri for Mr. Muilenburg

    Question 1. How is Boeing working to develop procedures that are 
more tolerant of ``human factors'' or interactions between ``human and 
machine''? Is human performance currently a major consideration during 
the safety evaluation process?
    Answer. Boeing's design, analysis and evaluation approach is based 
on FAA guidance and published industry standards. Human performance is 
and will continue to be an important consideration in the evaluation of 
all Boeing airplanes. As part of the design and evaluation process, 
Boeing has Human Factors specialists, engineers, and pilots that 
consider the effects of cognition, perception, physical ergonomics, 
anthropometry, and human computer interface on Boeing's design. Boeing 
is in the process of re-evaluating our processes and assumptions 
regarding human factors as a result of information we have learned from 
the investigations into the MAX accidents. This review is not limited 
to the MAX.

    Question 2. It is Boeing's position that the MCAS was not hidden 
from FAA, customers, and pilots. In what ways did Boeing ensure MCAS 
was known and understood by all those parties?
    Answer. Boeing briefed the FAA and international regulators on 
numerous occasions about MCAS and its final design parameters. Although 
MCAS itself had been discussed in multiple briefings over many years, 
the meetings and information exchanges with regulators regarding MCAS's 
final design parameters began in mid-2016 and continued over subsequent 
months. The information provided to the FAA in these interactions 
included MCAS's maximum stabilizer authority of 2.5 degrees, as well as 
other aspects of the control law's functioning. For example, the use of 
MCAS at low speeds was included in briefing materials for meetings 
between Boeing and the FAA in July 2016, a revised certification 
deliverable submitted to the FAA in October 2016, and materials from 
validation meetings between Boeing staff and regulators in the fall of 
2016.
    In addition to these briefings, FAA personnel also observed the 
operation of MCAS during certification flight testing. Boeing and the 
FAA began certification flight testing of the 737 MAX 8 in August 2016. 
Multiple conditions involving MCAS activation were flown through 
January 2017. The objectives for these tests included demonstrating 
that the 737 MAX 8 had compliant maneuvering and handling 
characteristics in stall and near-stall conditions. The tests also 
evaluated whether the airplane could safely fly and land with various 
control system malfunctions or simulated failures. The conditions 
tested included MCAS's performance during low speed stalls, and during 
these tests, MCAS was activated nearly to the limit of its maximum 
stabilizer authority of 2.5 degrees. FAA personnel--including 
engineers, pilots, and at times both--were on board many of these 
flight tests to observe the performance of the flight conditions, 
including those involving MCAS. In some cases, FAA test pilots were at 
the controls and flew the relevant conditions. Boeing also provided the 
FAA with data of MCAS activating in low speed conditions.
    Descriptions of MCAS were included in presentations given to 
multiple customers at conferences for MAX customers, and Boeing 
received questions from customers about MCAS and its operation prior to 
delivery. Boeing did not hide information on the system, and provided 
information in response to those customer inquiries.

    Question 3. When the MAX and MCAS were being tested, what were 
Boeing's assumptions related to flight crews' reactions to erroneous 
MCAS function?
    Answer. As authorized by applicable FAA guidance, including FAA 
Advisory Circular 25-7C (``Flight Test Guide for Certification of 
Transport Category Airplanes''), in conducting their hazard 
assessments, Boeing's subject matter experts made a series of 
assumptions about how a flight crew would react if MCAS failed or did 
not function as intended. Consistent with established FAA guidance, 
this included the assumption that the crew would recognize and address 
uncommanded MCAS activation through normal use of the control column 
and the electric trim switches, and that the crew would also be able to 
use the stabilizer cutout switches and rely on manual trimming (as 
outlined in the Runaway Stabilizer Non-Normal Procedure) to stop any 
unintended stabilizer motion. Test pilots participated in the simulator 
testing of MCAS and had vital input into the hazard analysis.

    Question 4. How is Boeing working with customers, airlines, pilots, 
and regulators to address their concerns with the 737 MAX going 
forward?
    Answer. Boeing has taken extensive action to update the MAX flight 
control system, and to rebuild confidence with our customers, our 
regulators, and the pilots who fly our aircraft.
    We have made three key changes to the MCAS flight control software 
that will prevent accidents like these from happening again:
      The flight control system will compare inputs from both 
angle-of-attack sensors, and MCAS will not activate if the sensors 
disagree by 5.5 degrees or more.
      MCAS will no longer activate repeatedly. It will provide 
one input for each elevated angle-of-attack event.
      Finally, MCAS will never be able to command more 
stabilizer input than can be counteracted by the flight crew pulling 
back on the control column.
    Boeing has worked to update the MAX flight control software, we 
have been actively engaged with airlines and pilots throughout the 
process. As of November 26th, 2019, Boeing has conducted simulator 
sessions with 545 participants from 99 of our airline customers and 41 
global regulators to give them an opportunity to fly the new software. 
We have spent over 150,000 engineering and test hours relating to the 
MAX, and have flown more than 992 test and production flights.
    Boeing has been transparent with regulators in their review of the 
MAX, and, consistent with our culture, we have prioritized safety. The 
MAX will not return to service until the FAA and other global 
regulators have complete confidence that it is safe to do so.

   Questions from Hon. Garret Graves of Louisiana for Mr. Muilenburg

    Question 1. It does seem that Boeing, the Boeing ODA, and FAA did 
not always communicate well and had both lax as well as informal 
recordkeeping processes. Do you believe these processes need to be 
improved? If so, how would you propose to improve Boeing's 
communication and recordkeeping processes?
    Answer. As Mr. Muilenburg testified, Boeing believes these 
processes can and should be improved. The FAA requires extensive and 
detailed recordkeeping from ODA holders in order to enable the FAA to 
conduct compliance checks and audits of those ODA holders' performance. 
Boeing is consistently working to improve the performance of our ODA, 
and that includes our recordkeeping and our transparency with 
regulators.
    Boeing's ODA procedures manual, which is approved by the FAA, 
contains procedures to ensure certain communications between Boeing ODA 
unit members and the FAA are formally documented and managed. These 
procedures help ensure the ODA is properly following FAA guidance. 
Expanding this type of documentation requirement will help facilitate 
both safety and transparency.

    Question 2. Additionally, during the hearing I asked Mr. Muilenburg 
to provide the Committee with responses to the following questions:
    Question 2.a. After reviewing the recommendations of NTSB and 
others available as of the date of the hearing (October 30, 2019), 
please advise the Committee of any of those recommendations that Boeing 
does not concur with?
    Answer. Boeing is deeply committed to the safety of its products 
and the safety of the aviation system and value the role of the NTSB in 
promoting aviation safety. We do not oppose the recommendations from 
the NTSB to the FAA on September 26, 2019. Boeing has already 
undertaken steps that align with at least one of the NTSB's 
recommendations.
    The NTSB recommended that FAA require manufacturers to consider the 
way cockpit design can impact pilot reaction to alerts and alarms that 
may sound in non-normal situations.As a result of a recommendation from 
a special committee of Boeing's Board of Directors, the company is 
already planning to work with our airline customers to re-examine the 
way we design our cockpits, with the goal of helping pilots to 
prioritize their attention and their actions when faced with multiple 
alerts and alarms. Boeing is taking this step with the recognition that 
pilot training and experience can vary significantly in different 
regions of the world.

    Question 2.b. Provide an explanation of the specific changes Boeing 
is making to the 737 MAX to help us better understand the proposed 
fixes Boeing will submit to the FAA for recertification?
    Answer. Boeing has made 3 key changes to the MCAS flight control 
software:
      The flight control system will compare inputs from both 
angle-of-attack sensors, and MCAS will not activate if the sensors 
disagree by 5.5 degrees or more
      MCAS will no longer activate repeatedly. It will provide 
one input for each elevated angle-of-attack event.
      Finally, MCAS will never be able to command more 
stabilizer input than can be counteracted by the flight crew pulling 
back on the control column.
    In addition, working under the guidance of the U.S. Federal 
Aviation Administration, Boeing also addressed certain highly 
improbable scenarios involving the flight control computers on the 737 
MAX. The two flight control computers on each MAX airplane will now 
monitor one another continuously, known as ``cross-checking.'' This 
will further enhance the safety of the airplane.

    Question 2.c. Provide responses to the following recommendations 
made by the 737 MAX accident victims' families. Is Boeing willing to 
commit to----
    i.  Publicly disclosing the MCAS fix?
    ii.  Clearly defining the utility of MCAS?
    iii.  Addressing concerns that the culture within Boeing might have 
been prioritizing the wrong things?
    iv.  Ensuring that there were no efforts to conceal the MCAS and 
its role?
    v.  Ensuring that the entire airplane is viewed as an integrated 
system, as opposed to individual components where safety regulators may 
not be able to recognize their role in the larger system.
    Answer. Yes, Boeing is committed to keeping the public informed 
about the status of the enhancements being made to the MCAS system. 
Boeing has created a public website with information regarding the MAX 
to facilitate dissemination of information regarding the MAX. That 
website is located at http://www.boeing.com/737-max-updates/. Boeing is 
also committed to demonstrating the safety of the 737 MAX to regulators 
as well as the flying public, including the safety of its design and 
the improvements that have been made since the accidents. As Boeing has 
publicly stated, when the MAX returns to service, MCAS will compare 
inputs from both angle-of-attack sensors on the MAX, it will only 
activate one time per high angle-of-attack event, and MCAS will never 
command more stabilizer input than can be counteracted by the flight 
crew pulling back on the control column.
    In addition, Boeing is committed to safety as a core value of the 
company. Boeing has undertaken a number of structural changes to 
strengthen this commitment, including the creation of a permanent 
Aerospace Safety Committee within our Board of Directors, the creation 
of a new internal Product and Services Safety organization, and 
reorganization of the company's engineering function. These changes 
will enhance and amplify our focus on safety, strengthen our culture, 
and help to ensure that the safety of all our products are evaluated 
holistically.
    Boeing is also committed to ongoing transparency with FAA and 
international regulators, who were briefed on multiple occasions about 
the existence of MCAS, as well as MCAS's final configuration and 
operating parameters. During the certification process, MCAS was 
installed on the airplanes used for training-related flight testing 
that the FAA administered in August 2016. And FAA personnel observed 
the operation of MCAS in its final configuration during certification 
flight testing, beginning in August 2016 and continuing through January 
2017. Boeing is working hand-in-hand with regulators to return the 737 
MAX to service.

    Question 3. The Chairman read from a December 2015 email where a 
Boeing engineer asked: ``Are we vulnerable to a single AoA sensor 
failure . . . '' In what context was this email sent and what exactly 
is your understanding of the concern raised in the email? How was the 
concern addressed?
    Answer. The development of MCAS was an integrated effort involving 
numerous technical disciplines across Boeing. Multiple Boeing test 
pilots, as well as engineers across many different organizations, were 
involved in the development process and in the work of designing the 
function's operating parameters, developing test conditions, and 
evaluating the safety and efficacy of the design. Information was 
shared freely among the individuals and groups involved in these 
efforts, and the discussion of issues relating to the evolving design 
was robust.
    The referenced communication occurred during this design process. 
The issue raised in the quoted sentence was one among innumerable 
technical issues discussed during the design and development of the 737 
MAX. As Mr. Hamilton testified, he has discussed the general topic of 
MCAS's reliance on a single sensor with one of the engineers involved 
in this exchange. As Mr. Hamilton further testified, this communication 
reflects and demonstrates Boeing's open engineering culture, which 
encourages the robust discussion of technical issues and concerns as an 
integral part of the design process.
    Boeing engaged in a multi-step process for evaluating the potential 
safety considerations involved in the implementation of MCAS. At each 
stage of the design, development, and testing of MCAS, Boeing subject 
matter experts reviewed and evaluated the design change and its 
potential safety implications. The MCAS safety evaluation was 
consistent with applicable FAA guidance, including in relying on well-
accepted, industry-wide assumptions by Boeing's experts about how crew 
members would act or react to different scenarios involving uncommanded 
MCAS activation.

    Question 4. During the hearing, Mr. Hamilton stated that a version 
MCAS is implemented on the KC-46 tanker. Can you provide more details 
on the KC-46 tanker version of MCAS and the 737 MAX MCAS? Please 
describe any differences and the reason for those differences?
    Answer. A version of the MCAS control law was implemented on the 
KC-46 767 Tanker airplane. However, the architecture, implementation, 
and pilot interface of MCAS are different for the KC-46 tanker and the 
737 MAX.
    The 737 MAX MCAS function is an extension of the pre-existing Speed 
Trim System. This system resides in the Flight Control Computer (FCC), 
and helps stabilize the airplane speed by commanding stabilizer in the 
direction to oppose a speed change. This system has been used safely on 
737 series airplanes for decades. In adding MCAS to the 737 MAX, Boeing 
determined to utilize the existing speed trim system architecture, 
including use of a single sensor for AOA inputs, consistent with the 
fundamental airplane design principle of minimizing unnecessary changes 
to a sound and safe existing airplane design. With this design, the 737 
MAX was able to meet all design requirements, including those 
associated with the applicable functional hazard assessment hazard 
categories.

    Question 5. Were there differences between the final MCAS design 
and its original design requirements? The witnesses indicated that 
Boeing's MCAS design met FAA regulatory standards and Boeing's own 
design requirements. What were those standards and design requirements? 
On what basis was it determined that Boeing's MCAS design met FAA 
regulatory standards and Boeing's own design requirements?
    Answer. MCAS's design changed over time. Boeing developed and 
refined MCAS design requirements, including those requirements 
discussed by the witnesses, such as the requirements related to dive 
recovery and MCAS's interaction with the piloting of the airplane, that 
defined how MCAS would function in normal operation. MCAS, as 
originally certified, met those requirements for normal operations. 
Unless otherwise expressly noted in the requirements, the specific 
requirements were not intended to apply to abnormal operation or in 
failure conditions. To assess those situations, Boeing experts 
initially performed a thorough safety assessment for the initial MCAS 
design, which would activate only in high-speed conditions, with Boeing 
test pilots and engineers conducting a number of piloted simulator 
sessions in 2012 and 2013 to evaluate possible hazards. In March 2016, 
concurrently with developing the requirements for MCAS to operate at 
low speeds, Boeing subject matter experts--including both engineers and 
experienced pilots--conducted an additional targeted assessment of the 
potential hazards posed by MCAS's greater stabilizer authority at low 
speeds. In performing this assessment, Boeing's experts applied their 
engineering judgment and piloting experience to the existing safety 
analysis and data for the earlier MCAS design, and also considered new 
performance data generated through piloted simulator testing and 
computer analysis of MCAS's operation at low speeds.
    Boeing's subject matter experts had already concluded that MCAS's 
earlier design met all applicable functional hazard assessment 
thresholds. Based on their updated hazard analysis, Boeing's subject 
matter experts concluded at the end of March 2016 that the expanded 
version of MCAS also met all applicable requirements, and did not 
create any heightened risks beyond the earlier design.
    Among other conditions tested during the MAX development process, 
Boeing considered uncommanded MCAS operation resulting in unintended 
nose down trim to the maximum stabilizer authority for both the earlier 
and expanded MCAS designs. In March 2016, based on new simulator 
testing, Boeing experts assessed this condition as a ``Minor'' hazard 
when uncommanded operation of MCAS occurred at low speed in the normal 
flight envelope. This was a lower classification category than had been 
assessed for the uncommanded operation scenario for the earlier MCAS 
design, which had been active only in high speed, high G-force 
conditions. Based on this testing and analysis performed during the 
lengthy MCAS development process, Boeing's technical experts determined 
that the hazard classification categories for both the high-speed and 
expanded MCAS functionality satisfied all applicable regulatory and 
certification requirements.
    As authorized by applicable FAA guidance, including FAA Advisory 
Circular 25-7C (``Flight Test Guide for Certification of Transport 
Category Airplanes''), in conducting their hazard assessments, Boeing's 
subject matter experts made a series of assumptions about how a flight 
crew would react if MCAS failed or did not function as intended. This 
was the case for their hazard assessments of both the earlier and 
expanded MCAS designs. Consistent with established FAA guidance, this 
included the assumption that the crew would recognize and address 
uncommanded activation through normal use of the control column and the 
electric trim switches, and that the crew would also be able to use the 
stabilizer cutout switches and rely on manual trimming (as outlined in 
the Runaway Stabilizer Non-Normal Procedure) to stop any unintended 
stabilizer motion. Test pilots participated in the simulator testing of 
expanded MCAS and had vital input into the hazard analysis.

    Question 6. Boeing has stated that it assumed that pilots would 
react a specific way to repeated, unexpected nose down stabilizer trim 
inputs due to MCAS activation. Can you describe what assumption Boeing 
made in terms of how pilots would react and what actions they would 
take in response to repeated, unexpected nose down stabilizer trim 
inputs? What was the basis for this assumption?
    Answer. As authorized by applicable FAA guidance including FAA 
Advisory Circular 25-7C, in conducting their hazard assessments, 
Boeing's subject matter experts made a series of assumptions about how 
a flight crew would react if MCAS failed or did not function as 
intended. Consistent with established FAA guidance, this included the 
assumption that the crew would recognize and address uncommanded 
activation through normal use of the control column and electric trim 
switches, and that the crew would also be able to use the stabilizer 
cutout switches (as outlined in the Runaway Stabilizer Non-Normal 
Procedure) to stop any unintended stabilizer motion.

    Question 7. In January 2019, Boeing recommended Level A differences 
training (pilot training) accompany introduction of the MCAS updates. 
Please describe on what basis Boeing made this recommendation.
    Answer. In the wake of the Lion Air accident, Boeing and the FAA 
have carefully scrutinized the level and content of appropriate 
training for MAX pilots. Prior to the grounding of the MAX fleet on 
March 13, 2019, following the Ethiopian Airlines flight 302 accident, 
the FAA did not impose any additional training requirements for flight 
crews operating the existing MAX fleet, which still had the original, 
certified version of MCAS installed. The FAA and Boeing each 
independently deemed the issuance of the OMB and AD, combined with the 
existing training curriculum, sufficient to enable the safe operation 
of the fleet pending the implementation of updated flight control 
computer software, which Boeing began developing immediately after the 
Lion Air accident.
    Simultaneous with the development of that software update, Boeing 
and the FAA assessed potential additional training requirements for 
pilots who would operate MAX airplanes with the updated software, as is 
typical for such a design change. Boeing began working closely with the 
FAA starting in December 2018 to develop this training plan and 
associated evaluation testing.
    Responding to the FAA's request for a training proposal, Boeing in 
January 2019 initially recommended Level A differences training for the 
MCAS updates. Boeing noted in support of this recommendation that the 
``difference between the 737 NG and 737 MAX relating to the MCAS flight 
control law do[es] not affect pilot knowledge, skills, abilities, or 
flight safety.'' No specific differences training is required under the 
applicable regulatory guidance when this standard is met. Boeing 
nonetheless was proposing Level A training in response to ``customers' 
continued interest in the MCAS flight control law.'' Boeing also 
proposed a plan to substantiate the training proposal for the FAA, 
including the use of flight simulators to demonstrate various flight 
scenarios involving the updated MCAS functionality.
    Boeing worked expeditiously to complete its evaluation and approval 
plan, submitting the final plan to the FAA on February 11. The FAA 
accepted the plan, and agreed to Boeing's proposed date for simulator 
testing of March 13. The FAA expressed willingness ``to evaluate 
Boeing's proposal for Level A training,'' but also advised that the 
evaluation ``is proceeding at risk,'' meaning that the FAA could 
ultimately determine based on the evaluation results to require a 
higher level of training.
    The simulator testing took place as planned on March 13, using a 
test procedure agreed upon with the FAA. Representatives from the FAA--
as well as the European Union Aviation Safety Agency and Transport 
Canada--participated in the testing.
    The next day, March 14, the FAA sent Boeing its pilot training 
evaluation for the updated MCAS. The FAA noted that the Flight 
Standardization Board (``FSB'') for the MAX had determined that ``no 
pilot handling differences exist between the B-737 NG series and B-737 
MAX aircraft in normal and non-normal operation of MCAS.'' In the FAA's 
evaluation, ``[t]he NG and MAX aircraft handled the same and no 
aircraft device training is necessary.'' Nonetheless, the FAA 
explained, ``[t]he FSB determined that Level B training and checking is 
required to ensure pilot knowledge and retention of MCAS for initial, 
transition, upgrade, and recurrent [training].'' After describing the 
exhaustive test scenarios performed during the evaluation process, the 
letter concluded that ``level B training is provisionally approved'' 
pending certification of the MCAS updates.
    In accordance with the FSB's determination, Boeing provided the FAA 
a computer-based Level B training module for evaluation. The FAA FSB 
evaluated and tested this module on March 18, and the following day the 
FAA wrote to Boeing that the module ``satisfies the Level B training 
and checking requirement.'' On March 25, the FAA sent Boeing further 
written confirmation that ``[v]alidation of level B [computer-based] 
training met all knowledge, skills, and abilities required to fly the 
MAX.'' And on April 16, the FAA posted a draft FSB report for public 
comment, in which the FAA described the FSB's ``evaluation of the 
modified [MCAS] for training and checking differences determination,'' 
and stated that ``[t]he MCAS system was found to be operationally 
suitable.'' That draft report has not been finalized.
    Boeing's discussions with the FAA about pilot training for the MCAS 
updates have continued since the FAA's posting of the FSB's draft 
report in April. Boeing is committed to continuing to work with the FAA 
to ensure that pilots receive appropriate training to accompany the 
MCAS updates in connection with the MAX's return to service.

    Question 8. Earlier this year, it was discovered that in 2017 
Boeing learned that the AOA DISAGREE alert on the 737 MAX was not 
operable on all airplanes. What steps did Boeing take upon making this 
discovery? Did Boeing immediately inform the FAA and its customers? If 
not, why not?
    Answer. In 2017, within several months after beginning 737 MAX 
deliveries, engineers at Boeing identified that the 737 MAX display 
system software delivered by Boeing's supplier did not correctly meet 
the requirements relating to the AOA DISAGREE alert. Instead of 
activating the AOA DISAGREE alert on all MAX airplanes, as Boeing's 
requirements provided, the software activated the alert only if an 
airline selected the optional AOA indicator. When Boeing's engineers 
identified the discrepancy between the requirements and the software, 
Boeing followed its standard process for determining the appropriate 
resolution of such issues. That review, which involved multiple company 
subject matter experts, determined that the absence of the AOA DISAGREE 
alert did not adversely impact the safety, operation, or certification 
of the airplane. Accordingly, the review concluded, the existing 
functionality was acceptable until the alert and the indicator could be 
delinked in the next planned display system software update, scheduled 
for 2020.
    Shortly after the Lion Air Flight 610 accident on October 29, 2018, 
both Boeing and the FAA informed MAX operators that the AOA DISAGREE 
alert was available only if the AOA indicator option had been 
installed. In the discussions that followed, Boeing fulfilled several 
customer requests to implement the AOA indicator, and by extension the 
AOA DISAGREE alert, on their airplanes. Boeing also discussed the 
status of the AOA DISAGREE alert extensively with the FAA--including 
the software discrepancy identified in 2017 and Boeing's determination 
that the issue was not safety related. In close coordination with the 
FAA, Boeing convened a Safety Review Board in December 2018, which 
confirmed the prior determination that the absence of the AOA DISAGREE 
alert from certain 737 MAX flight displays did not present a safety 
issue. Boeing fully informed the FAA about this result and the 
underlying analysis. The FAA subsequently informed Boeing that it had 
convened a Corrective Action Review Board and reached the same 
conclusion that the AOA DISAGREE alert issue did not present an unsafe 
condition.
    Boeing determined shortly after the Lion Air accident to accelerate 
the AOA DISAGREE alert software update, and began the required software 
development. MAX customers were informed of this plan beginning in 
November 2018. As a result of these software development efforts, when 
the MAX returns to service, all MAX airplanes will have an activated 
and operable AOA DISAGREE alert.

           Questions from Hon. Brian Babin for Mr. Muilenburg

    Question 1. Would it be fair to say that you didn't inform pilots 
about MCAS because when there is an emergency in the cockpit, you want 
them to respond to the problem versus diagnose the problem? For 
instance, like when I am driving my car, and it's veering off the side 
of the road, I don't sit there and think, what is causing this, my 
first thought is to steer the car back into the lane. Is that a fair 
comparison?
    Answer. In accordance with FAA regulatory guidance, flight training 
for all Boeing airplanes, including the 737 MAX, is designed to give 
pilots the knowledge, skills, and abilities necessary to safely operate 
each model on which they are licensed (or ``type-rated''). This is not 
necessarily the same information that would be needed to diagnose 
particular types of failures, as the accepted training philosophy is to 
equip pilots to address the particular non-normal condition at issue, 
not diagnose the underlying cause of the failure. The priority in 
developing the pilot training curriculum is always on giving pilots the 
knowledge they need to safely fly the airplane.

    Question 2. How do other manufacturers from other countries certify 
their planes? Do they have something similar to delegation?
    Answer. Delegation is common in aviation systems throughout the 
world, though each regulatory authority handles delegation differently. 
For instance, the European Aviation Safety Agency also uses a system of 
delegation.

    Question 3. This committee clearly has a lot of concern about how 
Boeing prioritizes its safety versus its desire to make a profit and 
increase its stock price. Boeing has talked a lot recently about the 
recommendations that its board made, in what I see as an attempt to 
respond to that criticism and concern. On a day-to-day basis, how will 
those changes really lead to Boeing making safer airplanes?
    Answer. First and foremost, the changes Boeing has made will 
reinforce Boeing's safety culture. The Product and Services Safety 
organization will review all aspects of product safety, across the 
enterprise, ensuring that an independent organization within the 
company is responsible for reviewing safety concerns and allegations of 
undue pressure. It also enhances the presence of dedicated, safety-
related leadership and accountability within Boeing's corporate 
structure. Moreover, by realigning the engineering function so that 
each engineer reports to the Chief Engineer, we have ensured that all 
engineers report to technical staff. Finally, we are expanding our 
safety promotion center to disseminate safety-related information 
throughout Boeing's global workforce.
    In addition, Boeing is also re-examining flight deck design and 
operation assumptions, in coordination with the regulators, our 
commercial and defense customers, and other stakeholders. Pilot 
training and experience can vary across operators in a rapidly growing 
global aviation industry that faces pilot shortages in many regions, 
and new technologies have also caused design assumptions to evolve. 
Boeing will work with its partners to anticipate the needs of future 
pilot populations. That review will help us design flight deck 
interfaces that reflect the needs of the thousands of additional pilots 
needed in the coming decades.

    Questions from Hon. Jenniffer Gonzalez-Colon for Mr. Muilenburg

    Question 1. Mr. Muilenburg, given your statements on the values of 
Boeing including safety, quality, and integrity, why did it take so 
long for Boeing to alert the Federal Aviation Administration about 
internal concerns regarding the 737 MAX?
    Answer. Safety, quality, and integrity are at the core of Boeing's 
values. Boeing offers its employees a number of channels for raising 
concerns and complaints and has a rigorous process in place to ensure 
such complaints receive thorough consideration. If, after review, 
Boeing identifies a safety issue with a product or program, the issue 
is promptly reported to the FAA.

    Question 2. What steps has Boeing taken to change its internal 
culture to ensure that safety, quality, and integrity are put again at 
the forefront of focus at the company?
    Answer. After the 737 MAX grounding, Boeing initiated a review by a 
special board committee. That committee recommended several changes to 
our organization and processes, several of which will further enhance 
Boeing's strong safety culture. These changes include:
    (1)  Creating a permanent Aerospace Safety Committee within our 
Board of Directors to oversee and ensure safe design, development, 
manufacture, maintenance, and delivery of our products and services;
    (2)  Creating a Product and Services Safety organization to review 
all aspects of product safety;
    (3)  Realigning the Engineering function within the company, so 
that engineers across Boeing will report directly to the Chief 
Engineer;
    (4)  Establishing a design requirements program to further 
facilitate the incorporation of historical design materials, data and 
information, best practices, lessons learned, and detailed after action 
reports to reinforce Boeing's commitment to continuous improvement;
    (5)  Enhancing our Continued Operational Safety Program to aid 
transparency and visibility of safety related issues; the Continued 
Operational Safety Program now will require the Chief Engineer's review 
of all safety and potential safety reports;
    (6)  To anticipate the needs of future pilot populations, re-
examining assumptions about flight deck design and operation in 
partnership with our airline customers and industry members;
    (7)  Expanding our Safety Promotion Center for employees to learn 
and reflect on our safety culture and renew personal commitments to 
safety;
    (8)  Expanding our anonymous safety reporting system to strengthen 
safety management systems within Boeing and our supply chain;
    (9)  Investing in new capabilities, including enhanced flight 
simulation and computing, and advanced R&D for future flight decks, as 
well as pilot and maintenance technician training and STEM education.