[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]
THE BOEING 737 MAX: EXAMINING THE FEDERAL AVIATION ADMINISTRATION'S
OVERSIGHT OF THE AIRCRAFT'S CERTIFICATION
=======================================================================
(116-46)
HEARING
BEFORE THE
COMMITTEE ON
TRANSPORTATION AND INFRASTRUCTURE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
DECEMBER 11, 2019
__________
Printed for the use of the
Committee on Transportation and Infrastructure
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online at: https://www.govinfo.gov/committee/house-
transportation?path=/browsecommittee/chamber/house/committee/
transportation
___________
U.S. GOVERNMENT PUBLISHING OFFICE
40-697 PDF WASHINGTON : 2020
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
PETER A. DeFAZIO, Oregon, Chair
ELEANOR HOLMES NORTON, SAM GRAVES, Missouri
District of Columbia DON YOUNG, Alaska
EDDIE BERNICE JOHNSON, Texas ERIC A. ``RICK'' CRAWFORD,
RICK LARSEN, Washington Arkansas
GRACE F. NAPOLITANO, California BOB GIBBS, Ohio
DANIEL LIPINSKI, Illinois DANIEL WEBSTER, Florida
STEVE COHEN, Tennessee THOMAS MASSIE, Kentucky
ALBIO SIRES, New Jersey MARK MEADOWS, North Carolina
JOHN GARAMENDI, California SCOTT PERRY, Pennsylvania
HENRY C. ``HANK'' JOHNSON, Jr., RODNEY DAVIS, Illinois
Georgia ROB WOODALL, Georgia
ANDRE CARSON, Indiana JOHN KATKO, New York
DINA TITUS, Nevada BRIAN BABIN, Texas
SEAN PATRICK MALONEY, New York GARRET GRAVES, Louisiana
JARED HUFFMAN, California DAVID ROUZER, North Carolina
JULIA BROWNLEY, California MIKE BOST, Illinois
FREDERICA S. WILSON, Florida RANDY K. WEBER, Sr., Texas
DONALD M. PAYNE, Jr., New Jersey DOUG LaMALFA, California
ALAN S. LOWENTHAL, California BRUCE WESTERMAN, Arkansas
MARK DeSAULNIER, California LLOYD SMUCKER, Pennsylvania
STACEY E. PLASKETT, Virgin Islands PAUL MITCHELL, Michigan
STEPHEN F. LYNCH, Massachusetts BRIAN J. MAST, Florida
SALUD O. CARBAJAL, California, Vice MIKE GALLAGHER, Wisconsin
Chair GARY J. PALMER, Alabama
ANTHONY G. BROWN, Maryland BRIAN K. FITZPATRICK, Pennsylvania
ADRIANO ESPAILLAT, New York JENNIFFER GONZALEZ-COLON,
TOM MALINOWSKI, New Jersey Puerto Rico
GREG STANTON, Arizona TROY BALDERSON, Ohio
DEBBIE MUCARSEL-POWELL, Florida ROSS SPANO, Florida
LIZZIE FLETCHER, Texas PETE STAUBER, Minnesota
COLIN Z. ALLRED, Texas CAROL D. MILLER, West Virginia
SHARICE DAVIDS, Kansas GREG PENCE, Indiana
ABBY FINKENAUER, Iowa
JESUS G. ``CHUY'' GARCIA, Illinois
ANTONIO DELGADO, New York
CHRIS PAPPAS, New Hampshire
ANGIE CRAIG, Minnesota
HARLEY ROUDA, California
CONOR LAMB, Pennsylvania
CONTENTS
Page
STATEMENTS OF MEMBERS OF CONGRESS
Hon. Peter A. DeFazio, a Representative in Congress from the
State of Oregon, and Chair, Committee on Transportation and
Infrastructure:
Opening statement............................................ 1
Prepared statement........................................... 4
Hon. Sam Graves, a Representative in Congress from the State of
Missouri, and Ranking Member, Committee on Transportation and
Infrastructure:
Opening statement............................................ 6
Prepared statement........................................... 7
Hon. Rick Larsen, a Representative in Congress from the State of
Washington, and Chair, Subcommittee on Aviation:
Opening statement............................................ 7
Prepared statement........................................... 8
Hon. Garret Graves, a Representative in Congress from the State
of Louisiana, and Ranking Member, Subcommittee on Aviation:
Opening statement............................................ 8
Prepared statement........................................... 10
Hon. Eddie Bernice Johnson, a Representative in Congress from the
State of Texas, prepared statement............................. 153
Hon. Frederica S. Wilson, a Representative in Congress from the
State of Florida, prepared statement........................... 153
WITNESSES
Panel 1
Hon. Stephen M. Dickson, Administrator, Federal Aviation
Administration, accompanied by Earl Lawrence, Executive
Director, Aircraft Certification Service, Federal Aviation
Administration:
Oral statement of Hon. Dickson............................... 11
Prepared statement of Hon. Dickson........................... 13
Matthew Kiefer, Member, Technical Advisory Board:
Oral statement............................................... 16
Prepared statement........................................... 18
Panel 2
Edward F. Pierson, Former Senior Manager, Boeing, appearing in
his individual capacity:
Oral statement............................................... 72
Prepared statement........................................... 74
G. Michael Collins, Former Aerospace Engineer, Federal Aviation
Administration, appearing in his individual capacity:
Oral statement............................................... 113
Prepared statement........................................... 114
Mica R. Endsley, Ph.D., appearing on behalf of the Human Factors
and Ergonomics Society:
Oral statement............................................... 118
Prepared statement........................................... 120
John M. Cox, Chief Executive Officer, Safety Operating Systems:
Oral statement............................................... 133
Prepared statement........................................... 135
SUBMISSIONS FOR THE RECORD
Slides, Submitted by Hon. DeFazio:
Slide based on FAA's post-Lion Air ``Quantitative Risk
Assessment,'' Dec. 3, 2018
Slide based on United Airlines flight 232 crash of DC-10 on
July 18, 1989, in Sioux City, IA........................... 22
Slide based on crashes of 1989 USAir flight 5050 and 2008
Continental Airlines flight 1404........................... 22
Slide based on Boeing's MCAS ``Coordination Sheet,'' dive
recovery, June 11, 2018.................................... 59
Slide of letter from then-FAA Acting Administrator Dan Elwell
to Chair DeFazio regarding 737 MAX AOA Disagree Alert, July
11, 2019................................................... 66
Slide based on Boeing's MCAS ``Coordination Sheet,'' 10
seconds catastrophic, June 11, 2018........................ 68
Lists A and B, Submitted by Hon. DeFazio:
9/11/2015 EASA letter to FAA................................. 155
3/21/1997 Issue Paper........................................ 157
2/11/2015 FAA Letter to Boeing............................... 162
FAA-DeFazio--28834-28842 TAD Corrective Action Review Board
(CARB) Presentation Form................................... 165
FAA-DeFazio--28843-28860 Safety Review Board information..... 174
FAA-DeFazio--32891-32938 Presentation: BCA Airplane Programs,
Organization Designation Authorization Technical Review
Board...................................................... 192
Article of October 7, 2019, ``Airline Went Into Records After MAX
Crash, Engineer Says,'' by Bernard Condon, Submitted by Hon.
Perry.......................................................... 34
APPENDIX
Questions from Hon. Peter A. DeFazio for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration................. 241
Questions from Hon. Frederica S. Wilson for Hon. Stephen M.
Dickson, Administrator, Federal Aviation Administration........ 253
Questions from Hon. Andre Carson for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration................. 255
Questions from Hon. Brian K. Fitzpatrick for Hon. Stephen M.
Dickson, Administrator, Federal Aviation Administration........ 256
Questions from Hon. Paul Mitchell for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration................. 256
Questions from Hon. Peter A. DeFazio for G. Michael Collins,
Former Aerospace Engineer, Federal Aviation Administration,
appearing in his individual capacity........................... 257
Questions from Hon. Peter A. DeFazio for Mica R. Endsley, Ph.D.,
appearing on behalf of the Human Factors and Ergonomics Society 262
Questions from Hon. Frederica S. Wilson to John M. Cox, Chief
Executive Officer, Safety Operating Systems.................... 263
Questions from Hon. Conor Lamb to John M. Cox, Chief Executive
Officer, Safety Operating Systems.............................. 264
THE BOEING 737 MAX: EXAMINING THE FEDERAL AVIATION ADMINISTRATION'S
OVERSIGHT OF THE AIRCRAFT'S CERTIFICATION
----------
WEDNESDAY, DECEMBER 11, 2019
U.S. House of Representatives,
Committee on Transportation and Infrastructure,
Washington, DC.
The committee met, pursuant to notice, at 10:02 a.m., in
room 2167, Rayburn House Office Building, Hon. Peter A. DeFazio
(Chairman of the committee) presiding.
Mr. DeFazio. The committee will come to order.
I ask unanimous consent the chair be authorized to declare
recesses during today's hearing. Without objection, so ordered.
I ask unanimous consent the chair and ranking member of the
full committee be recognized for 10 minutes each during the
question rounds. Without objection, so ordered.
Before I begin, and similar to the previous hearing on the
737 MAX with the CEO of Boeing testifying in October, I want to
explain an administrative matter regarding some documents we
may use at today's hearing. I will be making two unanimous
consent requests in reference to two document lists, List A,
List B.
First, the documents contained on List B are marked
``Export Controlled''; apparently, FAA stamps everything Export
Controlled. We have been advised by House general counsel that
the Constitution provides ample authority for us to release
these documents. However, to prevent confusion with regards to
documents with Export Controlled markings on them, I will be
making unanimous consent requests regarding the release of
these documents pursuant to the Export Control Act.
Second, I will be making a unanimous consent request to
enter the documents on List A into the hearing record. This
list includes the Export Controlled documents on List B as well
as additional documents. We have made the ranking member's
staff aware of the documents from both lists. The documents
have been available to them.
And with that, I would ask unanimous consent that the
documents on List B be disclosed pursuant to 50 U.S.C. section
4820(h)(2)(B)(ii) because withholding such information is
contrary to the national interest. Hearing no objection, so
ordered.
In addition, I ask unanimous consent to enter all the
documents on List A into the hearing record. Without objection,
so ordered.
[Lists A and B are on pages 154-239.]
I now recognize myself for opening remarks.
I want to thank our witnesses for being here today. This is
the committee's fifth hearing on the design, development and
certification of the Boeing 737 MAX in response to two
catastrophic crashes that claimed 346 lives in the span of 5
months.
Once again, I would like to recognize the family members of
those killed, some of whom are here today, and our thoughts are
with you, as always. And we are here to ensure that the lives
of your family members were not lost in vain and without
response.
You can be sure this committee will continue to be
aggressive in our oversight efforts to determine what went so
horribly wrong and why, and we will not rest until we have
enacted legislation to prevent future unairworthy airplanes
from slipping through regulatory cracks and into airline
service.
In November 2018, a few days after a powerful system
running in the background of the 737 MAX called MCAS pushed
Lion Air flight 610 into an unrecoverable dive, the FAA issued
an emergency airworthiness directive that purported to inform
pilots on how to respond to an erroneous activation of MCAS,
while it actually never mentioned that system by name. In fact,
during the certification of the 737 MAX, Boeing actively pushed
the FAA to remove references to MCAS from the flight crew
operating manual, as revealed in the emails and instant
messages from Boeing executive Mark Forkner, which Boeing
initially failed to provide to the committee. The FAA accepted
Boeing's push, and Forkner went on to boast that he was ``Jedi
mind-tricking'' other civil aviation regulators around the
world to adopt the FAA's faulty decision.
But perhaps most chillingly, we have learned that shortly
after the issuance of the airworthiness directive, the FAA
performed an analysis that concluded that if left uncorrected,
the MCAS design flaw in the 737 MAX could result in as many as
15 future fatal crashes over the life of the fleet, with the
assumption, which is questionable, that 99 out of 100 flight
crews could comply with the airworthiness directive and
successfully react to the cacophony of alarms and alerts
recounted in the National Transportation Safety Board's report
on the Lion Air tragedy within 10 seconds. Such an assumption,
we know now, was tragically wrong, and it certainly did not
meet FAA's criteria of 10 to the minus 9.
Despite its own calculations, the FAA rolled the dice on
the safety of the traveling public and let the MAX continue to
fly until Boeing could overhaul its MCAS software. Tragically,
the FAA's analysis--which never saw the light of day beyond the
closed doors of the FAA and Boeing--was correct. And the next
crash, taking more lives, was 5 months later, Ethiopian
Airlines flight 302, March 2019.
The committee's investigation into the two 737 MAX crashes
was launched just days after the second accident in March. We
have received more than half a million pages of documents from
Boeing, the FAA, and other parties that staff continues to
analyze. And that does not even include numerous emails from
the FAA that we have requested. We just received a large batch
on Monday night in response to our April request. And others
have yet to be provided.
We have interviewed and spoken with FAA employees and
Boeing whistleblowers, among others. These documents, emails,
and interviews are crucial to our investigation, which has
uncovered a broken safety culture within Boeing and an FAA that
was unknowing, unable, or unwilling to step up, regulate, and
provide appropriate oversight of Boeing. The FAA failed to ask
the right questions and failed to adequately question the
answers that agency staff received from Boeing.
Our investigation has revealed that many of the FAA's own
technical experts and safety inspectors believe FAA's
management often sides with Boeing rather than standing up for
the safety of the public. Mr. Dickson, I have read your
testimony. I appreciate the tenor and the substance of your
remarks. I commend your commitment to cultivating a just
culture among FAA employees, and ensuring that they have the
analysis and tools necessary to make the right decisions in the
name of safety.
But our investigation to date has established that FAA
employees did not have the analysis and tools necessary to make
the right decisions in the case of the 737 MAX. These safety
specialists need your support. There is no imaginable situation
in which they should be jammed or subjected to end runs by
Boeing to their managers. I expect you and your subordinates to
back them up, to defend their reasonable decisions based on
technical evidence and mandated compliance with FAA regulations
on safety.
Boeing made egregious errors, including the furtive
implementation of MCAS while knowing it could present a
catastrophic risk. The FAA also failed to do its job. It didn't
provide the regulatory oversight necessary to ensure the safety
of the flying public. The FAA trusted, but did not
appropriately verify, key information and assumptions Boeing
presented to the agency about the MAX. And this was at a time
when Boeing's own employees, as we learned at our last hearing,
reported they perceived undue pressure from management.
We are trying to figure out what went wrong here, fix it
legislatively, and not ever allow something like this to happen
again. In that spirit, on this panel we will hear from
Administrator Steve Dickson and a member of the review panel
that is assessing remedial changes to the MAX design.
Mr. Dickson, as I said, I appreciate what I read in your
testimony about your approach for improved safety. But I will
still have some tough questions for you, and I hope to hear
from you about what the FAA has identified as faults and
failures in the certification of the MAX, the FAA process
generally, and what concrete steps you have taken to date to
correct them. I also appreciate your commitment that the 737
MAX will not take flight again until you and your employees
responsible for overseeing Boeing and certifying its MCAS
overhaul are 100 percent confident in its safety.
On our second panel we will hear from two former FAA and
Boeing employees as well as two well-respected experts in the
fields of aviation safety and human factors for their
perspectives on the faulty design. And we will hear from a
Boeing whistleblower, FAA whistleblower, and a former employee
of Boeing.
So therefore, I want to be certain, Mr. Dickson, that--I
worked for a number of years, and it was only after people died
in the ValuJet crash that I stripped FAA of its promotional
responsibility, which was an artifact from the dawn of the
commercial aviation era. And I want to be certain that that has
not crept back in.
If the industry needs promotion, the Commerce Department
can do it or they can do it themselves. You and your people are
there for one reason and one reason only, to assure the safety
of the flying public. And I look forward to your testimony
today.
[Mr. DeFazio's prepared statement follows:]
Prepared Statement of Hon. Peter A. DeFazio, a Representative in
Congress from the State of Oregon, and Chairman, Committee on
Transportation and Infrastructure
Thank you to our witnesses for being here today. This is the
Committee's fifth hearing on the design, development and certification
of the Boeing 737 MAX in response to two catastrophic crashes that
claimed 346 lives in the span of five months.
Once again, I'd like to recognize the family members of those
killed in these preventable crashes, some of whom are here today. Our
thoughts are with you all. We are here to ensure that the lives of your
family members were not lost in vain.
You can be sure this Committee will continue to be aggressive in
our oversight efforts to determine what went so horribly wrong and why,
and we will not rest until we have enacted legislation to prevent
future unairworthy airplanes from slipping through the regulatory
cracks and into airline service.
In November 2018, a few days after a powerful system running in the
background of the 737 MAX called MCAS pushed Lion Air flight 610 into
an unrecoverable dive, the FAA issued an emergency airworthiness
directive that purported to inform pilots on how to respond to an
erroneous activation of MCAS, while never actually mentioning that
system by name. In fact, during the certification of the 737 MAX,
Boeing actively pushed the FAA to remove references to MCAS from the
flight crew operating manual, as revealed in the e-mails and instant
messages from Boeing executive Mark Forkner, which Boeing initially
failed to provide to the Committee. The FAA accepted Boeing's push, and
Forkner went on to boast that he was ``Jedi mind-tricking'' other civil
aviation regulators to adopt the FAA's faulty decision.
But perhaps most chillingly, we have learned that shortly after the
issuance of the airworthiness directive, the FAA performed an analysis
that concluded that, if left uncorrected, the MCAS design flaw in the
737 MAX could result in as many as 15 future fatal crashes over the
life of the fleet--and that was assuming that 99 out of 100 flight
crews could comply with the airworthiness directive and successfully
react to the cacophony of alarms and alerts recounted in the National
Transportation Safety Board's report on the Lion Air tragedy within 10
seconds. Such an assumption, we know now, was tragically wrong.
Despite its own calculations, the FAA rolled the dice on the safety
of the traveling public and let the 737 MAX continue to fly until
Boeing could overhaul its MCAS software. Tragically, the FAA's
analysis--which never saw the light of day beyond the closed doors of
the FAA and Boeing--was correct. The next crash would occur just five
months later, when Ethiopian Airlines flight 302 plummeted to earth in
March 2019.
update on investigation
The Committee's investigation into the two 737 MAX crashes was
launched just days after the second accident in March, and we have
received more than half a million pages of documents from Boeing, the
FAA and other parties that my staff continues to analyze. And that
doesn't even include numerous emails from the FAA that we have
requested; we just received a large batch on Monday night in response
to our April request. And others are yet to be provided.
We have interviewed or spoken with FAA employees and Boeing
whistleblowers, among others. These documents, email and interviews are
crucial to our investigation, which has uncovered a broken safety
culture within Boeing and an FAA that was unknowing, unable or
unwilling to step up, regulate, and provide appropriate oversight of
Boeing. The FAA failed to ask the right questions and failed to
adequately question the answers that agency staff received from Boeing.
Our investigation has revealed that many of the FAA's own technical
experts and safety inspectors believe FAA's management often sides with
Boeing rather than standing up for the safety of the public. Mr.
Dickson, I have read your testimony and appreciate the tenor and
substance of your remarks. I commend your commitment to cultivating a
just culture among FAA employees--and ensuring that they have the
analysis and tools necessary to make the right decisions in the name of
safety. But our investigation to date has established that FAA
employees did not have the analysis and tools necessary to make the
right decisions in the case of the 737 MAX. These safety specialists
need your support. There is no imaginable situation in which they
should be jammed or subjected to end-runs by Boeing to their managers.
I expect you and your subordinates to back them up: to defend their
reasonable decisions based on technical evidence and mandated
compliance with FAA regulations in the interest of safety.
Boeing made egregious errors, including the furtive implementation
of MCAS while knowing it could present a ``catastrophic'' risk. The FAA
also failed to do its job. It failed to provide the regulatory
oversight necessary to ensure the safety of the flying public. The FAA
trusted, but did not appropriately verify, key information and
assumptions Boeing presented to the agency about the 737 MAX. And this
was at a time when Boeing's own employees, as we learned at our last
hearing, reported they perceived ``undue pressure'' from management.
purpose of hearing
We are striving to understand what went wrong here and what we need
to fix legislatively. Our goal is to prevent a future unsafe airplane
design from slipping through the cracks and exposing millions of
airline passengers to an unacceptable risk.
In that spirit, on our first panel, we will hear from FAA
Administrator Steve Dickson and a member of the review panel that is
assessing remedial changes to the 737 MAX design.
Mr. Dickson, I appreciate what I read in your testimony about your
approach to improving safety. But, I will have some tough questions for
you, and I hope to hear from you about what the FAA has identified as
faults and failures in the certification of the 737 MAX and FAA
processes generally--and what concrete steps you have taken to date to
correct them. I also appreciate your commitment that the 737 MAX will
not take flight again until you--and your employees responsible for
overseeing Boeing and certifying its MCAS overhaul--are 100 percent
confident in its safety.
On our second panel, we will hear from two former FAA and Boeing
employees as well as two well-respected experts in the fields of
aviation safety and human factors for their perspectives on the faulty
design of this airplane.
undue pressure
On our second panel we'll hear from an FAA whistleblower that
Boeing applied undue pressure on FAA managers to overrule those
managers' own safety engineers and experts on safety-critical matters.
According to information provided to the Committee, FAA safety
engineers determined that an uncontained engine failure on a 737 MAX
could send shrapnel through the rudder control cables. And in a high-
thrust, low-energy situation such as initial climb off the runway--or
even during the takeoff roll--the pilots would likely lose control of
the airplane. But the FAA dismissed this concern. We need to know why.
Chair Larsen and I wrote Administrator Dickson about this issue
early last month, and on Friday afternoon we finally received a
response. However, your response still doesn't explain how the
unanimous judgment of more than a dozen FAA safety experts was
overruled by a single manager. On what data was that manager relying? I
am glad that one of our witnesses on the second panel was directly
involved in the rudder cable issue while he was at FAA so we can get
his straightforward perspective on this issue based on his nearly three
decades of experience at the agency.
promotion of industry
In 1996, I pushed to remove the FAA's statutory mandate to
``promote'' the civil aviation industry following the ValuJet flight
592 accident. That's why I'm particularly concerned this investigation
has produced rumors that some people within the FAA either feel it's
their role to facilitate the U.S. aviation industry's agenda, or feel
pressure from outside or from above to do so.
I want Administrator Dickson's absolute assurance today that he and
Deputy Administrator Dan Elwell will clearly and frequently communicate
to the FAA workforce--and to the industry--that the work of every
single FAA employee must be in the service of one and only one
objective: preserving aviation safety.
Let the industry promote itself. If it needs help in that effort,
I'm sure the Commerce Department is happy to oblige. Your job,
Administrator Dickson, is to regulate. The only thing you should be
promoting is the highest possible level of safety.
Millions of lives are at stake. We have to get this right. We will
be changing the certification laws to ensure the 346 lives lost in
Ethiopia and in the Java Sea were not lost in vain.
I look forward to hearing from our witnesses about how we can
accomplish that goal. Thank you.
Mr. DeFazio. With that, I would yield to the ranking
member.
Mr. Graves of Missouri. Thank you, Mr. Chairman. I want to
add my comments and recognize the families and the friends of
the accident victims. We have not forgotten your losses. And I
am sure that we all share the same goal, and that is ensuring
that our system remains the number one system in the world and
the safest system in the world.
This is the fifth hearing on Boeing and the tragic
accidents that the committee has held in 8 months. In addition,
there are at least a dozen other reviews and investigations
that are ongoing. Some of them, I will say, have been completed
recently, and we are fortunate to have one of the
representatives from the Technical Advisory Board, or the TAB,
that is going to be with us today. And I am pleased that the
committee is going to hear from him on the TAB's ongoing work
to independently evaluate the Boeing software fix.
Collectively, I am confident that these expert reviews are
going to provide us with the insights that we need to keep our
aviation system the safest in the world. Today the majority has
invited the current FAA leaders to testify, and while they can
address the FAA's efforts since the two accidents, they were
not in charge for that 5 years between 2012 and 2017 when the
MAX certification process and approvals took place.
And until we hear from the officials that were in charge at
the time, then the investigation remains incomplete at best,
and at worst it looks like we are willing to overlook the past
administration's culpability in this matter. Now, having said
that, as I have said many, many times, should the
investigations reveal problems within the certification
process, then I think Congress can and they should act, or we
should act, accordingly.
We have to ensure that we have the benefit of all expert
reviews and investigations that are still underway, and focus
on the facts and the data from those reviews. And when it comes
to aviation safety, I do believe we have to leave out the
partisanship and the ``gotcha'' moments. And I know
Administrator Dickson and his team and the thousands of FAA
professionals are all dedicated to aviation safety and
improving any process that needs improvement.
And I look forward to hearing what the Administrator is
doing with the recommendations that have already been received
and his own observations since, within the last year, taking
leadership of the FAA. And I, along with the Republicans on
this committee, am committed to addressing any problems
discovered in the process and working with the chairman in a
very bipartisan effort.
And I have said this before, too, and it bears repeating.
As a professional pilot myself, I still believe that the FAA
remains the gold standard in the world for safety. Air travel
is the safest mode of transportation in history. And when the
FAA clears the 737 MAX to fly again, it is going to be safe to
fly. There is no doubt in my mind.
Working to ensure our aviation safety system improves is
always the right goal, and we have a responsibility to do that
together. And with that, I look forward to today's hearing, and
would yield back the balance.
[Mr. Graves of Missouri's prepared statement follows:]
Prepared Statement of Hon. Sam Graves, a Representative in Congress
from the State of Missouri, and Ranking Member, Committee on
Transportation and Infrastructure
Thank you, Mr. Chairman. I want to recognize the families and
friends of the accident victims. We have not forgotten your losses, and
I assure you we all share the same goal--ensuring our system remains
the safest in the world.
This is the fifth hearing on Boeing and the tragic accidents that
the Committee has held in eight months. In addition, there are at least
a dozen other reviews and investigations--some that have been completed
recently. We are fortunate to have a representative from the Technical
Advisory Board (TAB) with us today. I am pleased that the Committee
will hear from him on the TAB's ongoing work to independently evaluate
Boeing's software fix. Collectively, I am confident that these expert
reviews will provide us with the insights we need to keep our aviation
system the safest in the world.
Today the Majority has invited current FAA leaders to testify.
While they can address FAA's efforts since the two accidents, they were
not in charge between 2012 and 2017 when the MAX certification
processes and approvals took place. Until we hear from the officials in
charge at the time, the Majority's investigation remains incomplete at
best and at worst looks as if they are willing to overlook the past
Administration's culpability in the matter.
As I have said many times, should the investigations reveal
problems with the certification process, Congress can and should act
accordingly. However, we must ensure that we have the benefit of all
the expert reviews and investigations still underway and focus on the
facts and data from those reviews. When it comes to aviation safety, we
must leave out partisanship and avoid ``gotcha'' moments.
I know that Administrator Dickson, his team, and the thousands of
FAA professionals are all dedicated to aviation safety and improving
any processes that need improvement. And I look forward to hearing what
the Administrator is doing with the recommendations he has already
received and his own observations since taking over leadership of the
FAA.
I, along with all Republicans on the Committee, am committed to
addressing any problems discovered in the process and working with the
Chairman in a bipartisan fashion. I have said it before, and it bears
repeating, as a professional pilot I still believe that the FAA remains
the gold standard for safety. Air travel is the safest mode of
transportation in history, and when the FAA clears the 737 MAX to fly
again, it will be safe to fly. Working to ensure that our aviation
safety system improves is always the right goal. We have a
responsibility to do that together.
Mr. DeFazio. I thank the gentleman.
The subcommittee chair, Representative Larsen.
Mr. Larsen. Thank you, Chair DeFazio. My comments will be
relatively brief because I released a video statement
yesterday, and I commend folks to that video statement for my
full comments. But I do want to summarize it.
With today's hearing, the committee does reach another
milestone in its investigation. It is increasingly clear the
process by which the FAA evaluates and certifies aircraft is
itself in need of repair. Congress must reevaluate and improve
the current certification process to ensure the safety of the
flying public.
As this critical oversight work continues, the 346 lives
tragically lost in the Lion Air and Ethiopian Airlines crashes
will remain at the forefront of these efforts. Several of the
family members of the victims are here today, and I extend my
deepest condolences to you and your loved ones. Your advocacy
makes a difference.
The FAA must fix its credibility problem. Just like I asked
Boeing CEO Dennis Muilenburg at the committee's last hearing,
today I expect to hear from the FAA the three main mistakes the
FAA itself made regarding the 737 MAX, and the specific steps
the agency is taking to restore public confidence. I also look
forward to hearing about the TAB's progress as it looks over
the FAA's shoulder as the agency works on a return to service
decision.
From today's second panel, the two former Boeing and FAA
employees are providing an important perspective on
questionable management decisionmaking that seemed to
prioritize economic interests over public safety. Further, I am
interested in learning more from the safety experts on the
panel about the integration of human factors as aviation
technology becomes increasingly automated. Airplanes are
changing, but the Federal Government and certification is not
changing with those airplanes.
Though 2019 is coming to an end, the committee's
investigation is far from over. The committee will continue to
maintain safety as the guiding principle and use all available
tools to ensure the safety of the traveling public. With that,
thank you, and I yield back.
[Mr. Larsen's prepared statement follows:]
Prepared Statement of Hon. Rick Larsen, a Representative in Congress
from the State of Washington, and Chairman, Subcommittee on Aviation
Thank you, Chair DeFazio.
With today's hearing, the Committee reaches another milestone in
its investigation.
It is increasingly clear the process by which the FAA evaluates and
certifies aircraft is itself in need of repair.
Congress must reevaluate and improve the current certification
process to ensure the safety of the flying public.
As this critical oversight work continues, the 346 lives tragically
lost in the Lion Air and Ethiopian Airlines crashes will remain at the
forefront of these efforts.
Several of the family members of the victims are here today. I
extend my deepest condolences to you and your loved ones. Your advocacy
makes a difference.
The FAA must fix its credibility problem. Just like I asked Boeing
CEO Dennis Muilenburg at the Committee's last hearing, I expect to hear
the three main mistakes the FAA made regarding the 737 MAX and the
specific steps the agency is taking to restore public confidence.
I also look forward to hearing about the TAB's progress as it looks
over the FAA's shoulder as the agency works on a return to service
decision.
From today's second panel, the two former Boeing and FAA employees
are providing an important perspective on questionable management
decision-making that seem to prioritize economic interests over public
safety.
Further, I am interested in learning more from the safety experts
on the panel about the integration of human factors as aviation
technology becomes increasingly automated. Airplanes are changing, but
the federal government and certification is not changing with those
planes.
Though 2019 is coming to an end, the Committee's investigation is
far from over.
The Committee will continue to maintain safety as the guiding
principle and use all available tools to ensure the safety of the
traveling public.
Thank you, I yield back.
Mr. DeFazio. I thank the gentleman.
With that, I recognize the ranking member of the
subcommittee, Mr. Graves from Louisiana.
Mr. Graves of Louisiana. Thank you, Mr. Chairman.
First I want to thank the families for being at the hearing
today, our fifth hearing on the MAX. As I have said at every
previous hearing and I am going to say again today, your
efforts remind us that this is about people. It is not about
Government bureaucracy process. It is about people and safety.
And I want to thank you all for your advocacy efforts
throughout this process.
Mr. Chairman, we are on our fifth hearing today, and there
are extraordinary efforts underway to ensure that we are able
to extract every single lesson that we can from the 737 MAX
disasters. As some have noted, the ongoing investigations are
investigations that have completed:
The Special Committee of the Safety Oversight and
Certification Advisory Committee; the Joint Authorities
Technical Review, or the JATR; the Technical Advisory Board, or
the TAB; the Flight Standardization Board; Boeing board of
directors Committee on Airplane Policies and Processes; the
National Transportation Safety Board, the NTSB; this very
committee--the majority has an investigation underway. We have
the Department of Transportation's inspector general. We have
the Department of Justice criminal investigation. We have the
Securities and Exchange Commission investigation, and others,
and the Indonesian and the Ethiopian authorities as well. So
multiple investigations. A lot going on.
Today at this hearing we have the Administrator of the FAA,
and Mr. Dickson, thanks for being here. As I recall, you have
been on the job for 4 months. And so you are here to talk right
now about, I guess, path forward--where we are, what we have
learned, and path forward.
In the second panel we have a number of folks, including
quasi-whistleblowers. And I want to be clear: I am not being
derogatory. As I understand, they have not sought official
whistleblower status, but folks that sort of played that role
of whistleblowers. And so we have folks that were there,
intimately involved in the process, perhaps, and they are able
to shed some light on what was going on on the ground.
So we have someone, the Administrator, who is the current
Administrator and he has been there for 4 months. We have folks
that were involved in the process on the ground that are,
again, somewhat whistleblower status. What we do not have, and
what we have not had in any of these hearings, are the people
that actually made the decisions back when--this process when
the aircraft was being certified. There is a gap in this
hearing, and Ranking Member Graves and I have requested over
and over again that we fill that void.
Look. I can go through, and I can say all these acronyms,
and I can talk about all these investigations. But if we don't
have the full slate of understanding of what is going on here,
then we are at risk of making decisions that don't have the
full view. And I have no desire whatsoever to sit here and rub
somebody's face in the ground. I don't.
But I do, and I made a commitment to those folks and I am
going to fulfill it--I do want to make sure that we understand
everything that happened and we don't allow mistakes to be made
again. We need to learn from the mistakes, and we need to learn
from the successes, and we need to build upon both of those.
And so I do hope, as we continue this process, as we move
forward in this investigation, that we fill that void and we
understand what has happened every step of the way, and that we
are able to make decisions that truly yield the safest, the
absolute safest, aviation system possible, and that we are able
to ensure that passengers on airlines, domestic and foreign,
that they will continue to be flying on the safest means of
transportation available.
So I want to thank you again for being here. I want to
thank you and many folks behind you and under you for all of
the work that you all have done to get us to where we are. I
think everyone knows what our end zone is, what our end goal
is, and that is to ensure that we prevent and we work to
prevent, absolute perfection. And I look forward to hearing
your testimony as well as that of the second panel. I yield
back.
[Mr. Graves of Louisiana's prepared statement follows:]
Prepared Statement of Hon. Garret Graves, a Representative in Congress
from the State of Louisiana, and Ranking Member, Subcommittee on
Aviation
Thank you, Mr. Chairman, for calling today's hearing. I also want
to thank the families and loved ones of the victims of Lion Air Flight
610 and Ethiopian Airlines Flight 302 for being here. Your efforts
continue to remind us that this isn't about government and bureaucracy,
it's about people and safety.
This is our fifth Boeing 737 MAX-related hearing of the year, and
there are extraordinary efforts underway to ensure we extract every
lesson we can from the accidents. Those efforts include the
investigations of the Special Committee of the Safety Oversight and
Certification Advisory Committee, the Joint Authorities Technical
Review, the Technical Advisory Board, the Flight Standardization Board,
the Boeing board of directors committee on airplane policies and
processes, the National Transportation Safety Board, this committee's
majority's investigation, the Department of Transportation Inspector
General, the Department of Justice criminal investigation, the
Securities and Exchange Commission investigation, and the Indonesian
and Ethiopian authorities' investigations.
Today, we will hear from Administrator Dickson, who's been on the
job for four months, and a member of the Technical Advisory Board to
talk about what we've learned and the path forward. We will also hear
from some witnesses who have worked inside the certification system on
the ground.
No matter what angle you look at these issues from, safety is
everyone's end goal. I'm worried that the Majority's investigation
seems to be taking a turn in a direction I don't believe is helpful and
could be harmful to the shared goal of safety. It seems more and more
that the investigation is about trying to paint our aviation system as
corrupt or broken. I believe strongly that nothing can be further from
the truth. There's a difference between learning hard truths about
where we have fallen short or needing to improve and undermining a
system that has kept billions of people safe over the years. Let's make
sure we keep our system the safest in the world.
What we don't have today, and haven't had in any of these hearings
yet, are the FAA officials who made any of the decisions back when the
aircraft was being certified. That creates a gap in the hearing record,
and Ranking Member Graves and I have requested repeatedly that we fill
that void.
I am committed to doing everything we can to make sure we learn
from any mistakes, but if we don't have a full understanding of what
happened, then we're at risk of making uninformed decisions about how
to ensure we have the absolute safest system possible.
Mr. DeFazio. I thank the gentleman.
Before I begin my questions, I would observe we have been
asking since we received our first tranche of emails from FAA
and Boeing to interview career staff who are the people who
made the decisions at the FAA. And until recently, with the new
Administrator, we were being stonewalled and being told, no,
you can't talk to the line employees who raised concerns. You
can only talk to managers.
And that has changed with this Administrator, and we have
interviews scheduled with the people who actually made the
decisions. If we find that it went higher than that, we will
call those people. But we just spent 7 hours jointly,
Republican and Democratic staff, questioning the current head
of safety, who was there when this document was issued about
the probability of another crash, and says he wasn't aware of
that and he wasn't aware of anything that went on.
So I don't know how high up this went, and I think that is
one of the problems and that is one of the things we have got
to look at. I think most of these decisions were made by
captive regulator managers in the Seattle offices, and no one
in the national offices knew a damned thing about it. So we are
going to get to the bottom of this. And if it goes any higher
than that, we will have those people.
So with that, I will recognize myself for questions.
Mr. Graves of Missouri. Statements.
Mr. DeFazio. Oh, I forgot. Thank you. Thank you. Thank you.
Thank you. I got carried away there.
[Laughter.]
Mr. DeFazio. Mr. Administrator.
TESTIMONY OF HON. STEPHEN M. DICKSON, ADMINISTRATOR, FEDERAL
AVIATION ADMINISTRATION, ACCOMPANIED BY EARL LAWRENCE,
EXECUTIVE DIRECTOR, AIRCRAFT CERTIFICATION SERVICE, FEDERAL
AVIATION ADMINISTRATION; AND MATTHEW KIEFER, MEMBER, TECHNICAL
ADVISORY BOARD
Mr. Dickson. Thank you, Mr. Chairman. Good morning,
Chairman DeFazio, Ranking Member Graves, and members of the
committee. Thank you for inviting me here today to speak with
you about the Federal Aviation Administration's approach to
safety oversight, and to provide you with an update concerning
the Boeing 737 MAX.
With me today is Mr. Earl Lawrence, the Executive Director
of the FAA's Aircraft Certification Service since December of
2018.
When we fly anywhere in the world, we enjoy a certainty of
safety that is unrivaled in the modern transportation era. That
is because the FAA and the world's aviation regulators
understand that the success of the global aviation system rests
squarely on our shared commitment to safety and our common
understanding of what it takes to achieve it.
Together we have built a safety record that is the envy of
other transportation modes, the healthcare field, and others.
But we are humbled when our best efforts fail. On behalf of the
United States Department of Transportation and the FAA, I would
like to once again extend our deepest sympathy and condolences
to the families of the victims of the Ethiopian Airlines and
Lion Air accidents, and thank you for being here today.
Deputy Administrator Dan Elwell and I have met with the
family members and friends of those on board. We have seen
their pain, their loss, and it reaffirms the seriousness with
which we must approach safety every single day. That is why we
are working tirelessly to ensure that the lessons learned from
these terrible losses will result in a higher margin of safety
for the aviation industry globally.
For the 737 MAX return to service, the FAA fully controls
the approvals process and is not delegating anything to Boeing.
We will retain authority to issue airworthiness certificates
and export certificates of airworthiness for all new 737 MAX
airplanes manufactured since the grounding.
When the 737 MAX is returned to service, it will be because
the safety issues have been addressed and pilots have received
all the training they need to safely operate the aircraft. This
process is not guided by a calendar or schedule.
Actions that must still take place include a certification
flight test and completion of work by the Joint Operations
Evaluation Board, which will include pilot training needs.
Additionally, the FAA and the Technical Advisory Board, or TAB,
will review the final design documentation. Finally, I am not
going to sign off on this airplane until I fly it myself.
Today's unprecedented safety record was built on the
willingness of aviation professionals to embrace hard lessons
and to proactively seek continuous improvement. In addition to
this committee's investigation and other congressional efforts,
we welcome the scrutiny and recommendations from several
independent reviews.
Included in these are:
A Joint Authorities Technical Review, or JATR, that the FAA
launched to conduct a comprehensive assessment of the MAX
automated flight control system certification;
The TAB we initiated to conduct an independent review of
the proposed integrated system, training, and continued
operational safety determination for the aircraft--and as an
aside I would like to recognize and thank Mr. Matt Kiefer, to
my left here, also testifying here this morning, for his work
as a member of this board;
Recommendations from the NTSB and the Indonesian accident
report on Lion Air flight 610;
The DOT's inspector general audit of the 737 MAX
certification; and finally,
A report from the Secretary's Special Committee on Aircraft
Certification.
We believe that transparency, open and honest
communication, and our willingness to improve our systems and
processes are the keys to restoring public trust in the FAA and
the safety of the 737 MAX.
Now, beyond the 737 MAX, the FAA is committed to addressing
issues regarding aircraft certification processes not only in
the United States but around the world. These issues include:
Moving toward a more holistic versus transactional, item-
by-item approach to aircraft certification;
Integrating human factors considerations more effectively
throughout the design process; and
Ensuring coordinated and flexible information flow during
the FAA's oversight process.
We and our international partners must also foster
improvements in how aircraft are designed and produced, but
also on how they are maintained and operated. We at the FAA are
prepared to take the lead in this new phase of system safety.
Aviation's hard lessons and the hard work in response to
those lessons have paved the way to creating a global aviation
system with an enviable safety record. But we recognize that
safety is a journey, not a destination, and we must build on
the lessons learned, and we must never allow ourselves to
become complacent.
Thank you, and this concludes my statement, and I am happy
to take your questions.
[The prepared statement of Mr. Dickson follows:]
Prepared Statement of Hon. Stephen M. Dickson, Administrator, Federal
Aviation Administration
Chairman DeFazio, Ranking Member Graves, and Members of the
Committee:
Thank you for inviting me here today to speak with you about the
Federal Aviation Administration's (FAA) approach to safety oversight
and to provide you with an update concerning the Boeing 737 MAX. On
behalf of the United States Department of Transportation and everyone
at the FAA, I would like to, once again, extend our deepest sympathy
and condolences to the families of the victims of the Ethiopian
Airlines and Lion Air accidents. Deputy Administrator Dan Elwell and I
have met with the family members and friends of those onboard. In these
meetings, we have seen their pain, their loss, and it reaffirms the
seriousness with which we must approach safety every single day. That
is why we are working tirelessly to ensure that the lessons learned
from these terrible losses will result in a higher margin of safety for
the aviation industry globally.
Accompanying me here today is Earl Lawrence. Mr. Lawrence is the
Executive Director of the FAA's Aircraft Certification Service, where
he is responsible for type certification, production approval,
airworthiness certification, and continued airworthiness of the U.S.
civil aircraft fleet including commercial and general aviation
activities.
Status of the 737 MAX Return-to-Service
Safety is the core of the FAA's mission and is our first priority.
We are working diligently to ensure that the type of accidents that
occurred in Indonesia and Ethiopia--resulting in the tragic loss of 346
lives--do not occur again. The FAA is following a thorough process for
returning the 737 MAX to service. This process is not guided by a
calendar or schedule. Safety is the driving consideration. I
unequivocally support the dedicated professionals of the FAA in
continuing to adhere to a data-driven, methodical analysis, review, and
validation of the modified flight control systems and pilot training
required to safely return the 737 MAX to commercial service. I have
directed FAA employees to take whatever time is needed to do that work.
With respect to our international partners, the FAA clearly
understands its responsibilities as the State of Design for the 737
MAX. In September, we met with more than 50 invited foreign civil
aviation officials, all of whom have provided input to the FAA and will
play a role in clearing the 737 MAX for flight in their respective
nations. We are also conducting and planning a number of outreach
activities, including providing assistance to support foreign
authorities on return-to-service issues; maintaining transparency
through communication and information sharing; and scheduling meetings
for technical discussions.
As I have stated before, the FAA's return-to-service decision on
the 737 MAX will rest solely on the FAA's analysis of the data to
determine whether Boeing's proposed software updates and pilot training
address the known issues for grounding the aircraft. The FAA fully
controls the approvals process for the flight control systems and is
not delegating anything to Boeing. The FAA will retain authority to
issue airworthiness certificates and export certificates of
airworthiness for all new 737 MAX airplanes manufactured since the
grounding. When the 737 MAX is returned to service, it will be because
the safety issues have been addressed and pilots have received all of
the training they need to safely operate the aircraft.
Actions that must still take place before the aircraft will return
to service include a certification flight test and completion of work
by the Joint Operations Evaluation Board (JOEB), which is comprised of
the FAA Flight Standardization Board (FSB) and our international
partners from Canada, Europe, and Brazil. The JOEB will evaluate pilot
training needs. The FSB will issue a report addressing the findings of
the JOEB and the report will be made available for public review and
comment. Additionally, the FAA will review all final design
documentation, which also will be reviewed by the multi-agency
Technical Advisory Board (TAB). The FAA will issue a Continued
Airworthiness Notification to the International Community providing
notice of pending significant safety actions and will publish an
Airworthiness Directive advising operators of required corrective
actions. Finally, I am not going to sign off on this aircraft until all
FAA technical reviews are complete, I fly it myself using my experience
as an Air Force and commercial pilot, and I am satisfied that I would
put my own family on it without a second thought.
Oversight of Aircraft Certification
Safety is a journey, not a destination--a journey we undertake each
and every day with humility. Today's unprecedented U.S. safety record
was built on the willingness of aviation professionals to embrace hard
lessons and to proactively seek continuous improvement. The FAA both
welcomes and invites scrutiny of our processes and procedures. In
addition to this Committee's investigation, several independent reviews
have been initiated to look at different aspects of the 737 MAX
certification and the FAA's certification and delegation processes
generally.
The first review to be completed was one that the FAA
commissioned--asking nine other civil aviation authorities to join the
FAA in a Joint Authorities Technical Review (JATR) to conduct a
comprehensive assessment of the certification of the automated flight
control system on the 737 MAX. The JATR was chaired by former National
Transportation Safety Board (NTSB) Chairman Christopher Hart and was
comprised of a team of experts from the FAA, National Aeronautics and
Space Administration (NASA), and the aviation authorities of Australia,
Brazil, Canada, China, the European Union, Indonesia, Japan, Singapore,
and the United Arab Emirates. Never before have 10 authorities come
together to conduct this type of review. I thank the JATR members for
their unvarnished and independent review and we welcome their
recommendations.
The FAA also initiated a TAB made up of FAA Chief Scientists and
experts from the U.S. Air Force, NASA, and Volpe National
Transportation Systems Center. The TAB's task is to conduct an
independent review of the proposed integrated system, training, and
continued operational safety determination for the 737 MAX. The TAB
recently briefed me, and previously briefed this Committee, on their
progress and the status of Boeing's and the FAA's responses to the
return-to-service action items.
Last month, the FAA received recommendations from the NTSB and the
Indonesian National Transportation Safety Committee's accident report
on Lion Air Flight 610. We are carefully evaluating the recommendations
in both of these reports as we continue our review of the proposed
changes to the 737 MAX. Work also continues on the Department of
Transportation's Inspector General audit of the 737 MAX certification,
as well as this Committee's investigation and other congressional
reviews. Finally, we are also awaiting a report from the Secretary of
Transportation's Special Committee on aircraft certification. This
blue-ribbon panel was established earlier this year to advise and
provide recommendations to the Department on policy-level topics
related to certification across the manufacturer spectrum.
We believe that transparency, open and honest communication, and
our willingness to improve our systems and processes are the keys to
restoring public trust in the FAA and in the safety of the 737 MAX when
it is returned to service. The FAA is fully committed to addressing the
recommendations from all of the various groups reviewing our
certification processes. We will implement any changes that would
improve our certification activities and increase safety. It would be
premature, however, to discuss any changes concerning the FAA's
certification processes or FAA's personnel at any level before this
Committee's investigation and other ongoing reviews have concluded, and
we have a chance to carefully analyze their results and
recommendations.
Moving Forward
Beyond the 737 MAX, the FAA is committed to addressing issues
regarding aircraft certification processes not only in the United
States, but around the world. These issues include:
moving toward a more holistic versus transactional, item-
by-item approach to aircraft certification--taking into account the
interactions between all aircraft systems and the crew;
integrating human factors considerations more effectively
throughout the design process, as aircraft become more automated and
systems more complex; and
ensuring coordinated and flexible information flow during
the oversight process.
Yet, if we are to continue to raise the bar for safety across the
globe, it will be important for the FAA and our international partners
to foster improvements in standards and approaches not just for how
aircraft are designed and produced, but also how they are maintained
and operated. We at the FAA are prepared to take the lead in this new
phase of system safety. I see our strategy coalescing around four
themes: Big Data; Just Culture; Global Leadership; and People.
Big Data
The FAA must continue leaning into our role as a data-driven, risk-
based decision-making oversight organization that prioritizes safety
above all else. We do that by breaking down silos between organizations
and implementing Safety Management Systems supported by compliance
programs and informed by data. We look at the aviation ecosystem as a
whole, including how all the parts interact: aircraft, pilots,
engineers, flight attendants, technicians, mechanics, dispatchers, air
traffic controllers--everyone and everything in the operating
environment. The FAA is examining the data we have, identifying data we
may need, and looking for new methods for analyzing and integrating
data to increase safety.
Just Culture
In addition to the technical work required for truly integrated
data, a key enabler of a data-driven safety organization is a healthy
and robust reporting culture. A good safety culture produces the data
you need to figure out what's really happening. If we know about safety
concerns and we know where threats are coming from and how errors are
occurring, we can mitigate the risks and fix the processes that led to
those errors. A good safety culture demands that we infuse that safety
data into all of our processes from top to bottom--in a continuous
loop.
To be successful, a safety organization relies on a Just Culture
that places great value on front-line employees and those involved in
the operation raising and reporting safety concerns in a timely,
systematic way, without fearing retaliation. A Just Culture starts at
the top. It's something leadership has to nurture and support
everywhere in the organization. Employees have to see the results, see
what the data is showing, and see how the organization is using
analysis tools to identify concerns and errors and put actions in place
to mitigate them.
Global Leadership
Today, the U.S. aviation system is the safest, most dynamic and
innovative in the world, and we have the numbers to prove it. This is
largely due to these collaborative approaches to safety. An example of
the kind of collaboration and safety innovation we can use to lead the
global aviation safety system to even higher levels of performance is
Aviation Safety Information Analysis and Sharing (ASIAS). ASIAS is one
of the crown jewels of the aviation safety system in the United States.
It is unique in the world. Its purpose is to proactively discover and
mitigate emerging safety issues before they result in an incident or
accident.
ASIAS de-identifies airline and company proprietary data submitted
by a growing number of stakeholders in accordance with information
sharing agreements and governance protocols. This ensures a level of
protection for participants and protects against disclosure of a
specific flight crew or entity, which has helped to foster a culture of
trust within the ASIAS program and across stakeholder organizations. As
trust has developed, data access has increased and enabled advancements
in data analysis methodologies through more automated capabilities and
the fusing together of data streams that provide a 360-degree
perspective on safety issues. This ``fusion'' bypasses the limits
associated with analyzing data in separate silos of information,
provides insight from multiple integrated data sources, and enables
analysts to better understand the full context of safety events. ASIAS
works in partnership with the Commercial Aviation Safety Team (CAST)
that proactively mitigates risks thorough the voluntary adoption of
Safety Enhancements.
Over the years, the FAA has exercised a leadership role in the
promotion and development of global aviation safety. We have helped
raise the bar on safety standards and practices around the world
working with ICAO and other civil aviation authorities. We have an
opportunity to do even more. We are committed to expanding our efforts
with other authorities around the world and to fostering safety
standards and policies at ICAO to help meet the public's expectations
of the highest possible levels of safety globally, even in areas the
FAA does not regulate directly. Without safety as a foundation, we
cannot have a vibrant aviation industry in any country, much less
between countries. Our international air transportation network is a
tightly woven fabric that is dependent on all of us making safety our
core value.
People
We live in an incredibly dynamic time in aviation, with new
emerging technologies and capabilities transforming the NAS. But at its
core, a huge technical, operational, and regulatory agency like the FAA
is made of people--people who are driven to serve, people with
families, hopes and dreams, and most importantly, people who are
dedicated safety professionals. I have the utmost respect for the jobs
that they do every day, making sure our skies are safe and that the
operation of the system is efficient--and serves the public--as well as
it possibly can. It's now time to show the next generation of aviation
leaders what incredible opportunities lie ahead for them in our field,
both personally and professionally. It is the people who will innovate
and collaborate to take us to the next level of safety, operational
excellence, and opportunity.
Conclusion
Aviation's hard lessons and the hard work in response to those
lessons--from both government and industry--have paved the way to
creating a global aviation system with an enviable safety record. But
as I mentioned earlier, safety is a journey, not a destination. We have
achieved unprecedented levels of safety in the United States. Yet what
we have done in the past and what we are doing now will not be good
enough in the future in an increasingly interconnected world. We must
build on the lessons learned, and we must never allow ourselves to
become complacent.
Those lessons teach us that in order to prevent the next accident
from happening, we have to look at the overall aviation system and how
all the pieces interact. Time and again, it has been shown that
accidents happened due to a complex interaction of multiple issues.
Focus on a single factor will lead us to miss opportunities to improve
safety that come from regulators and industry raising the bar not just
in certification, but in maintenance and training procedures. That will
require truly integrated data and collaboration, enterprise-wide. When
our data--and our organizations--are kept in silos, we may miss
information that could provide an opportunity to make important safety
decisions that will improve processes or even prevent accidents
entirely. We have to be constantly learning from each other--regulator
and those we regulate--to help each other improve.
The United States has been, and will continue to be, the global
leader in aviation safety. We are confident that continuing to approach
this task with a spirit of humility, openness, and transparency will
bolster aviation safety worldwide.
This concludes my statement. I will be glad to answer your
questions.
Mr. DeFazio. Thank you, Mr. Administrator.
With that, Mr. Kiefer, your testimony.
Mr. Kiefer. Good morning, Chairman DeFazio, Ranking Member
Graves, and distinguished members of the committee. Thank you
for having me here today. It is an honor to be on the panel.
I would like to first start by expressing my condolences to
the families and the friends of those who lost their lives in
the Lion Air and Ethiopian Airlines accidents. Their memories
were with us on our team as we did our work.
My name is Matt Kiefer, and I currently work for the U.S.
Air Force Airworthiness Office. I have worked in the aviation
industry for over 25 years in the military and in the private
sector. This has included work in flight test, system design
and integration, systems engineering management, and systems
safety.
As an aerospace engineering officer in the Navy Reserve, I
am responsible for the Navy's part of a joint team that
performs combat forensics analysis on aircraft battle damage. I
am also an instrument-rated private pilot with over 600 hours
of flight experience.
I was asked by the FAA to participate on a team known as
the Boeing 737 MAX Technical Advisory Board, also known as a
TAB. This is an independent team of industry experts with no
past involvement in the 737 MAX development or certification.
Our team is made up of experts from various specialties,
including test pilots, aerospace engineers, and chief
scientists, with backgrounds in flight controls, flight
operations, simulators, human factors, computer systems and
software, flight standards, and systems safety. We were chosen
for our ability to take a look at the 737 MAX changes
objectively, with fresh eyes, because we are independent from
Boeing and the FAA certification effort of the aircraft.
Our team was tasked to examine and review the changes
Boeing is making to the 737 MAX flight control system, and make
recommendations back to the FAA as to the suitability of those
changes before the aircraft is returned to service.
Our team had our first face-to-face meeting with Boeing at
their facilities in Seattle in May, where we spent time working
with the Boeing engineering department. This meeting started
off with encouragement from the FAA and Boeing management to
dig deep into the systems and scrutinize the work that has been
done to develop the solutions to the problems that led to the
accidents, and give our unbiased opinion as to the suitability
of those fixes.
At this meeting, we started by learning about how the speed
trim and MCAS function, as well as having discussions on the
various failure modes of the system. We were then given indepth
debriefings on what happened with the two mishap aircraft,
including information on the Lion Air flight that occurred the
day before the first accident. After that, we were given
detailed briefings with good discussion on the changes that had
been developed for MCAS.
Our team was also given the opportunity to fly the 737 MAX
simulator at the Boeing engineering facility. Many of our team
members, both pilots and engineers alike, got the opportunity
to fly the simulator with the old software and with the new. We
were able to experience the accident scenarios and were able to
observe the aircraft behavior with MCAS operating properly as
well as how the aircraft handles with MCAS disabled.
During these meetings, which included multiple online
conferences and two face-to-face meetings at Boeing, our team
had the full cooperation of Boeing engineering and flight test
staff, as well as good participation from the avionics
subcontractor.
At the first face-to-face meeting, the team started to
develop action items that had been determined are necessary
before returning the aircraft to service. These action items
are being actively tracked by the TAB and with Boeing and the
FAA. All action items that the team made for return to service
have either been addressed and closed or are presently in work.
The TAB is still working with Boeing to accept products to
close the remaining action items. Once all this work is
complete, the TAB will present the final report to the FAA. The
TAB still has work to do to complete our assessment of the
changes to the Boeing 737 MAX systems, and are awaiting more
information on the development assurance, testing of the
software, final safety assessments, and final training for the
aircrew.
Pending the team's determination that the remaining review
results meet our expectations, our team feels that the changes
made to the flight control system of the 737 MAX should vastly
improve the safety of the aircraft, in keeping with the highly
successful safety record of the previous models of the Boeing
737.
Thank you, and I will be happy to answer any questions you
have for me.
[The prepared statement of Mr. Kiefer follows:]
Prepared Statement of Matthew Kiefer, Member, Technical Advisory Board
Good morning Chairman DeFazio, Ranking Member Graves and Members of
the Committee. Thank you for having me here, it is my honor to
participate on this panel today.
First I'd like to introduce myself. My name is Matt Kiefer and I
have been working in the aviation industry for over 25 years. In that
time I have worked in aircraft maintenance on fighter jet aircraft as
well as general aviation aircraft. I have worked as a flight test
engineer and been responsible for all flight test data acquisition at
an aircraft modification company as well as system design and
integration for aircraft modification programs. I have worked for the
U.S. Department of Defense as a lead systems engineer for a Navy
aircraft program and been responsible for system safety engineers
working across several different Air Force programs. I have also been
an Aerospace Engineering Officer for the Navy Reserve for over ten
years where I specialize in combat forensics analysis of aircraft
battle damage. Currently I am working in the Air Force airworthiness
office where I am responsible for some aspects of policy and manage the
division's computer systems to include the one that processes
airworthiness reviews. I am also a Lieutenant Commander in the Navy
reserve attached to an engineering unit that supports NAVAIR.
Additionally I am an instrument rated private pilot with over 600
flight hours in general aviation aircraft.
I was asked by the FAA to participate on a team known as the B737
MAX Technical Advisory Board otherwise known as a TAB. This is an
independent team of aviation industry experts with no past involvement
with the B737 MAX development or certification. Our team is made up of
experts from various specialties including test pilots, aerospace
engineers and chief scientists with backgrounds in flight controls,
flight operations, simulators, human factors, computer systems and
software, flight standards and safety. These experts come from the FAA,
NASA, the Air Force and the Volpe Center. We were chosen for our
ability to take a look at the B737 MAX changes objectively with fresh
eyes because we are independent from Boeing or the FAA certification
effort of the aircraft. Our team was chartered to examine and review
the changes Boeing is making to the B737 MAX flight control system and
make recommendations back to the FAA as to the suitability of those
changes before the aircraft is returned to service.
Our team started our work with some teleconferences where we became
acquainted with the Boeing team and the 737 MAX airplane and its
systems. We then had our first face-to-face meeting at the Boeing
facilities in Seattle in May where we spent time working with the
Boeing engineering department. This meeting started off with
encouragement from FAA and Boeing management to dig into the systems
and scrutinize the work that has been done to develop the solutions to
the problems that led to the two accidents and give our unbiased
opinion as to the suitability of those fixes.
At this meeting we started by learning more about how the speed
trim system and MCAS function as well as having discussions on various
failure modes with the system. We were then given in-depth debriefings
on what happened with the two mishap aircraft including information on
the Lion Air flight that occurred the day before the first accident.
After that we were given detailed briefings with discussion on the
changes that had been developed for MCAS.
Our team was given an opportunity to fly in the B737 MAX eCAB which
is the engineering development simulator at the Boeing engineering
facility. Many of our team members, both pilots and engineers alike got
an opportunity to fly the simulator with the old software and the new
software. We were able to experience the accident scenarios and were
able to observe aircraft behavior with MCAS operating properly as well
as how the aircraft handles with MCAS disabled.
Boeing engineers sat down with several of the engineers on our team
to go over the software development and certification for the flight
control system. These sessions consisted of deep dives on how MCAS was
developed as well as a look at how the changes are being implemented.
Time was also spent by some of the team members reviewing aspects of
the flight manual and training given to pilots of the B737 MAX.
During these meetings, which included multiple online conferences
and two face-to-face meetings at Boeing, our team had the full
cooperation of the Boeing engineering and flight test staff as well as
good participation from the avionics sub-contractor. After these
meetings, briefings and demonstrations the team gathered to assemble
our findings and recommendations. Some of these we have determined are
necessary before returning the aircraft to service. These
recommendations/action items are being actively tracked internally to
the TAB and with Boeing and the FAA. All recommendations that the team
made for return to service have either been addressed and closed or are
presently in work. The TAB is still working with Boeing to accept
products to close the remaining action items. Once all of this work is
complete the TAB will present a final report to the FAA.
There are four main changes to the B737 MAX flight control system
software that have been developed to prevent future accidents like the
ones that happened with the Lion Air and Ethiopian Air flights. They
include the following:
1. Angle of Attack (AoA) comparison--an addition to MCAS that will
now compare readings from both angle of attack sensors on the aircraft.
If there is a difference of more than 5.5 degrees the speed trim system
will be disabled. Also included in this change is something known as a
``mid- value select'' which uses data from both sensors together to
create a third input that will help to filter out any AOA signal
oscillatory failures or spurious sensor failures. This modification
will prevent MCAS from commanding nose down trim when a single AoA
sensor reports a false AoA as it happened in the two accident flights.
2. MCAS resynchronization--this change will account for manual
electric trim inputs made by the pilot while MCAS is activating. It
will track whatever input the pilot makes and return the pitch trim to
that setting when MCAS retrims back to normal.
3. Stab trim command limit--is an addition that will limit the
maximum nose down trim that the automatic flight control system can
command to prevent the pitch trim from reaching an uncontrollable
situation.
4. FCC monitors--software monitors have been added to the flight
control computers that will cross check pitch trim commands against
each other. If a difference is detected by these monitors the automatic
trim functions are disabled. This protection helps prevent erroneous
trim commands from a myriad of causes that could occur in the automatic
flight control system.
These design changes in the software that controls the automatic
pitch trim features including MCAS should prevent angle of attack
sensor failures from causing the pitch trim to operate when it should
not. Further, they should prevent the trim from activating erroneously
for other reasons as well.
I would like to note that all along through our team's progress we
have gotten nothing but assistance and courtesy from Boeing. At no time
have any of our members been pressured to reach any predetermined
conclusions nor were we encouraged to operate according to a timetable
or schedule. Conversely we have been told by the FAA and Boeing
leadership to emphasize safety and diligence in our research.
The TAB still has work to do to complete our assessment of the
changes to the B737 MAX systems as we are awaiting more information on
the development assurance, testing of the software, final safety
assessments and final training for aircrew. Pending the team's
determination that the remaining review results meet our expectations,
our team feels that the changes made to the flight control software in
the B737 MAX should vastly improve the safety of the aircraft, in
keeping with the highly successful safety record of the previous models
of the Boeing 737.
Mr. DeFazio. Thank you for your work and for your
testimony, and I expect there will be questions later.
Mr. Kiefer. Yes, sir.
Mr. DeFazio. With that, then, I would recognize myself for
the first round of questions.
Administrator Dickson, we know you weren't there. But
obviously, I expect that you and your staff have put a
substantial amount of energy into trying to determine what
happened and how it happened, as you are charged with making it
work right in the future.
So I have got to ask about this TARAM analysis, which was
done on December 3, 2018. Again, you weren't there. Mr. Bahrami
was there. He was head of safety. And he met with me and Mr.
Larsen and I can't remember who else might have been there, and
told us this was a one-off accident in February.
Yet this analysis, which I thought the staff was going to
put up, was--thank you--was available at that time. He
apparently says he was unaware of it. He knew there was such a
process, but he didn't know they had evaluated this plane and
this system. But this analysis says that--this is post-Lion
Air--that in the lifetime of these aircraft, in operation, they
predicted there would be a potential of 15 fatal crashes.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio [continuing]. I am not aware of any other
certified transport aircraft that has such an analysis. I mean,
the normal analysis is 10 to the minus 9. This far exceeds
that. And I question why, given this TARAM--and I don't know
where it went since it didn't go to the head of safety--why the
aircraft wasn't grounded once this analysis was done, as
opposed to allowing the plane to fly while Boeing worked on a
fix.
We have talked a lot about being a data-driven organization
with you and former Administrator Elwell when we had the second
incident, when the plane stayed up yet for another couple of
days, and the assumptions that were made here is only 1 out of
100 pilots wouldn't react properly and effectively in that 10-
second period. Yet in the two instances extant--well, there
were actually three. There was a triggering, which was
recovered, in Indonesia. Then there was a triggering which
wasn't recovered, and then Ethiopia. So we have essentially a
33-percent success rate. But even after the first, we had a 50-
percent success rate.
I am just wondering, I mean, in retrospect do you think it
should have been grounded after Lion Air, given this TARAM
analysis?
Mr. Dickson. Well, thank you for your question, Mr.
Chairman. And I will say at the outset, as you noted, I was not
at the FAA when this analysis was done. However, I want to
advocate for my people. And they need--we are a data-driven
organization, as you said, and I know this--with all due
respect, any indication that any level of accidents is
acceptable in any analysis is not reflective of the 45,000
dedicated professionals at the FAA, whether they are involved
in air traffic or aviation safety. So I want to make that
abundantly clear. That is absolutely our highest priority.
Having said that, the reason that we have the safest
airspace in the U.S. in the world has been through decades of
developing data systems and decisionmaking tools that will
allow us to make the best decisions, and prioritize in the
interests of safety.
So remember, the information that was available at the time
was we really didn't know what the root cause of the accident--
--
Mr. DeFazio. If I could, Mr. Administrator, I understand.
But I have only got 10 minutes, and I have at least a couple
other questions.
So OK, you are not going to say anything definitive. I
would hope you would look into the distribution----
Mr. Dickson. Of course.
Mr. DeFazio [continuing]. Of this TARAM. It didn't come to
the attention of the head of safety, he tells us, so I don't
know where it went or who had access to it and what they may
have advocated. I think it is a pretty critical thing. And
again, I am not aware of any other aircraft where this sort of
analysis has found something that is going to cause crashes
inevitably and been allowed to fly. I mean, it just doesn't
meet your standards. So I appreciate the fact that you are
going to look into that and refuse that.
Now, I want to ask, again, I am concerned about Boeing's
influence over--particularly, it seems like this all stops in
the regional offices. We will find out with further interviews
with FAA employees. But again, with 7 hours with Mr. Bahrami,
he is not aware of any of the issues we raised outside that
were--where decisions were made up in Washington State.
And there are two issues regarding lightning protection on
the 787, where the plane was certified for production with the
lightning protection. Boeing decided to strip the lightning
protection off, and after they produced 40 airplanes, they came
to the FAA and said, ``Oh, by the way, you certified it with
lightning protection. We have taken it off. We would like you
to change your decision that it is necessary.'' And again,
safety analysts objected, and they were overruled by a local
manager.
And then the rudder: The rudder issue was actually seven
safety analysts said, ``No, you need to relocate the rudder
controls,'' and we do have photos of what happens when you lose
rudder controls on an airplane, particularly on climb-out or at
a critical time. I wish the staff would put that slide up,
please, if they are listening. And that is a critical thing.
[Slides]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]>
Mr. DeFazio [continuing]. And they were upheld at two
levels of review. So in total, we had 14 people at the FAA say,
they should relocate or better protect the rudder controls in
the wing, given this large new engine and the potential for
uncontained failure and fragmentation. And they were overruled
by a single manager, apparently again at the local level.
This causes concern on my part, that there doesn't seem to
be--and we haven't found yet--that there are levels of review
beyond the local office. Are you going to be looking at that
issue or problem as part of a solution?
Mr. Dickson. Yes. Well, thank you for the question, Mr.
Chairman. And I think that it is important to understand that
as we work through these processes and when you have technical
people involved in discussions, these processes by design
encourage debate. And there are differences of opinion as we
work through the processes.
And ultimately, remember that the managers who were
involved in these decisions are themselves, are themselves
experts, and there are times when they may have been overruled.
And it is not a matter, in my view, of what the applicant, or
the manufacturer in this case, wants.
It is really a matter of letting the process work. And
ultimately, the decision needs to be made on behalf of the
agency, and on occasion, that maybe the manager that has a
broader view that may be able to make that decision. I do think
that there are some improvements that we can put in place.
Aviation safety is working, as I mentioned, on just----
Mr. DeFazio. Thank you, Mr. Administrator. And one last
question--I am running out of time and do not want to abuse my
privileges here--Boeing self-certified and installed defective
slats on 137 applications, and you just announced a $4 million
civil fine for this deliberate abuse. And we have heard a lot
of other things about production pressures, and we will hear
more about that from the second panel.
I am concerned that will you look at these issues. And also
we will hear from the second panel about concerns about whether
or not sensors were installed, the AOA sensors installed
properly because of production pressures, calibrated properly
because of production pressures. Again, I have concern.
Again, and I do not get the sense thus far that you are
ready to go there, that we may have a captive regulatory
problem in the field offices. Because there are an awful lot of
decisions that have gone in Boeing's favor, overruling a whole
lot. The 787 had a safety specialist say, ``Hey, you can't put
a lithium battery in that plane without putting it in a steel
box and venting it over the side.'' Overruled. Guess what? The
plane gets grounded for 2 months because, hey, you have got to
put it in a steel box and vent it over the side.
There have been an awful lot of people who seem to have
been pressing it and right, and the question is, maybe this
needs to go beyond the local office when we are talking about
safety-critical systems.
And with that, I have run out of time. But I hope you will
look at that issue. Thank you. Thank you, Mr. Administrator.
Ranking Member Graves.
Mr. Graves of Missouri. Thank you, Mr. Chairman.
Something I worry about just a little bit is the direction
we are taking--and this isn't about Democrats and Republicans
because I hear it from both sides--and questioning the safety
of our system. And that does worry me because I want people to
feel safe getting in the air.
And I have heard people say, on both sides, that we have a
system that is absolutely fundamentally broken. And my question
to you, Administrator, is--and I don't think there is any
system that can't use improvement, particularly when it comes
to Government. But do you believe our system is fundamentally
broken? We have worked a long time to get our certification
process to where it is today. And so I ask you that question.
Are we broken?
Mr. Dickson. No. It is a great question. The system is not
broken. However, with any process, and I have said many times,
even in these last 4 months, that all processes need to be
improved really each and every day, and to the extent there are
gaps in the processes or, in the case of the MAX, fragmented,
inadequate communication; data that didn't have the fidelity
that we needed; the lack of a safety management system at
manufacturers--those kinds of things are all improvements that
can be put into place.
And I believe that the construct that we have, whether it
is at an air carrier or manufacturer or an airport, of the
agency being in a position to exercise effective oversight and
not be captive, but also have fluid information flow and data
flow from the regulated entity, is extremely important because
that is the foundation of what has led to the margin of safety
that we enjoy in the United States today.
Mr. Graves of Missouri. I am going to change directions
just a little bit so members of the committee can hear from a
pilot's perspective. And I know you are typed in several
different aircraft. In fact, name the aircraft you are typed in
right now, commercial aircraft.
Mr. Dickson. Commercial aircraft, the 727, 737, 757, 767,
and the Airbus A319, 320, and 321.
Mr. Graves of Missouri. So when you--and I have talked
about this, that it is--a crash should never focus on one
thing. We have got pilot issues. We have got maintenance
issues. We have got Boeing. We have got--and everybody has a
part of this that bears some of the blame.
But I have talked a lot about runaway trim and how MCAS, or
any autopilot, for that matter, how it manifests itself. And it
manifests itself as a runaway trim issue, which something here
in the United States, we learned as pilots, whether that is
private pilot training, commercial training, ATP training, is
memory items, muscle memory.
And you go through those mental items. And can you
explain--sometimes I get up here and harp on this stuff and
don't explain it very well. But can you explain what it feels
like? And I know you have run through the scenarios, too, in
the simulator of these accidents. Can you explain runaway trim?
Can you explain for the committee's benefit muscle memory and
what you have taken away from your perspective?
Mr. Dickson. Sure. Well, thank you for the question. This
actually gets to the chairman's question on looking at what
information was known right after the Lion Air accident. We had
flight recorder data that indicated some issues with crew
performance. We also had information with how the airplane was
maintained. And if any of those had gone a different way, that
accident would not have occurred, and events would have
manifested themselves differently.
The pilot is part of the system, and so when we are
designing flight control systems, any time you have a flight
control problem, if the airplane is not doing what you wanted
to do, the first thing you do is fly the airplane. And that
means disconnecting the automation; in this case, if the
autopilot is on, disconnect it. The autothrottles, disconnect
them. Let's get the airplane under control and find out what is
going on.
And then you execute whatever emergency procedure you have.
In this case, with runaway stab trim, if the airplane has got
control pressures that are undesirable, trim the airplane up.
And then in most airplanes you disable the electric trim system
and then can trim the airplane manually. Slow down. The
airplane is not on fire. You have not lost an engine. There is
plenty of time. There is not any urgency in addressing the
issue. So that is how we want to manage the workload in the
cockpit in these events.
But runaway stabilizer trim, I have had it during my
career. It is not a regular occurrence on modern aircraft, but
it is something that every pilot learns during their initial
qualification, whether in light aircraft or matriculating
through commercial aviation aircraft as well.
Mr. Graves of Missouri. So again--and I know when you read
the report, too, that the copilot--the pilot asks, ``Can you
trim the aircraft?'' Which at one point I think the aircraft
accelerated through 500 miles per hour; at least, that is what
some of the initial telemetry--you might explain that, too.
Because I have tried to explain it before.
When you are trying to trim an aircraft that is going way
too fast, the pressures that are against those control
surfaces--you might do a better job of explaining that, too. I
have used the analogy of trying to push a car door open when
you are going down the road at 100 miles an hour, and it is
very hard to get that.
It is the same thing you get on control surfaces when you
are trying to trim something manually. You might go into a
little bit further with that.
Mr. Dickson. Sure. At high speed, I mean, this is why with
any flight control problem it is important to maintain control
of the aircraft. And that usually means, for a large commercial
airplane, staying below 250 knots. And then if you have
something like a flat base symmetry or an undesirable control
force, a lot of times you will go back and reestablish what the
previous configuration was.
In this particular case dealing with a trim issue, those
forces are going to be much greater, which I believe is your
point, at a higher speed because the controls are much more
effective at high speed than they are at a slower speed.
Mr. Graves of Missouri. So I am going to--and there has
been a lot of talk directed at people blaming the pilots, which
I do not believe the pilots are to blame in this. I think they
were fighting for their life. And that is essentially what they
were doing, and the passengers.
I think they were overwhelmed. I think they were trying to
figure out what was going on. We know they reengaged the
system. But I place a lot of that blame--and there is plenty of
blame to go around in this whole thing again, whether that is
manufacturer or pilot response or maintenance, whatever it is.
But I still go back to, and I have said this before, the
Ethiopian Government that owns Ethiopian Airlines in that
particular crash, that is who I place a lot of focus on because
they put those two individuals in that cockpit. And it is
unfortunate that that is the case. And that is the thing that
worries me more than anything else. Because we do have
different training standards throughout the world, very
different training standards.
And when you have an airline that is growing as fast as
they were growing, and you are throwing people in the cockpit,
they may know how to fly the computer, but it goes back to what
you said: You still have to come back--and I have said this
before, too--the most important safety factor you can have in
any aircraft is a pilot that can handle whatever that situation
is.
And I don't care if the pilot has 200 hours or 20,000
hours. There are airplanes that--or pilots that I will get in
an airplane with that have 200 hours that I believe in their
ability. And there are pilots out there that have 20,000 hours
that I will never get in an aircraft with. It is all about how
they handle whatever situation it is.
And so I still come back to training standards. And I think
we are going to hear a little bit about that. And if we have
more questions, I have got some questions for the folks that
have been reviewing this because I know there is some talk
about pilot training standards.
But I do appreciate your perspective on this. And again, I
think there is a lot of blame to go around. But I do feel bad
for those two pilots because I think they were absolutely
overwhelmed with the task at hand.
Mr. Dickson. Well, Congressman, I would just say I
appreciate your comments. But I would just caution everyone,
and I think you would agree with this, I am not about casting
blame on anyone or anything. I am about identifying problems,
issues, and developing solutions, and improving the process.
And there is a lot to be done in all of these areas, both
with the technical processes, the human factors issues, and
international pilot training standards as well.
Mr. Graves of Missouri. I completely agree with you. And
that is exactly why we are here, which I appreciate the
chairman's point of view and what the committee is trying to
do. It is unfortunate that we had to have people killed to get
to this point, which has happened before in Government.
But I do think we need to be cautious as we move forward,
too. We have to fix the system, whatever needs to be upgraded.
But I do think we have to be very cautious moving forward and
not have knee-jerk reactions because we do want to keep--and
this comes back to my initial statement. I want to make sure
that we have a safe system.
I do believe we have the safest system in the world, and it
is the gold standard. And I want to make sure it stays that
way. But I don't want to tear it apart by the same token.
Thank you, Mr. Chairman.
Mr. DeFazio. I thank the gentleman for his questions. And
we are going to proceed in order of seniority. And first would
be Representative Norton. Seniority and arrival; if you weren't
here at the beginning, then----
Ms. Norton. Thank you, Mr. Chairman. This is a very
important hearing. I appreciate this hearing today.
And Administrator Dickson, I appreciate your being here.
Let me say I also appreciate the answers you have provided so
far to the Quiet Skies Caucus, of which I am a cochair. We are
concerned, obviously, about allegations that FAA was a captive
of the industry. So I want to ask you a series of questions
that go to Boeing's delays in providing safety information. It
looks like repetitive delays. We are trying to see whether or
not we can break with that.
In 2015, did the FAA enter into a settlement agreement with
Boeing--that is 4 years ago--to resolve multiple enforcement
cases against Boeing that were either pending or under
investigation at the time?
Mr. Dickson. Yes, we did.
Ms. Norton. Is it also true that under the agreement,
Boeing had to immediately pay $12 million into the U.S.
Treasury?
Mr. Dickson. Yes, ma'am.
Ms. Norton. Moving forward, is it also true that Boeing
faced up to $24 million in additional penalties through 2020 if
certain conditions were not met?
Mr. Dickson. That is correct.
Ms. Norton. Do these genesis of settlements show a pattern
of systemic issues on the part of Boeing, including failure to
identify problems, failure to put corrective actions in place,
inadequate resources, and inadequate training?
Mr. Dickson. Well, I have to say I have yet to conclude
that with respect to the settlement agreement. But it is
something that is under consideration, and it could be the
subject of future litigation. But I certainly reserve the right
to take further action with respect to that agreement.
Ms. Norton. We are talking about in the past, now, failure
to identify problems, failure to put corrective actions in
place. You are saying that is under litigation?
Mr. Dickson. No, it is not under litigation. But it is a
consideration about what actions may occur in the future with
respect to the remaining actions before the 2020 timeframe that
you talked about.
Ms. Norton. Well, I think those failures are pretty clear,
Administrator Dickson.
In designing and developing and manufacturing the 737 MAX,
Boeing has run into issues in meeting the obligations in most
of these categories. Isn't that true?
Mr. Dickson. I am sorry. Can you restate--I am not sure I
understood the question.
Ms. Norton. Yes. In designing and in developing and
manufacturing the 737 MAX, isn't it true Boeing has run into
issues in meeting the obligations in most of the categories I
just previously named?
Mr. Dickson. I am not aware. Perhaps Mr. Lawrence may be
aware. I am not aware of any specific issues.
Ms. Norton. Has Boeing met all the obligations under the
agreement?
Mr. Lawrence. That is still under evaluation right now.
Ms. Norton. Within the last decade, Boeing has had two
worldwide groundings of relatively new airplanes, the 787
Dreamliner and 737 MAX, and encountered numerous compliance
issues in the time since Boeing paid the $12 million
settlement. And I am assuming that settlement, that payment,
was made.
Has FAA assessed any additional financial penalties on
Boeing pursuant to the 2015 agreement?
Mr. Dickson. Not at this time. But as I mentioned earlier,
that is under consideration, and I reserve the right to go
ahead and proceed appropriately.
Ms. Norton. Thank you, Mr. Dickson. Thank you, Mr.
Chairman.
Mr. DeFazio. I thank the gentlelady.
Representative Gibbs.
Mr. Gibbs. Thank you, Mr. Chairman. And I too want to
extend my condolences to the families of the victims. This
tragedy--it is just unbelievable that you have to suffer
through this. I am glad you are here today.
Mr. Dickson, just to kind of start this out a little bit,
you mentioned about identifying problems. And to me, it seems
like, when I have tried to learn on this, that a software
glitch, maybe a sensor issue, pilot awareness and training, and
then also some of the problems trying to identify.
But then my overall question, talking about since you are
the new Administrator, when you came in, were you concerned
about what the relationship was with the FAA inspectors and the
Boeing technical people, inspectors, and the relationship, and
the culture between the two?
Mr. Dickson. I knew there were questions about that. Of
course, my experience is from the commercial airline industry,
27 years, and 12 years as a senior leader of flight operations.
And I have seen the power and the benefit of safety management
systems, and that how it has led to the incredible margin of
safety that we have now.
But manufacturing is a new environment for me, and what the
regulatory process is. I think one of the challenges that you
have in an aircraft certification project is that it takes
place over many years. And so I have become aware of,
throughout this committee's investigation, the result or what
we have seen so far, the Joint Authorities Technical Review, my
own observations and conversations with the team out in Seattle
about when we are bringing in various parts of the team and how
engaged everyone is from beginning to end of the process.
So there is the relationship between the FAA and the
manufacturer. But there is also how the pieces within the FAA
are fitting together and working together and communicating
with each other.
Mr. Gibbs. And it has expanded a little bit, the
relationship to FAA, relationship with the European Union
Aviation Safety Agency, and the relationship to Airbus and
other manufacturers, foreign manufacturers, for compliance, for
inspection and certification.
Mr. Dickson. It is a different model, similar. But I think
the issues are very similar. Over in Europe they have, again, a
different legal construct, and EASA would actually have to take
certificate action. Our system is a little more flexible in
some respects. Delegation is something that has to be earned.
It is a privilege. And it is really reliant on our trust with
the applicant. And to the extent that that needs to be
addressed, that will affect the decisions going forward.
Mr. Gibbs. Mr. Kiefer, as you are a TAB member, the
Technical Advisory Board, conducting the review of the 737 MAX
changes in pilot training, recommendations to ensure
independence, and an unbiased review of the 737 MAX changes,
how has that review--what is the progress and what do you think
we--the conclusions related to the safety changes to date?
Mr. Kiefer. As far as conclusions go, our team is still--we
still have work ongoing with Boeing. We have action items to
Boeing for further safety assessments. We are also waiting to
see the final training modules and so forth. But the items that
we have reviewed to date are looking good.
Mr. Gibbs. So the software changes, you are----
Mr. Kiefer. Yes. The software changes that have been put in
place are addressing the failures that led to the two
accidents. And----
Mr. Gibbs. Was there also a sensor issue, or lack of
duplication or additional sensors?
Mr. Kiefer. OK. So I will address that by saying one of the
new changes that Boeing has made to the software will have the
MCAS as a system looking at both angle-of-attack sensors on the
aircraft so that if one should fail like they did in the two
mishap aircraft, the system will detect that and disable MCAS.
Mr. Gibbs. On pilot training and awareness, do you have any
concerns that additional training and awareness when it fails--
what does the manufacturer do to make sure that pilots are more
aware of training? Do you have any comments on that?
Mr. Kiefer. So far as I have seen, the training that they
have developed for the--and our team, the training that we have
seen is adequate.
Mr. Gibbs. OK. Thank you. I yield back.
Mr. DeFazio. I thank the gentleman.
Representative Johnson.
Ms. Johnson of Texas. Thank you, Mr. Chairman. I ask
unanimous consent to put my opening statement in the record.
Mr. DeFazio. Without objection, so ordered.
Ms. Johnson of Texas. Thank you.
[The prepared statement of Ms. Johnson of Texas is on page
153.]
Ms. Johnson of Texas. Administrator Dickson, the faces of
the people being shown over here--I don't know whether you can
see them--are indelibly in our mind. And the only thing we are
trying to get at is how we avoid this again. And so the last
two airlines developed by Boeing, the 787 and the 737 MAX, have
been the subjects of worldwide groundings. Before the 787
grounding, the last airline type to be grounded was the DC-10
in 1979.
What do these groundings tell us about Boeing's ability to
deliver quality, airworthy airplanes? And what do these
groundings tell us about FAA's ability to conduct effective
oversight of the aircraft certification process?
Mr. Dickson. Well, thank you. It is an appropriate
question. I want to ensure that you and everyone here in the
committee, the families, and the American public know that my
highest priority is to make sure that nothing like this happens
again; but not only that, that we continue to raise the margin
of safety in the U.S. aviation system, and use our influence to
do so around the world.
These groundings, again, I think they illustrate that what
we have done historically we cannot be satisfied with. We have
got to continue to put process improvements in place. We have
got to support our people. We have got to make sure we have got
the right skill sets in our workforce, and that we are making
decisions the right way, with safety as our absolute highest
priority.
So again, that involves just culture, both within the
manufacturer and the regulator; the separation of safety issues
from business issues--there can't be undue pressure on one side
or the other; and we have got to make sure that system is
absolutely clean.
I think we also need to remember that in hindsight, there
are other accidents that have happened over history where
airplanes were not grounded because we didn't have data at the
time. And TWA 800 is an example. We have Air France 447, where
there were some similar human factors and issues involved
there.
And I think that, again, this is where pointing the finger
of blame prematurely ends up being counterproductive because we
just move on to the next thing. So I think that my interest is
in the whole system and how all the parts interact. And as
flight decks and airplanes continue to become more and more
modernized, we need to understand that humans are a part of the
system.
They are a part of the design process. They are a part of
maintaining the aircraft. They are a part of operating the
aircraft. And human frailty and our ability to be able to
engage with systems and be part of the system, all that needs
to be taken into account in the design moving forward.
Ms. Johnson of Texas. Thank you very much. Do you believe
that the recent failures of the Boeing 737 MAX or Boeing's
ability to deliver safe, reliable airplanes says anything about
the organization designation authorization structure?
Mr. Dickson. It is a good question. And I think that,
again, as I said before, the ability to delegate to the private
sector has existed for decades. And actually, in one form or
another, it goes back to the 1920s.
And if you look at the commercial airlines, which again is
what I am most familiar with, the certificate management
offices that oversee the major airlines have typically 30 or 40
operations inspectors who are supervising a pilot force at that
airline of maybe more than 10,000.
But they rely on those who are flying the airline every
day--the line check airman, the instructor designees, who are
really there and take their obligations as FAA designees very
seriously. I think there is an analogy to being able to do the
same thing at the manufacturer. But that does not mean that
there aren't improvements that need to be put into place.
I think that the ability to have higher fidelity data
around the globe--we have airplanes that can stream data almost
immediately off the airplane now. And we need to be able to put
protocols. We need to work with labor. We need to work with the
manufacturers. And we need to work within the FAA to make sure
we can take that data, and it will allow us to make better
decisions under an appropriate safety management system.
Mr. DeFazio. Thank you.
Mr. Massie.
Mr. Massie. Thank you, Mr. Chairman.
Mr. Kiefer, can you get into a little more detail about the
changes to the flight control system that you have observed
that have been made?
Mr. Kiefer. Yes, sir. Soo there are four main changes that
have been made to the speed trim system in MCAS in the flight
control system of the 737 MAX. The first is, as I said, there
is now going to be an angle-of-attack sensor comparison between
the two angle-of-attack sensors. If they vary more than 5\1/2\
degrees from each other, the speed trim system in MCAS will be
disabled.
The next one is maximum stab trim command limit. So this is
a limit put into the software that will prevent the stabilizer
from trimming to a point where the pilot will no longer have
control authority by pulling on the control wheel alone using
elevator controls.
The other one is the MCAS resynchronization change that has
been made. This change will account for any manual trim inputs
that the pilot makes with the electric manual trim while MCAS
is activating, and then return the trim back to that new
setting once MCAS is done or once angle of attacks come back
out of the MCAS range. This also will prevent more than one
MCAS firing during an angle-of-attack event.
The last change is a change that has the two flight control
computers in the aircraft monitoring each other's performance.
And if there is an errant or spurious trim command that comes
from one that is not also commanded by the other, it will shut
that trim system off.
Mr. Massie. It seems like after the first crash, and
definitely after the second crash, there was sort of a rush to
the flight simulators, and let's recreate the problem and see
how pilots respond to that. And in hindsight, we know the
failures were a combination of human factors, user interface
design, and an individual component failure.
In the certification process before even the plane is
certified, is there enough testing in the flight simulator of
individual component failure? Because it seems like with the
737 MAX, when there were changes to the user interface, the
flight control system, it would have been wise to go into the
flight simulator then and simulate failures like the angle-of-
attack sensor instead of after the fact.
Can you tell us, Mr. Lawrence, to what degree those things
are tested for in the certification process?
Mr. Lawrence. Thank you very much for the question. Human
factors testing and flight testing is a current requirement of
any aircraft certification project. And in fact, just to
warrant that, that is one of the reasons why we have had a
delay in the reintroduction of the 737.
It was that very testing earlier this year that our test
pilots identified some issues and required some additional
changes to the system. And that is when we added the additional
comparators and change in the flight control system so that the
two computers would be talking to each other.
So it is a factor in the system, and it is flight tested as
well. So obviously, some things can't--you don't want to go up
and flight test some things that are very dangerous; that is
why the simulators are used. But we try to accommodate every
possible failure that we can think of in the testing and
certification of the aircraft upfront.
Mr. Massie. Both crashes were tragic, and if we knew all
the factors in hindsight, they probably could have been
avoided. But the second one seems more tragic, given that it
was a similar set of factors as the first.
In hindsight, or looking forward, better yet, what could we
do between after a crash like the Lion Air crash--what could
you do at the FAA to prevent the second crash? I am not saying
what should people have done before. But what are we going to
do going forward to stop the second crash from ever happening?
Mr. Dickson.
Mr. Dickson. Well, I think it is a great question. And I
think I would just go back to the availability of data earlier,
and to be able to look at root causes. Because ultimately, we
are looking at a process by which a fix is being put in place.
And how urgent and what kind of timeframe are we looking at? Or
is it a high enough risk--remember, this is all about managing
risk--and is it a high enough risk that the airplane would
actually need to be grounded?
Mr. Massie. Thank you. My time is expired.
Mr. DeFazio. I thank the gentleman.
And with that, Representative Larsen, the chair of the
subcommittee.
Mr. Larsen. Thank you. Mr. Dickson, you were a pilot,
active pilot for Delta for how long?
Mr. Dickson. For 27 years.
Mr. Larsen. For 27 years. And then after you were a pilot
for Delta, you worked for Delta in operations. Is that right?
Mr. Dickson. Well, I was--so during my career, I flew as a
line pilot for about 9 years, and then was the senior vice
president of flight operations for the last 12 years of my
career.
Mr. Larsen. OK. And in that role you were pretty active
inside of Delta as well as with outreach to the Federal
Government in a capacity to the FAA?
Mr. Dickson. Yes, sir.
Mr. Larsen. So I know you have been on the job for 4
months. But you were not just air-dropped into this job at FAA.
You actually know what you are doing coming to the job. Is that
right?
Mr. Dickson. Yes.
Mr. Larsen. Mr. Lawrence, you have been at the FAA for
about 9 years, even though in your new job you just started
last year, 2018. But before that, you were active in the
Experimental Aircraft Association and other things. You just
weren't air-dropped into your job last year. You actually know
what you are doing in this new job. Right?
Mr. Lawrence. Correct.
Mr. Larsen. All right. So I think you should be proud of
your credentials and not underplay them and the role that you
play, both looking forward and in looking back. I wasn't in
Congress when a lot of things passed in Congress, but I am in
my job and I am responsible for those things.
You are responsible for the things that happened before you
got there, just as other people were. But you are responsible
now for those things that happened before you got there.
Mr. Dickson. Absolutely.
Mr. Larsen. As well as you being responsible going forward.
Mr. Dickson. Absolutely. The buck stops--I mean, I am
responsible.
Mr. Larsen. I am glad we can agree on that. Also, I would
note that the existing ODA program didn't exist in the 1920s,
although ODA in some form did exist back in the 1920s. The
existing one started in 2005, passed under an FAA law. So that
is what we are dealing with now as well, not what it was in the
1920s, but what it is now.
Mr. Dickson. Right.
Mr. Larsen. It is very different than what it was. So I
just want to establish some baseline here about what we are
talking about, not the 1920s, not the fact that you are new to
the job, because you are actually not all that new to the job.
And given that, I want to ask you about some of the decisions
that have been made at the FAA. And you may not be able to
answer them today, but you need to answer them.
For instance, the Boeing CEO, Mr. Muilenburg, stated to us
the FAA fully vetted the company's 2016 revised system safety
assessment. But the Indonesian accident authorities found that
the FAA's response was simply to accept that submission--so
fully vetted versus simply accept--with a note indicating that
that approval was delegated to Boeing. So that is what the
Indonesian air authorities noted in their report.
So is that the process? Is fully vetting, is all that means
is that Boeing gave it to FAA and the FAA accepted that, and
that is what ``fully vetting'' means?
Mr. Dickson. Fully vetting, in my definition, doesn't mean
that. I would defer to Mr. Lawrence on the technical details.
But I would say that from my understanding, it is not unusual
for design applicants to come in and ask for certain things to
be delegated.
Mr. Larsen. Mr. Lawrence?
Mr. Lawrence. So fully vetted would not just be a cursory
review, and that is not what is done in the system. As we have
talked about in the past, delegation is really used primarily
in routine and well-understood areas. But it also relies on the
data that were provided. And that is, as has been mentioned
earlier, an area that we are focusing on. If we don't have the
right information, it won't result in the correct answers.
Mr. Larsen. So the JATR report also found that MCAS
certification deliverables were not adequately updated by
Boeing to reflect the changes to the flight control system. We
sorted that out in the last hearing. At any time during the
process, did the FAA notify Boeing that these documents were in
fact insufficient? And if not, why not? I am trying to get at
gaps in the process we use to certify. That is what I am
getting at. So if not, why not?
Mr. Dickson. My understanding is the design change for
MCAS, which is what I believe you are referring to, was not
made evident to the aircraft evaluation group, which would be
responsible, really, for looking at the operational
implications of how the system was working.
There may have been some conversations within either the
flight test or technical areas of the FAA. So I think what it
indicates is this issue of fragmented communication and the
fact that there was information out there. But it was difficult
to put the whole picture together to make a sound decision.
That is absolutely something that we need to address going
forward.
Mr. Larsen. OK. I have run out of time. Sorry about the
questions, but I had to spend so much time bucking up your
credentials to show that you are qualified to answer these
questions for us today. And they don't all have to take--we
need to get to the folks who made these decisions as well.
But I have confidence that you have the credentials to
answer these questions and help us. And I also have confidence
to find out where the gaps are and hold folks responsible for
that as well. And I will hold you responsible for that.
Mr. Dickson. Thank you.
Mr. DeFazio. I thank the gentleman.
Now Representative Perry.
Mr. Perry. Thank you, Mr. Chairman. I also want to
acknowledge the representatives of those and their families who
were lost in the tragedy, and offer my condolences as well. We
appreciate your attendance and advocacy here today.
Mr. Dickson, Administrator, we want to make sure that we
have all the information so that we can trust the fidelity of
the outcome of this when it finally is complete. In that vein,
on October 7th of this year, the AP broke a story entitled,
``Airline Went into Records after MAX Crash, Engineer Says,''
which detailed the contents of a whistleblower complaint
submitted to the FAA and other international air safety
regulators by Ethiopian Airlines former chief engineer Yonas
Yeshanew.
Can I ask unanimous consent to have this entered into the
record?
Mr. DeFazio. Without objection, so ordered.
Mr. Perry. Thank you, Mr. Chairman.
[The AP news story follows:]
Article of October 7, 2019, ``Airline Went Into Records After MAX
Crash, Engineer Says,'' by Bernard Condon, Submitted by Hon. Perry
[The article is retained in committee files and is available online
at https://apnews.com/5ff095b8b9954b03925410680e8c907d.]
Mr. Perry. The allegations outlined in the complaint are
shocking and speak to a culture of corruption permeating the
state-owned airline, Ethiopian safety regulators, and the
Ethiopian Government at large. If true, the allegations of
fabricating documents, signing off on shoddy repairs, and even
beating those who got out of line appear to be directly
relevant to investigations into the cause of the crash in
question.
Do you have an update on the status of the investigation
into this complaint? And do you expect that completion of this
investigation prior to the publication of the crash
investigation report? And in light of these allegations against
Ethiopian Airlines, a state-owned enterprise and that nation's
safety regulators, does the FAA still have confidence in the
integrity and validity of the current crash investigation being
led by the Ethiopian Government?
Mr. Dickson. Well, thank you for the question. I do not
have an update today. But I will just say that, again, in this
process of improving, we need to make sure as we made decisions
and as the agency works with the committee to improve the
margin of safety globally that we take all of the factors into
account.
And of course, the FAA, I think, has a responsibility to
influence globally, even those that we don't directly regulate.
We do punt some of that through ICAO, but we also do it with
bilateral and regional relationships as well. So as various
facts come to light, we certainly need to take those into
account as we make decisions.
Mr. Perry. I appreciate your answer. And I would just
caution you, I suppose, even though you don't have an update.
It seems like we would want to make sure that we had all the
relevant information prior to the report, the crash
investigation report. And this might be relevant. It may not,
but we should know that.
I would like to switch gears here a little bit. The FAA has
identified December 20th, just in a few days, of this year as
the new projected date to release the NPRM on remote ID and
tracking of UAS. Is FAA still on track to release the NPRM,
which is essentially in 8 or 9 days? And if this date does pass
without release of the rulemaking, what are your plans to hold
people accountable for the continued delays?
Mr. Dickson. Thank you for the question on the remote ID.
The process is it is actually out of the FAA at this point. It
has proceeded out of the Department of Transportation and is
under review through OMB channels. And so I expect any time now
that we would have it out there. I don't have an exact date for
you. I am certainly hopeful that it will be by December 20th.
Mr. Perry. Could you restate that last part about December
20th
Mr. Dickson. I am hopeful that it will be out by December
20th. I am certainly planning on----
Mr. Perry. But you will confirm it is out of FAA's hands
now?
Mr. Dickson. Well, it is already out of FAA's hands, yes.
Mr. Perry. All right. Thank you, Mr. Director. I yield.
Mr. DeFazio. I thank the gentleman. And OMB is a perpetual
problem as we try and move forward on safety issues, and let's
hope that they can get this one done promptly.
With that, I would turn to Representative Napolitano.
Mrs. Napolitano. Thank you, Mr. Chairman.
Mr. Dickson, the U.S. aviation industry has to be
commended, and the FAA, for a stellar safety record over the
past decade, up until the Lion accident. And our deepest
condolences to the families, and thank you for being here.
However, checks have uncovered a system both at Boeing and
FAA about complacency in their commitment to safety because it
has such a stellar record for so long. And complacency can be a
dangerous thing, particularly in industries that are truly
safety-critical.
Despite this, we are not aware of any key efforts or
initiatives in FAA to emphasize and re-energize the safety
culture that once existed. We do understand, and you have
talked to your staff about not rushing the process of
ungrounding the MAX, for instance, and emphasizing safety
first.
But has FAA hired safety experts from outside the aviation
industry to take a fresh look at your processes? And has it
begun to hire more human factors experts, as some reviews have
suggested you should? Have you personally sat down with the FAA
managers and FAA technical staff in their Seattle office to
hear the recommendations for improving FAA, and their concerns
about oversight of Boeing? I would like to know what you have
done to address safety and oversight issues at FAA.
Mr. Dickson. Well, thank you. It is a great question, and I
actually welcome the opportunity to respond.
On my first day at the agency, in my first town hall, I
talked about the importance of just culture, which means that
we need to have a systematic way for employees to bring their
concerns forward, and we will have better-thought-through
solutions. We can't have groupthink. We have got to have honest
debate as we make these decisions. And my experience in the
airline industry is that that kind of construct is extremely
powerful in raising the safety bar.
Along with that, in my first 3 weeks I made a visit out to
Seattle to see for myself and to talk to the team out there.
And I actually had a conversation with one of our human factors
test pilots, a Ph.D. in human factors, and asked her whether we
had adequate human factors expertise and whether it was
embedded in our processes as effectively as it needs to be. And
I learned a lot from that conversation. I think there is an
opportunity for us to continue to update and improve those
skills in our workforce, and that is a big area of focus for
me.
Mrs. Napolitano. Sir, we are particularly interested in the
testimony of Dr. Endsley on the second panel, dealing with the
human factors involved with aircraft design, certification, and
operation, a topic that I have discussed with a certain friend
of mine, a professor of engineering at USC, Dr. Meshkati.
What do you think FAA and Boeing can do better to
incorporate human factors into the design and certification
process of airplanes to prevent future accidents?
Mr. Dickson. That is a great question. I am also interested
in hearing the comments, human factors comments, in the second
panel. And I have had a chance to read the testimony, and
couldn't agree more with the principles that are articulated
there.
I think as cockpits become more and more automated over the
decades, the job of flying an airplane does not get easier. But
what it does is it changes the nature of where the threat is
that needs to be mitigated. And there is an issue sometimes
with manual flying skills if we are operating in an automated
fashion too often. There is also an issue with losing
situational awareness. And this is--it is impossible to
engineer out human error.
So as we build modern airplanes, it is very important to do
so in a way that keeps the pilot engaged with the flight path
of the aircraft because ultimately, management of flight path
of the aircraft, putting it where it needs to be at any point
in time, whether it is on the ground, taxiing the airplane, or
flying it in the air, it amounts to three things, and that is
understanding where your airplane is supposed to be,
understanding your clearance, putting the airplane there to
comport with the clearance, and then making sure it stays
there.
And humans are not very good passive monitors. And so this
is where the issues about how engaging and the forms of tactile
feedback that are presented to the pilot as he or she is flying
the aircraft are extremely important, even as flight decks
become more automated in the future.
Mrs. Napolitano. Thank you. Mr. Chair, thank you.
Mr. DeFazio. I thank the gentlelady for her questions and
the answers.
Representative Davis.
Mr. Davis. Thank you, Mr. Chair, and thank you to all of
our witnesses for being here.
There are 794 Boeing employees living in my congressional
district who work at their facilities in St. Louis, Missouri,
or Mascoutah, Illinois. And back in October, we had the Boeing
CEO before this committee, sitting right where you are,
Administrator Dickson. And I explained to him that any time we
have tragedies like those that are being discussed today, it
really breaks my constituents.
They are workers that are there. It breaks their hearts
because they want to make sure that the planes that they are
manufacturing are going to be able to fly safely, and we don't
have tragic accidents that affected so many families that are
here in this room today. And again, I echo my colleague from
Pennsylvania, Mr. Perry's, comments. Our hearts go out to you.
Our condolences. But thank you for your presence.
Administrator Dickson, in your testimony you mentioned you
are working tirelessly to ensure the FAA learns from mistakes
surrounding these tragedies. And I know you mentioned in your
testimony--I know you have answered some of my colleagues'
questions--but what specifically have you not addressed yet--is
the FAA doing to ensure that oversight programs work to protect
passengers flying by plane, and also to preserve the dignity of
the workers, my constituents, who build the planes?
Mr. Dickson. Well, thank you for the question. I
certainly--we are all in this together. And the situation with
the 737 MAX is unprecedented in many respects, and so for the
time being we have pulled that work inside the FAA. We are not
delegating anything to Boeing because the expectation is that
the FAA is going to use its resources and the resources of
others--we talked about the TAB here--to make sure that we dot
every I and cross every T.
And that is not to be bureaucratic or slow about it. But we
need to make sure that the public has confidence in the
airplane, and I am confident that I would put my own family,
and those Boeing employees would put their own families on the
airplane, once we are finished with this process.
So again, we have a number of milestones yet to complete.
We have gone through the workload management engineering
simulator modules most recently. That data is being analyzed.
And we are currently looking at how the software has been
developed, along with our international partners, and running
all the audit trees that need to be run when you are talking
about software. After that there will be a certification flight
and then, as you know, I am going to be flying the airplane
myself before I sign off on it.
Separately, we are involving not only U.S.-trained pilots
but pilots from around the world in ensuring that the training
requirements that we require for getting the airplane flying
again are where they need to be.
Mr. Lawrence, I don't know if you had anything else you
wanted to add.
Mr. Davis. Any other witnesses want to add?
[No response.]
Mr. Davis. OK. Well, Administrator, thank you. And I am
going to relay the same thing that I relayed to the Boeing CEO.
Look, we expect results. No family should go through the
tragedy that these families have gone through. We know there
are things that we could all do better. We want to be here to
assist you and the FAA to make that happen. But results matter.
And I certainly appreciate your presence here today. I
certainly appreciate your leadership, and look forward to
working with you. And Mr. Chairman, I yield back.
Mr. DeFazio. I thank the gentleman.
And with that, Representative Lipinski.
Mr. Lipinski. Thank you, Mr. Chairman.
I want to start off by--so that no one out there faints, I
do not believe we should get rid of ODA. I am not suggesting
that. But I wanted to preface what I was going to say with that
because, Administrator, you had said that the system is not
broken. But improvements can be made.
We have seen 346 people die. And there was a second crash,
and we knew more after the first crash, before that second
crash. And so I would say the system is broken. Something went
wrong.
The first thing I want to raise is something Chairman
DeFazio raised at the beginning, the MCAS risk assessment
document. After the first crash, do you know--are you aware--of
where this--well, who saw this document in the FAA?
Mr. Dickson. I was not involved in that. I am not sure
exactly. I cannot speak for who saw it. I know that it was--
again, it is a decision tool that the----
Mr. Lipinski. Who makes the decision, then?
Mr. Dickson. Well, the board that comes together on
continuous airworthiness, essentially uses it to make its
decisions. Earl can walk you through how that process works.
Mr. Lawrence. So whenever we get reports, and we get
reports on a regular basis, we are constantly plugging those
reports into tools and evaluating what action needs to be
taken. And obviously, this was a very large action. We did not
need the forms to tell us this was a tragedy and that we needed
to act quickly.
But the forms do educate us on how to respond. And what the
form----
Mr. Lipinski. Was this an acceptable risk, though?
Mr. Lawrence. It is not an acceptable risk, and that is why
we issued an emergency AD before we even completed the first
set of evaluations, and then followed up with several other
evaluations on what additional----
Mr. Lipinski. Let me----
Mr. Lawrence [continuing]. Actions needed to be taken.
Mr. Lipinski [continuing]. Ask a question on that. You
mentioned the emergency AD. Because I wanted to ask: Why was
there no mention of MCAS in that emergency AD?
Mr. Lawrence. So the Continuing Airworthiness Review Board
is made up of pilots from our aircraft evaluation group. It is
made up of maintenance people. Made up of engineers. They
evaluated all the information, and they made a determination
not to use those words because those words were not included in
the Boeing manuals to start with.
And we--there was a discussion: Would that create too much
confusion? Because the system that needed to be addressed was
the trim system. And so they did not use those words at that
time because the action that needed to be taken by the pilots
was the----
Mr. Lipinski. It all started with the----
Mr. Lawrence [continuing]. Trim runaway checklist.
Mr. Lipinski [continuing]. MCAS not being named in the
manual to begin with. I don't have much time, so one other
thing that I wanted to mention, follow up a little bit on what
Mr. Larsen, Chairman Larsen, had been talking about.
I have a degree as a mechanical engineer. I know a little
bit about airplanes, not certainly as much as the pilots here
do. But I also have a degree in systems engineering. I don't
understand how it is possible that part of the procedure is not
to look at the entire system. It makes no sense to me that you
would just look at each piece of the system and not how the
entire system works together.
And to me, that says to me that the process is broken. The
ODA process is broken. I just want to be very clear that I
think that that needs to be changed.
Administrator Dickson, I wanted to get your response on
that.
Mr. Dickson. I think the use of integrated systems safety
assessments is absolutely an area that we have incorporated,
actually, in the MAX process up to this point. And putting
gates into the process at which this occurs more frequently is
definitely something that we need to be looking at.
And remember, those systems safety assessments are--that is
actually one of the process improvements I am talking about
putting in place in the very short term, even with ongoing
certification activity.
Mr. Lipinski. Thank you. I yield back.
Mr. DeFazio. I thank the gentleman. And in my first
questions, I did ask that you would look at the distribution of
this TARAM report. And I would like given what Mr. Lawrence
just said, to know specifically if the continued airworthiness
panel received this document and considered it at that time.
Thank you.
With that, I would recognize Representative Babin.
Dr. Babin. Thank you, Mr. Chairman.
I want to thank you, expert witnesses from the FAA, as well
for your testimony. I also want to thank the families and
friends of those who were lost in the tragedies.
Before I get to my questions, I want to make just a quick
comment. I think it is lamentable that we are once again
discussing the Boeing 737 MAX crashes, and not one FAA official
in charge from the time when the decisions related to the
certifications in question were made has been asked to testify.
I know that Ranking Member Sam Graves and Ranking Member
Garret Graves have requested the chairman hold a hearing with
these individuals. And I look forward to that in the future.
Administrator Dickson, could you briefly discuss how other
countries certify their planes? And maybe Mr. Lawrence can
chime in here as well. Do they have something similar to the
process that we use here? It is my opinion, and that of several
others, that we shouldn't throw the baby out with the bathwater
because our system and processes are not broken. But what
improvements could be made to our current framework to ensure
proper certification oversight?
Mr. Dickson. That is a great question, and I will let Mr.
Lawrence elaborate on my 35,000-foot answer.
Dr. Babin. OK.
Mr. Dickson. The processes around the world, and we are
really talking about the four primary states of design that we
are working with--although there are other entities that build
and design airplanes--it is really EASA, the Europeans; the
Canadians; and the Brazilians. And processes are similar.
Because of different legal formulations and the fact that
EASA is a multinational regulator that sits on top of the
national regulatory authorities, there are some differences in
how far their process goes and how it is managed.
I think that the concepts are the same in terms of
delegation, but rather than delegating individual items, for
example, if you contrast our system with the Europeans, we have
a lot of flexibility in delegating, and it is basically a
privilege to be able to delegate certain items.
Usually, as Mr. Lawrence said earlier, they are pretty
routine items. And the FAA can modify those decisions once it
starts, whereas in Europe they actually have a design
certificate, essentially, for the manufacturing entity. So
really the whole process is delegated in many respects, but
there is not the ability to delegate individual items. They
have an oversight system set up to look at----
Dr. Babin. Yes. As briefly as you can, Mr. Lawrence. I have
another question or two. Thank you.
Mr. Lawrence. I think that is a very good description. The
key difference is, on the legal system that EASA and the
European Union is working under, it is a certificate that a
manufacturer, a design organization, achieves. And so they have
an approval.
So it is really a different system. There is not a constant
review of things. And in our system, we can pick and choose
what we want to review, what we feel we need to review, where
there is more upfront work, though, in the European system. I
would say there is a lot more review and understanding ahead of
time. And those are some of the things that we are looking to
do as well.
Dr. Babin. OK. Thank you. We have heard a lot about how
assumptions may have been made about pilot capabilities that we
are learning may not have been accurate. Can you shed some
light on how those assumptions were made, as quickly as
possible, Mr. Dickson?
Mr. Dickson. The assumptions are really of some
longstanding in terms of the technical requirements. They were
developed over a period of years with test pilots and
engineers. And I don't know if there are any other details on
that that you would like to share. But these are some of the
things that, as a result of the reviews that we are doing now
and other external reviews, that are being revisited.
Dr. Babin. OK. Thank you. And then adding to it, in your
opinion, is there anything that we in the United States can do
to standardize the qualifications of pilots globally? We have
done that well here domestically, I think very well. But what
about internationally, and what role could the FAA play in
encouraging that?
Mr. Dickson. Thank you for the question. I think that the
FAA can play a very influential role there. As a matter of
fact, we introduced a paper at the recent ICAO assembly, and I
was part of the team that went up there, the International
Civil Aviation Organization, about lifting global pilot
training standards. And so that is something that we have taken
on as an agency already.
But then we will also have similar discussions with
regional regulatory entities and associations as well as some
of the bilateral relationships that we have around the world.
Dr. Babin. OK. Thank you. My time is expired. I yield back,
Mr. Chairman.
Mr. DeFazio. I thank the gentleman.
With that, Representative Cohen.
Mr. Cohen. Thank you, Chairman and Ranking Member Graves,
for holding this important hearing. And thanks to the witnesses
for being here today, and to the families. Again, my
condolences.
Today's hearing is another significant step in our
oversight of the two fatal Boeing 737 MAX accidents. These
tragedies, which claimed the lives of 346 individuals, have
unearthed a slew of problems regarding the FAA's ability to
effectively oversee those it regulates.
For instance, one issue that has raised serious concerns
relates to the angle-of-attack, AOA, disagree alerts. An AOA
disagree alert warns pilots when the aircraft's AOAs, angle of
alert sensors, do not match. In August 2017, Boeing learned
that the AOA disagree alerts were only functional on the planes
where customers also purchased an optional AOA indicator. To
put that into context, 20 percent of Boeing 737 MAX customers
purchased those optional AOA indicators.
AOA disagree alerts were not functioning, then, on about 80
percent of the 737 MAX aircraft sold to airlines around the
world. Southwest Airlines, which does operate in my hometown,
even said in a statement that it only learned that this system
was optional after the Lion Air tragedy.
We learned in our previous hearings in October that Boeing
initially decided to wait to fix the defect for 3 years after
discovering this flaw. Boeing also confirmed that it kept
producing planes with this known defect, and did not inform the
FAA or its customers about it until after the Lion Air crash in
October 2018. This was over 1 year after Boeing learned about
the defect.
More alarmingly, the Indonesian Civil Aviation Authority's
final report on the Lion Air crash found that the inoperative
AOA disagree alert on the airplane ``contributed to the crew
being denied valid information about abnormal conditions.''
This is completely unacceptable. Someone needs to be truly held
accountable. Someone needs to be held accountable at Boeing.
Administrator Stephen Dickson and the FAA shares in this.
Why has the FAA not taken any actions against Boeing, including
a civil penalty for knowingly delivering aircraft with
defective, nonfunctioning parts that pilots believed were
functioning?
Mr. Dickson. Well, thank you for the question, Congressman.
And I have not made a decision on this and a number of other
matters, as I mentioned earlier. I have expressed my
disappointment to the Boeing leadership about that they need
now and previously to be transparent in the sharing of
information with my team here at the agency. And so I reserve
the right to take further action, and we very well may do that.
I am not going to say today exactly what that may consist
of, but the facts that you just presented will certainly go
into that decision.
Mr. Cohen. Thank you, sir. Do you think that it almost
borders on criminal? They have knowledge of a defect, and they
don't give notice, and they invite the flying public onto those
planes?
Mr. Dickson. I don't have an opinion on that. I will say
that, again, if you look, as I said in my remarks or in answer
to a question earlier, I am not at this point interested in
casting blame because I want to run all of these issues to
ground and I want to fix the problem. There will be time for
the rest as we move forward.
Boeing has--grounding the airplane, not delegating anything
during the MAX return-to-service process, not delegating the
airworthiness certificates on each individual undelivered
aircraft. We talked earlier about the slat tracks enforcement
action, and I haven't ruled out other actions as necessary and
as you point out. And I will take those actions----
Mr. Cohen. Thank you. I appreciate you doing that. There
are serious concerns about Boeing's transparency about the
alert system that have been raised.
Today I introduced the Safety Is Not for Sale Act. I
introduced it with Senators Markey and Feinstein, and we
introduced it earlier in the Senate. This bill would require
all air carriers to adopt additional safety features and ensure
all nonrequired safety enhancing equipment is offered or
provided to all carriers without an additional charge.
Aviation safety should not be treated as a luxury, bought
or sold for an extra fee. Mr. Nader would say you shouldn't
charge for seatbelts, and you shouldn't. The flying public
expects and deserves more. I look forward to continuing to work
with my fellow committee members and relevant stakeholders to
ensure the safety and airworthiness, hopefully, of the Boeing
737 MAX. And with that, I yield back the balance of my time.
Mr. DeFazio. I thank the gentleman.
Now I will turn to the ranking member of the subcommittee,
Garret Graves of Louisiana.
Mr. Graves of Louisiana. Thank you, Mr. Chairman.
Mr. Chairman, I want to cite the comments that my friend
from California, Mrs. Napolitano, made earlier about the safety
of the domestic aviation industry, the FAA. I was reading a
Wall Street Journal article this morning, and it cited how,
prior to the 737 MAX disasters, I believe it was the Boeing
planes had an accident 1 out of every 10 million flights.
Comparatively, if you look at the European, Brazilian,
Canadian, and other manufacturers that are largely governed by
their civil aviation authorities, it was an accident once for
every 3 million flights. So again, 1 in every 10 million
flights, 1 in every 3 million flights. And we certainly do need
to get back to that level of safety, or, as I said before, even
better.
In the aftermath of the Indonesian crash, so there was an
emergency airworthiness directive that was put in place, which
is rare. But also, there was--the CARB was established, a
Corrective Action Review Board. Did the Corrective Action
Review Board, did they--were there any recommendations they
made that FAA did not follow?
Mr. Dickson. No. The FAA followed the recommendations from
the experts on the CARB.
Mr. Graves of Louisiana. And these are----
Mr. Dickson. And that was to develop the MCAS software
check.
Mr. Graves of Louisiana. And these are technical experts?
Mr. Dickson. Yes, sir.
Mr. Graves of Louisiana. And did they recommend a
grounding?
Mr. Dickson. They did not.
Mr. Graves of Louisiana. They did not recommend a
grounding? When the plane was ultimately grounded in the
aftermath of Ethiopia, which actually, by the way, in the
Ethiopian Air disaster, did they comply with the EAD? Did the
crew comply with the EAD in that case?
Mr. Dickson. Well, again, the accident report is not out
yet, so it remains to be seen. On my first day at the agency I
did have a chance to see the flight data recorder information
from both accidents and compare the two. And in my estimation,
for whatever reason, the AD procedures that the FAA expected to
be followed were not followed.
Mr. Graves of Louisiana. And so I just want to make sure we
highlight this because in the future, if something happens and
an AD is issued, an emergency airworthiness directive is
issued, we need to ensure that there is a better process, that
those lessons learned are actually applied and complied with.
And so I think that is one of the many lessons learned.
And you are exactly right, and I want to express caution
with my own statements. We do need to make sure we wait for the
Ethiopian report to be completed to see what their takeaways
are.
A question was asked of you earlier, and I want to give you
an opportunity to perhaps clarify. You were asked if you were
responsible for decisions of your predecessors. Now, look. I
ultimately ran for the Congress because I was frustrated by
what was here and I wasn't happy with the performance. That
motivated my decision to run.
We are where we are as a Nation today, as a Congress. We
are where we are as an FAA. Are you responsible for each of the
decisions that were made that got us to where we are? Or are
you responsible with where we are now and where we go?
Mr. Dickson. Well, I appreciate your comments, Congressman
Graves. I feel responsible, regardless. And that is just who I
am. And I think it is important that--Chairman DeFazio
mentioned the career professionals at the FAA. I need to
advocate for them and I need to support them.
I need to make sure that they have got the tools and the
direction and the support, whether it is Earl Lawrence and his
team or Ali Bahrami in the Aviation Safety Organization. Flight
standards, the Air Traffic Organization, whatever the case may
be, my job as a servant leader is to make sure that they have
what they need to be effective in their jobs.
So I feel responsible for that. And I want to take those
lessons that are learned, and apply them to put improvements in
place so that we continue to raise the bar on safety.
Mr. Graves of Louisiana. Well, and I certainly share the
objective of raising the bar and ensuring that we have maximum
safety.
So let me get to the last point here. So the CARB did not
recommend a grounding, but the plane was ultimately grounded.
Was that a decision by the technical folks or was that decision
by someone else, to ultimately ground the plane?
Mr. Dickson. That was a decision, I believe, that was made
by Mr. Bahrami, I think, or at least was driven by the
availability of additional data.
Mr. Graves of Louisiana. That was my understanding, that--
--
Mr. Dickson. Yes. Then-Acting Administrator Elwell.
Mr. Graves of Louisiana [continuing]. It came from Mr.
Bahrami as well.
And I just want to make note, Mr. Chairman, that this was
not a decision of the technical folks. This was the decision of
the leadership, to ultimately ground the plane. Yield back.
Mr. DeFazio. I thank the gentleman.
Representative Sires.
Mr. Sires. Thank you, Chairman, for holding this hearing.
Administrator Dickson, thank you for being here. And my heart
goes out to the family members that are here.
Later on, we are going to be hearing from Ed Pierson, who
oversaw a portion of the 737 MAX final assembly at the Renton
plant in Washington State. Mr. Pierson wrote to and met with
general managers of the Boeing 737 fleet months prior to the
Lion Air tragedy to express his concern that the safety and
quality were being compromised due to Boeing's production
pressures.
According to Mr. Pierson, in early 2018 Boeing's job behind
the schedule spiked to 10 times the normal amount, and the
rollout on-time percentage dropped to below 10 percent. Also, a
part backlogged caused Boeing to begin experiencing substantial
out-of-sequence work.
This means work was performed outside its planned location
or time, which increases the risk of mistakes. Boeing's
tracking system saw quality issues increase by over 30 percent.
I understand that Mr. Pierson's attorney has written to you
three times?
Mr. Dickson. He has written to me--I received a letter from
him in September, I believe.
Mr. Sires. Well, according to him, it is three times in
September to alert you to Mr. Pierson's concerns of chaotic,
rapidly deteriorating factory conditions that he witnessed at
the Boeing production facility. He also wrote that he believed
the flying public would remain at risk unless this unstable
production environment is rigorously investigated and remedied.
Administrator Dickson, the FAA grants production
certificates to Boeing. Right? They grant the----
Mr. Dickson. Yes, sir.
Mr. Sires. OK. Has the FAA investigated any other
production concerns of Boeing's that Mr. Pierson has raised?
Mr. Dickson. We have engaged Mr. Pierson, and we are
looking into these issues. Mr. Lawrence may have more details
on this. But we take concerns wherever they come from
seriously, and we have a process for dealing with that, for
interviewing and investigating concerns that are raised by
individuals and things that we observe during our own
oversight.
Mr. Sires. I don't mean to be difficult. But I just think,
to look into it, it doesn't seem enough. I want a commitment
from you that we are going to investigate these concerns for
the----
Mr. Dickson. And we are doing that. You have my commitment.
We are doing that.
Mr. Sires. Thank you. I don't have any further comments.
Mr. DeFazio. OK. I thank the gentleman.
Representative Spano.
Mr. Spano. Thank you, Mr. Chair. And I too want to express
my condolences to the members of the families that are here
today. My prayers are with you, and I just ask God's peace and
comfort as you deal with this difficult tragedy in your lives.
I had an opportunity several months ago to have a meeting
with a colleague of mine, a friend who is also a pilot and had
flown the 737 MAX. At the time, he and I--I am not a pilot; I
just ride in airplanes. That is as much as I know about them.
But what he expressed to me is there was a periodic
briefing that pilots are provided, which potentially provides--
essentially, it is a binder that includes memos, directives,
information that pilots should be aware of as it relates to
safety issues on the planes that they are piloting.
He told me that this particular issue with the MCAS system
was in fact, to his recollection, included within that binder
of things to be aware of. All right? But that it was kind of
buried at the bottom of a stack of such memos. OK? So I guess
my question--and so from his perspective, and it certainly
seems from my perspective as a lay person, that if you are
going to have a memo relating to an issue of such importance
buried in a stack this big, are you really providing any
meaningful direction to pilots?
And so, given that scenario, is that in fact the case? Can
you comment on that? Appreciate that. Thank you.
Mr. Dickson. Well, I believe--thank you for the question--
as Deputy Administrator Elwell had said in his previous
testimony, it is my belief, and he shares it, that pilots
should have known about the system on the airplane. It should
have been part of the initial training, particularly as the
design was changed so that it would operate more in the heart
of the flight envelope.
With respect to information about unscheduled stabilizer
trim and the emergency airworthiness directive, as Mr. Lawrence
said earlier, that is an extraordinary action. I think the last
one that the FAA had done was about 2 years earlier, in 2016.
It is something that should be stamped on top of everybody's
forehead out there.
So if that is not reaching the level of prominence that it
needs to in the operator community, that is definitely
something that we need to look at.
Mr. Spano. Yes. Thank you. And I would encourage you to do
that because the takeaway that I got from my conversation from
him is that he was certainly aware of the issue, but the fact
that you would have such an important memo with regard to an
issue of safety that is essentially buried, that can't happen.
It seems to me that those should be issues that should be
number one in terms of prominence.
Another question I had for you is that there--and if there
was a question earlier, I apologize--but are you aware of
allegations by a former FAA safety engineer that the FAA's
management safety culture is broken and demoralizing to
dedicated safety professionals? And if you are, how do you
respond to that allegation?
Mr. Dickson. Well, I want to make sure--again, on my first
day at the agency, I emphasized that. And this has to come from
the top, that we need to have a healthy safety reporting
culture. It is what we demand of those that we regulate. I come
from the airline business, and the ability to be able to
systematically intake or uptake safety concerns is extremely
important to the safe operation of an airline. And I think it
is equally important, if not more so, within the agency.
So we need to--as people raise issues, either through their
chain of command, through their boss, or as whistleblowers,
there also needs to be this middle ground where we are able to
take in systematically safety concerns.
One of the things that we need to do a better job of is
going back after decisions are made and communicating to the
workforce what all the considerations were, and why decisions
are being made because sometimes there may be a perception
that, oh, you sided with this person or that person, or this
company or--you know, chose to retain someone in the agency.
That is not the right lens that we need to be looking through
these things.
Also, we want to have a system where we encourage healthy
debate as we make decisions. You are going to have, whether
there are pilots or engineers, subject matter experts, you want
to have that healthy debate, but ultimately somebody has to
make the decision. And in these cases that you are referring
to, the decisionmakers themselves are actually experienced
technical experts as well.
Mr. Spano. Thank you, sir. I yield back.
Mr. DeFazio. OK. I thank the gentleman.
Now Representative Johnson.
Mr. Johnson of Georgia. Thank you, Mr. Chairman. I would
ask that the TARAM report that you displayed during your
questioning be placed back on the screen.
And Mr. Dickson, I would like to direct your attention to
it. In December of 2018, about 1 month after the Lion Air
flight 610 crashed, the FAA performed this risk assessment that
calculated the likelihood of future 737 MAX crashes caused by
the erroneous MCAS activation. Is that correct?
Mr. Dickson. Yes, sir. It is correct.
Mr. Johnson of Georgia. And this is the report that issued
from that analysis. Correct?
Mr. Dickson. Yes. And actually, my previous answer--I
should elaborate--this is looking at all the factors that went
into the accident, so not only MCAS but the other----
Mr. Johnson of Georgia. Not just the MCAS?
Mr. Dickson. The other factors, yes.
Mr. Johnson of Georgia. But you would admit that the
results show an unacceptable risk?
Mr. Dickson. Yes. And that is why the actions were taken,
to reduce that risk.
Mr. Johnson of Georgia. In fact, it is a drastic
unacceptable risk, is it not?
Mr. Dickson. Yes. So what it is indicating to us is
essentially, over the life, about a 45-year period, that we
would have an unacceptable level of risk, and so we need to
take action to be able to reduce that risk to the level that we
want.
Mr. Johnson of Georgia. So this is definitely an important
document that exists within the bowels of the FAA. Correct?
Mr. Dickson. It is a decision support tool. Remember that
before, data like this was----
Mr. Johnson of Georgia. My question is that this document
exists in the bowels of the FAA. Correct?
Mr. Dickson. It exists--I wouldn't necessarily say--I think
we are pretty aware of it at the highest levels of the FAA now.
Mr. Johnson of Georgia. But when did the highest levels of
the FAA--well, let me put it like this: Who was it that took
action on this report? And when was the first action taken?
Mr. Dickson. Well, the first action was taken just about
immediately, I think.
Is that correct, Earl?
Mr. Johnson of Georgia. And so what was the date? And what
was the action taken?
Mr. Dickson [to Mr. Lawrence]. How would you describe that?
Mr. Lawrence. So the first action that was taken, sir, was
the emergency AD, even before these forms were completed, and--
--
Mr. Johnson of Georgia. Well, I want to know: After this
form was completed, what was done? Because you have said that
it was a drastically unacceptable risk. And it was--this study
was performed prior to the Ethiopian Airlines crash.
Mr. Dickson. Yes, sir.
Mr. Johnson of Georgia. Which my friends on the other side,
by the way, want to try to impugn that it was the Ethiopian
Airlines, an African airline, and their personnel who were
somehow responsible for both of these crashes, when this
hearing is about the FAA certification process. And I resent
that.
But getting back to my point here, what was done about this
report when it was first received by the FAA?
Mr. Lawrence. So again, this is a tool used by our----
Mr. Johnson of Georgia. What was the date?
Mr. Lawrence [continuing]. By a board that meets on a
regular basis, and----
Mr. Johnson of Georgia. What was the date on this? What is
the date?
Mr. Lawrence. Yes. Before this report was even completed,
it was recognized that we needed to do additional work, that
even the----
Mr. Johnson of Georgia. OK. Well, what I am getting to is
what was done after this report was generated?
Mr. Lawrence. Before this report was generated, the action
was----
Mr. Johnson of Georgia. After the report was generated.
After the report was generated, is what I was getting at.
Mr. Lawrence. There wasn't an additional action after this
because the action prior to this even being completed was to
redesign the system. What this report guided the board to look
at was how much time would we allow Boeing to redesign the
system?
Mr. Johnson of Georgia. Well, let me ask this question. Can
either one of you admit to yourselves that the FAA made a
mistake in not taking action on this TARAM report when it was
first issued?
Mr. Dickson. I would say that this is something that we
need to look at very closely, and----
Mr. Johnson of Georgia. Well, I mean, was a mistake made?
Mr. Dickson. Obviously, the result is not satisfactory.
Mr. Johnson of Georgia. Well, you just can't bring yourself
to say that we made a mistake? And you weren't even there at
the time.
Mr. Dickson. Absolutely. This is a part of the process that
we need to look at. Whether it was the data that goes into the
decision, the decision did not achieve the result that it
needed to achieve.
Mr. Johnson of Georgia. Now, is the fact that the FAA,
overseeing Boeing with 45 personnel to 1,500 to Boeing--does
that indicate that perhaps there is a problem with staffing in
the FAA certification process so that we do not allow the fox
to guard the henhouse to the extent that it happened with the
737 MAX?
Mr. DeFazio. If you could briefly answer his question
because we are over time.
Mr. Dickson. I think that that is something that we need to
look at. It is not numbers as much as it is the skill set
within the workforce because that group that is overseeing the
Boeing ODA has the ability to draw resources from without the
agency, very similar to the way that a certificate management
office oversees an airline.
Mr. Johnson of Georgia. OK. Thank you.
Mr. DeFazio. I thank the gentleman.
Representative Miller.
Mrs. Miller. Thank you, Chairman DeFazio.
And to all of you who lost loved ones, my heart goes out to
you. I hope you have been able to be surrounded by family and
friends and your faith in love and the light that it will bring
you. It was a horror for you, and my heart does go out to you.
I think that this discussion and the questions that we have
had today from both sides of the aisle indicate how we want to
not ever have this happen again. It is definitely a bipartisan
issue because we are all human beings, and we all want to be
safe, and we all--I assume we all take airplanes somewhere at
some time in our life. And there are moments when you fly, if
you are not a pilot, you kind of go, ooh, what was that?
And so moving forward, it appears to me that we need more
transparency and communication when it comes to creating an
international aviation safety standard that does work for
everyone. It also appears that there are many areas that we
need to work on. The only way for us to come together to tackle
safety is to understand that we need to take a multifaceted
approach to the issue. And I believe that is what you all are
trying to do.
Mr. Dickson, can you elaborate on the Joint Authorities
Technical Review and what exactly is included?
Mr. Dickson. Well, thank you, and I appreciate the question
and the opportunity to comment. I agree with you 100 percent
that these issues need to be looked at from an aviation system
perspective. And we are seeing a lot of growth in the system
internationally, and the U.S. is a stable--it is a growing,
healthy system, but it is a pretty mature, stable system. And
what we do here, we are selling airplanes around the world. It
needs to be able to work everywhere. And so the issues that we
need to look at may vary somewhat.
But in terms of the JATR report, I think it is very
important to understand that the FAA commissioned that group
itself. But it is sort of like one piece of the pie. And it
does not offer the complete perspective. The perspective from
the TAB is another perspective that will inform our future
efforts. We also have the Secretary's Special Committee. We
have the investigative activities of this committee, as well as
the Senate Commerce Committee, and then also, the DOT IG
report.
So all of these things, and including our own internal
analysis, will help us get to the right answer. And that is
what we look forward to working with you on.
The JATR report really comes down to--if you take all of
the 12 recommendations, it really comes down to 3 things. And
that is, A, a holistic approach rather than, OK, I have
followed this rule and worked down the checklist. More
transactional is the word that I use in aircraft design.
A more effective integration of human factors
considerations throughout the design of the aircraft, and not
just building the machine and then figuring out how to operate
it on the end. Now, that is simplistic. That is not how the
process works today. But that is an end of the spectrum that
maybe we need to move a little more closely to what I have
described with a more integrated human factors approach.
And then there are some shortcomings that have been
identified that I have seen in how various offices within the
manufacturer communicate with each other, and then the entities
within the FAA. I think we need to bolster our systems
engineering expertise. We don't build the airplane. We just
need to oversee the process by which the manufacturer builds
the airplane.
And to do that system engineering expertise is very
important to understand how all these systems interact; and
then also, project management discipline, because these
certification projects take place over multiple years. And if
you look at the continuing operational safety of a fleet, you
are talking about a product that is going to be out there for
maybe 35 to 50 years, from----
Mrs. Miller. OK. I want to interrupt you also. I want to
ask you: Knowing that our products will be used across the
world, often in places that we are not able to regulate, how
can we continue to improve safety standards across aviation as
a whole?
Mr. Dickson. Well, that is a great question. It is
something that is of great interest to me. Again, there are
ways that we can work through ICAO, and there are ways that we
can work bilaterally and regionally. But we also need to take a
look at, what are the responsibilities when you are developing
and selling a product around the world, not just for a U.S.
manufacturer, but for all the certification authorities that we
talked about. And how do you take those issues into account?
And does the manufacturer need to be looking at who the
customer is in terms of what the support is in terms of
operation?
Mr. DeFazio. I thank the gentleman for his answer.
Just back for a minute to the TARAM, and I hate to keep
belaboring, but I still think this is an incredibly critical
issue. And in response to Representative Johnson, you said the
result wasn't satisfactory. And again, I want to really track
how that was utilized in the decisionmaking process because
yes, you issued an airworthiness directive, but that was the
month before.
Then you got the TARAM, which says, wait a minute. We are
going to lose 15 of these planes, and you just said 35 to 50
years. But when within 35 to 50 years? And unfortunately, it
was within 5 months. So I think it was way less than
satisfactory. It was catastrophic.
So with that, we would turn to Sean Patrick Maloney.
Mr. Maloney. Thank you, Mr. Chairman.
Mr. Dickson, do you know who Ed Pierson is?
Mr. Dickson. I have not met him personally, but I know of
him.
Mr. Maloney. And you understand he was the senior manager
at the Boeing 737 Renton, Washington, plant. Right?
Mr. Dickson. Yes, I do.
Mr. Maloney. And you understand he oversaw production for
the 737 final assembly?
Mr. Dickson. Yes.
Mr. Maloney. And a moment ago when you were responding to
my colleague's questions, you could not bring yourself to say
that the FAA made any mistakes here. I know you used different
language. I think some of us would feel better if you showed a
little more passion for this, sir.
So I want to give you another opportunity at this. I know
you knew that he wrote to you--that Mr. Pierson wrote to you
once in September. But in fact, he wrote to you three times,
sir. He wrote to you in September, he wrote to you in October,
and he wrote to you in November. And I know you just got on the
job.
But he didn't just write you letters. He sent you extensive
information, didn't he, sir?
Mr. Dickson. Yes.
Mr. Maloney. On production problems that he identified at
the Renton facility?
Mr. Dickson. Yes.
Mr. Maloney. So my question to you is: Have you interviewed
Mr. Pierson?
Mr. Dickson. We have reached out to Mr. Pierson to
schedule----
Mr. Maloney. That is not my question. Have you interviewed
him?
Mr. Dickson. I know that we have contacted him, yes. I
don't know if--I am not----
Mr. Maloney. Excuse me. He is sitting right over there.
Will you commit, as we sit here today, that you will interview
Mr. Pierson?
Mr. Dickson. Absolutely.
Mr. Maloney. Will you investigate the production problems
at the Renton facility?
Mr. Dickson. Yes.
Mr. Maloney. Have you done so to date?
Mr. Dickson. I know that there is ongoing activity through
our oversight.
Mr. Maloney. Sir, I am sorry. That is not good enough. You
have got a bunch of people over here who lost loved ones. Come
on. Have you to date investigated production problems at the
Renton facility?
Mr. Dickson. I believe we have. I am not aware of the
details.
Mr. Maloney. Well, let's talk about that. Have you got any
information on that, Mr. Lawrence? Have you interviewed
production line workers at Renton?
Mr. Lawrence. Yes, we have.
Mr. Maloney. How many?
Mr. Lawrence. I cannot give you a specific number. We do
have open investigations on the production of the----
Mr. Maloney. Is it more than five?
Mr. Lawrence. I would not quote a number without going back
to my investigators to give you the exact number.
Mr. Maloney. So it is fair to say that neither of you have
any specific information about whether you have actually
interviewed production workers at Renton. I mean, I know you
say you think you have. I know you say you are going to look
into it.
Sir, we are sitting here at a hearing in the United States
Congress. You have been on the job for a while now. I take it
this is the most important thing on your plate, fair to say.
Right?
Mr. Dickson. Absolutely.
Mr. Maloney. So are we going to interview the production
workers at the Renton facility? Is it going to be a real thing?
Can you come to us and give us some answers to what you are
actually going to dig into? Because we know this was not just a
software problem. Right? We know it was a hardware problem.
And you got a guy who wrote you detailed information who
served at the plant as the senior manager, who served 30 years
in the Navy before that. Naval Academy grad. Knows what he is
talking about. Couldn't get an answer to three detailed letters
he sent you. Never interviewed him as we sit here.
And honestly, it would be great if you had some specifics
on what you have done to look at the production problems at
that facility. Can you shed any light on that for us?
Mr. Dickson. You have my commitment that we are looking
into those problems, and we will continue to do so.
Mr. Maloney. But you don't know whether you--you don't know
how many workers you have interviewed?
Mr. Dickson. Not sitting here today, no.
Mr. Maloney. Mr. Lawrence?
Mr. Lawrence. We have interviewed workers, and we can
provide those for questions for the record afterwards.
Mr. Maloney. I would appreciate that. Have you reviewed
quality and production records from the facility?
Mr. Lawrence. Yes, we have.
Mr. Maloney. Would you tell us about that?
Mr. Lawrence. There are ongoing investigations, and again,
we can look at providing additional investigative reports at
the appropriate time.
Mr. Maloney. So you can't tell us anything about whether
you have learned anything as we sit here about whether
production problems, detailed in great detail by Mr. Pierson in
the letters he sent to you now months ago--I mean, are you
aware that 4 months before the first crash, he brought these
problems to Boeing's attention? Are you aware of that,
gentlemen? Four months before the first crash.
Mr. Dickson. I know that there were--yes, that concerns
were raised, yes.
Mr. Maloney. That is right. And do you understand that
after the Lion Air crash, he went up and down the chain at
Boeing. He went to the CEO. He went to the general counsel. He
went to the board. Are you aware of that? He sent them letters,
too.
Mr. Dickson. Yes.
Mr. Maloney. Saying all the same things. And you know what
they did? They sat on it until a second plane crash. That is
what happened. A bunch more people lost their lives.
Some of those pictures are right over there. And so we are
sitting here now, a year later, and neither of you can tell me
whether you got anything specific on the production problems
that he identified 4 months before the first crash?
So I am going to give you another chance, Mr. Dickson. Has
the FAA made any mistakes here?
Mr. Dickson. I think that is evident, that we have got
issues that I need to address and that our team needs to
address, and that we have processes that need to be improved.
So I would agree with you.
Mr. Maloney. You can't say that word ``mistake,'' huh? That
one is just sticking on your lips there.
Mr. Dickson. I don't want to blame other--again----
Mr. Maloney. It is not about blame, sir. It is about
accountability. We are not trying----
Mr. Dickson. Accountability--OK. again, I am accountable.
So I hold myself accountable.
Mr. Maloney. Can you say that the FAA made a mistake in not
taking seriously Mr. Pierson's concerns in a timely way?
Mr. Dickson. We are taking the--we are taking all concerns,
any concerns that are raised, we are going to take seriously
and run them to ground in a systematic way so that we can make
the right decisions.
Mr. Maloney. Yield back.
Mr. DeFazio. I thank the gentleman for his questioning.
And I would just ask, very quickly, given the
investigation, which you tell us is ongoing, of the production
issues, will that be completed and instruct you in terms of
whether or not the plane is allowed to fly, and under what
conditions it is allowed to fly, and what conditions of
inspection will be mandated on these planes before it is
allowed to fly?
Mr. Dickson. We will----
Mr. Lawrence. One thing that I can add is we have retained
the issuing of the airworthiness certificates. And so the FAA
will be doing that this time. It is not going to be part of the
Boeing system. So we will be doing that ourselves to assure
that they earn airworthy condition before any are returned to
service.
Mr. DeFazio. All right. Thank you.
Mr. Meadows.
Mr. Meadows. Thank you, Mr. Chairman.
Mr. Lawrence, I am going to follow up on something that Mr.
Maloney just shared because I think it is important that we get
to the bottom of this.
Is it reasonable to expect that in the next 60 days, that
you can interview an additional 10 line workers at the
facility?
Mr. Lawrence. Whatever--wherever the investigation----
Mr. Meadows. All right. Well, I will make it harder, then.
That was a softball.
Mr. Lawrence. Yes. Yes.
Mr. Meadows. And so I am going to throw an inside pitch. By
gosh, interview at least 10 people and report back to this
committee. Do I have your commitment to do that?
Mr. Lawrence. Yes, you do.
Mr. Meadows. All right. Mr. Dickson, I am going to come to
you because you have obviously been advised by counsel or
somebody to not admit that the FAA made a mistake. And I am
just giving you--your counsel is giving you bad advice.
Did the FAA at some point in this process make a mistake?
Mr. Dickson. Yes.
Mr. Meadows. Thank you.
Mr. Dickson. Yes. My only--again, my only--I just don't
want to leave it at that. That is my point----
Mr. Meadows. No. I get that. And listen. There is enough--
--
Mr. Dickson [continuing]. Is that I want to--I want to
take----
Mr. Meadows [continuing]. There is enough pictures over
here and enough blame to go around. I get that. But what I am
saying is, it is very frustrating, when it is obvious that
mistakes were made, that you just don't say, ``Mistakes were
made.'' And I understand lawyers always say, ``Don't admit
anything because of this.''
But I am just telling you, in the real world we have to
look at it that a mistake was made, and obviously, not one but
multiple mistakes. And we have got to get to the bottom of it.
So here is my question for you.
There is the suggestion--the committee has had the
suggestion--that indeed, that there is a perverted incentive on
the certification process, where you have FAA employees that,
whether it be bonuses or anything else, that they don't
actually engage in the proper way of putting safety first.
Would you agree with that? Not agee with that? Comment on
that?
Mr. Dickson. I do not agree with that. And I have made it
very clear to my workforce and my team that I support them in
keeping safety as their highest priority.
Mr. Meadows. All right. So what do we have to do to make
sure that when things come in--and let me just tell you, you
have got two people behind you that are part of your staff that
I have the highest regard for. One worked on committee staff
with me. The other worked in my personal staff, Mr. Newman. And
there is no one who will work harder on this issue and get
involved in it.
And so I know you have got some people that are very
capable working with you. I guess my question to you is: How do
we put in the process of making sure that what we have is that
it doesn't go into--I am not going to use a black hole
narrative. But how does it not get swept up in the bureaucracy
where there is a concern. There is a legitimate concern. And it
just doesn't reach the right person until we have a fatality.
How do we change that process?
Mr. Dickson. Well, there are several different ways. So you
can't get into analysis paralysis, or bureaucracy in these
things. You have got to have real-time data upon which to make
decisions that is visible across the whole organization.
Mr. Meadows. I am glad you said that because here is one of
the things. This is not the chairman's first rodeo nor mine.
And when we talk about certification, I want to streamline
certification. What I am concerned about is the FAA looks at
the certification process--and we are recertifying screws and
things that, quite frankly, are taking a whole lot of time. And
then on the critical areas, they get the same bandwidth in
terms of the certification process, whether we are working with
Boeing or anyone else.
Is there a way for us to highlight those new areas that are
coming to the market as part of an aviation product, and
perhaps de-emphasize some of the other things in this
certification process to speed it up, whether it be on private
individuals, or in this case, a commercial? Is there a way for
us to do that?
Mr. Dickson. I certainly think there is a way to make the
process less bureaucratic and more fluid. That is part of what
the JATR worked for.
Mr. Meadows. Will you come up with four recommendations to
report back to this committee on how you can do that?
Mr. Dickson. Yes.
Mr. Meadows. All right. And then the last thing, in the 20
seconds I have left. Obviously, we have got a system that has
not been repaired and it still has flaws in it. Will you commit
to the American people right now that you will set up a hotline
for our pilots to call in, that if they are seeing an issue--so
the users, the very people that actually have to use equipment,
where they can get something to you right now where that comes
to your attention, will you be willing to set that up in the
next 60 days?
Mr. Dickson. We have a hotline now.
Mr. Meadows. That comes to you. I know you have a hotline.
We have got hotlines all over the Federal Government and they
are worthless because they take about 2 years to get a return
phone call.
Mr. Dickson. Understand.
Mr. Meadows. I am talking about coming to you.
Mr. Dickson. We will set that up, absolutely.
Mr. Meadows. Thank you, sir. I yield back.
Mr. DeFazio. Representative Brownley.
Ms. Brownley. Thank you, Mr. Chairman. And I too wanted to
add my condolences to the families who are here today. As the
holiday season surrounds us, where families gather together,
our hearts and my heart breaks for all of you.
But I also want to thank you very, very much for your
presence here today because your presence is helping us to get
to the truth, and it is only the truth that is going to save
future lives. So I want to thank all of you for being here
today.
And I wanted to ask one more time, with regards to this
risk assessment predicting 15 more accidents. And I wanted to
ask the question, maybe, in a different way.
Mr. Dickson, you have said several times that the buck
stops with you, and you are the man ultimately accountable for
the FAA. And so we have talked a lot about the past, and we
understand that the past has to be fixed.
So I want to look to the future and say that if an employee
had brought this risk assessment to you and put it on your
desk--you are the FAA Administrator--you were given that
information. Would you have made a decision, a risk
assessment--and I understand it is over 45 years--but that 15
more accidents could occur, would you have grounded the
airplane?
Mr. Dickson. It is hard to Monday morning quarterback these
things, as you know. And I believe that the individuals who
were involved in making the decision were acting on the best
information they had at the time.
Ms. Brownley. But I am talking about you in the----
Mr. Dickson. They were taking action to drive that level of
risk.
Ms. Brownley. I am talking about you in the future now.
Mr. Dickson. With what I know now, yes. Yes.
Ms. Brownley. If that came to you----
Mr. Dickson. With what I know now.
Ms. Brownley. If that came to you and you saw that report,
you would ground the airplane today?
Mr. Dickson. I would have----
Ms. Brownley. Not second-guessing what happened in the
past, but today.
Mr. Dickson. With what I know today, yes, with what I know
today. But again, it is hard for me to go back and determine in
those days what information goes into----
Ms. Brownley. Yes. I am just trying to set a similar story,
but something that would happen in the future where you're----
Mr. Dickson. And remember, this document that we have been
looking at is only a decision support tool. It is not the
decision. The CARB comes together with subject matter experts,
and certainly I would want to confer with them and make sure
that we ran all the issues to ground on making a decision.
Ms. Brownley. You would be on high alert, though, if that
document was before you?
Mr. Dickson. Yes.
Ms. Brownley. And you would ultimately ground the airplane,
if I understood you correctly?
Mr. Dickson. Well, again, knowing what I know now, it is
impossible for me to go back. I know a lot more now than they
knew back then.
Ms. Brownley. Thank you. The other thing, Mr. Dickson, I
wanted to ask is that there was a Washington Post story last
night that revealed that the FAA plans to establish the
aircraft certification safety program management branch. And
apparently this is a new safety branch to address gaps in FAA's
oversight following the accidents and will ``help improve
understanding of systemic areas of risks, and facilitate
identification of emerging safety issues.''
I have to say I am disappointed to read about it in the
media instead of hearing directly from the FAA. Can you tell us
why the committee was not made aware of it? And secondarily,
how will this new office help ensure that the same mistakes are
not made in the future?
Mr. Dickson. So this actually is misreported. The purpose
of this office--it is actually a reorganization that Mr.
Lawrence had been looking at for--I think the organization had
been looking at it for about 2 years. And he can give you the
details.
Mr. Lawrence. Thank you for the opportunity to clarify that
one. It was a misrepresentation of an email that had gone out
by my staff. There is no new office. There is an Office of
Accident Investigation; that still exists and will continue,
and there is not a change there.
It was how I was organizing my folks, has been repeated
several times here. There are always opportunities to improve
our system, to do a better job on communication and the flow of
information within any organization. And that was an email
announcing that we were assigning somebody to look at how best
to set up the flow of communication and safety information
within the organization.
So yes, we are taking action. But it has not been--it is
not a new office, and certainly was not an approved
organization of any kind. It was----
Ms. Brownley. So you are evaluating a reorganization to be
more effective?
Mr. Lawrence. It is part of our reorganization that was
started 2 years ago, and making the tweaks and fixes as we go
through that to make sure that we are covering all the issues
that we should be in an appropriate way.
Ms. Brownley. Thank you. Mr. Chairman, I yield.
Mr. DeFazio. I thank the gentlelady.
Representative Carbajal.
Mr. Carbajal. Thank you, Mr. Chair. I am a little under the
weather so I am going to try to get through these questions.
But first, I want to offer my condolences to the families
that are here today. I can't even imagine your pain and your
loss.
Administrator Dickson, from the emails released to the
committee in October, it is clear that Boeing did not want to
disclose the MCAS in the flight crew operations manual, FCOM,
an aircraft training manual for pilots. Boeing minimized or hid
the true power of the MCAS system, convincing the FAA to delete
mention of it in the FCOM, and therefore hiding its existence
from the Flight Standardization Board.
What do you plan to do within the FAA to ensure and change
this dynamic? And two, how will you ensure that the FAA and not
Boeing or some other manufacturer is determining what is and is
not appropriate for pilots to know about what is on their
airplanes?
Mr. Dickson. Thank you for the question. This gets back to
the issue that was identified both through the interviews and
emails that you spoke about, and by the Joint Authorities
Technical Review, that this design change was not communicated
to the FAA, the folks who needed to make the decision on the
aircraft evaluation group.
I believe that there were some communications, perhaps, to
our flight test group or within the engineering circles, but
they didn't make it so that we had issues both within the
agency and----
Mr. Carbajal. Mr. Dickson, we could spend all day talking
about what transpired. But the question is: What do you plan to
do to change this dynamic so it doesn't continue to happen
again?
Mr. Dickson. So improve our project management to make sure
that the team is staying together as a cohesive team so they
are all hearing things at the same time, no matter what phase
of the project that we are in, and everybody understands what
the implications of design changes may be.
Also putting gates into the process to make sure that we
have checkpoints going because you have got a bunch of parallel
processes going on at the same time. From time to time we need
to loop back and make sure that these systems interact
correctly.
Increased use of system safety assessments, as we talked
about earlier.
And then finally, I would like to work with the Congress on
implementing safety management systems for manufacturers, which
will again facilitate even better information flow between the
applicant and the agency.
Mr. Carbajal. And does that address the issue of having the
FAA be in the driver's seat and making the determinations, not
the manufacturers?
Mr. DeFazio. Yes. We make those determinations now, and we
will continue to do so.
Mr. Carbajal. Thank you. Administrator Dickson, I would
also like to get your thoughts on the recent testimony from the
National Transportation Safety Board Chairman, Robert Sumwalt,
where he highlights the positive benefits of safety management
systems.
Given your experience in the aviation sector, do you agree
with the Chairman's perspective that safety management systems
improve safety?
Mr. Dickson. I have spoken with Chairman Sumwalt about
this, and we have had dialogue on their recommendations and on
SMS, and I am a huge proponent of SMS. I believe it has been
very beneficial in the airline industry and the commercial
aviation industry. And it should be applied in this environment
as well.
Mr. Carbajal. Do you have personal experience with the SMS
system during your time at Delta?
Mr. Dickson. Yes, sir, I do.
Mr. Carbajal. Do you think adoption of the SMS system for
manufacturers with FAA oversight would provide similar
benefits?
Mr. Dickson. Yes. In multiple ways. It provides the ability
for, again, a systematic way for the regulator to get higher
fidelity data, more in realtime, from the manufacturing
process. It also creates more fluid communication both within
the agency, for folks to raise concerns and for them to be
processed, and for us to go back to the workforce. But it
requires the participation of labor, and also the agency, and
also the manufacturer to be able to make it work effectively.
Mr. Carbajal. Thank you. You know, I have heard a lot of
issues and suggestions raised by my colleagues today--the
hotline that was suggested, a number of other things. As a
second-term Member of Congress, I always wonder: When do we
find out if all those items were implemented? When will you
report back to us after this hearing to go over that list of
issues that were discussed today, to share with us when they
have been implemented or will be implemented in terms of a
timeframe?
Mr. Dickson. I will work with the chairman and the ranking
member to put a timeline on those things. Some of what we have
talked about, we are already doing, and we have incorporated
some of the lessons learned from the MAX return-to-service
process. We will apply those immediately going forward.
We are looking, as an example, at some of the lessons that
we learned from the TAB process, and bringing them into our
certification activities going forward. So it sort of depends
on the topic that you are talking about, but I am happy to work
with----
Mr. Carbajal. Thank you. I am out of time. I would
appreciate getting that information. Mr. Chair, I yield back.
Mr. Meadows. Yes. To my second-term colleague, because
after two terms you start to understand this is the land of
promise but not necessarily delivery, so that is why I put a
60-day timeframe on those requests. And so either we will get
that back in 60 days or we will get an explanation of why. And
I will be glad to work with you in a bipartisan manner to make
sure that we get it done.
Mr. Carbajal. Thank you.
Mr. DeFazio. I thank the gentleman for his clarification.
Representative Stanton.
Mr. Stanton. Thank you very much, Mr. Chairman.
Administrator Dickson, at our last MAX hearing in this
committee last October, Boeing admitted that MCAS did not meet
its own design requirements. I think we have a slide that is
going to come up now.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. Stanton [continuing]. This is taken from Boeing's
coordination sheet, which outlined the company's requirements
for MCAS. As you can see, Boeing's criteria stated: ``MCAS
shall not interfere with dive recovery.'' It also stated:
``MCAS shall not have any objectionable interaction with the
piloting of the airplane.''
When I showed this to Boeing at our last hearing, Boeing's
chief engineer admitted the obvious, that MCAS interfered with
dive recovery on both Lion Air flight 610 and Ethiopian Air
flight number 302.
Administrator Dickson, do you agree with that assessment?
Mr. Dickson. Based on what I know about how the system was
initially designed and how the design was changed, I think that
is correct.
Mr. Stanton. Unfortunately, when I asked another obvious
question on whether MCAS had an objectionable interaction with
the piloting of the accident flights, Boeing did not give a
straight answer. In plain and simple terms, Boeing failed to
admit that the MCAS impacted the ability of the pilots to
control the plane. That is shameful.
How can anyone look at what happened in the cockpit of
those flights and think the pilots had any chance to counter a
system that they knew nothing about? This coordination sheet
that you have on the screen today is dated June 11, 2018, which
is after the MAX was certified. But we have seen earlier
versions of the same document from March 2016, before the MAX
was certified, and it contains the exact same MCAS design
requirements.
Administrator Dickson, did the FAA receive a copy of this
coordination sheet before the MAX was certified?
Mr. Dickson. I am not aware that we would have. And I
believe that is around the time when the design was modified.
But I would have to check.
Mr. Stanton. Should the FAA have received this document?
Mr. Dickson. I would say so.
Earl, have you got any opinion on that?
Mr. Lawrence. Well, this document is outlining what our
requirements are on Boeing. And so these are the regulatory
requirements, and this outlines what the requirements would be
to obtain certification.
Mr. Stanton. Thank you.
Mr. Dickson, did MCAS interfere with dive recovery on Lion
Air flight 610 or Ethiopian Air flight 302?
Mr. Dickson. Yes, it did. I would just point out again that
there is--the pilot, again, is part of that system. And the
design was relying on the pilot to be the mitigating factor,
and that proved to be incorrect.
Mr. Stanton. Boeing failed to meet its own design
requirements for a system that was certified by the FAA.
Despite this shocking reality, has the FAA issued any fines or
penalized Boeing for that failure at this time?
Mr. Dickson. Not at this time. But I reserve the right, as
I said earlier, to take action in the future.
Mr. Stanton. Beyond the design requirements, has the FAA
issued any fines to Boeing for its failures on the 737 MAX?
Mr. Dickson. Not at this point.
Mr. Stanton. And my final question: Since these tragic
accidents, has the FAA made any changes to how it certifies
software design requirements, certifies other manufacturer
aircraft components, or to any part of the certification
process?
Mr. Dickson. Yes. As I mentioned, we have not delegated
anything throughout this process. We are relying on resources
throughout the agency. We have brought in the Technical
Advisory Board to run in parallel with us, with experts from
NASA and Volpe and the Air Force and others. And we are also
working very closely with the international authorities as
well.
Mr. Stanton. So you are working on them, but as of yet, no
specific changes?
Mr. Dickson. Well, yes, those changes are being implemented
for the MAX project. Absolutely.
Mr. Stanton. Mr. Dickson, for me and for so many Americans,
these accidents, these tragic accidents, have shaken our
confidence in the FAA. And we owe it to the families who lost
loved ones to do better, and we must get this right. Anything
else would be a disservice to them and to all those who put
their faith in the safety of our air system.
I yield back.
Mr. DeFazio. I thank the gentleman.
Representative Davids, vice chair of the subcommittee.
Ms. Davids. Thank you, Chairman. And thank you all again
for continuing to be here.
Administrator Dickson, I want to follow up about the rudder
cable on the 737 MAX. As you know, at least half a dozen of the
FAA's own technical specialists, as well as an expert panel
established by the FAA's safety review process, raised serious
concerns that the rudder cable on the 737 MAX could be severed
if the engine failed, causing pilots to lose control of the
aircraft. This concern is not just a theoretical concern. The
FAA guidance is rooted in the tragic 1989 DC-10 crash in Sioux
City, Iowa. And 112 people died in that crash.
In your response to Chairman DeFazio and the Aviation
Subcommittee Chair Larsen's letter on this issue, you said,
``We followed the FAA procedures.'' Except that doesn't seem to
be the case, which we will get to in a second.
There is a kind of cornerstone of the FAA procedures, which
is that the components will become safer over time. It seems
like a good rule of thumb to follow. So when the FAA reviewed
and approved the 737 NG model, the FAA found that the 737 NG
had a lower risk of a severed cable than the 737 classic model.
And the reason that the risk was lower is because the engine on
the 737 classic was more powerful.
So based on the determination that there was a lower risk
in the 737 NG, it was approved. So there is a 1997 issue paper
for the 737 NG that warned that engines in the future on 737
models, if they got bigger, it would increase the risk of
severing that cable, and that additional steps to protect the
cable would be needed.
Which brings us to the 737 MAX, which has a bigger engine
and potentially greater risks of severing the cable. The FAA,
though, did not require any design changes. Instead, it ignored
that 1997 warning.
So my question is: Why didn't the FAA follow the guidance
from the 1997 issue paper and require additional protections
for the rudder cable?
Mr. Dickson. Well, thank you for the opportunity to
respond. And this is--I think it is important to understand
that these debates and discussions among subject matter experts
are part of what gets us to a safer system. And there are a
couple of different approaches that can be taken in these
instances.
Ms. Davids. Do those approaches include ignoring an issue
paper?
Mr. Dickson. Well, no. I am just saying that there are
approaches on--there are prescriptive rules that can be
followed, and there is also sometimes data that can be applied
based on the performance of a proven system.
And in this case, the team looked at--eventually, when the
decision was made, looked at the mitigations that had been put
in place in terms of floor structure and also the casing around
the CFM LEAP engines, and the reliability of those engines, and
the fact that they are already certified, essentially, from
their initial manufacture as capable of extended twin engine
operations, which is an extremely high level of reliability.
And so taking all of that into account, there is actually a
risk in adding complexity to an improved system that was put in
place in the 1990s to deal with the hardover rudder issues from
the accidents that we talked about earlier. And when you
introduce a fleet that has got additional complexity into an
operation that has already got thousands of airplanes out there
that have different maintenance practices, that itself creates
a risk. And so that is how that decision was made.
And remember that the manager who is making that decision
is actually a technical expert----
Ms. Davids. At FAA?
Mr. Dickson [continuing]. Himself. Yes. FAA, yes.
Ms. Davids. Or with Boeing?
Mr. Dickson. No. At FAA.
Ms. Davids. OK. So the concern here is that, first of all,
you are talking about increased complexity and not following
the guidance that had previously been stated, and not doing a
new type certificate.
So I think there are a lot of inconsistencies in the way
that you are describing this process. And the overarching
concern is that the process for safety reviews is becoming
either inconsistent or more lax, and that control is being
increasingly delegated to the manufacturers.
So I think that--I obviously have run out of time. But I do
think that there needs to be some serious consideration around
the--you have said yourself, this is a whole system. And across
the system, we have been hearing inconsistencies and places
where it seems as though the FAA has been more lax. And I think
that that is something that we can address and need to address.
I yield back.
Mr. Dickson. I can assure you we will not be lax. And
actually, I believe that the decisions that we are making are
going to be more rigorous because of the reliance on data and
performance.
Mr. DeFazio. I thank the gentlelady and the gentleman.
Representative Lamb.
Mr. Lamb. Thank you. And Mr. Chairman, could you put the
slide back up with the 15 number on it that we were looking at
earlier?
Mr. DeFazio. TARAM report?
Mr. Lamb. Yes. Thanks.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. Lamb [continuing]. Now, Mr. Administrator, based on
everything that you know now, and I understand you weren't in
office at this time--but based on everything that you know now,
if you saw a report like this with the 15.373 number on it,
that day or the next day would you have been comfortable with a
member of your own family flying on a 737 MAX?
Mr. Dickson. Yes, I would have. But that is because I
understand how the airplane operates, and I understand how to
deal with flight control issues. But on the other hand, there
is a--immediate aggressive action was being taken. And again,
this is just one aspect of trying to put some rigor around what
otherwise would be a very subjective decision.
Mr. Lamb. Do you think it is reasonable to expect that I,
who am not a pilot, or one of my constituents, who don't know
the inner workings of aircraft and how pilots are trained and
how they receive warning messages like this--do you think it
would have been reasonable for them to feel safe flying on a
737 MAX the day after this information was known to the FAA?
Mr. Dickson. Again, at this point dealing with what were
the driving factors in the accident, in the Lion Air accident;
and again, based on the information that was available at the
time, the emphasis was on the procedural aspect of
accomplishing the runaway stabilizer trim.
And so, again, that was the mitigation that was put in
place immediately. And then a very aggressive timeframe in
terms of the software modification.
Mr. Lamb. Yes. But what I am saying is people are relying
on you to protect them.
Mr. Dickson. Yes.
Mr. Lamb. In an area that they do not know a whole lot
about, and a lot of trust is required for them to participate
and feel safe about our airline industry. And nothing you just
said provides a reason why a person should have felt safe
stepping onto a 737 MAX when the FAA was in possession of the
information.
Let me ask you a slightly different way. There are echoes
in this incident of a situation that happened in western
Pennsylvania, where I represent, in 1994 when there was a plane
crash in Beaver County. And we have a witness coming in in the
panel after you, Captain Cox, who is going to say that that
incident, which was USAir flight 427, ``was a recurrence of a
fault that had brought down United Airlines flight 585 3 years
earlier. We did not learn all we could from it, as a result,
132 perished near Pittsburgh.''
He goes on to say, ``We did not learn all we could from
Lion Air 610 before the Ethiopian 302 accident.'' And as a
result, we lost not only all the people in the Lion Air crash
whose family and friends are with us here today, but the second
wave of people in Ethiopia.
And so what I don't understand is all these years later,
all these years after the Pittsburgh crash in 1994, what is
being done to make sure that we learn the first time and it
does not take two crashes for us to fix the problem? What is
changing?
Mr. Dickson. It doesn't. It doesn't. I mean, that is why we
need to make the processes more rigorous and have better
analytical tools so that we can drive that risk down and know
that the actions that we are taking will have that effect.
Mr. Lamb. Who is being held accountable for the fact that
pilots were not told about MCAS and that, in fact, the
references to MCAS were removed from the manual? Who is being
held accountable for that?
Mr. Dickson. Well, I think that is part of the process that
we are all going through.
Mr. Lamb. So you don't know?
Mr. Dickson. I think we are all being held accountable for
it. And we all need to make sure that that doesn't happen
again.
Mr. Lamb. I think we have different definitions of being
held accountable. Mr. Chairman, I yield back.
Mr. DeFazio. I thank the gentleman.
Now Representative Malinowski.
Mr. Malinowski. Thank you, Mr. Chairman.
Mr. Dickson, earlier in the hearing you said that one of
your priorities is to make sure that there is appropriate
separation at the FAA between business issues and safety
issues. I was struck by that; it is a very important point.
And given that you said that, I take it you believe that
there has not always been sufficient separation between
business and safety considerations. Is that a fair----
Mr. Dickson. Well, I was actually referring to the
manufacturer. I was referring to Boeing and the indications of
pressure on the workforce to accomplish certain things, and
being able to make sure that that didn't impact safety
decisions. And it is something that I want to make sure doesn't
bleed over into our workforce.
Mr. Malinowski. Well, exactly. I mean, I am concerned also
about pressure on the FAA because here is something that those
of us here who have looked at this feel seems to be happening,
that a manufacturer like Boeing will begin production of an
aircraft. They will complete all the steps up to the finalizing
production, including ordering materials, before getting FAA
permissions.
Then they will say, ``Oh, my gosh.'' If the FAA raises a
concern, they will say, ``Oh, my gosh. We have to get--we are
almost there. We will lose a tremendous amount of money if we
don't get this plane into the marketplace.'' And then the FAA
sometimes seems to take that into account.
I mean, isn't that potentially what happened, for example,
when the FAA initially said that flight simulator training
would be required for the 737 MAX, and then Boeing said, ``We
have this agreement with Southwest Airlines. We were promised a
million-dollar rebate per plane if it didn't require flight
simulator training.'' And then the FAA says, ``OK. You don't
have that requirement.''
Do you think those business concerns may have bled into the
FAA's decision there?
Mr. Dickson. I know, having spoken with our AEG pilots in
Seattle, and having read some of what their concerns have been
that have been expressed to the committee investigative staff,
that this was an item of concern that they had from very early
on in the project.
And so they were very engaged from the very early days, and
went through a process of--over a year--of making sure that
pilots from airlines were brought in, actual those who were
flying the 737 NG on a regular basis. We are able to have
proficiency even without additional simulator training on the
737 MAX.
So that was something that was of concern and that was
resolved through the process. But it is something that we need
to watch for, absolutely.
Mr. Malinowski. And what about the decision to exempt
Boeing from the requirement that new commercial airlines be
equipped with the EICAS system that would allow the aircrew to
prioritize all the different cautions and alerts that they
received? That system was required on the 747-400, the 757, the
767, the 777, the 787. The 737 MAX is the only aircraft that
was not required, that was exempted from that rule, I think,
since 1982.
Weren't there cost considerations that factored into that
decision?
Mr. Dickson. That is a great question. In my view, it
wasn't so much of a cost consideration, but how do you
integrate an airplane like that into an existing fleet. And I
will let Mr. Lawrence tell you how that process works.
Mr. Lawrence. So the question on that particular one is we
have a very large fleet and operators of that existing
aircraft. And if you change the procedures and the positioning
and the switches and the information, do you introduce another
safety hazard?
And so that was the debate on that particular system. It
wasn't as much of a cost, per se. It was looking at--you have
Southwest Airlines as an example, with a whole existing 737
fleet. You have all their pilots trained, all their maintenance
folks trained, the whole system built on that. And what are the
risks of introducing a new system that dramatically changes
that?
So it is a debate. We are not saying it is--that there
aren't good arguments on both sides of that discussion. I am
just saying that it is a discussion, and making those
determinations of whether you are going to allow an aircraft to
continue in that fleet in its existing configuration. Those are
all part of the discussions. And safety is the driver in all of
those discussions.
Mr. Malinowski. Thank you. I yield back.
Mr. DeFazio. I thank the gentleman.
Representative Allred.
Mr. Allred. Thank you, Mr. Chairman.
I want to pick up on the line of questioning of
Representative Lamb's around accountability, Mr. Administrator.
As you know, the 737 MAX was certified with the AOA disagree
alert being a standard feature on the aircraft.
However, in August 2017, Boeing learned that the AOA
disagree alert was not functioning on an estimated 80 percent
of the entire 737 MAX fleet. Boeing concealed this flaw from
the FAA and operators for more than a year, during which it
continued to build and deliver planes with this nonfunctioning
alert. More troubling, pilots expected the AOA disagree alert
to be operational and it wasn't.
In July of this year your predecessor, then-Acting
Administrator Dan Elwell, explained how Boeing's actions
violated FAA regulations in a letter to this committee, which I
think we have a slide of.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. Allred [continuing]. This is what he wrote: ``Once
certified by the FAA, all features included on the airplane
become part of the certified type design or approved type
design. These features are mandatory in each airplane produced
to that type design thereafter, whether or not they are
required for safety. . . . Although an AOA disagree message was
not necessary to meet FAA safety regulations, once it was made
part of the approved type design, it was required to be
installed and functional on all 737 MAX airplanes Boeing
produced.''
I will repeat that the disagree alert was ``required to be
installed and functional on all 737 MAX airplanes Boeing
produced.'' You may not believe that the absence of an AOA
disagree alert is a safety issue, but I strongly believe that
Boeing's open defiance of FAA requirements in knowingly
delivering airplanes without it is both a legal and an ethical
issue.
It is my understanding that the FAA has not penalized
Boeing in any way for this conduct, or even taken any other
actions to reprimand the company for its behavior. I know you
have been here 4 months, but the word ``accountability'' has
been used a few times. When I had the CEO of Boeing sitting
here, I told him I thought we might have a different definition
of that word. I hope that you and I don't share a difference in
that word's definition as well.
Why hasn't the FAA done anything to hold Boeing
accountable? It is your agency, and most important to the
public, for this sort of egregious behavior.
Mr. Dickson. Thank you for the question. And we have
already taken actions, as you know. Obviously, the airplane is
grounded. We are not delegating anything to Boeing during the
MAX return to service. We are not even delegating the
individual airworthiness certificates for each aircraft.
We have taken action, recent enforcement action, and we
have additional actions under consideration, both with the
existing settlement agreement that we discussed earlier here,
and there may be additional actions, as required. And I reserve
the right to take them, and I will take them, as appropriate.
And you point out a good example here.
Mr. Allred. Well, thank you. I think that where we have
regulations in place and where we have a purposeful evasion of
them, if there is no consequence for that evasion, then the
regulation doesn't matter.
And so I hope that we will see enforcement of this. And a
lot of my colleagues, we are trying to determine the balance
that we should strike here. Is the process fatally flawed? What
changes need to be made? But this, in my opinion, is an example
of something that is just a decision that needs to be made by
the FAA on how they are going to enforce their own regulations,
knowing that a violation occurred.
Mr. Dickson. Congressman, I couldn't agree with you more.
Safety is our highest priority, most important core value. And
what supports that is accountability.
Mr. Allred. Absolutely. Thank you, Mr. Chairman. I yield
back, if you want to take any time.
Mr. DeFazio. I thank the gentleman.
Representative Garcia.
Mr. Garcia. Thank you, Mr. Chairman.
Mr. Dickson, I would like to ask you some questions about
the FAA's Associate Administrator for Aviation Safety. As you
know, our committee staff had the opportunity to interview him
last week, and you have been provided with a copy of the
transcript.
I have to say I am shocked at some of the things he didn't
know. One, he hadn't seen Boeing's flight crew operations
manual bulletin following the Lion Air crash. When he was shown
a copy of the flight crew operations bulletin that Boeing
issued following the Lion Air crash, he said this was the first
time he had seen it.
He was asked, ``Have you seen this document before?'', and
he replied, ``No, I have not. But it is an FCOM--flight crew
operations manual.''
He was then asked, ``You don't recall seeing this prior to
today?''
He answered, ``No.''
And two, he was unaware that Boeing knew if a pilot didn't
react to the unanticipated MCAS activation within 10 seconds,
the result could be catastrophic. The slide that has come up on
the screen shows Boeing's coordination sheet. When we asked him
about this key document that was released at our last hearing--
showing that Boeing knew that if pilots did not respond to
unanticipated MCAS activation within 10 seconds, the result
could be catastrophic--he said he was not aware of the
document.
[Slide]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Garcia [continuing]. FAA's chief safety officer was
asked, ``So let's take it out of the hypothetical. You are
aware that this committee held a hearing on October 30 at which
Boeing testified. Is that correct?''
``I watched some of it,'' he replied.
He was then asked, ``OK. At the hearing, a document was
made public, a coordination sheet from Boeing on which
contained a functional hazard assessment, a portion of which
said if a pilot didn't react within 10 seconds, the result
would be catastrophic. That was information made public at the
hearing. Were you----''
He interrupted, ``No. I was not aware of that.''
The Member then asked, ``You didn't watch it? Weren't aware
of it? So you are not aware?''
And Mr. Bahrami replied, ``No, I didn't. You know, like I
said, I was in Montreal at the assembly, and I just watched
portions of the hearing. And I do not know about this
document.''
Administrator Dickson, this was the response of the FAA's
chief officer. He seemed completely unaware of the fact that
Boeing believed if pilots reacted to unanticipated MCAS
activation in 10 seconds or more, it could lead to the complete
loss of the aircraft. The result? Catastrophic accident, like
we saw in the Lion Air crash and the Ethiopian Airlines crash.
This seems like a pretty important piece of information for
the head of safety of FAA to be aware of and understand. This
release of this document was widely reported in the press,
including by the New York Times, Washington Post, Seattle
Times, Forbes, Reuters, and NPR.
Mr. Dickson, do you believe the Associate Administrator for
Aviation Safety, FAA's chief safety officer, should have seen
at some point over the past 13 months, a copy of Boeing's
flight crew operations manual bulletin, and that it used after
the Lion Air crash?
Mr. Dickson. You know, I can't substitute my judgment for
his. I believe this is a technical certification requirement or
an assumption.
Mr. Garcia. Should he have known, Mr. Dickson? Yes or no?
Mr. Dickson. You know, I think that--you know, I would hope
that he would have been aware as to what was made public in the
hearing.
Mr. Garcia. So is that a yes?
Mr. Dickson. Again, I will have to talk to him about it.
Mr. Garcia. Thank you. Do you believe the Associate
Administrator for Aviation Safety should be aware that if a
pilot failed to react to unanticipated MCAS activation within
10 seconds, the result could be catastrophic?
Mr. DeFazio. You are on the clock here, at about 7 minutes
here.
Mr. Dickson. Sorry, can you restate real quick? I----
Mr. Garcia. Do you believe that the Associate Administrator
for Aviation Safety should be aware that if a pilot failed to
react to unanticipated MCAS activations within 10 seconds, the
result could be catastrophic?
Mr. Dickson. I think that he was aware of the--of the
criteria. I do not know that he had seen this exact document.
Mr. DeFazio. OK, I thank the gentleman. The gentleman's
time has expired.
Mr. Garcia. Thank you. I yield back.
Mr. DeFazio. Representative Payne.
Mr. Payne. Thank you, Mr. Chairman.
Administrator Dickson, in its report, the Joint Authorities
Technical Review found that the FAA had inadequate awareness of
the MCAS function. Which, coupled with limited involvement,
resulted in an inability of the FAA to provide an independent
assessment of the adequacy of the Boeing proposed certification
activities associated with the MCAS. It appears that the trust
Congress gave FAA with delegation authority has been broken.
What steps is the FAA, and you personally, taking to ensure
that a lapse such as this does not happen again.
Mr. Dickson. Thank you, Congressman, a great question. I
appreciate the opportunity to respond.
Our whole construct here is based on trust. And it is
important that, as the regulator, we can trust the manufacturer
that we are delegating certain things to. And it is a
privilege. It is not a right; it is not a certificate that they
have. It is a privilege to have those items delegated.
That is why we have pulled back on this particular project,
on the 737 MAX. And as we do certification activity----
Mr. Payne. So Boeing does not have that privilege anymore,
correct?
Mr. Dickson. At this point, that is correct.
Mr. Payne. All right. I would suggest that might be
something that is looked at across the board, so there are not
issues with other airlines. But we are talking about Boeing
right now, and so we are trying to make sure that this does not
happen again.
Also, the JATR report also recommended that the FAA conduct
a workforce review of Boeing's Aviation Safety Oversight Office
engineers at FAA to ensure that there is a sufficient number of
experienced specialists to adequately perform certification and
oversight duties. Has there been a workforce review conducted?
Mr. Dickson. Yes, it is in process. There is actually a 10-
year workforce plan for the Aviation Safety Organization. This
group is part of that. And as we get the JATR report and the
other reviews of the process, we are looking specifically at
human factors, such as----
Mr. Payne. So there are no results yet? It is still in the
process?
Mr. Dickson. Yes, and we are putting those into action now.
Mr. Payne. Administrator Dickson, I am the 23d Member on
this side of the aisle to ask questions. And I have sat here
for a lengthy period of time and I have heard you respond
numerous times that we are in the process. Is there anything
that has been completed and done with respect to this issue?
Mr. Dickson. Yes. As I said, we have brought in experts
from outside the agency, the Technical Advisory Board. Mr.
Kiefer is a member of that. We have opened ourselves up to
review as no regulator ever has in this process with the Joint
Authorities Technical Review. We have the Secretary's Special
Committee on Aircraft Certification, which is coming forward
with additional recommendations. And with respect to the 737
MAX, as I have said, we have not delegated any activity,
including the issuing of individual airworthiness certificates,
tail by tail, on those aircraft. So those are some very
significant actions and there are more to come.
Mr. Payne. Well, sir, I would implore you as someone that
is sitting here, as opposed to where you are, and as Mr.
Meadows, the gentleman from North Carolina, asked you and you
were able to answer him specifically that you would have
certain things done in a time period, that you try as
diligently as possible to get these things done.
Sitting here, looking at these pictures is difficult. I
have loved ones of my own. And as I look through those
pictures, I have young children and cousins and brothers that
run the myriad of those pictures. We are fortunate that we are
not sitting there.
So it is our obligation where we sit, to make sure that no
other family has to sit in that corner again.
And with that----
Mr. Dickson. Congressman, I would just say I agree with you
100 percent. That is why we are working diligently each and
every day, really around the clock. And that is why I support
my people in these efforts. And that is frankly why I am going
to personally fly the airplane myself and go through the
proposed training and do everything I can, so that I would put
my own family on the airplane without a second thought. And
that is my absolute----
Mr. Payne. My time has expired. Thank you.
Mr. DeFazio. I thank both gentlemen.
Representative Balderson. I believe these will be the last
questions.
Mr. Balderson. Thank you very much, Mr. Chairman. Thank
you, panel, for being here. Also, I extend my condolences to
the families and thank you all for being here.
Administrator Dickson, on September 25, 2019, Boeing's
Committee on Airplane Policies and Processes announced a new
product and services safety organization. This organization is
responsible for reviewing all aspects of product safety,
including investigating cases of undue pressure and anonymous
safety concerns raised by employees.
Is the FAA satisfied with this new review process and do
you believe Boeing will take anonymous safety concerns reported
by its employees more seriously?
Mr. Dickson. Well, thank you for the question. I think that
it remains to be seen. It is easy to move around boxes on the
org chart and to appear to be doing something. We will have to
see how it is implemented and how it is incorporated into their
safety culture. And we are going to be doing the same thing or
similar things within the agency as well.
But I do think that the ability for employees to
systematically bring forward safety concerns is absolutely
foundational to the safety system that we have.
Mr. Balderson. Thank you. I would agree with that.
My next question for you, Mr. Administrator, is while the
ongoing investigations continue to get to the bottom of these
two crashes, are you aware of any legislation this committee
and Congress can pass now to improve aviation safety?
Mr. Dickson. I would be happy to work with the committee. I
do believe that the support for moving to implementing safety
management systems for manufacturers would be very beneficial.
I also believe that support for data analysis and data
consolidation, making our data systems more modern, that is one
of my most important strategic pillars at the agency and that
is something, another area where I think we can definitely
improve.
Mr. Balderson. Thank you very much. Mr. Chairman, I yield
back my remaining time.
Mr. DeFazio. I thank the gentleman. And I do want to thank
the panel for devoting so much time, I think, answering
questions for the most part responsibly, and for your further
commitments to continue this work and respond to some
particular suggestions that were raised here.
With that, the committee will recess for 5 minutes while we
assemble the next panel.
[Recess.]
Mr. DeFazio. OK, votes are pending so we are going to move
along right now, even though it has not been quite 5 minutes.
Panel 2, I would like to welcome the next panel, Mr. Edward
Pierson, Boeing retiree, appearing in his individual capacity,
with many years of experience in the industry; Mr. G. Michael
Collins, FAA retiree, appearing in his individual capacity,
again with many years' experience in a regulatory role at FAA;
Dr. Mica R. Endsley, president of SA Technologies, former Chief
Scientist, U.S. Air Force, former president, Human Factors and
Ergonomics Society; and Captain John Cox, president and CEO of
Safety Operating Systems.
Thank you all for being here today. We look forward to your
testimony. Without objection, your full statements will be
included in the record.
So we will now proceed with your testimony. Five minutes,
as best you want to summarize.
Mr. Pierson. I don't think it's on.
TESTIMONY OF EDWARD F. PIERSON, FORMER SENIOR MANAGER, BOEING,
APPEARING IN HIS INDIVIDUAL CAPACITY; G. MICHAEL COLLINS,
FORMER AEROSPACE ENGINEER, FEDERAL AVIATION ADMINISTRATION,
APPEARING IN HIS INDIVIDUAL CAPACITY; MICA R. ENDSLEY, Ph.D.,
APPEARING ON BEHALF OF THE HUMAN FACTORS AND ERGONOMICS
SOCIETY; AND JOHN M. COX, CHIEF EXECUTIVE OFFICER, SAFETY
OPERATING SYSTEMS
Mr. Pierson. Forgot to push the button. Sorry.
Chair DeFazio, Ranking Member Graves, members of the
committee, good afternoon. Thank you for inviting me to testify
today. My name is Ed Pierson.
I would first like to provide my heartfelt condolences for
all the families and friends who lost loved ones on Lion Air
flight 610, Ethiopian Airlines flight 302. Your loss and grief
are truly unimaginable.
Please allow me to provide a little information about
myself. I retired from the Boeing Company in August of 2018 as
a senior manager at the 737 factory in Renton, Washington. I
graduated from the Naval Academy, served in the military as a
naval flight officer and held several leadership positions,
including squadron commanding officer. I have over 30 years of
aviation experience.
I believe production problems at the Renton factory may
have contributed to these two tragic crashes. But I do not
believe our regulators are paying enough attention to that
factory, and I am calling for further investigation. I formally
warned Boeing leadership in writing on multiple occasions,
specifically once before the Lion Air crash and again before
the Ethiopian Airlines crash, about potential airplane risk due
to the unstable operating environment within the factory. Those
warnings were ignored.
June 9, 2018, while the Lion Air airplane was being
produced, 4 months before it crashed, I wrote an email to the
737 general manager, advising him to shut down the production
line to allow our team time to regroup so we could safely
produce planes. Following that email, I requested a one-on-one
meeting with the general manager on July 18 and repeated my
recommendation to shut down the factory for a brief period of
time.
When I mentioned that I have seen operations in the
military shut down for lesser safety concerns, I will never
forget his response, which was, ``The military isn't a profit-
making organization.''
During this timeframe, the 737 factory was in chaos. Every
single factory health metric was getting record low marks and
each one was trending in the wrong direction. Those metrics are
detailed in my written testimony and include overtime, quality
reports and out-of-sequence work. Keep in mind that, on October
29, 2018, when the Lion Air plane crashed killing 189 people,
it was only 2 months old.
After the crash, I wrote a letter directly to Boeing's
chairman, president and CEO, Dennis Muilenburg. Mr. Muilenburg
asked the general counsel to communicate with me and we spoke
on three occasions, where I renewed my warnings. I stressed
that investigating the factory, talking with frontline
employees was urgent, as I was very concerned that this might
not be an isolated incident.
On February 14, 2019, Boeing's assistant general counsel
assured me that Boeing had seen nothing that would suggest the
existence of embedded quality or safety issues. I wrote a
followup letter with supporting documentation to Boeing's board
of directors, requesting that they take urgent action, but
received no response.
Less than 1 month later, on March 10, 2019, Ethiopian
Airlines flight 302 crashed, killing 157 people. That airplane
was only 4 months old.
The U.S. regulator's investigation of these crashes has
been as disappointing as Boeing's insistence that it had no
systemic quality or safety issues. Over the last 8 months, I
have delivered detailed information about the factory to those
regulators and investigators. I specifically requested that
this information be shared with the international investigators
in Indonesia and Ethiopia. I also shared production quality
concerns about other 737 airplanes built during that timeframe
at the same factory with the National Transportation Safety
Board, the FAA and the Department of Transportation. The
disturbing responses of the leaders of these agencies are
detailed in my written testimony.
Despite my information, regulators have continued to direct
their primary, perhaps exclusive, focus on their certification
process, pilot training and the design failure of the flight
control system, specifically the MCAS software. But the
component that first failed leading to both crashes is the
angle-of-attack sensor part, which is an historically reliable
part.
Both Boeing and the FAA knew in December of 2018 that the
original angle-of-attack sensor on the Lion Air airplane had
failed, which is clearly a production issue since the airplane
was brand new. Although the defective Boeing-installed sensor
was replaced with a Lion Air-installed part before the crash,
that does not explain why the Boeing part failed in the first
place. It appears the same sensor failed on the Ethiopian
Airlines flight.
Let me be clear. I am not saying that I know factory
conditions caused these two crashes. I am saying that a
combination of three circumstances justify an investigation of
those factory conditions.
First, there have been two fatal crashes.
For the record, I would like to make a note that there was
actually a total of 347 people that were killed as a result of
these crashes. There was an Indonesian diver doing recovery
operations that also passed.
My second reason is I saw firsthand the factory was
stressed beyond anything in my experience.
And third, there have been 13 other safety incidents
involving faulty hardware or other systems, many of which were
serious. Any one of these circumstances alone should justify an
investigation of production. Together, they amount to an open-
and-shut case for such an investigation.
The bottom line is the 737 factory needs to be thoroughly
investigated and closely monitored by regulatory authorities,
specifically the FAA, on a continuous basis into the future. I
have included recommendations for the committee's consideration
in my written statement.
Thank you again for providing me this opportunity. I am
ready to answer your questions.
[Mr. Pierson's prepared statement follows:]
Prepared Statement of Edward F. Pierson, Former Senior Manager, Boeing,
appearing in his individual capacity
Chairman DeFazio, Ranking Member Graves, Members of the Committee,
good afternoon. Thank you for holding this hearing and inviting me to
testify today. My name is Ed Pierson and I am a former Senior Manager
at Boeing's 737 Factory in Renton, Washington. Before I provide my
substantive testimony, I need to provide my heartfelt condolences to
the families and friends who lost loved ones on Lion Air Flight 610 and
Ethiopian Airlines Flight 302. Your loss and grief are truly
unimaginable.
I am here to discuss the alarming state of Boeing's 737 Renton,
Washington factory in 2018. During this period, the factory produced
hundreds of aircraft, including the two 737 MAX planes that crashed in
October 2018 and March 2019. I witnessed a factory in chaos and
reported serious concerns about production quality to senior Boeing
leadership months before the first crash. I formally reported again
before the second crash. No action was taken in response to either of
my reports.
My Background
I worked for Boeing from 2008 until my retirement in August 2018.
In my last assignment I served as a Senior Manager in Boeing's 737
Renton, Washington Factory. In this role, I worked within the
Production System Support organization and oversaw production support
for 737 Final Assembly, P-8 and Wings manufacturing operations. Before
assuming this position, I served as a Senior Manager in the Boeing Test
& Evaluation organization, which is responsible for flight testing
newly manufactured planes. In addition to my work at Boeing, I served
honorably in the U.S. Navy for 30 years, including as a Squadron
Commanding Officer, earning the rank of Captain. I am a graduate of the
U.S. Naval Academy, Navy Flight School and George Mason University. My
resume and military biography are attached as Exhibits 1 and 2.
The State of the Renton, Washington Factory in 2018
The 737 is the flagship of Boeing's Commercial Airplanes division.
Boeing currently manufactures all of its 737 planes in Renton: the 737
MAX, the 737 Next Generation, and the P-8 Poseidon, a military
variation of the 737.
By June 2018, I had grown gravely concerned that Boeing was
prioritizing production speed over quality and safety. In early 2018,
Boeing experienced a substantial backlog in its production of 737
aircraft. Initially driven by the delayed delivery of critical parts,
the logjam quickly cascaded into numerous other problems within the
Renton factory, with key metrics growing continuously worse. ``Jobs
Behind Schedule'' (JBS) spiked to greater than ten times the normal
amount, and the ``Roll Out on Time'' percentage routinely dropped below
10%. In turn, the ``B1 Flights on Time'' rate \1\ also dropped
substantially.
---------------------------------------------------------------------------
\1\ ``B1'' is a flight-test term for the first test flight of a
manufactured airplane.
---------------------------------------------------------------------------
Despite the delays, Boeing continued its much-publicized push to
increase production at Renton from 47 to 52 planes per month in June
2018 and made clear its intent to increase the production rate again to
57 planes per month in 2019. Boeing said nothing about the chaos that
such goals created on the production floor. To meet its heightened
production target, Boeing initiated ``major recovery operations'' at
Renton. I realized these recovery operations were prioritizing
production speed over quality, placing both manufacturing employees and
the flying public at risk. The fallout from these operations was
widespread and largely concealed from public view. In Boeing's 2nd
quarter 2018 earnings report there was zero mention of the state of the
factory.
The factory did not have enough skilled employees, specifically
mechanics, electricians and technicians to keep up with the backlog of
work. As a result, the planned factory overtime rate more than doubled.
From my military and private-sector experience, I knew that employee
fatigue from excessive overtime inevitably produces process
breakdowns--e.g., workmanship mistakes, missed inspection items,
incomplete paperwork, or failure to follow established functional test
procedures--all of which add considerable risk to the safety of
airplanes. Moreover, the parts backlog was leading to substantial ``out
of sequence'' work, meaning the work was performed in an area or at a
time other than its planned location or time. This too increases the
risk of process breakdowns and quality mistakes.
At the same time, actions and decisions by new factory leadership
and a major supply chain reorganization led to further dysfunction.
Boeing canceled daily ``tiered'' meetings, which were crucial to
information sharing between shifts, replacing them with a once-a-shift
large daily status meeting held in the Town Hall conference room.
Following that transition, I witnessed numerous instances where
manufacturing employees failed to communicate effectively between
shifts, often leaving crews to wonder what work was properly completed.
At the new Town Hall meetings, 737 program leadership increased
schedule pressure by publicly grilling lower-level managers about
delays in front of a hundred or more of their peers, even when the
cause of a delay was completely beyond the individual employee's
control. I grew increasingly worried that this dogmatic focus on
schedule, coupled with employee fatigue, would inevitably lead to
rushed work and circumvention of established manufacturing processes.
Many employees expressed similar concerns and frustration publicly and
in private.
Unsurprisingly, the confluence of parts delays, employee fatigue,
out-of-sequence work, communications breakdowns, and schedule pressure
led to a decline in quality. Boeing rigorously tracks identified
process breakdowns and quality defects during production using a
computerized database. Each database entry represents a quality defect
during production, such as incomplete or incorrect build instructions,
missing or malfunctioning equipment, missing inspections, or missing,
damaged, or incorrect parts. More significant defects are elevated to a
``Nonconformance Report'' (NCR), which requires engineering and quality
personnel to sign off on a corrective action. During the relevant
period, the factory saw quality issues increase by over 30%, and NCRs
grew rapidly as well. There were many quality issues related to
Electrical Wiring Interconnect System (EWIS) compliance, such as
problems with functional testing of wiring or chaffed, cut, or pinched
wires. I knew that improperly manufactured, installed, or tested wires
can cause intermittent electrical or electronic data errors on critical
plane systems.
Boeing Refused to Address Its Deteriorating Factory Conditions
Alarmed by the Renton factory's rapid and unprecedented decline, I
emailed the 737 Program's Vice President and General Manager, Scott
Campbell, on June 9, 2018. See Exhibit 3 (emails to 737 General
Manager). Given the serious and time-sensitive nature of my concerns, I
bypassed multiple levels of my supervisory chain and executive
management to communicate directly with Mr. Campbell, the senior 737
executive who could address the factory conditions. I sent that email
nearly four months before the first 737 MAX crash, expressing the
gravity of my concerns as follows:
I fully appreciate the importance of doing our best to meet RO,
paint windows, B1s & delivery schedules. But there is a much,
much higher risk that we cannot lose sight of. I'm talking
about inadvertently imbedding safety hazard(s) into our
airplanes. As a retired Naval Officer and former Squadron
Commanding Officer, I know how dangerous even the smallest of
defects can be to the safety of an airplane. Frankly right now
all my internal warning bells are going off. And for the first
time in my life, I'm sorry to say that I'm hesitant about
putting my family on a Boeing airplane.
To address the worsening factory conditions, I recommended that
Boeing ``[s]hut down the production line to allow our team time to
regroup so we can safely finish the planes.'' In response, Mr. Campbell
assured me that ``safety and quality is number one and schedule come
[sic] after that,'' but he did not acknowledge, let alone act on, my
recommendation that Boeing shut down the line to allow workers time to
safely address the production backlog.
Over the following weeks, factory conditions worsened. In early
July, I requested an in-person meeting with Mr. Campbell to further
discuss my concerns. When we met on July 18, I gave multiple examples
of process breakdowns, explained the numerous metrics indicating a
decline in quality, and reiterated my recommendation that Boeing shut
down the line to address product and worker-safety risks. In response,
Mr. Campbell told me, ``We can't do that. I can't do that.'' I pushed
back, explaining that I had seen operations in the military shut down
over less substantial safety issues, and those organizations had
national security responsibilities. Mr. Campbell responded tersely,
``The military isn't a profit-making organization.''
In addition to shutting down the line, I also recommended a
thorough engineering and quality analysis to determine if the
production environment had caused safety risks that needed to be
disclosed to Boeing customers. Mr. Campbell also bristled at this
recommendation, but ultimately promised to have human resources pull
overtime statistics and to task the engineering and quality
organizations with conducting this analysis.
I left Mr. Campbell's office somewhat shocked by his dismissiveness
and general unawareness towards the factory turmoil. At the
recommendation of another senior manager, I documented the conversation
in an email to Mr. Campbell the next day, noting Mr. Campbell's promise
to address the cultural issues and worker fatigue and to conduct a
quality and engineering analysis to determine if there were ``any
potential quality risks that might require us to alert our customers.''
See Exhibit 3. Before my voluntary retirement from Boeing on August 1,
2018, I shared this email exchange with several colleagues, who I hoped
would monitor the resolution of these problems. To my knowledge, Boeing
never acted on my recommendations.
Boeing Failed to Investigate Its Chaotic Production Environment Even
After Two Deadly Crashes
Several months later, on October 29, 2018, Lion Air Flight 610
crashed, killing all 189 people on board. Because Boeing manufactured
the Lion Air airplane at Renton in the summer of 2018, I immediately
feared the chaotic factory conditions had contributed to this tragic
loss of life. When the Preliminary Aircraft Accident Investigation
Report failed to address that possibility, I started a months-long
effort to force Boeing and the accident investigators to focus on the
Renton factory. My efforts did not bear fruit.
I first made several calls to Boeing's Communications Office,
asking to speak with the Boeing employees supporting the accident
investigation. After weeks of fruitless efforts with the Communications
Office, Norwegian Air Flight 1933--a 737 MAX aircraft also manufactured
in the summer of 2018--conducted an emergency landing in Iran on
December 14, 2018 due to an engine issue. Feeling increased urgency, I
decided to appeal directly to Boeing's Chairman, President and CEO,
Dennis Muilenburg. In a December 19, 2018 letter, I requested Mr.
Muilenburg's assistance in contacting the Boeing employees supporting
the Lion Air accident investigation. Exhibit 4 (Dec. 19, 2018 letter to
Muilenburg). On January 7, 2019, I received a call from Boeing's
General Counsel, retired Judge Michael Luttig. Mr. Luttig stated that
Mr. Muilenburg had reviewed my letter and instructed him to follow up
with me. After discussing my background and concerns regarding the
Renton factory, I again reiterated my request to speak directly with
the Boeing employees supporting the investigative team for the Lion Air
crash. Mr. Luttig acknowledged this request and said he would share my
information with Mr. Muilenburg and CFO Greg Smith.
On January 21, I again spoke with Mr. Luttig about my concerns. Mr.
Luttig said that all the 737s in service had received thorough post-
manufacturing inspections and that Boeing had not seen any issues with
the other planes in the 737 fleet. Mr. Luttig then asked what I would
do to investigate my concerns. I recommended that Boeing establish a
cross-functional team of subject matter experts who could review data
for potential quality and engineering risks and interview employees on
the ground about the health of the Renton factory. In response to this
proposal, Mr. Luttig recommended that they add Assistant General
Counsel Padraic Fennelly to the conversation.
The following day, I spoke with Mr. Luttig and Mr. Fennelly over
the phone and once again reiterated my concerns and recommendations.
Shortly after the call began, however, I came to believe Mr. Luttig and
Mr. Fennelly were more interested in placating me than seriously
investigating the factory conditions. Disappointed with the call, I
promptly documented my core recommendation by email: ``Forming a cross
functional [Non-Advocate Review] team to conduct an objective,
comprehensive assessment of what occurred last year and the current
state of the program . . . This assessment would need to include the
analysis of production related data (e.g., quality data) and talking
with employees.'' See Exhibit 5 (emails exchanged with general
counsel). I stressed that investigating the Renton factory conditions
was ``obviously an ongoing urgent matter--it was urgent last summer
[and] made even more urgent this fall.'' Id.
Two weeks later, having heard nothing further, I sent another email
to Mr. Luttig and Mr. Fennelly, setting out in painstaking detail the
concerns I had been raising since June 2018: employee fatigue and
schedule pressure, aggressive leadership communication, mounting
quality defects (including numerous functional test and Electrical
Wiring Interconnect System problems), staffing constraints, process
deviations, communications breakdowns, and others. I emphasized that
``the sheer volume of these issues highlights the considerable &
unnecessary risk the company was (is still?) taking to meet ever
increasing airplane production rates and delivery schedules'' and that
``production mistakes may have been made with this airplane and
potentially others.'' Id. I also felt Boeing had misled the public
about the state of 737 production: ``Record numbers of airplanes
delivered makes for good headlines, but they can belie the reality of
production health.'' Id.
On February 14, Mr. Fennelly responded that Boeing had considered
my information but had ``seen nothing from any of [its data] sources
that would suggest the existence of embedded quality or safety
issues.'' Id. Unsatisfied, I escalated my concerns to the Board of
Directors in a February 19 letter that detailed my internal reporting
efforts and requested urgent action from the Board. See Exhibit 6 (Feb
19 letter to Board).
Before I received any response, tragedy struck again: On March 10,
2019, Ethiopian Airlines Flight 302 crashed, killing 157 people.
Another 737 aircraft manufactured in Renton in 2018 had experienced a
serious--and in this instance, deadly--safety issue within its first
months in service, despite Mr. Fennelly's assurance less than one month
earlier that there was no cause for concern.
I concluded that Boeing would not take appropriate action on its
own accord. Two days after the crash, I again wrote Boeing's Board,
this time to explain that I would be contacting the National
Transportation Safety Board (NTSB) and Federal Aviation Administration
(FAA) directly due to Boeing's disappointing response. See Exhibit 7
(Mar. 12, 2019 letter to Board).
My Efforts to Engage Federal Regulators
Following my March 12, 2019 letter to Boeing's Board, I immediately
attempted to contact the NTSB and other regulators. After months of
bureaucratic inaction, unexplainable delays, and communications from my
attorneys, an NTSB investigator assigned to the Ethiopian Airlines
crash finally contacted me to arrange a telephone interview. I provided
him with detailed information, yet he estimated that the interview
would require only 15 minutes. That interview occurred on June 26,
2019. See Exhibit 8 (Key points provided to NTSB investigator on June
26, 2019). The NTSB investigator had no responsibility for any matters
other than the Ethiopian Airlines crash. My information, however, was
not limited to that airplane. Instead, it concerned hundreds of
aircraft manufactured over many months, including not only the Lion Air
airplane but also numerous other planes that have experienced
significant safety incidents. The NTSB's reluctance to interview me,
and the limited scope of the interview it conducted, raised alarms that
the agency shares Boeing's aversion to exploring systemic causes for
the crashes.
As a result, I sent a letter through my counsel directly to NTSB
Chairman Robert L. Sumwalt on June 28, 2019, setting forth my concerns
about the condition of the Renton factory in 2018 and the lackluster
response I had received from the NTSB. I requested Mr. Sumwalt ensure
my information be shared with the Indonesian and Ethiopian accident
investigators in accordance with ICAO Annex 13 procedures. See Exhibit
9 (June 28, 2019 letter to NTSB). I provided documentation of my
communications with Boeing leadership; proposed that the NTSB analyze
the engineering, quality data, and manufacturing history of the Lion
Air and Ethiopian airlines planes; and offered to assist the
investigation in any way possible, including by identifying witnesses
who could corroborate my information regarding the Renton factory
environment.
On August 6, 2019, NTSB Managing Director Sharon W. Bryson sent a
one-page response to my June 28, 2019 letter, informing me that my
``concerns fall outside the scope of the NTSB's role in the 737 MAX
accident investigations.'' See Exhibit 10 (Aug. 6, 2019 letter from
NTSB). I was stunned by this response. Accident investigators routinely
review maintenance and training records going back years. And yet, when
two new airplanes crashed just months after they were built, the NTSB
unilaterally deemed the chaotic and unstable production environment in
which they were made to be outside the scope of the accident
investigations.
On September 17, 2019, counsel wrote on my behalf to both FAA
Administrator Steve Dickson and Secretary of Transportation Elaine
Chao, again laying out my concerns about the chaotic state of
production at the Renton factory and imploring the agencies to share my
information with accident investigators. See Exhibit 11 (Sept. 17, 2019
letter to DOT) and Exhibit 12 (Sept. 17, 2019 letter to FAA). The FAA's
response was to treat my letter as a ``Safety Hotline'' report. See
Exhibit 13 (Oct. 14, 2019 letter to FAA). I received no response from
the DOT. I followed up with an additional letter to the FAA on Nov. 5,
2019, expressing renewed safety concerns in light of the Indonesian
government's release of its Final Aircraft Accident Investigation
Report for Lion Air Flight 610, discussed in greater detail below. See
Exhibit 14 (Nov. 5, 2019 letter to FAA). Although the FAA suggested in
October that it might wish to interview me, I have heard nothing from
the agency since then.
To date, I have submitted to numerous interviews involving the
Department of Justice, the DOT's Office of the Inspector General, and
the NTSB. But I have received no confirmation that any of my
information concerning the state of the Renton factory has been shared
with accident investigators.
More Recent Developments and Ongoing Concerns
I remain gravely concerned that the dysfunctional production
conditions may have contributed to the tragic 737 MAX crashes and that
the flying public will remain at risk unless this unstable production
environment is rigorously investigated and closely monitored by
regulators on an ongoing basis. My concerns are heightened by the
regulators' apparent exclusive focus on the design failure of the
flight control system, specifically the failure of the Maneuvering
Characteristics Augmentation System (MCAS) software. But MCAS is a
system designed to correct flight anomalies when they occur. It was not
the first failure event that led to these crashes.
Instead, according to publicly available information, the likely
cause of both crashes was the transmission of incorrect information to
the planes' MCAS by faulty Angle of Attack (AOA) sensors, which in turn
caused the planes to execute a series of abrupt maneuvers contributing
to the pilots' loss of control. Despite this, there has been limited
discussion by Boeing and American regulators of the faulty AOA sensors,
let alone a determination of the root cause(s) of their failures in the
two crashes. In September 2019, however, the European Union Aviation
Safety Agency (EASA) informed the European Parliament that Boeing had
not provided an ``appropriate response to Angle of Attack integrity
issues'' and indicated that it would not unground the 737 MAX until
such a response was provided.
My concerns about the AOA sensors multiplied when the Indonesian
government released its Final Aircraft Accident Investigation Report
for Lion Air Flight 610 on October 28, 2019. The Final Accident Report
explains that on October 27, 2018, the day before the Lion Air crash,
the plane's AOA sensor was deemed defective and removed from the plane.
Boeing subsequently tested that AOA sensor on December 10, 2018 and
confirmed it was faulty. It is possible that a similarly faulty AOA
sensor was installed on the Ethiopian Airlines plane that crashed on
March 10, 2019.
AOA sensors have a long history of reliability. No one has asked
why two brand-new AOA sensors on two brand-new planes inspected,
installed, and tested by Boeing at the Renton plant during the summer
of 2018 failed. And no one has investigated whether the hundreds of
other planes manufactured during the summer of 2018 at Renton--
including the currently flying 737 Next Gen airplanes and P-8 military
airplanes--have faulty AOA sensors or other production quality issues.
I raised these concerns in a third letter to the FAA on November 5,
2019, urging Administrator Dickson to issue an Emergency Airworthiness
Directive to airlines and Boeing requiring them to inspect, test, and,
if necessary, replace similar model AOA sensors. See Exhibit 14 (Nov.
5, 2019 letter to FAA). I received no response.
The number of safety-related events involving this relatively new
aircraft is another alarming indicator that Renton production was
seriously deficient. Using publicly available information, I have
identified thirteen occasions where safety incidents occurred on 737
MAX aircraft just weeks or months into their service life. See Exhibit
15 (providing my analysis of recent 737 incidents). Combined with the
two crashes, this means that 15 aircraft, or 4% of the 737 MAX
airplanes delivered to customers had already experienced a safety
incident. While I am unable to perform a statistical comparison with
other aircraft, it is unacceptable to me that passengers on one of
every 25 airplanes can expect to experience a safety incident.
Although it is imperative to correct Boeing's flawed MCAS software
and pilot training, it is no less imperative to thoroughly evaluate why
the AOA sensors provided faulty data in the first place, and whether
those reasons implicate Renton production more broadly. It is alarming
that these sensors failed on multiple flights mere months after the
airplanes were manufactured in a factory experiencing frequent wiring
problems and functional test issues. Regulators simply must ask
questions about the conditions of the Renton factory and Boeing must
answer them candidly. The safety of the flying public depends on it.
Conclusion
Although delivering record numbers of airplanes does in fact make
for good headlines, the numbers can mask the reality of production
health and airplane quality. I witnessed that on-the-ground reality and
I watched with grief and horror as 346 individuals lost their lives in
the Lion Air and Ethiopian Airlines crashes. We would be remiss if we
failed to remember that another individual that wasn't on one of these
airplanes also died as a result of these crashes. He was an Indonesian
rescue diver named Syachrul Anto.
I am not a disgruntled employee and I never imagined that I would
find myself in this position. I am here today for one reason: to
prevent future tragedies by ensuring that regulators and Boeing take
every step necessary to prevent the loss of additional lives. Those
steps must include a thorough investigation into the production of 737
aircraft at the Renton Factory and close monitoring by regulators from
this point forward.
I have attached a list of recommendations for the committee's
consideration.
Recommendations for the House Transportation & Infrastructure Committee
1. Direct the FAA to conduct a comprehensive investigation of the
737 Renton, Washington Factory (Final Assembly, P-8 & Wings) to
determine if reported problems still exist. If the international
accident investigators want to be a part of this investigation they
should be afforded the opportunity. The FAA should take appropriate
actions as necessary depending on the results of the investigation.
2. Direct the FAA to issue an Emergency Airworthiness Directive
for Boeing and airlines to inspect, test and if necessary replace
faulty AOA Sensors (per Eric Havian's Nov 5, 2019 letter to the FAA)
3. Direct the FAA to deploy enough qualified employees into
Boeing's factories to closely monitor production operations and be
available to respond to production concerns from Boeing employees.
These FAA employees need to be accessible to Boeing employees working
on all shifts and be easily visible (FAA jackets, FAA shirts, FAA
posters, etc.).
4. Direct the FAA to analyze reports of safety incidents involving
737 airplanes (MAX, NG & P-8) built since 2017 and to provide a
comprehensive risk assessment to this committee NLT Jan 1, 2020. The
analysis needs to include the 13 other MAX incidents brought to the
attention of the committee.
5. Direct the FAA to develop rules to limit work hours for
employees involved in airplane manufacturing.
6. Direct the FAA to require Boeing to get FAA approval prior to
increasing production rates and to closely monitor production rate
increases to ensure production stability.
7. Direct the NTSB to develop a streamlined witness interviewing
process to ensure future witnesses are interviewed in a timely manner.
Publish this process on the NTSB website.
Exhibits
exhibit 1--resume
Available at http://docs.house.gov/meetings/PW/PW00/20191211/
110296/HHRG-116-PW00-Bio-PiersonE-20191211.pdf
exhibit 2--military biography
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 3--emails to 737 general manager june and july 2018
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 4--letter to boeing ceo, december 19, 2018
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 5--emails with boeing's general counsels, january and february
2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 6--first letter to boeing board of directors, february 2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 7--second letter to boeing board of directors, march 2019
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 8--key points provided to the national transportation safety
board, june 2019
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 9--letter to the national transportation safety board, june
2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 10--letter from the national transportation safety board,
august 2019
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 11--letter to the secretary of transportation, september 2019
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
exhibit 12--letter to the administrator of the federal aviation
administration, september 2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 13--second letter to the administrator of the federal aviation
administration, october 2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
exhibit 14--third letter to the administrator of the federal aviation
administration, november 2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Exhibit 15--Recent 737 Max Safety Incidents \\
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Date Type Airline Registration Line # B1-Flight Reason
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
5/12/18 737-9 Thai Lion Air HS-LSI 6816 4/14/18 two loud bangs prompted crew to shut down the right engine
10/29/18 737-8 Lion Air PK-LQP 7058 7/30/18 crash under investigation
12/1/18 737-8 WestJet C-GZSG 7005 7/7/18 STAB OUT OF TRIM light occurred just after flaps up on departure
11/14/18 737-8 Sunwing C-GMXB 6956 5/13/18 Multiple systems failures. Replaced left ADIRU
12/14/18 737-8 Norwegian Air Shuttle LN-BKE 7110 10/14/18 Low oil pressure indication on the left engine
12/14/18 737-8 Aerolineas Argentinas LV-HKU 6753 1/7/18 zone of adverse weather caused the failure of the left hand engine
12/24/18 737-8 Air Canada C-FSCY 6695 11/27/17 returned to origin after noticing decreasing hydraulic quantity
12/29/18 737-8 Air Canada C-FSIP 6841 3/13/18 lost wing anti-ice system due to an intermittent fault
1/6/19 737-8 SpiceJet VT-MAX 7103 9/12/18 left engine shutdown due to a restriction in fuel flow
1/13/19 737-8 Air Canada C-FSCY 6695 11/27/17 rejected takeoff due to a Master Caution light for forward door
1/28/19 737-8 Air Canada C-FSEQ 6814 2/12/18 right engine shutdown due to a low oil quantity and a low oil pressure
1/29/19 737-8 TUI Airways G-TUMA 7211 11/4/18 due to an abnormal engine (LEAP) indication
2/12/19 737-8 American N308RD 6652 12/13/17 crew declared an emergency due to hydraulic failure indication light
3/10/19 737-8 Ethiopian Airlines ET-AVJ 7243 10/30/18 crash under investigation
3/26/19 737-8 Southwest N8712L 6290 9/18/17 lost right engine on initial climbout
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
\\ Summary: 15 emergencies involving airplanes built during a 13 month timeframe; 2 crashes & 13 incidents
Mr. DeFazio. Thank you.
Mr. Collins, you are recognized.
Mr. Collins. I want to thank Chairman DeFazio, Ranking
Member Graves and the members of the committee for this
opportunity to testify. I also want to offer my condolences to
the family members and friends of those who died in the two
tragic 737 MAX accidents.
I am a retired aerospace engineer from the FAA with over 29
years of experience. Before that, I worked at Boeing for 5
years. I was the lead FAA engineer on the NTSB's TWA 800
accident investigation. That accident was caused by an
explosion of a fuel tank on a 747 airplane. Therefore, I have
seen firsthand the devastation caused by a catastrophic
airplane accident.
I became the FAA fuel tank safety program manager as FAA
began addressing the lessons learned from the TWA 800 accident.
During this time, we issued two major fuel tank safety rules,
one focused on preventing fuel tank ignition sources and a
second focused on reducing fuel tank flammability.
I have heard FAA executives state that safety is our
highest priority. I agree that safety was their highest
priority when I started working at the FAA in 1989. However,
over the last 15 years or so, FAA management culture has
shifted to where the wants of applicants now often take
precedent over the safety of the traveling public. A clear
example of this is the issue of the rudder control on the 737
MAX.
Over the objections of FAA technical specialists, the
airplane was approved with a rudder control design that is
unchanged from the original 1960s design. It has a single-
string control system consisting of cables running from the
cockpit to the rudder. This means that, in the event of an
uncontained engine failure during takeoff, a catastrophic loss
of control of the airplane could occur if an engine fragment
cuts one of the cables.
In 1989, a DC-10 crashed during an attempted landing at
Sioux City after an engine had an uncontained failure. Engine
debris damaged the airplane's three independent hydraulic
systems that powered the flight controls. This disabled all the
flight controls. The flight crew attempted to land but crashed
while landing. The result was 111 fatalities and 47 serious
injuries.
Because of the DC-10 accident and based on industry
committee recommendations, in 1997 the FAA updated the
compliance policy in a revised AC 20-128A. The AC specifically
requires protecting the rudder controls from one-third disk
fragment projectile in the event of an uncontained engine
failure.
During the 737 MAX project, FAA management initially agreed
with technical specialists that the existing design did not
comply with the FARs, considering the new engine on the
airplane. As the certification date neared and Boeing had not
made a design change, FAA management decided not to require
that Boeing modify the 50-year-old rudder control design. An
FAA employee submitted the issue to the FAA's internal safety
reporting process as a safety concern report.
I was one of four members of the FAA's safety oversight
board when the safety concern was submitted. The board includes
two aerospace engineers and two managers. The submittal
included the issue paper used to document agreement with the
applicant and the method of compliance. The issue paper was
signed by four managers, and all seven aerospace engineers and
the project pilot disagreed with the method of compliance. The
board identified a subject matter expert panel to review the
SRP report and make recommendations to the board. The panel
included four aerospace engineers and two managers, all from
various FAA offices.
The consensus-based recommendation of the panel included a
statement that the method of compliance in the issue paper does
not comply with the associated FAA regulations, the FARs. The
board agreed with the panel report and forwarded it to the
responsible FAA manager as the board's recommendation.
The manager did not accept the board's recommendations,
therefore overruling the board and the panel. That manager was
the same manager that had overruled the technical specialists
on the issue paper process.
In considering the nonconcurrences on the issue paper, the
SME panel report and the oversight board recommendations, a
total of at least 13 FAA aerospace engineers, 1 pilot and at
least 4 FAA managers disagreed with the method of compliance
the other managers allowed to be used.
By comparison, although the Airbus A320Neo was approved
with a similar rudder design, EASA worked with Airbus to reach
agreement that Airbus will revise the design using the guidance
in the 1997 AC and incorporate the new design during production
on all A320 series airplanes.
Thank you for this opportunity. I hope my testimony will
help improve the FAA management safety culture and the aircraft
certification service.
[Mr. Collins's prepared statement follows:]
Prepared Statement of G. Michael Collins, Former Aerospace Engineer,
Federal Aviation Administration, appearing in his individual capacity
I want to thank Chairman DeFazio, Chairman Larsen, Ranking Member
Graves, and the other members of the committee for this opportunity
today. I also want to offer my condolences to the family members and
friends of those who died in the two tragic 737MAX accidents.
I am a retired FAA Aerospace Engineer with 29 and a half years'
experience in the FAA as a propulsion specialist; 5 years' experience
in Boeing Commercial Airplane Company; and several years' experience in
other safety critical industries including nuclear and non-nuclear
power plant design. Although I am not representing anyone else, I know
I have the support of many of my past coworkers at the FAA.
As the committee reviews the FAA oversight of the 737MAX
certification, it is an opportunity to review the overall issue of FAA
oversight and the safety culture of management in the FAA's Aircraft
Certification Service. When I first started working at the FAA in 1989,
the management I worked for had a much different safety culture than
today. In my early years at the FAA, I found management very supportive
of engineers in the evaluation of proposed airplane design changes.
Management supported engineers when they identified features that did
not comply with the Federal Aviation Regulations (FARs). I was taught
the FARs defined the minimum level of safety for airplane designs. If
we discovered a design that did not comply, we identified the issue to
our managers and the applicant's Designated Engineering Representative
(DER). We then all worked with the applicant to help them develop
design changes that resulted in a design all the FAA specialists agreed
met the minimum safety standard defined in the FARs. It was a much more
a collaborative environment than what exists today.
There were some controversial issues then too, but typically the
final FAA position was something everyone on the FAA team, engineers
and managers alike, could agree was an acceptable method of compliance
to the FARs.
After the investigation of the TWA 800 accident and shortly after
the 2001 Fuel Tank Safety rule was issued, I saw a significant shift in
management. It was an erosion of the safety philosophy. FAA management
shifted away from supporting FAA technical specialists (FAA aerospace
engineers) in favor of industry positions. This shift continued until I
retired in July 2018. The most recent and clear example of this erosion
in safety culture was regarding the minimum level of safety debates on
how to protect the rudder controls on the 737MAX from catastrophic
damage from an uncontained failure of the new engines.
737max Rudder Control--Protection from Catastrophic Failure due to
Uncontained Engine Failure
I was not working on the 737MAX at the time, so I was not involved
in the original discussions of the rudder control design. I became
involved as one of four members on the Safety Oversight Board when a
safety concern (report) was submitted to the AIR Safety Review Process.
The safety reports were submitted to the Board with the submitter's
identifying information removed (de-identified).
The Board reviewed the submittal which included the Issue Paper
used to document the agreement with the applicant on the means of
compliance the applicant would use to the relevant FARs. In this case,
the Issue paper was signed by two managers, but all 7 FAA technical
specialists (aerospace engineers) and the project pilot disagreed with
the method of compliance described in the issue paper and therefore did
not concur. Three FAA aerospace engineers did sign the issue paper, but
their function was administrative. It was to ensure the issue paper was
coordinated with the appropriate technical specialists.
The SRP Oversight Board determined the issue was complex enough
that we would identify a Subject Matter Expert (SME) Panel to review
the SRP report and make recommendations on the safety concern to the
Board. The SME Panel members were selected based on their expertise in
the subject and were chosen from various FAA offices so many were not
involved in the original discussions. All recommendations from the SME
Panel, as well as from the Board, are required by the SRP process to be
consensus-based decisions. That is, the final report and
recommendations from the SME Panel, and the Board, must be something
all members of the respective panel or Board ``can live with.'' It is
not based on majority rule.
The SME Panel included four FAA aerospace engineers and two FAA
managers. The consensus-based recommendations of the SME Panel include
a statement that the method of compliance directed by FAA Management
and included in the issue paper does not comply with the associated
Federal Aviation Regulations (FARs). The method of compliance did not
meet the required minimum level of safety. Note that the report also
included recommendations on design changes that would result in an
acceptable means of compliance to the associated FARs.
The SRP Oversight Board, which was comprised of two aerospace
engineers and two managers, agreed with the SME Panel report and
forwarded it to the responsible FAA Aircraft Certification Service
Division/Directorate manager. The FAA Division/Directorate manager
responded later to the Board that the Transport Airplane Directorate
(TAD) ``considered the Board's recommendations and believes that the
TAD met the Board's intent by following existing FAA rules, orders and
procedures related to certification and delegation activities.'' The
SRP Oversight Board determined the Division/Directorate manager did not
implement the Board's recommendations and therefore, in accordance with
the SRP Process, the Board forward the Board/SME Panel's
recommendations and the Division/Directorate manager's response to the
Deputy Director, Aircraft Certification Service, AIR-2, for his/her
information.
Therefore, when considering the non-concurrences on the issue
paper, the SME Panel report and the SRP Oversight Board members
recommendation; a total of at least thirteen FAA aerospace engineers,
one pilot and at least four FAA managers disagreed with the method of
compliance other FAA managers allowed Boeing to use.
Note the SRP report said the Airbus A320neo rudder control had a
similar design to the 737MAX. The submitter said the FAA certification
team for the A320neo had reached agreement with EASA and Airbus that
Airbus would change the design to a compliant ``fly by wire'' rudder
control design and implement the new design into production after
certification. Although FAA did not require such a design change
through a time-limited partial grant of exemption, information on the
internet about a contract for rudder control servos indicates Airbus is
proceeding with the design change.
737max Fuel Tank Surface Temperature
Another issue submitted to the Safety Review Process on the 737MAX
project was where an agreement was made with the applicant using an
issue paper to allow fuel tank temperatures above the maximum
temperature allowed by the FARs. In this case, the technical specialist
(aerospace engineers) working the issue did all sign the issue paper,
indicating their concurrence. The issue paper document agreement on a
finding that the applicant's method of compliance was an ``Equivalent
Level of Safety'' to the normally accepted means of compliance.
However, an employee submitted a safety concern about the decision in
the issue paper to the SRP. The SRP Oversight Board designated a new,
unique, SME Panel to review the safety report and make recommendations
to the Board. The SME Panel agreed with the SRP submitter that the
issue paper agreement was not an equivalent means of compliance with
the associated FAR and made several recommendations. The SRP Oversight
Board accepted the SME Panel report and forwarded it the responsible
Division/Directorate manager. I do not know how the Division/
Directorate manager responded as there had not been a response when I
left the SRP Oversight Board prior to my retirement.
737max Fuel Pump Circuit Protection
An issue that was not raised in the SRP is related to the 737MAX
fuel pump electrical circuit protection. FAA fuel pump ignition source
prevention requirements essentially require ground fault interrupter
(GFI) or similar fast acting circuit protection with active faulty
detection and annunciation of failures on fuel pump power circuits.
This requirement is to prevent electrical arcs in fuel tanks from
failures of the high-power fuel pump wires. An FAA manager provided
guidance to Boeing without going through the issue paper process for
certification of a GFI installation that was contrary to FAA published
policy in Advisory Circular 25.981-1C and in a ``generic'' fuel pump
issue paper on the Transport Airplane Issues List. The manager told the
applicant they could consider fuel in the area between the fuel pump
and the housing the fuel pump is installed in as a flame or spark
barrier. This guidance was given by the manager despite FAA technical
specialists reminding the manager that there were known failures on a
similar fuel pump installation (L-1011) that experienced a wiring
failure inside the pump and burned a hole through both the fuel pump
and the housing. (Fortunately, that L-1011 event did not result in a
fuel tank explosion because the pump housing was under liquid fuel.)
The FAA manager told the applicant that taking credit for fuel in the
space between the motor and housing, which is typical for Transport
Category fuel pump installations including the L-1011 installation,
`was not prohibited by the AC.'
At the same time, the FAA required Airbus to modify their fuel pump
GFI installation before certification of the A320Neo. Before the FAA
required modification, the proposed A320Neo GFI installation was like
what the FAA manager allowed to be certificated on the 737MAX.
787 Lithium-Ion Battery Containment
Before the AIR Safety Review Process was implemented in mid-2015,
there were other examples of FAA management accepting applicant's
positions over the concerns of FAA technical specialists, the FAA's
aerospace safety engineers. For example, during initial certification
review of the new technology 787 lithium battery system design the
certification of the 787, an FAA technical specialist determined the
lack of a fireproof enclosure could result in catastrophic failure due
to uncontrolled fire from the battery. He proposed to FAA management
that the special conditions design of for the airplane system lithium-
ion battery should include a requirement for a steel containment
structure that would be vented overboard. FAA management overruled the
specialist. The specialist worked to modify a new special condition
that was applied to the battery installation so a containment system
would be required. Unfortunately, FAA managers pushed to delegate 95
percent of the certification to the applicant, including the high risk,
new technology, battery installation. Without FAA safety engineer
oversight, the ODA found the design without an enclosure to be
compliant. Sadly, after certification, the airplane system lithium-ion
battery experienced two extremely dangerous fire events and the FAA
mandated the 787 fleet to be grounded. The design changes the FAA
mandated to allow the 787 to fly again included a steel battery
containment box that was vented overboard; as originally proposed by
the FAA aerospace engineer.
Issuing Exemptions that Are Not in the (Traveling) Public Interest
FAA management often issues exemptions with more consideration to
the financial interest of the applicant compared with the safety
interest of the Traveling Public.
An example of this is a four-year time-limited exemption that
allowed production of 737NG airplanes with a non-compliant Fuel
Quantity Indicating System. Non-compliant means it does not meet the
minimum engineering safety level. The non-compliance was with the
safety regulation that was issued in 2001. This regulation was created
to prevent future accidents and address engineering design problems
learned from the TWA Flight 800 accident, which was caused by a fuel
tank explosion. On December 18, 2013, the FAA issued a ``Time-Limited
Partial Grant of Exemption,'' Exemption No. 10905 (DMS docket FAA-2012-
17). The justification stated by the applicant was the additional time
needed to develop a compliant design. However, the applicant and all
transport category manufacturers were aware of this design shortfall
since the TWA 800 accident investigation. This allowed continued
production of a non-compliant design. It required incorporation of a
few design changes but did not bring the design into compliance with
the minimum level of safety required by the associated FARs. It granted
the manufacturer 48 months to continue production of the 737NG, at the
end of which the exemption required ``the FQIS on all newly-produced
airplanes must be shown to comply with 25.901(c), Amendment 25-46,
and 25.981(a)(3), Amendment 25-102, or later amendments.'' Note that an
applicant for new type design has only 60 months to complete the FAA
type certification project.
Near the end of the 48-month period, the manufacturer petitioned
for an extension of the exemption (docket item FAA-2012-1137-0010). I
was assigned the task to evaluate the petition for extension. I was
also instructed to check with the FAA Counsel who had worked on the
2015 Boeing Settlement Agreement (https://www.faa.gov/news/
press_releases/news_story.cfm?newsId=19875). I asked the FAA Counsel if
the extension was related to the Settlement Agreement. He responded
that yes, it is related to the Settlement Agreement. He recommended we
not grant the extension and instead require the applicant comply with
the requirements of the original time-limited partial grant of
exemption. I drafted a denial letter and provided it to the manager.
The manager then held the letter for several months until Boeing
withdrew the petition for extension (FAA-2012-1137-0012). However,
Boeing then submitted a new petition for extension and FAA granted them
a permanent exemption (FAA-2012-1137-0019). This permanent exemption
required some additional modifications to improve the safety of the
737NG FQIS, but it allowed Boeing to continue to produce 737NG
airplanes with FQIS systems that did not meet the fuel tank ignition
prevention requirements in the FARs. This was more in the financial
interest of the petitioner than the safety interest of the traveling
public.
In contrast, the FAA issued an airworthiness directive in 1999 (AD
99-03-04) that required modification of the 737 Classic (737-100, -200,
-300, -400, and -500 series ) FQIS to meet the same fuel tank ignition
prevention requirements that they granted a permanent exemption for the
737NG. The FAA also issued an airworthiness directive in 1998 (AD 98-
20-40) that required modification of the 747 Classic (747-100, -200, -
300, SP, and SR series) FQIS that met the same fuel tank ignition
prevention requirements. These airworthiness directives were issued
because the FQIS failure mode that would have been eliminated by full
compliance to the FARs for which the above exemption was granted was
identified by the NTSB as the most likely ignition source that caused
the TWA Flight 800 accident \1\.
---------------------------------------------------------------------------
\1\ ``The National Transportation Safety Board determines that the
probable cause of the TWA flight 800 accident was an explosion of the
center wing fuel tank (CWT), resulting from ignition of the flammable
fuel/air mixture in the tank. The source of ignition energy for the
explosion could not be determined with certainty, but, of the sources
evaluated by the investigation, the most likely was a short circuit
outside of the CWT that allowed excessive voltage to enter it through
electrical wiring associated with the fuel quantity indication
system.'' (Executive Summary, NTSB Report on TWA Flight 800 Accident
(NTSB/AAR-00/03)
---------------------------------------------------------------------------
FARs vs. Industry Consensus Standards
There is a move to replace the Federal Aviation Regulations for
Transport Category Airplanes (14 CFR part 25) with industry developed
``consensus standards.'' I caution against such a change. The FARs have
been developed over time and new regulations typically were adopted to
incorporate lessons learned from fatal accidents. Therefore, many of
the FARs were issued to prevent future accidents based on those lessons
learned. Replacing with industry standards may lose those lessons.
Also, using industry standards, as was done with the FARs for Small
Airplanes (14 CFR part 23) makes it difficult for the public to comment
onchanges or understand the regulations. FARs are public. Industry
standards must be purchased from the industry organization.
Non-Compliant Design Features discovered during ODA Audits
When a design is type certificated using the ODA process, the ODA
certifies to the FAA that the design compliant and the FAA then grants
the type certification. Later, if the design is found not to be
compliant during an audit, the issue is usually closed by a statement
from the ODA that they will correct the non-compliance the next time
they make a design change in that area; which could be never. I
recommend that in cases where an ODA has said a design complies and it
is later determined it does not comply, the ODA be required to bring
the design into compliance during production. The production could
continue under a time limited exemption until the compliant design is
incorporated into production. The FAA could also evaluate the need to
mandate retrofit of the airplanes delivered with the non-compliant
design. Otherwise, the ODA company can produce the non-compliant design
in potentially thousands of airplanes; each of which has a life of 20
to 30 years. This should be considered an unacceptable risk to the
public, since the FARs do define the minimum acceptable level of safety
for the type design.
Conclusion
I hope these examples demonstrate that even with the perceived
limited resources of the FAA, their technical specialists did have the
ability and resources to identify safety issues. Prior to the ODA
system being implemented, FAA certificated the highly successful
757,767, 777, and 747-400 with fewer FAA engineers who conducted direct
oversight of company designees. However, more recently the FAA
management safety culture often seems more interested in allowing
applicants to produce designs that do not comply with the minimum
safety standards defined by the FARs. This flawed FAA management safety
culture has resulted in approval of airplanes with flaws resulting in
grounding of the 787, two horrific 737 MAX accidents with the tragic
loss of 346 lives and grounding the 737MAX for the last 9 months.
Families have been destroyed. Airlines and the flying public have also
been severely impacted by the groundings.
Balanced regulatory oversight supported by a strong FAA safety
culture is not costly to the industry, it's the foundation on which the
previous unprecedented safety record was built. Most of the aerospace
engineers I worked with are dedicated public servants who want to do
what is best for the traveling public. Not just what is best for
applicant's short-term bottom line. The existing FAA management safety
culture is broken and demoralizing to dedicated safety professionals.
I hope this committee considers this information when drafting
future legislation.
Mr. DeFazio. Thank you.
Dr. Endsley?
Ms. Endsley. Chairman DeFazio, Representative Meadows and
members of the committee, thank you for the opportunity to
testify today on behalf of the Human Factors and Ergonomics
Society. I express my heartfelt sympathies to the families of
the victims of both the Lion Air and Ethiopian Airline crashes.
It's heartbreaking.
The way in which technology is designed significantly
affects the performance of its human operator. Optimizing the
relationship between humans and technological systems is the
essence of human factors engineering. When the system is easy
to use, it guards against typical human limitations and errors
and helps people to rapidly understand key information about
what is happening, high levels of human performance can be
achieved. When poor system design encourages accidents, good
system design can prevent them.
A key foundation to safe air travel is the design and
development of the controls, displays and automated systems
that pilots rely upon to operate their aircraft. Our 70-year
history shows that aviation safety is significantly enhanced
when human factors engineering is prioritized in the design and
development of aircraft. History has also shown us the
catastrophic consequences when human factors design is
secondary to other considerations or is outright ignored.
In the case of the Boeing 737 MAX 8, the failure to
incorporate known human factors design principles and human
factors engineering processes, its analysis, design, testing
and certification, paved the way for both the Lion Air and the
Ethiopian Airline crashes. These accidents resulted from
inaccurate data provided by the aircraft's angle-of-attack
sensor and its cascading effects on MCAS. The addition of the
MCAS automation and its inherent unreliability, however, create
significant new challenges for pilot performance that were not
addressed.
While automation can be beneficial, it also leads to new
types of human error. Slow or incorrect pilot actions in
operating and intervening in automation control are common
problems and have been found in over 26 automation-related
accidents among air carriers.
Human factors research on these challenges sheds light on
several automation deficiencies that impacted the pilots of the
737 MAX 8. First, automation often leads to workload spikes in
abnormal situations. In both accidents, the pilots were
significantly overloaded, both mentally and physically. They
were forced to manage multiple, competing alerts that led them
away from the MCAS problem, and they needed to exert
considerable physical force on the control column in order to
counteract MCAS actions and maintain flight control.
Secondly, automation also often results in low situational
awareness. In these accidents, the pilots struggled, as they
were not provided with the needed displays for understanding
the functioning of MCAS, nor with the AOA sensor disagreement
displays that were needed to oversee it. The various alerts
that were provided were nondiagnostic and confusing. In
addition to these challenges, under the high workload and
distractions that were present, it appears the Ethiopian
Airline crew lost situational awareness of their airspeed.
Third, automation confusion is a frequent challenge in
aviation accidents, and it was a central problem on the MAX 8.
Automation confusion stems from both poor transparency of the
behavior of the automation due to inadequate displays, as well
as an inadequate understanding of how MCAS automation works due
to the inadequate training on the system. In addition to
failing to include MCAS in the flight manuals, training that
provided actual experience in detecting, diagnosing and
responding to failure conditions was not provided.
Finally, the pilots needed to be able to take over and fly
the aircraft manually. Without clear, unambiguous failure
indications and training, the air crew could not successfully
carry out the needed remediation procedures in the timeframe
that was expected. And the manual forces required for pitch
control could not be maintained.
Like most avoidable accidents, the Ethiopian Airline and
Lion Air crashes provide important human factors lessons that
should be leveraged to improve the safety of our aviation
system and to guard against similar problems in other safety-
critical systems. These automation problems could have been
easily prevented by following established human factors design
principles and standards for human-automation interaction and
alarm presentation. Emphasis on human factors engineering and
aircraft systems analysis, design, testing and certification is
critical for building in aviation safety.
We applaud recent statements by the FAA Administrator and
Boeing senior management to reinforce their commitment to
safety as the highest priority. And we hope they continue to
support this message through their actions.
My submitted testimony provides greater detail on the
automation and design deficiencies of the aircraft and both
near-term remedies and longer term prevention recommendations.
Thank you for the opportunity to share these insights today
and I look forward to answering your questions.
[Ms. Endsley's prepared statement follows:]
Prepared Statement of Mica R. Endsley, Ph.D., Human Factors and
Ergonomics Society, appearing on behalf of the Human Factors and
Ergonomics Society
Chairman DeFazio, Ranking Member Graves, Members of the Committee,
thank you for the opportunity to testify today on behalf of the Human
Factors and Ergonomics Society (HFES). With over 4,600 members, HFES is
the world's largest nonprofit association for Human Factors and
Ergonomics professionals. HFES members include researchers,
practitioners, and federal agency officials, all of whom have a common
interest in working to develop safe, effective, and practical human use
of technology, particularly in challenging settings. HFES has a
particularly strong record of expertise in aviation over its 70-year
history.
There is a long history of blaming the pilots when aviation
accidents occur. However, this does nothing towards fixing the systemic
problems that underlie aviation accidents that must be addressed to
enhance the safety of air travel. Often accidents are caused by design
flaws that do not take the human operator's capabilities and
limitations into account. Bad design encourages accidents; good design
prevents accidents. Solving these systematic design challenges is the
primary calling of the field of Human Factors Engineering, which
applies scientific research on human abilities, characteristics, and
limitations to the design of equipment, jobs, systems and operational
environments in order to promote safe and effective human performance.
Its goal is to support the ability of people to perform their jobs
safely and efficiently, thereby improving the overall performance of
the combined human-technology system.
Recent investigations of the Lion Air and Ethiopian Airlines
crashes of the Boeing 737-Max8 aircraft have highlighted the importance
of Human Factors in the design, testing and certification of
aircraft.1, 2 Neglect of attention to Human Factors
was also cited by both the National Transportation Safety Board (NTSB)
and the FAA Joint Authorities Technical Review (JATR) in their reviews
of the contributors to these accidents.3, 4 I will
discuss the field of Human Factors Engineering and its role in
supporting high levels of human performance and reducing accidents in
safety critical systems such as aviation, particularly as it relates to
the use of automation and these tragic aircraft accidents. This
includes (1) a discussion of key Human Factors research on the ways
that automation directly affects human performance, (2) Human Factors
design problems associated with the 737-Max8 flight deck pilot
interface, (3) Human Factors design process shortcomings, and (4)
organizational and safety culture issues that are implicated in these
accidents.
Human Factors Engineering
The practice of Human Factors Engineering is based on
scientifically derived data on how people perceive, think, move, and
act, particularly when interacting with technology. The way in which
any technology is designed significantly affects the performance of the
people who interact with it. The user interface of the technology can
make human performance much more efficient and human error
significantly less likely when it is designed to be compatible with
basic human capabilities. When the system is easy to use, guards
against typical human frailties and errors (i.e. error tolerance and
error resistance), and helps people to rapidly understand key
information about what is happening, high levels of human performance
in operating the system can be achieved. Conversely, if the technology
design is complex, its displays are difficult to perceive or
understand, it is easy to make errors, and significant effort is
required to piece together needed information in order to stay abreast
of a complicated and dynamic situation, the likelihood of human error
increases greatly.
Human Factors supplants a misplaced emphasis on blaming the pilot
or over-reliance on training, and instead creates systematic
improvements in human performance through improved system design. While
training is important, it cannot overcome poor system designs in the
long run.5 People are still likely to make the same types of
errors if the system design is not consistent with human capabilities
and limitations. For example, when researchers recreated one
automation-related aviation accident, they found that 10 out of 12
pilots made the same error as the pilots in the accident when
confronted with the same conditions.6 Further, a well-
designed system that is consistent with user's needs and is easier to
operate is also easier to train; thus, potentially reducing training
requirements as well as improving human performance.
The Human Factors profession can be traced back to early work in
aviation when it was discovered that a large number of crashes occurred
due to human errors that resulted from aircraft cockpits that were
inconsistent with basic human capabilities and limitations. This
spurred research on the perception, movement, and reaction time of
aviators that was used to significantly reduce the frequency of
aviation accidents over the following decades by redesigning the
controls and displays of the aircraft to be more consistent with pilot
characteristics.7
Since this beginning, Human Factors Engineering has expanded
considerably to address human performance challenges across a wide
range of industries including aviation, transportation, manufacturing,
military operations, power systems, space, healthcare, consumer
products, and many more. Today, Human Factors and Ergonomics Society
members are involved in conducting research on how people interact with
new technologies, and are actively engaged in applying Human Factors
design processes and knowledge across government and industry
organizations. The Human Factors field is multi-disciplinary; it
includes primarily engineers and psychologists, as well as
physiologists and other professionals. Over 50% of the Society's
members have PhD's and 32% have masters degrees. This blend of
backgrounds lends itself well to addressing the wide range of
considerations needed to optimize human performance in any system.
Automation and Human Performance
Automation has increasingly become a part of modern systems in a
wide variety of domains, including aviation systems, power systems and
automobiles. Across the past 50 years, considerable evidence has
mounted demonstrating many benefits from automation, but also many
challenges involving human interaction with automation that can
contribute to catastrophic failures.8-10 Just as no man is
an island, so too, no automation is an island. Automation must be able
to work successfully with human users or, ultimately, it will fail.
While automation has many benefits, it also creates new types of
errors that must be addressed through careful system design to prevent
these new and often catastrophic errors.8, 11 A long
list of automation-related aviation accidents precedes the recent
accidents involving the Boeing 737-Max8 that provide significant
lessons learned. A recent study listed 26 automation-related accidents
among major air carriers between 1972 and 2013, where the pilots were
significantly challenged in understanding what the automation was doing
and interacting with it correctly to avoid the resulting
accident.12 Several key challenges for human performance can
be identified with automation use in aircraft flight decks.
Insufficient Pilot Training and the Loss of Manual Skills
Human operators have an important role in complex technological
systems because of their ability to be flexible, learn, and adapt to
unexpected situations.13 To do this, however, pilots must be
highly trained and experienced in managing the aircraft and its systems
across a wide variety of flight conditions.14, 15
Today's airline training environments have been criticized as providing
insufficient attention to practice and exposure to the wide variety of
alerts and non-normal situations that may be encountered in
flight.16 Inadequate training on automation has been found
to be a critical problem in many automation accidents.17
Pilots are often encouraged to use automation and use it
frequently.18 As pilots use automation more often, however,
they become reliant on it,19 and skills needed for manual
performance and decision-making can deteriorate.9, 20
This includes both fine-motor skills associated with aircraft flight
control and cognitive skills associated with cross-check and carrying
out flight operations.21, 22 Further, newer pilots,
trained primarily to operate via automation, may never create well-
learned skills for manual aircraft operations. Poor manual flight
skills were implicated in the fatal crash of Colgan Air in 2009, for
example.23
Automation Creates High Workload Spikes and Long Periods of
Boredom
While automation has frequently been implemented with the goal of
reducing manual workload, it can actually increase pilot workload
during already high workload periods, such as when a route change is
needed or when a problem occurs. This renders it difficult to use, and
often pilots must quickly take over manual control in such
circumstances which can be quite challenging.24 It also can
make already low workload periods even less engaging, creating new
problems associated with lack of vigilance and poor monitoring.25,
26 This has been called the irony of automation.8
Automation Confusion is Common
Poor operator understanding of system functioning is a common
problem with automation, leading to inaccurate expectations of system
behavior and inappropriate interactions with the automation.27,
28 This is largely due to the fact that automation is inherently
complex, and its operations are often not fully understood, even by
pilots with extensive experience using it.29, 30 A
study of the factors underlying automation accidents and incidents
found that two of the biggest problems were inadequate understanding of
automation and poor transparency of the behavior of the
automation.17
Pilots report being highly challenged in determining what the
plane is doing and why, and predicting what it will do next, creating a
problem of automation surprise.31 Very often the
misalignment between pilots' understanding of how the aircraft will
behave and its actual behavior is only discovered when the aircraft
acts unexpectedly. At that point there may be too little time available
to discover the problem, properly understand it, and take appropriate
action before an accident occurs.32
Automation confusion is most likely to occur when three main
factors are present 33:
The automation acts on its own without immediately
preceding directions from the pilot;
The pilot has gaps in knowledge of how the automation
will work in different situations; and
Weak feedback is provided to the pilot on the activities
of the automation and its future activities relative to the state of
the world.
Low Situation Awareness to Support Automation Oversight and
Intervention
Automation is often brittle 34, unable to operate
outside of the situations that it is programmed for, and subject to
inappropriate performance due to faulty sensors or limited knowledge
about the current situation. Therefore, the ability of the pilot to
supervise the automation and correct for its deficiencies is critical.
While some engineers assume that pilots need less information about
what is happening when automation is involved, the reverse is actually
true. Situation awareness of both the state of the automation and of
the systems the automation is controlling is critical to the ability of
the pilot to effectively oversee it and make appropriate interventions
and control inputs as needed.35 Pilots need to keep track of
the state of the aircraft and its operation in the flight environment,
the state of the automation that is controlling some portion of the
job, and information that will allow them to check the reliability and
performance of the automation.
Achieving a high level of situation awareness, however, has been
found to be much more difficult when automation is involved. A key
challenge associated with automated systems is that it tends to reduce
the situation awareness of the human operator.35 Pilots with
low situation awareness are said to be ``out-of-the loop.'' Low
situation awareness when working with automated systems stems from
three main sources: 35
Displays--Poor information presentation is a
significant problem with many automated systems. The system developers
may either accidentally or intentionally remove key cues that pilots
rely on to determine that the system is operating successfully, as was
the case with the implementation of fly-by-wire aircraft.35
The difficulty of determining that automation is not working correctly
is a key challenge with automation use. The inadequacy of the displays
provided has been found to be a frequent cause of aircraft accidents
and incidents involving automation.17
Vigilance--Automation often puts people into the
role of passive monitor, however, in general, people are poor monitors
of automation.36 Vigilance decrements can be significant,
occurring both because of over-trust in automation,17, 19,
37 and because people are in general poor at maintaining
vigilance when passively monitoring.38, 39
Engagement--A person's level of engagement
decreases when they move from actively performing a task to passively
watching another entity performing the task.35, 40, 41
With low engagement, it has been found that people have a much lower
understanding of what is happening than when they are performing tasks
themselves. A review of automation research was summarized by a
fundamental automation conundrum: ``The more automation is added to a
system, and the more reliable and robust that automation is, the less
likely that human operators overseeing the automation will be aware of
critical information and able to take over manual control when
needed''.42
As automation becomes more technologically capable, with
increasing levels of reliability and robustness for performing an ever-
widening range of tasks, people will become even more hampered by low
situation awareness and fall short in the requirement to oversee the
automation and interact with it effectively. Even when system designs
are improved and people are vigilant, the degrading effects of reduced
engagement are difficult to overcome.42
Human Factors Automation Issues in Boeing 737-Max8 Accidents
The two recent crashes involving the Boeing 737-Max8 aircraft
involved several of these known automation challenges. These accidents
resulted from inaccurate data provided by the aircraft's angle-of-
attack (AOA) sensor and its cascading effects on the Maneuvering
Characteristics Augmentation System (MCAS) that was developed to
automatically provide pitch stability following the addition of new,
larger engines on this version of the aircraft. The following analysis
of the Human Factors and Safety problems contributing to these
accidents is based on the accident reports released by the relevant
investigation boards,1, 2 reviews by the NTSB 4
and the FAA JATR 3 in the United States, and other publicly
available information on the accidents and events leading up to it.
Insufficient Reliability of MCAS Automation
Several critical design decisions created an automated system that
was inherently brittle and not resilient to the inevitable problems
that can happen in the real world. First, the MCAS system on the 737-
Max8 was designed to operate from the inputs of only one AOA sensor,
unlike a version of the MCAS developed for the United States Air Force
KC-46 that measured and compared the inputs from two sensors.43
When the single AOA sensor provided inaccurate inputs, it created an
automated system that performed repeated, erroneous trim actions. The
automation had an erratic effect on the stability of the vehicle that
was at odds with pilot goals and actions. Redundancy is fundamental to
the design of a safe and resilient system; in this case a redundant
sensor could have provided the indications needed for alerting the
automation and the pilot of an anomaly. Simple maintenance errors, as
occurred in the Lion Air accident, can have catastrophic consequences
and should be guarded against though the use of Human Factors design
principles in the design of maintenance tasks, procedures, and
training.
Further, the 737-Max8 MCAS was designed to engage and then reengage
repeatedly, rather than only the single engagement allowed by the
version designed for the United States Air Force.43, 44
This created a situation in which the automation continued to perform
inappropriate and unsafe actions (based on erroneous input data), that
the pilots could not seem to override manually. The basic design of the
MCAS automation contained built-in assumptions regarding automation
reliability that proved to be unfounded, and that left the pilots
highly challenged in managing the aircraft safely.
Automation Confusion, Lack of Training and Inadequate Automation
Transparency
Automation confusion was high as the pilots struggled to understand
what the aircraft was doing. The pilots had no previous knowledge of
MCAS and the aircraft provided no displays to indicate that MCAS was
acting on the aircraft trim, nor any displays to help them understand
that it was getting erroneous data. They were in the dark regarding the
functioning of MCAS in these accidents.
Further, the pilots were not aware of or trained on MCAS, and it
was not included in their flight manuals, leaving them confused as to
why the plane was behaving erratically. They could not develop a
correct understanding of the situation they were facing because they
had no mental model to support this process. Effective training on how
to overcome automation failures involves not only a written notice or
description of the automation, but also actual experience in detecting,
diagnosing, and responding to such events,18 which was not
provided on the Boeing 737-Max8.
High Pilot Workload
In both accidents the pilots were heavily overloaded in trying to
manually control the airplane, needing to exert considerable physical
pressure on the control column to compensate for the repeated out-of-
limit trim problems. They were simultaneously faced with multiple
competing alerts provided by the aircraft. Alerts associated with
indicated airspeed (IAS) disagree and altitude disagree were inadequate
to help them to understand the fundamental problem they were facing as
a result of a faulty AOA sensor. The alerts further created extra
workload as the Lion Air pilots attempted to run indicated checklists
and work with Air Traffic Control to check their instrument readings.
The NTSB's preliminary report on these accidents highlights the
significant mental workload caused by multiple alerts and their role in
further distracting the pilots.4 The alerts provided were
insufficient to help the pilots properly understand and diagnose the
situation they were in, or to direct them to the appropriate checklists
for managing it. The NTSB recommends that ``the FAA develop design
standards, with the input of industry and human factors experts, for
aircraft system diagnostic tools that improve the prioritization and
clarity of failure indications (direct and indirect) presented to
pilots to improve the timeliness and effectiveness of their response.''
4 The Human Factors and Ergonomics Society strongly agrees
with this recommendation.
Lack of Support for Situation Awareness
In these accidents, the pilots were unable to gain the needed
situation awareness for accurate decision making. They were faced with
an aircraft that repeatedly made uncommanded pitch changes while they
received multiple alerts on airspeed disagreements and altitude
disagreements, which they attempted to address. However, these alerts
primarily served to add workload and distractions. Displays of the MCAS
operation actions (e.g. trim up or down), and displays that would have
helped the pilots to understand the state of the aircraft as affected
by the MCAS system were not provided.
For example, the inclusion of the AOA sensor display on the primary
flight display (PFD) was sold as a system upgrade option. It was not
included as a part of the addition of MCAS to the 737-Max8. However,
neither the airline customers nor the pilots may have been aware of the
need for AOA displays to support proper diagnosis of MCAS behaviors
when making such a purchasing decision, due to the lack of information
provided about MCAS and how it functioned. While Boeing had previously
classified the AOA indicator display and AOA disagree lights as
supplemental information and not necessary for the operation of the
aircraft, the development of the MCAS system, and its reliance on the
AOA sensors, should have created a re-evaluation of this decision. The
pilots in these accidents were not provided with the needed displays
for understanding the functioning of MCAS, nor of information needed to
oversee its performance.
There is also some evidence that the pilots may have lost situation
awareness of other automated systems whilst dealing with the problems
generated by MCAS. While there is only a preliminary accident report
available on the Ethiopian Airline accident, it indicates that the crew
did correctly set the STAB TRIM to CUTOUT and turned off the autopilot.
Subsequently, however, their high airspeed made it much more difficult
to manually trim the aircraft and maintain the desired pitch. The
aircraft throttle remained at 94% N1 throughout and the aircraft did
not stop at the input speed of 238 knots but continued to around 340
knots (vmo). While it is possible the pilots did not understand the
impact of the airspeed on the control problems they were facing, it is
likely they simply lost situation awareness of their airspeed due to
over-reliance on the auto-throttle system. The Boeing's flight crew
manual recommends use of auto-throttles in take out, climb, and all
other phases of flight. Problems with loss of situation awareness of
the state of automation and the systems they control are known to be
more frequent when people are under higher workload and when working on
competing tasks.45, 46 Task fixation is more likely to
occur under high workload. In this accident, the captain was highly
loaded with trying to fly the aircraft manually, needing to exert
considerable manual force, and with only a very inexperienced first
officer for help.
While alarms and alerts are a key method for helping pilots to
detect and diagnose system failures, they were of little help in these
accidents. Response to system alerts is not always automatic and
immediate, contrary to the stated design assumption of 3 seconds.
Responses to alarms and alerts are affected by many factors including
the salience of the alert for gaining attention, form of presentation,
agreement/disagreement with other indicators, and prior experience with
the alert.47, 48 People must also interpret the
meaning of alarms, which depends on context, their mental model of what
is happening, and expectations.49, 50 Often people
seek to confirm alarms, and need additional time to properly diagnose
the meaning of the alarms in order to select appropriate actions. For
example, Boeing's own data on controlled flight into terrain accidents
over a 17-year period show that 26% of these cases involved no
response, a slow response, or an incorrect response by the pilot to the
GPWS alarm.51
When multiple alerts across multiple systems are involved, as
was the case in these accidents, considerable workload is added and
much more time may be required to determine the root cause of the
problems so as to select the appropriate response.47
Multiple failures can cause contradictions between procedures or even
prevent their complete execution. The time to respond to the alerts was
further delayed due to the fact that the pilots had not been trained to
recognize the events and alerts they were presented with, nor to
understand MCAS, its reliance on the AOA sensor, and its impact on
aircraft control and other flight systems.18 A NASA Study
found that the probability of responding correctly for non-trained
aircraft emergencies was only 7%, as compared to highly trained
``textbook'' emergencies at 86%.52
In summary, information that would have informed pilots about
the activation of the MCAS or the faulty data inputs to it were lacking
on the 737-Max8. The absence of prior training on the MCAS led to a
lack of understanding of what was happening to aircraft control. The
various alerts that were provided were non-diagnostic and confusing,
adding to workload and leading away from a correct understanding of the
pitch trim problem, rather than contributing towards a correct
resolution in the available time frame. Pilot responses to the alerts
were significantly delayed and inadequate due to these deficiencies.
Inability to Successfully Assume Manual Control
Boeing has a widely publicized Cockpit Automation Philosophy that
has guided its aircraft development over the past several
decades.53 Its key tenants are that the pilot can always
override the automation, and that it should be an aid to the pilot but
not replace the pilot. In keeping with this guiding principle, in most
other Boeing aircraft the pilot can always easily resume control by
shutting off the autopilot system. However, the MCAS operated outside
of this autopilot system and operated at odds with commanded pilot
inputs.
It is unclear why the design of the 737-Max8 MCAS departed from
this consistent automation design philosophy and how the pilots were to
know that the MCAS automation was continuing to operate, even after the
autopilot was disengaged. Normally, pulling back on the control column
will interrupt electronic stabilizer nose down commands in the 737.
However, this was not effective in the 737-Max8 as it was set to repeat
its actions if it continued to detect an out of trim problem.1
Further, the first officer's side was modified to inhibit pilot column
cut-out functions while the MCAS was functioning.1 Thus, the
simple, and normal responses that normally worked did not.
Proper decision making and performance in the aircraft is highly
dependent on accurate situation awareness. While it has been noted that
the STAB TRIM CUTOUT switch could have been used to resolve the MCAS
problem, this procedure was not used by the crew of Lion Air due to the
many factors discussed that lead to their lack of situation awareness.
Procedures are only useful when the correct procedure can be selected
and applied in a given situation. In the case of the Ethiopian Airlines
accident, which occurred after the FAA issued an Emergency
Airworthiness Directive on the MCAS 54, the pilots set the
STAB TRIM to CUTOUT as directed, however, the flight crew continued to
experience flight control problems and concluded that the trim was not
working. It appears that their loss of situation awareness of the
airspeed may have confounded their efforts to manually trim the
aircraft, due to the high speeds generated.
Once the pilots became involved in trying to overcome the MCAS trim
activations, they were required to exert considerable manual force (in
excess of 100 pounds according to the Lion Air accident investigation)
to combat the actions of the system. Concerns have arisen as to the
levels of physical force required and the ability of pilots to combat
the strong forces associated with MCAS and the 737-Max8's engines under
the conditions involved in these accidents. Although the Ethiopian
Airline crew was able to turn off MCAS via the STAB TRIM CUTOUT switch,
they subsequently flew for some two and half minutes while needing to
exert manual forces on the control column to compensate for the mis-
trim. The FAA Code of Federal Regulations (CFR 25.143) requirement is
to not exceed 75 pounds for one-handed or 50 pounds for two-handed
short-term control of pitch, and 10 pounds of force for any long-term
control of pitch (more than 3 seconds), due to the effects of manual
fatigue. These pilots eventually stated ``pitch up together'' and
``pitch is not enough'' before turning the electric trim system back
on, presumably because they could no longer perform this task manually.
This led to the reactivation of MCAS and loss of aircraft control.
A determination is needed as to the ability of pilots (both male
and female) to exert sufficient manual force to counteract the forces
exerted by MCAS at the pitches and speeds in the operational envelope,
and to operate manually in the case of a need to deactivate the system
due to failures such as were experienced by these aircrew. A recent
study by the FAA found that over 60% of females and between 15 and 65%
of males (depending on age) were unable to meet current FAA code
requirements for short term force application.55 Further, 10
pounds of force for yoke pitch and stick pitch (the long term
requirement) could be maintained for less than 5 minutes by between 42%
and 60% of females and 12% of males.55 These results should
be extended to address international populations and used to update CFR
25.143 and to update aircraft cockpits to support actual pilot
capabilities.
7 Human Factors Principles for Automation that Prevent Accidents
A number of good design principles for improving people's ability
to successfully oversee and interact with automated systems have been
developed that could have prevented these accidents had they been
applied. 48, 56, 57
1. Provide automation reliability. A key tenant of safety is
the design of highly reliable systems. Automation needs to be resilient
to bad data and avoid single point failures by cross checking across
multiple inputs. Further, graceful degradation should be supported such
that if the automation is not getting good data, it can provide
automatic self-checking behaviors, with an accompanying message to the
pilot. In this case, the MCAS should have been designed to read and
compare inputs from both AOA sensors, with significant AOA sensor
disagreements being used to disable MCAS and support pilot
understanding of its operation.
2. The user should be in command. Automation should not interfere
with manual operations and manual override should always be possible.
Because people have the ultimate responsibility for system safety,
because they are more able to adapt to novel, unforeseen situations,
and because they may have information about the situation that an
automated system does not, they should always be able to easily and
simply override the automation and take control. Pilots should be able
to easily override activation by the MCAS, rather than having the
system fight the user for control. Overcoming the MCAS actions on the
trim system should have been as easy as overcoming other electronic
trim actions via the control column.
3. Provide automation transparency. The state of the autonomy and
its intended actions must be made highly transparent to the pilots. The
current goals and assumptions of the autonomy, its current and
projected actions, and how much confidence should be placed in its data
and algorithms should be clearly represented.48 The system
should provide sufficient information to (1) keep pilots informed of
its operating mode, intent, function and output, (2) inform pilots of
automation failure or degradation, and (3) inform pilots if potentially
unsafe modes are manually selected.56 It is critical that
the automation mode and status be clearly and saliently displayed. In
this case a display showing that the MCAS was on and each time it
engaged, as well as its effect on aircraft trim, would have provided
key input to the pilots as to what the system was doing. If the MCAS is
overridden by the pilot and turned off, this should be displayed as
well to provide clear feedback to the pilots on its state. Secondly,
the state of the world that the automation is basing its actions on,
such as the AOA sensors in this case, need to be clearly displayed so
the pilot can cross check the reliability of the automation to decide
whether to trust it or override it.
4. Provide training to users on automation to ensure adequate
understanding and appropriate levels of trust. New automation should be
introduced with training to allow pilots to develop accurate mental
models of how it works, an understanding of its limitations and
reliability in different situations, and information on how to detect
and recover from abnormal events and failure conditions. As a
significantly new piece of automation that had a direct effect on
aircraft control, experiential training (e.g. via simulations) should
have been provided that would allow pilots to experience MCAS
operations, its failure conditions, and to perform the tasks needed to
recover from and effectively overcome abnormal conditions.
5. Avoid increasing cognitive demands, workload and distractions
and make tasks easy to perform. The need to sort through multiple
competing alerts provided a significant distraction and added workload.
Systems should be intelligent enough to filter out extraneous,
incorrect, and misleading alerts in order to eliminate both nuisance
alarms and reduce unnecessary workload and distraction.
6. Make alarms unambiguous. A failure of the MCAS system due to
poor sensor data input should be displayed with a clear unambiguous
message. Attempting to diagnose a problem with messages or displays
that also have other meanings (e.g. the altitude disagree and airspeed
disagree warnings), is an invitation to error and significant delays in
responding appropriately to emergent events. Any abnormal behavior of
MCAS (as affected by degraded sensors or other factors), should be
displayed with an MCAS alert warning that is distinct from other
alerts.
7. Support the diagnosis, management, and assessment of multiple
alarms. System displays need to support pilots in determining the
relationship between multiple alarms, so as to better understand the
root cause of any warnings. If root causes are not independent, this
needs to be understood, otherwise individually addressing them may not
resolve a problem or make it worse. Pilots need support in responding
to and handling multiple alerts, which can cause contradictions between
procedures or even prevent their complete execution and degrade the
utility of the alerts. Alarm management systems for aircraft need to be
redesigned to support pilot understanding of how alarms across systems
interact, which actions are a priority, and what actions should
actually be taken to resolve the underlying problem.
The lessons learned from these devastating accidents are important
for the design, development and testing of automated systems for not
only aviation, but also many other industries where automation is being
implemented including military systems, power systems and automobiles.
Assumptions of perfect automation are unwarranted and unless great care
is taken in supporting the needs of the human operators to have good
situation awareness of both the automation and the systems they are
controlling, the resulting effect will be repeated tragedies of this
nature.
Human Factors Processes for Design and Certification
A FAA Human Factors team conducted a detailed study of automation-
related aviation accidents in 1996. They found that ``problems with
automation were not limited to any one aircraft type, manufacturer, or
air carrier, but were systemic, pointing to much larger problems with
the design of the pilot interfaces to the automation, as well as the
processes used for design, training, testing, and regulation that were
inadequate for addressing the inherent challenges associated with
automation.'' 30 Consistent with their findings, a number of
issues pertaining to the Human Factors processes used for the design
and certification of aircraft are highly relevant to the 737-MAX8
accidents that will be discussed in more detail. Addressing them across
the aviation industry is critical to preventing future accidents.
Compliance with Human Factors Design Standards
A number of detailed design standards exist relevant to Human
Factors and automation that should be adhered to in order to promote
good performance and accident prevention. This includes the FAA Human
Factors Design Standard,56 DOD MIL-STD 1472G Design Criteria
Standard: Human Engineering,58 and SAE 6909 Standard
Practice for Human Systems Integration.59 In the case of the
737-Max8, adherence to design principles for human-automation
interaction and alarms would have significantly reduced the likelihood
of these accidents, as has been discussed.
Incorporation of Human Factors Engineering in the Design Process
Early incorporation of Human Factors analysis, design, and testing
during the design process must be emphasized in order to build in safe,
efficient operability. The importance of designing in a consideration
of human capabilities and limitations throughout the design process is
well established.60 The design of the operator interface
cannot occur at the end of the design process; it is integral to the
system design and must occur early during system design to ensure that
the combined human-machine system will operate safely and effectively.
It is unknown whether Boeing included Human Factors Engineers in
its analysis, design, and testing activities, and, if so, whether they
were sufficiently empowered to affect the 737-Max8 design. Given the
many Human Factors deficiencies reported on in the accident analyses,
NTSB and JATR studies, it is highly unlikely that Human Factors
considerations received sufficient attention or prioritization in the
design and development of the 737-Max8 MCAS system.
Professionals trained in Human Factors Engineering should be
included on the design team and engaged throughout the design process
in: (1) conducting analyses of requirements to support human
performance, (2) determining system functionality and information
needs, (3) designing displays needed to support human performance in
both normal and non-normal conditions, and (4) conducting tests of the
ability of operators to perform in both normal and non-normal
conditions.
Conduct and Validate Safety Analyses
The value of any safety analysis rests on its thoroughness and its
assumptions. A number of poor assumptions regarding MCAS were made
during its development: (1) that uncommanded system inputs would be
readily recognizable and acted upon by the flight crew with no
additional training, (2) action to counter the failure would not
require exceptional skill or strength, (3) the pilot would take
immediate action counter the problem, and (4) trained flight crew
memory procedures would be followed to mitigate the failure. These
assumptions proved to be unwarranted in the accidents. The JATR also
found that ``the system safety assessment and the functional hazard
assessment, were not consistently updated.'' 3 This set the
stage for a failure of the safety analyses conducted to adequately
capture the real risks involved in the system design.
Any assumptions made during safety analyses should be thoroughly
vetted and evaluated to ensure that overly optimistic assumptions do
not invalidate the benefits of such efforts. When automated systems are
involved it is important that safety analyses always consider the
potential for invalid inputs to the system, encountering unexpected
situations outside of system design limitations, the need for human
oversight and intervention, and recovery from automation failures of
any kind. Further, safety analyses need to ensure that accurate
assumptions are made about human performance, based on human
performance data collected in realistic operational conditions when
using the system as designed.
Conduct Robust Human User Testing to Validate System Designs
The careful testing of any new safety critical system is
imperative, particularly when automation is involved. In that various
types of real-world events occur that may not have been anticipated
during the design process, automation's behavior may often prove
unexpected. The NTSB's recent Safety Recommendation Report 4
points out that specific failure modes that could lead to uncommanded
MCAS activation were not simulated as a part of Boeing's function
hazard assessment validation tests. Therefore, resultant flight deck
problems, such as misleading warning messages and erroneous information
displays, were not unearthed during the testing process or assessed for
their safety implications. The NTSB recommends that ``the FAA develop
robust tools and methods, with the input of industry and human factors
experts, for use in validating assumptions about pilot recognition and
response to safety-significant failure conditions as a part of the
design certification process''. 4 The Human Factors and
Ergonomics Society strongly agrees with this recommendation.
It is critical that testing of automation and operator interfaces
include:
1) both normal and non-normal events, including automation
failures and recovery;
2) a representative sample typical of operators who are external
to the system design process; and
3) objective measures of human performance, including actions
taken, errors, performance times, workload and situation awareness.
Support for Human Factors Assessments in Aircraft Certification
The FAA also has a significant role in the design and development
process for aircraft technology due to its responsibility as the
certifying body. In that it is always possible for design teams to make
errors in their assumptions and processes, or for cost and schedule
goals to subtly degrade safety decisions, there is great value in
having an external certification body who can provide a second review
and an independent assessment of the safety of the system.
The JATR report indicates that: (1) the FAA certification team did
not fully understand the overall impact of the new MCAS system design,
(2) the MCAS was not evaluated as a complete and integrated system on
the new aircraft, and (3) Boeing failed to inform the FAA of
significant design changes over the design process complicating their
task.3 It appears that the FAA was unable to perform its
important safety role due to the use of delegated authority, or ``self-
certification,'' in which Boeing was able to provide many of its own
tests and analyses without independent verification and validation.
This process misses the point of the value provided by an independent
certification process.
Critical to this situation is that the FAA may have inadequate
numbers of Human Factors engineers involved in aircraft certification
in addition to the pilots who are often serve in this role. Further,
the JATR found that the FAA ``sometimes didn't follow their own rules,
used out-of-date procedures and lacked the resources and expertise to
fully vet the design changes implicated in two fatal crashes.'' 3
The JATR recommends that:
``the FAA integrate and emphasize human systems integration
throughout its certification process. Human factors relevant
policies and guidance should be expanded and clarified and
compliance with regulatory requirements as 14 CFR 25.1302
(Installed systems and equipment for use by aircrew), 25.1309
(Equipment, Systems, and Installations), and 25.1322 (Flight
crew Alerting) should be thoroughly verified and documented. To
enable the thorough analysis and verification of compliance,
the FAA should expand its aircraft certification resources in
human factors and in human systems integration.'' 3
The Human Factors and Ergonomics Society strongly agrees with
this conclusion and recommendation.
Organization and Safety Culture
Development of Safety Culture
A strong safety culture is widely recognized as critical in high-
consequence organizations such as aviation, power systems, and ground
transportation. Studies have found that workplace-related disasters are
often a result of a breakdown in an organization's policies and
procedures that were established to deal with safety, and from
inadequate attention being paid to safety issues.61-66
Many of the effects of a poor or broken safety culture may be
subtle and subconscious. For example, a large body of research shows
that decisions about what is a problem or not a problem can be easily
influenced by reward structures, time pressures, or
instructions.67, 68 Actions and communications of
senior management, or rewards for cost and schedule performance (which
can be easily measured), can act to subtly shift people towards more
risky decisions. While some organizations may tout ``safety first''
without backing it up, strong safety cultures are effective in
promoting safety over short term profit objectives, overcoming fear of
reporting that can keep problems hidden, countering non-compliance with
standards, rules and procedures, and avoiding miscommunication on
critical design and operational factors.
Boeing has historically had a strong commitment to safety and human
factors in its flight deck programs, however, there are concerns about
the possible degradation of the safety culture at Boeing. For example,
it was reported in the media that a survey found that one in three
Boeing employees reported they felt undue pressure from managers
regarding safety-related approvals due to time and schedule concerns,
and some 15% reported encountering such problems several times or
frequently.69 Further, over the past 15 years Boeing has
reportedly lost many of its employees involved in Human Factors and it
may not have involved them in the development of MCAS.
A renewed focus on developing and maintaining an effective safety
culture sets the stage for avoiding the deterioration of design
processes that led to these accidents, and should be encouraged in all
safety critical organizations. This includes aircraft manufacturers,
airlines operations and maintenance, and certifying bodies. The Human
Factors and Ergonomics Society applauds recent statements by the FAA
Administrator and Boeing Senior Management to reinforce their
commitment to safety as the highest priority, and hopes they continue
to support this message through their actions. For example, Boeing
should examine the degree to which Human Factors and Safety experts are
involved in their design and development programs across the enterprise
and ensure that they are fully empowered to support safety.
Organizational Structure to Support Emphasis on Human Factors and
Safety
In that program managers can consciously or subconsciously
compromise safety due to organizational pressures to meet cost and
schedule goals, it is imperative that safety-critical organizations put
in place organizational structures to counter such tendencies and avoid
safety breakdowns. For this reason, a best practice is to appoint a
Vice-President level Manager of Human Factors and Safety, who oversees
safety at the organization and who can raise safety concerns to the
highest level of management. Qualified Human Factors and Safety
professionals should be assigned to all technology development
programs. They can identify potential problems to program managers and
recommend design solutions to enhance human performance and avoid
serious accidents. They should also have a direct line to the VP of
Human Factors and Safety so that unaddressed problems do not remain
hidden from top-level management.
Use of Qualified Human Factors Professionals
In many organizations, people assigned to address user interface
design, user experience, human factors, training, and safety may have
no formal training in these fields, or only cursory knowledge. This
unfortunately seriously degrades the effectiveness of their efforts.
Just like every other field of engineering, Human Factors Engineering
is based on a significant body of formal education that is paramount to
its successful practice. Because it is inherently interdisciplinary,
however, its practitioners may have different degree titles (often
Industrial Engineering or Cognitive/Experimental Psychology, as well as
Human Factors). While there are a few bachelors level educational
programs in Human Factors, most qualified practitioners will have
master's or PhD degrees in the field. The Human Factors and Ergonomics
Society maintains a directory of accredited academic programs in the
field. The Board of Certification of Professional Ergonomists (BCPE) is
the recognized body for certifying that individuals are qualified to
practice Human Factors, ergonomics, and user experience through a
combination of testing, experience, and academic qualifications.
Currently there is no federal job code for Human Factors professionals,
significantly complicating the ability of the FAA and other agencies
from hiring personnel with the appropriate expertise.
Recommendations
The objective of Human Factors Engineering is not to assign blame
after accidents occur, but rather to prevent accidents from occurring
by improving the design of technologies and systems in advance. In this
light, the Human Factors and Ergonomics Society recommends that the
FAA:
1) Encourage Boeing, and other aviation manufacturers, to
incorporate Human Factors processes and personnel into the analysis,
design, development, testing, manufacturing, and maintenance of
aircraft systems in order to comply with certification requirements.
(Supports FAA JATR recommendation 4)
2) Promote a safety culture in aviation that drives a primary
focus on the creation of safe products, which in turn comply with
certification requirements. (Supports FAA JATR recommendation 6)
3) Expand its aircraft certification resources in human factors
and in human system integration, and integrate and emphasize human
factors and human system integration throughout its certification
process. (Supports FAA JATR recommendation 7)
4) Review training programs for automated systems and recommend
improvements to ensure flight crew are adequately trained in automation
processes and dependencies.
5) Conduct a study to determine the adequacy of policy, guidance,
and assumptions related to maintenance and ground handling training
requirements, and needed human factors improvements to reduce
maintenance errors. (Supports FAA JATR recommendation 11)
6) Conduct system safety assessments for all manufacturers of type
rated aircraft to demonstrate the adequacy of assumptions regarding
human performance, particularly as it relates to pilot understanding of
and response to alerts, and ability to perform control functions
manually when needed. (Supports NTSB recommendations)
In addition to these recommendations, Congress and the federal
government can enact policies that will build up the FAA's and
industry's capacity and expertise to better understand and address
issues pertaining to alerting systems and human-automation interaction
that are crucial to avoiding future catastrophic accidents in the
nation's transportation and infrastructure. HFES recommends that
Congress enact the following policies:
7) Direct the National Academies of Science Board on Human Systems
Integration (NAS BOHSI) to conduct a study on human interaction with
artificial intelligence, autonomy, and advanced automation
technologies: enhancing safety and effectiveness. Such a study could
bolster the knowledge and understanding of the many complex issues
involved and provide important directions for the nation as it develops
and implements these technologies across the coming decade.
8) Increase funding for Human Factors research at NASA and FAA on:
a. Understanding the effects of multiple alerts and the ``design
of aircraft system diagnostic tools that improve the prioritization and
clarity of failure indications (direct and indirect) presented to
pilots to improve the timeliness and effectiveness of their response.''
(supporting NTSB recommendations)
b. Developing ``robust tools and methods for use in validating
assumptions about pilot recognition and response to safety-significant
failure conditions as part of the design certification process.''
(supporting NTSB recommendations)
c. The development of effective methods, displays, and training
for supporting human oversight and interaction with automated systems.
This could include support for the FAA's NextGen--Air Ground
Integration Human Factors program's efforts around Human Error
mitigation research, as well as the Flightdeck/Maintenance/System
Integration Human Factors program, and NASA's Crew Systems and Aviation
Operations program.
d. The development of tools to support human factors and safety
assessments in the certification process. (supporting FAA JATR
recommendations)
9) Direct the FAA to develop programs for educating management and
engineers on Human Factors, the effects of automation on human
performance in safety critical systems, and the incorporation of Human
Factors Engineering processes, as well as the development of improved
human-automation interaction approaches.
10) Direct the Office of Personnel Management to add job codes for
Human Factors Engineer and Human Factors Psychologist to its list of
occupational positions and establish appropriate qualifications in
order to ensure that FAA and other federal agencies have access to and
employ qualified Human Factors professionals.
Summary
The science and practice of Human Factors Engineering is well
established, with roots going back to the earliest days of aviation.
Aviation is highly dependent on the design and development of safe,
effective flight decks for pilot control. Achieving this goal is highly
dependent on the early incorporation of Human Factors in the analysis,
design, testing and certification processes. While this is true in
general, it is even more important with automated systems and as use of
artificial intelligence and system autonomy increases. The lessons
learned from the tragic accidents of the 737-Max8 should be leveraged
to improve the safety of our aviation system and to guard against
similar problems in other safety critical systems.
References
1 Republic of Indonesia Komite Nasional Keselamatan
Transportasi. (2019). Final Aircraft Accident Investigation Report. PT
Lion Mentari Airlines, Boeing 737-8 (max); PK-LQP, Tanjung, Karawang,
West Java Republic of Indonesia: Author.
2 Federal Democratic Republic of Ethiopia Ministry of
Transport Aircraft Accident Investigation Bureau. (2019). Aircraft
Accident Investigation Preliminary Report, Ethiopian Airlines Group,
B737-8 (Max) Registered ET-AVJ, 28 NM South East of Addis Ababa, Bole
International Airport Federal Democratic Repubic of Ethiopia: Author.
3 Federal Aviation Administration. (2019). Joint
Authorities Technical Review: Boeing 737 Max Flight Control System
Observations, Findings and Recommendations Washington, DC: Author.
4 National Transportation Safety Board. (2019). Safety
Recommendation Report: Assumptions used in the safety assessment
process and the effects of multiple alerts and indications on pilot
performance Washington, DC: Author.
5 Wickens, C. D. (1992). Engineering psychology and
human performance (2nd ed.). New York: Harper Collins.
6 Johnson, E. N., & Pritchett, A. R. (1995).
Experimental study of vertical flight path mode awareness. Proceedings
of the 6th IFAC/IFIP/IFORS/IEA Symposium on Analysis, Design and
Evaluation of Man-Machine Systems (pp. 185-190). Cambridge, MA: MIT.
7 Meister, D. (1965). Human factors evaluation in system
development. New York: Wiley and Sons.
8 Bainbridge, L. (1983). Ironies of automation.
Automatica, 19, 775-779.
9 Wiener, E. L., & Curry, R. E. (1980). Flight deck
automation: Promises and problems. Ergonomics, 23(10), 995-1011.
10 Wiener, E. L. (1993). Life in the second decade of
the glass cockpit. Proceedings of the Seventh International Symposium
on Aviation Psychology (pp. 1-11). Columbus, OH: Department of
Aviation, The Ohio State University.
11 Strauch, B. (2017). Ironies of automation: Still
unresolved after all these years. IEEE Transactions on Human-Machine
Systems, 48(5), 419-433.
12 Gawron, V. (2019). Automation in aviation accidents:
Accident analyses McLean, VA: MITRE Corporation.
13 Rasmussen, J. (1980). What can be learned from human
error reports? Change in the Working Life.
14 Ericsson, K. A., & Lehmann, A. C. (1996). Expert and
exceptional performance: Evidence of maximal adaptation to task
constraints. Annual Review of Psychology, 47, 273-305.
15 Meshkati, N., & Khashe, Y. (2015). Operators'
improvisation in complex technological systems: Successfully tackling
ambiguity, enhancing resiliency and the last resort to averting
disaster. Journal of Contingencies and Crisis Management, 23(2), 90-96.
16 DeCrespigny, R. C. (2015). Resilience--Recovering
pilots' lost flying skills. Air Transport (June), 32-37.
17 Funk, K., Lyall, B., Wilson, J., Vint, R., Niemczyk,
M., Suroteguh, C., & Owen, G. (1999). Flight deck automation issues.
The International Journal of Aviation Psychology, 9(2), 109-123.
18 Orlady, L. M. (2010). Airline pilot training today
and tomorrow Crew resource management (pp. 469-491): Elsevier.
19 Lee, J. D., & See, K. A. (2004). Trust in automation:
Designing for appropriate reliance. Human Factors, 46(1), 50-80.
20 Jacobson, S. (2010). Aircraft loss of control causal
factors and mitigation challenges. Proceedings of the AIAA Guidance,
navigation, and control conference (pp. 8007).
21 Haslbeck, A., & Hoermann, H.-J. (2016). Flying the
needles: flight deck automation erodes fine-motor flying skills among
airline pilots. Human factors, 58(4), 533-545.
22 Casner, S. M., Geven, R. W., Recker, M. P., &
Schooler, J. W. (2014). The retention of manual flying skills in the
automated cockpit. Human factors, 56(8), 1506-1516.
23 Board, N. T. S. (2010). Aviation accident report:
Loss of control on approach Colgan Air, Inc. operating as Continental
Connection Flight 3407 Bombardier DHC-8-400, N200WQ Clarence Center New
York, February 12, 2009. (Tech. Rep. No. NTSB/AAR-10/01 PB2010-910401.
24 Wiener, E. L., & Nagel, D. C. (Eds.). (1988). Human
Factors in Aviation. San Diego: Academic Press.
25 Warm, J. S., Dember, W. N., & Hancock, P. A. (1996).
Vigilance and workload in automated systems. Automation and human
performance: Theory and applications, 183-200.
26 Molloy, R., & Parasuraman, R. (1996). Monitoring an
automated system for a single failure: Vigilance and task complexity
effects. Human Factors, 38(2), 311-322.
27 Sarter, N. B., & Woods, D. D. (1992). Pilot
interaction with cockpit automation: Operational experiences with the
flight management system. The International Journal of Aviation
Psychology, 2(4), 303-321.
28 Sarter, N. B., & Woods, D. D. (1994). ``How in the
world did I ever get into that mode'': Mode error and awareness in
supervisory control. In R. D. Gilson, D. J. Garland & J. M. Koonce
(Eds.), Situational awareness in complex systems (pp. 111-124). Daytona
Beach, FL: Embry-Riddle Aeronautical University Press.
29 McClumpha, A., & James, M. (1994). Understanding
automated aircraft. In M. Mouloua & R. Parasuraman (Eds.), Human
performance in automated systems: Current research and trends (pp. 183-
190). Hillsdale, NJ: LEA.
30 Federal Aviation Administration Human Factors Team.
(1996). The interfaces between flightcrews and modern flight deck
systems Washington, DC: FAA.
31 Wiener, E. L. (1988). Cockpit automation. In E. L.
Wiener & D. C. Nagel (Eds.), Human Factors in Aviation (pp. 433-461).
San Diego: Academic Press.
32 Billings, C. E. (1997). Aviation automation: The
search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum.
33 Woods, D. D., & Sarter, N. B. (2000). Learning from
automation surprises and going sour accidents. Cognitive engineering in
the aviation domain, 327-353.
34 Woods, D. D., & Cook, R. I. (2017). Incidents-markers
of resilience or brittleness? Resilience Engineering (pp. 69-76): CRC
Press.
35 Endsley, M. R., & Kiris, E. O. (1995). The out-of-
the-loop performance problem and level of control in automation. Human
Factors, 37(2), 381-394.
36 Moray, N. (1986). Monitoring behavior and supervisory
control. In K. Boff (Ed.), Handbook of perception and human performance
(Vol. II, pp. 40/41-40/51). New York: Wiley.
37 Muir, B. M., & Moray, N. (1996). Trust in automation:
Part 2. Experimental studies of trust and human intervention in a
process control simulation. Ergonomics, 39, 429-460.
38 Davies, D. R., & Parasuraman, R. (1980). The
psychology of vigilance. London: Academic Press.
39 Hancock, P. (2013). In search of vigilance: The
problem of iatrogenically created psychological phenomena. American
Psychologist, 68(2), 97-109.
40 Manzey, D., Reichenbach, J., & Onnasch, L. (2012).
Human performance consequences of automated decision aids: The impact
of degree of automation and system experience. Journal of Cognitive
Engineering and Decision Making, 6, 57-87.
41 Metzger, U., & Parasuraman, R. (2001). Automation-
related ``complacency'': Theory, empirical data and design
implications. Proceedings of the Human Factors and Ergonomics Society
45th Annual Meeting (pp. 463-467). Santa Monica, CA: Human Factors and
Ergonomics Society.
42 Endsley, M. R. (2017). From here to autonomy: Lessons
learned from human-automation research. Human Factors, 59(1), 5-27.
43 Everstine, B., & Tirpack, J. A. (2019, 3/22/2019).
USAF reviewing training after MAX 8 crashes; KC-46 uses similar MCAS.
Air Force Magazine.
44 Sider, A., & Tangel, A. (2019, September 29, 2019).
Before 737 MAX, Boeing's flight control system included key safeguards.
The Wall Street Journal.
45 Kaber, D. B., & Endsley, M. R. (2004). The Effects of
Level of Automation and Adaptive Automation on Human Performance,
Situation Awareness and Workload in a Dynamic Control Task. Theoretical
Issues in Ergonomic Science, 5(2), 113-153.
46 Ma, R., Sheik-Nainar, M. A., & Kaber, D. B. (2005).
Situation awareness in driving while using adaptive cruise control and
a cell phone. Proceedings of the Human Factors and Ergonomics Society
49th Annual Meeting (pp. 381-385). Santa Monica, CA Human Factors and
Ergonomics Society.
47 Gilson, R. D., Deaton, J. E., & Mouloua, M. (1996).
Coping with Complex Alarms: Sophisticated Aircraft Cockpit Alarm
Systems Demand a Shift in Training Strategies. Ergonomics in Design,
4(4), 12-18.
48 Endsley, M. R., & Jones, D. G. (2012). Designing for
situation awareness: An approach to human-centered design (2nd ed.).
London: Taylor & Francis.
49 Gilson, R. D., Mouloua, M., Graft, A. S., & McDonald,
D. P. (2001). Behavioral influences of proximal alarms. Human Factors,
4(4), 595-610.
50 Seagull, F. J., & Sanderson, P. M. (2001). Anesthesia
alarms in context: An observational study. Human Factors, 43(1), 66-78.
51 Graeber, R. C. (1996). Integrating human factors and
safety into airplane design and operations. In B. J. Hayward & A. R.
Lowe (Eds.), Applied aviation psychology: Achievement, change and
challenge (pp. 27-38). Aldershot, UK: Avebury Aviation.
52 Burian, B. K., Barshi, I., & Dismukes, K. (2005). The
challenge of aviation emergency and abnormal situations (NASA/TM-2005-
213462). Moffett Field, CA: NASA.
53 Braune, R. J., & Graeber, R. C. (1992). Human-
centered designs in commercial transport aircraft. Proceedings of the
Proceedings of the Human Factors and Ergonomics Society Annual Meeting
(pp. 1118-1122). SAGE Publications Sage CA: Los Angeles, CA.
54 Federal Aviation Administration. (2018). Emergency
Airworthiness Directive AD #2018-23-51: Author.
55 Beringer, D. B. (2019). NextGen Final Report: Data
for updating 14 CFR Part 25.143 and potential reference standards for
part 23, 27 and 29 aircraft: An evaluation of muscular force that can
be applied to flight controls (DOT/FAA/AM-19/5). Oklahoma City: FAA
Civil Aerospace Medical Institute.
56 Federal Aviation Administration. (2016). The Human
Factors Design Standard (HF-STD-001). Washington, DC: Author.
57 Yeh, M., Swider, C., Jo, Y. J., & Donovan, C. (2016).
Human factors considerations in the design and evaluation of flight
deck displays and controls: version 2.0: John A. Volpe National
Transportation Systems Center (US).
58 Department of Defense. (2012). MIL-STD-1472G Design
Criteria Standard: Human Engineering Washington, DC: Author.
59 SAE International. (2019). SAE 6906 Standard Practice
for Human Systems Integration Warrendale, PA: Author.
60 Pew, R. W., & Mavor, A. S. (Eds.). (2007). Human
system integration in the system development process: A new look.
Washington, DC: National Academic Press.
61 Cooper, M. D. (2000). Towards a model of safety
culture. Safety science, 36(2), 111-136.
62 Pidgeon, N., & O'Leary, M. (1994). Organizational
safety culture: Implications for aviation practice. Aviation psychology
in practice, 21-43.
63 Meshkati, N. (2002). Macroergonomics and aviation
safety: The importance of cultural factors in technology transfer
Macroergonomics (pp. 337-344): CRC Press.
64 Meshkati, N. (2007). Lessons of the Chernobyl nuclear
accident for sustainable energy generation: Creation of the safety
culture in nuclear power plants around the world. Energy Sources, Part
A, 29(9), 807-815.
65 Reason, J. (2016). Managing the risks of
organizational accidents: Routledge.
66 Wiegmann, D. A., Zhang, H., Von Thaden, T. L.,
Sharma, G., & Gibbons, A. M. (2004). Safety culture: An integrative
review. The International Journal of Aviation Psychology, 14(2), 117-
134.
67 Green, D. M., & Swets, J. A. (1966). Signal detection
theory and psychophysics (Vol. 1): Wiley New York.
68 Barkan, R. (2002). Using a signal detection safety
model to simulate managerial expectations and supervisory feedback.
Organizational Behavior and Human Decision Processes, 89(2), 1005-1031.
69 Tangel, A., & Pasztor, A. (2019, October 10, 2019).
Congress ramps up scrutiny of Boeing executives, board, The Wall Street
Journal.
Mr. DeFazio. Thank you, Doctor.
Captain Cox?
Mr. Cox. Good afternoon, Mr. Chairman. I thank you and the
committee for asking me to share my views on the issues raised
by these two tragic 737 MAX accidents. In my 50 years in
aviation, and 33 as an aircraft accident investigator, I have
not seen a more complex accident than Lion Air 610. Sadly, it
was a forewarning of unanticipated conditions that existed
which could lead to another accident. Ethiopian flight 302 was
that accident.
For an investigator, the most difficult accident is when
there is a reoccurrence of a previous accident. I saw this in
the mid-1990s with the USAir flight 427 accident near
Pittsburgh in September 1994. It was a reoccurrence of a fault
that had brought down United Airlines flight 585 3 years
earlier. We did not learn all we could. As a result, 132
perished near Pittsburgh.
We did not learn all we could from Lion Air 610 before the
Ethiopian 302 accident. The investigation was not complete. But
there was compelling evidence of a single failure that could
cause multiple warnings and adversely affect the handling
characteristics of the airplane. It is crucial that we learn
all we can from these accidents so that there is no
reoccurrence of the numerous factors that led to the
catastrophic loss of these two flights.
There are immense complexities in these accidents. They are
characterized as a loss of control-inflight accident. However,
the contributing factors are numerous. Since the loss of these
flights, there have been numerous attempts to blame one or two
organizations or individuals. But this is inaccurate and
misguided. Only with the consideration of all contributing
factors can we learn all the lessons.
In the Lion Air accident, there are contributing factors
from aircraft design, certification oversight, maintenance
execution, pilot performance, pilot dependence on automation,
human factors, culture and regulatory oversight of the
operator. And within each of these contributors are numerous
issues. This is why I make the statement this is the most
complex accident I have seen in 33 years.
As the committee is aware, the National Transportation
Safety Board and the Joint Authorities Technical Review have
both recommended that future certification of aircraft include
multiple warnings caused by a single failure. This was a
critical factor in both of the accidents. The flight crews had
multiple warnings occurring simultaneously, including one that
is very distracting, the stick shaker.
During the ensuing pandemonium, the recognition of
inappropriate stabilizer trim movement would have been
difficult. This is one reason that the runaway trim stabilizer
trim procedure was not immediately accomplished.
Aviation is the safest form of public transportation. We
will fly 4\1/2\ billion passengers this year on 45 million
flights safely. We have gotten progressively better since that
first flight in 1903. And while the record is exceptional, it
is not good enough for tomorrow or the day after. Aviation has
to continue to be safer.
I am frequently asked the question, is the MAX going to be
safe when it returns to service? My answer is, yes, for I have
great confidence in the FAA and in Boeing. Additionally, I have
confidence that the recommendations from the Indonesian
Transportation Safety Committee and the U.S. National
Transportation Safety Board and the Joint Authorities Technical
Review, these recommendations for safety are not only for the
MAX but for aviation overall.
We have a chance to take the lessons from these calamities
and to make our skies safer. Let us not squander this
opportunity. Let us carefully review each of the contributing
factors of these accidents and improve the design certification
processes to better address human factors, better failure
analysis for multiple system failures, better pilot training
with improved emphasis on manual handling skills, and improved
organizational culture where the focus is on safety first.
This committee's recommendations and actions can improve
aviation safety. We can enhance the FAA's ability to improve
failure analysis, system safety analysis, which may prevent a
future accident.
Let me conclude with an observation. I first soloed in
1970. Had we maintained the same accident rate from then to
today, there would have been hundreds more accidents and
thousands more fatalities. We were not satisfied with that
safety record, nor should we be with today's much improved
safety record. Let us learn all we can from the MAX accidents
to improve aviation safety.
I look forward to your questions. Thank you, Mr. Chairman.
[Mr. Cox's prepared statement follows:]
Prepared Statement of John M. Cox, Chief Executive Officer, Safety
Operating Systems
Good morning/afternoon Mr. Chairman. I thank you and the committee
for asking me to share my views of the issues raised by the two tragic
737 MAX accidents.
In my 50 years in aviation, and 33 as an aircraft accident
investigator, I have not seen a more complex accident than Lion Air
flight 610. Sadly, it was a forewarning of unanticipated conditions
that existed, which could lead to another accident. Ethiopian Airlines
flight 302 was that flight.
For an investigator the most difficult accident is when there is a
recurrence of a previous accident. I saw this in the mid 90s in the US
Air flight 427 accident near Pittsburgh in September 1994. It was a
recurrence of a fault that had brought down United Airlines flight 585
three years earlier. We did not learn all we could from it, as a result
132 perished near Pittsburgh.
We did not learn all we could from Lion Air 610 before the
Ethiopian 302 accident. The investigation was not complete, but there
was compelling evidence of a single failure that could cause multiple
warning and adversely affect the handling characteristics of the
airplane. It is crucial that we learn all we can from these accidents
so that there are no recurrences of the numerous factors that led the
catastrophic loss of these two flights.
There are immense complexities in these accidents. They are
characterized as Loss of Control--Inflight accidents. However, the
contributing factors are numerous. Since the loss of these flights
there have been attempts to blame one or two organizations or
individuals, but this is inaccurate and misguided. Only with the
consideration of all contributing factors can we learn all the lessons.
In the Lion Air accident there are contributing factors from
aircraft design, certification/oversight, maintenance execution, pilot
performance, pilot dependence on automation, human factors, culture and
regulatory oversight of the operator. Within each of the contributors
are numerous issues. This why I make the statement it is the most
complex accident I have seen in 33 years.
As the committee is aware, the National Transportation Safety Board
and the Joint Authorities Technical Review have both recommended that
future certification of aircraft include review of multiple warning
caused by a single failure. This was a critical factor in both
accidents. The flight crews had multiple warning occurring
simultaneously, including one that is very distracting, the stick
shaker. During the ensuing pandemonium, recognition of inappropriate
stabilizer trim movement would be difficult. This is one reason that
the runaway trim procedure was not immediately completed.
Aviation is the safest form of public transportation. We will fly
nearly 4.5 billion passengers this year on 45 million flights safely.
We have gotten progressively better since that first flight in 1903.
While that record is exceptional, it is not good enough for tomorrow or
the day after. Aviation has to continue to be safer.
I frequently am asked the question ``Is the MAX going to be safe
when it returns to service?'' My answer is yes, for I have great
confidence in the FAA and in Boeing. Additionally, I have confidence
that the recommendations from the Indonesian National Transportation
Safety Committee, the US National Transportation Safety Board, and the
Joint Authorities Technical Review. These are recommendations for
safety enhancements not only for the MAX, but for aviation overall.
We have a chance to take the lessons from these calamities, and
make our skies safer. Let us not squander this opportunity. Let us
carefully review each of the contributing factors of these accidents
and improved design and certification processes to better address human
factors, better failure analysis for multiple system failures, better
pilot training with improved emphasis on manual flying skills and
improved organizational culture where the focus is on safety first.
This committee's recommendation and actions can improve aviation
safety. We can enhance the FAA's ability to improve failure analysis,
and system safety analysis, which may prevent a future accident.
Let me conclude with an observation. I first soloed in 1970, had we
maintained the same accident rate to today there would have been
hundreds more accidents with thousands more fatalities. We were not
satisfied with that safety record, nor should be with today's much
improved safety record. Let us learn all we can from the MAX accidents
to improve aviation's safety record.
I look forward to your questions.
Thank you Mr. Chairman.
Mr. DeFazio. Thank you for that testimony.
We have three votes coming up on the floor of the House
right now, we're in process, so the committee will adjourn, and
I will return immediately after the votes. Let's say, I mean,
they drag out votes around here. Yes, OK, recess. Sorry, we are
going to take a break. I would say 30 minutes. So we will give
you 30 minutes, you can run down to the cafeteria. I hope you
can all come back, please. Thank you.
[Recess.]
Mr. DeFazio. I apologize. I was almost all the way back
here, and then the Republicans called a, ``Doomed to Fail''
procedural vote and I had to go all the way back to the floor
again, so we waste a lot of time around here.
So, let's proceed to questions. Since I just got back and I
want to gather myself for a minute, Rick, are you ready to
question? OK.
Mr. Larsen. I presume it will be 5 minutes.
Mr. DeFazio. Yes.
Mr. Larsen. Five minutes on the clock?
Mr. DeFazio. Oh, yeah. Five minutes.
Mr. Larsen. Yeah.
Mr. DeFazio. Yeah.
Mr. Larsen. OK. I had to ask, thanks. So, thanks. I want to
thank the folks for being here.
Dr. Endsley, in your discussion with regards to human
factors, one of the issues we are looking at is, going forward,
if we should change, and I think we should, but how we change
the certification process and what changes ought to be made.
How should we think about incorporating human factors analysis
into the certification of airplanes?
Ms. Endsley. The JATR report talks quite a bit about that,
and we certainly concur with their recommendations to emphasize
human factors more in the certification process.
The real value of certification is getting a second set of
eyes on what is going on. It is way too easy for even very
knowledgeable, well-intentioned engineers to make incorrect
assumptions or errors in their analysis, and the ability to
have that independent set of eyes looking at what is going on
and the processes that are being used, and the outcomes of the
results I think is extraordinarily valuable.
We need to make sure that those teams are equipped with
well-qualified human factors engineers who understand a lot of
the complexities of human behavior that are involved in these
sorts of events, particularly with things like automation and
alarm situations such as we saw here.
Mr. Larsen. Yeah. In your opinion, and you may not have an
opinion or knowledge. Maybe if someone else does have an answer
to this, I would welcome that. Does the FAA currently have
people in line to conduct human factors analysis of airplane
designs and of system designs?
Ms. Endsley. Yes. The FAA has some very well qualified
human factors professionals. Dr. Kathy Abbott is in charge of
certification on the human factors side and she is very
knowledgeable about this. I think the issue is one of having
enough people and having those people involved in that process
such that they are getting the information they need and are
involved all along the way.
That is really the most valuable way to incorporate human
factors. You can't just put a stamp at the end. You have really
got to be involved early on it and continuously.
Mr. Larsen. Yeah. Anyone else want to answer that question
on human factors about type, numbers of people, skills,
capabilities within the FAA?
All right. OK. Nothing? OK.
Mr. Pierson, in your written testimony, you alleged that
last year, the 737 program's vice president and general manager
agreed to conduct a thorough engineering and quality analysis
to determine if the production environment has caused safety
risks. To your knowledge, was that analysis conducted? Are you
at the microphone, please?
Mr. Pierson. Not to my knowledge.
Mr. Larsen. ``Not to your knowledge''? Did you yourself do
any follow up on that, or was that your role? Or whose role
would have been to follow up on that in your organization?
Mr. Pierson. That would have the general manager's
responsibility with the appropriate leaders of the other
organizations like engineering and quality.
Mr. Larsen. Mm-hmm. In that circumstance, was Mr. Campbell
within the ODA, and was your concern made into the ODA at
Boeing for this question? Or was this outside of that?
Mr. Pierson. This was a discussion that I had with him one-
on-one. It wasn't involving anybody else in the ODA.
Mr. Larsen. OK. All right. Is your argument, is the point
that you are making in your testimony that this is a problem
with production pressure because of economic factors, or a
problem with the way Boeing is organized to build and to
certify airplanes?
Mr. Pierson. Could you rephrase that again, Congressman?
Mr. Larsen. Yeah. Is your argument, or the point you are
making with your testimony is a very good point. Is it because
of economic pressures only, or is it a problem with how Boeing
uses the ODA?
Mr. Pierson. You know, I really don't have a comment about
the ODA. As far as economic factors go, I am obviously not an
economist. My issues were really what I saw in the factory and
the environment, and the things that were happening at the time
when those planes were being built, and then I wasn't there
when the second plane was built. I had retired just prior to
that, but----
Mr. Larsen. Yeah----
Mr. Pierson. That was my concern, and----
Mr. Larsen. Right. All right.
Mr. Pierson. I will say----
Mr. Larsen. Yeah----
Mr. Pierson. Just on the topic, if I may.
Mr. Larsen. Sure.
Mr. Pierson. There has been a lot of discussion about
certification, and the certification process, and a lot of
discussion on the left side, if you will, of the process which
is the design and the flight training and things like that.
Mr. Larsen. Right. Right.
Mr. Pierson. The right is on the far right is what is
called the production part, and Boeing is issued a production
certificate that expects to have every plane built with the
same level of repeatable quality. And so, that is a really
important part of the airplane certification process that we
shouldn't forget.
Mr. Larsen. All right. Thank you.
Thank you, Mr. Chairman. I yield back.
Mr. DeFazio. I thank the gentleman. I will recognize myself
now.
Captain Cox, we have heard from some through these hearings
who have said, ``Well, if this had happened with U.S. or
European pilots, it would not have been a problem because they
have superior training.'' Yet I believe you are aware of U.S.
and European pilots who knew this problem was coming in a
simulator and were unsuccessful in managing it. Is that
correct?
Mr. Cox. Yes, sir. I am aware of some anecdotal tests that
were done with some European and North American pilots that
also let the airplane get to a quite high speed, over speed
condition. So, I don't believe there is evidence that can
support a premise that it is exclusively due to their being
developing world countries that these accidents were caused by
this.
Mr. DeFazio. Right, and also, I think was it you used the
word, ``pandemonium''?
Mr. Cox. Yes, sir.
Mr. DeFazio. Yeah. Now, what are you referring to there?
Mr. Cox. The fact that when this situation occurs, that
when the airplane breaks ground, you get somewhere around seven
simultaneous failures, one of which is very, very distracting.
The stick shaker. Literally the column in your hand is shaking
and it is very loud. So, you as a pilot, the training comes in
to, how do you sort through that? Where do you go back to the
commonality and sort through that, and in what priority?
But with that much noise going on, and with these
simultaneous failures, the word ``pandemonium'' is appropriate,
sir.
Mr. DeFazio. OK. Yeah, I think NTSB said, ``cacophony,'' I
think is the word they used, but similar.
Mr. Cox. I have had a stick shaker go off in an airplane
with passengers, and it, by itself, is enough of a challenge,
much less now compounded with six to seven other simultaneous
warnings and failures. It would be a real handful.
Mr. DeFazio. Dr. Endsley, wouldn't that sort of fit into
the human factors approach in terms of solving how quickly a
pilot could solve that?
Ms. Endsley. Yes. That was a big factor. The idea that
pilots could respond in 3 seconds is based on a lot of things,
but it would have to be a well-recognized cue for a well-
trained procedure, and that was not the case here. They had all
kinds of multiple competing alerts which will really slow down
decisionmaking time.
Mr. DeFazio. OK. Mr. Pierson, you mentioned it in your
statement, but I would just like to revisit it. I think after
your extraordinary persistence when you finally got in to see
the general manager of the 737 program, would you just please
give us a little color on that meeting? A little more than in
your testimony? Yeah.
Mr. Pierson. Congressman, you are referring to, I believe,
our July 2018 meeting.
As far as just color, if you will, commentary is when the
meeting started, it was a follow up to the email that I had
written requesting a shutdown of the factory. I met with him,
and I walked into the office and he asked me, ``Why are you
here?'' And I said, ``I am here to follow up to my earlier
communication with you.'' And he asked me how it was going. And
I explained that it was getting worse in my opinion, and that I
echoed my recommendations.
I had a bit of a difference of opinion at that point, and
then we talked, and at the end, he agreed that he would pull
the overtime records and look at how much work we were asking
of our union employees, and I emphasized that not only that is
obviously really important, because they are the ones doing the
lion's share of the work, but also the managers that are
overseeing them. And then, the engineering quality analysis
that I had requested be done to see if there was any possible
issues that may have required us to alert our customers.
Mr. DeFazio. And nothing changed?
Mr. Pierson. Not to my knowledge.
Mr. DeFazio. OK.
Mr. Pierson. I retired in August.
Mr. DeFazio. Right, and we asked the CEO in the last
hearing after he got that recommendation from you, and, ``Did
you close down the line?'' ``No.'' ``Did you slow down the
line?'' ``No.'' And apparently, none of the engineering reviews
that you asked for or overtime reviews, if they were reviewed,
they were disregarded. So, and when you posited that, from your
experience in the Navy, this would say, ``No. We have got to
stop and revisit this and fix it,'' but he did say to you
something about, ``The Navy isn't a profit-making----''? What
was that?
Mr. Pierson. He said when I explained to him that, ``In the
military operations, if we have these kinds of indications of
unstable safety type of things, we would stop.'' And he said
that, ``The military is not a profit-making organization.''
That's what he said.
Mr. DeFazio. Now, Mr. Collins, your involvement in the
issue regarding the placement of, and/or lack of, additional
protection for the rudder control cable, as I understand it, I
mean, in the end, there were how many people involved in the--
what do you call it? A nonconcur?
Mr. Collins. A nonconcurrence. Well, there was the issue
paper nonconcurrence, and then there was the SRP panel, whose
recommendation was rejected, and the board recommendation. So,
I think it was a total of 13 engineers, 1 project pilot, and 4
managers documented that they did not agree with the decision.
Mr. DeFazio. And this was, to the best of your knowledge,
overruled by a single manager who is in the office in
Washington State?
Mr. Collins. Yeah. He is in the consolidated office. He was
the transport airplane director manager at the time. He is the
one that signed it and took responsibility.
Mr. DeFazio. Mm-hmm.
Mr. Collins. Others supported it. Other managers supported
him.
Mr. DeFazio. And there were questions raised by the
minority that they think, ``Well, we should bring in former FAA
Administrator Huerta or somebody else.'' To the best of your
knowledge, did the decision on--because this is only one
decision, and there have been others, and we are going to track
these things down, but do you think that anyone higher up, like
in the national office, was involved in the rudder cable issue
or even aware of it?
Mr. Collins. Well, the safety SRP report of the board's
recommendation, the manager had to come back and explain why he
disagreed with that, and that went up to Air2, the deputy
director of aircraft certification.
Mr. DeFazio. Oh.
Mr. Collins. In the earlier decision, it has been my
experience in issues like this that they are discussed with the
aircraft certification deputy or director.
Mr. DeFazio. And that is someone based in Washington?
Mr. Collins. Yes, in Washington, DC.
Mr. DeFazio. OK. Good. Then, that is a string to follow for
us, and then, we will see where it goes from there. Thank you.
That is helpful.
With that, I don't have any other questions at the moment,
and I recognize Representative Norton.
Ms. Norton. Thank you, Mr. Chairman. I appreciate your
inviting these witnesses as well because they broaden our
understanding. And I think I'd like to begin with Mr. Pierson
because your testimony, as I understood it, focused primarily
on the Renton, Washington, factory, but, in past hearings, I've
raised concerns about the North Charleston, South Carolina,
factory, which makes the Boeing 787 Dreamliner.
There we have reports of concerns from employees of
defective manufacturing, even pressure not to report
violations. Each time my office raised concerns with Boeing
representatives they have assured me and my staff that the
problems found in South Carolina were not systemic. Your
testimony indicates some of the same issues were present in
Renton, Washington. To your knowledge, how widespread were or
are these issues, do you believe, Mr. Pierson?
Mr. Pierson. Yes. Congresswoman, I have no experience at
the South Carolina facility, but what you speak of I did
witness at the Renton factory. There was certainly an
inordinate amount of schedule pressure being placed on
employees, and we had a lot of challenges with parts. I mean,
normally, when the factory is running fine, everything is going
well, but then we had kind of a cascading problem, and it just
kind of got out of hand.
Ms. Norton. I don't know why we'd want to trust Boeing
without making sure that the FAA should go farther. In fact,
would you favor that, the FAA going farther and doing an
investigation of U.S. Boeing factories?
Mr. Pierson. I fully support that. I'm encouraged to hear
the FAA go in and do a thorough investigation. I really think
that's necessary. And again, as I mentioned before, not only go
and investigate, identify problems and fix them but maintain
that presence that you need to have into the future.
Ms. Norton. I'm going to suggest that following this
hearing. Mr. Collins, you say that the culture at FAA shifted
from supporting FAA technical specialists to favoring industry
positions. This is something that concerned me in my questions
this morning. I'd like to know what immediate steps you think
FAA leadership can take to return the agency to a culture of
safety you apparently experienced when you first began there.
Mr. Collins. I think that the culture has evolved, so it
would take something to turn it around. I had experience
working with Flight Standards for a bit, and they rewarded
employees who raised safety issues. I think rewarding employees
and managers who address safety issues might be a good help. I
mean, I've heard--I don't have evidence, but I've heard in the
past managers' bonuses and things were based on, in part,
applicants' schedules.
Ms. Norton. Applicants' what?
Mr. Collins. Schedules for projects to complete a project
on time.
Ms. Norton. Well, isn't that what leadership is all about?
I mean, you can't change in any comprehensive way if you don't
have somebody at the top for complicated organizations forcing
change down. Do you think that the present leadership, for
example, at FAA has the capacity to bring that kind of change
or make sure that kind of change happens at Boeing?
Mr. Collins. And I can speak to the FAA. At the FAA, I
think they have the ability to do it. It's going to take work
to change the culture at all the different levels that has
evolved over time.
Ms. Norton. And apparently this is by now built into the
culture at places like Boeing. That's why my question to Mr.
Pierson was about not assuming that what you see at one Boeing
factory won't be the case at another. It seems to me that given
what we have learned, the recalcitrance of Boeing, it is going
to be on us if we do not take the steps to systematically look
at Boeing factories across the United States. Thank you, Mr.
Chairman.
Mr. DeFazio. I thank the gentlelady. The gentlelady from
West Virginia, Mrs. Miller, is recognized.
Mrs. Miller. Thank you, Chairman DeFazio. Dr. Endsley, the
FAA is looking into incorporating human factors into
considerations throughout the design and certification process.
Can you tell me about that?
Ms. Endsley. Yes. That was one of the recommendations of
the JATR, and we certainly concur with that. What needs to be
done is to increase the staff that's available. We also need to
increase some of the research that's needed to look at some of
these issues that they're having challenges with such as
multiple alerting situations and human automation interaction.
There are a number of those kind of steps that can be done.
To enable the certification to really consider human
factors, I think it's really important that they are there as
part of that team and that they get the kind of data that's
needed all through the process from the analysis to looking at
the designs to reviewing test procedures and test results.
That's a really important thing to be incorporated all the way
through.
Mrs. Miller. That was sort of my second question as well.
So you're talking about multiple factors, multiple human
factors in the beginning of your statement?
Ms. Endsley. Yes. Human factors is really looking at every
aspect of how humans perceive, think, how they move, the
anthropometry, really all human characteristics and human
capabilities and limitations and then designing the systems to
be compatible with how we work and to guard against some of
where our known failure points are.
So it's a systematic way of designing systems based on the
research on how people work, and that's the way to really
improve human performance. It works to not only improve the
efficiency of your system but also guard against the kind of
errors that lead to accidents.
Mrs. Miller. Some people freeze. Other people the adrenalin
starts to flow. So that will be difficult unless they are
trained consistently how to react to specific problems, don't
you think?
Ms. Endsley. Training is extremely important, and it's a
part of what we look at in human factors. So the first thing
you want to do is design the system appropriately because it's
very hard to train for bad designs. So you want to design it
appropriately first, and then you want to train people, and
training people on what to do in emergency situations is
extremely important. It's very important for dealing with
things like automation, automation failures and getting into
these sorts of edges of the envelope where the automation
doesn't behave properly.
And you have to really expose people to that so they know
what cues look like, how to prioritize information, how to
respond, how to communicate, and those well-learned behaviors
then can be executed much more smoothly when the real thing
happens.
Mrs. Miller. How do we tackle that automation surprise?
Ms. Endsley. We try to avoid it. So the way we have to
address it is, one, training. So people actually get good
training on the automation, which didn't occur in these
accidents but we know is extremely important for automation
because it's very complex. You can find even very experienced
pilots don't actually know how the system is going to operate
in a wide variety of circumstances. So training is important.
The other thing is really the displays we provide. Even
well-trained pilots aren't going to do the right thing if they
don't get the right information. For example, here they didn't
have information or not what MCAS was really doing. They didn't
have the information they needed to even understand that the
angle-of-attack sensors disagreed or had a problem with it. So
they didn't have the information they needed.
Mrs. Miller. How to override it, so to speak?
Ms. Endsley. So they could override it, right. So having
all the procedures, having all the training won't work if you
don't have the situational awareness you need to make the right
decision.
Mrs. Miller. OK. Thank you. I yield back my time.
Mr. DeFazio. I thank the gentlelady. Albio Sires.
Mr. Sires. Thank you, Mr. Chairman. Mr. Pierson, thank you
very much for being here today. It gives me a great deal of
comfort to know that there are people like yourself out there
that when you see something wrong you're willing to speak up
and let people know what is going on and how you feel. I think
as someone who travels on planes it's very comforting to know
that you would try to do the right thing. You went through the
management. They ignored you.
And this morning I just can't believe that after all we
have gone through this morning we finally got a commitment from
Mr. Dickson that they're going to investigate all your emails
and the reasons that it happened. That's amazing to me after
all this time. It took this hearing for them just to even look
and investigate what your comments were. So I thank you.
Mr. Pierson. You're welcome, Congressman. It's just the
right thing to do.
Mr. Sires. Was this pressure unique on employees at Boeing,
or was it just this because of the 737 MAX, and they had to get
them out, or was this something that was all the time at
Boeing? Is this the culture, just keep pressuring the employees
to push, push, push?
Mr. Pierson. In my experience at Boeing, the other
positions I was in at Boeing I didn't see that. In my vantage
point, it was the factory. It was in the production facility.
It's just the pressure and the schedule and scheduling. In 30
years in the military, I never saw that level of schedule
pressure being put on people. When you put people in that kind
of pressure and they're tired, mistakes are made, and I think
the doctor would agree with that.
Mr. Sires. Can you give me other examples of what was going
on? Because I'm not well-versed on the factory or some of the
issues that you talked about. What you saw, what you saw that
was wrong.
Mr. Pierson. Well, maybe it would be best to just very
quickly give a--in the factory, everything is planned.
Everything is planned and is supposed to be done in accordance
with our FAA-approved production certificate. And when things
are working fine, parts are getting delivered on time, the
people are working in position, the plane moves down the line
and then eventually is properly flight tested, et cetera.
End of 2017 and 2018 what I started observing--again, I
wasn't alone, and this is why I've been adamant about talking
to other employees at the site. We started having problems with
our parts being delivered, and it wasn't just big parts like
the engines, which was a chronic problem. We had other things
that were really very important. Every part in a plane is
important, but wiring, wire bundles, things like that, these
are really important things.
This starts to lead to a lot of out-of-sequence work, and
so resources are stretched. People that are used to working in
one position or two are now being asked to kind of work all the
way down through the factory and maybe even outside, and of
course that means their managers are also stretched, and the
equipment is stretched. There's a lot of stuff going on, and
it's very challenging, in my opinion, to maintain the level of
quality that we really are expected to maintain.
Mr. Sires. Do you stay in touch with some of your former
workers, coworkers?
Mr. Pierson. I'm sorry. Say again?
Mr. Sires. Do you stay in touch with some of your
coworkers?
Mr. Pierson. I have a lot of friends at Boeing, and I for
the most part with the exception of two employees I've been in
contact with, I decided it wasn't really the right thing to do
to talk to them about what I was trying to do and get the
investigators to go look. So I haven't really talked to them.
Mr. Sires. Because I was just wondering if that same
practice continues today, what you observed while you were
there. Has anything changed?
Mr. Pierson. That's a great question. Again, I'm really
encouraged the FAA is going to go in and do a thorough
investigation, talk to employees and start with the employees
that are actually building the plane, the people that are the
mechanics and the electricians and the quality inspectors.
Those are the people who are going to give the best perspective
overall of how things are going. And looking at all the data in
the production reports there's a lot to look at. I am
encouraged by that, though, that they're committed to doing
that.
Mr. Sires. You're encouraged by what Mr. Dickson said this
morning, that he's going to follow up on this?
Mr. Pierson. I'm encouraged that they're going to do it.
I'm a healthy skeptic right now, Congressman.
Mr. Sires. Well, Mr. Chairman, I hope our committee follows
up and makes sure that Mr. Dickson does what he committed to us
this morning.
Mr. DeFazio. I can assure the gentleman we will be
following that very closely. We want to see that commitment
delivered on, and I appreciate Mr. Pierson's persistence in
this matter.
Mr. Sires. Thank you, Mr. Pierson.
Mr. DeFazio. With that I recognize Representative Brownley.
Ms. Brownley. Thank you, Mr. Chairman. I just wanted to
also note to the committee that's concerning to me is that Mr.
Pierson also reached out to NTSB and to the Department of
Transportation in his effort to get someone's attention, and in
both cases with NTSB and Department of Transportation they did
not take any action from your notifications. Is that correct?
Mr. Pierson. It's correct, Congresswoman, that it was an
effort to try to get the investigators. I was trying to get to
them and share information, and it took over 3 months before
they'd even agree to meet with me. They didn't want to receive
the documents. Eventually, they did meet with me. They offered
to give me 15 minutes. My attorneys and myself said that's not
nearly enough time.
They only gave an hour and a half, and at the end of it
all, they referred us to Department of Transportation IG and
said that it was outside their scope. We had asked them again
to pass the information to the Indonesian and Ethiopian
investigators, and their take on the matter was that it was
beyond the scope of their responsibilities and those
investigations.
Ms. Brownley. Thank you. I heard a podcast on Boeing
probably 6 or 8 months ago. I can't remember how long it was,
but it was another Boeing whistleblower who was talking about
production of the airplanes and the intensity that Boeing was
putting on the employees to produce and produce in a timely
way.
And in this podcast, they referenced the fact that they
were directed at one particular time that there were engines
that were not allegedly fully functioned engines. That they
were marked and painted in a way that said there was some
malfunction going on with the engine, and in this push to move
the assembly line, that they actually were instructed to go use
an engine off of that. I don't know if you ever observed
anything like that.
The podcast went on to say, too, that there were tools and
so forth left in the belly of the plane or in the tail of the
plane. Just sort of sloppy work that wasn't being inspected,
and I don't know if you witnessed anything like that?
Mr. Pierson. Congresswoman, again, I didn't work in South
Carolina. I will say that.
Ms. Brownley. That was in South Carolina.
Mr. Pierson. If you are asking about the Renton facility, I
don't ever recall anybody ever saying, ``Go get a part,'' that
wasn't approved. I never saw that.
Ms. Brownley. OK. OK, very good.
And Mr. Collins, in terms of talking about the FAA culture
and how it really needs to change, was there a crash that
occurred when you were employed by FAA?
Mr. Collins. Yes. I actually investigated two accidents.
One was an Air France in Tahiti that ran off the runway and
nobody was hurt, and the other was the TWA 800 accident where
everybody died, and so, I was at the hangar. I was the lead FAA
engineer on it when it became clear it was a fuel tank
explosion.
Ms. Brownley. And when you were at the FAA and those
incidences occurred, did you see changes in the way FAA
operated? Did you see changes in the culture of the
organization?
Mr. Collins. I was kind of under the initial culture. We
did a lot of work. We did two rulemakings to improve the
safety. There were hundreds of airworthiness directives as we
learned about different failures that could create ignition
sources. It was really after implementation of the 2001 fuel
tank safety rule a few years later where I saw industry
resistance and management supporting it start to creep in.
Ms. Brownley. Would you say that was the beginning of a
cultural change starting to happen?
Mr. Collins. Yeah. That was when we first started seeing
engineers nonconcurring on issue papers. I really don't
remember it before then, so 2002, 2003ish.
Ms. Brownley. And this culture is not just with the Boeing
organization. It is with any manufacturer.
Mr. Collins. No. It is across the board with manufacturers.
It is not just Boeing.
Ms. Brownley. Thank you, sir.
I yield back, Mr. Chairman.
Mr. Collins. If I could add, the example of the rudder was
the one that was the most dramatic because it was really
unprecedented to have that many people document a disagreement
like that.
Ms. Brownley. Thank you.
Mr. DeFazio. I thank the gentlelady.
Yeah, Mr. Collins, just to follow up on that, you mentioned
the name of one individual who we are going to seek to discuss
this with. You mentioned there were others. Do you happen to
recall their names?
Mr. Collins. On the----?
Mr. DeFazio. When they overruled everybody and said----
Mr. Collins. On the rudder control issue?
Mr. DeFazio. Yeah, yeah.
Mr. Collins. Yeah. One of the managers is Victor Wicklund.
He was the transport standard staff manager.
Mr. DeFazio. Mm-hmm. OK. All right, because we are looking
to pursue more interviews with FAA, and----
Mr. Collins. Right----
Mr. DeFazio [continuing]. I think we would want to discuss
this with them, because----
Mr. Collins. Yeah, and the other one was the transport
airplane directorate manager which was Jeff Duven.
Mr. DeFazio. All right. Yeah, because I mean, the rationale
I saw was that the NG engine was slightly smaller than previous
versions, and therefore, and had not had an uncontained
failure, so therefore, even though the MAX engine was much
larger, they thought it would be very dependable and never have
an uncontained failure, which is like, ``It's a new engine. How
do you know that?''
Mr. Collins. I agree. I mean, as a propulsion engineer, I
didn't see validity in that argument.
Mr. DeFazio. You didn't?
Mr. Collins. On a higher energy rudder.
Mr. DeFazio. Yeah.
Mr. Collins. And you have to, on the airplane side, assume
you get the uncontained failure, and then protect against it.
When the engine is being approved, their job is to show that it
is not going to eject parts, but on the airplane side on the
installation, you have to assume it is going to have those
failures, and then protect the airplane from the failure.
Mr. DeFazio. Yeah. Thank you. So, you would say that during
your lengthy tenure with FAA, and you just mentioned it in
response to Representative Brownley, that you saw a change
after you began. It was unusual to see nonconcurs before we
went through the fuel tank issue.
Mr. Collins. Correct. Yes.
Mr. DeFazio. Yeah.
Mr. Collins. This just kind of creeped in after that.
Mr. DeFazio. Interesting, and you never saw, in your 30
years, one where this many people nonconcurred and got
overruled?
Mr. Collins. No, and then, we had the additional part of
the new voluntary safety reporting process. They brought in his
specialists that weren't working on the project and reviewed it
and came to the same conclusion as those that didn't agree with
the issue paper. And then, that was overruled. So, it was
disappointing for it to go through that process and not see any
change.
Mr. DeFazio. What do you think is--I mean, we have some
will say, ``Well, it would be impossible without ODA,'' and I
agree. If you are going into minor aspects of the planes. My
concern is anything that would take a plane down, FAA should be
directly and fully informed of, and directly involved in, but I
mean, what do you think about the current process, and how
might we change it?
Mr. Collins. Well, and I agree. When I first started, I was
taught that the Federal Aviation Regulations defined the
minimum level of safety for the airplane, and this is where the
means of compliance and lessons learned from accidents should
be incorporated in showing compliance with that.
Mr. DeFazio. Mm-hmm.
Mr. Collins. And there are a lot of exceptions under 21-101
where new rules aren't incorporated in amended type of design,
and then exemptions also where too often to me, it seemed the
interest of the applicant was, again, over the interest of the
traveling public.
Mr. DeFazio. Mm-hmm.
Mr. Collins. One example in my testimony is about an
exemption that was granted for fuel quantity indicating wires,
ignition prevention in the fuel tank where a 4-year time
limited exemption was granted on the 737 NGs and, well, 5 years
is all it takes for a new type design approval.
At the end of the 4 years, no change had been made, and
then a permanent exemption was granted instead of making the
manufacturer fix it.
Mr. DeFazio. OK.
Captain Cox, you have a lot of years in the air and I think
you flew earlier versions of the '37. In one of the hearings, I
showed an image of a flight deck from 100, and then an image of
a flight deck from the MAX, and it just really didn't look like
the same plane. I mean do you think we should consider how many
times you can amend a certificate versus actually going through
certification?
Mr. Cox. It is an incremental step process so that pilots--
and I flew the 200 and 300 and there was quite a bit of
difference between those two, to the point that we finally
split the fleet where only 200 pilots would fly the 73-200
and----
Mr. DeFazio. Really?
Mr. Cox [continuing]. So we in essence treated it like a
separate airplane. And some airlines have been willing to do
that and others, for economic reasons have elected not to.
There is a lot of difference between a MAX and the first-
generation 737. I think it would be unreasonable to ask a pilot
to fly a 100 or 200 on Monday, Wednesday, Friday and on
Tuesday, Thursday go fly a MAX.
Mr. DeFazio. Right.
Mr. Cox. But as the incremental steps that we are taking, I
can understand how the FAA approved it, but I think the 737 is
a bit unique because I don't think we have another airplane in
the fleet that has as many derivative type certificates or that
has been in service as long, and I don't think there will be
another version of the 737. I think the MAX is the last one.
Mr. DeFazio. Right.
Mr. Cox. So, I think the problem is, to some degree, going
to cure itself.
Mr. DeFazio. Yeah, and I don't know if anybody could answer
this, but they are trying to amend the type certificate for the
777 with folding wings and say that this doesn't require
recertification. I am not aware of any commercial transport
aircraft that have folding wings. It seems like a pretty
radical departure.
Mr. Cox. It is, but as an example, the Airbus, and I flew
the 319, 20, and 21, there were subtle differences between the
three airplanes but for the most part, they flew virtually
identically.
Mr. DeFazio. Mm-hmm.
Mr. Cox. The 737, 300, and 400 were very close.
Mr. DeFazio. Mm-hmm.
Mr. Cox. 737, 700, and 800 are very close.
Mr. DeFazio. Mm-hmm.
Mr. Cox. So, there are cases where the differences are
minor, but there are some that the differences are significant.
Mr. DeFazio. OK. I guess at that point, I don't think I
have further questions. Well, maybe staff has a further
question, which is this? OK. Where? Which one? Where am I? OK.
OK. Captain Cox, as a former pilot and safety consultant,
how important is it for a pilot to be knowledge and trained on
new flight control systems, particularly something that is
novel or unique, such as MCAS?
Mr. Cox. I think the training is critical in the fact that
the assumption was made that the pilots would instantly
recognize inappropriate stabilizer trend movement.
Mr. DeFazio. Mm-hmm.
Mr. Cox. With 737, starting with the 300 series, that trim
system moves because of a system known as the speed trim
system. So, you would have to recognize that movement in and of
itself, uncommanded movement by the pilots in and of itself
would not necessarily be a trim runaway, and when you have
multiple failures that are going on, the recognition of an MCAS
activation would be much more difficult. Hence, that needs to
be trained as a possibility that if you see a stick shaker that
comes on with multiple failures, recognize at the moment the
flaps are retracted, you may get a significant nose-down input.
That was not done, and that training, I think that lack of
or the failure of that training to be widely disseminated is a
contributor here.
Mr. DeFazio. OK. Thank you.
And Dr. Endsley, again, human factors. MCAS, at least in
the first flight, first accident, not in the manual. I mean, do
you think in terms of a human factors approach that pilots
should have been made aware if something is running in the
background that can radically alter the behavior of the
airplane?
Ms. Endsley. Absolutely.
Mr. DeFazio. Yeah.
Ms. Endsley. It is very hard to understand and diagnose
what the plane is doing when it is a system you have never even
heard of. They didn't have any information about why it was
acting erratically, and as Captain Cox just pointed out, they
didn't even have good cues that would match up to running the
procedure that Boeing assumed they would be able to run very
rapidly.
Mr. DeFazio. Mm-hmm.
Ms. Endsley. So, it was really this whole combination of
factors of no information on the flight manual, no training,
and no adequate displays that were just the worst possible
combination.
Mr. DeFazio. Thank you. So then, and we have kept you a
long time. This will be the last question, and I would ask
anybody or everybody who wants to respond. What do you think is
the biggest concern this committee should focus on regarding
the FAA's capability of overseeing Boeing production and novel
systems, given everything you have heard here today? I will
start with Captain Cox.
Mr. Cox. I think, based on the things that I have heard
today and what I have learned over the months of watching this,
I would encourage the committee: Don't get too focused. The
JATR report was very good in taking a holistic view.
There is not a single cause to this accident, and you have
a rare opportunity if the committee will view it in its
entirety of the complexity, you can help really significantly
promote aviation safety going forward, and I think that that
was reinforced today here. There is an awful lot of focus on
the FAA. There is an awful lot of focus on Boeing, and they are
two of the major contributors to these tragedies, but they are
not the only ones.
And so, I would encourage in the strongest possible term,
sir, keep the focus broad.
Mr. DeFazio. Right. Well, and I would agree, and in terms
of the AOA, we did have a company that hadn't repaired the AOA
that was on--was that on Lion Air, I think, that they had even
lost their license.
Mr. Cox. Yes, sir, and if I might, the installation of the
angle-of-attack sensor----
Mr. DeFazio. Mm-hmm----
Mr. Cox [continuing]. On the Lion Air airplane. There is a
calibration procedure that has to be followed, and the
maintenance department signed off that they did it. It is not
possible that they did.
Mr. DeFazio. Right, because it immediately was----
Mr. Cox. Because that is very specifically what the
procedure is for----
Mr. DeFazio. Mm-hmm----
Mr. Cox [continuing]. Is to determine the accuracy of the
sensor output.
Mr. DeFazio. Mm-hmm.
Mr. Cox. So, this is, to come full circle----
Mr. DeFazio. Yeah----
Mr. Cox [continuing]. This is the reason I say, ``There is
a lot of contributing factors.''
Mr. DeFazio. Right. I get that.
Dr. Endsley, do you----?
Ms. Endsley. Yes. There has been considerable discussion
here today and also previously in the press about concerns
about safety culture at both Boeing and the FAA that sort of
underlie a lot of the failures we saw in good process and ended
up being in good design.
The FAA Administrator and Boeing have made a number of
announcements of things they are going to do to try to fix
that, and we are glad to see that, but changing culture is
really hard. You can't just give a one-shot and it is done. It
is something you have to do every day.
It has a lot more to do with actions than with words, and
so, the importance of really following up on those actions of
taking safety issues very seriously, of reprioritizing safety
with regard to production and cost in schedule, those changes
are going to require a lot of continued interaction by
management, and it is going to require bringing in a lot of
people who are knowledgeable about these things to get those
changes moved through the organization, and the NTSB has been
talking about the importance of safety culture for the last 20
years. It is something we really need to emphasize as well as
solving some of these basic process problems.
Mr. DeFazio. And I agree with you on that 100 percent. At
my first meeting with Mr. Dickson when he was nominated, I
talked to him on what I view as the principalities within FAA
who seem resistant to Administrators and changes from that
level, and he assured me that he was going to be reaching down
in the organization and trying to change the culture.
So, Mr. Collins.
Mr. Collins. I agree with everything she said about
changing the safety culture, and what Administrator Dickson
talked about was all hands meetings and things. I think he
needs to get down in the working level more, talk to groups of
people. I was a union rep. The union reps usually feel a little
more free and a little more protected in discussing issues than
most employees but, you know, talk to them in the offices. The
Seattle office for sure.
We always hear the conversation about resources and sure,
you could use more aerospace engineers and maybe manage the
resources better, but the lesson that I would like to leave is
that when you have those resources and they identify safety
issues, that really concerns me. The ones that are missed, you
can do improvements and better oversight, but when managers are
made aware of safety issues and compliance issues, I wish there
would be a culture shift so that they would give more
credibility and more thought to compliance versus production
schedules and things.
Mr. DeFazio. OK. Thank you.
And finally, Mr. Pierson.
Mr. Pierson. Congressman, I think just to try to keep it
simple. First, an investigation. A detailed investigation of
the production facility I think is definitely in order, and a
very important thing is to maintain a presence in the factory.
I should have mentioned earlier that I was there for 3 years
and honestly, I had never saw, I never met an FAA employee in
my 3 years in----
Mr. DeFazio. Really?
Mr. Pierson. Yes, and I never actually remember any of my
employees saying they talked to an FAA employee. Now, they may
have been there, but they certainly weren't visible and
present. My son said, ``Shouldn't they be wearing a jacket or
something?'' Or maybe they should know that this is FAA people
so if we are not getting the problem resolved by our normal
chain, we need the regulators to do that.
And the last thing I would say is that you could have the
most amazing design by the most brilliant engineers and flown
by the most talented pilots, but if you have a tired mechanic
or electrician that is overworked or a technician that is
stressed because they haven't had a chance to take care of
their family because they have been working so many hours, it
could all be for naught.
So, don't lose sight of the fact that, again, we have to do
the whole thing. Some from the design all the way out to
ongoing production into the future.
Mr. DeFazio. Thanks, and yeah. Just on reflecting on your
comment about not seeing an FAA employee on the floor, I mean,
a number of years ago, I raised concerns when, as we moved more
to an agency which, and this was more in terms of maintenance
than production, but where they were spending much less time at
maintenance facilities and more time reviewing paperwork they
received from maintenance facilities, and I think it is vital
for them to actually have a presence and they may not
personally observe something while they are there, but it may
be some employee who would want to come up to them and say,
``Hey, I have got some concerns here. You are from the FAA. I
want you to hear this.''
Mr. Pierson. Absolutely.
Mr. DeFazio. Yeah. OK. Well, thank you all. Thanks for your
generous allowance of time. I appreciate your testimony, and we
are going to continue with this investigation. I want to,
again, give my condolences to the families, and thank you for
your constructive--and I have to do some stuff, so just hang on
for a second. My script.
OK. I assume this has got the right days here. We remain
open until such a time as our witnesses have provided answers
to any questions that may be submitted to them in writing.
So ordered.
I ask unanimous consent that the record remain open for 15
days for any additional comments, and information submitted by
Members or witnesses to be included in the record of today's
hearing.
Without objection, so ordered.
And again, I thank you, and I have nothing else to add, so
the committee stands adjourned.
[Whereupon, at 3:35 p.m., the committee was adjourned.]
Submissions for the Record
----------
Prepared Statement of Hon. Eddie Bernice Johnson, a Representative in
Congress from the State of Texas
I thank the Chairman and Ranking Member for having this hearing
today, as it allows us to examine issues related to the design,
development, and certification of the 737 MAX. I am eager to hear from
our panel of witnesses and receive testimony from Federal Aviation
Administration (FAA) officials; a member of the Technical Advisory
Board, which is an independent review panel established by the FAA to
issue recommendations related to the certification of the 737 MAX;
whistleblowers; and aviation safety experts.
My interests are specific as to how we as a legislative body can
adequately address the promotion of aviation safety; potential avenues
of reform in the agency certification processes; and simply, how we can
prevent these accidents in the future.
As to safety, the Boeing 737 MAX was marketed as a safe, modern
airplane; however, after two major failures and hundreds of people
losing their lives, we now know that the 737 MAX is not a safe plane
and consequently has been grounded. The safety systems and backup
systems on the Boeing 737 MAX failed to work properly and resulted in
356 deaths, including 8 Americans.
As to the agency certification process, we must ensure that the
planes that are certified to fly go through the most comprehensive
certification process modernly available, so that we may avoid these
tragic failures in flight. As I have noted before, we are experiencing
a serious crisis of trust in aviation safety. The importance of an
appropriate certification process for large aircraft in the United
States is now more pertinent than ever. If the safety certification
process merits reexamination and reform, we must advocate for
transparency. This will avert not only the reduction of the United
States' position of authority on aviation safety, but also the
endangerment of hundreds of lives in preventable accidents. It is clear
that the certification of this aircraft failed to detect technical
problems from which even experienced pilots could not recover.
My district in Texas is a major hub for aviation, and with the
significance of this industry and the jobs that the airline industry
provides, I am dedicated to addressing the imminent and long-term
concerns regarding the grounding and ensuing safety concerns of the 737
MAX aircraft. This is of significant concern to me, as both American
Airlines and Southwest Airlines are prominent entities at the Dallas
Fort Worth International Airport and the Dallas Love Field Airport and
had previously employed a significant number of this aircraft model.
Therefore, the operational implications of the grounding and safety
certification of the Boeing 737 MAX are literally a matter of life and
death. My heart truly goes out to the families who have lost loved ones
in these tragedies.
Again, I look forward to the testimony of the witnesses and the
answers to my questions. With this hearing, I join the efforts of my
colleagues in Congress to meaningfully and comprehensively address
these urgent concerns as we work to regain the trust of the American
people in the airline industry.
Prepared Statement of Hon. Frederica S. Wilson, a Representative in
Congress from the State of Florida
Thank you, Chairman DeFazio.
Thank you to our witnesses for being here.
I want to begin by extending my deepest condolences to the families
and communities that lost loved ones in the Lion Air and Ethiopian
Airlines crashes.
News reports and investigations have uncovered systematic failures
that must be addressed at every level and I am committed to
understanding each failure that led to the loss of 346 lives.
I am also committed to honoring the victims by using the full power
of this committee to ensure the flying public's safety.
Based on the testimony set before me, I am concerned that actions
and decisions were taken that ultimately abused legislation passed
through this committee.
The FAA has routinely lauded its safety record with zero fatalities
over the last decade.
These accidents must serve as a wake-up call to remind us that none
of us can rest on our laurels.
In light of the information that has surfaced in the last few
weeks, the decisions that we come to through this hearing must extend
beyond fixing the MCAS system or a few lines of code to address the
negligence that led us here.
We must address the Organization Designation Authorization program
and the cozy relationship between Boeing and the FAA.
Our citizens deserve that.
The families who lost loved ones deserve that, too.
With that I will begin my questions.
Lists A and B, Submitted by Hon. DeFazio
Lists A and B:
9/11/2015 EASA letter to FAA
3/21/1997 Issue Paper
2/11/2015 FAA Letter to Boeing
FAA-DeFazio--28834-28842 TAD Corrective Action Review
Board (CARB) Presentation Form
FAA-DeFazio--28843-28860 Safety Review Board information
FAA-DeFazio--32891-32938 Presentation: BCA Airplane
Programs, Organization Designation Authorization Technical Review Board
9/11/2015 easa letter to faa
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
3/21/1997 issue paper
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
2/11/2015 faa letter to boeing
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
faa-defazio--28834-28842 tad corrective action review board (carb)
presentation form
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
faa-defazio--28843-28860 safety review board information
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
faa-defazio--32891-32938 presentation: bca airplane programs,
organization designation authorization technical review board
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Appendix
----------
Questions from Hon. Peter A. DeFazio for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration
Question 1. According to a recent news report, in an email sent by
an official at Transport Canada to the FAA, the European Union Aviation
Safety Agency (EASA), and Brazil's civil aviation authority, the
official stated that ``[t]he only way I see moving forward at this
point'' with the 737 MAX was that MCAS ``has to go.'' \1\ Do you agree
with this view? Do you believe the 737 MAX can be certified by the FAA
if MCAS is removed altogether?
---------------------------------------------------------------------------
\1\ Allison Lampert & David Shepardson, ``Canadian official's email
says 737 MAX software must go reflects `working-level' view--
regulator,'' Reuters (Nov. 22, 2019), available at: https://
fr.reuters.com/article/industrialsSector/idUKL2N2821HI
---------------------------------------------------------------------------
Answer. The FAA's first priority is safety. The agency will not
approve the aircraft for return to service until it has completed
rigorous testing and we are satisfied that it is safe.
The FAA understands that Transport Canada Civil Aviation put out a
statement clarifying that the statement quoted in this question did not
necessarily represent the views of their agency.
The FAA has a transparent and collaborative relationship with other
civil aviation authorities as we all review and collaborate on the
changes to software on the Boeing 737 MAX. The FAA and its
international partners have engaged in robust discussions at various
stages in this process as part of the thorough scrutiny of Boeing's
work. We value and support constructive debate and candor in the
exchange of information and perspective between our technical experts.
The excerpted email is an example of those exchanges.
Stability augmentation systems are not new in aviation or aircraft
design. MCAS is one part of the flight control system design. As
specified by Boeing, MCAS is intended to help pilots in narrow regimes
of the flight envelope and to meet part 25 airworthiness requirements.
The changes that are being made to MCAS software will prevent the
system from making uncommanded pitch corrections based on errant inputs
and causing the same type of problem that occurred during the two
accident flights.
The FAA does not make design-level decisions for manufacturers. We
certify submitted designs based on their conformity to FARs and safety
evaluations. As stated above, the Agency will not approve the aircraft
for return to service until the design changes have been rigorously
tested and we are satisfied the aircraft is safe.
Question 2. An FAA Flight Standardization Board (FSB) develops
pilot training criteria and requirements for pilots for a particular
aircraft. At our May 15, 2019, Aviation Subcommittee hearing on the 737
MAX, then-Acting Administrator Elwell testified that the FAA had
recently solicited public comment on a draft report prepared by the FSB
for the Boeing 737 MAX. Deputy Administrator Elwell stated that ``[t]he
FAA will review this input before making a final assessment.'' Where is
the FAA in the FSB process? Can the FAA make an assessment at this time
regarding the pilot training that will be required after ungrounding
the 737 MAX?
Answer. The FAA will carry out the FSB function after the
completion of the Joint Operations Evaluation Board (JOEB). The JOEB is
a multi-authority body, the outcomes of which will be documented in the
FSB report. The FSB report was initially posted for public comment last
April. The JOEB work will commence once critical certification
milestones have been completed. Once the JOEB completes its evaluation
of Boeing's proposed training requirements, the JOEB conclusions will
be included in an updated FSB report. That report will be posted for
public comment.
Question 3. According to the Joint Authorities Technical Review
(JATR), the FAA ``extensively delegated compliance findings . . . to
[the] Boeing [Organization Designation Authority] ODA. Safety critical
areas, including system safety documents related to MCAS, were
initially retained by the FAA and then delegated to the Boeing ODA.''
\2\
---------------------------------------------------------------------------
\2\ Joint Authorities Technical Review, October 11, 2019, p. 26,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. In your opinion, did the FAA over-delegate review of certain
safety-critical functions, like MCAS, to Boeing?
Answer. A large, transport category aircraft such as the MAX
consists of many thousands of parts and systems, all of which must be
certified to meet FAA standards. The transport category aircraft
certification process comprises four functions: 1) certification basis,
2) planning and standards, 3) analysis and testing, and 4) final
decision and certification of design.
The certification work FAA typically delegates primarily relates to
a single portion of the process-the third function outlined above-
analysis and testing. About 94% of work in this area, for all aircraft,
is delegated, and much of that work involves lower risk and routine
items such as interior reconfigurations for seats, lavatories, galleys,
etc. FAA also delegates analysis and testing of aircraft systems and
airframe components when the applicant is using established and proven
compliance methods and the organization or designee is authorized and
has demonstrated the ability to perform the work to FAA's satisfaction.
The FAA determines the certification basis, identifies the
standards, and makes all key and final decisions. The FAA is directly
involved in the testing of new and novel features and technologies. The
FAA does not delegate the other portions of the certification process.
For the software update efforts of the 737 MAX, FAA has retained
all findings. No part of the review has been delegated to Boeing.
The FAA is reviewing how we structure our approach to delegation,
while complying with the requirements mandated by Congress in the FAA
Reauthorization Act of 2018. In addition, the FAA is in the process of
reevaluating our delegation decisions for other current certification
projects.
b. The JATR goes on to state that it is their belief that ``FAA
involvement in the certification of MCAS would likely have resulted in
design changes that would have improved safety.'' \3\ Do you agree with
that assessment?
---------------------------------------------------------------------------
\3\ Joint Authorities Technical Review, October 11, 2019, p. 27,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
Answer. MCAS is not a stand-alone system, it is an element of the
Speed Trim System. The Speed Trim System has been part of the flight
control system on all prior 737 models. Thus, there was no
certification of MCAS, but rather the flight control system.
The FAA is focused is on improving the certification system and
considering the findings of the JATR and other independent reviews. As
noted above, for software update efforts, the FAA has retained the
approvals process for the flight control systems and is not delegating
anything to Boeing. As part of the initial return to service effort,
the FAA will retain authority to issue airworthiness certificates and
export certificates of airworthiness for the grounded fleet and 737 MAX
airplanes manufactured since the grounding. When the 737 MAX is
returned to service, it will be because the safety issues have been
addressed and pilots have received all of the training they need to
safely operate the aircraft.
c. What steps is the FAA currently taking, if any, to review and
make changes administratively to the current ODA program?
Answer. The Organization Designation Authorization (ODA) has long
been a key part of the FAA's use of delegation. As the role ODA has
played in FAA's safety programs has increased and the technical and
compliance assurance capabilities of ODA holders have matured, it has
become clear that FAA's approach to oversight must also evolve. ODA
holders provide an effective compliment to FAA oversight and
certification responsibilities during the certification process for a
new or amended type certificate. Using ODAs during the certification
process allows the FAA to focus on critical or new and novel
technologies during the certification process.
In the FAA Reauthorization Act of 2018, Congress mandated that FAA
establish an ODA Office within AVS. The intent of this mandate is to
achieve standardization and consistency of oversight functions of the
ODA program across AVS and facilitate risk based, system-level
oversight for:
Standardized application of policy;
Proficiency of ODA Office and field staff in executing
oversight processes;
Monitoring of risk and performance issues; and
Continuous improvement of AVS ODA program performance.
To this end, in March 2019, then Acting Administrator Dan Elwell
approved the establishment of the AVS ODA Office in the Aircraft
Certification Service's (AIR) System Oversight Division (AIR-800). We
continue to operationalize the office with temporary staff. The
Department of Transportation requested $7 million in the President's
FY21 budget in order to permanently and effectively staff and resource
this office.
Additionally, the FAA recently completed the charter for the ODA
expert panel as required in the FAA Reauthorization Act of 2018. We
have also completed the initial steps for the Panel to conduct an ODA
Survey under the requirements of the Paperwork Reduction Act. Once the
Panel has drafted the survey and conducted their review, the report
will be developed and submitted to Congress as well as numerous FAA
offices and advisory committees for consideration.
One area of focus is to improve the information flow and
coordination between the operational and certification functions during
the certification process. Thus, we are placing greater emphasis on
operational involvement within the certification process and, more
importantly, how design and operational assumptions are documented and
communicated as part of type design. This is occurring for all
certification projects currently under review by the agency.
The Aircraft Certification Service (AIR) and Flight Standards (AFX)
are working cohesively and collaboratively to address structural
organizational changes. Examples include appointing a single program
manager for all certification projects; this program manager will have
program oversight over both AIR and AFX. Our agency will also focus on
strategic and tactical program management efforts, to include fostering
better communication between all stakeholders. These efforts are among
the most important process improvements we are implementing to our
certification processes. They are of significant focus and are ongoing.
The FAA has much work to do to evaluate the many recommendations we
have received to date from the various investigations, including
recommendations related to the ODA program. Additional recommendations
are expected from reviews still underway. The FAA is committed to
reviewing all recommendations and improving its ODA program.
Question 4. On November 7, 2018, just days after the Lion Air
crash, the FAA issued an Emergency Airworthiness Directive (AD) to
provide critical information to pilots. This followed Boeing's issuance
of a Flight Crew Operations Manual Bulletin the day before--which
provided similar, critical information to pilots. Neither of these
documents mentioned ``MCAS'' by name and apparently this omission was
deliberate. According to the New York Times, at the last minute, an FAA
manager told agency engineers to remove the only mention of MCAS in
FAA's Emergency AD.\4\
---------------------------------------------------------------------------
\4\ Natalie Kitroeff, David Gelles and Jack Nicas, ``The Roots of
Boeing's 737 Max Crisis: A Regulator Relaxes Its Oversight,'' NEW YORK
TIMES (July 27, 2019), accessed at: https://www.nytimes.com/2019/07/27/
business/boeing-737-max-faa.html?searchResultPosition=2
---------------------------------------------------------------------------
a. Is this news reporting accurate?
b. If so, please explain why the FAA removed reference to MCAS from
this Emergency AD?
c. If not, please explain why the FAA chose not to mention MCAS in
the Emergency AD in the first place?
Boeing has told our Committee that it worked very closely with the
FAA on the contents of both the Bulletin and FAA's Emergency AD.
d. Did Boeing ever ask, or in any way recommend or request, that
the FAA NOT mention MCAS in the Emergency AD?
Answer (a.-d.). Airworthiness Directives (AD) are used to address
unsafe conditions in aircraft and mandate fleet-wide corrective
actions. An AD must address any unsafe conditions and avoid introducing
new safety hazards. In this case, the FAA decided that an AD was
necessary to address a runaway stabilizer event. Although in the time
since, it has become clear that MCAS functionality was involved in two
accidents, at the time of the Emergency AD decision, we were still in
the early stages of an accident investigation. Furthermore, the FAA's
opinion at the time was that introducing a new system name that did not
exist in the aircraft documentation available to pilots had the
potential to cause confusion in an emergency situation. MCAS is not a
stand-alone system, but rather a name given to a section of code in the
flight control computer, which is, in turn, part of the flight control
system. The FAA therefore decided to remove the MCAS reference from the
draft AD so that flight crews would focus on runaway stabilizer
recognition instead of attempting to troubleshoot MCAS. In an emergency
situation, it was more important for a crew to recognize and respond to
a runaway stabilizer event than it was to troubleshoot MCAS.
We know from a Boeing ``Coordination Sheet'' released at our MAX
hearing in October 2019 that Boeing had long known that if a pilot
failed to respond to unintended MCAS activation within 10 seconds, the
result could be catastrophic. Boeing apparently knew this at least by
March 2016, and re-affirmed it in June 2018, more than one year after
the 737 MAX had been certified by the FAA and just four months before
the Lion Air accident.
e. When the FAA issued its Emergency AD, was the FAA aware that
Boeing had determined that a failure to respond to unanticipated MCAS
activation within 10 seconds could be catastrophic? If not, when did
the FAA first become aware that if a pilot responded in 10 seconds or
more to unanticipated MCAS activation it could be catastrophic?
Answer. At the time of original 737MAX certification, the FAA knew
an MCAS failure could present itself as a runaway trim stab event,
which is a well-known procedure in which pilots are trained. The FAA's
analysis of the accidents and recommendations of several independent
panels indicate that assumptions concerning MCAS used during
certification need to be re-evaluated and adjusted to better reflect
present-day cockpit conditions and pilot response expectations.
f. Do you believe it would have been helpful for 737 MAX pilots to
know that if they failed to respond to unanticipated MCAS activation
within 10 seconds the result could be catastrophic? If not, please
explain why you believe that to be the case.
Answer. Pilots operating aircraft must be fully prepared and
appropriately trained for known failure scenarios that may be
encountered in service as documented in engineering hazard analysis and
required by regulation.
g. In hindsight, do you believe Boeing provided adequate
information to the FAA regarding MCAS when the FAA was preparing the
Emergency AD?
Answer. After the Lion Air accident, the FAA knew there was a
faulty AOA sensor which sent incorrect information to the aircraft
flight control computer which then erroneously attempted to correct a
nonexistent high angle of attack situation by trimming the aircraft
nose down via the MCAS system. From the cockpit, the situation
presented as a runaway stabilizer. The emergency AD was drafted to
alert flight crews how to react when the aircraft attempted to trim
nose down.
At the time of the emergency AD, the FAA was aware of MCAS. Boeing
provided answers to questions related to the Lion Air accident and MCAS
in general. We believed we had all the necessary information to issue
an Emergency AD meant to immediately bring attention to a potentially
unsafe condition and provide for interim corrective actions while the
agency continued to investigate the accident.
The FAA requires manufacturers to provide any and all pertinent
information to our safety specialists whenever a serious aircraft
safety event or accident occurs.
Question 5. In the Flight Crew Operations Manual Bulletin that
Boeing issued following the Lion Air crash, Boeing describes how
erroneous angle of attack (AOA) can potentially cause many indications
and effects in the cockpit, including: continuous or intermittent stick
shaker; increasing nose down control forces; and as many as four
different alerts or lights (IAS DISAGREE, ALT DISAGREE, AOA DISAGREE,
and FEEL DIFF PRESS light).
a. It is my understanding that every newly type certificated
aircraft since 1982 includes an ``engine-indicating and crew-alerting
system'' (EICAS)--a system that can show pilots a list of messages,
rather than lights indicating failure of a system, in order to help
pilots prioritize responding to multiple simultaneous indications that
may lead to pilot confusion. Why was this system not included in the
737 MAX during its original certification?
Answer. EICAS is not required to meet FAA regulations. 14 CFR Sec.
25.1322, Flightcrew Alerting, describes what alerts must be included on
a transport category airplane. It is a performance-based rule, meaning
that the airplane must meet the required performance as stated in the
rule and no specific means of meeting the requirements are stated. The
decision to use EICAS as a way to show compliance with the requirements
of Sec. 25.1322 is a design choice made by the manufacturer.
b. Is the FAA evaluating whether an EICAS or similar system should
be included in a re-certified 737 MAX before it is ungrounded?
Answer. The FAA is taking the external review recommendations into
consideration in our evaluation of the changes to the 737 MAX. We will
be conducting further reviews in this area for potential changes to our
processes going forward.
Question 6. Please provide a detailed account of all communication
between Boeing and FAA's Associate Administrator for Aviation Safety
between the Lion Air crash on October 29, 2018, and the Ethiopian
Airlines crash on March 10, 2019, including:
a. the date, time, and mode (telephone, email, letter, in person
meeting, etc.) of each communication;
b. the job title of the individual(s) at Boeing with whom the
Associate Administrator communicated;
c. the subject of each communication;
d. copies of all communications to the extent they were in writing;
and
e. a summary of all communications that were not in writing.
Answer (a.-e.). The Associate Administrator for Aviation Safety
communicates regularly with Boeing representatives on a variety of
aviation safety topics via different modes of communication, including
during the time period referenced.
The Associate Administrator for Aviation Safety provided more
detailed information about his communications with Boeing during his
transcribed interview with Committee staff on December 5, 2019.
Question 7. Did FAA's Associate Administrator for Aviation Safety
have any discussions with Boeing about the potential grounding of the
737 MAX prior to the Ethiopian Airlines crash? If so, please:
a. provide the date, time, and mode (telephone, email, letter, in
person meeting, etc.) of each such discussion;
b. identify the job title of the individual(s) at FAA who conducted
such discussions with Boeing;
c. provide copies of any such discussions to the extent they were
in writing;
d. provide a summary of all such discussions to the extent they
that were not in writing;
e. indicate, for each discussion, whether the economic and/or
financial impact that grounding the 737 MAX would have had on Boeing
was discussed.
Answer (a.-e.). The Associate Administrator previously provided
information about his communications with Boeing during a transcribed
interview your staff conducted on December 5, 2019.
Question 8. In December 2018, after the Lion Air crash, the FAA
produced a Quantitative Risk Assessment Random Transport Airplane Risk
Analysis (R-TARA), based on the Transport Airplane Risk Assessment
Methodology (TARAM), that calculated the estimated risk of another
catastrophic 737 MAX accident during the lifetime of the fleet without
a technical fix to the MCAS software. Please provide a list of all
staff within the FAA's Aviation Safety (AVS) branch and the Office of
the Administrator (AOA) who received, prior to the Ethiopian Air crash
on March 10, 2019, a copy of this R-TARA analysis, or any memoranda,
summaries, e-mails, or presentations about this analysis, and the date
upon which each individual received it.
Answer. The FAA senior staff who prepared the TARAM were
interviewed by Committee Staff. They answered staff questions related
to the TARAM.
A TARAM is a scientific risk-assessment tool. It weighs a number of
factors and is used to help the FAA quantify risk. It is not the FAA's
sole decision-making tool; rather, its purpose is to assist the
Corrective Action Review Board (CARB)--comprised of experts in their
field--in making decisions about how to reduce or eliminate risk. The
FAA would never accept a risk of additional accidents without taking
immediate action, and in fact, the agency acted immediately--with
interim and permanent steps--to respond to the Lion Air accident. The
FAA issued an emergency AD reminding pilots how to deal with runaway
speed trim eight days after the Lion Air accident and before the TARAM
analysis was complete. When the AD was issued, the FAA determined the
permanent action was to require a design change to address MCAS. That
effort also was underway before the TARAM was prepared in December
2018.
The TARAM analysis of the 737 MAX MCAS safety issue was presented
to the Seattle ACO Corrective Action Review Board (CARB) on November
28, 2018, December 12, 2018, and February 6, 2019. After reviewing the
available information, the Seattle ACO recommended an Emergency
Airworthiness Directive, AD 2018-23-51. The Seattle ACO then followed
FAA's standard coordination process prior to formalizing the decision.
Question 9. Following up on Mr. Earl Lawrence's response to Rep.
Sean Patrick Maloney, please provide a list of all workers at Boeing's
Renton, Washington, facility by title, who have been interviewed by the
FAA regarding production, quality, safety, or related matters
concerning the 737 MAX since the Lion Air crash on October 29, 2018, as
well as the dates of such interviews.
Answer. Since the Lion Air accident on October 29, 2018, the FAA
has increased its oversight activities and conducted more than 115
investigations at the Boeing production facility in Renton, Washington.
A majority of these investigations were conducted as part of the FAA's
certificate management activities that focused on Boeing products and
processes. While conducting these certificate management-related
investigations, the FAA questioned numerous Boeing employees, but as
these interactions are not considered formal interviews, the titles of
those questioned are not recorded.
In addition to the certificate management-related investigations,
the FAA conducted nine Aviation Safety Hotline/Whistleblower
investigations related to the Model 737 MAX following the Lion Air
accident. In support of those nine Aviation Safety Hotline/
Whistleblower investigations, the FAA interviewed the following Boeing
employees, by title:
------------------------------------------------------------------------
Date of Interview (A) =
Boeing Employee Title Approximately
------------------------------------------------------------------------
Assembly Inspector......................... 4/10/2019
------------------------------------------------------------------------
Engineer................................... 4/10/2019
------------------------------------------------------------------------
Assembly Inspector......................... 4/15/2019 (A)
------------------------------------------------------------------------
Quality Manager............................ 4/15/2019 (A)
------------------------------------------------------------------------
Test Area Manager.......................... 4/15/2019 (A)
------------------------------------------------------------------------
Quality Manager............................ 4/15/2019 (A)
------------------------------------------------------------------------
Aviation Technician........................ 4/18/2019 (A)
------------------------------------------------------------------------
Aviation Maintenance Technician Inspector 4/18/2019 (A)
Lead.
------------------------------------------------------------------------
Preflight Manager.......................... 4/18/2019 (A)
------------------------------------------------------------------------
Materials Processor........................ 5/3/2019
------------------------------------------------------------------------
Lead Technician............................ 5/13/2019
------------------------------------------------------------------------
Software Test Engineer (Contractor)........ 5/15/2019
------------------------------------------------------------------------
Kitting Team Lead.......................... 5/16/2019
------------------------------------------------------------------------
Local Receiving Area Manager............... 5/16/2019
------------------------------------------------------------------------
Local Receiving Area Team Lead............. 5/16/2019
------------------------------------------------------------------------
Warehouse Team Lead........................ 5/16/2019
------------------------------------------------------------------------
Operations Delivery Manager................ 5/23/2019
------------------------------------------------------------------------
Preflight Quality Manager.................. 5/23/2019
------------------------------------------------------------------------
Preflight Quality Manager.................. 5/23/2019
------------------------------------------------------------------------
Quality Manager............................ 5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Liaison Engineer... 5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Liaison Engineer... 5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Quality Manager.... 5/23/2019
------------------------------------------------------------------------
Mechanic................................... 5/29/2019 (A)
------------------------------------------------------------------------
Mechanic................................... 5/29/2019 (A)
------------------------------------------------------------------------
Mechanic................................... 5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector.......................... 5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector.......................... 5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector.......................... 5/29/2019 (A)
------------------------------------------------------------------------
Flight Management System Software Engineer. 6/5/2019 (A)
------------------------------------------------------------------------
Structural Engineer........................ 9/3/2019
------------------------------------------------------------------------
Propulsion Structures Engineer............. 9/19/2019
------------------------------------------------------------------------
In addition to the Boeing employees listed above, during the course
of these Aviation Safety Hotline/Whistleblower investigations, the FAA
interviewed two additional complainants that had worked at Boeing, but
the FAA was not provided with their titles. One complainant was
interviewed on April 10, 2019, and the other on April 16, 2019.
During the December 11, 2019, Congressional hearing the FAA
Administrator committed to conduct additional interviews with Boeing
employees in the Renton, Washington, production facility related to
matters concerning manufacturing of the Boeing Model 737 MAX airplane.
The FAA conducted interviews of the following Boeing employees on
January 28 and 29, 2020:
3 manufacturing technicians
2 manufacturing engineers
3 quality technicians
2 Boeing ODA unit members
1 ODA manager
2 manufacturing managers
Lastly, it should be noted that the FAA has an office co-located at
the Renton, Washington facility and aviation safety inspectors are on
the production floor daily conducting safety oversight.
Amended Type Certificates
Question 10. The 737 MAX is a vastly different airplane than the
original 737, yet the MAX did not require a new type certificate. The
737 fuselage is based on the 707-fuselage introduced in 1958. And the
original 737 itself was type-certified in 1967. The trim wheel in the
737 MAX--an important part of the story of these crashes--also dates to
the 1967 version. The MAX is also significantly different from the
737NG. It has new fly by wire spoilers, new winglets, new engines and
revisions to the Flight Deck. Boeing has designed 14 variations of the
737 aircraft since the original was certified in 1967.
I have serious concerns that the amended type certificate is a
strategic tactic to shortcut the FAA certification process--allowing
the manufacturer to shave-off time during the review of its new
aircraft by relying on data, tests, or assumptions used for the
previous model made years (or even decades) earlier. In the case of the
737 MAX it was based on the design of an aircraft certified by the FAA
half-a-century earlier.
At what point should all substantial design and technological
changes make the FAA regard an aircraft as a new plane, requiring a new
type certificate?
Answer. Amended type certificates are not intended to shortcut the
certification process. Rather, they allow manufacturers to build on
successful and safe prior designs while incorporating new or novel
design changes. Amended type certificates allow the FAA to focus our
certification resources on the proposed changes between models. The
certification of the MAX took five years which is typical for new and
amended type certificates.
Additionally, whether a manufacturer applies for an amended TC or a
new TC, the project receives a current certification basis. A
certification basis is the formal determination of the standards in FAA
regulations that will apply to the project.
The determination to classify the Model 737-8 airplane as an
amended type certificate is consistent with current guidance, as well
as determinations made on previous certification programs.
Boeing applied for an amended TC for the Model 737-8 airplane in
January 2012. The FAA established the certification basis for the Model
737-8 airplane in February 2014. The FAA classified the Model 737-8
airplane as an amended TC based on a review of the airplane design
changes in accordance with 14 CFR Sec. 21.19. Accordingly, the FAA
concluded that the design changes for the Model 737-8 airplane did not
require a new TC.
Question 11. Boeing applied for amended type certificates for the
777X, which will include two variants: the 777-9 (a derivative model of
the 777-300ER) and 777-8 (a derivative model of the 777-9). Most
notably, these planes will be constructed with new carbon-fiber-
reinforced plastic wings with folding wingtips.
The FAA determined that the folding wingtips are ``novel or unusual
design features'' and the agency issued ``special conditions''
containing ``additional safety standards'' for Boeing to meet to prove
these wingtips are safe to operate.\5\ Boeing determined that a
catastrophic event could occur if the wingtips are not properly
positioned and secured for takeoff or during flight.
---------------------------------------------------------------------------
\5\ FAA, Final Special Conditions, 83 Fed. Reg. 23209 (May 18,
2018).
---------------------------------------------------------------------------
However, in addition to these new wingtips--not contemplated before
on commercial aircraft--the 777X will have a stretched fuselage, new
engines, modified landing gear, and a new fuel system compared to its
predecessor 777 model. And yet, the FAA has permitted Boeing to proceed
with an amended type certificate, rather than requiring Boeing receive
a completely new type certificate, which would involve a more
extensive, top-to-bottom review of the design.
a. What is the FAA's estimate of the overall portion of commonality
between the 777-9 and the 777-300ER?
Answer. We do not evaluate an applicant's proposal in terms of
degree or percentage of commonality. Rather, we initially focus on the
changes to the aircraft proposed by the applicant, and we work to
ensure those areas meet the current requirements as described in
response to question 10. We are still evaluating the system in its
entirety to ensure that the aircraft meet FAA requirements and is safe
to operate in accordance with our regulations.
b. How can tests or data from the prior model be used to certify
the 777X given that the new wings, engines, materials, and other
features may affect the handling and performance of the aircraft?
Answer. Prior to installation, there is a series of engineering
evaluations and research and development testing that new components
undergo, to include a wide range of inspection and testing prior to
installation.
According to FAA Order 8110.4, Type Certification, certification
tests are used by the FAA to verify the flight test data reported by
the applicant or to obtain compliance data for flight testing conducted
concurrently with the applicant. Certification tests may include
flight, ground, functional, and reliability testing, along with
engineering testing.
The FAA uses the certification tests to evaluate the aircraft's
performance, flight characteristics, operational qualities, and
equipment operation. The tests also determine operational limitations,
procedures, and pilot information.
FAA Order 8110.4, Type Certification, provides an allowance for use
of prior aircraft data in new designs, provided that strict conditions
are met by the applicant. Use of prior data is helpful to understand
what aspects of the new design need further review, regardless of any
credit given for prior data in a new design. In the case of the 777x
and the substantial changes to the wing design, we anticipate that
Boeing will be developing extensive new data and will be required to
conduct a robust amount of flight testing.
Presumably there will be new checklists for pilots to ensure the
wingtips are properly configured before takeoff, and potentially
caution lights, warning lights, or other functions associated with
wingtip configuration or misconfigurations, requiring pilots to take
specific actions in response. As you know, the FAA only required Level
B (non-simulator) pilot training for the 737 MAX, despite a completely
new software system (MCAS) on the plane.
c. Does the FAA expect there to be simulator training required for
pilots transitioning from the 777-300ER to the 777X?
Answer. The FAA is currently engaged with Boeing to determine the
level of training required for pilots transitioning from the B777 300ER
to the 777X. The final determination of minimum training is ongoing, in
accordance with the FSB process in AC 120-53, which will conclude with
FAA's final determination of the minimum level of training after a
draft FSB report is published for public comment.
Joint Authorities Technical Review
Question 12. The JATR found that FAA's Boeing Aviation Safety
Oversight Office (BASOO) is severely outnumbered by Boeing's ODA
office--45 to 1,500 people respectively,\6\ and many BASOO employees
are junior engineers.
---------------------------------------------------------------------------
\6\ Joint Authorities Technical Review, October 11, 2019, p. 27,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Do you believe that the FAA can adequately oversee the Boeing
ODA with this employee ratio?
Answer. The approximately 45 BASOO employees oversee the Boeing
ODA, not the 1500 individual Boeing employees. The FAA oversees the
Boeing system as outlined in Boeing's FAA-approved procedures manual.
Boeing, as the ODA holder, oversees, trains, and manages its 1500 ODA
unit members. The purpose of organizational delegation is to transfer
the burden on individual oversight from the FAA to the ODA holder. This
is why the criteria for ODA appointment are stringent.
Additionally, in order to sustain the workforce needed by the FAA,
we are recruiting engineers and training them for specialized functions
within the agency. The workforce in the BASOO has completed training
specific to their positions and is led by multiple senior engineers
that oversee and advise the entire workforce. All FAA engineers and
inspectors also have access to FAA resources like our Chief Scientific
and Technical Advisors who are renowned in their respective fields of
specialization.
b. In the wake of the 737 MAX crashes is the FAA taking any action
to review the technical skills, expertise, and capacity of the BASOO to
adequately perform certification and oversight duties of Boeing? If so,
please explain what actions the FAA has already taken, is currently
taking, or plans to take.
Answer. We are reviewing the structure of the BASOO to ensure
appropriate oversight of the Boeing ODA and to identify opportunities
to strengthen cross organizational coordination on our oversight
efforts. We have also increased involvement in key areas such as system
safety, AEG evaluation of installed systems and equipment evaluations
and software development processes.
Question 13. As you know, the FAA oversight of the certification
process for the B737 MAX was performed by the FAA's BASOO. Based on the
JATR team's observations and findings, JATR recommended that the FAA
conduct a workforce review of the BASOO engineer staffing level to
ensure there is a sufficient number of experienced specialists to
adequately perform certification and oversight duties, commensurate
with the extent of work being performed by Boeing.\7\
---------------------------------------------------------------------------
\7\ Joint Authorities Technical Review, October 11, 2019, p. VIII,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Has the FAA conducted this review? If yes, please provide a copy
of this review to the Committee.
b. If not, does the FAA plan to accept this recommendation and
conduct a review?
Answer. The aerospace industry is a competitive workspace as
employers like the FAA and Boeing compete for talented employees with
the requisite training, skills and experience. The FAA is conducting a
workforce review of the engineering staffing levels at the BASOO. The
FAA regularly conducts recurrent reviews of positions throughout all of
the offices, to include the BASOO. Staffing and hiring plan reviews are
held on a recurring schedule and include review of a number of
positions for each office to ensure adequate workload and staff
distribution, analysis of specific job analysis tools which outline
specific job duties, and validation of appropriate pay levels for the
specific positions. This effort will allow the FAA to recruit and
retain the most qualified personnel with the right skillsets to
evaluate complex automation technologies. The focus of our hiring in
the future will include various dynamic and safety-critical positions
(e.g. system safety engineers and human factors systems engineers).
Skillsets like these are becoming more important, as the integration of
aircraft systems and the interaction of aircraft with the National
Airspace System (NAS) continues to increase. Personnel with these
skillsets will further enable our ability to be a data driven
organization.
Question 14. The JATR found that while issues in human-machine
interaction are at the core of all recent aviation accidents and are
implicated in the two B737 MAX accidents, the FAA has very few human
factors and human system integration experts on its certification
staff. As a result, the JATR recommended the FAA expand its aircraft
certification resources in human factors and human system
integration.\8\
---------------------------------------------------------------------------
\8\ Joint Authorities Technical Review, October 11, 2019, p. IX,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Does the FAA plan to adopt this recommendation?
i. If yes, has the FAA determined how many new human factors
experts it requires? Please detail the number and types of human
factors experts the FAA plans to hire and when.
ii. If no, please explain why not.
Answer. The FAA is planning to expand its aircraft certification
resources in human factors and human system integration. We are still
in the process of determining the number and types of experts that the
FAA plans to hire, as well as a timeline to hire new personnel.
The President's FY21 Budget request $7.5 million to help boost the
FAA's human factors research on flight deck, maintenance, and system
integration and requests $5 million towards recruiting individuals with
specialized skillsets.
Question 15. The JATR report states that MCAS ``used the stabilizer
trim to change the column force feel, not trim the aircraft . . . and
that this is a case of using the control surface in a new way that the
regulations never accounted for.'' \9\
---------------------------------------------------------------------------
\9\ Joint Authorities Technical Review, October 11, 2019, p. 14,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
Boeing maintains that it complied with all FAA regulations, and the
aircraft, including MCAS, was compliant with the FAA's regulations and
the company followed the appropriate FAA certification process. This
signals to me that the certification process is broken or at least
severely flawed if a manufacturer can develop an unsafe airplane that
still meets all of the FAA's regulatory criteria. Do you agree that the
FAA certification process is flawed?
Answer. The FAA certification process is well established and has
contributed to consistently improving the safety record of transport
category aircraft over the past 50 years. The FAA acknowledges that our
processes, policies, guidance, and regulations do need to be updated
periodically, and we are committed to continually improving the
aircraft certification process along with our other processes. We are
reviewing the recommendations presented by the JATR and other
independent reviews in an effort to increase safety.
Question 16. The JATR found that Boeing submitted to the FAA's
Aircraft Evaluation Group (AEG) a list of features of the B-737-8 MAX
cockpit which were changed from the base model B737-800. After the FAA
initially raised concerns that the cumulative effects of system changes
from the B-737 NG to the B737 MAX could require additional pilot
training, Boeing responded by pointing out that current FAA rules
(Advisory Circular 120-53B) did not require the cumulative effects on
system changes to be considered, a response the FAA later accepted.\10\
---------------------------------------------------------------------------
\10\ Joint Authorities Technical Review, October 11, 2019, p. 43,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Please explain why the FAA ignored these initial concerns and
ultimately acquiesced to Boeing?
Answer. The FAA did not ignore any initial concerns. The FAA
carefully reviewed all design changes submitted by Boeing. The FAA
followed established advisory guidance, as described in AC 120-53,
during the FSB process. The FAA AEG continued to analyze all
information supplied by the applicant (Boeing) throughout the FSB
process as required by AC 120-53 until the final JOEB evaluation--which
validated that the proposed training was adequate.
b. Does the FAA plan to revise Advisory Circular 120-53B and FAA
Order 8900.1, per JATR's recommendations, to include an assessment of
the cumulative effects of changed products, such as differences in
aircraft systems, displays, flight characteristics, and procedures?
Answer. The FAA intends to comprehensively review and revise AC
120-53B and associated FAA Order 8900.1 guidance to improve the process
for conducting and using FSB evaluations. To build upon the JATR
findings, the FAA tasked the Air Carrier Training Aviation Rulemaking
Committee (ACT ARC) to recommend changes to the process outlined in AC
120-53B to ensure that the current guidance is clear and to recommend
changes where needed. The ACT ARC's work is in progress.
Question 17. The JATR report identified that the design process for
the B737 MAX's flight control system ``was not sufficient to identify
all the potential MCAS hazards.'' \11\
---------------------------------------------------------------------------
\11\ Joint Authorities Technical Review, October 11, 2019, p. 30,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. How did the FAA's current certification process--widely touted
as the safest and most trusted in the world--fail to identify the full
range of potential MCAS hazards for the B737 MAX?
b. What steps is the FAA taking to ensure that the design process
for future flight control systems adequately identifies all potential
hazards?
Answer (a.-b.). We are evaluating the assumptions Boeing used in
the original integrated Systems Safety Assessment (iSSA). The purpose
of the safety assessment process is to identify potential safety issues
early in the aircraft design through hazard classification and
probability of occurrence. The underlying assumptions used during the
system safety assessment process were well established. However, the
recommendations from the JATR report and other independent reviews
suggest that the full range of pilot reactions across all global
operators should be re-assessed. As a result, we intend to assess our
policy with other authorities for both evaluating and validating the
underlying assumptions used in the safety assessment process.
Question 18. The JATR found that the fragmented submission of
certification documents by Boeing could lead to FAA's BASOO, which is
responsible for overseeing the Boeing ODA process and certification of
Boeing products, having trouble successfully transferring critical
information regarding MCAS to the Seattle Aircraft Certification Office
(SACO), which is responsible for overseeing continued operational
safety management of Boeing products once they are certificated.\12\
---------------------------------------------------------------------------
\12\ Joint Authorities Technical Review, October 11, 2019, pp. 50-
51, available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
The JATR also noted that test pilots working in the certification
process may not always have complete knowledge of operational issues,
while pilots working in the operational evaluation process may not have
complete knowledge of certification issues. This gap may contribute to
limited communication between the two processes, creating the potential
for a lack of operational insight into the certification process.\13\
---------------------------------------------------------------------------
\13\ Joint Authorities Technical Review, October 11, 2019, p. XI,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
What steps, if any, is the FAA taking to evaluate and improve
internal FAA communications problems regarding the FAA's certification
processes that have been observed and documented by independent
reviews?
Answer. We are placing greater emphasis on operational involvement
within the certification process and, more importantly, how design and
operational assumptions are documented and communicated as part of type
design. This is occurring for all certification projects currently
under review by the agency.
The Aircraft Certification Service (AIR) and Flight Standards (AFX)
are working cohesively and collaboratively to address structural
organizational changes. Examples include appointing a single program
manager for all certification projects; this program manager will have
program oversight over both AIR and AFX. Our agency will also focus on
strategic and tactical program management efforts, to include fostering
better communication between all stakeholders. These efforts are among
the most important process improvements we are implementing to our
certification processes. They are of significant focus and are ongoing.
Question 19. The JATR recommended that the FAA's Changed Product
Rules (e.g., 14 CFR Sec. Sec. 21.19 & 21.101) and associated guidance
(e.g., Advisory Circular 21.101-1B and FAA Orders 8110.4C) should be
revised to require a top-down approach whereby every change to an
aircraft is evaluated from an integrated whole aircraft system
perspective.\14\
---------------------------------------------------------------------------
\14\ Joint Authorities Technical Review, October 11, 2019, p. IV,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Does the FAA believe that its certification of the B737 MAX
lacked this integrated whole aircraft system evaluation?
b. Does the FAA plan to adopt these recommendations or take other
steps to require a more holistic approach to evaluating changes to
aircraft?
Answer (a.-b.). Multiple investigations and reviews of the Boeing
737 MAX, have been conducted, some of which are still underway. We will
consider all reports and recommendations--including those that come
from the open investigations and reviews--in formulating possible
updates to our regulations, policy, and guidance. The FAA is always
looking for ways to improve our processes. The Changed Product Rule is
a top-down approach that we have harmonized with EASA, Transport Canada
and ANAC (the Brazilian authority). Changes and suggested improvements
to this process, along with updated policy and guidance, will need to
be worked with our international partners to ensure common
understanding and common application.
Question 20. According to the JATR, the B737-8 MAX accident
scenarios were not properly identified during the testing and
certification process.\15\
---------------------------------------------------------------------------
\15\ Joint Authorities Technical Review, October 11, 2019, p. 41,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Why weren't these scenarios properly identified?
b. Does the FAA plan to change the certification process to ensure
the agency is identifying the full range of accident scenarios? If so,
what kind of changes does the agency intend to make?
Answer (a.-b.). The FAA certification process is well established
and has contributed to consistently improving the safety record of
transport category aircraft over the last 50 years and longer. Still,
we acknowledge the need to continually improve our certification
process along with our other processes.
Uncommanded stabilizer movement was identified as a potential
failure scenario during the testing and certification. Possible crew
response times to failures and emergency situations were based on
industry-wide assumptions, but failed to take into account the full
range of pilot experience across the global operating fleet. The FAA is
in the process of reevaluating assumptions related to crew response for
current certification projects and is reviewing our guidance for
changes that will consider the level of aircrew training and
proficiency globally.
Question 21. The JATR recommended the FAA should review training
programs to ensure flight crews are competent in the handling of mis-
trim events.\16\
---------------------------------------------------------------------------
\16\ Joint Authorities Technical Review, October 11, 2019, p. XII,
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
a. Does the FAA plan to conduct this review? If so, does the FAA
have a timetable on conducting this review?
Answer. The FAA plans to evaluate pilot performance during runaway
stabilizer events, and pilot competency using manual trim during normal
and abnormal conditions. For the 737 MAX, this evaluation will occur
during the Joint Operational Evaluation Board (JOEB) evaluation this
year. The FAA will analyze the results of the evaluation and training
recommendations will be documented in the 737 FSB report that will be
published for public comment before being finalized. The FAA will then
approve U.S. carrier training programs to ensure the minimum level of
training is met prior to any return to service.
b. How does the FAA plan to ensure all 737 MAX flight crews are
fully competent in handling potential mis-trim events?
Answer. The FAA is currently evaluating a proposal submitted by
Boeing. Once the FAA validates that this training is appropriate, the
training requirements will be documented in the 737 MAX FSB report
recommendations that are published for public comment prior to being
finalized. Any U.S. operator's training programs will then be reviewed
and approved by the FAA. The FAA will oversee the training programs to
ensure they are delivered in a manner that is acceptable.
National Transportation Safety Board
Question 22. The National Transportation Safety Board (NTSB) has
issued several recommendations to the FAA responding to the crash of
Lion Air flight 610.\17\ Implementation of these recommendations will
save lives.
---------------------------------------------------------------------------
\17\ National Transportation Safety Board Safety Recommendation
Report, ``Assumptions Used in the Safety Assessment Process and the
Effects of Multiple Alerts and Indications on Pilot Performance,''
(Sept. 19, 2019), pp. 12-13, accessed at: https://www.ntsb.gov/
investigations/AccidentReports/Reports/ASR1901.pdf
---------------------------------------------------------------------------
a. The NTSB recommended that the FAA require Boeing to ensure its
assumptions regarding pilot responses to uncommanded flight control
inputs fully account for the effects of a cacophony of flight deck
cautions, warnings, and other indications on pilot recognition and
response. Has the FAA informed Boeing that this will now be required,
and if so what is the timeline for Boeing's compliance? If not, why
not?
b. The NTSB recommended that the FAA develop robust tools and
methods to validate assumptions about pilot recognition and response to
significant failures. Has the FAA taken steps to address this
recommendation and if so what steps has the agency taken?
c. The NTSB recommended that the FAA develop design standards for
aircraft diagnostic systems that improve how quickly and effectively
pilots respond to failures. Does the FAA intend to develop these
standards and what steps has the agency taken to do so?
Answer (a.-c.). The FAA is continuing to review and address this
NTSB recommendation along with all recommendations received. We are
fully committed to ensuring that the lessons learned from the 737 MAX
accidents are incorporated into the software updates and included in
all future certification projects as appropriate.
The FAA has included this review as part of our testing for the 737
MAX software updates by conducting an evaluation of its Installed
Systems and Equipment for Use by the Flight Crew (14 CFR Sec. 25.1302)
and Minimum Flight Crew evaluation (14 CFR Sec. 25.1523). These
evaluations are focused on minimizing the occurrence of design related
errors, enabling the crew to detect and manage errors if they do occur,
and crew requirements for safe operation considering crew workload and
controls.
Currently, there is no timeline for Boeing's compliance. We are
considering recommendations from all independent reviews in addition to
the NTSB recommendations received. The 737 MAX will not be returned to
service until it is in compliance.
The FAA is continuing to review and address this NTSB
recommendation along with all recommendations received. We are fully
committed to ensuring that the lessons learned from the 737 MAX
accidents are incorporated into the software updates of the 737 MAX and
included in all future certification projects as appropriate. We are
committed to the evolution of FAA regulations, programs, and
initiatives so they are in sync with emerging technologies, while
addressing associated human factors and global impact. We are also
increasing program coordination with Flight Standards, including its
Aircraft Evaluation Group, to ensure that operation and training issues
are fully addressed.
As always, the FAA intends to work closely with stakeholders and
industry standards groups (including SAE, AIA, and GAMA) for their
collective input to update existing, and develop new, aviation
standards.
Questions from Hon. Frederica S. Wilson for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration
Pilot Training
Question 1. Administrator Dickson, ensuring that our nation's
transportation workforce is highly trained has been a priority for me
both as a member of this committee and as chair of the Subcommittee on
Health, Employment, Labor, and Pension of the Committee on Education
and Labor.
It was very disturbing to read numerous reports on Boeing decisions
such as designing MCAS to rely on input from a single angle-of-attack
sensor, removing MCAS references from the flight crew operation
manuals, and downplaying the system to regulators. These decisions and
other efforts to minimize training requirements for the 737 Max left
pilots in the dark and jeopardized the flying public's safety.
Given what we have learned from the two crashes, the NTSB finding
that the pilots ``lacked the tools to identify the most effective
response'' to the crises they faced, and the catastrophic implications
of an MCAS failure, do you now support additional training for 737 Max
pilots?
Answer. The FAA Aircraft Evaluation Group (AEG) is responsible for
determining the minimum level of training necessary to safely operate
an aircraft and oversee implementation of pilot training. The FAA plans
to evaluate pilot performance during runaway stabilizer events, and
pilot competency using manual trim during normal and abnormal
conditions. This evaluation will occur during the Joint Operational
Evaluation Board (JOEB) which includes the FAA, EASA and TCCA. The FAA
will then analyze the results of the evaluation and training
recommendations will be documented in the 737 Flight Standardization
Board (FSB) report which will be published for public comment before
being finalized. The FAA will then approve U.S. carrier training
programs to ensure the minimum level of training is met prior to any
return to service.
The FAA is also currently evaluating a proposal submitted by
Boeing, which will include both Computer Based Training (CBT) and
simulator training. Once the FAA validates that this training is
appropriate, the training requirements will be documented in the 737
MAX FSB report recommendations that are published for public comment
prior to being finalized. Any U.S. operator's training programs will
then be reviewed and approved by the FAA. The FAA will oversee the
training programs to ensure they are delivered in a manner that is
acceptable.
Question 2. Administrator Dickson, the final report on the Lion Air
flight 610 found that Boeing did not simulate, as part of its
functional hazard assessment validation tests, an erroneously high
angle-of-attack input leading to uncommanded MCAS activation.
When renowned airline Captain, Chelsey ``Sully'' Sullenberger, the
Hudson River Hero, testified before this committee about the status of
the 737 Max, he made the following assertion regarding pilot training,
``We should all want pilots to experience these challenging situations
for the first time in a simulator and not in flight with passengers and
crew on board . . . reading about it on an iPad is not even close to
sufficient. They need to develop a muscle memory of their experiences
so that it will be immediately accessible to them in the future, even
years from now, when they face such a crisis.''
Knowing what you know now, do you agree with Captain Sully that 737
Max pilots should be provided Level-D simulator training?
Answer. Pilots operating aircraft must be fully prepared and
appropriately trained for all known failure scenarios that may be
encountered in service, as documented in engineering hazard analysis
and required by regulation. For the MCAS software updates of the MAX,
the FAA is currently evaluating updated training proposals to determine
appropriate training requirements.
Question 3. Administrator Dickson, the NTSB recommended that the
FAA develop standards for improved aircraft system diagnostic tools
that help pilots better identify and respond to failures.
Will you provide this committee with your absolute assurance that
any future Boeing airplane will include such a system?
Answer. The FAA has received recommendations from several
investigative teams, including the Secretary's Special Committee, the
Joint Authorities Technical Review (JATR), and the KNKT accident
report. We are reviewing all of these recommendations, along with those
from the NTSB, to ensure that process changes, where needed, are made,
lessons learned are institutionalized, training programs are reviewed,
and adequate guidance is available to manufacturers and operators. The
FAA is also reviewing assumptions related to present-day cockpit
conditions and pilot response expectations.
Question 4. Administrator Dickson, the NTSB recommended that the
FAA reexamine its assumption that pilots will always recognize a non-
normal condition in 1 second and respond within 3 seconds.
Do you support that recommendation?
Answer. The FAA is addressing this NTSB recommendation, to include
examining the human factors aspects of current type certificated
aircraft, as well as addressing future human factor challenges to help
mitigate associated risks and promote improved situational awareness
and safety.
Assumptions regarding design and aircraft-pilot interaction are
currently being reviewed and addressed for the 737 MAX and other
certification projects. As an example, during review and testing of
Boeing's proposed software design changes last year, it was determined
a broader review of how MCAS functions within the Speed Trim System was
warranted considering past assumptions. This led to more extensive
design changes.
Advancements in aircraft automation have contributed to an
unprecedented level of safety in our domestic aviation system, but
technology advancements necessitate continuous review. By further
considering human factors and the interface between aircraft pilots and
systems during certification, we will be moving toward a holistic
approach to aircraft certification.
Question 5. Administrator Dickson, Boeing and the FAA assumed that
the pilots would recognize a non-normal condition within one second and
respond to that non-normal condition within three seconds. But the
National Transportation Safety Board concluded that Boeing's
assumptions in its assessment ``of uncommanded MCAS (em-cass) function
for the 737 MAX did not adequately consider and account for the impact
that multiple flight deck alerts and indications could have on pilots'
responses to the hazard.''
Do you accept that finding?
Answer. We have taken the comments into consideration, as we are
evaluating the changes to the 737 MAX for return to service. We intend
to conduct further reviews in this area for potential changes to our
processes going forward.
As mentioned, assumptions regarding design and aircraft-pilot
interaction are currently being reviewed and addressed for the 737 MAX
and other certification projects. As an example, during review and
testing of Boeing's proposed software design changes last year, it was
determined a broader review of how MCAS functions within the Speed Trim
System was warranted considering past assumptions. This led to more
extensive design changes.
Advancements in aircraft automation have contributed to an
unprecedented level of safety in our domestic aviation system, but
technology advancements necessitate continuous review. By further
considering human factors and the interface between aircraft pilots and
systems during certification, we will be moving toward a holistic
approach to aircraft certification.
What are you doing to ensure FAA adequately considers pilot
response times in designing future airplanes?
Answer. Pilot recognition and response times are one part of the
safe design of the system. Another important part is the quality and
timeliness of the aircraft information that is provided to the flight
crews. The FAA is working to ensure flight crews receive aircraft
information in a manner which is useful and to which a flightcrew can
quickly respond. At times, a flightcrew's response will be a memory
item and at other times the flightcrew's response will require
additional diagnosis and reaction before countermeasures can be
started.
The FAA has received several recommendations on pilot response
times and how system safety assessments are conducted. We are reviewing
all of the recommendations to identify where process changes are needed
and ensure that we have adequate guidance for our employees and for
designers/manufacturers. Design assumptions related to pilot reaction
times must be substantiated and take the cockpit environment into
consideration. Empirical data collected during our Joint Operational
Evaluation Board (JOEB) process for aircraft certification projects
will also be considered in our review.
NTSB Recommendations
Question 6. Mr. Dickson, the NTSB recommended that the FAA require
Boeing to incorporate design enhancements, pilot procedures, and/or
training requirements, where needed, to minimize the potential that
pilots would respond to multiple cautions and warnings in a manner
different from the manner that Boeing has assumed.
When do you plan to implement this recommendation?
Answer. The FAA is taking these recommendations into consideration
for the redesign of the MAX. The FAA has completed multiple reviews of
system safety assessments (SSA) for the Boeing 737 MAX and is in the
process of certifying the design changes to address causal factors
associated with the Lion Air and Ethiopian Airlines accidents, as well
as additional changes to improve functionality.
The evaluation of the final design change will include a workload
assessment, using revised pilot procedures, to minimize the potential
for manufacturer assumptions to be inconsistent with pilot actions. The
FAA will further assess these pilot procedures as part of an
operational evaluation, to ensure that appropriate procedures and
training requirements are included in the project approval. These
activities will occur prior to the return to service.
Questions from Hon. Andre Carson for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration
Question 1. Administrator Dickson, please let me know who at FAA
met with Boeing to discuss the information underlying the TARAM
(Transport Airplane Risk Assessment Methodology) report.
a. Where did any such briefing, discussion or presentation on the
TARAM take place?
b. Who received this information?
Answer (a.-b.). A TARAM is a scientific risk-assessment tool. It
weighs a number of factors and is used to help the FAA quantify risk.
It is not the FAA's sole decision-making tool; rather, its purpose is
to assist the Corrective Action Review Board (CARB)--comprised of
experts in their field--in making decisions about how to reduce or
eliminate risk. The FAA would never accept a risk of additional
accidents without taking immediate action, and in fact, the agency
acted immediately--with interim and permanent steps--to respond to the
Lion Air accident. The FAA issued an emergency AD reminding pilots how
to deal with runaway speed trim eight days after the Lion Air accident
and before the TARAM analysis was complete. When the AD was issued, the
FAA determined the permanent action was to require a design change to
address MCAS. That effort was also underway before the TARAM was
prepared in December 2018.
The TARAM analysis of the 737 MAX MCAS safety issue was presented
to the Seattle ACO Corrective Action Review Board (CARB) on November
28, 2018, December 12, 2018, and February 6, 2019. Boeing's Airplane
Safety Engineering Focal attended each of the CARB meetings as an
observer. The meetings were held at the FAA Regional Office in Des
Moines, Washington. On February 13, 2019, the Seattle ACO Office
Manager met with the Boeing 737 MAX Chief Project Engineer to discuss
and sign the TARAM-derived risk-based corrective action schedule.
c. Who made the decision to act on the Airworthiness Directive?
Answer. After reviewing the available information, the Seattle ACO
recommended an Emergency Airworthiness Directive, AD 2018-23-51. The
Seattle ACO then followed FAA's standard coordination process prior to
formalizing the decision.
d. Who had the authority to ground the MAX based on the TARAM last
December?
Answer. The decision to ground the 737MAX was not based solely on
the December 2018 TARAM.
The Administrator of the Federal Aviation Administration carries
out statutory duties and powers related to aviation safety, including
the authority to ground aircraft.
e. Did Mr. Ali Bahrami have the TARAM information in December 2018?
If not Mr. Bahrami, who did?
Answer. The Associate Administrator previously answered this
question during a transcribed interview your staff conducted on
December 5, 2019.
The FAA followed the recommendation of the technical experts in
Seattle following the Lion Air accident and issued an emergency AD
within days of the accident. When additional data and information
became available after the Ethiopian Airlines accident, the Associate
Administrator for Aviation Safety recommended grounding the 737 MAX
fleet.
Questions from Hon. Brian K. Fitzpatrick for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration
Question 1. Administrator Dickson, my top aviation priority has
been safety--I know that you and the FAA share that priority, but so
far, the FAA has shown little intention of implementing the secondary
barriers provision that was included in the FAA Reauthorization Act of
2018.
Currently, the Aviation Rule Making Council (ARAC) has dragged
their feet. Can you speak to a realistic timeline of when this critical
safety barrier will be implemented on new aircraft?
Answer. The FAA takes cockpit security seriously and is committed
to meeting the intent of section 336 of the FAA Reauthorization Act of
2018 regarding secondary cockpit barriers. On June 20, 2019, the FAA
tasked our Aviation Rulemaking Advisory Committee (ARAC) to provide
information and recommendations on this topic. The ARAC formed a Flight
Deck Secondary Barrier Working Group to address the tasking. We expect
the Flight Deck Secondary Barrier Working Group to provide the ARAC
with a report in early 2020 and expect the ARAC to consider that report
at their March 2020 meeting. The ARAC's recommendations will help the
FAA develop an approach that provides manufacturers with necessary
technical information to enable implementation, as well as other
information on costs and benefits required by the rulemaking process.
Under the Administrative Procedure Act (APA), the FAA must engage
in a rulemaking proceeding to issue an order requiring installation of
a secondary cockpit barrier on each new aircraft that is manufactured
for delivery to a passenger air carrier in the United States operating
under the provisions of part 121 of title 14, Code of Federal
Regulations.
Questions from Hon. Paul Mitchell for Hon. Stephen M. Dickson,
Administrator, Federal Aviation Administration
Question 2. The various investigations of the Boeing 737 MAX
accidents--including those by Congress, the FAA, Boeing, and the
press--have shown many assumptions were made during the design and
certification of the 737 MAX. With hindsight, it is clear some of those
assumptions were faulty. It also appears that not every potential input
and variable was entered into these assumptions.
a. What can and will the FAA do to reassess the assumptions it uses
during aircraft certification?
b. What new internal processes--either via new procedures or
staffing changes--can and will the FAA pursue to ensure robust testing
of and counterpoints to assumptions it utilizes?
Answer (a.-b.). Assumptions regarding design and aircraft-pilot
interaction are currently being reviewed and addressed for the 737 MAX
and other certification projects. As an example, during review and
testing of Boeing's proposed software design changes last year, it was
determined a broader review of how MCAS functions within the Speed Trim
System was warranted considering past assumptions. This led to more
extensive design changes.
Advancements in aircraft automation have contributed to an
unprecedented level of safety in our domestic aviation system, but
technology advancements necessitate continuous review. By further
considering human factors and the interface between aircraft pilots and
systems during certification, we will be moving toward a holistic
approach to aircraft certification.
Additionally, the FAA is reviewing how we structure our approach to
delegation. In the case of Boeing, we have reduced the amount of
delegation, and we have pulled back some of the previously delegated
items. Specifically regarding the 737 MAX, the FAA has retained all
aspects of the review. No part of the review has been delegated to the
manufacturer. In addition, the FAA is in the process of reevaluating
our delegation decisions for other current Boeing projects.
We are carefully reviewing the recommendations received to date and
are identifying the FAA and external stakeholders who would be
responsible for the development and implementation of proposals to
address the recommendations. This includes items like Recommendation R9
of the Joint Authorities Technical Review (JATR) report, which
discusses operational design assumption of crew response.
Question 3. In the submitted written testimony from Mr. Edward
Pierson, he noted that during a 13-month timeframe from 5/12/18 to 3/
26/19, the Boeing 737 line had 15 emergencies, leading to 2 crashes and
13 incidents.
a. Is this statistic consistent with the FAA statistics on the 737
line?
b. If so, how does this record compare with other aircraft types?
c. If this statistic is an outlier, what accounts for this
inconsistency?
Answer (a.-c.). The FAA's understanding of Mr. Pierson's comments
is that he is referring to the two accidents that led to the grounding
and current redesign of the 737 MAX, and 13 Service Difficulty Reports
(SDR) received on the MAX aircraft. It is not unusual for transport
aircraft to have 13 SDRs in the stated reporting time period.
The FAA reviewed the SDRs raised by Mr. Pierson and determined that
none of them required an Airworthiness Directive (AD) mandating
corrective actions for the airplane.
Questions from Hon. Peter A. DeFazio for G. Michael Collins, Former
Aerospace Engineer, Federal Aviation Administration, appearing in his
individual capacity
Question 1. Mr. Collins, delegating authority to entities such as
Boeing has been a long-standing practice which can be beneficial to the
Federal Aviation Administration (FAA) in leveraging the technical
expertise of manufacturers to help make key determinations concerning
the safety of aircraft. However, there is a risk of over-delegation
that can lead to regulatory capture where the FAA favors industry's
interests at the expense of its regulatory responsibilities.
a. Over your three-decade career at the FAA, what are your
observations on how the FAA has managed its relationship with the
entities it regulates?
Answer. Delegating authority to entities such as Boeing has changed
dramatically over my three-decade career as an FAA aerospace engineer
in the Aircraft Certification Service. Thirty years ago, the system
provided for direct oversight of and open communications between FAA
technical specialists and those in industry to whom FAA delegated
authority to make compliance findings under the Designated Engineering
Representative (DER) system. Now, under the ``Organization Designation
Authorization'' (ODA) system there is no direct oversight of and very
limited \1\ communication between FAA specialists and those in the ODA
who are authorized to make compliance findings for the FAA (``unit
members''). Instead of using FAA oversight to identify and correct
safety issues (non-compliances) before certification, the FAA has been
moving toward identifying safety issues during audits after a design
has been certificated and is in production The concept of auditing
after the certification to determine if the compliance finding was
appropriate and process used to make the finding needs improvement is
an ineffective and inefficient. The process leads to the flying public
being exposed to potentially unsafe designs until or if the deficiency
is found during an audit or disclosure by the company. Direct
involvement of the FAA safety engineers and collaboratively working
with the DERs resulted in identifying and fixing non compliances before
the airplanes entered service.
---------------------------------------------------------------------------
\1\ Boeing implemented internal procedures that required their ARs
to get permission before talking with FAA certification engineers. This
practice stifled a collaborative oversight and compliance working
relationship.
---------------------------------------------------------------------------
In addition to the changes in delegation, FAA management has
changed their focus from one that prioritized compliance to regulations
and policy thirty years ago to a management culture that gives priority
to applicants' positions, their costs and schedules over compliance to
FAA regulations and policy. There are several examples of this shift in
management focus in my written testimony such as the 737 MAX rudder
control, 737 MAX fuel tank surface temperature, 737 MAX fuel pump
circuit protection, the 787 lithium-ion battery containment as well as
the issue of FAA issuing exemptions that are more in the economic
interests of the applicant than in the interest of the Public.
Regarding exemptions, Title 14 Code of Federal Regulations (14 CFR)
section Sec. 11.81 is titled ``What information must I include in my
petition for an exemption?'': Paragraphs (d) and (e) state:
(d) The reasons why granting your request would be in the
public interest; that is, how it would benefit the public as a
whole;
(e) The reasons why granting the exemption would not adversely
affect safety, or how the exemption would provide a level of
safety at least equal to that provided by the rule from which
you seek the exemption;
However, FAA management often grants exemptions to petitioners
(type design applicants) that allow designs that do not provide a level
of safety at least equal to that provided by the rule. Those exemptions
allow the applicant to produce a design that has a level of safety
below that required by the FARs. Further, those exemptions are only in
the financial interest of the applicant; they do not benefit the public
as a whole as stated in the regulation.
b. What is the ``right'' amount of authority for the FAA to
delegate to industry?
Answer. There is no numerical answer that defines the right amount
of authority to delegate to industry. The right amount depends on the
scope and potential safety impact of the certification project and each
applicant's technical expertise, knowledge of Federal Aviation
Regulations (FARs), the regulation's intent and published FAA policy.
One factor should be the applicant's compliance culture which is
demonstrated by their ability to follow FAA regulations and policy. If
an applicant repeatedly presents designs that clearly do not comply
with the regulations and policy, and often argues with the FAA over the
intent of the FAA's regulations, that does not demonstrate a good
compliance culture. A designee is supposed to demonstrate the knowledge
and ability to follow FAA regulations and policy.
Another factor should be the safety culture of the applicant. The
Federal Aviation Regulations (FARs) define the minimum level of safety
for obtaining an FAA type certificate. They do not define a maximum
level of safety that should be included in a design. Applicants should
demonstrate a safety culture that values presenting designs that not
only meet the FARs but exceed the safety level required by the FARs for
those critical safety designs where an additional safety level is in
the public interest; as well as in the interest of the applicant to
produce a safe product and maintain a high safety reputation with the
public.
c. Would you say that the FAA has yielded too much authority to
Boeing? Why or why not?
Answer. Yes, it does seem the FAA has yielded too much authority to
Boeing; especially since granting Boeing an Organizational Delegation
Authority (ODA). This has been demonstrated by the grounding of two
type design approvals Boeing obtained under their ODA in each model's
first year of operations. The first Boeing model approved under their
ODA, the 787, was grounded for several months because the design of the
lithium-ion battery installation approved under the ODA process was
unsafe. As presented in my written testimony, an FAA technical
specialist had proposed the FAA require a steel containment structure
be required but was overruled. A steel containment structure was part
of the design change that allowed the lifting of the grounding of the
787.
The second model approved under Boeing's ODA, the 737 MAX, series
has now been grounded for nearly one year following the second of two
catastrophic crashes. Those failures of the ODA demonstrate a lack of a
good compliance culture and safety culture necessary for the authority
FAA has yielded to Boeing.
In both instances, delegation decisions were made based upon
management pressure and their desire to support Boeing's schedule
needs. For instance, on the 787, the delegation should have been
limited due to the significant amount of new technology incorporated
into the design and the new global supply network and business model
used to develop and manufacture the airplane. Rather than limit the
delegation authority, FAA managers made decisions to delegate over 95
percent of the findings. On the 737 MAX managers made similar
delegation decisions based upon resources and program schedule needs.
Even then, the 737 MAX received type certification ahead of Boeing's
schedule.
In addition, these are examples of how FAA has yielded too much
authority to Boeing and other ODAs:
i. The Boeing ODA manual restricts what FAA aerospace engineers
can look at technically and restricts what can be challenged by the FAA
aerospace engineers.
ii. FAA management directed (forced) FAA technical specialists to
delegate 90% and more of engineering safety findings to the Boeing ODA.
d. What does the FAA need to do to ensure that it is able to
adequately oversee the work it delegates?
Answer. Delegation works best when there is direct communication,
trust, integrity, and professionalism on both sides. The FAA aerospace
certification engineers should be able to work directly with the
designee (in this case, the ODA unit members) to establish and maintain
trust. The FAA aerospace certification engineer must be able to review
and approve novel and safety critical test plans and witness novel and
safety critical testing to conduct proper oversight the of designee's
knowledge of FAA regulations and policy as well as designee's
professionalism. The designee must be allowed to directly communicate
with the FAA aerospace certification engineers (and vice versa) at any
time and to freely discuss engineering safety concerns and tackle in-
service problems in a professional and collaborative manner.
FAA should be required to establish a formalized delegation
decision process that is based upon factors noted above regarding the
ODA performance, and the technical risk of the particular design
aspect. The technical risk should be established by a team of experts
consisting of FAA technical experts and outside experts if additional
expertise is needed to address new technology aspects of a product. The
retention status of an item would be established at the beginning of
the program and it could not be changed without a formal decision by
the technical team. Managers should not be able to override the team
decision due to pressures by applicants later in the program due to
schedule related concerns. Delegation decisions could be reviewed by
the technical team and delegation authorized in consideration of new
information provided by the applicant justifying delegation. FAA
management should not direct delegation of authority to an applicant
based on any arbitrary numerical value.
Current FAA policy for ODAs, including Order FAA Order 8100.15B,
``Organization Designation Authorization Procedures,'' allows for FAA
to determine how much to delegate to an ODA and allow for evaluating
proposed unit members. However, a change in the 2018 FAA
Reauthorization removes that ability. The change essentially made
delegation a right of the ODA holder instead of a privilege. Section
212(a) requires the FAA to ``delegate fully'' to an ODA holder the
functions specified in the ODA holder's procedures manual. The FAA can
limit any function only after the delegation if investigation shows
that public interest and safety require such a limitation. This is in
contrast with current policy, which requires the FAA to retain certain
inherently governmental functions, such as interpretations of
airworthiness standards, and specific compliance findings if the ODA
either has no experience with the issue or has demonstrated previously
that it can't be relied on, e.g., by not following FAA policy in making
a compliance finding. (See FAA Order 8100.15B, paragraphs 8-4,
Limitations, and 8-6, Type Certification Programs.) Section 212(a) also
requires the FAA, at the ``request'' of an existing ODA holder, to
approve revisions to its procedures manual and to delegate fully each
function described in the manual, with the same restrictions on
limiting functions.
In addition, the FAA should dedicate additional resources
(aerospace engineers) to the oversight function during certification
instead of dedicating new resources to audit type functions.
Question 2. Mr. Collins, you were a member of the Safety Oversight
Board that was responsible for reviewing safety concerns raised by FAA
employees. One of the issues the board considered was the design of the
rudder cable on the 737 MAX. According to several FAA technical staff,
the rudder cable is at risk of being damaged--meaning that the plane
could no longer be steered--from debris in the event of an uncontained
engine failure. However, Boeing felt that the design changes were
impractical, and FAA managers ultimately sided with Boeing over the
agency's technical experts.
a. In the case of the 737 MAX rudder cable issue, was it unusual
for so many experts to express their concerns over the FAA's reticence
to have Boeing change the design?
Answer. Yes; it was very unusual for so many FAA technical experts
as well as several FAA managers to disagree with the decision of some
FAA managers on a means of compliance to the Federal Aviation
Regulations. Even more unusual that they would document their
disagreement in writing.
FAA management was not only reticent toward the end of the 737 MAX
certification project to have Boeing change the design of the rudder
controls from the original 1960's design; FAA managers actively
developed the FAA position in the issue paper and their response to the
SRP Oversight Board/SME Panel's determination to try to present a
reason the old rudder control design could be found as compliant to the
FARs in spite of the lessons learned from the 1989 DC-10 accident. The
result is the rudder control of the 737 MAX, as documented by the SME
Panel report, is subject to a single failure causing a catastrophic
accident as happened in the DC-10 accident. FAA management's reasons
were found unacceptable by all those who documented their disagreement,
including the independent SRP Subject Matter Expert Panel and the SRP
Oversight Board.
The FAA management position at the end of the certification project
is in stark contrast to their position earlier in the certification
project when those same FAA managers signed FAA letters and the FAA
issue paper stating Boeing needed to change the rudder control design
in order to be compliant with the Federal Aviation Regulations. In
effect, at the FAA management position early in the 737 MAX
certification process agreed with the later position of the FAA
technical specialists, SRP SME Panel and the SRP Oversight Board.
b. How concerned are you that the voices of the FAA's technical
experts are not being heard and how do you believe that can undermine
aviation safety?
Answer. I am very concerned that these days FAA managers more often
spend time looking for ways justify accepting industry proposals while
overruling the FAA technical specialists who have determined the
industry proposal does not demonstrate compliance to the Federal
Aviation Regulations (FAR). The technical specialists I worked with
consider themselves public servants who want to make sure designs
approved by the FAA do comply with the minimum standards in the FARs or
truly provide an equivalent level of safety to the relevant FARs. As
public servants, they know their decisions affect the safety of the
flying public as well as those on the ground if an aircraft crashes.
When designs are approved that do not meet the minimum safety
standards, it clearly undermines aviation safety. As I stated in my
written testimony, it is also demoralizing to FAA technical specialists
when managers continually overrule their technical findings.
I believe that those FAA managers who often overrule technical
specialists are in many cases violating the regulations and policies
and putting the public safety at risk. In order to send a message that
the FAA has a just safety culture and will not accept this behavior,
these managers should be held accountable.
c. What are your recommendations for ensuring the Safety Review
Process (SRP) strikes the right balance between safety concerns and the
industry's business interests?
Answer. The SRP process was created to provide a voluntary safety
reporting process that provides the opportunity for FAA employees to
report safety issues and for those issues to be evaluated using a
collaborative process, rather than a unilateral FAA management process.
It isn't intended to strike a balance between a safety concern and
industry's business interests. It is intended to evaluate a safety
concern, for example a concern an FAA decision allows a design that
does not comply with the FAA regulations, and determine if the safety
concern is valid. If the safety concern is valid, then the SRP process
is intended to make recommendations to correct the safety issue.
When the issue involves a decision made regarding an applicant's
proposed method of compliance, such as the 737 MAX rudder control issue
I discussed in my written testimony, the SRP process evaluates the
applicant's position and the FAA's decision against the FAA safety
regulations and policy. When the SRP collaborative process determines
an FAA decision was contrary to FAA regulations and policy, FAA
management should take the Oversight Board's decision seriously instead
of being defensive about it and just restating their support for their
prior decision. This was the same difficulty the current Administrator
had during your December 11, 2019 hearing in admitting the FAA made a
mistake regarding the approval of MCAS on the 737 MAX..
With regard to striking a balance between safety and industry's
business (cost) interests, when the FAA proposes a change to the
regulations (FARs) they are required to perform an extensive cost-
benefit analysis. The rulemaking process evaluates the cost of
implementing the change to future designs against the safety benefit to
the public as a whole. This process includes a public comment period
and review of the rulemaking by the Department of Transportation. In
additions, significant rulemaking is reviewed by the Office of
Management and Budget before it is issued. It is during the rulemaking
process that the FAA strikes the balance between safety and industry's
cost interests. Therefore, when a design is non-compliant with FARs the
FAA has not achieved the right balance between industry and public
interest that was previously determined during the rulemaking process.
In addition, FAA regulations already have methods to try to balance
compliance to the regulations with the cost to the applicant for
changed products (e.g., amended type certificate projects like the 737
MAX). When evaluating the application of newer regulations to a changed
product, the Changed Product rule allows FAA to consider the cost of
applying a new regulation verses the safety benefit. Using that process
the FAA may decide to allow the applicant to continue to use the older
regulations that applied to the baseline model by granting an
``exception'' or the FAA may decide it is in the public interest to
require the applicant apply the latest regulation.
Advisory Circular (AC) 21.101-1B, ``Establishing the Certification
Basis of Changed Aeronautical Products'' describes the use of
exceptions. In section 2.2.1 it states ``Section 21.101(a) requires a
change to a TC and the area affected by the change to comply with the
latest requirements, unless the change meets the criteria for the
exceptions identified in Sec. 21.101(b) or (c). The intent of Sec.
21.101 is to enhance safety by incorporating the latest requirements
into the type certification basis for the changed product to the
greatest extent practicable.''
For example, the FAA can evaluate if the newer cockpit display
rules should be applied to a changed product such as the 737 MAX, or
should an exception be granted that allows the applicant to use the
regulations in the previous (baseline) model's certification basis.
This is not a public process like rulemaking or petitions for
exemption. I believe FAA Management has too often placed their priority
on industry cost concerns verses the safety of the public as a whole
when granting exceptions under the Changed Product Rule. Therefore, I
recommend the FAA change the process for granting an exception to
include an opportunity for the public to comment on proposed
exceptions. The notice to the public requesting comment on a proposed
exception should include all justification used by the applicant in
their request for the exception; similar to the public exemption
process.
In the case of the 737 MAX rudder control, the regulations had not
been updated since the 737 model being changed. In fact, the FAA policy
had not changed since the certification of the baseline 737 NG models.
Therefore, a better way for FAA management to respond to a decision and
recommendation by the SRP Oversight Process when it determines the
method of compliance was not appropriate would be to use an existing
tool the FAA has in the regulations to evaluate a design that does not
comply with the regulations; the Exemption process defined under 14 CFR
Section 11. FAA management should have required the applicant submit a
petition for exemption and then FAA should have evaluated the petition
using the process defined in Section 11. This was one of the SRP Panel/
Oversight Board recommendations.
When evaluating the exemption, FAA should use a collaborative
process between the local manager and the FAA technical specialists.
Any exemption granted should be in the interest of the public as a
whole, as stated in the regulations, and clearly provide an equivalent
level of protection to the regulations, as stated in the regulation.
Exemptions should not be granted solely on the basis of the financial
interests of the applicant. As discussed above, when each regulation
was issued it went through an evaluation of the cost to industry verses
the safety benefit of the regulation. Exemptions should not be used as
a method to circumvent the public cost benefit evaluation used when
regulations were adopted.
In using the exemption process for the 737 MAX rudder cable issue,
FAA Management could have granted a time-limited partial exemption to
give Boeing additional time to modify the rudder design so that it
complies with the regulations. This seems similar to how EASA worked
with Airbus on the similar A320neo rudder design. Alternatively, FAA
management could have granted Boeing a full exemption so Boeing could
continue to produce the 737 MAX with the 1960s rudder design for
another 30 years or however long the 737 MAX remains in production,
although in my opinion that would not have been in the interest of the
public as a whole.
Prior to the SRP being developed, I was on a joint Union-Management
collaborative team that recommended a different type of voluntary
safety reporting process that was similar to the very successful Air
Traffic Safety Action Program (ATSAP). The proposal from the team
included a third independent party in addition to Union representatives
and Aircraft Certification Managers in the group evaluating the SRP
report and making recommendations. Later, I was in a meeting when FAA
management in Washington, D.C. (AVS-1 at the time) expressed her
concern with having a third party in the process and would not agree to
this proposal. Unfortunately, the SRP system that is in place today has
once again demonstrated that FAA managers refuse to admit any fault in
a past decision and correct poor safety decisions.
The existing SRP process could be improved by requiring upper level
management (e.g., AIR-1) document their decision to either accept the
SRP Oversight Board's recommendation or accept the FAA Division
manager's decision to reject the Oversight Board's recommendation.
A further improvement to the SRP could be to add an independent
review process for those SRP reports where FAA Management rejects the
SRP Oversight Board recommendation. The issue could be submitted to the
NTSB using a process like the existing Airman Appeal process. FAA could
be required to submit the FAA Management justification together with
the SRP report and Oversight Board recommendations to the NTSB for
review. Such an independent review step could help develop a just
safety culture in FAA Aircraft Certification Service management from
the highest levels of management to the line managers.
Questions from Hon. Peter A. DeFazio for Mica R. Endsley, Ph.D.,
appearing on behalf of the Human Factors and Ergonomics Society
Question 1. Dr. Endsley, in your testimony you note that pilots
were not aware of or trained on the maneuvering characteristics
augmentation system (MCAS), and that ``[e]ffective training on how to
overcome automation failures involves not only a written notice or
description of automation, but also actual experience in detecting,
diagnosing, and responding of such events.''
a. Does this mean you believe 737 MAX pilots should have had
simulator-based training before flying the aircraft?
Answer. Scientific research shows that training pilots on fight
deck automation is critical for developing a robust understanding of
how it works. This mental model is needed to support pilots in
understanding automation modes and accurately predicting its behaviors
under both normal and non-normal conditions. An accurate mental model
of how automation works is critical to developing good situation
awareness and performance in flight operations.
While there was an expectation by Boeing that pilots did not need
simulator training because the MCAS automation would be acting in the
background, this expectation did not consider the challenges of
abnormal events such as was experienced in these accidents. Simulator-
based training on MCAS should have been provided to all pilots prior to
flying the aircraft to allow them to develop the needed understanding
of the behavior of the MCAS automation under both normal and non-normal
events, such as degraded or inoperative sensors.
b. When the 737 MAX is ungrounded, do you think pilots should have
to go through some kind of simulator-based training before being
allowed to fly the aircraft again?
Answer. Prior to flying the 737-MAX, pilots should be provided with
training on the MCAS system regarding how the newly revised system
works as well as its limitations and potential failure modes. They
should also be provided with the opportunity to fly a 737-MAX
configured flight simulator and to experience potential failure
conditions. The simulator training should include identification of
critical cues that indicate a failure mode, differentiation between
MCAS failure and other failure conditions, and execution of the proper
response to any MCAS failures.
While some pilot training can be provided via classroom or
computer-based training programs, it is important that flight
simulators are also employed to ensure that pilots can recognize
automation behaviors and failure conditions in context, can accurately
carry out the appropriate procedures, and can experience aircraft
flight handling changes to gain proficiency. Training programs should
be tested and validated to show that they are successful in providing
the needed skills to line pilots.
Question 2. Dr. Endsley, it has now been more than one year since
Boeing admitted that it concealed from both the Federal Aviation
Administration (FAA) and 737 MAX operators the fact that the angle of
attack (AOA) disagree alert wasn't functioning properly on the vast
majority of the 737 MAX fleet in service. Yet, the FAA hasn't taken any
kind of enforcement action against Boeing for its failure to divulge
this to the FAA or its customers. The FAA has issued no fines or
penalties--despite the fact that this was a clear violation of FAA
regulation.
Do you think the FAA should propose some kind of penalty against
Boeing for its handling of the AOA disagree alert, and if it doesn't,
what kind of message do you believe that sends to Boeing and industry?
Answer. Companies are responsible for establishing a strong safety
culture that promotes the application of safety and human factors
practices, and the open reporting of any system problems and
appropriate remedial safety actions that are needed. This includes
design changes, training, and communications with regulatory
authorities and customers. While the Human Factors and Ergonomics
Society strongly endorses such activities based on scientifically
supported best practices, it is not our role take a position with
regard to punitive actions or penalties pertaining to regulatory
compliance. It is the purview of the government to determine the
appropriate proactive and/or reactive measures that should be taken in
regards to regulatory compliance.
Question 3. Dr. Endsley, do you believe the FAA's November 7, 2018,
Emergency Airworthiness Directive was insufficient for preventing the
second 737 MAX accident. If so, why?
Answer. The Emergency Airworthiness Directive (AD) was clearly
insufficient for preventing the second accident in the 737 MAX. While
the AD addressed the issue of blocked AOA sensors affecting aircraft
performance, it did not address the MCAS by name, nor did it explain
how the MCAS used the sensor inputs to control the aircraft's pitch,
leaving pilots with an insufficient mental model of MCAS in normal and
abnormal situations. More importantly, it failed to mandate training on
the MCAS, on correctly identifying problems with improper MCAS
operations, and on proper procedure execution.
The revisions to the flight manual in the AD provide only a long
list of potential problems that were not sufficiently diagnostic of the
MCAS failure condition. The cues received by the pilots due to degraded
sensors affecting MCAS were significantly different than the cues
received with a runaway stabilizer trim, the procedure that Boeing and
the AD instructed pilots to use, slowing diagnosis of the problem.
While the Indonesian Airlines crew was able to correctly identify
the need to use the runaway stabilizer trim procedure (in that the
first officer had completed initial training on the aircraft after the
AD was issued), they were not able to correctly perform the execution
of the procedure. A mis-trim was still in place after the crew set the
system to CUT-OUT. Additionally, they were unaware of the disconnect of
the auto-throttle system, leading to loss of situation awareness on
airspeed. The combined mis-trim and high airspeed created a pitch
problem that was uncontrollable.
Questions from Hon. Frederica S. Wilson to John M. Cox, Chief Executive
Officer, Safety Operating Systems
Joint Authorities Technical Review (JATR)
Question 1. Mr. Cox, the JATR found that the MCAS system was not
evaluated as a ``complete and integrated'' function in the
certification documents that were submitted to the FAA, that the safety
analysis was fragmented among several documents, and parts of the
System Safety Analysis (SSA) from the B737 NG were reused in the B737
MAX without sufficient evaluation.
How important is it to evaluate new flight systems and technology
as a ``complete and integrated function'' of the aircraft?
Answer. In today's modern, complex airliners it is vital that the
entire system be evaluated, not just individual components. This is the
purpose of the System Safety Analysis. It is my understanding that
Boeing evaluated MCAS with a System Safety Analysis in the original
state (.6 degrees of stabilizer movement per activation) but not when
the authority was increased (2.4 degrees of stabilizer movement per
activation). This was a significant oversight or error.
I agree with the JATR that is very important that a complete and
integrated system should be evaluated. Furthermore, each component
should be evaluated for failure and the effect on the overall system.
As an example; if an Angle of Attack sensor fails the system will be
affected with the activation of the stick shaker, IAS Disagree, ALT
Disagree, FEEL DIFF PRES, warnings plus the disengagement of the
autopilot and autothrottles. Pilot response to these numerous and
simultaneous warnings should be carefully evaluated for risk severity.
Certification criteria can be improved to be more inclusive of
component failures that affect systems.
Boeing-FAA, Boeing-Airlines, Boeing-Pilots Communications
Question 2. Captain Cox, the Committee's investigation has revealed
that Boeing communicated important information about MCAS and related
systems to the FAA and airlines either in a fragmented way or not at
all. Does that raise alarm in your view?
The Joint Authorities Technical Review found, and I quote, that
``Aircraft functions should be assessed, not in an incremental and
fragmented manner, but holistically at the aircraft level.'' Do you
agree?
Answer. Boeing viewed MCAS as a subsystem of the Speed Trim System,
and not of importance to the operator or crew. I respectfully disagree
with this assessment. Any system that can move a major flight control,
such as the stabilizer trim, should be explained to the operator and
flight crew. It does concern me that the Boeing evaluation did not
adequately take into account the simultaneous failures that could occur
which, could slow crew response and complicate diagnosing the problem.
I fully agree with the JATR that aircraft functions should be
assessed in a holistic manner. With increasing complexity and
increasing interrelation between systems (computers exchanging
information with other computers) it is very important that system
performance be evaluated carefully when a failure occurs.
Questions from Hon. Conor Lamb to John M. Cox, Chief Executive Officer,
Safety Operating Systems
Question 1. Captain Cox, you worked on the investigation of the
USAir flight 427 accident in 1994, which tragically occurred in my
district. As you know, USAir 427 was the second crash attributable to
the same design flaw in the Boeing 737 rudder power control unit. In
your testimony, you spoke to the fact that it is unacceptable to have
two successive crashes related to the same design flaw.
Does it give you concern that, 25 years later, two 737s have again
crashed due to a common design flaw?
Answer. I, along with numerous other investigators, spent five
years solving the US Air 427 accident. The industry did not learn
everything possible from the United Airline accident four years earlier
in Colorado Springs (UAL 585). It does concern me that there were two
MAX accidents in which there were many similar causal and contributing
factors.
Due to the short time between the Lion Air and Ethiopian Airlines
accident the investigation of Lion Air was not complete. However, there
was compelling evidence of a serious problem with MCAS activation and
the resulting impact on controllability.
A review of the assumptions of pilot actions following MCAS
activation should have been undertaken after Lion Air.
An accident that is due to the reoccurrence of problem known from a
previous accident or incident is the most difficult for accident
investigators.
Question 2. Do you recall that pilots were blamed after the first
and second accidents in the 1990s? What are your thoughts on this?
Answer. There were some people and organizations that attempted to
blame the pilots for the United 585 and US Air 427 accidents. NTSB did
not agree that the pilots were the cause of these accidents.
Some organizations quickly blame pilots because they are the last
people that could have stopped the accident sequence. As an experience
accident investigator I have learned that this is simplistic and does
not address all of the issues.
All accidents are the result of a complex series of events.
Preventing future accidents requires understanding and mitigating all
of these contributing factors. Sometimes assessments should be done
before the final report is released to ensure continued safety of the
fleet.
If human error is a causal factor, evaluation of what caused the
error should be done. Human factors and human performance are important
parts of accident investigation.
Question 3. What recommendations do you have to ensure that
corrective action is taken after an initial crash before a subsequent
crash occurs?
Answer. Early in an investigation an evaluation of aircraft and
crew performance compared to expected performance should be done. If
there are discrepancies in either crew performance or aircraft
performance an evaluation of the risk to the fleet should be conducted.
Could this happen again? Are the assumptions of crew performance the
same as accident crew's actual performance? Did the airplane perform as
expected?
Conduct a review of fleet history to determine if similar events
occurred, even if they did not result in an accident. This information
provides data for the likelihood of a future occurrence. This review
should be transparent and shared with all parties to the investigation.
[all]