[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]


  THE BOEING 737 MAX: EXAMINING THE FEDERAL AVIATION ADMINISTRATION'S 
               OVERSIGHT OF THE AIRCRAFT'S CERTIFICATION

=======================================================================

                                (116-46)

                                HEARING

                               BEFORE THE

                              COMMITTEE ON
                   TRANSPORTATION AND INFRASTRUCTURE
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION
                               __________

                           DECEMBER 11, 2019
                               __________

                       Printed for the use of the
             Committee on Transportation and Infrastructure
             
             
                  [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]             


     Available online at: https://www.govinfo.gov/committee/house-
     transportation?path=/browsecommittee/chamber/house/committee/
                             transportation
                                                          
                              ___________

                    U.S. GOVERNMENT PUBLISHING OFFICE
                    
40-697 PDF                WASHINGTON : 2020                             
                             
                             
                             
             COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE

                    PETER A. DeFAZIO, Oregon, Chair
ELEANOR HOLMES NORTON,               SAM GRAVES, Missouri
  District of Columbia               DON YOUNG, Alaska
EDDIE BERNICE JOHNSON, Texas         ERIC A. ``RICK'' CRAWFORD, 
RICK LARSEN, Washington                  Arkansas
GRACE F. NAPOLITANO, California      BOB GIBBS, Ohio
DANIEL LIPINSKI, Illinois            DANIEL WEBSTER, Florida
STEVE COHEN, Tennessee               THOMAS MASSIE, Kentucky
ALBIO SIRES, New Jersey              MARK MEADOWS, North Carolina
JOHN GARAMENDI, California           SCOTT PERRY, Pennsylvania
HENRY C. ``HANK'' JOHNSON, Jr.,      RODNEY DAVIS, Illinois
    Georgia                          ROB WOODALL, Georgia
ANDRE CARSON, Indiana                JOHN KATKO, New York
DINA TITUS, Nevada                   BRIAN BABIN, Texas
SEAN PATRICK MALONEY, New York       GARRET GRAVES, Louisiana
JARED HUFFMAN, California            DAVID ROUZER, North Carolina
JULIA BROWNLEY, California           MIKE BOST, Illinois
FREDERICA S. WILSON, Florida         RANDY K. WEBER, Sr., Texas
DONALD M. PAYNE, Jr., New Jersey     DOUG LaMALFA, California
ALAN S. LOWENTHAL, California        BRUCE WESTERMAN, Arkansas
MARK DeSAULNIER, California          LLOYD SMUCKER, Pennsylvania
STACEY E. PLASKETT, Virgin Islands   PAUL MITCHELL, Michigan
STEPHEN F. LYNCH, Massachusetts      BRIAN J. MAST, Florida
SALUD O. CARBAJAL, California, Vice  MIKE GALLAGHER, Wisconsin
    Chair                            GARY J. PALMER, Alabama
ANTHONY G. BROWN, Maryland           BRIAN K. FITZPATRICK, Pennsylvania
ADRIANO ESPAILLAT, New York          JENNIFFER GONZALEZ-COLON,
TOM MALINOWSKI, New Jersey             Puerto Rico
GREG STANTON, Arizona                TROY BALDERSON, Ohio
DEBBIE MUCARSEL-POWELL, Florida      ROSS SPANO, Florida
LIZZIE FLETCHER, Texas               PETE STAUBER, Minnesota
COLIN Z. ALLRED, Texas               CAROL D. MILLER, West Virginia
SHARICE DAVIDS, Kansas               GREG PENCE, Indiana
ABBY FINKENAUER, Iowa
JESUS G. ``CHUY'' GARCIA, Illinois
ANTONIO DELGADO, New York
CHRIS PAPPAS, New Hampshire
ANGIE CRAIG, Minnesota
HARLEY ROUDA, California
CONOR LAMB, Pennsylvania



                                CONTENTS

                                                                   Page

                   STATEMENTS OF MEMBERS OF CONGRESS

Hon. Peter A. DeFazio, a Representative in Congress from the 
  State of Oregon, and Chair, Committee on Transportation and 
  Infrastructure:

    Opening statement............................................     1
    Prepared statement...........................................     4
Hon. Sam Graves, a Representative in Congress from the State of 
  Missouri, and Ranking Member, Committee on Transportation and 
  Infrastructure:

    Opening statement............................................     6
    Prepared statement...........................................     7
Hon. Rick Larsen, a Representative in Congress from the State of 
  Washington, and Chair, Subcommittee on Aviation:

    Opening statement............................................     7
    Prepared statement...........................................     8
Hon. Garret Graves, a Representative in Congress from the State 
  of Louisiana, and Ranking Member, Subcommittee on Aviation:

    Opening statement............................................     8
    Prepared statement...........................................    10
Hon. Eddie Bernice Johnson, a Representative in Congress from the 
  State of Texas, prepared statement.............................   153
Hon. Frederica S. Wilson, a Representative in Congress from the 
  State of Florida, prepared statement...........................   153

                               WITNESSES
                                Panel 1

Hon. Stephen M. Dickson, Administrator, Federal Aviation 
  Administration, accompanied by Earl Lawrence, Executive 
  Director, Aircraft Certification Service, Federal Aviation 
  Administration:

    Oral statement of Hon. Dickson...............................    11
    Prepared statement of Hon. Dickson...........................    13
Matthew Kiefer, Member, Technical Advisory Board:

    Oral statement...............................................    16
    Prepared statement...........................................    18

                                Panel 2

Edward F. Pierson, Former Senior Manager, Boeing, appearing in 
  his individual capacity:

    Oral statement...............................................    72
    Prepared statement...........................................    74
G. Michael Collins, Former Aerospace Engineer, Federal Aviation 
  Administration, appearing in his individual capacity:

    Oral statement...............................................   113
    Prepared statement...........................................   114
Mica R. Endsley, Ph.D., appearing on behalf of the Human Factors 
  and Ergonomics Society:

    Oral statement...............................................   118
    Prepared statement...........................................   120
John M. Cox, Chief Executive Officer, Safety Operating Systems:

    Oral statement...............................................   133
    Prepared statement...........................................   135

                       SUBMISSIONS FOR THE RECORD

Slides, Submitted by Hon. DeFazio:

    Slide based on FAA's post-Lion Air ``Quantitative Risk 
      Assessment,'' Dec. 3, 2018 



    Slide based on United Airlines flight 232 crash of DC-10 on 
      July 18, 1989, in Sioux City, IA...........................    22
    Slide based on crashes of 1989 USAir flight 5050 and 2008 
      Continental Airlines flight 1404...........................    22
    Slide based on Boeing's MCAS ``Coordination Sheet,'' dive 
      recovery, June 11, 2018....................................    59
    Slide of letter from then-FAA Acting Administrator Dan Elwell 
      to Chair DeFazio regarding 737 MAX AOA Disagree Alert, July 
      11, 2019...................................................    66
    Slide based on Boeing's MCAS ``Coordination Sheet,'' 10 
      seconds catastrophic, June 11, 2018........................    68
Lists A and B, Submitted by Hon. DeFazio:

    9/11/2015 EASA letter to FAA.................................   155
    3/21/1997 Issue Paper........................................   157
    2/11/2015 FAA Letter to Boeing...............................   162
    FAA-DeFazio--28834-28842 TAD Corrective Action Review Board 
      (CARB) Presentation Form...................................   165
    FAA-DeFazio--28843-28860 Safety Review Board information.....   174
    FAA-DeFazio--32891-32938 Presentation: BCA Airplane Programs, 
      Organization Designation Authorization Technical Review 
      Board......................................................   192
Article of October 7, 2019, ``Airline Went Into Records After MAX 
  Crash, Engineer Says,'' by Bernard Condon, Submitted by Hon. 
  Perry..........................................................    34

                                APPENDIX

Questions from Hon. Peter A. DeFazio for Hon. Stephen M. Dickson, 
  Administrator, Federal Aviation Administration.................   241
Questions from Hon. Frederica S. Wilson for Hon. Stephen M. 
  Dickson, Administrator, Federal Aviation Administration........   253
Questions from Hon. Andre Carson for Hon. Stephen M. Dickson, 
  Administrator, Federal Aviation Administration.................   255
Questions from Hon. Brian K. Fitzpatrick for Hon. Stephen M. 
  Dickson, Administrator, Federal Aviation Administration........   256
Questions from Hon. Paul Mitchell for Hon. Stephen M. Dickson, 
  Administrator, Federal Aviation Administration.................   256
Questions from Hon. Peter A. DeFazio for G. Michael Collins, 
  Former Aerospace Engineer, Federal Aviation Administration, 
  appearing in his individual capacity...........................   257
Questions from Hon. Peter A. DeFazio for Mica R. Endsley, Ph.D., 
  appearing on behalf of the Human Factors and Ergonomics Society   262
Questions from Hon. Frederica S. Wilson to John M. Cox, Chief 
  Executive Officer, Safety Operating Systems....................   263
Questions from Hon. Conor Lamb to John M. Cox, Chief Executive 
  Officer, Safety Operating Systems..............................   264


 
           
  THE BOEING 737 MAX: EXAMINING THE FEDERAL AVIATION ADMINISTRATION'S 
               OVERSIGHT OF THE AIRCRAFT'S CERTIFICATION

                              ----------                              


                      WEDNESDAY, DECEMBER 11, 2019

             U.S. House of Representatives,
    Committee on Transportation and Infrastructure,
                                            Washington, DC.
    The committee met, pursuant to notice, at 10:02 a.m., in 
room 2167, Rayburn House Office Building, Hon. Peter A. DeFazio 
(Chairman of the committee) presiding.
    Mr. DeFazio. The committee will come to order.
    I ask unanimous consent the chair be authorized to declare 
recesses during today's hearing. Without objection, so ordered.
    I ask unanimous consent the chair and ranking member of the 
full committee be recognized for 10 minutes each during the 
question rounds. Without objection, so ordered.
    Before I begin, and similar to the previous hearing on the 
737 MAX with the CEO of Boeing testifying in October, I want to 
explain an administrative matter regarding some documents we 
may use at today's hearing. I will be making two unanimous 
consent requests in reference to two document lists, List A, 
List B.
    First, the documents contained on List B are marked 
``Export Controlled''; apparently, FAA stamps everything Export 
Controlled. We have been advised by House general counsel that 
the Constitution provides ample authority for us to release 
these documents. However, to prevent confusion with regards to 
documents with Export Controlled markings on them, I will be 
making unanimous consent requests regarding the release of 
these documents pursuant to the Export Control Act.
    Second, I will be making a unanimous consent request to 
enter the documents on List A into the hearing record. This 
list includes the Export Controlled documents on List B as well 
as additional documents. We have made the ranking member's 
staff aware of the documents from both lists. The documents 
have been available to them.
    And with that, I would ask unanimous consent that the 
documents on List B be disclosed pursuant to 50 U.S.C. section 
4820(h)(2)(B)(ii) because withholding such information is 
contrary to the national interest. Hearing no objection, so 
ordered.
    In addition, I ask unanimous consent to enter all the 
documents on List A into the hearing record. Without objection, 
so ordered.
    [Lists A and B are on pages 154-239.]
    I now recognize myself for opening remarks.
    I want to thank our witnesses for being here today. This is 
the committee's fifth hearing on the design, development and 
certification of the Boeing 737 MAX in response to two 
catastrophic crashes that claimed 346 lives in the span of 5 
months.
    Once again, I would like to recognize the family members of 
those killed, some of whom are here today, and our thoughts are 
with you, as always. And we are here to ensure that the lives 
of your family members were not lost in vain and without 
response.
    You can be sure this committee will continue to be 
aggressive in our oversight efforts to determine what went so 
horribly wrong and why, and we will not rest until we have 
enacted legislation to prevent future unairworthy airplanes 
from slipping through regulatory cracks and into airline 
service.
    In November 2018, a few days after a powerful system 
running in the background of the 737 MAX called MCAS pushed 
Lion Air flight 610 into an unrecoverable dive, the FAA issued 
an emergency airworthiness directive that purported to inform 
pilots on how to respond to an erroneous activation of MCAS, 
while it actually never mentioned that system by name. In fact, 
during the certification of the 737 MAX, Boeing actively pushed 
the FAA to remove references to MCAS from the flight crew 
operating manual, as revealed in the emails and instant 
messages from Boeing executive Mark Forkner, which Boeing 
initially failed to provide to the committee. The FAA accepted 
Boeing's push, and Forkner went on to boast that he was ``Jedi 
mind-tricking'' other civil aviation regulators around the 
world to adopt the FAA's faulty decision.
    But perhaps most chillingly, we have learned that shortly 
after the issuance of the airworthiness directive, the FAA 
performed an analysis that concluded that if left uncorrected, 
the MCAS design flaw in the 737 MAX could result in as many as 
15 future fatal crashes over the life of the fleet, with the 
assumption, which is questionable, that 99 out of 100 flight 
crews could comply with the airworthiness directive and 
successfully react to the cacophony of alarms and alerts 
recounted in the National Transportation Safety Board's report 
on the Lion Air tragedy within 10 seconds. Such an assumption, 
we know now, was tragically wrong, and it certainly did not 
meet FAA's criteria of 10 to the minus 9.
    Despite its own calculations, the FAA rolled the dice on 
the safety of the traveling public and let the MAX continue to 
fly until Boeing could overhaul its MCAS software. Tragically, 
the FAA's analysis--which never saw the light of day beyond the 
closed doors of the FAA and Boeing--was correct. And the next 
crash, taking more lives, was 5 months later, Ethiopian 
Airlines flight 302, March 2019.
    The committee's investigation into the two 737 MAX crashes 
was launched just days after the second accident in March. We 
have received more than half a million pages of documents from 
Boeing, the FAA, and other parties that staff continues to 
analyze. And that does not even include numerous emails from 
the FAA that we have requested. We just received a large batch 
on Monday night in response to our April request. And others 
have yet to be provided.
    We have interviewed and spoken with FAA employees and 
Boeing whistleblowers, among others. These documents, emails, 
and interviews are crucial to our investigation, which has 
uncovered a broken safety culture within Boeing and an FAA that 
was unknowing, unable, or unwilling to step up, regulate, and 
provide appropriate oversight of Boeing. The FAA failed to ask 
the right questions and failed to adequately question the 
answers that agency staff received from Boeing.
    Our investigation has revealed that many of the FAA's own 
technical experts and safety inspectors believe FAA's 
management often sides with Boeing rather than standing up for 
the safety of the public. Mr. Dickson, I have read your 
testimony. I appreciate the tenor and the substance of your 
remarks. I commend your commitment to cultivating a just 
culture among FAA employees, and ensuring that they have the 
analysis and tools necessary to make the right decisions in the 
name of safety.
    But our investigation to date has established that FAA 
employees did not have the analysis and tools necessary to make 
the right decisions in the case of the 737 MAX. These safety 
specialists need your support. There is no imaginable situation 
in which they should be jammed or subjected to end runs by 
Boeing to their managers. I expect you and your subordinates to 
back them up, to defend their reasonable decisions based on 
technical evidence and mandated compliance with FAA regulations 
on safety.
    Boeing made egregious errors, including the furtive 
implementation of MCAS while knowing it could present a 
catastrophic risk. The FAA also failed to do its job. It didn't 
provide the regulatory oversight necessary to ensure the safety 
of the flying public. The FAA trusted, but did not 
appropriately verify, key information and assumptions Boeing 
presented to the agency about the MAX. And this was at a time 
when Boeing's own employees, as we learned at our last hearing, 
reported they perceived undue pressure from management.
    We are trying to figure out what went wrong here, fix it 
legislatively, and not ever allow something like this to happen 
again. In that spirit, on this panel we will hear from 
Administrator Steve Dickson and a member of the review panel 
that is assessing remedial changes to the MAX design.
    Mr. Dickson, as I said, I appreciate what I read in your 
testimony about your approach for improved safety. But I will 
still have some tough questions for you, and I hope to hear 
from you about what the FAA has identified as faults and 
failures in the certification of the MAX, the FAA process 
generally, and what concrete steps you have taken to date to 
correct them. I also appreciate your commitment that the 737 
MAX will not take flight again until you and your employees 
responsible for overseeing Boeing and certifying its MCAS 
overhaul are 100 percent confident in its safety.
    On our second panel we will hear from two former FAA and 
Boeing employees as well as two well-respected experts in the 
fields of aviation safety and human factors for their 
perspectives on the faulty design. And we will hear from a 
Boeing whistleblower, FAA whistleblower, and a former employee 
of Boeing.
    So therefore, I want to be certain, Mr. Dickson, that--I 
worked for a number of years, and it was only after people died 
in the ValuJet crash that I stripped FAA of its promotional 
responsibility, which was an artifact from the dawn of the 
commercial aviation era. And I want to be certain that that has 
not crept back in.
    If the industry needs promotion, the Commerce Department 
can do it or they can do it themselves. You and your people are 
there for one reason and one reason only, to assure the safety 
of the flying public. And I look forward to your testimony 
today.
    [Mr. DeFazio's prepared statement follows:]

                                 
   Prepared Statement of Hon. Peter A. DeFazio, a Representative in 
     Congress from the State of Oregon, and Chairman, Committee on 
                   Transportation and Infrastructure
    Thank you to our witnesses for being here today. This is the 
Committee's fifth hearing on the design, development and certification 
of the Boeing 737 MAX in response to two catastrophic crashes that 
claimed 346 lives in the span of five months.
    Once again, I'd like to recognize the family members of those 
killed in these preventable crashes, some of whom are here today. Our 
thoughts are with you all. We are here to ensure that the lives of your 
family members were not lost in vain.
    You can be sure this Committee will continue to be aggressive in 
our oversight efforts to determine what went so horribly wrong and why, 
and we will not rest until we have enacted legislation to prevent 
future unairworthy airplanes from slipping through the regulatory 
cracks and into airline service.
    In November 2018, a few days after a powerful system running in the 
background of the 737 MAX called MCAS pushed Lion Air flight 610 into 
an unrecoverable dive, the FAA issued an emergency airworthiness 
directive that purported to inform pilots on how to respond to an 
erroneous activation of MCAS, while never actually mentioning that 
system by name. In fact, during the certification of the 737 MAX, 
Boeing actively pushed the FAA to remove references to MCAS from the 
flight crew operating manual, as revealed in the e-mails and instant 
messages from Boeing executive Mark Forkner, which Boeing initially 
failed to provide to the Committee. The FAA accepted Boeing's push, and 
Forkner went on to boast that he was ``Jedi mind-tricking'' other civil 
aviation regulators to adopt the FAA's faulty decision.
    But perhaps most chillingly, we have learned that shortly after the 
issuance of the airworthiness directive, the FAA performed an analysis 
that concluded that, if left uncorrected, the MCAS design flaw in the 
737 MAX could result in as many as 15 future fatal crashes over the 
life of the fleet--and that was assuming that 99 out of 100 flight 
crews could comply with the airworthiness directive and successfully 
react to the cacophony of alarms and alerts recounted in the National 
Transportation Safety Board's report on the Lion Air tragedy within 10 
seconds. Such an assumption, we know now, was tragically wrong.
    Despite its own calculations, the FAA rolled the dice on the safety 
of the traveling public and let the 737 MAX continue to fly until 
Boeing could overhaul its MCAS software. Tragically, the FAA's 
analysis--which never saw the light of day beyond the closed doors of 
the FAA and Boeing--was correct. The next crash would occur just five 
months later, when Ethiopian Airlines flight 302 plummeted to earth in 
March 2019.
                        update on investigation
    The Committee's investigation into the two 737 MAX crashes was 
launched just days after the second accident in March, and we have 
received more than half a million pages of documents from Boeing, the 
FAA and other parties that my staff continues to analyze. And that 
doesn't even include numerous emails from the FAA that we have 
requested; we just received a large batch on Monday night in response 
to our April request. And others are yet to be provided.
    We have interviewed or spoken with FAA employees and Boeing 
whistleblowers, among others. These documents, email and interviews are 
crucial to our investigation, which has uncovered a broken safety 
culture within Boeing and an FAA that was unknowing, unable or 
unwilling to step up, regulate, and provide appropriate oversight of 
Boeing. The FAA failed to ask the right questions and failed to 
adequately question the answers that agency staff received from Boeing.
    Our investigation has revealed that many of the FAA's own technical 
experts and safety inspectors believe FAA's management often sides with 
Boeing rather than standing up for the safety of the public. Mr. 
Dickson, I have read your testimony and appreciate the tenor and 
substance of your remarks. I commend your commitment to cultivating a 
just culture among FAA employees--and ensuring that they have the 
analysis and tools necessary to make the right decisions in the name of 
safety. But our investigation to date has established that FAA 
employees did not have the analysis and tools necessary to make the 
right decisions in the case of the 737 MAX. These safety specialists 
need your support. There is no imaginable situation in which they 
should be jammed or subjected to end-runs by Boeing to their managers. 
I expect you and your subordinates to back them up: to defend their 
reasonable decisions based on technical evidence and mandated 
compliance with FAA regulations in the interest of safety.
    Boeing made egregious errors, including the furtive implementation 
of MCAS while knowing it could present a ``catastrophic'' risk. The FAA 
also failed to do its job. It failed to provide the regulatory 
oversight necessary to ensure the safety of the flying public. The FAA 
trusted, but did not appropriately verify, key information and 
assumptions Boeing presented to the agency about the 737 MAX. And this 
was at a time when Boeing's own employees, as we learned at our last 
hearing, reported they perceived ``undue pressure'' from management.
                           purpose of hearing
    We are striving to understand what went wrong here and what we need 
to fix legislatively. Our goal is to prevent a future unsafe airplane 
design from slipping through the cracks and exposing millions of 
airline passengers to an unacceptable risk.
    In that spirit, on our first panel, we will hear from FAA 
Administrator Steve Dickson and a member of the review panel that is 
assessing remedial changes to the 737 MAX design.
    Mr. Dickson, I appreciate what I read in your testimony about your 
approach to improving safety. But, I will have some tough questions for 
you, and I hope to hear from you about what the FAA has identified as 
faults and failures in the certification of the 737 MAX and FAA 
processes generally--and what concrete steps you have taken to date to 
correct them. I also appreciate your commitment that the 737 MAX will 
not take flight again until you--and your employees responsible for 
overseeing Boeing and certifying its MCAS overhaul--are 100 percent 
confident in its safety.
    On our second panel, we will hear from two former FAA and Boeing 
employees as well as two well-respected experts in the fields of 
aviation safety and human factors for their perspectives on the faulty 
design of this airplane.
                             undue pressure
    On our second panel we'll hear from an FAA whistleblower that 
Boeing applied undue pressure on FAA managers to overrule those 
managers' own safety engineers and experts on safety-critical matters. 
According to information provided to the Committee, FAA safety 
engineers determined that an uncontained engine failure on a 737 MAX 
could send shrapnel through the rudder control cables. And in a high-
thrust, low-energy situation such as initial climb off the runway--or 
even during the takeoff roll--the pilots would likely lose control of 
the airplane. But the FAA dismissed this concern. We need to know why.
    Chair Larsen and I wrote Administrator Dickson about this issue 
early last month, and on Friday afternoon we finally received a 
response. However, your response still doesn't explain how the 
unanimous judgment of more than a dozen FAA safety experts was 
overruled by a single manager. On what data was that manager relying? I 
am glad that one of our witnesses on the second panel was directly 
involved in the rudder cable issue while he was at FAA so we can get 
his straightforward perspective on this issue based on his nearly three 
decades of experience at the agency.
                         promotion of industry
    In 1996, I pushed to remove the FAA's statutory mandate to 
``promote'' the civil aviation industry following the ValuJet flight 
592 accident. That's why I'm particularly concerned this investigation 
has produced rumors that some people within the FAA either feel it's 
their role to facilitate the U.S. aviation industry's agenda, or feel 
pressure from outside or from above to do so.
    I want Administrator Dickson's absolute assurance today that he and 
Deputy Administrator Dan Elwell will clearly and frequently communicate 
to the FAA workforce--and to the industry--that the work of every 
single FAA employee must be in the service of one and only one 
objective: preserving aviation safety.
    Let the industry promote itself. If it needs help in that effort, 
I'm sure the Commerce Department is happy to oblige. Your job, 
Administrator Dickson, is to regulate. The only thing you should be 
promoting is the highest possible level of safety.
    Millions of lives are at stake. We have to get this right. We will 
be changing the certification laws to ensure the 346 lives lost in 
Ethiopia and in the Java Sea were not lost in vain.
    I look forward to hearing from our witnesses about how we can 
accomplish that goal. Thank you.

    Mr. DeFazio. With that, I would yield to the ranking 
member.
    Mr. Graves of Missouri. Thank you, Mr. Chairman. I want to 
add my comments and recognize the families and the friends of 
the accident victims. We have not forgotten your losses. And I 
am sure that we all share the same goal, and that is ensuring 
that our system remains the number one system in the world and 
the safest system in the world.
    This is the fifth hearing on Boeing and the tragic 
accidents that the committee has held in 8 months. In addition, 
there are at least a dozen other reviews and investigations 
that are ongoing. Some of them, I will say, have been completed 
recently, and we are fortunate to have one of the 
representatives from the Technical Advisory Board, or the TAB, 
that is going to be with us today. And I am pleased that the 
committee is going to hear from him on the TAB's ongoing work 
to independently evaluate the Boeing software fix.
    Collectively, I am confident that these expert reviews are 
going to provide us with the insights that we need to keep our 
aviation system the safest in the world. Today the majority has 
invited the current FAA leaders to testify, and while they can 
address the FAA's efforts since the two accidents, they were 
not in charge for that 5 years between 2012 and 2017 when the 
MAX certification process and approvals took place.
    And until we hear from the officials that were in charge at 
the time, then the investigation remains incomplete at best, 
and at worst it looks like we are willing to overlook the past 
administration's culpability in this matter. Now, having said 
that, as I have said many, many times, should the 
investigations reveal problems within the certification 
process, then I think Congress can and they should act, or we 
should act, accordingly.
    We have to ensure that we have the benefit of all expert 
reviews and investigations that are still underway, and focus 
on the facts and the data from those reviews. And when it comes 
to aviation safety, I do believe we have to leave out the 
partisanship and the ``gotcha'' moments. And I know 
Administrator Dickson and his team and the thousands of FAA 
professionals are all dedicated to aviation safety and 
improving any process that needs improvement.
    And I look forward to hearing what the Administrator is 
doing with the recommendations that have already been received 
and his own observations since, within the last year, taking 
leadership of the FAA. And I, along with the Republicans on 
this committee, am committed to addressing any problems 
discovered in the process and working with the chairman in a 
very bipartisan effort.
    And I have said this before, too, and it bears repeating. 
As a professional pilot myself, I still believe that the FAA 
remains the gold standard in the world for safety. Air travel 
is the safest mode of transportation in history. And when the 
FAA clears the 737 MAX to fly again, it is going to be safe to 
fly. There is no doubt in my mind.
    Working to ensure our aviation safety system improves is 
always the right goal, and we have a responsibility to do that 
together. And with that, I look forward to today's hearing, and 
would yield back the balance.
    [Mr. Graves of Missouri's prepared statement follows:]

                                 
  Prepared Statement of Hon. Sam Graves, a Representative in Congress 
     from the State of Missouri, and Ranking Member, Committee on 
                   Transportation and Infrastructure
    Thank you, Mr. Chairman. I want to recognize the families and 
friends of the accident victims. We have not forgotten your losses, and 
I assure you we all share the same goal--ensuring our system remains 
the safest in the world.
    This is the fifth hearing on Boeing and the tragic accidents that 
the Committee has held in eight months. In addition, there are at least 
a dozen other reviews and investigations--some that have been completed 
recently. We are fortunate to have a representative from the Technical 
Advisory Board (TAB) with us today. I am pleased that the Committee 
will hear from him on the TAB's ongoing work to independently evaluate 
Boeing's software fix. Collectively, I am confident that these expert 
reviews will provide us with the insights we need to keep our aviation 
system the safest in the world.
    Today the Majority has invited current FAA leaders to testify. 
While they can address FAA's efforts since the two accidents, they were 
not in charge between 2012 and 2017 when the MAX certification 
processes and approvals took place. Until we hear from the officials in 
charge at the time, the Majority's investigation remains incomplete at 
best and at worst looks as if they are willing to overlook the past 
Administration's culpability in the matter.
    As I have said many times, should the investigations reveal 
problems with the certification process, Congress can and should act 
accordingly. However, we must ensure that we have the benefit of all 
the expert reviews and investigations still underway and focus on the 
facts and data from those reviews. When it comes to aviation safety, we 
must leave out partisanship and avoid ``gotcha'' moments.
    I know that Administrator Dickson, his team, and the thousands of 
FAA professionals are all dedicated to aviation safety and improving 
any processes that need improvement. And I look forward to hearing what 
the Administrator is doing with the recommendations he has already 
received and his own observations since taking over leadership of the 
FAA.
    I, along with all Republicans on the Committee, am committed to 
addressing any problems discovered in the process and working with the 
Chairman in a bipartisan fashion. I have said it before, and it bears 
repeating, as a professional pilot I still believe that the FAA remains 
the gold standard for safety. Air travel is the safest mode of 
transportation in history, and when the FAA clears the 737 MAX to fly 
again, it will be safe to fly. Working to ensure that our aviation 
safety system improves is always the right goal. We have a 
responsibility to do that together.

    Mr. DeFazio. I thank the gentleman.
    The subcommittee chair, Representative Larsen.
    Mr. Larsen. Thank you, Chair DeFazio. My comments will be 
relatively brief because I released a video statement 
yesterday, and I commend folks to that video statement for my 
full comments. But I do want to summarize it.
    With today's hearing, the committee does reach another 
milestone in its investigation. It is increasingly clear the 
process by which the FAA evaluates and certifies aircraft is 
itself in need of repair. Congress must reevaluate and improve 
the current certification process to ensure the safety of the 
flying public.
    As this critical oversight work continues, the 346 lives 
tragically lost in the Lion Air and Ethiopian Airlines crashes 
will remain at the forefront of these efforts. Several of the 
family members of the victims are here today, and I extend my 
deepest condolences to you and your loved ones. Your advocacy 
makes a difference.
    The FAA must fix its credibility problem. Just like I asked 
Boeing CEO Dennis Muilenburg at the committee's last hearing, 
today I expect to hear from the FAA the three main mistakes the 
FAA itself made regarding the 737 MAX, and the specific steps 
the agency is taking to restore public confidence. I also look 
forward to hearing about the TAB's progress as it looks over 
the FAA's shoulder as the agency works on a return to service 
decision.
    From today's second panel, the two former Boeing and FAA 
employees are providing an important perspective on 
questionable management decisionmaking that seemed to 
prioritize economic interests over public safety. Further, I am 
interested in learning more from the safety experts on the 
panel about the integration of human factors as aviation 
technology becomes increasingly automated. Airplanes are 
changing, but the Federal Government and certification is not 
changing with those airplanes.
    Though 2019 is coming to an end, the committee's 
investigation is far from over. The committee will continue to 
maintain safety as the guiding principle and use all available 
tools to ensure the safety of the traveling public. With that, 
thank you, and I yield back.
    [Mr. Larsen's prepared statement follows:]

                                 
 Prepared Statement of Hon. Rick Larsen, a Representative in Congress 
  from the State of Washington, and Chairman, Subcommittee on Aviation
    Thank you, Chair DeFazio.
    With today's hearing, the Committee reaches another milestone in 
its investigation.
    It is increasingly clear the process by which the FAA evaluates and 
certifies aircraft is itself in need of repair.
    Congress must reevaluate and improve the current certification 
process to ensure the safety of the flying public.
    As this critical oversight work continues, the 346 lives tragically 
lost in the Lion Air and Ethiopian Airlines crashes will remain at the 
forefront of these efforts.
    Several of the family members of the victims are here today. I 
extend my deepest condolences to you and your loved ones. Your advocacy 
makes a difference.
    The FAA must fix its credibility problem. Just like I asked Boeing 
CEO Dennis Muilenburg at the Committee's last hearing, I expect to hear 
the three main mistakes the FAA made regarding the 737 MAX and the 
specific steps the agency is taking to restore public confidence.
    I also look forward to hearing about the TAB's progress as it looks 
over the FAA's shoulder as the agency works on a return to service 
decision.
    From today's second panel, the two former Boeing and FAA employees 
are providing an important perspective on questionable management 
decision-making that seem to prioritize economic interests over public 
safety.
    Further, I am interested in learning more from the safety experts 
on the panel about the integration of human factors as aviation 
technology becomes increasingly automated. Airplanes are changing, but 
the federal government and certification is not changing with those 
planes.
    Though 2019 is coming to an end, the Committee's investigation is 
far from over.
    The Committee will continue to maintain safety as the guiding 
principle and use all available tools to ensure the safety of the 
traveling public.
    Thank you, I yield back.

    Mr. DeFazio. I thank the gentleman.
    With that, I recognize the ranking member of the 
subcommittee, Mr. Graves from Louisiana.
    Mr. Graves of Louisiana. Thank you, Mr. Chairman.
    First I want to thank the families for being at the hearing 
today, our fifth hearing on the MAX. As I have said at every 
previous hearing and I am going to say again today, your 
efforts remind us that this is about people. It is not about 
Government bureaucracy process. It is about people and safety. 
And I want to thank you all for your advocacy efforts 
throughout this process.
    Mr. Chairman, we are on our fifth hearing today, and there 
are extraordinary efforts underway to ensure that we are able 
to extract every single lesson that we can from the 737 MAX 
disasters. As some have noted, the ongoing investigations are 
investigations that have completed:
    The Special Committee of the Safety Oversight and 
Certification Advisory Committee; the Joint Authorities 
Technical Review, or the JATR; the Technical Advisory Board, or 
the TAB; the Flight Standardization Board; Boeing board of 
directors Committee on Airplane Policies and Processes; the 
National Transportation Safety Board, the NTSB; this very 
committee--the majority has an investigation underway. We have 
the Department of Transportation's inspector general. We have 
the Department of Justice criminal investigation. We have the 
Securities and Exchange Commission investigation, and others, 
and the Indonesian and the Ethiopian authorities as well. So 
multiple investigations. A lot going on.
    Today at this hearing we have the Administrator of the FAA, 
and Mr. Dickson, thanks for being here. As I recall, you have 
been on the job for 4 months. And so you are here to talk right 
now about, I guess, path forward--where we are, what we have 
learned, and path forward.
    In the second panel we have a number of folks, including 
quasi-whistleblowers. And I want to be clear: I am not being 
derogatory. As I understand, they have not sought official 
whistleblower status, but folks that sort of played that role 
of whistleblowers. And so we have folks that were there, 
intimately involved in the process, perhaps, and they are able 
to shed some light on what was going on on the ground.
    So we have someone, the Administrator, who is the current 
Administrator and he has been there for 4 months. We have folks 
that were involved in the process on the ground that are, 
again, somewhat whistleblower status. What we do not have, and 
what we have not had in any of these hearings, are the people 
that actually made the decisions back when--this process when 
the aircraft was being certified. There is a gap in this 
hearing, and Ranking Member Graves and I have requested over 
and over again that we fill that void.
    Look. I can go through, and I can say all these acronyms, 
and I can talk about all these investigations. But if we don't 
have the full slate of understanding of what is going on here, 
then we are at risk of making decisions that don't have the 
full view. And I have no desire whatsoever to sit here and rub 
somebody's face in the ground. I don't.
    But I do, and I made a commitment to those folks and I am 
going to fulfill it--I do want to make sure that we understand 
everything that happened and we don't allow mistakes to be made 
again. We need to learn from the mistakes, and we need to learn 
from the successes, and we need to build upon both of those.
    And so I do hope, as we continue this process, as we move 
forward in this investigation, that we fill that void and we 
understand what has happened every step of the way, and that we 
are able to make decisions that truly yield the safest, the 
absolute safest, aviation system possible, and that we are able 
to ensure that passengers on airlines, domestic and foreign, 
that they will continue to be flying on the safest means of 
transportation available.
    So I want to thank you again for being here. I want to 
thank you and many folks behind you and under you for all of 
the work that you all have done to get us to where we are. I 
think everyone knows what our end zone is, what our end goal 
is, and that is to ensure that we prevent and we work to 
prevent, absolute perfection. And I look forward to hearing 
your testimony as well as that of the second panel. I yield 
back.
    [Mr. Graves of Louisiana's prepared statement follows:]

                                 
Prepared Statement of Hon. Garret Graves, a Representative in Congress 
   from the State of Louisiana, and Ranking Member, Subcommittee on 
                                Aviation
    Thank you, Mr. Chairman, for calling today's hearing. I also want 
to thank the families and loved ones of the victims of Lion Air Flight 
610 and Ethiopian Airlines Flight 302 for being here. Your efforts 
continue to remind us that this isn't about government and bureaucracy, 
it's about people and safety.
    This is our fifth Boeing 737 MAX-related hearing of the year, and 
there are extraordinary efforts underway to ensure we extract every 
lesson we can from the accidents. Those efforts include the 
investigations of the Special Committee of the Safety Oversight and 
Certification Advisory Committee, the Joint Authorities Technical 
Review, the Technical Advisory Board, the Flight Standardization Board, 
the Boeing board of directors committee on airplane policies and 
processes, the National Transportation Safety Board, this committee's 
majority's investigation, the Department of Transportation Inspector 
General, the Department of Justice criminal investigation, the 
Securities and Exchange Commission investigation, and the Indonesian 
and Ethiopian authorities' investigations.
    Today, we will hear from Administrator Dickson, who's been on the 
job for four months, and a member of the Technical Advisory Board to 
talk about what we've learned and the path forward. We will also hear 
from some witnesses who have worked inside the certification system on 
the ground.
    No matter what angle you look at these issues from, safety is 
everyone's end goal. I'm worried that the Majority's investigation 
seems to be taking a turn in a direction I don't believe is helpful and 
could be harmful to the shared goal of safety. It seems more and more 
that the investigation is about trying to paint our aviation system as 
corrupt or broken. I believe strongly that nothing can be further from 
the truth. There's a difference between learning hard truths about 
where we have fallen short or needing to improve and undermining a 
system that has kept billions of people safe over the years. Let's make 
sure we keep our system the safest in the world.
    What we don't have today, and haven't had in any of these hearings 
yet, are the FAA officials who made any of the decisions back when the 
aircraft was being certified. That creates a gap in the hearing record, 
and Ranking Member Graves and I have requested repeatedly that we fill 
that void.
    I am committed to doing everything we can to make sure we learn 
from any mistakes, but if we don't have a full understanding of what 
happened, then we're at risk of making uninformed decisions about how 
to ensure we have the absolute safest system possible.

    Mr. DeFazio. I thank the gentleman.
    Before I begin my questions, I would observe we have been 
asking since we received our first tranche of emails from FAA 
and Boeing to interview career staff who are the people who 
made the decisions at the FAA. And until recently, with the new 
Administrator, we were being stonewalled and being told, no, 
you can't talk to the line employees who raised concerns. You 
can only talk to managers.
    And that has changed with this Administrator, and we have 
interviews scheduled with the people who actually made the 
decisions. If we find that it went higher than that, we will 
call those people. But we just spent 7 hours jointly, 
Republican and Democratic staff, questioning the current head 
of safety, who was there when this document was issued about 
the probability of another crash, and says he wasn't aware of 
that and he wasn't aware of anything that went on.
    So I don't know how high up this went, and I think that is 
one of the problems and that is one of the things we have got 
to look at. I think most of these decisions were made by 
captive regulator managers in the Seattle offices, and no one 
in the national offices knew a damned thing about it. So we are 
going to get to the bottom of this. And if it goes any higher 
than that, we will have those people.
    So with that, I will recognize myself for questions.
    Mr. Graves of Missouri. Statements.
    Mr. DeFazio. Oh, I forgot. Thank you. Thank you. Thank you. 
Thank you. I got carried away there.
    [Laughter.]
    Mr. DeFazio. Mr. Administrator.

 TESTIMONY OF HON. STEPHEN M. DICKSON, ADMINISTRATOR, FEDERAL 
    AVIATION ADMINISTRATION, ACCOMPANIED BY EARL LAWRENCE, 
  EXECUTIVE DIRECTOR, AIRCRAFT CERTIFICATION SERVICE, FEDERAL 
AVIATION ADMINISTRATION; AND MATTHEW KIEFER, MEMBER, TECHNICAL 
                         ADVISORY BOARD

    Mr. Dickson. Thank you, Mr. Chairman. Good morning, 
Chairman DeFazio, Ranking Member Graves, and members of the 
committee. Thank you for inviting me here today to speak with 
you about the Federal Aviation Administration's approach to 
safety oversight, and to provide you with an update concerning 
the Boeing 737 MAX.
    With me today is Mr. Earl Lawrence, the Executive Director 
of the FAA's Aircraft Certification Service since December of 
2018.
    When we fly anywhere in the world, we enjoy a certainty of 
safety that is unrivaled in the modern transportation era. That 
is because the FAA and the world's aviation regulators 
understand that the success of the global aviation system rests 
squarely on our shared commitment to safety and our common 
understanding of what it takes to achieve it.
    Together we have built a safety record that is the envy of 
other transportation modes, the healthcare field, and others. 
But we are humbled when our best efforts fail. On behalf of the 
United States Department of Transportation and the FAA, I would 
like to once again extend our deepest sympathy and condolences 
to the families of the victims of the Ethiopian Airlines and 
Lion Air accidents, and thank you for being here today.
    Deputy Administrator Dan Elwell and I have met with the 
family members and friends of those on board. We have seen 
their pain, their loss, and it reaffirms the seriousness with 
which we must approach safety every single day. That is why we 
are working tirelessly to ensure that the lessons learned from 
these terrible losses will result in a higher margin of safety 
for the aviation industry globally.
    For the 737 MAX return to service, the FAA fully controls 
the approvals process and is not delegating anything to Boeing. 
We will retain authority to issue airworthiness certificates 
and export certificates of airworthiness for all new 737 MAX 
airplanes manufactured since the grounding.
    When the 737 MAX is returned to service, it will be because 
the safety issues have been addressed and pilots have received 
all the training they need to safely operate the aircraft. This 
process is not guided by a calendar or schedule.
    Actions that must still take place include a certification 
flight test and completion of work by the Joint Operations 
Evaluation Board, which will include pilot training needs. 
Additionally, the FAA and the Technical Advisory Board, or TAB, 
will review the final design documentation. Finally, I am not 
going to sign off on this airplane until I fly it myself.
    Today's unprecedented safety record was built on the 
willingness of aviation professionals to embrace hard lessons 
and to proactively seek continuous improvement. In addition to 
this committee's investigation and other congressional efforts, 
we welcome the scrutiny and recommendations from several 
independent reviews.
    Included in these are:
    A Joint Authorities Technical Review, or JATR, that the FAA 
launched to conduct a comprehensive assessment of the MAX 
automated flight control system certification;
    The TAB we initiated to conduct an independent review of 
the proposed integrated system, training, and continued 
operational safety determination for the aircraft--and as an 
aside I would like to recognize and thank Mr. Matt Kiefer, to 
my left here, also testifying here this morning, for his work 
as a member of this board;
    Recommendations from the NTSB and the Indonesian accident 
report on Lion Air flight 610;
    The DOT's inspector general audit of the 737 MAX 
certification; and finally,
    A report from the Secretary's Special Committee on Aircraft 
Certification.
    We believe that transparency, open and honest 
communication, and our willingness to improve our systems and 
processes are the keys to restoring public trust in the FAA and 
the safety of the 737 MAX.
    Now, beyond the 737 MAX, the FAA is committed to addressing 
issues regarding aircraft certification processes not only in 
the United States but around the world. These issues include:
    Moving toward a more holistic versus transactional, item-
by-item approach to aircraft certification;
    Integrating human factors considerations more effectively 
throughout the design process; and
    Ensuring coordinated and flexible information flow during 
the FAA's oversight process.
    We and our international partners must also foster 
improvements in how aircraft are designed and produced, but 
also on how they are maintained and operated. We at the FAA are 
prepared to take the lead in this new phase of system safety.
    Aviation's hard lessons and the hard work in response to 
those lessons have paved the way to creating a global aviation 
system with an enviable safety record. But we recognize that 
safety is a journey, not a destination, and we must build on 
the lessons learned, and we must never allow ourselves to 
become complacent.
    Thank you, and this concludes my statement, and I am happy 
to take your questions.
    [The prepared statement of Mr. Dickson follows:]

                                 
 Prepared Statement of Hon. Stephen M. Dickson, Administrator, Federal 
                        Aviation Administration
    Chairman DeFazio, Ranking Member Graves, and Members of the 
Committee:
    Thank you for inviting me here today to speak with you about the 
Federal Aviation Administration's (FAA) approach to safety oversight 
and to provide you with an update concerning the Boeing 737 MAX. On 
behalf of the United States Department of Transportation and everyone 
at the FAA, I would like to, once again, extend our deepest sympathy 
and condolences to the families of the victims of the Ethiopian 
Airlines and Lion Air accidents. Deputy Administrator Dan Elwell and I 
have met with the family members and friends of those onboard. In these 
meetings, we have seen their pain, their loss, and it reaffirms the 
seriousness with which we must approach safety every single day. That 
is why we are working tirelessly to ensure that the lessons learned 
from these terrible losses will result in a higher margin of safety for 
the aviation industry globally.
    Accompanying me here today is Earl Lawrence. Mr. Lawrence is the 
Executive Director of the FAA's Aircraft Certification Service, where 
he is responsible for type certification, production approval, 
airworthiness certification, and continued airworthiness of the U.S. 
civil aircraft fleet including commercial and general aviation 
activities.
                Status of the 737 MAX Return-to-Service
    Safety is the core of the FAA's mission and is our first priority. 
We are working diligently to ensure that the type of accidents that 
occurred in Indonesia and Ethiopia--resulting in the tragic loss of 346 
lives--do not occur again. The FAA is following a thorough process for 
returning the 737 MAX to service. This process is not guided by a 
calendar or schedule. Safety is the driving consideration. I 
unequivocally support the dedicated professionals of the FAA in 
continuing to adhere to a data-driven, methodical analysis, review, and 
validation of the modified flight control systems and pilot training 
required to safely return the 737 MAX to commercial service. I have 
directed FAA employees to take whatever time is needed to do that work.
    With respect to our international partners, the FAA clearly 
understands its responsibilities as the State of Design for the 737 
MAX. In September, we met with more than 50 invited foreign civil 
aviation officials, all of whom have provided input to the FAA and will 
play a role in clearing the 737 MAX for flight in their respective 
nations. We are also conducting and planning a number of outreach 
activities, including providing assistance to support foreign 
authorities on return-to-service issues; maintaining transparency 
through communication and information sharing; and scheduling meetings 
for technical discussions.
    As I have stated before, the FAA's return-to-service decision on 
the 737 MAX will rest solely on the FAA's analysis of the data to 
determine whether Boeing's proposed software updates and pilot training 
address the known issues for grounding the aircraft. The FAA fully 
controls the approvals process for the flight control systems and is 
not delegating anything to Boeing. The FAA will retain authority to 
issue airworthiness certificates and export certificates of 
airworthiness for all new 737 MAX airplanes manufactured since the 
grounding. When the 737 MAX is returned to service, it will be because 
the safety issues have been addressed and pilots have received all of 
the training they need to safely operate the aircraft.
    Actions that must still take place before the aircraft will return 
to service include a certification flight test and completion of work 
by the Joint Operations Evaluation Board (JOEB), which is comprised of 
the FAA Flight Standardization Board (FSB) and our international 
partners from Canada, Europe, and Brazil. The JOEB will evaluate pilot 
training needs. The FSB will issue a report addressing the findings of 
the JOEB and the report will be made available for public review and 
comment. Additionally, the FAA will review all final design 
documentation, which also will be reviewed by the multi-agency 
Technical Advisory Board (TAB). The FAA will issue a Continued 
Airworthiness Notification to the International Community providing 
notice of pending significant safety actions and will publish an 
Airworthiness Directive advising operators of required corrective 
actions. Finally, I am not going to sign off on this aircraft until all 
FAA technical reviews are complete, I fly it myself using my experience 
as an Air Force and commercial pilot, and I am satisfied that I would 
put my own family on it without a second thought.
                  Oversight of Aircraft Certification
    Safety is a journey, not a destination--a journey we undertake each 
and every day with humility. Today's unprecedented U.S. safety record 
was built on the willingness of aviation professionals to embrace hard 
lessons and to proactively seek continuous improvement. The FAA both 
welcomes and invites scrutiny of our processes and procedures. In 
addition to this Committee's investigation, several independent reviews 
have been initiated to look at different aspects of the 737 MAX 
certification and the FAA's certification and delegation processes 
generally.
    The first review to be completed was one that the FAA 
commissioned--asking nine other civil aviation authorities to join the 
FAA in a Joint Authorities Technical Review (JATR) to conduct a 
comprehensive assessment of the certification of the automated flight 
control system on the 737 MAX. The JATR was chaired by former National 
Transportation Safety Board (NTSB) Chairman Christopher Hart and was 
comprised of a team of experts from the FAA, National Aeronautics and 
Space Administration (NASA), and the aviation authorities of Australia, 
Brazil, Canada, China, the European Union, Indonesia, Japan, Singapore, 
and the United Arab Emirates. Never before have 10 authorities come 
together to conduct this type of review. I thank the JATR members for 
their unvarnished and independent review and we welcome their 
recommendations.
    The FAA also initiated a TAB made up of FAA Chief Scientists and 
experts from the U.S. Air Force, NASA, and Volpe National 
Transportation Systems Center. The TAB's task is to conduct an 
independent review of the proposed integrated system, training, and 
continued operational safety determination for the 737 MAX. The TAB 
recently briefed me, and previously briefed this Committee, on their 
progress and the status of Boeing's and the FAA's responses to the 
return-to-service action items.
    Last month, the FAA received recommendations from the NTSB and the 
Indonesian National Transportation Safety Committee's accident report 
on Lion Air Flight 610. We are carefully evaluating the recommendations 
in both of these reports as we continue our review of the proposed 
changes to the 737 MAX. Work also continues on the Department of 
Transportation's Inspector General audit of the 737 MAX certification, 
as well as this Committee's investigation and other congressional 
reviews. Finally, we are also awaiting a report from the Secretary of 
Transportation's Special Committee on aircraft certification. This 
blue-ribbon panel was established earlier this year to advise and 
provide recommendations to the Department on policy-level topics 
related to certification across the manufacturer spectrum.
    We believe that transparency, open and honest communication, and 
our willingness to improve our systems and processes are the keys to 
restoring public trust in the FAA and in the safety of the 737 MAX when 
it is returned to service. The FAA is fully committed to addressing the 
recommendations from all of the various groups reviewing our 
certification processes. We will implement any changes that would 
improve our certification activities and increase safety. It would be 
premature, however, to discuss any changes concerning the FAA's 
certification processes or FAA's personnel at any level before this 
Committee's investigation and other ongoing reviews have concluded, and 
we have a chance to carefully analyze their results and 
recommendations.
                             Moving Forward
    Beyond the 737 MAX, the FAA is committed to addressing issues 
regarding aircraft certification processes not only in the United 
States, but around the world. These issues include:
      moving toward a more holistic versus transactional, item-
by-item approach to aircraft certification--taking into account the 
interactions between all aircraft systems and the crew;
      integrating human factors considerations more effectively 
throughout the design process, as aircraft become more automated and 
systems more complex; and
      ensuring coordinated and flexible information flow during 
the oversight process.
    Yet, if we are to continue to raise the bar for safety across the 
globe, it will be important for the FAA and our international partners 
to foster improvements in standards and approaches not just for how 
aircraft are designed and produced, but also how they are maintained 
and operated. We at the FAA are prepared to take the lead in this new 
phase of system safety. I see our strategy coalescing around four 
themes: Big Data; Just Culture; Global Leadership; and People.
Big Data
    The FAA must continue leaning into our role as a data-driven, risk-
based decision-making oversight organization that prioritizes safety 
above all else. We do that by breaking down silos between organizations 
and implementing Safety Management Systems supported by compliance 
programs and informed by data. We look at the aviation ecosystem as a 
whole, including how all the parts interact: aircraft, pilots, 
engineers, flight attendants, technicians, mechanics, dispatchers, air 
traffic controllers--everyone and everything in the operating 
environment. The FAA is examining the data we have, identifying data we 
may need, and looking for new methods for analyzing and integrating 
data to increase safety.
Just Culture
    In addition to the technical work required for truly integrated 
data, a key enabler of a data-driven safety organization is a healthy 
and robust reporting culture. A good safety culture produces the data 
you need to figure out what's really happening. If we know about safety 
concerns and we know where threats are coming from and how errors are 
occurring, we can mitigate the risks and fix the processes that led to 
those errors. A good safety culture demands that we infuse that safety 
data into all of our processes from top to bottom--in a continuous 
loop.
    To be successful, a safety organization relies on a Just Culture 
that places great value on front-line employees and those involved in 
the operation raising and reporting safety concerns in a timely, 
systematic way, without fearing retaliation. A Just Culture starts at 
the top. It's something leadership has to nurture and support 
everywhere in the organization. Employees have to see the results, see 
what the data is showing, and see how the organization is using 
analysis tools to identify concerns and errors and put actions in place 
to mitigate them.
Global Leadership
    Today, the U.S. aviation system is the safest, most dynamic and 
innovative in the world, and we have the numbers to prove it. This is 
largely due to these collaborative approaches to safety. An example of 
the kind of collaboration and safety innovation we can use to lead the 
global aviation safety system to even higher levels of performance is 
Aviation Safety Information Analysis and Sharing (ASIAS). ASIAS is one 
of the crown jewels of the aviation safety system in the United States. 
It is unique in the world. Its purpose is to proactively discover and 
mitigate emerging safety issues before they result in an incident or 
accident.
    ASIAS de-identifies airline and company proprietary data submitted 
by a growing number of stakeholders in accordance with information 
sharing agreements and governance protocols. This ensures a level of 
protection for participants and protects against disclosure of a 
specific flight crew or entity, which has helped to foster a culture of 
trust within the ASIAS program and across stakeholder organizations. As 
trust has developed, data access has increased and enabled advancements 
in data analysis methodologies through more automated capabilities and 
the fusing together of data streams that provide a 360-degree 
perspective on safety issues. This ``fusion'' bypasses the limits 
associated with analyzing data in separate silos of information, 
provides insight from multiple integrated data sources, and enables 
analysts to better understand the full context of safety events. ASIAS 
works in partnership with the Commercial Aviation Safety Team (CAST) 
that proactively mitigates risks thorough the voluntary adoption of 
Safety Enhancements.
    Over the years, the FAA has exercised a leadership role in the 
promotion and development of global aviation safety. We have helped 
raise the bar on safety standards and practices around the world 
working with ICAO and other civil aviation authorities. We have an 
opportunity to do even more. We are committed to expanding our efforts 
with other authorities around the world and to fostering safety 
standards and policies at ICAO to help meet the public's expectations 
of the highest possible levels of safety globally, even in areas the 
FAA does not regulate directly. Without safety as a foundation, we 
cannot have a vibrant aviation industry in any country, much less 
between countries. Our international air transportation network is a 
tightly woven fabric that is dependent on all of us making safety our 
core value.
People
    We live in an incredibly dynamic time in aviation, with new 
emerging technologies and capabilities transforming the NAS. But at its 
core, a huge technical, operational, and regulatory agency like the FAA 
is made of people--people who are driven to serve, people with 
families, hopes and dreams, and most importantly, people who are 
dedicated safety professionals. I have the utmost respect for the jobs 
that they do every day, making sure our skies are safe and that the 
operation of the system is efficient--and serves the public--as well as 
it possibly can. It's now time to show the next generation of aviation 
leaders what incredible opportunities lie ahead for them in our field, 
both personally and professionally. It is the people who will innovate 
and collaborate to take us to the next level of safety, operational 
excellence, and opportunity.
                               Conclusion
    Aviation's hard lessons and the hard work in response to those 
lessons--from both government and industry--have paved the way to 
creating a global aviation system with an enviable safety record. But 
as I mentioned earlier, safety is a journey, not a destination. We have 
achieved unprecedented levels of safety in the United States. Yet what 
we have done in the past and what we are doing now will not be good 
enough in the future in an increasingly interconnected world. We must 
build on the lessons learned, and we must never allow ourselves to 
become complacent.
    Those lessons teach us that in order to prevent the next accident 
from happening, we have to look at the overall aviation system and how 
all the pieces interact. Time and again, it has been shown that 
accidents happened due to a complex interaction of multiple issues. 
Focus on a single factor will lead us to miss opportunities to improve 
safety that come from regulators and industry raising the bar not just 
in certification, but in maintenance and training procedures. That will 
require truly integrated data and collaboration, enterprise-wide. When 
our data--and our organizations--are kept in silos, we may miss 
information that could provide an opportunity to make important safety 
decisions that will improve processes or even prevent accidents 
entirely. We have to be constantly learning from each other--regulator 
and those we regulate--to help each other improve.
    The United States has been, and will continue to be, the global 
leader in aviation safety. We are confident that continuing to approach 
this task with a spirit of humility, openness, and transparency will 
bolster aviation safety worldwide.
    This concludes my statement. I will be glad to answer your 
questions.

    Mr. DeFazio. Thank you, Mr. Administrator.
    With that, Mr. Kiefer, your testimony.
    Mr. Kiefer. Good morning, Chairman DeFazio, Ranking Member 
Graves, and distinguished members of the committee. Thank you 
for having me here today. It is an honor to be on the panel.
    I would like to first start by expressing my condolences to 
the families and the friends of those who lost their lives in 
the Lion Air and Ethiopian Airlines accidents. Their memories 
were with us on our team as we did our work.
    My name is Matt Kiefer, and I currently work for the U.S. 
Air Force Airworthiness Office. I have worked in the aviation 
industry for over 25 years in the military and in the private 
sector. This has included work in flight test, system design 
and integration, systems engineering management, and systems 
safety.
    As an aerospace engineering officer in the Navy Reserve, I 
am responsible for the Navy's part of a joint team that 
performs combat forensics analysis on aircraft battle damage. I 
am also an instrument-rated private pilot with over 600 hours 
of flight experience.
    I was asked by the FAA to participate on a team known as 
the Boeing 737 MAX Technical Advisory Board, also known as a 
TAB. This is an independent team of industry experts with no 
past involvement in the 737 MAX development or certification.
    Our team is made up of experts from various specialties, 
including test pilots, aerospace engineers, and chief 
scientists, with backgrounds in flight controls, flight 
operations, simulators, human factors, computer systems and 
software, flight standards, and systems safety. We were chosen 
for our ability to take a look at the 737 MAX changes 
objectively, with fresh eyes, because we are independent from 
Boeing and the FAA certification effort of the aircraft.
    Our team was tasked to examine and review the changes 
Boeing is making to the 737 MAX flight control system, and make 
recommendations back to the FAA as to the suitability of those 
changes before the aircraft is returned to service.
    Our team had our first face-to-face meeting with Boeing at 
their facilities in Seattle in May, where we spent time working 
with the Boeing engineering department. This meeting started 
off with encouragement from the FAA and Boeing management to 
dig deep into the systems and scrutinize the work that has been 
done to develop the solutions to the problems that led to the 
accidents, and give our unbiased opinion as to the suitability 
of those fixes.
    At this meeting, we started by learning about how the speed 
trim and MCAS function, as well as having discussions on the 
various failure modes of the system. We were then given indepth 
debriefings on what happened with the two mishap aircraft, 
including information on the Lion Air flight that occurred the 
day before the first accident. After that, we were given 
detailed briefings with good discussion on the changes that had 
been developed for MCAS.
    Our team was also given the opportunity to fly the 737 MAX 
simulator at the Boeing engineering facility. Many of our team 
members, both pilots and engineers alike, got the opportunity 
to fly the simulator with the old software and with the new. We 
were able to experience the accident scenarios and were able to 
observe the aircraft behavior with MCAS operating properly as 
well as how the aircraft handles with MCAS disabled.
    During these meetings, which included multiple online 
conferences and two face-to-face meetings at Boeing, our team 
had the full cooperation of Boeing engineering and flight test 
staff, as well as good participation from the avionics 
subcontractor.
    At the first face-to-face meeting, the team started to 
develop action items that had been determined are necessary 
before returning the aircraft to service. These action items 
are being actively tracked by the TAB and with Boeing and the 
FAA. All action items that the team made for return to service 
have either been addressed and closed or are presently in work.
    The TAB is still working with Boeing to accept products to 
close the remaining action items. Once all this work is 
complete, the TAB will present the final report to the FAA. The 
TAB still has work to do to complete our assessment of the 
changes to the Boeing 737 MAX systems, and are awaiting more 
information on the development assurance, testing of the 
software, final safety assessments, and final training for the 
aircrew.
    Pending the team's determination that the remaining review 
results meet our expectations, our team feels that the changes 
made to the flight control system of the 737 MAX should vastly 
improve the safety of the aircraft, in keeping with the highly 
successful safety record of the previous models of the Boeing 
737.
    Thank you, and I will be happy to answer any questions you 
have for me.
    [The prepared statement of Mr. Kiefer follows:]

                                 
 Prepared Statement of Matthew Kiefer, Member, Technical Advisory Board
    Good morning Chairman DeFazio, Ranking Member Graves and Members of 
the Committee. Thank you for having me here, it is my honor to 
participate on this panel today.
    First I'd like to introduce myself. My name is Matt Kiefer and I 
have been working in the aviation industry for over 25 years. In that 
time I have worked in aircraft maintenance on fighter jet aircraft as 
well as general aviation aircraft. I have worked as a flight test 
engineer and been responsible for all flight test data acquisition at 
an aircraft modification company as well as system design and 
integration for aircraft modification programs. I have worked for the 
U.S. Department of Defense as a lead systems engineer for a Navy 
aircraft program and been responsible for system safety engineers 
working across several different Air Force programs. I have also been 
an Aerospace Engineering Officer for the Navy Reserve for over ten 
years where I specialize in combat forensics analysis of aircraft 
battle damage. Currently I am working in the Air Force airworthiness 
office where I am responsible for some aspects of policy and manage the 
division's computer systems to include the one that processes 
airworthiness reviews. I am also a Lieutenant Commander in the Navy 
reserve attached to an engineering unit that supports NAVAIR. 
Additionally I am an instrument rated private pilot with over 600 
flight hours in general aviation aircraft.
    I was asked by the FAA to participate on a team known as the B737 
MAX Technical Advisory Board otherwise known as a TAB. This is an 
independent team of aviation industry experts with no past involvement 
with the B737 MAX development or certification. Our team is made up of 
experts from various specialties including test pilots, aerospace 
engineers and chief scientists with backgrounds in flight controls, 
flight operations, simulators, human factors, computer systems and 
software, flight standards and safety. These experts come from the FAA, 
NASA, the Air Force and the Volpe Center. We were chosen for our 
ability to take a look at the B737 MAX changes objectively with fresh 
eyes because we are independent from Boeing or the FAA certification 
effort of the aircraft. Our team was chartered to examine and review 
the changes Boeing is making to the B737 MAX flight control system and 
make recommendations back to the FAA as to the suitability of those 
changes before the aircraft is returned to service.
    Our team started our work with some teleconferences where we became 
acquainted with the Boeing team and the 737 MAX airplane and its 
systems. We then had our first face-to-face meeting at the Boeing 
facilities in Seattle in May where we spent time working with the 
Boeing engineering department. This meeting started off with 
encouragement from FAA and Boeing management to dig into the systems 
and scrutinize the work that has been done to develop the solutions to 
the problems that led to the two accidents and give our unbiased 
opinion as to the suitability of those fixes.
    At this meeting we started by learning more about how the speed 
trim system and MCAS function as well as having discussions on various 
failure modes with the system. We were then given in-depth debriefings 
on what happened with the two mishap aircraft including information on 
the Lion Air flight that occurred the day before the first accident. 
After that we were given detailed briefings with discussion on the 
changes that had been developed for MCAS.
    Our team was given an opportunity to fly in the B737 MAX eCAB which 
is the engineering development simulator at the Boeing engineering 
facility. Many of our team members, both pilots and engineers alike got 
an opportunity to fly the simulator with the old software and the new 
software. We were able to experience the accident scenarios and were 
able to observe aircraft behavior with MCAS operating properly as well 
as how the aircraft handles with MCAS disabled.
    Boeing engineers sat down with several of the engineers on our team 
to go over the software development and certification for the flight 
control system. These sessions consisted of deep dives on how MCAS was 
developed as well as a look at how the changes are being implemented. 
Time was also spent by some of the team members reviewing aspects of 
the flight manual and training given to pilots of the B737 MAX.
    During these meetings, which included multiple online conferences 
and two face-to-face meetings at Boeing, our team had the full 
cooperation of the Boeing engineering and flight test staff as well as 
good participation from the avionics sub-contractor. After these 
meetings, briefings and demonstrations the team gathered to assemble 
our findings and recommendations. Some of these we have determined are 
necessary before returning the aircraft to service. These 
recommendations/action items are being actively tracked internally to 
the TAB and with Boeing and the FAA. All recommendations that the team 
made for return to service have either been addressed and closed or are 
presently in work. The TAB is still working with Boeing to accept 
products to close the remaining action items. Once all of this work is 
complete the TAB will present a final report to the FAA.
    There are four main changes to the B737 MAX flight control system 
software that have been developed to prevent future accidents like the 
ones that happened with the Lion Air and Ethiopian Air flights. They 
include the following:
    1.  Angle of Attack (AoA) comparison--an addition to MCAS that will 
now compare readings from both angle of attack sensors on the aircraft. 
If there is a difference of more than 5.5 degrees the speed trim system 
will be disabled. Also included in this change is something known as a 
``mid- value select'' which uses data from both sensors together to 
create a third input that will help to filter out any AOA signal 
oscillatory failures or spurious sensor failures. This modification 
will prevent MCAS from commanding nose down trim when a single AoA 
sensor reports a false AoA as it happened in the two accident flights.
    2.  MCAS resynchronization--this change will account for manual 
electric trim inputs made by the pilot while MCAS is activating. It 
will track whatever input the pilot makes and return the pitch trim to 
that setting when MCAS retrims back to normal.
    3.  Stab trim command limit--is an addition that will limit the 
maximum nose down trim that the automatic flight control system can 
command to prevent the pitch trim from reaching an uncontrollable 
situation.
    4.  FCC monitors--software monitors have been added to the flight 
control computers that will cross check pitch trim commands against 
each other. If a difference is detected by these monitors the automatic 
trim functions are disabled. This protection helps prevent erroneous 
trim commands from a myriad of causes that could occur in the automatic 
flight control system.
    These design changes in the software that controls the automatic 
pitch trim features including MCAS should prevent angle of attack 
sensor failures from causing the pitch trim to operate when it should 
not. Further, they should prevent the trim from activating erroneously 
for other reasons as well.
    I would like to note that all along through our team's progress we 
have gotten nothing but assistance and courtesy from Boeing. At no time 
have any of our members been pressured to reach any predetermined 
conclusions nor were we encouraged to operate according to a timetable 
or schedule. Conversely we have been told by the FAA and Boeing 
leadership to emphasize safety and diligence in our research.
    The TAB still has work to do to complete our assessment of the 
changes to the B737 MAX systems as we are awaiting more information on 
the development assurance, testing of the software, final safety 
assessments and final training for aircrew. Pending the team's 
determination that the remaining review results meet our expectations, 
our team feels that the changes made to the flight control software in 
the B737 MAX should vastly improve the safety of the aircraft, in 
keeping with the highly successful safety record of the previous models 
of the Boeing 737.

    Mr. DeFazio. Thank you for your work and for your 
testimony, and I expect there will be questions later.
    Mr. Kiefer. Yes, sir.
    Mr. DeFazio. With that, then, I would recognize myself for 
the first round of questions.
    Administrator Dickson, we know you weren't there. But 
obviously, I expect that you and your staff have put a 
substantial amount of energy into trying to determine what 
happened and how it happened, as you are charged with making it 
work right in the future.
    So I have got to ask about this TARAM analysis, which was 
done on December 3, 2018. Again, you weren't there. Mr. Bahrami 
was there. He was head of safety. And he met with me and Mr. 
Larsen and I can't remember who else might have been there, and 
told us this was a one-off accident in February.
    Yet this analysis, which I thought the staff was going to 
put up, was--thank you--was available at that time. He 
apparently says he was unaware of it. He knew there was such a 
process, but he didn't know they had evaluated this plane and 
this system. But this analysis says that--this is post-Lion 
Air--that in the lifetime of these aircraft, in operation, they 
predicted there would be a potential of 15 fatal crashes.
    [Slide]
    
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. DeFazio [continuing]. I am not aware of any other 
certified transport aircraft that has such an analysis. I mean, 
the normal analysis is 10 to the minus 9. This far exceeds 
that. And I question why, given this TARAM--and I don't know 
where it went since it didn't go to the head of safety--why the 
aircraft wasn't grounded once this analysis was done, as 
opposed to allowing the plane to fly while Boeing worked on a 
fix.
    We have talked a lot about being a data-driven organization 
with you and former Administrator Elwell when we had the second 
incident, when the plane stayed up yet for another couple of 
days, and the assumptions that were made here is only 1 out of 
100 pilots wouldn't react properly and effectively in that 10-
second period. Yet in the two instances extant--well, there 
were actually three. There was a triggering, which was 
recovered, in Indonesia. Then there was a triggering which 
wasn't recovered, and then Ethiopia. So we have essentially a 
33-percent success rate. But even after the first, we had a 50-
percent success rate.
    I am just wondering, I mean, in retrospect do you think it 
should have been grounded after Lion Air, given this TARAM 
analysis?
    Mr. Dickson. Well, thank you for your question, Mr. 
Chairman. And I will say at the outset, as you noted, I was not 
at the FAA when this analysis was done. However, I want to 
advocate for my people. And they need--we are a data-driven 
organization, as you said, and I know this--with all due 
respect, any indication that any level of accidents is 
acceptable in any analysis is not reflective of the 45,000 
dedicated professionals at the FAA, whether they are involved 
in air traffic or aviation safety. So I want to make that 
abundantly clear. That is absolutely our highest priority.
    Having said that, the reason that we have the safest 
airspace in the U.S. in the world has been through decades of 
developing data systems and decisionmaking tools that will 
allow us to make the best decisions, and prioritize in the 
interests of safety.
    So remember, the information that was available at the time 
was we really didn't know what the root cause of the accident--
--
    Mr. DeFazio. If I could, Mr. Administrator, I understand. 
But I have only got 10 minutes, and I have at least a couple 
other questions.
    So OK, you are not going to say anything definitive. I 
would hope you would look into the distribution----
    Mr. Dickson. Of course.
    Mr. DeFazio [continuing]. Of this TARAM. It didn't come to 
the attention of the head of safety, he tells us, so I don't 
know where it went or who had access to it and what they may 
have advocated. I think it is a pretty critical thing. And 
again, I am not aware of any other aircraft where this sort of 
analysis has found something that is going to cause crashes 
inevitably and been allowed to fly. I mean, it just doesn't 
meet your standards. So I appreciate the fact that you are 
going to look into that and refuse that.
    Now, I want to ask, again, I am concerned about Boeing's 
influence over--particularly, it seems like this all stops in 
the regional offices. We will find out with further interviews 
with FAA employees. But again, with 7 hours with Mr. Bahrami, 
he is not aware of any of the issues we raised outside that 
were--where decisions were made up in Washington State.
    And there are two issues regarding lightning protection on 
the 787, where the plane was certified for production with the 
lightning protection. Boeing decided to strip the lightning 
protection off, and after they produced 40 airplanes, they came 
to the FAA and said, ``Oh, by the way, you certified it with 
lightning protection. We have taken it off. We would like you 
to change your decision that it is necessary.'' And again, 
safety analysts objected, and they were overruled by a local 
manager.
    And then the rudder: The rudder issue was actually seven 
safety analysts said, ``No, you need to relocate the rudder 
controls,'' and we do have photos of what happens when you lose 
rudder controls on an airplane, particularly on climb-out or at 
a critical time. I wish the staff would put that slide up, 
please, if they are listening. And that is a critical thing.
    [Slides]
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]>
    

    Mr. DeFazio [continuing]. And they were upheld at two 
levels of review. So in total, we had 14 people at the FAA say, 
they should relocate or better protect the rudder controls in 
the wing, given this large new engine and the potential for 
uncontained failure and fragmentation. And they were overruled 
by a single manager, apparently again at the local level.
    This causes concern on my part, that there doesn't seem to 
be--and we haven't found yet--that there are levels of review 
beyond the local office. Are you going to be looking at that 
issue or problem as part of a solution?
    Mr. Dickson. Yes. Well, thank you for the question, Mr. 
Chairman. And I think that it is important to understand that 
as we work through these processes and when you have technical 
people involved in discussions, these processes by design 
encourage debate. And there are differences of opinion as we 
work through the processes.
    And ultimately, remember that the managers who were 
involved in these decisions are themselves, are themselves 
experts, and there are times when they may have been overruled. 
And it is not a matter, in my view, of what the applicant, or 
the manufacturer in this case, wants.
    It is really a matter of letting the process work. And 
ultimately, the decision needs to be made on behalf of the 
agency, and on occasion, that maybe the manager that has a 
broader view that may be able to make that decision. I do think 
that there are some improvements that we can put in place. 
Aviation safety is working, as I mentioned, on just----
    Mr. DeFazio. Thank you, Mr. Administrator. And one last 
question--I am running out of time and do not want to abuse my 
privileges here--Boeing self-certified and installed defective 
slats on 137 applications, and you just announced a $4 million 
civil fine for this deliberate abuse. And we have heard a lot 
of other things about production pressures, and we will hear 
more about that from the second panel.
    I am concerned that will you look at these issues. And also 
we will hear from the second panel about concerns about whether 
or not sensors were installed, the AOA sensors installed 
properly because of production pressures, calibrated properly 
because of production pressures. Again, I have concern.
    Again, and I do not get the sense thus far that you are 
ready to go there, that we may have a captive regulatory 
problem in the field offices. Because there are an awful lot of 
decisions that have gone in Boeing's favor, overruling a whole 
lot. The 787 had a safety specialist say, ``Hey, you can't put 
a lithium battery in that plane without putting it in a steel 
box and venting it over the side.'' Overruled. Guess what? The 
plane gets grounded for 2 months because, hey, you have got to 
put it in a steel box and vent it over the side.
    There have been an awful lot of people who seem to have 
been pressing it and right, and the question is, maybe this 
needs to go beyond the local office when we are talking about 
safety-critical systems.
    And with that, I have run out of time. But I hope you will 
look at that issue. Thank you. Thank you, Mr. Administrator.
    Ranking Member Graves.
    Mr. Graves of Missouri. Thank you, Mr. Chairman.
    Something I worry about just a little bit is the direction 
we are taking--and this isn't about Democrats and Republicans 
because I hear it from both sides--and questioning the safety 
of our system. And that does worry me because I want people to 
feel safe getting in the air.
    And I have heard people say, on both sides, that we have a 
system that is absolutely fundamentally broken. And my question 
to you, Administrator, is--and I don't think there is any 
system that can't use improvement, particularly when it comes 
to Government. But do you believe our system is fundamentally 
broken? We have worked a long time to get our certification 
process to where it is today. And so I ask you that question. 
Are we broken?
    Mr. Dickson. No. It is a great question. The system is not 
broken. However, with any process, and I have said many times, 
even in these last 4 months, that all processes need to be 
improved really each and every day, and to the extent there are 
gaps in the processes or, in the case of the MAX, fragmented, 
inadequate communication; data that didn't have the fidelity 
that we needed; the lack of a safety management system at 
manufacturers--those kinds of things are all improvements that 
can be put into place.
    And I believe that the construct that we have, whether it 
is at an air carrier or manufacturer or an airport, of the 
agency being in a position to exercise effective oversight and 
not be captive, but also have fluid information flow and data 
flow from the regulated entity, is extremely important because 
that is the foundation of what has led to the margin of safety 
that we enjoy in the United States today.
    Mr. Graves of Missouri. I am going to change directions 
just a little bit so members of the committee can hear from a 
pilot's perspective. And I know you are typed in several 
different aircraft. In fact, name the aircraft you are typed in 
right now, commercial aircraft.
    Mr. Dickson. Commercial aircraft, the 727, 737, 757, 767, 
and the Airbus A319, 320, and 321.
    Mr. Graves of Missouri. So when you--and I have talked 
about this, that it is--a crash should never focus on one 
thing. We have got pilot issues. We have got maintenance 
issues. We have got Boeing. We have got--and everybody has a 
part of this that bears some of the blame.
    But I have talked a lot about runaway trim and how MCAS, or 
any autopilot, for that matter, how it manifests itself. And it 
manifests itself as a runaway trim issue, which something here 
in the United States, we learned as pilots, whether that is 
private pilot training, commercial training, ATP training, is 
memory items, muscle memory.
    And you go through those mental items. And can you 
explain--sometimes I get up here and harp on this stuff and 
don't explain it very well. But can you explain what it feels 
like? And I know you have run through the scenarios, too, in 
the simulator of these accidents. Can you explain runaway trim? 
Can you explain for the committee's benefit muscle memory and 
what you have taken away from your perspective?
    Mr. Dickson. Sure. Well, thank you for the question. This 
actually gets to the chairman's question on looking at what 
information was known right after the Lion Air accident. We had 
flight recorder data that indicated some issues with crew 
performance. We also had information with how the airplane was 
maintained. And if any of those had gone a different way, that 
accident would not have occurred, and events would have 
manifested themselves differently.
    The pilot is part of the system, and so when we are 
designing flight control systems, any time you have a flight 
control problem, if the airplane is not doing what you wanted 
to do, the first thing you do is fly the airplane. And that 
means disconnecting the automation; in this case, if the 
autopilot is on, disconnect it. The autothrottles, disconnect 
them. Let's get the airplane under control and find out what is 
going on.
    And then you execute whatever emergency procedure you have. 
In this case, with runaway stab trim, if the airplane has got 
control pressures that are undesirable, trim the airplane up. 
And then in most airplanes you disable the electric trim system 
and then can trim the airplane manually. Slow down. The 
airplane is not on fire. You have not lost an engine. There is 
plenty of time. There is not any urgency in addressing the 
issue. So that is how we want to manage the workload in the 
cockpit in these events.
    But runaway stabilizer trim, I have had it during my 
career. It is not a regular occurrence on modern aircraft, but 
it is something that every pilot learns during their initial 
qualification, whether in light aircraft or matriculating 
through commercial aviation aircraft as well.
    Mr. Graves of Missouri. So again--and I know when you read 
the report, too, that the copilot--the pilot asks, ``Can you 
trim the aircraft?'' Which at one point I think the aircraft 
accelerated through 500 miles per hour; at least, that is what 
some of the initial telemetry--you might explain that, too. 
Because I have tried to explain it before.
    When you are trying to trim an aircraft that is going way 
too fast, the pressures that are against those control 
surfaces--you might do a better job of explaining that, too. I 
have used the analogy of trying to push a car door open when 
you are going down the road at 100 miles an hour, and it is 
very hard to get that.
    It is the same thing you get on control surfaces when you 
are trying to trim something manually. You might go into a 
little bit further with that.
    Mr. Dickson. Sure. At high speed, I mean, this is why with 
any flight control problem it is important to maintain control 
of the aircraft. And that usually means, for a large commercial 
airplane, staying below 250 knots. And then if you have 
something like a flat base symmetry or an undesirable control 
force, a lot of times you will go back and reestablish what the 
previous configuration was.
    In this particular case dealing with a trim issue, those 
forces are going to be much greater, which I believe is your 
point, at a higher speed because the controls are much more 
effective at high speed than they are at a slower speed.
    Mr. Graves of Missouri. So I am going to--and there has 
been a lot of talk directed at people blaming the pilots, which 
I do not believe the pilots are to blame in this. I think they 
were fighting for their life. And that is essentially what they 
were doing, and the passengers.
    I think they were overwhelmed. I think they were trying to 
figure out what was going on. We know they reengaged the 
system. But I place a lot of that blame--and there is plenty of 
blame to go around in this whole thing again, whether that is 
manufacturer or pilot response or maintenance, whatever it is.
    But I still go back to, and I have said this before, the 
Ethiopian Government that owns Ethiopian Airlines in that 
particular crash, that is who I place a lot of focus on because 
they put those two individuals in that cockpit. And it is 
unfortunate that that is the case. And that is the thing that 
worries me more than anything else. Because we do have 
different training standards throughout the world, very 
different training standards.
    And when you have an airline that is growing as fast as 
they were growing, and you are throwing people in the cockpit, 
they may know how to fly the computer, but it goes back to what 
you said: You still have to come back--and I have said this 
before, too--the most important safety factor you can have in 
any aircraft is a pilot that can handle whatever that situation 
is.
    And I don't care if the pilot has 200 hours or 20,000 
hours. There are airplanes that--or pilots that I will get in 
an airplane with that have 200 hours that I believe in their 
ability. And there are pilots out there that have 20,000 hours 
that I will never get in an aircraft with. It is all about how 
they handle whatever situation it is.
    And so I still come back to training standards. And I think 
we are going to hear a little bit about that. And if we have 
more questions, I have got some questions for the folks that 
have been reviewing this because I know there is some talk 
about pilot training standards.
    But I do appreciate your perspective on this. And again, I 
think there is a lot of blame to go around. But I do feel bad 
for those two pilots because I think they were absolutely 
overwhelmed with the task at hand.
    Mr. Dickson. Well, Congressman, I would just say I 
appreciate your comments. But I would just caution everyone, 
and I think you would agree with this, I am not about casting 
blame on anyone or anything. I am about identifying problems, 
issues, and developing solutions, and improving the process.
    And there is a lot to be done in all of these areas, both 
with the technical processes, the human factors issues, and 
international pilot training standards as well.
    Mr. Graves of Missouri. I completely agree with you. And 
that is exactly why we are here, which I appreciate the 
chairman's point of view and what the committee is trying to 
do. It is unfortunate that we had to have people killed to get 
to this point, which has happened before in Government.
    But I do think we need to be cautious as we move forward, 
too. We have to fix the system, whatever needs to be upgraded. 
But I do think we have to be very cautious moving forward and 
not have knee-jerk reactions because we do want to keep--and 
this comes back to my initial statement. I want to make sure 
that we have a safe system.
    I do believe we have the safest system in the world, and it 
is the gold standard. And I want to make sure it stays that 
way. But I don't want to tear it apart by the same token.
    Thank you, Mr. Chairman.
    Mr. DeFazio. I thank the gentleman for his questions. And 
we are going to proceed in order of seniority. And first would 
be Representative Norton. Seniority and arrival; if you weren't 
here at the beginning, then----
    Ms. Norton. Thank you, Mr. Chairman. This is a very 
important hearing. I appreciate this hearing today.
    And Administrator Dickson, I appreciate your being here. 
Let me say I also appreciate the answers you have provided so 
far to the Quiet Skies Caucus, of which I am a cochair. We are 
concerned, obviously, about allegations that FAA was a captive 
of the industry. So I want to ask you a series of questions 
that go to Boeing's delays in providing safety information. It 
looks like repetitive delays. We are trying to see whether or 
not we can break with that.
    In 2015, did the FAA enter into a settlement agreement with 
Boeing--that is 4 years ago--to resolve multiple enforcement 
cases against Boeing that were either pending or under 
investigation at the time?
    Mr. Dickson. Yes, we did.
    Ms. Norton. Is it also true that under the agreement, 
Boeing had to immediately pay $12 million into the U.S. 
Treasury?
    Mr. Dickson. Yes, ma'am.
    Ms. Norton. Moving forward, is it also true that Boeing 
faced up to $24 million in additional penalties through 2020 if 
certain conditions were not met?
    Mr. Dickson. That is correct.
    Ms. Norton. Do these genesis of settlements show a pattern 
of systemic issues on the part of Boeing, including failure to 
identify problems, failure to put corrective actions in place, 
inadequate resources, and inadequate training?
    Mr. Dickson. Well, I have to say I have yet to conclude 
that with respect to the settlement agreement. But it is 
something that is under consideration, and it could be the 
subject of future litigation. But I certainly reserve the right 
to take further action with respect to that agreement.
    Ms. Norton. We are talking about in the past, now, failure 
to identify problems, failure to put corrective actions in 
place. You are saying that is under litigation?
    Mr. Dickson. No, it is not under litigation. But it is a 
consideration about what actions may occur in the future with 
respect to the remaining actions before the 2020 timeframe that 
you talked about.
    Ms. Norton. Well, I think those failures are pretty clear, 
Administrator Dickson.
    In designing and developing and manufacturing the 737 MAX, 
Boeing has run into issues in meeting the obligations in most 
of these categories. Isn't that true?
    Mr. Dickson. I am sorry. Can you restate--I am not sure I 
understood the question.
    Ms. Norton. Yes. In designing and in developing and 
manufacturing the 737 MAX, isn't it true Boeing has run into 
issues in meeting the obligations in most of the categories I 
just previously named?
    Mr. Dickson. I am not aware. Perhaps Mr. Lawrence may be 
aware. I am not aware of any specific issues.
    Ms. Norton. Has Boeing met all the obligations under the 
agreement?
    Mr. Lawrence. That is still under evaluation right now.
    Ms. Norton. Within the last decade, Boeing has had two 
worldwide groundings of relatively new airplanes, the 787 
Dreamliner and 737 MAX, and encountered numerous compliance 
issues in the time since Boeing paid the $12 million 
settlement. And I am assuming that settlement, that payment, 
was made.
    Has FAA assessed any additional financial penalties on 
Boeing pursuant to the 2015 agreement?
    Mr. Dickson. Not at this time. But as I mentioned earlier, 
that is under consideration, and I reserve the right to go 
ahead and proceed appropriately.
    Ms. Norton. Thank you, Mr. Dickson. Thank you, Mr. 
Chairman.
    Mr. DeFazio. I thank the gentlelady.
    Representative Gibbs.
    Mr. Gibbs. Thank you, Mr. Chairman. And I too want to 
extend my condolences to the families of the victims. This 
tragedy--it is just unbelievable that you have to suffer 
through this. I am glad you are here today.
    Mr. Dickson, just to kind of start this out a little bit, 
you mentioned about identifying problems. And to me, it seems 
like, when I have tried to learn on this, that a software 
glitch, maybe a sensor issue, pilot awareness and training, and 
then also some of the problems trying to identify.
    But then my overall question, talking about since you are 
the new Administrator, when you came in, were you concerned 
about what the relationship was with the FAA inspectors and the 
Boeing technical people, inspectors, and the relationship, and 
the culture between the two?
    Mr. Dickson. I knew there were questions about that. Of 
course, my experience is from the commercial airline industry, 
27 years, and 12 years as a senior leader of flight operations. 
And I have seen the power and the benefit of safety management 
systems, and that how it has led to the incredible margin of 
safety that we have now.
    But manufacturing is a new environment for me, and what the 
regulatory process is. I think one of the challenges that you 
have in an aircraft certification project is that it takes 
place over many years. And so I have become aware of, 
throughout this committee's investigation, the result or what 
we have seen so far, the Joint Authorities Technical Review, my 
own observations and conversations with the team out in Seattle 
about when we are bringing in various parts of the team and how 
engaged everyone is from beginning to end of the process.
    So there is the relationship between the FAA and the 
manufacturer. But there is also how the pieces within the FAA 
are fitting together and working together and communicating 
with each other.
    Mr. Gibbs. And it has expanded a little bit, the 
relationship to FAA, relationship with the European Union 
Aviation Safety Agency, and the relationship to Airbus and 
other manufacturers, foreign manufacturers, for compliance, for 
inspection and certification.
    Mr. Dickson. It is a different model, similar. But I think 
the issues are very similar. Over in Europe they have, again, a 
different legal construct, and EASA would actually have to take 
certificate action. Our system is a little more flexible in 
some respects. Delegation is something that has to be earned. 
It is a privilege. And it is really reliant on our trust with 
the applicant. And to the extent that that needs to be 
addressed, that will affect the decisions going forward.
    Mr. Gibbs. Mr. Kiefer, as you are a TAB member, the 
Technical Advisory Board, conducting the review of the 737 MAX 
changes in pilot training, recommendations to ensure 
independence, and an unbiased review of the 737 MAX changes, 
how has that review--what is the progress and what do you think 
we--the conclusions related to the safety changes to date?
    Mr. Kiefer. As far as conclusions go, our team is still--we 
still have work ongoing with Boeing. We have action items to 
Boeing for further safety assessments. We are also waiting to 
see the final training modules and so forth. But the items that 
we have reviewed to date are looking good.
    Mr. Gibbs. So the software changes, you are----
    Mr. Kiefer. Yes. The software changes that have been put in 
place are addressing the failures that led to the two 
accidents. And----
    Mr. Gibbs. Was there also a sensor issue, or lack of 
duplication or additional sensors?
    Mr. Kiefer. OK. So I will address that by saying one of the 
new changes that Boeing has made to the software will have the 
MCAS as a system looking at both angle-of-attack sensors on the 
aircraft so that if one should fail like they did in the two 
mishap aircraft, the system will detect that and disable MCAS.
    Mr. Gibbs. On pilot training and awareness, do you have any 
concerns that additional training and awareness when it fails--
what does the manufacturer do to make sure that pilots are more 
aware of training? Do you have any comments on that?
    Mr. Kiefer. So far as I have seen, the training that they 
have developed for the--and our team, the training that we have 
seen is adequate.
    Mr. Gibbs. OK. Thank you. I yield back.
    Mr. DeFazio. I thank the gentleman.
    Representative Johnson.
    Ms. Johnson of Texas. Thank you, Mr. Chairman. I ask 
unanimous consent to put my opening statement in the record.
    Mr. DeFazio. Without objection, so ordered.
    Ms. Johnson of Texas. Thank you.
    [The prepared statement of Ms. Johnson of Texas is on page 
153.]
    Ms. Johnson of Texas. Administrator Dickson, the faces of 
the people being shown over here--I don't know whether you can 
see them--are indelibly in our mind. And the only thing we are 
trying to get at is how we avoid this again. And so the last 
two airlines developed by Boeing, the 787 and the 737 MAX, have 
been the subjects of worldwide groundings. Before the 787 
grounding, the last airline type to be grounded was the DC-10 
in 1979.
    What do these groundings tell us about Boeing's ability to 
deliver quality, airworthy airplanes? And what do these 
groundings tell us about FAA's ability to conduct effective 
oversight of the aircraft certification process?
    Mr. Dickson. Well, thank you. It is an appropriate 
question. I want to ensure that you and everyone here in the 
committee, the families, and the American public know that my 
highest priority is to make sure that nothing like this happens 
again; but not only that, that we continue to raise the margin 
of safety in the U.S. aviation system, and use our influence to 
do so around the world.
    These groundings, again, I think they illustrate that what 
we have done historically we cannot be satisfied with. We have 
got to continue to put process improvements in place. We have 
got to support our people. We have got to make sure we have got 
the right skill sets in our workforce, and that we are making 
decisions the right way, with safety as our absolute highest 
priority.
    So again, that involves just culture, both within the 
manufacturer and the regulator; the separation of safety issues 
from business issues--there can't be undue pressure on one side 
or the other; and we have got to make sure that system is 
absolutely clean.
    I think we also need to remember that in hindsight, there 
are other accidents that have happened over history where 
airplanes were not grounded because we didn't have data at the 
time. And TWA 800 is an example. We have Air France 447, where 
there were some similar human factors and issues involved 
there.
    And I think that, again, this is where pointing the finger 
of blame prematurely ends up being counterproductive because we 
just move on to the next thing. So I think that my interest is 
in the whole system and how all the parts interact. And as 
flight decks and airplanes continue to become more and more 
modernized, we need to understand that humans are a part of the 
system.
    They are a part of the design process. They are a part of 
maintaining the aircraft. They are a part of operating the 
aircraft. And human frailty and our ability to be able to 
engage with systems and be part of the system, all that needs 
to be taken into account in the design moving forward.
    Ms. Johnson of Texas. Thank you very much. Do you believe 
that the recent failures of the Boeing 737 MAX or Boeing's 
ability to deliver safe, reliable airplanes says anything about 
the organization designation authorization structure?
    Mr. Dickson. It is a good question. And I think that, 
again, as I said before, the ability to delegate to the private 
sector has existed for decades. And actually, in one form or 
another, it goes back to the 1920s.
    And if you look at the commercial airlines, which again is 
what I am most familiar with, the certificate management 
offices that oversee the major airlines have typically 30 or 40 
operations inspectors who are supervising a pilot force at that 
airline of maybe more than 10,000.
    But they rely on those who are flying the airline every 
day--the line check airman, the instructor designees, who are 
really there and take their obligations as FAA designees very 
seriously. I think there is an analogy to being able to do the 
same thing at the manufacturer. But that does not mean that 
there aren't improvements that need to be put into place.
    I think that the ability to have higher fidelity data 
around the globe--we have airplanes that can stream data almost 
immediately off the airplane now. And we need to be able to put 
protocols. We need to work with labor. We need to work with the 
manufacturers. And we need to work within the FAA to make sure 
we can take that data, and it will allow us to make better 
decisions under an appropriate safety management system.
    Mr. DeFazio. Thank you.
    Mr. Massie.
    Mr. Massie. Thank you, Mr. Chairman.
    Mr. Kiefer, can you get into a little more detail about the 
changes to the flight control system that you have observed 
that have been made?
    Mr. Kiefer. Yes, sir. Soo there are four main changes that 
have been made to the speed trim system in MCAS in the flight 
control system of the 737 MAX. The first is, as I said, there 
is now going to be an angle-of-attack sensor comparison between 
the two angle-of-attack sensors. If they vary more than 5\1/2\ 
degrees from each other, the speed trim system in MCAS will be 
disabled.
    The next one is maximum stab trim command limit. So this is 
a limit put into the software that will prevent the stabilizer 
from trimming to a point where the pilot will no longer have 
control authority by pulling on the control wheel alone using 
elevator controls.
    The other one is the MCAS resynchronization change that has 
been made. This change will account for any manual trim inputs 
that the pilot makes with the electric manual trim while MCAS 
is activating, and then return the trim back to that new 
setting once MCAS is done or once angle of attacks come back 
out of the MCAS range. This also will prevent more than one 
MCAS firing during an angle-of-attack event.
    The last change is a change that has the two flight control 
computers in the aircraft monitoring each other's performance. 
And if there is an errant or spurious trim command that comes 
from one that is not also commanded by the other, it will shut 
that trim system off.
    Mr. Massie. It seems like after the first crash, and 
definitely after the second crash, there was sort of a rush to 
the flight simulators, and let's recreate the problem and see 
how pilots respond to that. And in hindsight, we know the 
failures were a combination of human factors, user interface 
design, and an individual component failure.
    In the certification process before even the plane is 
certified, is there enough testing in the flight simulator of 
individual component failure? Because it seems like with the 
737 MAX, when there were changes to the user interface, the 
flight control system, it would have been wise to go into the 
flight simulator then and simulate failures like the angle-of-
attack sensor instead of after the fact.
    Can you tell us, Mr. Lawrence, to what degree those things 
are tested for in the certification process?
    Mr. Lawrence. Thank you very much for the question. Human 
factors testing and flight testing is a current requirement of 
any aircraft certification project. And in fact, just to 
warrant that, that is one of the reasons why we have had a 
delay in the reintroduction of the 737.
    It was that very testing earlier this year that our test 
pilots identified some issues and required some additional 
changes to the system. And that is when we added the additional 
comparators and change in the flight control system so that the 
two computers would be talking to each other.
    So it is a factor in the system, and it is flight tested as 
well. So obviously, some things can't--you don't want to go up 
and flight test some things that are very dangerous; that is 
why the simulators are used. But we try to accommodate every 
possible failure that we can think of in the testing and 
certification of the aircraft upfront.
    Mr. Massie. Both crashes were tragic, and if we knew all 
the factors in hindsight, they probably could have been 
avoided. But the second one seems more tragic, given that it 
was a similar set of factors as the first.
    In hindsight, or looking forward, better yet, what could we 
do between after a crash like the Lion Air crash--what could 
you do at the FAA to prevent the second crash? I am not saying 
what should people have done before. But what are we going to 
do going forward to stop the second crash from ever happening? 
Mr. Dickson.
    Mr. Dickson. Well, I think it is a great question. And I 
think I would just go back to the availability of data earlier, 
and to be able to look at root causes. Because ultimately, we 
are looking at a process by which a fix is being put in place. 
And how urgent and what kind of timeframe are we looking at? Or 
is it a high enough risk--remember, this is all about managing 
risk--and is it a high enough risk that the airplane would 
actually need to be grounded?
    Mr. Massie. Thank you. My time is expired.
    Mr. DeFazio. I thank the gentleman.
    And with that, Representative Larsen, the chair of the 
subcommittee.
    Mr. Larsen. Thank you. Mr. Dickson, you were a pilot, 
active pilot for Delta for how long?
    Mr. Dickson. For 27 years.
    Mr. Larsen. For 27 years. And then after you were a pilot 
for Delta, you worked for Delta in operations. Is that right?
    Mr. Dickson. Well, I was--so during my career, I flew as a 
line pilot for about 9 years, and then was the senior vice 
president of flight operations for the last 12 years of my 
career.
    Mr. Larsen. OK. And in that role you were pretty active 
inside of Delta as well as with outreach to the Federal 
Government in a capacity to the FAA?
    Mr. Dickson. Yes, sir.
    Mr. Larsen. So I know you have been on the job for 4 
months. But you were not just air-dropped into this job at FAA. 
You actually know what you are doing coming to the job. Is that 
right?
    Mr. Dickson. Yes.
    Mr. Larsen. Mr. Lawrence, you have been at the FAA for 
about 9 years, even though in your new job you just started 
last year, 2018. But before that, you were active in the 
Experimental Aircraft Association and other things. You just 
weren't air-dropped into your job last year. You actually know 
what you are doing in this new job. Right?
    Mr. Lawrence. Correct.
    Mr. Larsen. All right. So I think you should be proud of 
your credentials and not underplay them and the role that you 
play, both looking forward and in looking back. I wasn't in 
Congress when a lot of things passed in Congress, but I am in 
my job and I am responsible for those things.
    You are responsible for the things that happened before you 
got there, just as other people were. But you are responsible 
now for those things that happened before you got there.
    Mr. Dickson. Absolutely.
    Mr. Larsen. As well as you being responsible going forward.
    Mr. Dickson. Absolutely. The buck stops--I mean, I am 
responsible.
    Mr. Larsen. I am glad we can agree on that. Also, I would 
note that the existing ODA program didn't exist in the 1920s, 
although ODA in some form did exist back in the 1920s. The 
existing one started in 2005, passed under an FAA law. So that 
is what we are dealing with now as well, not what it was in the 
1920s, but what it is now.
    Mr. Dickson. Right.
    Mr. Larsen. It is very different than what it was. So I 
just want to establish some baseline here about what we are 
talking about, not the 1920s, not the fact that you are new to 
the job, because you are actually not all that new to the job. 
And given that, I want to ask you about some of the decisions 
that have been made at the FAA. And you may not be able to 
answer them today, but you need to answer them.
    For instance, the Boeing CEO, Mr. Muilenburg, stated to us 
the FAA fully vetted the company's 2016 revised system safety 
assessment. But the Indonesian accident authorities found that 
the FAA's response was simply to accept that submission--so 
fully vetted versus simply accept--with a note indicating that 
that approval was delegated to Boeing. So that is what the 
Indonesian air authorities noted in their report.
    So is that the process? Is fully vetting, is all that means 
is that Boeing gave it to FAA and the FAA accepted that, and 
that is what ``fully vetting'' means?
    Mr. Dickson. Fully vetting, in my definition, doesn't mean 
that. I would defer to Mr. Lawrence on the technical details. 
But I would say that from my understanding, it is not unusual 
for design applicants to come in and ask for certain things to 
be delegated.
    Mr. Larsen. Mr. Lawrence?
    Mr. Lawrence. So fully vetted would not just be a cursory 
review, and that is not what is done in the system. As we have 
talked about in the past, delegation is really used primarily 
in routine and well-understood areas. But it also relies on the 
data that were provided. And that is, as has been mentioned 
earlier, an area that we are focusing on. If we don't have the 
right information, it won't result in the correct answers.
    Mr. Larsen. So the JATR report also found that MCAS 
certification deliverables were not adequately updated by 
Boeing to reflect the changes to the flight control system. We 
sorted that out in the last hearing. At any time during the 
process, did the FAA notify Boeing that these documents were in 
fact insufficient? And if not, why not? I am trying to get at 
gaps in the process we use to certify. That is what I am 
getting at. So if not, why not?
    Mr. Dickson. My understanding is the design change for 
MCAS, which is what I believe you are referring to, was not 
made evident to the aircraft evaluation group, which would be 
responsible, really, for looking at the operational 
implications of how the system was working.
    There may have been some conversations within either the 
flight test or technical areas of the FAA. So I think what it 
indicates is this issue of fragmented communication and the 
fact that there was information out there. But it was difficult 
to put the whole picture together to make a sound decision. 
That is absolutely something that we need to address going 
forward.
    Mr. Larsen. OK. I have run out of time. Sorry about the 
questions, but I had to spend so much time bucking up your 
credentials to show that you are qualified to answer these 
questions for us today. And they don't all have to take--we 
need to get to the folks who made these decisions as well.
    But I have confidence that you have the credentials to 
answer these questions and help us. And I also have confidence 
to find out where the gaps are and hold folks responsible for 
that as well. And I will hold you responsible for that.
    Mr. Dickson. Thank you.
    Mr. DeFazio. I thank the gentleman.
    Now Representative Perry.
    Mr. Perry. Thank you, Mr. Chairman. I also want to 
acknowledge the representatives of those and their families who 
were lost in the tragedy, and offer my condolences as well. We 
appreciate your attendance and advocacy here today.
    Mr. Dickson, Administrator, we want to make sure that we 
have all the information so that we can trust the fidelity of 
the outcome of this when it finally is complete. In that vein, 
on October 7th of this year, the AP broke a story entitled, 
``Airline Went into Records after MAX Crash, Engineer Says,'' 
which detailed the contents of a whistleblower complaint 
submitted to the FAA and other international air safety 
regulators by Ethiopian Airlines former chief engineer Yonas 
Yeshanew.
    Can I ask unanimous consent to have this entered into the 
record?
    Mr. DeFazio. Without objection, so ordered.
    Mr. Perry. Thank you, Mr. Chairman.
    [The AP news story follows:]

                                 
   Article of October 7, 2019, ``Airline Went Into Records After MAX 
   Crash, Engineer Says,'' by Bernard Condon, Submitted by Hon. Perry
    [The article is retained in committee files and is available online 
at https://apnews.com/5ff095b8b9954b03925410680e8c907d.]

    Mr. Perry. The allegations outlined in the complaint are 
shocking and speak to a culture of corruption permeating the 
state-owned airline, Ethiopian safety regulators, and the 
Ethiopian Government at large. If true, the allegations of 
fabricating documents, signing off on shoddy repairs, and even 
beating those who got out of line appear to be directly 
relevant to investigations into the cause of the crash in 
question.
    Do you have an update on the status of the investigation 
into this complaint? And do you expect that completion of this 
investigation prior to the publication of the crash 
investigation report? And in light of these allegations against 
Ethiopian Airlines, a state-owned enterprise and that nation's 
safety regulators, does the FAA still have confidence in the 
integrity and validity of the current crash investigation being 
led by the Ethiopian Government?
    Mr. Dickson. Well, thank you for the question. I do not 
have an update today. But I will just say that, again, in this 
process of improving, we need to make sure as we made decisions 
and as the agency works with the committee to improve the 
margin of safety globally that we take all of the factors into 
account.
    And of course, the FAA, I think, has a responsibility to 
influence globally, even those that we don't directly regulate. 
We do punt some of that through ICAO, but we also do it with 
bilateral and regional relationships as well. So as various 
facts come to light, we certainly need to take those into 
account as we make decisions.
    Mr. Perry. I appreciate your answer. And I would just 
caution you, I suppose, even though you don't have an update. 
It seems like we would want to make sure that we had all the 
relevant information prior to the report, the crash 
investigation report. And this might be relevant. It may not, 
but we should know that.
    I would like to switch gears here a little bit. The FAA has 
identified December 20th, just in a few days, of this year as 
the new projected date to release the NPRM on remote ID and 
tracking of UAS. Is FAA still on track to release the NPRM, 
which is essentially in 8 or 9 days? And if this date does pass 
without release of the rulemaking, what are your plans to hold 
people accountable for the continued delays?
    Mr. Dickson. Thank you for the question on the remote ID. 
The process is it is actually out of the FAA at this point. It 
has proceeded out of the Department of Transportation and is 
under review through OMB channels. And so I expect any time now 
that we would have it out there. I don't have an exact date for 
you. I am certainly hopeful that it will be by December 20th.
    Mr. Perry. Could you restate that last part about December 
20th
    Mr. Dickson. I am hopeful that it will be out by December 
20th. I am certainly planning on----
    Mr. Perry. But you will confirm it is out of FAA's hands 
now?
    Mr. Dickson. Well, it is already out of FAA's hands, yes.
    Mr. Perry. All right. Thank you, Mr. Director. I yield.
    Mr. DeFazio. I thank the gentleman. And OMB is a perpetual 
problem as we try and move forward on safety issues, and let's 
hope that they can get this one done promptly.
    With that, I would turn to Representative Napolitano.
    Mrs. Napolitano. Thank you, Mr. Chairman.
    Mr. Dickson, the U.S. aviation industry has to be 
commended, and the FAA, for a stellar safety record over the 
past decade, up until the Lion accident. And our deepest 
condolences to the families, and thank you for being here.
    However, checks have uncovered a system both at Boeing and 
FAA about complacency in their commitment to safety because it 
has such a stellar record for so long. And complacency can be a 
dangerous thing, particularly in industries that are truly 
safety-critical.
    Despite this, we are not aware of any key efforts or 
initiatives in FAA to emphasize and re-energize the safety 
culture that once existed. We do understand, and you have 
talked to your staff about not rushing the process of 
ungrounding the MAX, for instance, and emphasizing safety 
first.
    But has FAA hired safety experts from outside the aviation 
industry to take a fresh look at your processes? And has it 
begun to hire more human factors experts, as some reviews have 
suggested you should? Have you personally sat down with the FAA 
managers and FAA technical staff in their Seattle office to 
hear the recommendations for improving FAA, and their concerns 
about oversight of Boeing? I would like to know what you have 
done to address safety and oversight issues at FAA.
    Mr. Dickson. Well, thank you. It is a great question, and I 
actually welcome the opportunity to respond.
    On my first day at the agency, in my first town hall, I 
talked about the importance of just culture, which means that 
we need to have a systematic way for employees to bring their 
concerns forward, and we will have better-thought-through 
solutions. We can't have groupthink. We have got to have honest 
debate as we make these decisions. And my experience in the 
airline industry is that that kind of construct is extremely 
powerful in raising the safety bar.
    Along with that, in my first 3 weeks I made a visit out to 
Seattle to see for myself and to talk to the team out there. 
And I actually had a conversation with one of our human factors 
test pilots, a Ph.D. in human factors, and asked her whether we 
had adequate human factors expertise and whether it was 
embedded in our processes as effectively as it needs to be. And 
I learned a lot from that conversation. I think there is an 
opportunity for us to continue to update and improve those 
skills in our workforce, and that is a big area of focus for 
me.
    Mrs. Napolitano. Sir, we are particularly interested in the 
testimony of Dr. Endsley on the second panel, dealing with the 
human factors involved with aircraft design, certification, and 
operation, a topic that I have discussed with a certain friend 
of mine, a professor of engineering at USC, Dr. Meshkati.
    What do you think FAA and Boeing can do better to 
incorporate human factors into the design and certification 
process of airplanes to prevent future accidents?
    Mr. Dickson. That is a great question. I am also interested 
in hearing the comments, human factors comments, in the second 
panel. And I have had a chance to read the testimony, and 
couldn't agree more with the principles that are articulated 
there.
    I think as cockpits become more and more automated over the 
decades, the job of flying an airplane does not get easier. But 
what it does is it changes the nature of where the threat is 
that needs to be mitigated. And there is an issue sometimes 
with manual flying skills if we are operating in an automated 
fashion too often. There is also an issue with losing 
situational awareness. And this is--it is impossible to 
engineer out human error.
    So as we build modern airplanes, it is very important to do 
so in a way that keeps the pilot engaged with the flight path 
of the aircraft because ultimately, management of flight path 
of the aircraft, putting it where it needs to be at any point 
in time, whether it is on the ground, taxiing the airplane, or 
flying it in the air, it amounts to three things, and that is 
understanding where your airplane is supposed to be, 
understanding your clearance, putting the airplane there to 
comport with the clearance, and then making sure it stays 
there.
    And humans are not very good passive monitors. And so this 
is where the issues about how engaging and the forms of tactile 
feedback that are presented to the pilot as he or she is flying 
the aircraft are extremely important, even as flight decks 
become more automated in the future.
    Mrs. Napolitano. Thank you. Mr. Chair, thank you.
    Mr. DeFazio. I thank the gentlelady for her questions and 
the answers.
    Representative Davis.
    Mr. Davis. Thank you, Mr. Chair, and thank you to all of 
our witnesses for being here.
    There are 794 Boeing employees living in my congressional 
district who work at their facilities in St. Louis, Missouri, 
or Mascoutah, Illinois. And back in October, we had the Boeing 
CEO before this committee, sitting right where you are, 
Administrator Dickson. And I explained to him that any time we 
have tragedies like those that are being discussed today, it 
really breaks my constituents.
    They are workers that are there. It breaks their hearts 
because they want to make sure that the planes that they are 
manufacturing are going to be able to fly safely, and we don't 
have tragic accidents that affected so many families that are 
here in this room today. And again, I echo my colleague from 
Pennsylvania, Mr. Perry's, comments. Our hearts go out to you. 
Our condolences. But thank you for your presence.
    Administrator Dickson, in your testimony you mentioned you 
are working tirelessly to ensure the FAA learns from mistakes 
surrounding these tragedies. And I know you mentioned in your 
testimony--I know you have answered some of my colleagues' 
questions--but what specifically have you not addressed yet--is 
the FAA doing to ensure that oversight programs work to protect 
passengers flying by plane, and also to preserve the dignity of 
the workers, my constituents, who build the planes?
    Mr. Dickson. Well, thank you for the question. I 
certainly--we are all in this together. And the situation with 
the 737 MAX is unprecedented in many respects, and so for the 
time being we have pulled that work inside the FAA. We are not 
delegating anything to Boeing because the expectation is that 
the FAA is going to use its resources and the resources of 
others--we talked about the TAB here--to make sure that we dot 
every I and cross every T.
    And that is not to be bureaucratic or slow about it. But we 
need to make sure that the public has confidence in the 
airplane, and I am confident that I would put my own family, 
and those Boeing employees would put their own families on the 
airplane, once we are finished with this process.
    So again, we have a number of milestones yet to complete. 
We have gone through the workload management engineering 
simulator modules most recently. That data is being analyzed. 
And we are currently looking at how the software has been 
developed, along with our international partners, and running 
all the audit trees that need to be run when you are talking 
about software. After that there will be a certification flight 
and then, as you know, I am going to be flying the airplane 
myself before I sign off on it.
    Separately, we are involving not only U.S.-trained pilots 
but pilots from around the world in ensuring that the training 
requirements that we require for getting the airplane flying 
again are where they need to be.
    Mr. Lawrence, I don't know if you had anything else you 
wanted to add.
    Mr. Davis. Any other witnesses want to add?
    [No response.]
    Mr. Davis. OK. Well, Administrator, thank you. And I am 
going to relay the same thing that I relayed to the Boeing CEO. 
Look, we expect results. No family should go through the 
tragedy that these families have gone through. We know there 
are things that we could all do better. We want to be here to 
assist you and the FAA to make that happen. But results matter.
    And I certainly appreciate your presence here today. I 
certainly appreciate your leadership, and look forward to 
working with you. And Mr. Chairman, I yield back.
    Mr. DeFazio. I thank the gentleman.
    And with that, Representative Lipinski.
    Mr. Lipinski. Thank you, Mr. Chairman.
    I want to start off by--so that no one out there faints, I 
do not believe we should get rid of ODA. I am not suggesting 
that. But I wanted to preface what I was going to say with that 
because, Administrator, you had said that the system is not 
broken. But improvements can be made.
    We have seen 346 people die. And there was a second crash, 
and we knew more after the first crash, before that second 
crash. And so I would say the system is broken. Something went 
wrong.
    The first thing I want to raise is something Chairman 
DeFazio raised at the beginning, the MCAS risk assessment 
document. After the first crash, do you know--are you aware--of 
where this--well, who saw this document in the FAA?
    Mr. Dickson. I was not involved in that. I am not sure 
exactly. I cannot speak for who saw it. I know that it was--
again, it is a decision tool that the----
    Mr. Lipinski. Who makes the decision, then?
    Mr. Dickson. Well, the board that comes together on 
continuous airworthiness, essentially uses it to make its 
decisions. Earl can walk you through how that process works.
    Mr. Lawrence. So whenever we get reports, and we get 
reports on a regular basis, we are constantly plugging those 
reports into tools and evaluating what action needs to be 
taken. And obviously, this was a very large action. We did not 
need the forms to tell us this was a tragedy and that we needed 
to act quickly.
    But the forms do educate us on how to respond. And what the 
form----
    Mr. Lipinski. Was this an acceptable risk, though?
    Mr. Lawrence. It is not an acceptable risk, and that is why 
we issued an emergency AD before we even completed the first 
set of evaluations, and then followed up with several other 
evaluations on what additional----
    Mr. Lipinski. Let me----
    Mr. Lawrence [continuing]. Actions needed to be taken.
    Mr. Lipinski [continuing]. Ask a question on that. You 
mentioned the emergency AD. Because I wanted to ask: Why was 
there no mention of MCAS in that emergency AD?
    Mr. Lawrence. So the Continuing Airworthiness Review Board 
is made up of pilots from our aircraft evaluation group. It is 
made up of maintenance people. Made up of engineers. They 
evaluated all the information, and they made a determination 
not to use those words because those words were not included in 
the Boeing manuals to start with.
    And we--there was a discussion: Would that create too much 
confusion? Because the system that needed to be addressed was 
the trim system. And so they did not use those words at that 
time because the action that needed to be taken by the pilots 
was the----
    Mr. Lipinski. It all started with the----
    Mr. Lawrence [continuing]. Trim runaway checklist.
    Mr. Lipinski [continuing]. MCAS not being named in the 
manual to begin with. I don't have much time, so one other 
thing that I wanted to mention, follow up a little bit on what 
Mr. Larsen, Chairman Larsen, had been talking about.
    I have a degree as a mechanical engineer. I know a little 
bit about airplanes, not certainly as much as the pilots here 
do. But I also have a degree in systems engineering. I don't 
understand how it is possible that part of the procedure is not 
to look at the entire system. It makes no sense to me that you 
would just look at each piece of the system and not how the 
entire system works together.
    And to me, that says to me that the process is broken. The 
ODA process is broken. I just want to be very clear that I 
think that that needs to be changed.
    Administrator Dickson, I wanted to get your response on 
that.
    Mr. Dickson. I think the use of integrated systems safety 
assessments is absolutely an area that we have incorporated, 
actually, in the MAX process up to this point. And putting 
gates into the process at which this occurs more frequently is 
definitely something that we need to be looking at.
    And remember, those systems safety assessments are--that is 
actually one of the process improvements I am talking about 
putting in place in the very short term, even with ongoing 
certification activity.
    Mr. Lipinski. Thank you. I yield back.
    Mr. DeFazio. I thank the gentleman. And in my first 
questions, I did ask that you would look at the distribution of 
this TARAM report. And I would like given what Mr. Lawrence 
just said, to know specifically if the continued airworthiness 
panel received this document and considered it at that time. 
Thank you.
    With that, I would recognize Representative Babin.
    Dr. Babin. Thank you, Mr. Chairman.
    I want to thank you, expert witnesses from the FAA, as well 
for your testimony. I also want to thank the families and 
friends of those who were lost in the tragedies.
    Before I get to my questions, I want to make just a quick 
comment. I think it is lamentable that we are once again 
discussing the Boeing 737 MAX crashes, and not one FAA official 
in charge from the time when the decisions related to the 
certifications in question were made has been asked to testify.
    I know that Ranking Member Sam Graves and Ranking Member 
Garret Graves have requested the chairman hold a hearing with 
these individuals. And I look forward to that in the future.
    Administrator Dickson, could you briefly discuss how other 
countries certify their planes? And maybe Mr. Lawrence can 
chime in here as well. Do they have something similar to the 
process that we use here? It is my opinion, and that of several 
others, that we shouldn't throw the baby out with the bathwater 
because our system and processes are not broken. But what 
improvements could be made to our current framework to ensure 
proper certification oversight?
    Mr. Dickson. That is a great question, and I will let Mr. 
Lawrence elaborate on my 35,000-foot answer.
    Dr. Babin. OK.
    Mr. Dickson. The processes around the world, and we are 
really talking about the four primary states of design that we 
are working with--although there are other entities that build 
and design airplanes--it is really EASA, the Europeans; the 
Canadians; and the Brazilians. And processes are similar.
    Because of different legal formulations and the fact that 
EASA is a multinational regulator that sits on top of the 
national regulatory authorities, there are some differences in 
how far their process goes and how it is managed.
    I think that the concepts are the same in terms of 
delegation, but rather than delegating individual items, for 
example, if you contrast our system with the Europeans, we have 
a lot of flexibility in delegating, and it is basically a 
privilege to be able to delegate certain items.
    Usually, as Mr. Lawrence said earlier, they are pretty 
routine items. And the FAA can modify those decisions once it 
starts, whereas in Europe they actually have a design 
certificate, essentially, for the manufacturing entity. So 
really the whole process is delegated in many respects, but 
there is not the ability to delegate individual items. They 
have an oversight system set up to look at----
    Dr. Babin. Yes. As briefly as you can, Mr. Lawrence. I have 
another question or two. Thank you.
    Mr. Lawrence. I think that is a very good description. The 
key difference is, on the legal system that EASA and the 
European Union is working under, it is a certificate that a 
manufacturer, a design organization, achieves. And so they have 
an approval.
    So it is really a different system. There is not a constant 
review of things. And in our system, we can pick and choose 
what we want to review, what we feel we need to review, where 
there is more upfront work, though, in the European system. I 
would say there is a lot more review and understanding ahead of 
time. And those are some of the things that we are looking to 
do as well.
    Dr. Babin. OK. Thank you. We have heard a lot about how 
assumptions may have been made about pilot capabilities that we 
are learning may not have been accurate. Can you shed some 
light on how those assumptions were made, as quickly as 
possible, Mr. Dickson?
    Mr. Dickson. The assumptions are really of some 
longstanding in terms of the technical requirements. They were 
developed over a period of years with test pilots and 
engineers. And I don't know if there are any other details on 
that that you would like to share. But these are some of the 
things that, as a result of the reviews that we are doing now 
and other external reviews, that are being revisited.
    Dr. Babin. OK. Thank you. And then adding to it, in your 
opinion, is there anything that we in the United States can do 
to standardize the qualifications of pilots globally? We have 
done that well here domestically, I think very well. But what 
about internationally, and what role could the FAA play in 
encouraging that?
    Mr. Dickson. Thank you for the question. I think that the 
FAA can play a very influential role there. As a matter of 
fact, we introduced a paper at the recent ICAO assembly, and I 
was part of the team that went up there, the International 
Civil Aviation Organization, about lifting global pilot 
training standards. And so that is something that we have taken 
on as an agency already.
    But then we will also have similar discussions with 
regional regulatory entities and associations as well as some 
of the bilateral relationships that we have around the world.
    Dr. Babin. OK. Thank you. My time is expired. I yield back, 
Mr. Chairman.
    Mr. DeFazio. I thank the gentleman.
    With that, Representative Cohen.
    Mr. Cohen. Thank you, Chairman and Ranking Member Graves, 
for holding this important hearing. And thanks to the witnesses 
for being here today, and to the families. Again, my 
condolences.
    Today's hearing is another significant step in our 
oversight of the two fatal Boeing 737 MAX accidents. These 
tragedies, which claimed the lives of 346 individuals, have 
unearthed a slew of problems regarding the FAA's ability to 
effectively oversee those it regulates.
    For instance, one issue that has raised serious concerns 
relates to the angle-of-attack, AOA, disagree alerts. An AOA 
disagree alert warns pilots when the aircraft's AOAs, angle of 
alert sensors, do not match. In August 2017, Boeing learned 
that the AOA disagree alerts were only functional on the planes 
where customers also purchased an optional AOA indicator. To 
put that into context, 20 percent of Boeing 737 MAX customers 
purchased those optional AOA indicators.
    AOA disagree alerts were not functioning, then, on about 80 
percent of the 737 MAX aircraft sold to airlines around the 
world. Southwest Airlines, which does operate in my hometown, 
even said in a statement that it only learned that this system 
was optional after the Lion Air tragedy.
    We learned in our previous hearings in October that Boeing 
initially decided to wait to fix the defect for 3 years after 
discovering this flaw. Boeing also confirmed that it kept 
producing planes with this known defect, and did not inform the 
FAA or its customers about it until after the Lion Air crash in 
October 2018. This was over 1 year after Boeing learned about 
the defect.
    More alarmingly, the Indonesian Civil Aviation Authority's 
final report on the Lion Air crash found that the inoperative 
AOA disagree alert on the airplane ``contributed to the crew 
being denied valid information about abnormal conditions.'' 
This is completely unacceptable. Someone needs to be truly held 
accountable. Someone needs to be held accountable at Boeing.
    Administrator Stephen Dickson and the FAA shares in this. 
Why has the FAA not taken any actions against Boeing, including 
a civil penalty for knowingly delivering aircraft with 
defective, nonfunctioning parts that pilots believed were 
functioning?
    Mr. Dickson. Well, thank you for the question, Congressman. 
And I have not made a decision on this and a number of other 
matters, as I mentioned earlier. I have expressed my 
disappointment to the Boeing leadership about that they need 
now and previously to be transparent in the sharing of 
information with my team here at the agency. And so I reserve 
the right to take further action, and we very well may do that.
    I am not going to say today exactly what that may consist 
of, but the facts that you just presented will certainly go 
into that decision.
    Mr. Cohen. Thank you, sir. Do you think that it almost 
borders on criminal? They have knowledge of a defect, and they 
don't give notice, and they invite the flying public onto those 
planes?
    Mr. Dickson. I don't have an opinion on that. I will say 
that, again, if you look, as I said in my remarks or in answer 
to a question earlier, I am not at this point interested in 
casting blame because I want to run all of these issues to 
ground and I want to fix the problem. There will be time for 
the rest as we move forward.
    Boeing has--grounding the airplane, not delegating anything 
during the MAX return-to-service process, not delegating the 
airworthiness certificates on each individual undelivered 
aircraft. We talked earlier about the slat tracks enforcement 
action, and I haven't ruled out other actions as necessary and 
as you point out. And I will take those actions----
    Mr. Cohen. Thank you. I appreciate you doing that. There 
are serious concerns about Boeing's transparency about the 
alert system that have been raised.
    Today I introduced the Safety Is Not for Sale Act. I 
introduced it with Senators Markey and Feinstein, and we 
introduced it earlier in the Senate. This bill would require 
all air carriers to adopt additional safety features and ensure 
all nonrequired safety enhancing equipment is offered or 
provided to all carriers without an additional charge.
    Aviation safety should not be treated as a luxury, bought 
or sold for an extra fee. Mr. Nader would say you shouldn't 
charge for seatbelts, and you shouldn't. The flying public 
expects and deserves more. I look forward to continuing to work 
with my fellow committee members and relevant stakeholders to 
ensure the safety and airworthiness, hopefully, of the Boeing 
737 MAX. And with that, I yield back the balance of my time.
    Mr. DeFazio. I thank the gentleman.
    Now I will turn to the ranking member of the subcommittee, 
Garret Graves of Louisiana.
    Mr. Graves of Louisiana. Thank you, Mr. Chairman.
    Mr. Chairman, I want to cite the comments that my friend 
from California, Mrs. Napolitano, made earlier about the safety 
of the domestic aviation industry, the FAA. I was reading a 
Wall Street Journal article this morning, and it cited how, 
prior to the 737 MAX disasters, I believe it was the Boeing 
planes had an accident 1 out of every 10 million flights.
    Comparatively, if you look at the European, Brazilian, 
Canadian, and other manufacturers that are largely governed by 
their civil aviation authorities, it was an accident once for 
every 3 million flights. So again, 1 in every 10 million 
flights, 1 in every 3 million flights. And we certainly do need 
to get back to that level of safety, or, as I said before, even 
better.
    In the aftermath of the Indonesian crash, so there was an 
emergency airworthiness directive that was put in place, which 
is rare. But also, there was--the CARB was established, a 
Corrective Action Review Board. Did the Corrective Action 
Review Board, did they--were there any recommendations they 
made that FAA did not follow?
    Mr. Dickson. No. The FAA followed the recommendations from 
the experts on the CARB.
    Mr. Graves of Louisiana. And these are----
    Mr. Dickson. And that was to develop the MCAS software 
check.
    Mr. Graves of Louisiana. And these are technical experts?
    Mr. Dickson. Yes, sir.
    Mr. Graves of Louisiana. And did they recommend a 
grounding?
    Mr. Dickson. They did not.
    Mr. Graves of Louisiana. They did not recommend a 
grounding? When the plane was ultimately grounded in the 
aftermath of Ethiopia, which actually, by the way, in the 
Ethiopian Air disaster, did they comply with the EAD? Did the 
crew comply with the EAD in that case?
    Mr. Dickson. Well, again, the accident report is not out 
yet, so it remains to be seen. On my first day at the agency I 
did have a chance to see the flight data recorder information 
from both accidents and compare the two. And in my estimation, 
for whatever reason, the AD procedures that the FAA expected to 
be followed were not followed.
    Mr. Graves of Louisiana. And so I just want to make sure we 
highlight this because in the future, if something happens and 
an AD is issued, an emergency airworthiness directive is 
issued, we need to ensure that there is a better process, that 
those lessons learned are actually applied and complied with. 
And so I think that is one of the many lessons learned.
    And you are exactly right, and I want to express caution 
with my own statements. We do need to make sure we wait for the 
Ethiopian report to be completed to see what their takeaways 
are.
    A question was asked of you earlier, and I want to give you 
an opportunity to perhaps clarify. You were asked if you were 
responsible for decisions of your predecessors. Now, look. I 
ultimately ran for the Congress because I was frustrated by 
what was here and I wasn't happy with the performance. That 
motivated my decision to run.
    We are where we are as a Nation today, as a Congress. We 
are where we are as an FAA. Are you responsible for each of the 
decisions that were made that got us to where we are? Or are 
you responsible with where we are now and where we go?
    Mr. Dickson. Well, I appreciate your comments, Congressman 
Graves. I feel responsible, regardless. And that is just who I 
am. And I think it is important that--Chairman DeFazio 
mentioned the career professionals at the FAA. I need to 
advocate for them and I need to support them.
    I need to make sure that they have got the tools and the 
direction and the support, whether it is Earl Lawrence and his 
team or Ali Bahrami in the Aviation Safety Organization. Flight 
standards, the Air Traffic Organization, whatever the case may 
be, my job as a servant leader is to make sure that they have 
what they need to be effective in their jobs.
    So I feel responsible for that. And I want to take those 
lessons that are learned, and apply them to put improvements in 
place so that we continue to raise the bar on safety.
    Mr. Graves of Louisiana. Well, and I certainly share the 
objective of raising the bar and ensuring that we have maximum 
safety.
    So let me get to the last point here. So the CARB did not 
recommend a grounding, but the plane was ultimately grounded. 
Was that a decision by the technical folks or was that decision 
by someone else, to ultimately ground the plane?
    Mr. Dickson. That was a decision, I believe, that was made 
by Mr. Bahrami, I think, or at least was driven by the 
availability of additional data.
    Mr. Graves of Louisiana. That was my understanding, that--
--
    Mr. Dickson. Yes. Then-Acting Administrator Elwell.
    Mr. Graves of Louisiana [continuing]. It came from Mr. 
Bahrami as well.
    And I just want to make note, Mr. Chairman, that this was 
not a decision of the technical folks. This was the decision of 
the leadership, to ultimately ground the plane. Yield back.
    Mr. DeFazio. I thank the gentleman.
    Representative Sires.
    Mr. Sires. Thank you, Chairman, for holding this hearing. 
Administrator Dickson, thank you for being here. And my heart 
goes out to the family members that are here.
    Later on, we are going to be hearing from Ed Pierson, who 
oversaw a portion of the 737 MAX final assembly at the Renton 
plant in Washington State. Mr. Pierson wrote to and met with 
general managers of the Boeing 737 fleet months prior to the 
Lion Air tragedy to express his concern that the safety and 
quality were being compromised due to Boeing's production 
pressures.
    According to Mr. Pierson, in early 2018 Boeing's job behind 
the schedule spiked to 10 times the normal amount, and the 
rollout on-time percentage dropped to below 10 percent. Also, a 
part backlogged caused Boeing to begin experiencing substantial 
out-of-sequence work.
    This means work was performed outside its planned location 
or time, which increases the risk of mistakes. Boeing's 
tracking system saw quality issues increase by over 30 percent. 
I understand that Mr. Pierson's attorney has written to you 
three times?
    Mr. Dickson. He has written to me--I received a letter from 
him in September, I believe.
    Mr. Sires. Well, according to him, it is three times in 
September to alert you to Mr. Pierson's concerns of chaotic, 
rapidly deteriorating factory conditions that he witnessed at 
the Boeing production facility. He also wrote that he believed 
the flying public would remain at risk unless this unstable 
production environment is rigorously investigated and remedied.
    Administrator Dickson, the FAA grants production 
certificates to Boeing. Right? They grant the----
    Mr. Dickson. Yes, sir.
    Mr. Sires. OK. Has the FAA investigated any other 
production concerns of Boeing's that Mr. Pierson has raised?
    Mr. Dickson. We have engaged Mr. Pierson, and we are 
looking into these issues. Mr. Lawrence may have more details 
on this. But we take concerns wherever they come from 
seriously, and we have a process for dealing with that, for 
interviewing and investigating concerns that are raised by 
individuals and things that we observe during our own 
oversight.
    Mr. Sires. I don't mean to be difficult. But I just think, 
to look into it, it doesn't seem enough. I want a commitment 
from you that we are going to investigate these concerns for 
the----
    Mr. Dickson. And we are doing that. You have my commitment. 
We are doing that.
    Mr. Sires. Thank you. I don't have any further comments.
    Mr. DeFazio. OK. I thank the gentleman.
    Representative Spano.
    Mr. Spano. Thank you, Mr. Chair. And I too want to express 
my condolences to the members of the families that are here 
today. My prayers are with you, and I just ask God's peace and 
comfort as you deal with this difficult tragedy in your lives.
    I had an opportunity several months ago to have a meeting 
with a colleague of mine, a friend who is also a pilot and had 
flown the 737 MAX. At the time, he and I--I am not a pilot; I 
just ride in airplanes. That is as much as I know about them.
    But what he expressed to me is there was a periodic 
briefing that pilots are provided, which potentially provides--
essentially, it is a binder that includes memos, directives, 
information that pilots should be aware of as it relates to 
safety issues on the planes that they are piloting.
    He told me that this particular issue with the MCAS system 
was in fact, to his recollection, included within that binder 
of things to be aware of. All right? But that it was kind of 
buried at the bottom of a stack of such memos. OK? So I guess 
my question--and so from his perspective, and it certainly 
seems from my perspective as a lay person, that if you are 
going to have a memo relating to an issue of such importance 
buried in a stack this big, are you really providing any 
meaningful direction to pilots?
    And so, given that scenario, is that in fact the case? Can 
you comment on that? Appreciate that. Thank you.
    Mr. Dickson. Well, I believe--thank you for the question--
as Deputy Administrator Elwell had said in his previous 
testimony, it is my belief, and he shares it, that pilots 
should have known about the system on the airplane. It should 
have been part of the initial training, particularly as the 
design was changed so that it would operate more in the heart 
of the flight envelope.
    With respect to information about unscheduled stabilizer 
trim and the emergency airworthiness directive, as Mr. Lawrence 
said earlier, that is an extraordinary action. I think the last 
one that the FAA had done was about 2 years earlier, in 2016. 
It is something that should be stamped on top of everybody's 
forehead out there.
    So if that is not reaching the level of prominence that it 
needs to in the operator community, that is definitely 
something that we need to look at.
    Mr. Spano. Yes. Thank you. And I would encourage you to do 
that because the takeaway that I got from my conversation from 
him is that he was certainly aware of the issue, but the fact 
that you would have such an important memo with regard to an 
issue of safety that is essentially buried, that can't happen. 
It seems to me that those should be issues that should be 
number one in terms of prominence.
    Another question I had for you is that there--and if there 
was a question earlier, I apologize--but are you aware of 
allegations by a former FAA safety engineer that the FAA's 
management safety culture is broken and demoralizing to 
dedicated safety professionals? And if you are, how do you 
respond to that allegation?
    Mr. Dickson. Well, I want to make sure--again, on my first 
day at the agency, I emphasized that. And this has to come from 
the top, that we need to have a healthy safety reporting 
culture. It is what we demand of those that we regulate. I come 
from the airline business, and the ability to be able to 
systematically intake or uptake safety concerns is extremely 
important to the safe operation of an airline. And I think it 
is equally important, if not more so, within the agency.
    So we need to--as people raise issues, either through their 
chain of command, through their boss, or as whistleblowers, 
there also needs to be this middle ground where we are able to 
take in systematically safety concerns.
    One of the things that we need to do a better job of is 
going back after decisions are made and communicating to the 
workforce what all the considerations were, and why decisions 
are being made because sometimes there may be a perception 
that, oh, you sided with this person or that person, or this 
company or--you know, chose to retain someone in the agency. 
That is not the right lens that we need to be looking through 
these things.
    Also, we want to have a system where we encourage healthy 
debate as we make decisions. You are going to have, whether 
there are pilots or engineers, subject matter experts, you want 
to have that healthy debate, but ultimately somebody has to 
make the decision. And in these cases that you are referring 
to, the decisionmakers themselves are actually experienced 
technical experts as well.
    Mr. Spano. Thank you, sir. I yield back.
    Mr. DeFazio. OK. I thank the gentleman.
    Now Representative Johnson.
    Mr. Johnson of Georgia. Thank you, Mr. Chairman. I would 
ask that the TARAM report that you displayed during your 
questioning be placed back on the screen.
    And Mr. Dickson, I would like to direct your attention to 
it. In December of 2018, about 1 month after the Lion Air 
flight 610 crashed, the FAA performed this risk assessment that 
calculated the likelihood of future 737 MAX crashes caused by 
the erroneous MCAS activation. Is that correct?
    Mr. Dickson. Yes, sir. It is correct.
    Mr. Johnson of Georgia. And this is the report that issued 
from that analysis. Correct?
    Mr. Dickson. Yes. And actually, my previous answer--I 
should elaborate--this is looking at all the factors that went 
into the accident, so not only MCAS but the other----
    Mr. Johnson of Georgia. Not just the MCAS?
    Mr. Dickson. The other factors, yes.
    Mr. Johnson of Georgia. But you would admit that the 
results show an unacceptable risk?
    Mr. Dickson. Yes. And that is why the actions were taken, 
to reduce that risk.
    Mr. Johnson of Georgia. In fact, it is a drastic 
unacceptable risk, is it not?
    Mr. Dickson. Yes. So what it is indicating to us is 
essentially, over the life, about a 45-year period, that we 
would have an unacceptable level of risk, and so we need to 
take action to be able to reduce that risk to the level that we 
want.
    Mr. Johnson of Georgia. So this is definitely an important 
document that exists within the bowels of the FAA. Correct?
    Mr. Dickson. It is a decision support tool. Remember that 
before, data like this was----
    Mr. Johnson of Georgia. My question is that this document 
exists in the bowels of the FAA. Correct?
    Mr. Dickson. It exists--I wouldn't necessarily say--I think 
we are pretty aware of it at the highest levels of the FAA now.
    Mr. Johnson of Georgia. But when did the highest levels of 
the FAA--well, let me put it like this: Who was it that took 
action on this report? And when was the first action taken?
    Mr. Dickson. Well, the first action was taken just about 
immediately, I think.
    Is that correct, Earl?
    Mr. Johnson of Georgia. And so what was the date? And what 
was the action taken?
    Mr. Dickson [to Mr. Lawrence]. How would you describe that?
    Mr. Lawrence. So the first action that was taken, sir, was 
the emergency AD, even before these forms were completed, and--
--
    Mr. Johnson of Georgia. Well, I want to know: After this 
form was completed, what was done? Because you have said that 
it was a drastically unacceptable risk. And it was--this study 
was performed prior to the Ethiopian Airlines crash.
    Mr. Dickson. Yes, sir.
    Mr. Johnson of Georgia. Which my friends on the other side, 
by the way, want to try to impugn that it was the Ethiopian 
Airlines, an African airline, and their personnel who were 
somehow responsible for both of these crashes, when this 
hearing is about the FAA certification process. And I resent 
that.
    But getting back to my point here, what was done about this 
report when it was first received by the FAA?
    Mr. Lawrence. So again, this is a tool used by our----
    Mr. Johnson of Georgia. What was the date?
    Mr. Lawrence [continuing]. By a board that meets on a 
regular basis, and----
    Mr. Johnson of Georgia. What was the date on this? What is 
the date?
    Mr. Lawrence. Yes. Before this report was even completed, 
it was recognized that we needed to do additional work, that 
even the----
    Mr. Johnson of Georgia. OK. Well, what I am getting to is 
what was done after this report was generated?
    Mr. Lawrence. Before this report was generated, the action 
was----
    Mr. Johnson of Georgia. After the report was generated. 
After the report was generated, is what I was getting at.
    Mr. Lawrence. There wasn't an additional action after this 
because the action prior to this even being completed was to 
redesign the system. What this report guided the board to look 
at was how much time would we allow Boeing to redesign the 
system?
    Mr. Johnson of Georgia. Well, let me ask this question. Can 
either one of you admit to yourselves that the FAA made a 
mistake in not taking action on this TARAM report when it was 
first issued?
    Mr. Dickson. I would say that this is something that we 
need to look at very closely, and----
    Mr. Johnson of Georgia. Well, I mean, was a mistake made?
    Mr. Dickson. Obviously, the result is not satisfactory.
    Mr. Johnson of Georgia. Well, you just can't bring yourself 
to say that we made a mistake? And you weren't even there at 
the time.
    Mr. Dickson. Absolutely. This is a part of the process that 
we need to look at. Whether it was the data that goes into the 
decision, the decision did not achieve the result that it 
needed to achieve.
    Mr. Johnson of Georgia. Now, is the fact that the FAA, 
overseeing Boeing with 45 personnel to 1,500 to Boeing--does 
that indicate that perhaps there is a problem with staffing in 
the FAA certification process so that we do not allow the fox 
to guard the henhouse to the extent that it happened with the 
737 MAX?
    Mr. DeFazio. If you could briefly answer his question 
because we are over time.
    Mr. Dickson. I think that that is something that we need to 
look at. It is not numbers as much as it is the skill set 
within the workforce because that group that is overseeing the 
Boeing ODA has the ability to draw resources from without the 
agency, very similar to the way that a certificate management 
office oversees an airline.
    Mr. Johnson of Georgia. OK. Thank you.
    Mr. DeFazio. I thank the gentleman.
    Representative Miller.
    Mrs. Miller. Thank you, Chairman DeFazio.
    And to all of you who lost loved ones, my heart goes out to 
you. I hope you have been able to be surrounded by family and 
friends and your faith in love and the light that it will bring 
you. It was a horror for you, and my heart does go out to you.
    I think that this discussion and the questions that we have 
had today from both sides of the aisle indicate how we want to 
not ever have this happen again. It is definitely a bipartisan 
issue because we are all human beings, and we all want to be 
safe, and we all--I assume we all take airplanes somewhere at 
some time in our life. And there are moments when you fly, if 
you are not a pilot, you kind of go, ooh, what was that?
    And so moving forward, it appears to me that we need more 
transparency and communication when it comes to creating an 
international aviation safety standard that does work for 
everyone. It also appears that there are many areas that we 
need to work on. The only way for us to come together to tackle 
safety is to understand that we need to take a multifaceted 
approach to the issue. And I believe that is what you all are 
trying to do.
    Mr. Dickson, can you elaborate on the Joint Authorities 
Technical Review and what exactly is included?
    Mr. Dickson. Well, thank you, and I appreciate the question 
and the opportunity to comment. I agree with you 100 percent 
that these issues need to be looked at from an aviation system 
perspective. And we are seeing a lot of growth in the system 
internationally, and the U.S. is a stable--it is a growing, 
healthy system, but it is a pretty mature, stable system. And 
what we do here, we are selling airplanes around the world. It 
needs to be able to work everywhere. And so the issues that we 
need to look at may vary somewhat.
    But in terms of the JATR report, I think it is very 
important to understand that the FAA commissioned that group 
itself. But it is sort of like one piece of the pie. And it 
does not offer the complete perspective. The perspective from 
the TAB is another perspective that will inform our future 
efforts. We also have the Secretary's Special Committee. We 
have the investigative activities of this committee, as well as 
the Senate Commerce Committee, and then also, the DOT IG 
report.
    So all of these things, and including our own internal 
analysis, will help us get to the right answer. And that is 
what we look forward to working with you on.
    The JATR report really comes down to--if you take all of 
the 12 recommendations, it really comes down to 3 things. And 
that is, A, a holistic approach rather than, OK, I have 
followed this rule and worked down the checklist. More 
transactional is the word that I use in aircraft design.
    A more effective integration of human factors 
considerations throughout the design of the aircraft, and not 
just building the machine and then figuring out how to operate 
it on the end. Now, that is simplistic. That is not how the 
process works today. But that is an end of the spectrum that 
maybe we need to move a little more closely to what I have 
described with a more integrated human factors approach.
    And then there are some shortcomings that have been 
identified that I have seen in how various offices within the 
manufacturer communicate with each other, and then the entities 
within the FAA. I think we need to bolster our systems 
engineering expertise. We don't build the airplane. We just 
need to oversee the process by which the manufacturer builds 
the airplane.
    And to do that system engineering expertise is very 
important to understand how all these systems interact; and 
then also, project management discipline, because these 
certification projects take place over multiple years. And if 
you look at the continuing operational safety of a fleet, you 
are talking about a product that is going to be out there for 
maybe 35 to 50 years, from----
    Mrs. Miller. OK. I want to interrupt you also. I want to 
ask you: Knowing that our products will be used across the 
world, often in places that we are not able to regulate, how 
can we continue to improve safety standards across aviation as 
a whole?
    Mr. Dickson. Well, that is a great question. It is 
something that is of great interest to me. Again, there are 
ways that we can work through ICAO, and there are ways that we 
can work bilaterally and regionally. But we also need to take a 
look at, what are the responsibilities when you are developing 
and selling a product around the world, not just for a U.S. 
manufacturer, but for all the certification authorities that we 
talked about. And how do you take those issues into account? 
And does the manufacturer need to be looking at who the 
customer is in terms of what the support is in terms of 
operation?
    Mr. DeFazio. I thank the gentleman for his answer.
    Just back for a minute to the TARAM, and I hate to keep 
belaboring, but I still think this is an incredibly critical 
issue. And in response to Representative Johnson, you said the 
result wasn't satisfactory. And again, I want to really track 
how that was utilized in the decisionmaking process because 
yes, you issued an airworthiness directive, but that was the 
month before.
    Then you got the TARAM, which says, wait a minute. We are 
going to lose 15 of these planes, and you just said 35 to 50 
years. But when within 35 to 50 years? And unfortunately, it 
was within 5 months. So I think it was way less than 
satisfactory. It was catastrophic.
    So with that, we would turn to Sean Patrick Maloney.
    Mr. Maloney. Thank you, Mr. Chairman.
    Mr. Dickson, do you know who Ed Pierson is?
    Mr. Dickson. I have not met him personally, but I know of 
him.
    Mr. Maloney. And you understand he was the senior manager 
at the Boeing 737 Renton, Washington, plant. Right?
    Mr. Dickson. Yes, I do.
    Mr. Maloney. And you understand he oversaw production for 
the 737 final assembly?
    Mr. Dickson. Yes.
    Mr. Maloney. And a moment ago when you were responding to 
my colleague's questions, you could not bring yourself to say 
that the FAA made any mistakes here. I know you used different 
language. I think some of us would feel better if you showed a 
little more passion for this, sir.
    So I want to give you another opportunity at this. I know 
you knew that he wrote to you--that Mr. Pierson wrote to you 
once in September. But in fact, he wrote to you three times, 
sir. He wrote to you in September, he wrote to you in October, 
and he wrote to you in November. And I know you just got on the 
job.
    But he didn't just write you letters. He sent you extensive 
information, didn't he, sir?
    Mr. Dickson. Yes.
    Mr. Maloney. On production problems that he identified at 
the Renton facility?
    Mr. Dickson. Yes.
    Mr. Maloney. So my question to you is: Have you interviewed 
Mr. Pierson?
    Mr. Dickson. We have reached out to Mr. Pierson to 
schedule----
    Mr. Maloney. That is not my question. Have you interviewed 
him?
    Mr. Dickson. I know that we have contacted him, yes. I 
don't know if--I am not----
    Mr. Maloney. Excuse me. He is sitting right over there. 
Will you commit, as we sit here today, that you will interview 
Mr. Pierson?
    Mr. Dickson. Absolutely.
    Mr. Maloney. Will you investigate the production problems 
at the Renton facility?
    Mr. Dickson. Yes.
    Mr. Maloney. Have you done so to date?
    Mr. Dickson. I know that there is ongoing activity through 
our oversight.
    Mr. Maloney. Sir, I am sorry. That is not good enough. You 
have got a bunch of people over here who lost loved ones. Come 
on. Have you to date investigated production problems at the 
Renton facility?
    Mr. Dickson. I believe we have. I am not aware of the 
details.
    Mr. Maloney. Well, let's talk about that. Have you got any 
information on that, Mr. Lawrence? Have you interviewed 
production line workers at Renton?
    Mr. Lawrence. Yes, we have.
    Mr. Maloney. How many?
    Mr. Lawrence. I cannot give you a specific number. We do 
have open investigations on the production of the----
    Mr. Maloney. Is it more than five?
    Mr. Lawrence. I would not quote a number without going back 
to my investigators to give you the exact number.
    Mr. Maloney. So it is fair to say that neither of you have 
any specific information about whether you have actually 
interviewed production workers at Renton. I mean, I know you 
say you think you have. I know you say you are going to look 
into it.
    Sir, we are sitting here at a hearing in the United States 
Congress. You have been on the job for a while now. I take it 
this is the most important thing on your plate, fair to say. 
Right?
    Mr. Dickson. Absolutely.
    Mr. Maloney. So are we going to interview the production 
workers at the Renton facility? Is it going to be a real thing? 
Can you come to us and give us some answers to what you are 
actually going to dig into? Because we know this was not just a 
software problem. Right? We know it was a hardware problem.
    And you got a guy who wrote you detailed information who 
served at the plant as the senior manager, who served 30 years 
in the Navy before that. Naval Academy grad. Knows what he is 
talking about. Couldn't get an answer to three detailed letters 
he sent you. Never interviewed him as we sit here.
    And honestly, it would be great if you had some specifics 
on what you have done to look at the production problems at 
that facility. Can you shed any light on that for us?
    Mr. Dickson. You have my commitment that we are looking 
into those problems, and we will continue to do so.
    Mr. Maloney. But you don't know whether you--you don't know 
how many workers you have interviewed?
    Mr. Dickson. Not sitting here today, no.
    Mr. Maloney. Mr. Lawrence?
    Mr. Lawrence. We have interviewed workers, and we can 
provide those for questions for the record afterwards.
    Mr. Maloney. I would appreciate that. Have you reviewed 
quality and production records from the facility?
    Mr. Lawrence. Yes, we have.
    Mr. Maloney. Would you tell us about that?
    Mr. Lawrence. There are ongoing investigations, and again, 
we can look at providing additional investigative reports at 
the appropriate time.
    Mr. Maloney. So you can't tell us anything about whether 
you have learned anything as we sit here about whether 
production problems, detailed in great detail by Mr. Pierson in 
the letters he sent to you now months ago--I mean, are you 
aware that 4 months before the first crash, he brought these 
problems to Boeing's attention? Are you aware of that, 
gentlemen? Four months before the first crash.
    Mr. Dickson. I know that there were--yes, that concerns 
were raised, yes.
    Mr. Maloney. That is right. And do you understand that 
after the Lion Air crash, he went up and down the chain at 
Boeing. He went to the CEO. He went to the general counsel. He 
went to the board. Are you aware of that? He sent them letters, 
too.
    Mr. Dickson. Yes.
    Mr. Maloney. Saying all the same things. And you know what 
they did? They sat on it until a second plane crash. That is 
what happened. A bunch more people lost their lives.
    Some of those pictures are right over there. And so we are 
sitting here now, a year later, and neither of you can tell me 
whether you got anything specific on the production problems 
that he identified 4 months before the first crash?
    So I am going to give you another chance, Mr. Dickson. Has 
the FAA made any mistakes here?
    Mr. Dickson. I think that is evident, that we have got 
issues that I need to address and that our team needs to 
address, and that we have processes that need to be improved. 
So I would agree with you.
    Mr. Maloney. You can't say that word ``mistake,'' huh? That 
one is just sticking on your lips there.
    Mr. Dickson. I don't want to blame other--again----
    Mr. Maloney. It is not about blame, sir. It is about 
accountability. We are not trying----
    Mr. Dickson. Accountability--OK. again, I am accountable. 
So I hold myself accountable.
    Mr. Maloney. Can you say that the FAA made a mistake in not 
taking seriously Mr. Pierson's concerns in a timely way?
    Mr. Dickson. We are taking the--we are taking all concerns, 
any concerns that are raised, we are going to take seriously 
and run them to ground in a systematic way so that we can make 
the right decisions.
    Mr. Maloney. Yield back.
    Mr. DeFazio. I thank the gentleman for his questioning.
    And I would just ask, very quickly, given the 
investigation, which you tell us is ongoing, of the production 
issues, will that be completed and instruct you in terms of 
whether or not the plane is allowed to fly, and under what 
conditions it is allowed to fly, and what conditions of 
inspection will be mandated on these planes before it is 
allowed to fly?
    Mr. Dickson. We will----
    Mr. Lawrence. One thing that I can add is we have retained 
the issuing of the airworthiness certificates. And so the FAA 
will be doing that this time. It is not going to be part of the 
Boeing system. So we will be doing that ourselves to assure 
that they earn airworthy condition before any are returned to 
service.
    Mr. DeFazio. All right. Thank you.
    Mr. Meadows.
    Mr. Meadows. Thank you, Mr. Chairman.
    Mr. Lawrence, I am going to follow up on something that Mr. 
Maloney just shared because I think it is important that we get 
to the bottom of this.
    Is it reasonable to expect that in the next 60 days, that 
you can interview an additional 10 line workers at the 
facility?
    Mr. Lawrence. Whatever--wherever the investigation----
    Mr. Meadows. All right. Well, I will make it harder, then. 
That was a softball.
    Mr. Lawrence. Yes. Yes.
    Mr. Meadows. And so I am going to throw an inside pitch. By 
gosh, interview at least 10 people and report back to this 
committee. Do I have your commitment to do that?
    Mr. Lawrence. Yes, you do.
    Mr. Meadows. All right. Mr. Dickson, I am going to come to 
you because you have obviously been advised by counsel or 
somebody to not admit that the FAA made a mistake. And I am 
just giving you--your counsel is giving you bad advice.
    Did the FAA at some point in this process make a mistake?
    Mr. Dickson. Yes.
    Mr. Meadows. Thank you.
    Mr. Dickson. Yes. My only--again, my only--I just don't 
want to leave it at that. That is my point----
    Mr. Meadows. No. I get that. And listen. There is enough--
--
    Mr. Dickson [continuing]. Is that I want to--I want to 
take----
    Mr. Meadows [continuing]. There is enough pictures over 
here and enough blame to go around. I get that. But what I am 
saying is, it is very frustrating, when it is obvious that 
mistakes were made, that you just don't say, ``Mistakes were 
made.'' And I understand lawyers always say, ``Don't admit 
anything because of this.''
    But I am just telling you, in the real world we have to 
look at it that a mistake was made, and obviously, not one but 
multiple mistakes. And we have got to get to the bottom of it. 
So here is my question for you.
    There is the suggestion--the committee has had the 
suggestion--that indeed, that there is a perverted incentive on 
the certification process, where you have FAA employees that, 
whether it be bonuses or anything else, that they don't 
actually engage in the proper way of putting safety first.
    Would you agree with that? Not agee with that? Comment on 
that?
    Mr. Dickson. I do not agree with that. And I have made it 
very clear to my workforce and my team that I support them in 
keeping safety as their highest priority.
    Mr. Meadows. All right. So what do we have to do to make 
sure that when things come in--and let me just tell you, you 
have got two people behind you that are part of your staff that 
I have the highest regard for. One worked on committee staff 
with me. The other worked in my personal staff, Mr. Newman. And 
there is no one who will work harder on this issue and get 
involved in it.
    And so I know you have got some people that are very 
capable working with you. I guess my question to you is: How do 
we put in the process of making sure that what we have is that 
it doesn't go into--I am not going to use a black hole 
narrative. But how does it not get swept up in the bureaucracy 
where there is a concern. There is a legitimate concern. And it 
just doesn't reach the right person until we have a fatality. 
How do we change that process?
    Mr. Dickson. Well, there are several different ways. So you 
can't get into analysis paralysis, or bureaucracy in these 
things. You have got to have real-time data upon which to make 
decisions that is visible across the whole organization.
    Mr. Meadows. I am glad you said that because here is one of 
the things. This is not the chairman's first rodeo nor mine. 
And when we talk about certification, I want to streamline 
certification. What I am concerned about is the FAA looks at 
the certification process--and we are recertifying screws and 
things that, quite frankly, are taking a whole lot of time. And 
then on the critical areas, they get the same bandwidth in 
terms of the certification process, whether we are working with 
Boeing or anyone else.
    Is there a way for us to highlight those new areas that are 
coming to the market as part of an aviation product, and 
perhaps de-emphasize some of the other things in this 
certification process to speed it up, whether it be on private 
individuals, or in this case, a commercial? Is there a way for 
us to do that?
    Mr. Dickson. I certainly think there is a way to make the 
process less bureaucratic and more fluid. That is part of what 
the JATR worked for.
    Mr. Meadows. Will you come up with four recommendations to 
report back to this committee on how you can do that?
    Mr. Dickson. Yes.
    Mr. Meadows. All right. And then the last thing, in the 20 
seconds I have left. Obviously, we have got a system that has 
not been repaired and it still has flaws in it. Will you commit 
to the American people right now that you will set up a hotline 
for our pilots to call in, that if they are seeing an issue--so 
the users, the very people that actually have to use equipment, 
where they can get something to you right now where that comes 
to your attention, will you be willing to set that up in the 
next 60 days?
    Mr. Dickson. We have a hotline now.
    Mr. Meadows. That comes to you. I know you have a hotline. 
We have got hotlines all over the Federal Government and they 
are worthless because they take about 2 years to get a return 
phone call.
    Mr. Dickson. Understand.
    Mr. Meadows. I am talking about coming to you.
    Mr. Dickson. We will set that up, absolutely.
    Mr. Meadows. Thank you, sir. I yield back.
    Mr. DeFazio. Representative Brownley.
    Ms. Brownley. Thank you, Mr. Chairman. And I too wanted to 
add my condolences to the families who are here today. As the 
holiday season surrounds us, where families gather together, 
our hearts and my heart breaks for all of you.
    But I also want to thank you very, very much for your 
presence here today because your presence is helping us to get 
to the truth, and it is only the truth that is going to save 
future lives. So I want to thank all of you for being here 
today.
    And I wanted to ask one more time, with regards to this 
risk assessment predicting 15 more accidents. And I wanted to 
ask the question, maybe, in a different way.
    Mr. Dickson, you have said several times that the buck 
stops with you, and you are the man ultimately accountable for 
the FAA. And so we have talked a lot about the past, and we 
understand that the past has to be fixed.
    So I want to look to the future and say that if an employee 
had brought this risk assessment to you and put it on your 
desk--you are the FAA Administrator--you were given that 
information. Would you have made a decision, a risk 
assessment--and I understand it is over 45 years--but that 15 
more accidents could occur, would you have grounded the 
airplane?
    Mr. Dickson. It is hard to Monday morning quarterback these 
things, as you know. And I believe that the individuals who 
were involved in making the decision were acting on the best 
information they had at the time.
    Ms. Brownley. But I am talking about you in the----
    Mr. Dickson. They were taking action to drive that level of 
risk.
    Ms. Brownley. I am talking about you in the future now.
    Mr. Dickson. With what I know now, yes. Yes.
    Ms. Brownley. If that came to you----
    Mr. Dickson. With what I know now.
    Ms. Brownley. If that came to you and you saw that report, 
you would ground the airplane today?
    Mr. Dickson. I would have----
    Ms. Brownley. Not second-guessing what happened in the 
past, but today.
    Mr. Dickson. With what I know today, yes, with what I know 
today. But again, it is hard for me to go back and determine in 
those days what information goes into----
    Ms. Brownley. Yes. I am just trying to set a similar story, 
but something that would happen in the future where you're----
    Mr. Dickson. And remember, this document that we have been 
looking at is only a decision support tool. It is not the 
decision. The CARB comes together with subject matter experts, 
and certainly I would want to confer with them and make sure 
that we ran all the issues to ground on making a decision.
    Ms. Brownley. You would be on high alert, though, if that 
document was before you?
    Mr. Dickson. Yes.
    Ms. Brownley. And you would ultimately ground the airplane, 
if I understood you correctly?
    Mr. Dickson. Well, again, knowing what I know now, it is 
impossible for me to go back. I know a lot more now than they 
knew back then.
    Ms. Brownley. Thank you. The other thing, Mr. Dickson, I 
wanted to ask is that there was a Washington Post story last 
night that revealed that the FAA plans to establish the 
aircraft certification safety program management branch. And 
apparently this is a new safety branch to address gaps in FAA's 
oversight following the accidents and will ``help improve 
understanding of systemic areas of risks, and facilitate 
identification of emerging safety issues.''
    I have to say I am disappointed to read about it in the 
media instead of hearing directly from the FAA. Can you tell us 
why the committee was not made aware of it? And secondarily, 
how will this new office help ensure that the same mistakes are 
not made in the future?
    Mr. Dickson. So this actually is misreported. The purpose 
of this office--it is actually a reorganization that Mr. 
Lawrence had been looking at for--I think the organization had 
been looking at it for about 2 years. And he can give you the 
details.
    Mr. Lawrence. Thank you for the opportunity to clarify that 
one. It was a misrepresentation of an email that had gone out 
by my staff. There is no new office. There is an Office of 
Accident Investigation; that still exists and will continue, 
and there is not a change there.
    It was how I was organizing my folks, has been repeated 
several times here. There are always opportunities to improve 
our system, to do a better job on communication and the flow of 
information within any organization. And that was an email 
announcing that we were assigning somebody to look at how best 
to set up the flow of communication and safety information 
within the organization.
    So yes, we are taking action. But it has not been--it is 
not a new office, and certainly was not an approved 
organization of any kind. It was----
    Ms. Brownley. So you are evaluating a reorganization to be 
more effective?
    Mr. Lawrence. It is part of our reorganization that was 
started 2 years ago, and making the tweaks and fixes as we go 
through that to make sure that we are covering all the issues 
that we should be in an appropriate way.
    Ms. Brownley. Thank you. Mr. Chairman, I yield.
    Mr. DeFazio. I thank the gentlelady.
    Representative Carbajal.
    Mr. Carbajal. Thank you, Mr. Chair. I am a little under the 
weather so I am going to try to get through these questions.
    But first, I want to offer my condolences to the families 
that are here today. I can't even imagine your pain and your 
loss.
    Administrator Dickson, from the emails released to the 
committee in October, it is clear that Boeing did not want to 
disclose the MCAS in the flight crew operations manual, FCOM, 
an aircraft training manual for pilots. Boeing minimized or hid 
the true power of the MCAS system, convincing the FAA to delete 
mention of it in the FCOM, and therefore hiding its existence 
from the Flight Standardization Board.
    What do you plan to do within the FAA to ensure and change 
this dynamic? And two, how will you ensure that the FAA and not 
Boeing or some other manufacturer is determining what is and is 
not appropriate for pilots to know about what is on their 
airplanes?
    Mr. Dickson. Thank you for the question. This gets back to 
the issue that was identified both through the interviews and 
emails that you spoke about, and by the Joint Authorities 
Technical Review, that this design change was not communicated 
to the FAA, the folks who needed to make the decision on the 
aircraft evaluation group.
    I believe that there were some communications, perhaps, to 
our flight test group or within the engineering circles, but 
they didn't make it so that we had issues both within the 
agency and----
    Mr. Carbajal. Mr. Dickson, we could spend all day talking 
about what transpired. But the question is: What do you plan to 
do to change this dynamic so it doesn't continue to happen 
again?
    Mr. Dickson. So improve our project management to make sure 
that the team is staying together as a cohesive team so they 
are all hearing things at the same time, no matter what phase 
of the project that we are in, and everybody understands what 
the implications of design changes may be.
    Also putting gates into the process to make sure that we 
have checkpoints going because you have got a bunch of parallel 
processes going on at the same time. From time to time we need 
to loop back and make sure that these systems interact 
correctly.
    Increased use of system safety assessments, as we talked 
about earlier.
    And then finally, I would like to work with the Congress on 
implementing safety management systems for manufacturers, which 
will again facilitate even better information flow between the 
applicant and the agency.
    Mr. Carbajal. And does that address the issue of having the 
FAA be in the driver's seat and making the determinations, not 
the manufacturers?
    Mr. DeFazio. Yes. We make those determinations now, and we 
will continue to do so.
    Mr. Carbajal. Thank you. Administrator Dickson, I would 
also like to get your thoughts on the recent testimony from the 
National Transportation Safety Board Chairman, Robert Sumwalt, 
where he highlights the positive benefits of safety management 
systems.
    Given your experience in the aviation sector, do you agree 
with the Chairman's perspective that safety management systems 
improve safety?
    Mr. Dickson. I have spoken with Chairman Sumwalt about 
this, and we have had dialogue on their recommendations and on 
SMS, and I am a huge proponent of SMS. I believe it has been 
very beneficial in the airline industry and the commercial 
aviation industry. And it should be applied in this environment 
as well.
    Mr. Carbajal. Do you have personal experience with the SMS 
system during your time at Delta?
    Mr. Dickson. Yes, sir, I do.
    Mr. Carbajal. Do you think adoption of the SMS system for 
manufacturers with FAA oversight would provide similar 
benefits?
    Mr. Dickson. Yes. In multiple ways. It provides the ability 
for, again, a systematic way for the regulator to get higher 
fidelity data, more in realtime, from the manufacturing 
process. It also creates more fluid communication both within 
the agency, for folks to raise concerns and for them to be 
processed, and for us to go back to the workforce. But it 
requires the participation of labor, and also the agency, and 
also the manufacturer to be able to make it work effectively.
    Mr. Carbajal. Thank you. You know, I have heard a lot of 
issues and suggestions raised by my colleagues today--the 
hotline that was suggested, a number of other things. As a 
second-term Member of Congress, I always wonder: When do we 
find out if all those items were implemented? When will you 
report back to us after this hearing to go over that list of 
issues that were discussed today, to share with us when they 
have been implemented or will be implemented in terms of a 
timeframe?
    Mr. Dickson. I will work with the chairman and the ranking 
member to put a timeline on those things. Some of what we have 
talked about, we are already doing, and we have incorporated 
some of the lessons learned from the MAX return-to-service 
process. We will apply those immediately going forward.
    We are looking, as an example, at some of the lessons that 
we learned from the TAB process, and bringing them into our 
certification activities going forward. So it sort of depends 
on the topic that you are talking about, but I am happy to work 
with----
    Mr. Carbajal. Thank you. I am out of time. I would 
appreciate getting that information. Mr. Chair, I yield back.
    Mr. Meadows. Yes. To my second-term colleague, because 
after two terms you start to understand this is the land of 
promise but not necessarily delivery, so that is why I put a 
60-day timeframe on those requests. And so either we will get 
that back in 60 days or we will get an explanation of why. And 
I will be glad to work with you in a bipartisan manner to make 
sure that we get it done.
    Mr. Carbajal. Thank you.
    Mr. DeFazio. I thank the gentleman for his clarification.
    Representative Stanton.
    Mr. Stanton. Thank you very much, Mr. Chairman.
    Administrator Dickson, at our last MAX hearing in this 
committee last October, Boeing admitted that MCAS did not meet 
its own design requirements. I think we have a slide that is 
going to come up now.
    [Slide]
    
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Stanton [continuing]. This is taken from Boeing's 
coordination sheet, which outlined the company's requirements 
for MCAS. As you can see, Boeing's criteria stated: ``MCAS 
shall not interfere with dive recovery.'' It also stated: 
``MCAS shall not have any objectionable interaction with the 
piloting of the airplane.''
    When I showed this to Boeing at our last hearing, Boeing's 
chief engineer admitted the obvious, that MCAS interfered with 
dive recovery on both Lion Air flight 610 and Ethiopian Air 
flight number 302.
    Administrator Dickson, do you agree with that assessment?
    Mr. Dickson. Based on what I know about how the system was 
initially designed and how the design was changed, I think that 
is correct.
    Mr. Stanton. Unfortunately, when I asked another obvious 
question on whether MCAS had an objectionable interaction with 
the piloting of the accident flights, Boeing did not give a 
straight answer. In plain and simple terms, Boeing failed to 
admit that the MCAS impacted the ability of the pilots to 
control the plane. That is shameful.
    How can anyone look at what happened in the cockpit of 
those flights and think the pilots had any chance to counter a 
system that they knew nothing about? This coordination sheet 
that you have on the screen today is dated June 11, 2018, which 
is after the MAX was certified. But we have seen earlier 
versions of the same document from March 2016, before the MAX 
was certified, and it contains the exact same MCAS design 
requirements.
    Administrator Dickson, did the FAA receive a copy of this 
coordination sheet before the MAX was certified?
    Mr. Dickson. I am not aware that we would have. And I 
believe that is around the time when the design was modified. 
But I would have to check.
    Mr. Stanton. Should the FAA have received this document?
    Mr. Dickson. I would say so.
    Earl, have you got any opinion on that?
    Mr. Lawrence. Well, this document is outlining what our 
requirements are on Boeing. And so these are the regulatory 
requirements, and this outlines what the requirements would be 
to obtain certification.
    Mr. Stanton. Thank you.
    Mr. Dickson, did MCAS interfere with dive recovery on Lion 
Air flight 610 or Ethiopian Air flight 302?
    Mr. Dickson. Yes, it did. I would just point out again that 
there is--the pilot, again, is part of that system. And the 
design was relying on the pilot to be the mitigating factor, 
and that proved to be incorrect.
    Mr. Stanton. Boeing failed to meet its own design 
requirements for a system that was certified by the FAA. 
Despite this shocking reality, has the FAA issued any fines or 
penalized Boeing for that failure at this time?
    Mr. Dickson. Not at this time. But I reserve the right, as 
I said earlier, to take action in the future.
    Mr. Stanton. Beyond the design requirements, has the FAA 
issued any fines to Boeing for its failures on the 737 MAX?
    Mr. Dickson. Not at this point.
    Mr. Stanton. And my final question: Since these tragic 
accidents, has the FAA made any changes to how it certifies 
software design requirements, certifies other manufacturer 
aircraft components, or to any part of the certification 
process?
    Mr. Dickson. Yes. As I mentioned, we have not delegated 
anything throughout this process. We are relying on resources 
throughout the agency. We have brought in the Technical 
Advisory Board to run in parallel with us, with experts from 
NASA and Volpe and the Air Force and others. And we are also 
working very closely with the international authorities as 
well.
    Mr. Stanton. So you are working on them, but as of yet, no 
specific changes?
    Mr. Dickson. Well, yes, those changes are being implemented 
for the MAX project. Absolutely.
    Mr. Stanton. Mr. Dickson, for me and for so many Americans, 
these accidents, these tragic accidents, have shaken our 
confidence in the FAA. And we owe it to the families who lost 
loved ones to do better, and we must get this right. Anything 
else would be a disservice to them and to all those who put 
their faith in the safety of our air system.
    I yield back.
    Mr. DeFazio. I thank the gentleman.
    Representative Davids, vice chair of the subcommittee.
    Ms. Davids. Thank you, Chairman. And thank you all again 
for continuing to be here.
    Administrator Dickson, I want to follow up about the rudder 
cable on the 737 MAX. As you know, at least half a dozen of the 
FAA's own technical specialists, as well as an expert panel 
established by the FAA's safety review process, raised serious 
concerns that the rudder cable on the 737 MAX could be severed 
if the engine failed, causing pilots to lose control of the 
aircraft. This concern is not just a theoretical concern. The 
FAA guidance is rooted in the tragic 1989 DC-10 crash in Sioux 
City, Iowa. And 112 people died in that crash.
    In your response to Chairman DeFazio and the Aviation 
Subcommittee Chair Larsen's letter on this issue, you said, 
``We followed the FAA procedures.'' Except that doesn't seem to 
be the case, which we will get to in a second.
    There is a kind of cornerstone of the FAA procedures, which 
is that the components will become safer over time. It seems 
like a good rule of thumb to follow. So when the FAA reviewed 
and approved the 737 NG model, the FAA found that the 737 NG 
had a lower risk of a severed cable than the 737 classic model. 
And the reason that the risk was lower is because the engine on 
the 737 classic was more powerful.
    So based on the determination that there was a lower risk 
in the 737 NG, it was approved. So there is a 1997 issue paper 
for the 737 NG that warned that engines in the future on 737 
models, if they got bigger, it would increase the risk of 
severing that cable, and that additional steps to protect the 
cable would be needed.
    Which brings us to the 737 MAX, which has a bigger engine 
and potentially greater risks of severing the cable. The FAA, 
though, did not require any design changes. Instead, it ignored 
that 1997 warning.
    So my question is: Why didn't the FAA follow the guidance 
from the 1997 issue paper and require additional protections 
for the rudder cable?
    Mr. Dickson. Well, thank you for the opportunity to 
respond. And this is--I think it is important to understand 
that these debates and discussions among subject matter experts 
are part of what gets us to a safer system. And there are a 
couple of different approaches that can be taken in these 
instances.
    Ms. Davids. Do those approaches include ignoring an issue 
paper?
    Mr. Dickson. Well, no. I am just saying that there are 
approaches on--there are prescriptive rules that can be 
followed, and there is also sometimes data that can be applied 
based on the performance of a proven system.
    And in this case, the team looked at--eventually, when the 
decision was made, looked at the mitigations that had been put 
in place in terms of floor structure and also the casing around 
the CFM LEAP engines, and the reliability of those engines, and 
the fact that they are already certified, essentially, from 
their initial manufacture as capable of extended twin engine 
operations, which is an extremely high level of reliability.
    And so taking all of that into account, there is actually a 
risk in adding complexity to an improved system that was put in 
place in the 1990s to deal with the hardover rudder issues from 
the accidents that we talked about earlier. And when you 
introduce a fleet that has got additional complexity into an 
operation that has already got thousands of airplanes out there 
that have different maintenance practices, that itself creates 
a risk. And so that is how that decision was made.
    And remember that the manager who is making that decision 
is actually a technical expert----
    Ms. Davids. At FAA?
    Mr. Dickson [continuing]. Himself. Yes. FAA, yes.
    Ms. Davids. Or with Boeing?
    Mr. Dickson. No. At FAA.
    Ms. Davids. OK. So the concern here is that, first of all, 
you are talking about increased complexity and not following 
the guidance that had previously been stated, and not doing a 
new type certificate.
    So I think there are a lot of inconsistencies in the way 
that you are describing this process. And the overarching 
concern is that the process for safety reviews is becoming 
either inconsistent or more lax, and that control is being 
increasingly delegated to the manufacturers.
    So I think that--I obviously have run out of time. But I do 
think that there needs to be some serious consideration around 
the--you have said yourself, this is a whole system. And across 
the system, we have been hearing inconsistencies and places 
where it seems as though the FAA has been more lax. And I think 
that that is something that we can address and need to address.
    I yield back.
    Mr. Dickson. I can assure you we will not be lax. And 
actually, I believe that the decisions that we are making are 
going to be more rigorous because of the reliance on data and 
performance.
    Mr. DeFazio. I thank the gentlelady and the gentleman.
    Representative Lamb.
    Mr. Lamb. Thank you. And Mr. Chairman, could you put the 
slide back up with the 15 number on it that we were looking at 
earlier?
    Mr. DeFazio. TARAM report?
    Mr. Lamb. Yes. Thanks.
    [Slide]
    
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Lamb [continuing]. Now, Mr. Administrator, based on 
everything that you know now, and I understand you weren't in 
office at this time--but based on everything that you know now, 
if you saw a report like this with the 15.373 number on it, 
that day or the next day would you have been comfortable with a 
member of your own family flying on a 737 MAX?
    Mr. Dickson. Yes, I would have. But that is because I 
understand how the airplane operates, and I understand how to 
deal with flight control issues. But on the other hand, there 
is a--immediate aggressive action was being taken. And again, 
this is just one aspect of trying to put some rigor around what 
otherwise would be a very subjective decision.
    Mr. Lamb. Do you think it is reasonable to expect that I, 
who am not a pilot, or one of my constituents, who don't know 
the inner workings of aircraft and how pilots are trained and 
how they receive warning messages like this--do you think it 
would have been reasonable for them to feel safe flying on a 
737 MAX the day after this information was known to the FAA?
    Mr. Dickson. Again, at this point dealing with what were 
the driving factors in the accident, in the Lion Air accident; 
and again, based on the information that was available at the 
time, the emphasis was on the procedural aspect of 
accomplishing the runaway stabilizer trim.
    And so, again, that was the mitigation that was put in 
place immediately. And then a very aggressive timeframe in 
terms of the software modification.
    Mr. Lamb. Yes. But what I am saying is people are relying 
on you to protect them.
    Mr. Dickson. Yes.
    Mr. Lamb. In an area that they do not know a whole lot 
about, and a lot of trust is required for them to participate 
and feel safe about our airline industry. And nothing you just 
said provides a reason why a person should have felt safe 
stepping onto a 737 MAX when the FAA was in possession of the 
information.
    Let me ask you a slightly different way. There are echoes 
in this incident of a situation that happened in western 
Pennsylvania, where I represent, in 1994 when there was a plane 
crash in Beaver County. And we have a witness coming in in the 
panel after you, Captain Cox, who is going to say that that 
incident, which was USAir flight 427, ``was a recurrence of a 
fault that had brought down United Airlines flight 585 3 years 
earlier. We did not learn all we could from it, as a result, 
132 perished near Pittsburgh.''
    He goes on to say, ``We did not learn all we could from 
Lion Air 610 before the Ethiopian 302 accident.'' And as a 
result, we lost not only all the people in the Lion Air crash 
whose family and friends are with us here today, but the second 
wave of people in Ethiopia.
    And so what I don't understand is all these years later, 
all these years after the Pittsburgh crash in 1994, what is 
being done to make sure that we learn the first time and it 
does not take two crashes for us to fix the problem? What is 
changing?
    Mr. Dickson. It doesn't. It doesn't. I mean, that is why we 
need to make the processes more rigorous and have better 
analytical tools so that we can drive that risk down and know 
that the actions that we are taking will have that effect.
    Mr. Lamb. Who is being held accountable for the fact that 
pilots were not told about MCAS and that, in fact, the 
references to MCAS were removed from the manual? Who is being 
held accountable for that?
    Mr. Dickson. Well, I think that is part of the process that 
we are all going through.
    Mr. Lamb. So you don't know?
    Mr. Dickson. I think we are all being held accountable for 
it. And we all need to make sure that that doesn't happen 
again.
    Mr. Lamb. I think we have different definitions of being 
held accountable. Mr. Chairman, I yield back.
    Mr. DeFazio. I thank the gentleman.
    Now Representative Malinowski.
    Mr. Malinowski. Thank you, Mr. Chairman.
    Mr. Dickson, earlier in the hearing you said that one of 
your priorities is to make sure that there is appropriate 
separation at the FAA between business issues and safety 
issues. I was struck by that; it is a very important point.
    And given that you said that, I take it you believe that 
there has not always been sufficient separation between 
business and safety considerations. Is that a fair----
    Mr. Dickson. Well, I was actually referring to the 
manufacturer. I was referring to Boeing and the indications of 
pressure on the workforce to accomplish certain things, and 
being able to make sure that that didn't impact safety 
decisions. And it is something that I want to make sure doesn't 
bleed over into our workforce.
    Mr. Malinowski. Well, exactly. I mean, I am concerned also 
about pressure on the FAA because here is something that those 
of us here who have looked at this feel seems to be happening, 
that a manufacturer like Boeing will begin production of an 
aircraft. They will complete all the steps up to the finalizing 
production, including ordering materials, before getting FAA 
permissions.
    Then they will say, ``Oh, my gosh.'' If the FAA raises a 
concern, they will say, ``Oh, my gosh. We have to get--we are 
almost there. We will lose a tremendous amount of money if we 
don't get this plane into the marketplace.'' And then the FAA 
sometimes seems to take that into account.
    I mean, isn't that potentially what happened, for example, 
when the FAA initially said that flight simulator training 
would be required for the 737 MAX, and then Boeing said, ``We 
have this agreement with Southwest Airlines. We were promised a 
million-dollar rebate per plane if it didn't require flight 
simulator training.'' And then the FAA says, ``OK. You don't 
have that requirement.''
    Do you think those business concerns may have bled into the 
FAA's decision there?
    Mr. Dickson. I know, having spoken with our AEG pilots in 
Seattle, and having read some of what their concerns have been 
that have been expressed to the committee investigative staff, 
that this was an item of concern that they had from very early 
on in the project.
    And so they were very engaged from the very early days, and 
went through a process of--over a year--of making sure that 
pilots from airlines were brought in, actual those who were 
flying the 737 NG on a regular basis. We are able to have 
proficiency even without additional simulator training on the 
737 MAX.
    So that was something that was of concern and that was 
resolved through the process. But it is something that we need 
to watch for, absolutely.
    Mr. Malinowski. And what about the decision to exempt 
Boeing from the requirement that new commercial airlines be 
equipped with the EICAS system that would allow the aircrew to 
prioritize all the different cautions and alerts that they 
received? That system was required on the 747-400, the 757, the 
767, the 777, the 787. The 737 MAX is the only aircraft that 
was not required, that was exempted from that rule, I think, 
since 1982.
    Weren't there cost considerations that factored into that 
decision?
    Mr. Dickson. That is a great question. In my view, it 
wasn't so much of a cost consideration, but how do you 
integrate an airplane like that into an existing fleet. And I 
will let Mr. Lawrence tell you how that process works.
    Mr. Lawrence. So the question on that particular one is we 
have a very large fleet and operators of that existing 
aircraft. And if you change the procedures and the positioning 
and the switches and the information, do you introduce another 
safety hazard?
    And so that was the debate on that particular system. It 
wasn't as much of a cost, per se. It was looking at--you have 
Southwest Airlines as an example, with a whole existing 737 
fleet. You have all their pilots trained, all their maintenance 
folks trained, the whole system built on that. And what are the 
risks of introducing a new system that dramatically changes 
that?
    So it is a debate. We are not saying it is--that there 
aren't good arguments on both sides of that discussion. I am 
just saying that it is a discussion, and making those 
determinations of whether you are going to allow an aircraft to 
continue in that fleet in its existing configuration. Those are 
all part of the discussions. And safety is the driver in all of 
those discussions.
    Mr. Malinowski. Thank you. I yield back.
    Mr. DeFazio. I thank the gentleman.
    Representative Allred.
    Mr. Allred. Thank you, Mr. Chairman.
    I want to pick up on the line of questioning of 
Representative Lamb's around accountability, Mr. Administrator. 
As you know, the 737 MAX was certified with the AOA disagree 
alert being a standard feature on the aircraft.
    However, in August 2017, Boeing learned that the AOA 
disagree alert was not functioning on an estimated 80 percent 
of the entire 737 MAX fleet. Boeing concealed this flaw from 
the FAA and operators for more than a year, during which it 
continued to build and deliver planes with this nonfunctioning 
alert. More troubling, pilots expected the AOA disagree alert 
to be operational and it wasn't.
    In July of this year your predecessor, then-Acting 
Administrator Dan Elwell, explained how Boeing's actions 
violated FAA regulations in a letter to this committee, which I 
think we have a slide of.
    [Slide]
    
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Allred [continuing]. This is what he wrote: ``Once 
certified by the FAA, all features included on the airplane 
become part of the certified type design or approved type 
design. These features are mandatory in each airplane produced 
to that type design thereafter, whether or not they are 
required for safety. . . . Although an AOA disagree message was 
not necessary to meet FAA safety regulations, once it was made 
part of the approved type design, it was required to be 
installed and functional on all 737 MAX airplanes Boeing 
produced.''
    I will repeat that the disagree alert was ``required to be 
installed and functional on all 737 MAX airplanes Boeing 
produced.'' You may not believe that the absence of an AOA 
disagree alert is a safety issue, but I strongly believe that 
Boeing's open defiance of FAA requirements in knowingly 
delivering airplanes without it is both a legal and an ethical 
issue.
    It is my understanding that the FAA has not penalized 
Boeing in any way for this conduct, or even taken any other 
actions to reprimand the company for its behavior. I know you 
have been here 4 months, but the word ``accountability'' has 
been used a few times. When I had the CEO of Boeing sitting 
here, I told him I thought we might have a different definition 
of that word. I hope that you and I don't share a difference in 
that word's definition as well.
    Why hasn't the FAA done anything to hold Boeing 
accountable? It is your agency, and most important to the 
public, for this sort of egregious behavior.
    Mr. Dickson. Thank you for the question. And we have 
already taken actions, as you know. Obviously, the airplane is 
grounded. We are not delegating anything to Boeing during the 
MAX return to service. We are not even delegating the 
individual airworthiness certificates for each aircraft.
    We have taken action, recent enforcement action, and we 
have additional actions under consideration, both with the 
existing settlement agreement that we discussed earlier here, 
and there may be additional actions, as required. And I reserve 
the right to take them, and I will take them, as appropriate. 
And you point out a good example here.
    Mr. Allred. Well, thank you. I think that where we have 
regulations in place and where we have a purposeful evasion of 
them, if there is no consequence for that evasion, then the 
regulation doesn't matter.
    And so I hope that we will see enforcement of this. And a 
lot of my colleagues, we are trying to determine the balance 
that we should strike here. Is the process fatally flawed? What 
changes need to be made? But this, in my opinion, is an example 
of something that is just a decision that needs to be made by 
the FAA on how they are going to enforce their own regulations, 
knowing that a violation occurred.
    Mr. Dickson. Congressman, I couldn't agree with you more. 
Safety is our highest priority, most important core value. And 
what supports that is accountability.
    Mr. Allred. Absolutely. Thank you, Mr. Chairman. I yield 
back, if you want to take any time.
    Mr. DeFazio. I thank the gentleman.
    Representative Garcia.
    Mr. Garcia. Thank you, Mr. Chairman.
    Mr. Dickson, I would like to ask you some questions about 
the FAA's Associate Administrator for Aviation Safety. As you 
know, our committee staff had the opportunity to interview him 
last week, and you have been provided with a copy of the 
transcript.
    I have to say I am shocked at some of the things he didn't 
know. One, he hadn't seen Boeing's flight crew operations 
manual bulletin following the Lion Air crash. When he was shown 
a copy of the flight crew operations bulletin that Boeing 
issued following the Lion Air crash, he said this was the first 
time he had seen it.
    He was asked, ``Have you seen this document before?'', and 
he replied, ``No, I have not. But it is an FCOM--flight crew 
operations manual.''
    He was then asked, ``You don't recall seeing this prior to 
today?''
    He answered, ``No.''
    And two, he was unaware that Boeing knew if a pilot didn't 
react to the unanticipated MCAS activation within 10 seconds, 
the result could be catastrophic. The slide that has come up on 
the screen shows Boeing's coordination sheet. When we asked him 
about this key document that was released at our last hearing--
showing that Boeing knew that if pilots did not respond to 
unanticipated MCAS activation within 10 seconds, the result 
could be catastrophic--he said he was not aware of the 
document.
    [Slide]
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    Mr. Garcia [continuing]. FAA's chief safety officer was 
asked, ``So let's take it out of the hypothetical. You are 
aware that this committee held a hearing on October 30 at which 
Boeing testified. Is that correct?''
    ``I watched some of it,'' he replied.
    He was then asked, ``OK. At the hearing, a document was 
made public, a coordination sheet from Boeing on which 
contained a functional hazard assessment, a portion of which 
said if a pilot didn't react within 10 seconds, the result 
would be catastrophic. That was information made public at the 
hearing. Were you----''
    He interrupted, ``No. I was not aware of that.''
    The Member then asked, ``You didn't watch it? Weren't aware 
of it? So you are not aware?''
    And Mr. Bahrami replied, ``No, I didn't. You know, like I 
said, I was in Montreal at the assembly, and I just watched 
portions of the hearing. And I do not know about this 
document.''
    Administrator Dickson, this was the response of the FAA's 
chief officer. He seemed completely unaware of the fact that 
Boeing believed if pilots reacted to unanticipated MCAS 
activation in 10 seconds or more, it could lead to the complete 
loss of the aircraft. The result? Catastrophic accident, like 
we saw in the Lion Air crash and the Ethiopian Airlines crash.
    This seems like a pretty important piece of information for 
the head of safety of FAA to be aware of and understand. This 
release of this document was widely reported in the press, 
including by the New York Times, Washington Post, Seattle 
Times, Forbes, Reuters, and NPR.
    Mr. Dickson, do you believe the Associate Administrator for 
Aviation Safety, FAA's chief safety officer, should have seen 
at some point over the past 13 months, a copy of Boeing's 
flight crew operations manual bulletin, and that it used after 
the Lion Air crash?
    Mr. Dickson. You know, I can't substitute my judgment for 
his. I believe this is a technical certification requirement or 
an assumption.
    Mr. Garcia. Should he have known, Mr. Dickson? Yes or no?
    Mr. Dickson. You know, I think that--you know, I would hope 
that he would have been aware as to what was made public in the 
hearing.
    Mr. Garcia. So is that a yes?
    Mr. Dickson. Again, I will have to talk to him about it.
    Mr. Garcia. Thank you. Do you believe the Associate 
Administrator for Aviation Safety should be aware that if a 
pilot failed to react to unanticipated MCAS activation within 
10 seconds, the result could be catastrophic?
    Mr. DeFazio. You are on the clock here, at about 7 minutes 
here.
    Mr. Dickson. Sorry, can you restate real quick? I----
    Mr. Garcia. Do you believe that the Associate Administrator 
for Aviation Safety should be aware that if a pilot failed to 
react to unanticipated MCAS activations within 10 seconds, the 
result could be catastrophic?
    Mr. Dickson. I think that he was aware of the--of the 
criteria. I do not know that he had seen this exact document.
    Mr. DeFazio. OK, I thank the gentleman. The gentleman's 
time has expired.
    Mr. Garcia. Thank you. I yield back.
    Mr. DeFazio. Representative Payne.
    Mr. Payne. Thank you, Mr. Chairman.
    Administrator Dickson, in its report, the Joint Authorities 
Technical Review found that the FAA had inadequate awareness of 
the MCAS function. Which, coupled with limited involvement, 
resulted in an inability of the FAA to provide an independent 
assessment of the adequacy of the Boeing proposed certification 
activities associated with the MCAS. It appears that the trust 
Congress gave FAA with delegation authority has been broken.
    What steps is the FAA, and you personally, taking to ensure 
that a lapse such as this does not happen again.
    Mr. Dickson. Thank you, Congressman, a great question. I 
appreciate the opportunity to respond.
    Our whole construct here is based on trust. And it is 
important that, as the regulator, we can trust the manufacturer 
that we are delegating certain things to. And it is a 
privilege. It is not a right; it is not a certificate that they 
have. It is a privilege to have those items delegated.
    That is why we have pulled back on this particular project, 
on the 737 MAX. And as we do certification activity----
    Mr. Payne. So Boeing does not have that privilege anymore, 
correct?
    Mr. Dickson. At this point, that is correct.
    Mr. Payne. All right. I would suggest that might be 
something that is looked at across the board, so there are not 
issues with other airlines. But we are talking about Boeing 
right now, and so we are trying to make sure that this does not 
happen again.
    Also, the JATR report also recommended that the FAA conduct 
a workforce review of Boeing's Aviation Safety Oversight Office 
engineers at FAA to ensure that there is a sufficient number of 
experienced specialists to adequately perform certification and 
oversight duties. Has there been a workforce review conducted?
    Mr. Dickson. Yes, it is in process. There is actually a 10-
year workforce plan for the Aviation Safety Organization. This 
group is part of that. And as we get the JATR report and the 
other reviews of the process, we are looking specifically at 
human factors, such as----
    Mr. Payne. So there are no results yet? It is still in the 
process?
    Mr. Dickson. Yes, and we are putting those into action now.
    Mr. Payne. Administrator Dickson, I am the 23d Member on 
this side of the aisle to ask questions. And I have sat here 
for a lengthy period of time and I have heard you respond 
numerous times that we are in the process. Is there anything 
that has been completed and done with respect to this issue?
    Mr. Dickson. Yes. As I said, we have brought in experts 
from outside the agency, the Technical Advisory Board. Mr. 
Kiefer is a member of that. We have opened ourselves up to 
review as no regulator ever has in this process with the Joint 
Authorities Technical Review. We have the Secretary's Special 
Committee on Aircraft Certification, which is coming forward 
with additional recommendations. And with respect to the 737 
MAX, as I have said, we have not delegated any activity, 
including the issuing of individual airworthiness certificates, 
tail by tail, on those aircraft. So those are some very 
significant actions and there are more to come.
    Mr. Payne. Well, sir, I would implore you as someone that 
is sitting here, as opposed to where you are, and as Mr. 
Meadows, the gentleman from North Carolina, asked you and you 
were able to answer him specifically that you would have 
certain things done in a time period, that you try as 
diligently as possible to get these things done.
    Sitting here, looking at these pictures is difficult. I 
have loved ones of my own. And as I look through those 
pictures, I have young children and cousins and brothers that 
run the myriad of those pictures. We are fortunate that we are 
not sitting there.
    So it is our obligation where we sit, to make sure that no 
other family has to sit in that corner again.
    And with that----
    Mr. Dickson. Congressman, I would just say I agree with you 
100 percent. That is why we are working diligently each and 
every day, really around the clock. And that is why I support 
my people in these efforts. And that is frankly why I am going 
to personally fly the airplane myself and go through the 
proposed training and do everything I can, so that I would put 
my own family on the airplane without a second thought. And 
that is my absolute----
    Mr. Payne. My time has expired. Thank you.
    Mr. DeFazio. I thank both gentlemen.
    Representative Balderson. I believe these will be the last 
questions.
    Mr. Balderson. Thank you very much, Mr. Chairman. Thank 
you, panel, for being here. Also, I extend my condolences to 
the families and thank you all for being here.
    Administrator Dickson, on September 25, 2019, Boeing's 
Committee on Airplane Policies and Processes announced a new 
product and services safety organization. This organization is 
responsible for reviewing all aspects of product safety, 
including investigating cases of undue pressure and anonymous 
safety concerns raised by employees.
    Is the FAA satisfied with this new review process and do 
you believe Boeing will take anonymous safety concerns reported 
by its employees more seriously?
    Mr. Dickson. Well, thank you for the question. I think that 
it remains to be seen. It is easy to move around boxes on the 
org chart and to appear to be doing something. We will have to 
see how it is implemented and how it is incorporated into their 
safety culture. And we are going to be doing the same thing or 
similar things within the agency as well.
    But I do think that the ability for employees to 
systematically bring forward safety concerns is absolutely 
foundational to the safety system that we have.
    Mr. Balderson. Thank you. I would agree with that.
    My next question for you, Mr. Administrator, is while the 
ongoing investigations continue to get to the bottom of these 
two crashes, are you aware of any legislation this committee 
and Congress can pass now to improve aviation safety?
    Mr. Dickson. I would be happy to work with the committee. I 
do believe that the support for moving to implementing safety 
management systems for manufacturers would be very beneficial. 
I also believe that support for data analysis and data 
consolidation, making our data systems more modern, that is one 
of my most important strategic pillars at the agency and that 
is something, another area where I think we can definitely 
improve.
    Mr. Balderson. Thank you very much. Mr. Chairman, I yield 
back my remaining time.
    Mr. DeFazio. I thank the gentleman. And I do want to thank 
the panel for devoting so much time, I think, answering 
questions for the most part responsibly, and for your further 
commitments to continue this work and respond to some 
particular suggestions that were raised here.
    With that, the committee will recess for 5 minutes while we 
assemble the next panel.
    [Recess.]
    Mr. DeFazio. OK, votes are pending so we are going to move 
along right now, even though it has not been quite 5 minutes.
    Panel 2, I would like to welcome the next panel, Mr. Edward 
Pierson, Boeing retiree, appearing in his individual capacity, 
with many years of experience in the industry; Mr. G. Michael 
Collins, FAA retiree, appearing in his individual capacity, 
again with many years' experience in a regulatory role at FAA; 
Dr. Mica R. Endsley, president of SA Technologies, former Chief 
Scientist, U.S. Air Force, former president, Human Factors and 
Ergonomics Society; and Captain John Cox, president and CEO of 
Safety Operating Systems.
    Thank you all for being here today. We look forward to your 
testimony. Without objection, your full statements will be 
included in the record.
    So we will now proceed with your testimony. Five minutes, 
as best you want to summarize.
    Mr. Pierson. I don't think it's on.

TESTIMONY OF EDWARD F. PIERSON, FORMER SENIOR MANAGER, BOEING, 
   APPEARING IN HIS INDIVIDUAL CAPACITY; G. MICHAEL COLLINS, 
  FORMER AEROSPACE ENGINEER, FEDERAL AVIATION ADMINISTRATION, 
 APPEARING IN HIS INDIVIDUAL CAPACITY; MICA R. ENDSLEY, Ph.D., 
    APPEARING ON BEHALF OF THE HUMAN FACTORS AND ERGONOMICS 
   SOCIETY; AND JOHN M. COX, CHIEF EXECUTIVE OFFICER, SAFETY 
                       OPERATING SYSTEMS

    Mr. Pierson. Forgot to push the button. Sorry.
    Chair DeFazio, Ranking Member Graves, members of the 
committee, good afternoon. Thank you for inviting me to testify 
today. My name is Ed Pierson.
    I would first like to provide my heartfelt condolences for 
all the families and friends who lost loved ones on Lion Air 
flight 610, Ethiopian Airlines flight 302. Your loss and grief 
are truly unimaginable.
    Please allow me to provide a little information about 
myself. I retired from the Boeing Company in August of 2018 as 
a senior manager at the 737 factory in Renton, Washington. I 
graduated from the Naval Academy, served in the military as a 
naval flight officer and held several leadership positions, 
including squadron commanding officer. I have over 30 years of 
aviation experience.
    I believe production problems at the Renton factory may 
have contributed to these two tragic crashes. But I do not 
believe our regulators are paying enough attention to that 
factory, and I am calling for further investigation. I formally 
warned Boeing leadership in writing on multiple occasions, 
specifically once before the Lion Air crash and again before 
the Ethiopian Airlines crash, about potential airplane risk due 
to the unstable operating environment within the factory. Those 
warnings were ignored.
    June 9, 2018, while the Lion Air airplane was being 
produced, 4 months before it crashed, I wrote an email to the 
737 general manager, advising him to shut down the production 
line to allow our team time to regroup so we could safely 
produce planes. Following that email, I requested a one-on-one 
meeting with the general manager on July 18 and repeated my 
recommendation to shut down the factory for a brief period of 
time.
    When I mentioned that I have seen operations in the 
military shut down for lesser safety concerns, I will never 
forget his response, which was, ``The military isn't a profit-
making organization.''
    During this timeframe, the 737 factory was in chaos. Every 
single factory health metric was getting record low marks and 
each one was trending in the wrong direction. Those metrics are 
detailed in my written testimony and include overtime, quality 
reports and out-of-sequence work. Keep in mind that, on October 
29, 2018, when the Lion Air plane crashed killing 189 people, 
it was only 2 months old.
    After the crash, I wrote a letter directly to Boeing's 
chairman, president and CEO, Dennis Muilenburg. Mr. Muilenburg 
asked the general counsel to communicate with me and we spoke 
on three occasions, where I renewed my warnings. I stressed 
that investigating the factory, talking with frontline 
employees was urgent, as I was very concerned that this might 
not be an isolated incident.
    On February 14, 2019, Boeing's assistant general counsel 
assured me that Boeing had seen nothing that would suggest the 
existence of embedded quality or safety issues. I wrote a 
followup letter with supporting documentation to Boeing's board 
of directors, requesting that they take urgent action, but 
received no response.
    Less than 1 month later, on March 10, 2019, Ethiopian 
Airlines flight 302 crashed, killing 157 people. That airplane 
was only 4 months old.
    The U.S. regulator's investigation of these crashes has 
been as disappointing as Boeing's insistence that it had no 
systemic quality or safety issues. Over the last 8 months, I 
have delivered detailed information about the factory to those 
regulators and investigators. I specifically requested that 
this information be shared with the international investigators 
in Indonesia and Ethiopia. I also shared production quality 
concerns about other 737 airplanes built during that timeframe 
at the same factory with the National Transportation Safety 
Board, the FAA and the Department of Transportation. The 
disturbing responses of the leaders of these agencies are 
detailed in my written testimony.
    Despite my information, regulators have continued to direct 
their primary, perhaps exclusive, focus on their certification 
process, pilot training and the design failure of the flight 
control system, specifically the MCAS software. But the 
component that first failed leading to both crashes is the 
angle-of-attack sensor part, which is an historically reliable 
part.
    Both Boeing and the FAA knew in December of 2018 that the 
original angle-of-attack sensor on the Lion Air airplane had 
failed, which is clearly a production issue since the airplane 
was brand new. Although the defective Boeing-installed sensor 
was replaced with a Lion Air-installed part before the crash, 
that does not explain why the Boeing part failed in the first 
place. It appears the same sensor failed on the Ethiopian 
Airlines flight.
    Let me be clear. I am not saying that I know factory 
conditions caused these two crashes. I am saying that a 
combination of three circumstances justify an investigation of 
those factory conditions.
    First, there have been two fatal crashes.
    For the record, I would like to make a note that there was 
actually a total of 347 people that were killed as a result of 
these crashes. There was an Indonesian diver doing recovery 
operations that also passed.
    My second reason is I saw firsthand the factory was 
stressed beyond anything in my experience.
    And third, there have been 13 other safety incidents 
involving faulty hardware or other systems, many of which were 
serious. Any one of these circumstances alone should justify an 
investigation of production. Together, they amount to an open-
and-shut case for such an investigation.
    The bottom line is the 737 factory needs to be thoroughly 
investigated and closely monitored by regulatory authorities, 
specifically the FAA, on a continuous basis into the future. I 
have included recommendations for the committee's consideration 
in my written statement.
    Thank you again for providing me this opportunity. I am 
ready to answer your questions.
    [Mr. Pierson's prepared statement follows:]

                                 
Prepared Statement of Edward F. Pierson, Former Senior Manager, Boeing, 
                  appearing in his individual capacity
    Chairman DeFazio, Ranking Member Graves, Members of the Committee, 
good afternoon. Thank you for holding this hearing and inviting me to 
testify today. My name is Ed Pierson and I am a former Senior Manager 
at Boeing's 737 Factory in Renton, Washington. Before I provide my 
substantive testimony, I need to provide my heartfelt condolences to 
the families and friends who lost loved ones on Lion Air Flight 610 and 
Ethiopian Airlines Flight 302. Your loss and grief are truly 
unimaginable.
    I am here to discuss the alarming state of Boeing's 737 Renton, 
Washington factory in 2018. During this period, the factory produced 
hundreds of aircraft, including the two 737 MAX planes that crashed in 
October 2018 and March 2019. I witnessed a factory in chaos and 
reported serious concerns about production quality to senior Boeing 
leadership months before the first crash. I formally reported again 
before the second crash. No action was taken in response to either of 
my reports.
                             My Background
    I worked for Boeing from 2008 until my retirement in August 2018. 
In my last assignment I served as a Senior Manager in Boeing's 737 
Renton, Washington Factory. In this role, I worked within the 
Production System Support organization and oversaw production support 
for 737 Final Assembly, P-8 and Wings manufacturing operations. Before 
assuming this position, I served as a Senior Manager in the Boeing Test 
& Evaluation organization, which is responsible for flight testing 
newly manufactured planes. In addition to my work at Boeing, I served 
honorably in the U.S. Navy for 30 years, including as a Squadron 
Commanding Officer, earning the rank of Captain. I am a graduate of the 
U.S. Naval Academy, Navy Flight School and George Mason University. My 
resume and military biography are attached as Exhibits 1 and 2.
          The State of the Renton, Washington Factory in 2018
    The 737 is the flagship of Boeing's Commercial Airplanes division. 
Boeing currently manufactures all of its 737 planes in Renton: the 737 
MAX, the 737 Next Generation, and the P-8 Poseidon, a military 
variation of the 737.
    By June 2018, I had grown gravely concerned that Boeing was 
prioritizing production speed over quality and safety. In early 2018, 
Boeing experienced a substantial backlog in its production of 737 
aircraft. Initially driven by the delayed delivery of critical parts, 
the logjam quickly cascaded into numerous other problems within the 
Renton factory, with key metrics growing continuously worse. ``Jobs 
Behind Schedule'' (JBS) spiked to greater than ten times the normal 
amount, and the ``Roll Out on Time'' percentage routinely dropped below 
10%. In turn, the ``B1 Flights on Time'' rate \1\ also dropped 
substantially.
---------------------------------------------------------------------------
    \1\ ``B1'' is a flight-test term for the first test flight of a 
manufactured airplane.
---------------------------------------------------------------------------
    Despite the delays, Boeing continued its much-publicized push to 
increase production at Renton from 47 to 52 planes per month in June 
2018 and made clear its intent to increase the production rate again to 
57 planes per month in 2019. Boeing said nothing about the chaos that 
such goals created on the production floor. To meet its heightened 
production target, Boeing initiated ``major recovery operations'' at 
Renton. I realized these recovery operations were prioritizing 
production speed over quality, placing both manufacturing employees and 
the flying public at risk. The fallout from these operations was 
widespread and largely concealed from public view. In Boeing's 2nd 
quarter 2018 earnings report there was zero mention of the state of the 
factory.
    The factory did not have enough skilled employees, specifically 
mechanics, electricians and technicians to keep up with the backlog of 
work. As a result, the planned factory overtime rate more than doubled. 
From my military and private-sector experience, I knew that employee 
fatigue from excessive overtime inevitably produces process 
breakdowns--e.g., workmanship mistakes, missed inspection items, 
incomplete paperwork, or failure to follow established functional test 
procedures--all of which add considerable risk to the safety of 
airplanes. Moreover, the parts backlog was leading to substantial ``out 
of sequence'' work, meaning the work was performed in an area or at a 
time other than its planned location or time. This too increases the 
risk of process breakdowns and quality mistakes.
    At the same time, actions and decisions by new factory leadership 
and a major supply chain reorganization led to further dysfunction. 
Boeing canceled daily ``tiered'' meetings, which were crucial to 
information sharing between shifts, replacing them with a once-a-shift 
large daily status meeting held in the Town Hall conference room. 
Following that transition, I witnessed numerous instances where 
manufacturing employees failed to communicate effectively between 
shifts, often leaving crews to wonder what work was properly completed. 
At the new Town Hall meetings, 737 program leadership increased 
schedule pressure by publicly grilling lower-level managers about 
delays in front of a hundred or more of their peers, even when the 
cause of a delay was completely beyond the individual employee's 
control. I grew increasingly worried that this dogmatic focus on 
schedule, coupled with employee fatigue, would inevitably lead to 
rushed work and circumvention of established manufacturing processes. 
Many employees expressed similar concerns and frustration publicly and 
in private.
    Unsurprisingly, the confluence of parts delays, employee fatigue, 
out-of-sequence work, communications breakdowns, and schedule pressure 
led to a decline in quality. Boeing rigorously tracks identified 
process breakdowns and quality defects during production using a 
computerized database. Each database entry represents a quality defect 
during production, such as incomplete or incorrect build instructions, 
missing or malfunctioning equipment, missing inspections, or missing, 
damaged, or incorrect parts. More significant defects are elevated to a 
``Nonconformance Report'' (NCR), which requires engineering and quality 
personnel to sign off on a corrective action. During the relevant 
period, the factory saw quality issues increase by over 30%, and NCRs 
grew rapidly as well. There were many quality issues related to 
Electrical Wiring Interconnect System (EWIS) compliance, such as 
problems with functional testing of wiring or chaffed, cut, or pinched 
wires. I knew that improperly manufactured, installed, or tested wires 
can cause intermittent electrical or electronic data errors on critical 
plane systems.
     Boeing Refused to Address Its Deteriorating Factory Conditions
    Alarmed by the Renton factory's rapid and unprecedented decline, I 
emailed the 737 Program's Vice President and General Manager, Scott 
Campbell, on June 9, 2018. See Exhibit 3 (emails to 737 General 
Manager). Given the serious and time-sensitive nature of my concerns, I 
bypassed multiple levels of my supervisory chain and executive 
management to communicate directly with Mr. Campbell, the senior 737 
executive who could address the factory conditions. I sent that email 
nearly four months before the first 737 MAX crash, expressing the 
gravity of my concerns as follows:

        I fully appreciate the importance of doing our best to meet RO, 
        paint windows, B1s & delivery schedules. But there is a much, 
        much higher risk that we cannot lose sight of. I'm talking 
        about inadvertently imbedding safety hazard(s) into our 
        airplanes. As a retired Naval Officer and former Squadron 
        Commanding Officer, I know how dangerous even the smallest of 
        defects can be to the safety of an airplane. Frankly right now 
        all my internal warning bells are going off. And for the first 
        time in my life, I'm sorry to say that I'm hesitant about 
        putting my family on a Boeing airplane.

    To address the worsening factory conditions, I recommended that 
Boeing ``[s]hut down the production line to allow our team time to 
regroup so we can safely finish the planes.'' In response, Mr. Campbell 
assured me that ``safety and quality is number one and schedule come 
[sic] after that,'' but he did not acknowledge, let alone act on, my 
recommendation that Boeing shut down the line to allow workers time to 
safely address the production backlog.
    Over the following weeks, factory conditions worsened. In early 
July, I requested an in-person meeting with Mr. Campbell to further 
discuss my concerns. When we met on July 18, I gave multiple examples 
of process breakdowns, explained the numerous metrics indicating a 
decline in quality, and reiterated my recommendation that Boeing shut 
down the line to address product and worker-safety risks. In response, 
Mr. Campbell told me, ``We can't do that. I can't do that.'' I pushed 
back, explaining that I had seen operations in the military shut down 
over less substantial safety issues, and those organizations had 
national security responsibilities. Mr. Campbell responded tersely, 
``The military isn't a profit-making organization.''
    In addition to shutting down the line, I also recommended a 
thorough engineering and quality analysis to determine if the 
production environment had caused safety risks that needed to be 
disclosed to Boeing customers. Mr. Campbell also bristled at this 
recommendation, but ultimately promised to have human resources pull 
overtime statistics and to task the engineering and quality 
organizations with conducting this analysis.
    I left Mr. Campbell's office somewhat shocked by his dismissiveness 
and general unawareness towards the factory turmoil. At the 
recommendation of another senior manager, I documented the conversation 
in an email to Mr. Campbell the next day, noting Mr. Campbell's promise 
to address the cultural issues and worker fatigue and to conduct a 
quality and engineering analysis to determine if there were ``any 
potential quality risks that might require us to alert our customers.'' 
See Exhibit 3. Before my voluntary retirement from Boeing on August 1, 
2018, I shared this email exchange with several colleagues, who I hoped 
would monitor the resolution of these problems. To my knowledge, Boeing 
never acted on my recommendations.
 Boeing Failed to Investigate Its Chaotic Production Environment Even 
                        After Two Deadly Crashes
    Several months later, on October 29, 2018, Lion Air Flight 610 
crashed, killing all 189 people on board. Because Boeing manufactured 
the Lion Air airplane at Renton in the summer of 2018, I immediately 
feared the chaotic factory conditions had contributed to this tragic 
loss of life. When the Preliminary Aircraft Accident Investigation 
Report failed to address that possibility, I started a months-long 
effort to force Boeing and the accident investigators to focus on the 
Renton factory. My efforts did not bear fruit.
    I first made several calls to Boeing's Communications Office, 
asking to speak with the Boeing employees supporting the accident 
investigation. After weeks of fruitless efforts with the Communications 
Office, Norwegian Air Flight 1933--a 737 MAX aircraft also manufactured 
in the summer of 2018--conducted an emergency landing in Iran on 
December 14, 2018 due to an engine issue. Feeling increased urgency, I 
decided to appeal directly to Boeing's Chairman, President and CEO, 
Dennis Muilenburg. In a December 19, 2018 letter, I requested Mr. 
Muilenburg's assistance in contacting the Boeing employees supporting 
the Lion Air accident investigation. Exhibit 4 (Dec. 19, 2018 letter to 
Muilenburg). On January 7, 2019, I received a call from Boeing's 
General Counsel, retired Judge Michael Luttig. Mr. Luttig stated that 
Mr. Muilenburg had reviewed my letter and instructed him to follow up 
with me. After discussing my background and concerns regarding the 
Renton factory, I again reiterated my request to speak directly with 
the Boeing employees supporting the investigative team for the Lion Air 
crash. Mr. Luttig acknowledged this request and said he would share my 
information with Mr. Muilenburg and CFO Greg Smith.
    On January 21, I again spoke with Mr. Luttig about my concerns. Mr. 
Luttig said that all the 737s in service had received thorough post-
manufacturing inspections and that Boeing had not seen any issues with 
the other planes in the 737 fleet. Mr. Luttig then asked what I would 
do to investigate my concerns. I recommended that Boeing establish a 
cross-functional team of subject matter experts who could review data 
for potential quality and engineering risks and interview employees on 
the ground about the health of the Renton factory. In response to this 
proposal, Mr. Luttig recommended that they add Assistant General 
Counsel Padraic Fennelly to the conversation.
    The following day, I spoke with Mr. Luttig and Mr. Fennelly over 
the phone and once again reiterated my concerns and recommendations. 
Shortly after the call began, however, I came to believe Mr. Luttig and 
Mr. Fennelly were more interested in placating me than seriously 
investigating the factory conditions. Disappointed with the call, I 
promptly documented my core recommendation by email: ``Forming a cross 
functional [Non-Advocate Review] team to conduct an objective, 
comprehensive assessment of what occurred last year and the current 
state of the program . . . This assessment would need to include the 
analysis of production related data (e.g., quality data) and talking 
with employees.'' See Exhibit 5 (emails exchanged with general 
counsel). I stressed that investigating the Renton factory conditions 
was ``obviously an ongoing urgent matter--it was urgent last summer 
[and] made even more urgent this fall.'' Id.
    Two weeks later, having heard nothing further, I sent another email 
to Mr. Luttig and Mr. Fennelly, setting out in painstaking detail the 
concerns I had been raising since June 2018: employee fatigue and 
schedule pressure, aggressive leadership communication, mounting 
quality defects (including numerous functional test and Electrical 
Wiring Interconnect System problems), staffing constraints, process 
deviations, communications breakdowns, and others. I emphasized that 
``the sheer volume of these issues highlights the considerable & 
unnecessary risk the company was (is still?) taking to meet ever 
increasing airplane production rates and delivery schedules'' and that 
``production mistakes may have been made with this airplane and 
potentially others.'' Id. I also felt Boeing had misled the public 
about the state of 737 production: ``Record numbers of airplanes 
delivered makes for good headlines, but they can belie the reality of 
production health.'' Id.
    On February 14, Mr. Fennelly responded that Boeing had considered 
my information but had ``seen nothing from any of [its data] sources 
that would suggest the existence of embedded quality or safety 
issues.'' Id. Unsatisfied, I escalated my concerns to the Board of 
Directors in a February 19 letter that detailed my internal reporting 
efforts and requested urgent action from the Board. See Exhibit 6 (Feb 
19 letter to Board).
    Before I received any response, tragedy struck again: On March 10, 
2019, Ethiopian Airlines Flight 302 crashed, killing 157 people. 
Another 737 aircraft manufactured in Renton in 2018 had experienced a 
serious--and in this instance, deadly--safety issue within its first 
months in service, despite Mr. Fennelly's assurance less than one month 
earlier that there was no cause for concern.
    I concluded that Boeing would not take appropriate action on its 
own accord. Two days after the crash, I again wrote Boeing's Board, 
this time to explain that I would be contacting the National 
Transportation Safety Board (NTSB) and Federal Aviation Administration 
(FAA) directly due to Boeing's disappointing response. See Exhibit 7 
(Mar. 12, 2019 letter to Board).
                My Efforts to Engage Federal Regulators
    Following my March 12, 2019 letter to Boeing's Board, I immediately 
attempted to contact the NTSB and other regulators. After months of 
bureaucratic inaction, unexplainable delays, and communications from my 
attorneys, an NTSB investigator assigned to the Ethiopian Airlines 
crash finally contacted me to arrange a telephone interview. I provided 
him with detailed information, yet he estimated that the interview 
would require only 15 minutes. That interview occurred on June 26, 
2019. See Exhibit 8 (Key points provided to NTSB investigator on June 
26, 2019). The NTSB investigator had no responsibility for any matters 
other than the Ethiopian Airlines crash. My information, however, was 
not limited to that airplane. Instead, it concerned hundreds of 
aircraft manufactured over many months, including not only the Lion Air 
airplane but also numerous other planes that have experienced 
significant safety incidents. The NTSB's reluctance to interview me, 
and the limited scope of the interview it conducted, raised alarms that 
the agency shares Boeing's aversion to exploring systemic causes for 
the crashes.
    As a result, I sent a letter through my counsel directly to NTSB 
Chairman Robert L. Sumwalt on June 28, 2019, setting forth my concerns 
about the condition of the Renton factory in 2018 and the lackluster 
response I had received from the NTSB. I requested Mr. Sumwalt ensure 
my information be shared with the Indonesian and Ethiopian accident 
investigators in accordance with ICAO Annex 13 procedures. See Exhibit 
9 (June 28, 2019 letter to NTSB). I provided documentation of my 
communications with Boeing leadership; proposed that the NTSB analyze 
the engineering, quality data, and manufacturing history of the Lion 
Air and Ethiopian airlines planes; and offered to assist the 
investigation in any way possible, including by identifying witnesses 
who could corroborate my information regarding the Renton factory 
environment.
    On August 6, 2019, NTSB Managing Director Sharon W. Bryson sent a 
one-page response to my June 28, 2019 letter, informing me that my 
``concerns fall outside the scope of the NTSB's role in the 737 MAX 
accident investigations.'' See Exhibit 10 (Aug. 6, 2019 letter from 
NTSB). I was stunned by this response. Accident investigators routinely 
review maintenance and training records going back years. And yet, when 
two new airplanes crashed just months after they were built, the NTSB 
unilaterally deemed the chaotic and unstable production environment in 
which they were made to be outside the scope of the accident 
investigations.
    On September 17, 2019, counsel wrote on my behalf to both FAA 
Administrator Steve Dickson and Secretary of Transportation Elaine 
Chao, again laying out my concerns about the chaotic state of 
production at the Renton factory and imploring the agencies to share my 
information with accident investigators. See Exhibit 11 (Sept. 17, 2019 
letter to DOT) and Exhibit 12 (Sept. 17, 2019 letter to FAA). The FAA's 
response was to treat my letter as a ``Safety Hotline'' report. See 
Exhibit 13 (Oct. 14, 2019 letter to FAA). I received no response from 
the DOT. I followed up with an additional letter to the FAA on Nov. 5, 
2019, expressing renewed safety concerns in light of the Indonesian 
government's release of its Final Aircraft Accident Investigation 
Report for Lion Air Flight 610, discussed in greater detail below. See 
Exhibit 14 (Nov. 5, 2019 letter to FAA). Although the FAA suggested in 
October that it might wish to interview me, I have heard nothing from 
the agency since then.
    To date, I have submitted to numerous interviews involving the 
Department of Justice, the DOT's Office of the Inspector General, and 
the NTSB. But I have received no confirmation that any of my 
information concerning the state of the Renton factory has been shared 
with accident investigators.
             More Recent Developments and Ongoing Concerns
    I remain gravely concerned that the dysfunctional production 
conditions may have contributed to the tragic 737 MAX crashes and that 
the flying public will remain at risk unless this unstable production 
environment is rigorously investigated and closely monitored by 
regulators on an ongoing basis. My concerns are heightened by the 
regulators' apparent exclusive focus on the design failure of the 
flight control system, specifically the failure of the Maneuvering 
Characteristics Augmentation System (MCAS) software. But MCAS is a 
system designed to correct flight anomalies when they occur. It was not 
the first failure event that led to these crashes.
    Instead, according to publicly available information, the likely 
cause of both crashes was the transmission of incorrect information to 
the planes' MCAS by faulty Angle of Attack (AOA) sensors, which in turn 
caused the planes to execute a series of abrupt maneuvers contributing 
to the pilots' loss of control. Despite this, there has been limited 
discussion by Boeing and American regulators of the faulty AOA sensors, 
let alone a determination of the root cause(s) of their failures in the 
two crashes. In September 2019, however, the European Union Aviation 
Safety Agency (EASA) informed the European Parliament that Boeing had 
not provided an ``appropriate response to Angle of Attack integrity 
issues'' and indicated that it would not unground the 737 MAX until 
such a response was provided.
    My concerns about the AOA sensors multiplied when the Indonesian 
government released its Final Aircraft Accident Investigation Report 
for Lion Air Flight 610 on October 28, 2019. The Final Accident Report 
explains that on October 27, 2018, the day before the Lion Air crash, 
the plane's AOA sensor was deemed defective and removed from the plane. 
Boeing subsequently tested that AOA sensor on December 10, 2018 and 
confirmed it was faulty. It is possible that a similarly faulty AOA 
sensor was installed on the Ethiopian Airlines plane that crashed on 
March 10, 2019.
    AOA sensors have a long history of reliability. No one has asked 
why two brand-new AOA sensors on two brand-new planes inspected, 
installed, and tested by Boeing at the Renton plant during the summer 
of 2018 failed. And no one has investigated whether the hundreds of 
other planes manufactured during the summer of 2018 at Renton--
including the currently flying 737 Next Gen airplanes and P-8 military 
airplanes--have faulty AOA sensors or other production quality issues.
    I raised these concerns in a third letter to the FAA on November 5, 
2019, urging Administrator Dickson to issue an Emergency Airworthiness 
Directive to airlines and Boeing requiring them to inspect, test, and, 
if necessary, replace similar model AOA sensors. See Exhibit 14 (Nov. 
5, 2019 letter to FAA). I received no response.
    The number of safety-related events involving this relatively new 
aircraft is another alarming indicator that Renton production was 
seriously deficient. Using publicly available information, I have 
identified thirteen occasions where safety incidents occurred on 737 
MAX aircraft just weeks or months into their service life. See Exhibit 
15 (providing my analysis of recent 737 incidents). Combined with the 
two crashes, this means that 15 aircraft, or 4% of the 737 MAX 
airplanes delivered to customers had already experienced a safety 
incident. While I am unable to perform a statistical comparison with 
other aircraft, it is unacceptable to me that passengers on one of 
every 25 airplanes can expect to experience a safety incident.
    Although it is imperative to correct Boeing's flawed MCAS software 
and pilot training, it is no less imperative to thoroughly evaluate why 
the AOA sensors provided faulty data in the first place, and whether 
those reasons implicate Renton production more broadly. It is alarming 
that these sensors failed on multiple flights mere months after the 
airplanes were manufactured in a factory experiencing frequent wiring 
problems and functional test issues. Regulators simply must ask 
questions about the conditions of the Renton factory and Boeing must 
answer them candidly. The safety of the flying public depends on it.
                               Conclusion
    Although delivering record numbers of airplanes does in fact make 
for good headlines, the numbers can mask the reality of production 
health and airplane quality. I witnessed that on-the-ground reality and 
I watched with grief and horror as 346 individuals lost their lives in 
the Lion Air and Ethiopian Airlines crashes. We would be remiss if we 
failed to remember that another individual that wasn't on one of these 
airplanes also died as a result of these crashes. He was an Indonesian 
rescue diver named Syachrul Anto.
    I am not a disgruntled employee and I never imagined that I would 
find myself in this position. I am here today for one reason: to 
prevent future tragedies by ensuring that regulators and Boeing take 
every step necessary to prevent the loss of additional lives. Those 
steps must include a thorough investigation into the production of 737 
aircraft at the Renton Factory and close monitoring by regulators from 
this point forward.
    I have attached a list of recommendations for the committee's 
consideration.
Recommendations for the House Transportation & Infrastructure Committee
    1.  Direct the FAA to conduct a comprehensive investigation of the 
737 Renton, Washington Factory (Final Assembly, P-8 & Wings) to 
determine if reported problems still exist. If the international 
accident investigators want to be a part of this investigation they 
should be afforded the opportunity. The FAA should take appropriate 
actions as necessary depending on the results of the investigation.
    2.  Direct the FAA to issue an Emergency Airworthiness Directive 
for Boeing and airlines to inspect, test and if necessary replace 
faulty AOA Sensors (per Eric Havian's Nov 5, 2019 letter to the FAA)
    3.  Direct the FAA to deploy enough qualified employees into 
Boeing's factories to closely monitor production operations and be 
available to respond to production concerns from Boeing employees. 
These FAA employees need to be accessible to Boeing employees working 
on all shifts and be easily visible (FAA jackets, FAA shirts, FAA 
posters, etc.).
    4.  Direct the FAA to analyze reports of safety incidents involving 
737 airplanes (MAX, NG & P-8) built since 2017 and to provide a 
comprehensive risk assessment to this committee NLT Jan 1, 2020. The 
analysis needs to include the 13 other MAX incidents brought to the 
attention of the committee.
    5.  Direct the FAA to develop rules to limit work hours for 
employees involved in airplane manufacturing.
    6.  Direct the FAA to require Boeing to get FAA approval prior to 
increasing production rates and to closely monitor production rate 
increases to ensure production stability.
    7.  Direct the NTSB to develop a streamlined witness interviewing 
process to ensure future witnesses are interviewed in a timely manner. 
Publish this process on the NTSB website.
                                Exhibits
                           exhibit 1--resume
    Available at http://docs.house.gov/meetings/PW/PW00/20191211/
110296/HHRG-116-PW00-Bio-PiersonE-20191211.pdf
                     exhibit 2--military biography

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

      exhibit 3--emails to 737 general manager june and july 2018

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

           exhibit 4--letter to boeing ceo, december 19, 2018
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

exhibit 5--emails with boeing's general counsels, january and february 
                                  2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


  exhibit 6--first letter to boeing board of directors, february 2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


   exhibit 7--second letter to boeing board of directors, march 2019

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

 exhibit 8--key points provided to the national transportation safety 
                            board, june 2019

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

  exhibit 9--letter to the national transportation safety board, june 
                                  2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

   exhibit 10--letter from the national transportation safety board, 
                              august 2019

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

 exhibit 11--letter to the secretary of transportation, september 2019

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

    exhibit 12--letter to the administrator of the federal aviation 
                     administration, september 2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

exhibit 13--second letter to the administrator of the federal aviation 
                      administration, october 2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

 exhibit 14--third letter to the administrator of the federal aviation 
                     administration, november 2019

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


                                                                         Exhibit 15--Recent 737 Max Safety Incidents \\
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
      Date             Type                    Airline               Registration       Line #         B1-Flight                                       Reason
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
      5/12/18            737-9                             Thai Lion Air     HS-LSI         6816         4/14/18                    two loud bangs prompted crew to shut down the right engine
     10/29/18            737-8                                  Lion Air     PK-LQP         7058         7/30/18                                                     crash under investigation
      12/1/18            737-8                           WestJet          C-GZSG            7005          7/7/18              STAB OUT OF TRIM light occurred just after flaps up on departure
     11/14/18            737-8                           Sunwing          C-GMXB            6956         5/13/18                                Multiple systems failures. Replaced left ADIRU
     12/14/18            737-8             Norwegian Air Shuttle                LN-BKE      7110        10/14/18                                                                              Low oil pressure indication on the left engine
     12/14/18            737-8             Aerolineas Argentinas                LV-HKU      6753          1/7/18            zone of adverse weather caused the failure of the left hand engine
     12/24/18            737-8                        Air Canada          C-FSCY            6695        11/27/17               returned to origin after noticing decreasing hydraulic quantity
     12/29/18            737-8                        Air Canada          C-FSIP            6841         3/13/18                        lost wing anti-ice system due to an intermittent fault
       1/6/19            737-8                          SpiceJet          VT-MAX            7103         9/12/18                        left engine shutdown due to a restriction in fuel flow
      1/13/19            737-8                        Air Canada          C-FSCY            6695        11/27/17               rejected takeoff due to a Master Caution light for forward door
      1/28/19            737-8                        Air Canada          C-FSEQ            6814         2/12/18        right engine shutdown due to a low oil quantity and a low oil pressure
      1/29/19            737-8                       TUI Airways          G-TUMA            7211         11/4/18                                                   due to an abnormal engine (LEAP) indication
      2/12/19            737-8                          American          N308RD            6652        12/13/17          crew declared an emergency due to hydraulic failure indication light
      3/10/19            737-8                Ethiopian Airlines          ET-AVJ            7243        10/30/18                                                     crash under investigation
      3/26/19            737-8                         Southwest           N8712L           6290         9/18/17                                         lost right engine on initial climbout
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
\\ Summary: 15 emergencies involving airplanes built during a 13 month timeframe; 2 crashes & 13 incidents


    Mr. DeFazio. Thank you.
    Mr. Collins, you are recognized.
    Mr. Collins. I want to thank Chairman DeFazio, Ranking 
Member Graves and the members of the committee for this 
opportunity to testify. I also want to offer my condolences to 
the family members and friends of those who died in the two 
tragic 737 MAX accidents.
    I am a retired aerospace engineer from the FAA with over 29 
years of experience. Before that, I worked at Boeing for 5 
years. I was the lead FAA engineer on the NTSB's TWA 800 
accident investigation. That accident was caused by an 
explosion of a fuel tank on a 747 airplane. Therefore, I have 
seen firsthand the devastation caused by a catastrophic 
airplane accident.
    I became the FAA fuel tank safety program manager as FAA 
began addressing the lessons learned from the TWA 800 accident. 
During this time, we issued two major fuel tank safety rules, 
one focused on preventing fuel tank ignition sources and a 
second focused on reducing fuel tank flammability.
    I have heard FAA executives state that safety is our 
highest priority. I agree that safety was their highest 
priority when I started working at the FAA in 1989. However, 
over the last 15 years or so, FAA management culture has 
shifted to where the wants of applicants now often take 
precedent over the safety of the traveling public. A clear 
example of this is the issue of the rudder control on the 737 
MAX.
    Over the objections of FAA technical specialists, the 
airplane was approved with a rudder control design that is 
unchanged from the original 1960s design. It has a single-
string control system consisting of cables running from the 
cockpit to the rudder. This means that, in the event of an 
uncontained engine failure during takeoff, a catastrophic loss 
of control of the airplane could occur if an engine fragment 
cuts one of the cables.
    In 1989, a DC-10 crashed during an attempted landing at 
Sioux City after an engine had an uncontained failure. Engine 
debris damaged the airplane's three independent hydraulic 
systems that powered the flight controls. This disabled all the 
flight controls. The flight crew attempted to land but crashed 
while landing. The result was 111 fatalities and 47 serious 
injuries.
    Because of the DC-10 accident and based on industry 
committee recommendations, in 1997 the FAA updated the 
compliance policy in a revised AC 20-128A. The AC specifically 
requires protecting the rudder controls from one-third disk 
fragment projectile in the event of an uncontained engine 
failure.
    During the 737 MAX project, FAA management initially agreed 
with technical specialists that the existing design did not 
comply with the FARs, considering the new engine on the 
airplane. As the certification date neared and Boeing had not 
made a design change, FAA management decided not to require 
that Boeing modify the 50-year-old rudder control design. An 
FAA employee submitted the issue to the FAA's internal safety 
reporting process as a safety concern report.
    I was one of four members of the FAA's safety oversight 
board when the safety concern was submitted. The board includes 
two aerospace engineers and two managers. The submittal 
included the issue paper used to document agreement with the 
applicant and the method of compliance. The issue paper was 
signed by four managers, and all seven aerospace engineers and 
the project pilot disagreed with the method of compliance. The 
board identified a subject matter expert panel to review the 
SRP report and make recommendations to the board. The panel 
included four aerospace engineers and two managers, all from 
various FAA offices.
    The consensus-based recommendation of the panel included a 
statement that the method of compliance in the issue paper does 
not comply with the associated FAA regulations, the FARs. The 
board agreed with the panel report and forwarded it to the 
responsible FAA manager as the board's recommendation.
    The manager did not accept the board's recommendations, 
therefore overruling the board and the panel. That manager was 
the same manager that had overruled the technical specialists 
on the issue paper process.
    In considering the nonconcurrences on the issue paper, the 
SME panel report and the oversight board recommendations, a 
total of at least 13 FAA aerospace engineers, 1 pilot and at 
least 4 FAA managers disagreed with the method of compliance 
the other managers allowed to be used.
    By comparison, although the Airbus A320Neo was approved 
with a similar rudder design, EASA worked with Airbus to reach 
agreement that Airbus will revise the design using the guidance 
in the 1997 AC and incorporate the new design during production 
on all A320 series airplanes.
    Thank you for this opportunity. I hope my testimony will 
help improve the FAA management safety culture and the aircraft 
certification service.
    [Mr. Collins's prepared statement follows:]

                                 
 Prepared Statement of G. Michael Collins, Former Aerospace Engineer, 
 Federal Aviation Administration, appearing in his individual capacity
    I want to thank Chairman DeFazio, Chairman Larsen, Ranking Member 
Graves, and the other members of the committee for this opportunity 
today. I also want to offer my condolences to the family members and 
friends of those who died in the two tragic 737MAX accidents.
    I am a retired FAA Aerospace Engineer with 29 and a half years' 
experience in the FAA as a propulsion specialist; 5 years' experience 
in Boeing Commercial Airplane Company; and several years' experience in 
other safety critical industries including nuclear and non-nuclear 
power plant design. Although I am not representing anyone else, I know 
I have the support of many of my past coworkers at the FAA.
    As the committee reviews the FAA oversight of the 737MAX 
certification, it is an opportunity to review the overall issue of FAA 
oversight and the safety culture of management in the FAA's Aircraft 
Certification Service. When I first started working at the FAA in 1989, 
the management I worked for had a much different safety culture than 
today. In my early years at the FAA, I found management very supportive 
of engineers in the evaluation of proposed airplane design changes. 
Management supported engineers when they identified features that did 
not comply with the Federal Aviation Regulations (FARs). I was taught 
the FARs defined the minimum level of safety for airplane designs. If 
we discovered a design that did not comply, we identified the issue to 
our managers and the applicant's Designated Engineering Representative 
(DER). We then all worked with the applicant to help them develop 
design changes that resulted in a design all the FAA specialists agreed 
met the minimum safety standard defined in the FARs. It was a much more 
a collaborative environment than what exists today.
    There were some controversial issues then too, but typically the 
final FAA position was something everyone on the FAA team, engineers 
and managers alike, could agree was an acceptable method of compliance 
to the FARs.
    After the investigation of the TWA 800 accident and shortly after 
the 2001 Fuel Tank Safety rule was issued, I saw a significant shift in 
management. It was an erosion of the safety philosophy. FAA management 
shifted away from supporting FAA technical specialists (FAA aerospace 
engineers) in favor of industry positions. This shift continued until I 
retired in July 2018. The most recent and clear example of this erosion 
in safety culture was regarding the minimum level of safety debates on 
how to protect the rudder controls on the 737MAX from catastrophic 
damage from an uncontained failure of the new engines.
  737max Rudder Control--Protection from Catastrophic Failure due to 
                       Uncontained Engine Failure
    I was not working on the 737MAX at the time, so I was not involved 
in the original discussions of the rudder control design. I became 
involved as one of four members on the Safety Oversight Board when a 
safety concern (report) was submitted to the AIR Safety Review Process. 
The safety reports were submitted to the Board with the submitter's 
identifying information removed (de-identified).
    The Board reviewed the submittal which included the Issue Paper 
used to document the agreement with the applicant on the means of 
compliance the applicant would use to the relevant FARs. In this case, 
the Issue paper was signed by two managers, but all 7 FAA technical 
specialists (aerospace engineers) and the project pilot disagreed with 
the method of compliance described in the issue paper and therefore did 
not concur. Three FAA aerospace engineers did sign the issue paper, but 
their function was administrative. It was to ensure the issue paper was 
coordinated with the appropriate technical specialists.
    The SRP Oversight Board determined the issue was complex enough 
that we would identify a Subject Matter Expert (SME) Panel to review 
the SRP report and make recommendations on the safety concern to the 
Board. The SME Panel members were selected based on their expertise in 
the subject and were chosen from various FAA offices so many were not 
involved in the original discussions. All recommendations from the SME 
Panel, as well as from the Board, are required by the SRP process to be 
consensus-based decisions. That is, the final report and 
recommendations from the SME Panel, and the Board, must be something 
all members of the respective panel or Board ``can live with.'' It is 
not based on majority rule.
    The SME Panel included four FAA aerospace engineers and two FAA 
managers. The consensus-based recommendations of the SME Panel include 
a statement that the method of compliance directed by FAA Management 
and included in the issue paper does not comply with the associated 
Federal Aviation Regulations (FARs). The method of compliance did not 
meet the required minimum level of safety. Note that the report also 
included recommendations on design changes that would result in an 
acceptable means of compliance to the associated FARs.
    The SRP Oversight Board, which was comprised of two aerospace 
engineers and two managers, agreed with the SME Panel report and 
forwarded it to the responsible FAA Aircraft Certification Service 
Division/Directorate manager. The FAA Division/Directorate manager 
responded later to the Board that the Transport Airplane Directorate 
(TAD) ``considered the Board's recommendations and believes that the 
TAD met the Board's intent by following existing FAA rules, orders and 
procedures related to certification and delegation activities.'' The 
SRP Oversight Board determined the Division/Directorate manager did not 
implement the Board's recommendations and therefore, in accordance with 
the SRP Process, the Board forward the Board/SME Panel's 
recommendations and the Division/Directorate manager's response to the 
Deputy Director, Aircraft Certification Service, AIR-2, for his/her 
information.
    Therefore, when considering the non-concurrences on the issue 
paper, the SME Panel report and the SRP Oversight Board members 
recommendation; a total of at least thirteen FAA aerospace engineers, 
one pilot and at least four FAA managers disagreed with the method of 
compliance other FAA managers allowed Boeing to use.
    Note the SRP report said the Airbus A320neo rudder control had a 
similar design to the 737MAX. The submitter said the FAA certification 
team for the A320neo had reached agreement with EASA and Airbus that 
Airbus would change the design to a compliant ``fly by wire'' rudder 
control design and implement the new design into production after 
certification. Although FAA did not require such a design change 
through a time-limited partial grant of exemption, information on the 
internet about a contract for rudder control servos indicates Airbus is 
proceeding with the design change.
                  737max Fuel Tank Surface Temperature
    Another issue submitted to the Safety Review Process on the 737MAX 
project was where an agreement was made with the applicant using an 
issue paper to allow fuel tank temperatures above the maximum 
temperature allowed by the FARs. In this case, the technical specialist 
(aerospace engineers) working the issue did all sign the issue paper, 
indicating their concurrence. The issue paper document agreement on a 
finding that the applicant's method of compliance was an ``Equivalent 
Level of Safety'' to the normally accepted means of compliance. 
However, an employee submitted a safety concern about the decision in 
the issue paper to the SRP. The SRP Oversight Board designated a new, 
unique, SME Panel to review the safety report and make recommendations 
to the Board. The SME Panel agreed with the SRP submitter that the 
issue paper agreement was not an equivalent means of compliance with 
the associated FAR and made several recommendations. The SRP Oversight 
Board accepted the SME Panel report and forwarded it the responsible 
Division/Directorate manager. I do not know how the Division/
Directorate manager responded as there had not been a response when I 
left the SRP Oversight Board prior to my retirement.
                  737max Fuel Pump Circuit Protection
    An issue that was not raised in the SRP is related to the 737MAX 
fuel pump electrical circuit protection. FAA fuel pump ignition source 
prevention requirements essentially require ground fault interrupter 
(GFI) or similar fast acting circuit protection with active faulty 
detection and annunciation of failures on fuel pump power circuits. 
This requirement is to prevent electrical arcs in fuel tanks from 
failures of the high-power fuel pump wires. An FAA manager provided 
guidance to Boeing without going through the issue paper process for 
certification of a GFI installation that was contrary to FAA published 
policy in Advisory Circular 25.981-1C and in a ``generic'' fuel pump 
issue paper on the Transport Airplane Issues List. The manager told the 
applicant they could consider fuel in the area between the fuel pump 
and the housing the fuel pump is installed in as a flame or spark 
barrier. This guidance was given by the manager despite FAA technical 
specialists reminding the manager that there were known failures on a 
similar fuel pump installation (L-1011) that experienced a wiring 
failure inside the pump and burned a hole through both the fuel pump 
and the housing. (Fortunately, that L-1011 event did not result in a 
fuel tank explosion because the pump housing was under liquid fuel.) 
The FAA manager told the applicant that taking credit for fuel in the 
space between the motor and housing, which is typical for Transport 
Category fuel pump installations including the L-1011 installation, 
`was not prohibited by the AC.'
    At the same time, the FAA required Airbus to modify their fuel pump 
GFI installation before certification of the A320Neo. Before the FAA 
required modification, the proposed A320Neo GFI installation was like 
what the FAA manager allowed to be certificated on the 737MAX.
                  787 Lithium-Ion Battery Containment
    Before the AIR Safety Review Process was implemented in mid-2015, 
there were other examples of FAA management accepting applicant's 
positions over the concerns of FAA technical specialists, the FAA's 
aerospace safety engineers. For example, during initial certification 
review of the new technology 787 lithium battery system design the 
certification of the 787, an FAA technical specialist determined the 
lack of a fireproof enclosure could result in catastrophic failure due 
to uncontrolled fire from the battery. He proposed to FAA management 
that the special conditions design of for the airplane system lithium-
ion battery should include a requirement for a steel containment 
structure that would be vented overboard. FAA management overruled the 
specialist. The specialist worked to modify a new special condition 
that was applied to the battery installation so a containment system 
would be required. Unfortunately, FAA managers pushed to delegate 95 
percent of the certification to the applicant, including the high risk, 
new technology, battery installation. Without FAA safety engineer 
oversight, the ODA found the design without an enclosure to be 
compliant. Sadly, after certification, the airplane system lithium-ion 
battery experienced two extremely dangerous fire events and the FAA 
mandated the 787 fleet to be grounded. The design changes the FAA 
mandated to allow the 787 to fly again included a steel battery 
containment box that was vented overboard; as originally proposed by 
the FAA aerospace engineer.
   Issuing Exemptions that Are Not in the (Traveling) Public Interest
    FAA management often issues exemptions with more consideration to 
the financial interest of the applicant compared with the safety 
interest of the Traveling Public.
    An example of this is a four-year time-limited exemption that 
allowed production of 737NG airplanes with a non-compliant Fuel 
Quantity Indicating System. Non-compliant means it does not meet the 
minimum engineering safety level. The non-compliance was with the 
safety regulation that was issued in 2001. This regulation was created 
to prevent future accidents and address engineering design problems 
learned from the TWA Flight 800 accident, which was caused by a fuel 
tank explosion. On December 18, 2013, the FAA issued a ``Time-Limited 
Partial Grant of Exemption,'' Exemption No. 10905 (DMS docket FAA-2012-
17). The justification stated by the applicant was the additional time 
needed to develop a compliant design. However, the applicant and all 
transport category manufacturers were aware of this design shortfall 
since the TWA 800 accident investigation. This allowed continued 
production of a non-compliant design. It required incorporation of a 
few design changes but did not bring the design into compliance with 
the minimum level of safety required by the associated FARs. It granted 
the manufacturer 48 months to continue production of the 737NG, at the 
end of which the exemption required ``the FQIS on all newly-produced 
airplanes must be shown to comply with  25.901(c), Amendment 25-46, 
and 25.981(a)(3), Amendment 25-102, or later amendments.'' Note that an 
applicant for new type design has only 60 months to complete the FAA 
type certification project.
    Near the end of the 48-month period, the manufacturer petitioned 
for an extension of the exemption (docket item FAA-2012-1137-0010). I 
was assigned the task to evaluate the petition for extension. I was 
also instructed to check with the FAA Counsel who had worked on the 
2015 Boeing Settlement Agreement (https://www.faa.gov/news/
press_releases/news_story.cfm?newsId=19875). I asked the FAA Counsel if 
the extension was related to the Settlement Agreement. He responded 
that yes, it is related to the Settlement Agreement. He recommended we 
not grant the extension and instead require the applicant comply with 
the requirements of the original time-limited partial grant of 
exemption. I drafted a denial letter and provided it to the manager. 
The manager then held the letter for several months until Boeing 
withdrew the petition for extension (FAA-2012-1137-0012). However, 
Boeing then submitted a new petition for extension and FAA granted them 
a permanent exemption (FAA-2012-1137-0019). This permanent exemption 
required some additional modifications to improve the safety of the 
737NG FQIS, but it allowed Boeing to continue to produce 737NG 
airplanes with FQIS systems that did not meet the fuel tank ignition 
prevention requirements in the FARs. This was more in the financial 
interest of the petitioner than the safety interest of the traveling 
public.
    In contrast, the FAA issued an airworthiness directive in 1999 (AD 
99-03-04) that required modification of the 737 Classic (737-100, -200, 
-300, -400, and -500 series ) FQIS to meet the same fuel tank ignition 
prevention requirements that they granted a permanent exemption for the 
737NG. The FAA also issued an airworthiness directive in 1998 (AD 98-
20-40) that required modification of the 747 Classic (747-100, -200, -
300, SP, and SR series) FQIS that met the same fuel tank ignition 
prevention requirements. These airworthiness directives were issued 
because the FQIS failure mode that would have been eliminated by full 
compliance to the FARs for which the above exemption was granted was 
identified by the NTSB as the most likely ignition source that caused 
the TWA Flight 800 accident \1\.
---------------------------------------------------------------------------
    \1\ ``The National Transportation Safety Board determines that the 
probable cause of the TWA flight 800 accident was an explosion of the 
center wing fuel tank (CWT), resulting from ignition of the flammable 
fuel/air mixture in the tank. The source of ignition energy for the 
explosion could not be determined with certainty, but, of the sources 
evaluated by the investigation, the most likely was a short circuit 
outside of the CWT that allowed excessive voltage to enter it through 
electrical wiring associated with the fuel quantity indication 
system.'' (Executive Summary, NTSB Report on TWA Flight 800 Accident 
(NTSB/AAR-00/03)
---------------------------------------------------------------------------
                 FARs vs. Industry Consensus Standards
    There is a move to replace the Federal Aviation Regulations for 
Transport Category Airplanes (14 CFR part 25) with industry developed 
``consensus standards.'' I caution against such a change. The FARs have 
been developed over time and new regulations typically were adopted to 
incorporate lessons learned from fatal accidents. Therefore, many of 
the FARs were issued to prevent future accidents based on those lessons 
learned. Replacing with industry standards may lose those lessons. 
Also, using industry standards, as was done with the FARs for Small 
Airplanes (14 CFR part 23) makes it difficult for the public to comment 
onchanges or understand the regulations. FARs are public. Industry 
standards must be purchased from the industry organization.
       Non-Compliant Design Features discovered during ODA Audits
    When a design is type certificated using the ODA process, the ODA 
certifies to the FAA that the design compliant and the FAA then grants 
the type certification. Later, if the design is found not to be 
compliant during an audit, the issue is usually closed by a statement 
from the ODA that they will correct the non-compliance the next time 
they make a design change in that area; which could be never. I 
recommend that in cases where an ODA has said a design complies and it 
is later determined it does not comply, the ODA be required to bring 
the design into compliance during production. The production could 
continue under a time limited exemption until the compliant design is 
incorporated into production. The FAA could also evaluate the need to 
mandate retrofit of the airplanes delivered with the non-compliant 
design. Otherwise, the ODA company can produce the non-compliant design 
in potentially thousands of airplanes; each of which has a life of 20 
to 30 years. This should be considered an unacceptable risk to the 
public, since the FARs do define the minimum acceptable level of safety 
for the type design.
                               Conclusion
    I hope these examples demonstrate that even with the perceived 
limited resources of the FAA, their technical specialists did have the 
ability and resources to identify safety issues. Prior to the ODA 
system being implemented, FAA certificated the highly successful 
757,767, 777, and 747-400 with fewer FAA engineers who conducted direct 
oversight of company designees. However, more recently the FAA 
management safety culture often seems more interested in allowing 
applicants to produce designs that do not comply with the minimum 
safety standards defined by the FARs. This flawed FAA management safety 
culture has resulted in approval of airplanes with flaws resulting in 
grounding of the 787, two horrific 737 MAX accidents with the tragic 
loss of 346 lives and grounding the 737MAX for the last 9 months. 
Families have been destroyed. Airlines and the flying public have also 
been severely impacted by the groundings.
    Balanced regulatory oversight supported by a strong FAA safety 
culture is not costly to the industry, it's the foundation on which the 
previous unprecedented safety record was built. Most of the aerospace 
engineers I worked with are dedicated public servants who want to do 
what is best for the traveling public. Not just what is best for 
applicant's short-term bottom line. The existing FAA management safety 
culture is broken and demoralizing to dedicated safety professionals.
    I hope this committee considers this information when drafting 
future legislation.

    Mr. DeFazio. Thank you.
    Dr. Endsley?
    Ms. Endsley. Chairman DeFazio, Representative Meadows and 
members of the committee, thank you for the opportunity to 
testify today on behalf of the Human Factors and Ergonomics 
Society. I express my heartfelt sympathies to the families of 
the victims of both the Lion Air and Ethiopian Airline crashes. 
It's heartbreaking.
    The way in which technology is designed significantly 
affects the performance of its human operator. Optimizing the 
relationship between humans and technological systems is the 
essence of human factors engineering. When the system is easy 
to use, it guards against typical human limitations and errors 
and helps people to rapidly understand key information about 
what is happening, high levels of human performance can be 
achieved. When poor system design encourages accidents, good 
system design can prevent them.
    A key foundation to safe air travel is the design and 
development of the controls, displays and automated systems 
that pilots rely upon to operate their aircraft. Our 70-year 
history shows that aviation safety is significantly enhanced 
when human factors engineering is prioritized in the design and 
development of aircraft. History has also shown us the 
catastrophic consequences when human factors design is 
secondary to other considerations or is outright ignored.
    In the case of the Boeing 737 MAX 8, the failure to 
incorporate known human factors design principles and human 
factors engineering processes, its analysis, design, testing 
and certification, paved the way for both the Lion Air and the 
Ethiopian Airline crashes. These accidents resulted from 
inaccurate data provided by the aircraft's angle-of-attack 
sensor and its cascading effects on MCAS. The addition of the 
MCAS automation and its inherent unreliability, however, create 
significant new challenges for pilot performance that were not 
addressed.
    While automation can be beneficial, it also leads to new 
types of human error. Slow or incorrect pilot actions in 
operating and intervening in automation control are common 
problems and have been found in over 26 automation-related 
accidents among air carriers.
    Human factors research on these challenges sheds light on 
several automation deficiencies that impacted the pilots of the 
737 MAX 8. First, automation often leads to workload spikes in 
abnormal situations. In both accidents, the pilots were 
significantly overloaded, both mentally and physically. They 
were forced to manage multiple, competing alerts that led them 
away from the MCAS problem, and they needed to exert 
considerable physical force on the control column in order to 
counteract MCAS actions and maintain flight control.
    Secondly, automation also often results in low situational 
awareness. In these accidents, the pilots struggled, as they 
were not provided with the needed displays for understanding 
the functioning of MCAS, nor with the AOA sensor disagreement 
displays that were needed to oversee it. The various alerts 
that were provided were nondiagnostic and confusing. In 
addition to these challenges, under the high workload and 
distractions that were present, it appears the Ethiopian 
Airline crew lost situational awareness of their airspeed.
    Third, automation confusion is a frequent challenge in 
aviation accidents, and it was a central problem on the MAX 8. 
Automation confusion stems from both poor transparency of the 
behavior of the automation due to inadequate displays, as well 
as an inadequate understanding of how MCAS automation works due 
to the inadequate training on the system. In addition to 
failing to include MCAS in the flight manuals, training that 
provided actual experience in detecting, diagnosing and 
responding to failure conditions was not provided.
    Finally, the pilots needed to be able to take over and fly 
the aircraft manually. Without clear, unambiguous failure 
indications and training, the air crew could not successfully 
carry out the needed remediation procedures in the timeframe 
that was expected. And the manual forces required for pitch 
control could not be maintained.
    Like most avoidable accidents, the Ethiopian Airline and 
Lion Air crashes provide important human factors lessons that 
should be leveraged to improve the safety of our aviation 
system and to guard against similar problems in other safety-
critical systems. These automation problems could have been 
easily prevented by following established human factors design 
principles and standards for human-automation interaction and 
alarm presentation. Emphasis on human factors engineering and 
aircraft systems analysis, design, testing and certification is 
critical for building in aviation safety.
    We applaud recent statements by the FAA Administrator and 
Boeing senior management to reinforce their commitment to 
safety as the highest priority. And we hope they continue to 
support this message through their actions.
    My submitted testimony provides greater detail on the 
automation and design deficiencies of the aircraft and both 
near-term remedies and longer term prevention recommendations.
    Thank you for the opportunity to share these insights today 
and I look forward to answering your questions.
    [Ms. Endsley's prepared statement follows:]

                                 
    Prepared Statement of Mica R. Endsley, Ph.D., Human Factors and 
   Ergonomics Society, appearing on behalf of the Human Factors and 
                           Ergonomics Society
    Chairman DeFazio, Ranking Member Graves, Members of the Committee, 
thank you for the opportunity to testify today on behalf of the Human 
Factors and Ergonomics Society (HFES). With over 4,600 members, HFES is 
the world's largest nonprofit association for Human Factors and 
Ergonomics professionals. HFES members include researchers, 
practitioners, and federal agency officials, all of whom have a common 
interest in working to develop safe, effective, and practical human use 
of technology, particularly in challenging settings. HFES has a 
particularly strong record of expertise in aviation over its 70-year 
history.
    There is a long history of blaming the pilots when aviation 
accidents occur. However, this does nothing towards fixing the systemic 
problems that underlie aviation accidents that must be addressed to 
enhance the safety of air travel. Often accidents are caused by design 
flaws that do not take the human operator's capabilities and 
limitations into account. Bad design encourages accidents; good design 
prevents accidents. Solving these systematic design challenges is the 
primary calling of the field of Human Factors Engineering, which 
applies scientific research on human abilities, characteristics, and 
limitations to the design of equipment, jobs, systems and operational 
environments in order to promote safe and effective human performance. 
Its goal is to support the ability of people to perform their jobs 
safely and efficiently, thereby improving the overall performance of 
the combined human-technology system.
    Recent investigations of the Lion Air and Ethiopian Airlines 
crashes of the Boeing 737-Max8 aircraft have highlighted the importance 
of Human Factors in the design, testing and certification of 
aircraft.1, 2 Neglect of attention to Human Factors 
was also cited by both the National Transportation Safety Board (NTSB) 
and the FAA Joint Authorities Technical Review (JATR) in their reviews 
of the contributors to these accidents.3, 4 I will 
discuss the field of Human Factors Engineering and its role in 
supporting high levels of human performance and reducing accidents in 
safety critical systems such as aviation, particularly as it relates to 
the use of automation and these tragic aircraft accidents. This 
includes (1) a discussion of key Human Factors research on the ways 
that automation directly affects human performance, (2) Human Factors 
design problems associated with the 737-Max8 flight deck pilot 
interface, (3) Human Factors design process shortcomings, and (4) 
organizational and safety culture issues that are implicated in these 
accidents.
                       Human Factors Engineering
    The practice of Human Factors Engineering is based on 
scientifically derived data on how people perceive, think, move, and 
act, particularly when interacting with technology. The way in which 
any technology is designed significantly affects the performance of the 
people who interact with it. The user interface of the technology can 
make human performance much more efficient and human error 
significantly less likely when it is designed to be compatible with 
basic human capabilities. When the system is easy to use, guards 
against typical human frailties and errors (i.e. error tolerance and 
error resistance), and helps people to rapidly understand key 
information about what is happening, high levels of human performance 
in operating the system can be achieved. Conversely, if the technology 
design is complex, its displays are difficult to perceive or 
understand, it is easy to make errors, and significant effort is 
required to piece together needed information in order to stay abreast 
of a complicated and dynamic situation, the likelihood of human error 
increases greatly.
    Human Factors supplants a misplaced emphasis on blaming the pilot 
or over-reliance on training, and instead creates systematic 
improvements in human performance through improved system design. While 
training is important, it cannot overcome poor system designs in the 
long run.5 People are still likely to make the same types of 
errors if the system design is not consistent with human capabilities 
and limitations. For example, when researchers recreated one 
automation-related aviation accident, they found that 10 out of 12 
pilots made the same error as the pilots in the accident when 
confronted with the same conditions.6 Further, a well-
designed system that is consistent with user's needs and is easier to 
operate is also easier to train; thus, potentially reducing training 
requirements as well as improving human performance.
    The Human Factors profession can be traced back to early work in 
aviation when it was discovered that a large number of crashes occurred 
due to human errors that resulted from aircraft cockpits that were 
inconsistent with basic human capabilities and limitations. This 
spurred research on the perception, movement, and reaction time of 
aviators that was used to significantly reduce the frequency of 
aviation accidents over the following decades by redesigning the 
controls and displays of the aircraft to be more consistent with pilot 
characteristics.7
    Since this beginning, Human Factors Engineering has expanded 
considerably to address human performance challenges across a wide 
range of industries including aviation, transportation, manufacturing, 
military operations, power systems, space, healthcare, consumer 
products, and many more. Today, Human Factors and Ergonomics Society 
members are involved in conducting research on how people interact with 
new technologies, and are actively engaged in applying Human Factors 
design processes and knowledge across government and industry 
organizations. The Human Factors field is multi-disciplinary; it 
includes primarily engineers and psychologists, as well as 
physiologists and other professionals. Over 50% of the Society's 
members have PhD's and 32% have masters degrees. This blend of 
backgrounds lends itself well to addressing the wide range of 
considerations needed to optimize human performance in any system.
                    Automation and Human Performance
    Automation has increasingly become a part of modern systems in a 
wide variety of domains, including aviation systems, power systems and 
automobiles. Across the past 50 years, considerable evidence has 
mounted demonstrating many benefits from automation, but also many 
challenges involving human interaction with automation that can 
contribute to catastrophic failures.8-10 Just as no man is 
an island, so too, no automation is an island. Automation must be able 
to work successfully with human users or, ultimately, it will fail.
    While automation has many benefits, it also creates new types of 
errors that must be addressed through careful system design to prevent 
these new and often catastrophic errors.8, 11 A long 
list of automation-related aviation accidents precedes the recent 
accidents involving the Boeing 737-Max8 that provide significant 
lessons learned. A recent study listed 26 automation-related accidents 
among major air carriers between 1972 and 2013, where the pilots were 
significantly challenged in understanding what the automation was doing 
and interacting with it correctly to avoid the resulting 
accident.12 Several key challenges for human performance can 
be identified with automation use in aircraft flight decks.
Insufficient Pilot Training and the Loss of Manual Skills
    Human operators have an important role in complex technological 
systems because of their ability to be flexible, learn, and adapt to 
unexpected situations.13 To do this, however, pilots must be 
highly trained and experienced in managing the aircraft and its systems 
across a wide variety of flight conditions.14, 15 
Today's airline training environments have been criticized as providing 
insufficient attention to practice and exposure to the wide variety of 
alerts and non-normal situations that may be encountered in 
flight.16 Inadequate training on automation has been found 
to be a critical problem in many automation accidents.17
    Pilots are often encouraged to use automation and use it 
frequently.18 As pilots use automation more often, however, 
they become reliant on it,19 and skills needed for manual 
performance and decision-making can deteriorate.9, 20 
This includes both fine-motor skills associated with aircraft flight 
control and cognitive skills associated with cross-check and carrying 
out flight operations.21, 22 Further, newer pilots, 
trained primarily to operate via automation, may never create well-
learned skills for manual aircraft operations. Poor manual flight 
skills were implicated in the fatal crash of Colgan Air in 2009, for 
example.23
Automation Creates High Workload Spikes and Long Periods of 
        Boredom
    While automation has frequently been implemented with the goal of 
reducing manual workload, it can actually increase pilot workload 
during already high workload periods, such as when a route change is 
needed or when a problem occurs. This renders it difficult to use, and 
often pilots must quickly take over manual control in such 
circumstances which can be quite challenging.24 It also can 
make already low workload periods even less engaging, creating new 
problems associated with lack of vigilance and poor monitoring.25, 
26 This has been called the irony of automation.8
Automation Confusion is Common
    Poor operator understanding of system functioning is a common 
problem with automation, leading to inaccurate expectations of system 
behavior and inappropriate interactions with the automation.27, 
28 This is largely due to the fact that automation is inherently 
complex, and its operations are often not fully understood, even by 
pilots with extensive experience using it.29, 30 A 
study of the factors underlying automation accidents and incidents 
found that two of the biggest problems were inadequate understanding of 
automation and poor transparency of the behavior of the 
automation.17
    Pilots report being highly challenged in determining what the 
plane is doing and why, and predicting what it will do next, creating a 
problem of automation surprise.31 Very often the 
misalignment between pilots' understanding of how the aircraft will 
behave and its actual behavior is only discovered when the aircraft 
acts unexpectedly. At that point there may be too little time available 
to discover the problem, properly understand it, and take appropriate 
action before an accident occurs.32
    Automation confusion is most likely to occur when three main 
factors are present 33:
      The automation acts on its own without immediately 
preceding directions from the pilot;
      The pilot has gaps in knowledge of how the automation 
will work in different situations; and
      Weak feedback is provided to the pilot on the activities 
of the automation and its future activities relative to the state of 
the world.
Low Situation Awareness to Support Automation Oversight and 
        Intervention
    Automation is often brittle 34, unable to operate 
outside of the situations that it is programmed for, and subject to 
inappropriate performance due to faulty sensors or limited knowledge 
about the current situation. Therefore, the ability of the pilot to 
supervise the automation and correct for its deficiencies is critical. 
While some engineers assume that pilots need less information about 
what is happening when automation is involved, the reverse is actually 
true. Situation awareness of both the state of the automation and of 
the systems the automation is controlling is critical to the ability of 
the pilot to effectively oversee it and make appropriate interventions 
and control inputs as needed.35 Pilots need to keep track of 
the state of the aircraft and its operation in the flight environment, 
the state of the automation that is controlling some portion of the 
job, and information that will allow them to check the reliability and 
performance of the automation.
    Achieving a high level of situation awareness, however, has been 
found to be much more difficult when automation is involved. A key 
challenge associated with automated systems is that it tends to reduce 
the situation awareness of the human operator.35 Pilots with 
low situation awareness are said to be ``out-of-the loop.'' Low 
situation awareness when working with automated systems stems from 
three main sources: 35
      Displays--Poor information presentation is a 
significant problem with many automated systems. The system developers 
may either accidentally or intentionally remove key cues that pilots 
rely on to determine that the system is operating successfully, as was 
the case with the implementation of fly-by-wire aircraft.35 
The difficulty of determining that automation is not working correctly 
is a key challenge with automation use. The inadequacy of the displays 
provided has been found to be a frequent cause of aircraft accidents 
and incidents involving automation.17
      Vigilance--Automation often puts people into the 
role of passive monitor, however, in general, people are poor monitors 
of automation.36 Vigilance decrements can be significant, 
occurring both because of over-trust in automation,17, 19, 
37 and because people are in general poor at maintaining 
vigilance when passively monitoring.38, 39
      Engagement--A person's level of engagement 
decreases when they move from actively performing a task to passively 
watching another entity performing the task.35, 40, 41 
With low engagement, it has been found that people have a much lower 
understanding of what is happening than when they are performing tasks 
themselves. A review of automation research was summarized by a 
fundamental automation conundrum: ``The more automation is added to a 
system, and the more reliable and robust that automation is, the less 
likely that human operators overseeing the automation will be aware of 
critical information and able to take over manual control when 
needed''.42
    As automation becomes more technologically capable, with 
increasing levels of reliability and robustness for performing an ever-
widening range of tasks, people will become even more hampered by low 
situation awareness and fall short in the requirement to oversee the 
automation and interact with it effectively. Even when system designs 
are improved and people are vigilant, the degrading effects of reduced 
engagement are difficult to overcome.42
   Human Factors Automation Issues in Boeing 737-Max8 Accidents
    The two recent crashes involving the Boeing 737-Max8 aircraft 
involved several of these known automation challenges. These accidents 
resulted from inaccurate data provided by the aircraft's angle-of-
attack (AOA) sensor and its cascading effects on the Maneuvering 
Characteristics Augmentation System (MCAS) that was developed to 
automatically provide pitch stability following the addition of new, 
larger engines on this version of the aircraft. The following analysis 
of the Human Factors and Safety problems contributing to these 
accidents is based on the accident reports released by the relevant 
investigation boards,1, 2 reviews by the NTSB 4 
and the FAA JATR 3 in the United States, and other publicly 
available information on the accidents and events leading up to it.
Insufficient Reliability of MCAS Automation
    Several critical design decisions created an automated system that 
was inherently brittle and not resilient to the inevitable problems 
that can happen in the real world. First, the MCAS system on the 737-
Max8 was designed to operate from the inputs of only one AOA sensor, 
unlike a version of the MCAS developed for the United States Air Force 
KC-46 that measured and compared the inputs from two sensors.43 
When the single AOA sensor provided inaccurate inputs, it created an 
automated system that performed repeated, erroneous trim actions. The 
automation had an erratic effect on the stability of the vehicle that 
was at odds with pilot goals and actions. Redundancy is fundamental to 
the design of a safe and resilient system; in this case a redundant 
sensor could have provided the indications needed for alerting the 
automation and the pilot of an anomaly. Simple maintenance errors, as 
occurred in the Lion Air accident, can have catastrophic consequences 
and should be guarded against though the use of Human Factors design 
principles in the design of maintenance tasks, procedures, and 
training.
    Further, the 737-Max8 MCAS was designed to engage and then reengage 
repeatedly, rather than only the single engagement allowed by the 
version designed for the United States Air Force.43, 44 
This created a situation in which the automation continued to perform 
inappropriate and unsafe actions (based on erroneous input data), that 
the pilots could not seem to override manually. The basic design of the 
MCAS automation contained built-in assumptions regarding automation 
reliability that proved to be unfounded, and that left the pilots 
highly challenged in managing the aircraft safely.
Automation Confusion, Lack of Training and Inadequate Automation 
        Transparency
    Automation confusion was high as the pilots struggled to understand 
what the aircraft was doing. The pilots had no previous knowledge of 
MCAS and the aircraft provided no displays to indicate that MCAS was 
acting on the aircraft trim, nor any displays to help them understand 
that it was getting erroneous data. They were in the dark regarding the 
functioning of MCAS in these accidents.
    Further, the pilots were not aware of or trained on MCAS, and it 
was not included in their flight manuals, leaving them confused as to 
why the plane was behaving erratically. They could not develop a 
correct understanding of the situation they were facing because they 
had no mental model to support this process. Effective training on how 
to overcome automation failures involves not only a written notice or 
description of the automation, but also actual experience in detecting, 
diagnosing, and responding to such events,18 which was not 
provided on the Boeing 737-Max8.
High Pilot Workload
    In both accidents the pilots were heavily overloaded in trying to 
manually control the airplane, needing to exert considerable physical 
pressure on the control column to compensate for the repeated out-of-
limit trim problems. They were simultaneously faced with multiple 
competing alerts provided by the aircraft. Alerts associated with 
indicated airspeed (IAS) disagree and altitude disagree were inadequate 
to help them to understand the fundamental problem they were facing as 
a result of a faulty AOA sensor. The alerts further created extra 
workload as the Lion Air pilots attempted to run indicated checklists 
and work with Air Traffic Control to check their instrument readings.
    The NTSB's preliminary report on these accidents highlights the 
significant mental workload caused by multiple alerts and their role in 
further distracting the pilots.4 The alerts provided were 
insufficient to help the pilots properly understand and diagnose the 
situation they were in, or to direct them to the appropriate checklists 
for managing it. The NTSB recommends that ``the FAA develop design 
standards, with the input of industry and human factors experts, for 
aircraft system diagnostic tools that improve the prioritization and 
clarity of failure indications (direct and indirect) presented to 
pilots to improve the timeliness and effectiveness of their response.'' 
4 The Human Factors and Ergonomics Society strongly agrees 
with this recommendation.
Lack of Support for Situation Awareness
    In these accidents, the pilots were unable to gain the needed 
situation awareness for accurate decision making. They were faced with 
an aircraft that repeatedly made uncommanded pitch changes while they 
received multiple alerts on airspeed disagreements and altitude 
disagreements, which they attempted to address. However, these alerts 
primarily served to add workload and distractions. Displays of the MCAS 
operation actions (e.g. trim up or down), and displays that would have 
helped the pilots to understand the state of the aircraft as affected 
by the MCAS system were not provided.
    For example, the inclusion of the AOA sensor display on the primary 
flight display (PFD) was sold as a system upgrade option. It was not 
included as a part of the addition of MCAS to the 737-Max8. However, 
neither the airline customers nor the pilots may have been aware of the 
need for AOA displays to support proper diagnosis of MCAS behaviors 
when making such a purchasing decision, due to the lack of information 
provided about MCAS and how it functioned. While Boeing had previously 
classified the AOA indicator display and AOA disagree lights as 
supplemental information and not necessary for the operation of the 
aircraft, the development of the MCAS system, and its reliance on the 
AOA sensors, should have created a re-evaluation of this decision. The 
pilots in these accidents were not provided with the needed displays 
for understanding the functioning of MCAS, nor of information needed to 
oversee its performance.
    There is also some evidence that the pilots may have lost situation 
awareness of other automated systems whilst dealing with the problems 
generated by MCAS. While there is only a preliminary accident report 
available on the Ethiopian Airline accident, it indicates that the crew 
did correctly set the STAB TRIM to CUTOUT and turned off the autopilot. 
Subsequently, however, their high airspeed made it much more difficult 
to manually trim the aircraft and maintain the desired pitch. The 
aircraft throttle remained at 94% N1 throughout and the aircraft did 
not stop at the input speed of 238 knots but continued to around 340 
knots (vmo). While it is possible the pilots did not understand the 
impact of the airspeed on the control problems they were facing, it is 
likely they simply lost situation awareness of their airspeed due to 
over-reliance on the auto-throttle system. The Boeing's flight crew 
manual recommends use of auto-throttles in take out, climb, and all 
other phases of flight. Problems with loss of situation awareness of 
the state of automation and the systems they control are known to be 
more frequent when people are under higher workload and when working on 
competing tasks.45, 46 Task fixation is more likely to 
occur under high workload. In this accident, the captain was highly 
loaded with trying to fly the aircraft manually, needing to exert 
considerable manual force, and with only a very inexperienced first 
officer for help.
    While alarms and alerts are a key method for helping pilots to 
detect and diagnose system failures, they were of little help in these 
accidents. Response to system alerts is not always automatic and 
immediate, contrary to the stated design assumption of 3 seconds. 
Responses to alarms and alerts are affected by many factors including 
the salience of the alert for gaining attention, form of presentation, 
agreement/disagreement with other indicators, and prior experience with 
the alert.47, 48 People must also interpret the 
meaning of alarms, which depends on context, their mental model of what 
is happening, and expectations.49, 50 Often people 
seek to confirm alarms, and need additional time to properly diagnose 
the meaning of the alarms in order to select appropriate actions. For 
example, Boeing's own data on controlled flight into terrain accidents 
over a 17-year period show that 26% of these cases involved no 
response, a slow response, or an incorrect response by the pilot to the 
GPWS alarm.51
    When multiple alerts across multiple systems are involved, as 
was the case in these accidents, considerable workload is added and 
much more time may be required to determine the root cause of the 
problems so as to select the appropriate response.47 
Multiple failures can cause contradictions between procedures or even 
prevent their complete execution. The time to respond to the alerts was 
further delayed due to the fact that the pilots had not been trained to 
recognize the events and alerts they were presented with, nor to 
understand MCAS, its reliance on the AOA sensor, and its impact on 
aircraft control and other flight systems.18 A NASA Study 
found that the probability of responding correctly for non-trained 
aircraft emergencies was only 7%, as compared to highly trained 
``textbook'' emergencies at 86%.52
    In summary, information that would have informed pilots about 
the activation of the MCAS or the faulty data inputs to it were lacking 
on the 737-Max8. The absence of prior training on the MCAS led to a 
lack of understanding of what was happening to aircraft control. The 
various alerts that were provided were non-diagnostic and confusing, 
adding to workload and leading away from a correct understanding of the 
pitch trim problem, rather than contributing towards a correct 
resolution in the available time frame. Pilot responses to the alerts 
were significantly delayed and inadequate due to these deficiencies.
Inability to Successfully Assume Manual Control
    Boeing has a widely publicized Cockpit Automation Philosophy that 
has guided its aircraft development over the past several 
decades.53 Its key tenants are that the pilot can always 
override the automation, and that it should be an aid to the pilot but 
not replace the pilot. In keeping with this guiding principle, in most 
other Boeing aircraft the pilot can always easily resume control by 
shutting off the autopilot system. However, the MCAS operated outside 
of this autopilot system and operated at odds with commanded pilot 
inputs.
    It is unclear why the design of the 737-Max8 MCAS departed from 
this consistent automation design philosophy and how the pilots were to 
know that the MCAS automation was continuing to operate, even after the 
autopilot was disengaged. Normally, pulling back on the control column 
will interrupt electronic stabilizer nose down commands in the 737. 
However, this was not effective in the 737-Max8 as it was set to repeat 
its actions if it continued to detect an out of trim problem.1 
Further, the first officer's side was modified to inhibit pilot column 
cut-out functions while the MCAS was functioning.1 Thus, the 
simple, and normal responses that normally worked did not.
    Proper decision making and performance in the aircraft is highly 
dependent on accurate situation awareness. While it has been noted that 
the STAB TRIM CUTOUT switch could have been used to resolve the MCAS 
problem, this procedure was not used by the crew of Lion Air due to the 
many factors discussed that lead to their lack of situation awareness. 
Procedures are only useful when the correct procedure can be selected 
and applied in a given situation. In the case of the Ethiopian Airlines 
accident, which occurred after the FAA issued an Emergency 
Airworthiness Directive on the MCAS 54, the pilots set the 
STAB TRIM to CUTOUT as directed, however, the flight crew continued to 
experience flight control problems and concluded that the trim was not 
working. It appears that their loss of situation awareness of the 
airspeed may have confounded their efforts to manually trim the 
aircraft, due to the high speeds generated.
    Once the pilots became involved in trying to overcome the MCAS trim 
activations, they were required to exert considerable manual force (in 
excess of 100 pounds according to the Lion Air accident investigation) 
to combat the actions of the system. Concerns have arisen as to the 
levels of physical force required and the ability of pilots to combat 
the strong forces associated with MCAS and the 737-Max8's engines under 
the conditions involved in these accidents. Although the Ethiopian 
Airline crew was able to turn off MCAS via the STAB TRIM CUTOUT switch, 
they subsequently flew for some two and half minutes while needing to 
exert manual forces on the control column to compensate for the mis-
trim. The FAA Code of Federal Regulations (CFR 25.143) requirement is 
to not exceed 75 pounds for one-handed or 50 pounds for two-handed 
short-term control of pitch, and 10 pounds of force for any long-term 
control of pitch (more than 3 seconds), due to the effects of manual 
fatigue. These pilots eventually stated ``pitch up together'' and 
``pitch is not enough'' before turning the electric trim system back 
on, presumably because they could no longer perform this task manually. 
This led to the reactivation of MCAS and loss of aircraft control.
    A determination is needed as to the ability of pilots (both male 
and female) to exert sufficient manual force to counteract the forces 
exerted by MCAS at the pitches and speeds in the operational envelope, 
and to operate manually in the case of a need to deactivate the system 
due to failures such as were experienced by these aircrew. A recent 
study by the FAA found that over 60% of females and between 15 and 65% 
of males (depending on age) were unable to meet current FAA code 
requirements for short term force application.55 Further, 10 
pounds of force for yoke pitch and stick pitch (the long term 
requirement) could be maintained for less than 5 minutes by between 42% 
and 60% of females and 12% of males.55 These results should 
be extended to address international populations and used to update CFR 
25.143 and to update aircraft cockpits to support actual pilot 
capabilities.
7 Human Factors Principles for Automation that Prevent Accidents
    A number of good design principles for improving people's ability 
to successfully oversee and interact with automated systems have been 
developed that could have prevented these accidents had they been 
applied. 48, 56, 57
    1.  Provide automation reliability. A key tenant of safety is 
the design of highly reliable systems. Automation needs to be resilient 
to bad data and avoid single point failures by cross checking across 
multiple inputs. Further, graceful degradation should be supported such 
that if the automation is not getting good data, it can provide 
automatic self-checking behaviors, with an accompanying message to the 
pilot. In this case, the MCAS should have been designed to read and 
compare inputs from both AOA sensors, with significant AOA sensor 
disagreements being used to disable MCAS and support pilot 
understanding of its operation.
    2.  The user should be in command. Automation should not interfere 
with manual operations and manual override should always be possible. 
Because people have the ultimate responsibility for system safety, 
because they are more able to adapt to novel, unforeseen situations, 
and because they may have information about the situation that an 
automated system does not, they should always be able to easily and 
simply override the automation and take control. Pilots should be able 
to easily override activation by the MCAS, rather than having the 
system fight the user for control. Overcoming the MCAS actions on the 
trim system should have been as easy as overcoming other electronic 
trim actions via the control column.
    3.  Provide automation transparency. The state of the autonomy and 
its intended actions must be made highly transparent to the pilots. The 
current goals and assumptions of the autonomy, its current and 
projected actions, and how much confidence should be placed in its data 
and algorithms should be clearly represented.48 The system 
should provide sufficient information to (1) keep pilots informed of 
its operating mode, intent, function and output, (2) inform pilots of 
automation failure or degradation, and (3) inform pilots if potentially 
unsafe modes are manually selected.56 It is critical that 
the automation mode and status be clearly and saliently displayed. In 
this case a display showing that the MCAS was on and each time it 
engaged, as well as its effect on aircraft trim, would have provided 
key input to the pilots as to what the system was doing. If the MCAS is 
overridden by the pilot and turned off, this should be displayed as 
well to provide clear feedback to the pilots on its state. Secondly, 
the state of the world that the automation is basing its actions on, 
such as the AOA sensors in this case, need to be clearly displayed so 
the pilot can cross check the reliability of the automation to decide 
whether to trust it or override it.
    4.  Provide training to users on automation to ensure adequate 
understanding and appropriate levels of trust. New automation should be 
introduced with training to allow pilots to develop accurate mental 
models of how it works, an understanding of its limitations and 
reliability in different situations, and information on how to detect 
and recover from abnormal events and failure conditions. As a 
significantly new piece of automation that had a direct effect on 
aircraft control, experiential training (e.g. via simulations) should 
have been provided that would allow pilots to experience MCAS 
operations, its failure conditions, and to perform the tasks needed to 
recover from and effectively overcome abnormal conditions.
    5.  Avoid increasing cognitive demands, workload and distractions 
and make tasks easy to perform. The need to sort through multiple 
competing alerts provided a significant distraction and added workload. 
Systems should be intelligent enough to filter out extraneous, 
incorrect, and misleading alerts in order to eliminate both nuisance 
alarms and reduce unnecessary workload and distraction.
    6.  Make alarms unambiguous. A failure of the MCAS system due to 
poor sensor data input should be displayed with a clear unambiguous 
message. Attempting to diagnose a problem with messages or displays 
that also have other meanings (e.g. the altitude disagree and airspeed 
disagree warnings), is an invitation to error and significant delays in 
responding appropriately to emergent events. Any abnormal behavior of 
MCAS (as affected by degraded sensors or other factors), should be 
displayed with an MCAS alert warning that is distinct from other 
alerts.
    7.  Support the diagnosis, management, and assessment of multiple 
alarms. System displays need to support pilots in determining the 
relationship between multiple alarms, so as to better understand the 
root cause of any warnings. If root causes are not independent, this 
needs to be understood, otherwise individually addressing them may not 
resolve a problem or make it worse. Pilots need support in responding 
to and handling multiple alerts, which can cause contradictions between 
procedures or even prevent their complete execution and degrade the 
utility of the alerts. Alarm management systems for aircraft need to be 
redesigned to support pilot understanding of how alarms across systems 
interact, which actions are a priority, and what actions should 
actually be taken to resolve the underlying problem.
    The lessons learned from these devastating accidents are important 
for the design, development and testing of automated systems for not 
only aviation, but also many other industries where automation is being 
implemented including military systems, power systems and automobiles. 
Assumptions of perfect automation are unwarranted and unless great care 
is taken in supporting the needs of the human operators to have good 
situation awareness of both the automation and the systems they are 
controlling, the resulting effect will be repeated tragedies of this 
nature.
          Human Factors Processes for Design and Certification
    A FAA Human Factors team conducted a detailed study of automation-
related aviation accidents in 1996. They found that ``problems with 
automation were not limited to any one aircraft type, manufacturer, or 
air carrier, but were systemic, pointing to much larger problems with 
the design of the pilot interfaces to the automation, as well as the 
processes used for design, training, testing, and regulation that were 
inadequate for addressing the inherent challenges associated with 
automation.'' 30 Consistent with their findings, a number of 
issues pertaining to the Human Factors processes used for the design 
and certification of aircraft are highly relevant to the 737-MAX8 
accidents that will be discussed in more detail. Addressing them across 
the aviation industry is critical to preventing future accidents.
Compliance with Human Factors Design Standards
    A number of detailed design standards exist relevant to Human 
Factors and automation that should be adhered to in order to promote 
good performance and accident prevention. This includes the FAA Human 
Factors Design Standard,56 DOD MIL-STD 1472G Design Criteria 
Standard: Human Engineering,58 and SAE 6909 Standard 
Practice for Human Systems Integration.59 In the case of the 
737-Max8, adherence to design principles for human-automation 
interaction and alarms would have significantly reduced the likelihood 
of these accidents, as has been discussed.
Incorporation of Human Factors Engineering in the Design Process
    Early incorporation of Human Factors analysis, design, and testing 
during the design process must be emphasized in order to build in safe, 
efficient operability. The importance of designing in a consideration 
of human capabilities and limitations throughout the design process is 
well established.60 The design of the operator interface 
cannot occur at the end of the design process; it is integral to the 
system design and must occur early during system design to ensure that 
the combined human-machine system will operate safely and effectively.
    It is unknown whether Boeing included Human Factors Engineers in 
its analysis, design, and testing activities, and, if so, whether they 
were sufficiently empowered to affect the 737-Max8 design. Given the 
many Human Factors deficiencies reported on in the accident analyses, 
NTSB and JATR studies, it is highly unlikely that Human Factors 
considerations received sufficient attention or prioritization in the 
design and development of the 737-Max8 MCAS system.
    Professionals trained in Human Factors Engineering should be 
included on the design team and engaged throughout the design process 
in: (1) conducting analyses of requirements to support human 
performance, (2) determining system functionality and information 
needs, (3) designing displays needed to support human performance in 
both normal and non-normal conditions, and (4) conducting tests of the 
ability of operators to perform in both normal and non-normal 
conditions.
Conduct and Validate Safety Analyses
    The value of any safety analysis rests on its thoroughness and its 
assumptions. A number of poor assumptions regarding MCAS were made 
during its development: (1) that uncommanded system inputs would be 
readily recognizable and acted upon by the flight crew with no 
additional training, (2) action to counter the failure would not 
require exceptional skill or strength, (3) the pilot would take 
immediate action counter the problem, and (4) trained flight crew 
memory procedures would be followed to mitigate the failure. These 
assumptions proved to be unwarranted in the accidents. The JATR also 
found that ``the system safety assessment and the functional hazard 
assessment, were not consistently updated.'' 3 This set the 
stage for a failure of the safety analyses conducted to adequately 
capture the real risks involved in the system design.
    Any assumptions made during safety analyses should be thoroughly 
vetted and evaluated to ensure that overly optimistic assumptions do 
not invalidate the benefits of such efforts. When automated systems are 
involved it is important that safety analyses always consider the 
potential for invalid inputs to the system, encountering unexpected 
situations outside of system design limitations, the need for human 
oversight and intervention, and recovery from automation failures of 
any kind. Further, safety analyses need to ensure that accurate 
assumptions are made about human performance, based on human 
performance data collected in realistic operational conditions when 
using the system as designed.
Conduct Robust Human User Testing to Validate System Designs
    The careful testing of any new safety critical system is 
imperative, particularly when automation is involved. In that various 
types of real-world events occur that may not have been anticipated 
during the design process, automation's behavior may often prove 
unexpected. The NTSB's recent Safety Recommendation Report 4 
points out that specific failure modes that could lead to uncommanded 
MCAS activation were not simulated as a part of Boeing's function 
hazard assessment validation tests. Therefore, resultant flight deck 
problems, such as misleading warning messages and erroneous information 
displays, were not unearthed during the testing process or assessed for 
their safety implications. The NTSB recommends that ``the FAA develop 
robust tools and methods, with the input of industry and human factors 
experts, for use in validating assumptions about pilot recognition and 
response to safety-significant failure conditions as a part of the 
design certification process''. 4 The Human Factors and 
Ergonomics Society strongly agrees with this recommendation.
    It is critical that testing of automation and operator interfaces 
include:
    1)  both normal and non-normal events, including automation 
failures and recovery;
    2)  a representative sample typical of operators who are external 
to the system design process; and
    3)  objective measures of human performance, including actions 
taken, errors, performance times, workload and situation awareness.
Support for Human Factors Assessments in Aircraft Certification
    The FAA also has a significant role in the design and development 
process for aircraft technology due to its responsibility as the 
certifying body. In that it is always possible for design teams to make 
errors in their assumptions and processes, or for cost and schedule 
goals to subtly degrade safety decisions, there is great value in 
having an external certification body who can provide a second review 
and an independent assessment of the safety of the system.
    The JATR report indicates that: (1) the FAA certification team did 
not fully understand the overall impact of the new MCAS system design, 
(2) the MCAS was not evaluated as a complete and integrated system on 
the new aircraft, and (3) Boeing failed to inform the FAA of 
significant design changes over the design process complicating their 
task.3 It appears that the FAA was unable to perform its 
important safety role due to the use of delegated authority, or ``self-
certification,'' in which Boeing was able to provide many of its own 
tests and analyses without independent verification and validation. 
This process misses the point of the value provided by an independent 
certification process.
    Critical to this situation is that the FAA may have inadequate 
numbers of Human Factors engineers involved in aircraft certification 
in addition to the pilots who are often serve in this role. Further, 
the JATR found that the FAA ``sometimes didn't follow their own rules, 
used out-of-date procedures and lacked the resources and expertise to 
fully vet the design changes implicated in two fatal crashes.'' 3 
The JATR recommends that:

        ``the FAA integrate and emphasize human systems integration 
        throughout its certification process. Human factors relevant 
        policies and guidance should be expanded and clarified and 
        compliance with regulatory requirements as 14 CFR 25.1302 
        (Installed systems and equipment for use by aircrew), 25.1309 
        (Equipment, Systems, and Installations), and 25.1322 (Flight 
        crew Alerting) should be thoroughly verified and documented. To 
        enable the thorough analysis and verification of compliance, 
        the FAA should expand its aircraft certification resources in 
        human factors and in human systems integration.'' 3

    The Human Factors and Ergonomics Society strongly agrees with 
this conclusion and recommendation.
                    Organization and Safety Culture
Development of Safety Culture
    A strong safety culture is widely recognized as critical in high-
consequence organizations such as aviation, power systems, and ground 
transportation. Studies have found that workplace-related disasters are 
often a result of a breakdown in an organization's policies and 
procedures that were established to deal with safety, and from 
inadequate attention being paid to safety issues.61-66
    Many of the effects of a poor or broken safety culture may be 
subtle and subconscious. For example, a large body of research shows 
that decisions about what is a problem or not a problem can be easily 
influenced by reward structures, time pressures, or 
instructions.67, 68 Actions and communications of 
senior management, or rewards for cost and schedule performance (which 
can be easily measured), can act to subtly shift people towards more 
risky decisions. While some organizations may tout ``safety first'' 
without backing it up, strong safety cultures are effective in 
promoting safety over short term profit objectives, overcoming fear of 
reporting that can keep problems hidden, countering non-compliance with 
standards, rules and procedures, and avoiding miscommunication on 
critical design and operational factors.
    Boeing has historically had a strong commitment to safety and human 
factors in its flight deck programs, however, there are concerns about 
the possible degradation of the safety culture at Boeing. For example, 
it was reported in the media that a survey found that one in three 
Boeing employees reported they felt undue pressure from managers 
regarding safety-related approvals due to time and schedule concerns, 
and some 15% reported encountering such problems several times or 
frequently.69 Further, over the past 15 years Boeing has 
reportedly lost many of its employees involved in Human Factors and it 
may not have involved them in the development of MCAS.
    A renewed focus on developing and maintaining an effective safety 
culture sets the stage for avoiding the deterioration of design 
processes that led to these accidents, and should be encouraged in all 
safety critical organizations. This includes aircraft manufacturers, 
airlines operations and maintenance, and certifying bodies. The Human 
Factors and Ergonomics Society applauds recent statements by the FAA 
Administrator and Boeing Senior Management to reinforce their 
commitment to safety as the highest priority, and hopes they continue 
to support this message through their actions. For example, Boeing 
should examine the degree to which Human Factors and Safety experts are 
involved in their design and development programs across the enterprise 
and ensure that they are fully empowered to support safety.
Organizational Structure to Support Emphasis on Human Factors and 
        Safety
    In that program managers can consciously or subconsciously 
compromise safety due to organizational pressures to meet cost and 
schedule goals, it is imperative that safety-critical organizations put 
in place organizational structures to counter such tendencies and avoid 
safety breakdowns. For this reason, a best practice is to appoint a 
Vice-President level Manager of Human Factors and Safety, who oversees 
safety at the organization and who can raise safety concerns to the 
highest level of management. Qualified Human Factors and Safety 
professionals should be assigned to all technology development 
programs. They can identify potential problems to program managers and 
recommend design solutions to enhance human performance and avoid 
serious accidents. They should also have a direct line to the VP of 
Human Factors and Safety so that unaddressed problems do not remain 
hidden from top-level management.
Use of Qualified Human Factors Professionals
    In many organizations, people assigned to address user interface 
design, user experience, human factors, training, and safety may have 
no formal training in these fields, or only cursory knowledge. This 
unfortunately seriously degrades the effectiveness of their efforts. 
Just like every other field of engineering, Human Factors Engineering 
is based on a significant body of formal education that is paramount to 
its successful practice. Because it is inherently interdisciplinary, 
however, its practitioners may have different degree titles (often 
Industrial Engineering or Cognitive/Experimental Psychology, as well as 
Human Factors). While there are a few bachelors level educational 
programs in Human Factors, most qualified practitioners will have 
master's or PhD degrees in the field. The Human Factors and Ergonomics 
Society maintains a directory of accredited academic programs in the 
field. The Board of Certification of Professional Ergonomists (BCPE) is 
the recognized body for certifying that individuals are qualified to 
practice Human Factors, ergonomics, and user experience through a 
combination of testing, experience, and academic qualifications. 
Currently there is no federal job code for Human Factors professionals, 
significantly complicating the ability of the FAA and other agencies 
from hiring personnel with the appropriate expertise.
                            Recommendations
    The objective of Human Factors Engineering is not to assign blame 
after accidents occur, but rather to prevent accidents from occurring 
by improving the design of technologies and systems in advance. In this 
light, the Human Factors and Ergonomics Society recommends that the 
FAA:
    1)  Encourage Boeing, and other aviation manufacturers, to 
incorporate Human Factors processes and personnel into the analysis, 
design, development, testing, manufacturing, and maintenance of 
aircraft systems in order to comply with certification requirements. 
(Supports FAA JATR recommendation 4)
    2)  Promote a safety culture in aviation that drives a primary 
focus on the creation of safe products, which in turn comply with 
certification requirements. (Supports FAA JATR recommendation 6)
    3)  Expand its aircraft certification resources in human factors 
and in human system integration, and integrate and emphasize human 
factors and human system integration throughout its certification 
process. (Supports FAA JATR recommendation 7)
    4)  Review training programs for automated systems and recommend 
improvements to ensure flight crew are adequately trained in automation 
processes and dependencies.
    5)  Conduct a study to determine the adequacy of policy, guidance, 
and assumptions related to maintenance and ground handling training 
requirements, and needed human factors improvements to reduce 
maintenance errors. (Supports FAA JATR recommendation 11)
    6)  Conduct system safety assessments for all manufacturers of type 
rated aircraft to demonstrate the adequacy of assumptions regarding 
human performance, particularly as it relates to pilot understanding of 
and response to alerts, and ability to perform control functions 
manually when needed. (Supports NTSB recommendations)
    In addition to these recommendations, Congress and the federal 
government can enact policies that will build up the FAA's and 
industry's capacity and expertise to better understand and address 
issues pertaining to alerting systems and human-automation interaction 
that are crucial to avoiding future catastrophic accidents in the 
nation's transportation and infrastructure. HFES recommends that 
Congress enact the following policies:
    7)  Direct the National Academies of Science Board on Human Systems 
Integration (NAS BOHSI) to conduct a study on human interaction with 
artificial intelligence, autonomy, and advanced automation 
technologies: enhancing safety and effectiveness. Such a study could 
bolster the knowledge and understanding of the many complex issues 
involved and provide important directions for the nation as it develops 
and implements these technologies across the coming decade.
    8)  Increase funding for Human Factors research at NASA and FAA on:
      a.  Understanding the effects of multiple alerts and the ``design 
of aircraft system diagnostic tools that improve the prioritization and 
clarity of failure indications (direct and indirect) presented to 
pilots to improve the timeliness and effectiveness of their response.'' 
(supporting NTSB recommendations)
      b.  Developing ``robust tools and methods for use in validating 
assumptions about pilot recognition and response to safety-significant 
failure conditions as part of the design certification process.'' 
(supporting NTSB recommendations)
      c.  The development of effective methods, displays, and training 
for supporting human oversight and interaction with automated systems. 
This could include support for the FAA's NextGen--Air Ground 
Integration Human Factors program's efforts around Human Error 
mitigation research, as well as the Flightdeck/Maintenance/System 
Integration Human Factors program, and NASA's Crew Systems and Aviation 
Operations program.
      d.  The development of tools to support human factors and safety 
assessments in the certification process. (supporting FAA JATR 
recommendations)
    9)  Direct the FAA to develop programs for educating management and 
engineers on Human Factors, the effects of automation on human 
performance in safety critical systems, and the incorporation of Human 
Factors Engineering processes, as well as the development of improved 
human-automation interaction approaches.
    10)  Direct the Office of Personnel Management to add job codes for 
Human Factors Engineer and Human Factors Psychologist to its list of 
occupational positions and establish appropriate qualifications in 
order to ensure that FAA and other federal agencies have access to and 
employ qualified Human Factors professionals.
                                Summary
    The science and practice of Human Factors Engineering is well 
established, with roots going back to the earliest days of aviation. 
Aviation is highly dependent on the design and development of safe, 
effective flight decks for pilot control. Achieving this goal is highly 
dependent on the early incorporation of Human Factors in the analysis, 
design, testing and certification processes. While this is true in 
general, it is even more important with automated systems and as use of 
artificial intelligence and system autonomy increases. The lessons 
learned from the tragic accidents of the 737-Max8 should be leveraged 
to improve the safety of our aviation system and to guard against 
similar problems in other safety critical systems.
                               References
    1 Republic of Indonesia Komite Nasional Keselamatan 
Transportasi. (2019). Final Aircraft Accident Investigation Report. PT 
Lion Mentari Airlines, Boeing 737-8 (max); PK-LQP, Tanjung, Karawang, 
West Java Republic of Indonesia: Author.
    2 Federal Democratic Republic of Ethiopia Ministry of 
Transport Aircraft Accident Investigation Bureau. (2019). Aircraft 
Accident Investigation Preliminary Report, Ethiopian Airlines Group, 
B737-8 (Max) Registered ET-AVJ, 28 NM South East of Addis Ababa, Bole 
International Airport Federal Democratic Repubic of Ethiopia: Author.
    3 Federal Aviation Administration. (2019). Joint 
Authorities Technical Review: Boeing 737 Max Flight Control System 
Observations, Findings and Recommendations Washington, DC: Author.
    4 National Transportation Safety Board. (2019). Safety 
Recommendation Report: Assumptions used in the safety assessment 
process and the effects of multiple alerts and indications on pilot 
performance Washington, DC: Author.
    5 Wickens, C. D. (1992). Engineering psychology and 
human performance (2nd ed.). New York: Harper Collins.
    6 Johnson, E. N., & Pritchett, A. R. (1995). 
Experimental study of vertical flight path mode awareness. Proceedings 
of the 6th IFAC/IFIP/IFORS/IEA Symposium on Analysis, Design and 
Evaluation of Man-Machine Systems (pp. 185-190). Cambridge, MA: MIT.
    7 Meister, D. (1965). Human factors evaluation in system 
development. New York: Wiley and Sons.
    8 Bainbridge, L. (1983). Ironies of automation. 
Automatica, 19, 775-779.
    9 Wiener, E. L., & Curry, R. E. (1980). Flight deck 
automation: Promises and problems. Ergonomics, 23(10), 995-1011.
    10 Wiener, E. L. (1993). Life in the second decade of 
the glass cockpit. Proceedings of the Seventh International Symposium 
on Aviation Psychology (pp. 1-11). Columbus, OH: Department of 
Aviation, The Ohio State University.
    11 Strauch, B. (2017). Ironies of automation: Still 
unresolved after all these years. IEEE Transactions on Human-Machine 
Systems, 48(5), 419-433.
    12 Gawron, V. (2019). Automation in aviation accidents: 
Accident analyses McLean, VA: MITRE Corporation.
    13 Rasmussen, J. (1980). What can be learned from human 
error reports? Change in the Working Life.
    14 Ericsson, K. A., & Lehmann, A. C. (1996). Expert and 
exceptional performance: Evidence of maximal adaptation to task 
constraints. Annual Review of Psychology, 47, 273-305.
    15 Meshkati, N., & Khashe, Y. (2015). Operators' 
improvisation in complex technological systems: Successfully tackling 
ambiguity, enhancing resiliency and the last resort to averting 
disaster. Journal of Contingencies and Crisis Management, 23(2), 90-96.
    16 DeCrespigny, R. C. (2015). Resilience--Recovering 
pilots' lost flying skills. Air Transport (June), 32-37.
    17 Funk, K., Lyall, B., Wilson, J., Vint, R., Niemczyk, 
M., Suroteguh, C., & Owen, G. (1999). Flight deck automation issues. 
The International Journal of Aviation Psychology, 9(2), 109-123.
    18 Orlady, L. M. (2010). Airline pilot training today 
and tomorrow Crew resource management (pp. 469-491): Elsevier.
    19 Lee, J. D., & See, K. A. (2004). Trust in automation: 
Designing for appropriate reliance. Human Factors, 46(1), 50-80.
    20 Jacobson, S. (2010). Aircraft loss of control causal 
factors and mitigation challenges. Proceedings of the AIAA Guidance, 
navigation, and control conference (pp. 8007).
    21 Haslbeck, A., & Hoermann, H.-J. (2016). Flying the 
needles: flight deck automation erodes fine-motor flying skills among 
airline pilots. Human factors, 58(4), 533-545.
    22 Casner, S. M., Geven, R. W., Recker, M. P., & 
Schooler, J. W. (2014). The retention of manual flying skills in the 
automated cockpit. Human factors, 56(8), 1506-1516.
    23 Board, N. T. S. (2010). Aviation accident report: 
Loss of control on approach Colgan Air, Inc. operating as Continental 
Connection Flight 3407 Bombardier DHC-8-400, N200WQ Clarence Center New 
York, February 12, 2009. (Tech. Rep. No. NTSB/AAR-10/01 PB2010-910401.
    24 Wiener, E. L., & Nagel, D. C. (Eds.). (1988). Human 
Factors in Aviation. San Diego: Academic Press.
    25 Warm, J. S., Dember, W. N., & Hancock, P. A. (1996). 
Vigilance and workload in automated systems. Automation and human 
performance: Theory and applications, 183-200.
    26 Molloy, R., & Parasuraman, R. (1996). Monitoring an 
automated system for a single failure: Vigilance and task complexity 
effects. Human Factors, 38(2), 311-322.
    27 Sarter, N. B., & Woods, D. D. (1992). Pilot 
interaction with cockpit automation: Operational experiences with the 
flight management system. The International Journal of Aviation 
Psychology, 2(4), 303-321.
    28 Sarter, N. B., & Woods, D. D. (1994). ``How in the 
world did I ever get into that mode'': Mode error and awareness in 
supervisory control. In R. D. Gilson, D. J. Garland & J. M. Koonce 
(Eds.), Situational awareness in complex systems (pp. 111-124). Daytona 
Beach, FL: Embry-Riddle Aeronautical University Press.
    29 McClumpha, A., & James, M. (1994). Understanding 
automated aircraft. In M. Mouloua & R. Parasuraman (Eds.), Human 
performance in automated systems: Current research and trends (pp. 183-
190). Hillsdale, NJ: LEA.
    30 Federal Aviation Administration Human Factors Team. 
(1996). The interfaces between flightcrews and modern flight deck 
systems Washington, DC: FAA.
    31 Wiener, E. L. (1988). Cockpit automation. In E. L. 
Wiener & D. C. Nagel (Eds.), Human Factors in Aviation (pp. 433-461). 
San Diego: Academic Press.
    32 Billings, C. E. (1997). Aviation automation: The 
search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum.
    33 Woods, D. D., & Sarter, N. B. (2000). Learning from 
automation surprises and going sour accidents. Cognitive engineering in 
the aviation domain, 327-353.
    34 Woods, D. D., & Cook, R. I. (2017). Incidents-markers 
of resilience or brittleness? Resilience Engineering (pp. 69-76): CRC 
Press.
    35 Endsley, M. R., & Kiris, E. O. (1995). The out-of-
the-loop performance problem and level of control in automation. Human 
Factors, 37(2), 381-394.
    36 Moray, N. (1986). Monitoring behavior and supervisory 
control. In K. Boff (Ed.), Handbook of perception and human performance 
(Vol. II, pp. 40/41-40/51). New York: Wiley.
    37 Muir, B. M., & Moray, N. (1996). Trust in automation: 
Part 2. Experimental studies of trust and human intervention in a 
process control simulation. Ergonomics, 39, 429-460.
    38 Davies, D. R., & Parasuraman, R. (1980). The 
psychology of vigilance. London: Academic Press.
    39 Hancock, P. (2013). In search of vigilance: The 
problem of iatrogenically created psychological phenomena. American 
Psychologist, 68(2), 97-109.
    40 Manzey, D., Reichenbach, J., & Onnasch, L. (2012). 
Human performance consequences of automated decision aids: The impact 
of degree of automation and system experience. Journal of Cognitive 
Engineering and Decision Making, 6, 57-87.
    41 Metzger, U., & Parasuraman, R. (2001). Automation-
related ``complacency'': Theory, empirical data and design 
implications. Proceedings of the Human Factors and Ergonomics Society 
45th Annual Meeting (pp. 463-467). Santa Monica, CA: Human Factors and 
Ergonomics Society.
    42 Endsley, M. R. (2017). From here to autonomy: Lessons 
learned from human-automation research. Human Factors, 59(1), 5-27.
    43 Everstine, B., & Tirpack, J. A. (2019, 3/22/2019). 
USAF reviewing training after MAX 8 crashes; KC-46 uses similar MCAS. 
Air Force Magazine.
    44 Sider, A., & Tangel, A. (2019, September 29, 2019). 
Before 737 MAX, Boeing's flight control system included key safeguards. 
The Wall Street Journal.
    45 Kaber, D. B., & Endsley, M. R. (2004). The Effects of 
Level of Automation and Adaptive Automation on Human Performance, 
Situation Awareness and Workload in a Dynamic Control Task. Theoretical 
Issues in Ergonomic Science, 5(2), 113-153.
    46 Ma, R., Sheik-Nainar, M. A., & Kaber, D. B. (2005). 
Situation awareness in driving while using adaptive cruise control and 
a cell phone. Proceedings of the Human Factors and Ergonomics Society 
49th Annual Meeting (pp. 381-385). Santa Monica, CA Human Factors and 
Ergonomics Society.
    47 Gilson, R. D., Deaton, J. E., & Mouloua, M. (1996). 
Coping with Complex Alarms: Sophisticated Aircraft Cockpit Alarm 
Systems Demand a Shift in Training Strategies. Ergonomics in Design, 
4(4), 12-18.
    48 Endsley, M. R., & Jones, D. G. (2012). Designing for 
situation awareness: An approach to human-centered design (2nd ed.). 
London: Taylor & Francis.
    49 Gilson, R. D., Mouloua, M., Graft, A. S., & McDonald, 
D. P. (2001). Behavioral influences of proximal alarms. Human Factors, 
4(4), 595-610.
    50 Seagull, F. J., & Sanderson, P. M. (2001). Anesthesia 
alarms in context: An observational study. Human Factors, 43(1), 66-78.
    51 Graeber, R. C. (1996). Integrating human factors and 
safety into airplane design and operations. In B. J. Hayward & A. R. 
Lowe (Eds.), Applied aviation psychology: Achievement, change and 
challenge (pp. 27-38). Aldershot, UK: Avebury Aviation.
    52 Burian, B. K., Barshi, I., & Dismukes, K. (2005). The 
challenge of aviation emergency and abnormal situations (NASA/TM-2005-
213462). Moffett Field, CA: NASA.
    53 Braune, R. J., & Graeber, R. C. (1992). Human-
centered designs in commercial transport aircraft. Proceedings of the 
Proceedings of the Human Factors and Ergonomics Society Annual Meeting 
(pp. 1118-1122). SAGE Publications Sage CA: Los Angeles, CA.
    54 Federal Aviation Administration. (2018). Emergency 
Airworthiness Directive AD #2018-23-51: Author.
    55 Beringer, D. B. (2019). NextGen Final Report: Data 
for updating 14 CFR Part 25.143 and potential reference standards for 
part 23, 27 and 29 aircraft: An evaluation of muscular force that can 
be applied to flight controls (DOT/FAA/AM-19/5). Oklahoma City: FAA 
Civil Aerospace Medical Institute.
    56 Federal Aviation Administration. (2016). The Human 
Factors Design Standard (HF-STD-001). Washington, DC: Author.
    57 Yeh, M., Swider, C., Jo, Y. J., & Donovan, C. (2016). 
Human factors considerations in the design and evaluation of flight 
deck displays and controls: version 2.0: John A. Volpe National 
Transportation Systems Center (US).
    58 Department of Defense. (2012). MIL-STD-1472G Design 
Criteria Standard: Human Engineering Washington, DC: Author.
    59 SAE International. (2019). SAE 6906 Standard Practice 
for Human Systems Integration Warrendale, PA: Author.
    60 Pew, R. W., & Mavor, A. S. (Eds.). (2007). Human 
system integration in the system development process: A new look. 
Washington, DC: National Academic Press.
    61 Cooper, M. D. (2000). Towards a model of safety 
culture. Safety science, 36(2), 111-136.
    62 Pidgeon, N., & O'Leary, M. (1994). Organizational 
safety culture: Implications for aviation practice. Aviation psychology 
in practice, 21-43.
    63 Meshkati, N. (2002). Macroergonomics and aviation 
safety: The importance of cultural factors in technology transfer 
Macroergonomics (pp. 337-344): CRC Press.
    64 Meshkati, N. (2007). Lessons of the Chernobyl nuclear 
accident for sustainable energy generation: Creation of the safety 
culture in nuclear power plants around the world. Energy Sources, Part 
A, 29(9), 807-815.
    65 Reason, J. (2016). Managing the risks of 
organizational accidents: Routledge.
    66 Wiegmann, D. A., Zhang, H., Von Thaden, T. L., 
Sharma, G., & Gibbons, A. M. (2004). Safety culture: An integrative 
review. The International Journal of Aviation Psychology, 14(2), 117-
134.
    67 Green, D. M., & Swets, J. A. (1966). Signal detection 
theory and psychophysics (Vol. 1): Wiley New York.
    68 Barkan, R. (2002). Using a signal detection safety 
model to simulate managerial expectations and supervisory feedback. 
Organizational Behavior and Human Decision Processes, 89(2), 1005-1031.
    69 Tangel, A., & Pasztor, A. (2019, October 10, 2019). 
Congress ramps up scrutiny of Boeing executives, board, The Wall Street 
Journal.

    Mr. DeFazio. Thank you, Doctor.
    Captain Cox?
    Mr. Cox. Good afternoon, Mr. Chairman. I thank you and the 
committee for asking me to share my views on the issues raised 
by these two tragic 737 MAX accidents. In my 50 years in 
aviation, and 33 as an aircraft accident investigator, I have 
not seen a more complex accident than Lion Air 610. Sadly, it 
was a forewarning of unanticipated conditions that existed 
which could lead to another accident. Ethiopian flight 302 was 
that accident.
    For an investigator, the most difficult accident is when 
there is a reoccurrence of a previous accident. I saw this in 
the mid-1990s with the USAir flight 427 accident near 
Pittsburgh in September 1994. It was a reoccurrence of a fault 
that had brought down United Airlines flight 585 3 years 
earlier. We did not learn all we could. As a result, 132 
perished near Pittsburgh.
    We did not learn all we could from Lion Air 610 before the 
Ethiopian 302 accident. The investigation was not complete. But 
there was compelling evidence of a single failure that could 
cause multiple warnings and adversely affect the handling 
characteristics of the airplane. It is crucial that we learn 
all we can from these accidents so that there is no 
reoccurrence of the numerous factors that led to the 
catastrophic loss of these two flights.
    There are immense complexities in these accidents. They are 
characterized as a loss of control-inflight accident. However, 
the contributing factors are numerous. Since the loss of these 
flights, there have been numerous attempts to blame one or two 
organizations or individuals. But this is inaccurate and 
misguided. Only with the consideration of all contributing 
factors can we learn all the lessons.
    In the Lion Air accident, there are contributing factors 
from aircraft design, certification oversight, maintenance 
execution, pilot performance, pilot dependence on automation, 
human factors, culture and regulatory oversight of the 
operator. And within each of these contributors are numerous 
issues. This is why I make the statement this is the most 
complex accident I have seen in 33 years.
    As the committee is aware, the National Transportation 
Safety Board and the Joint Authorities Technical Review have 
both recommended that future certification of aircraft include 
multiple warnings caused by a single failure. This was a 
critical factor in both of the accidents. The flight crews had 
multiple warnings occurring simultaneously, including one that 
is very distracting, the stick shaker.
    During the ensuing pandemonium, the recognition of 
inappropriate stabilizer trim movement would have been 
difficult. This is one reason that the runaway trim stabilizer 
trim procedure was not immediately accomplished.
    Aviation is the safest form of public transportation. We 
will fly 4\1/2\ billion passengers this year on 45 million 
flights safely. We have gotten progressively better since that 
first flight in 1903. And while the record is exceptional, it 
is not good enough for tomorrow or the day after. Aviation has 
to continue to be safer.
    I am frequently asked the question, is the MAX going to be 
safe when it returns to service? My answer is, yes, for I have 
great confidence in the FAA and in Boeing. Additionally, I have 
confidence that the recommendations from the Indonesian 
Transportation Safety Committee and the U.S. National 
Transportation Safety Board and the Joint Authorities Technical 
Review, these recommendations for safety are not only for the 
MAX but for aviation overall.
    We have a chance to take the lessons from these calamities 
and to make our skies safer. Let us not squander this 
opportunity. Let us carefully review each of the contributing 
factors of these accidents and improve the design certification 
processes to better address human factors, better failure 
analysis for multiple system failures, better pilot training 
with improved emphasis on manual handling skills, and improved 
organizational culture where the focus is on safety first.
    This committee's recommendations and actions can improve 
aviation safety. We can enhance the FAA's ability to improve 
failure analysis, system safety analysis, which may prevent a 
future accident.
    Let me conclude with an observation. I first soloed in 
1970. Had we maintained the same accident rate from then to 
today, there would have been hundreds more accidents and 
thousands more fatalities. We were not satisfied with that 
safety record, nor should we be with today's much improved 
safety record. Let us learn all we can from the MAX accidents 
to improve aviation safety.
    I look forward to your questions. Thank you, Mr. Chairman.
    [Mr. Cox's prepared statement follows:]

                                 
  Prepared Statement of John M. Cox, Chief Executive Officer, Safety 
                           Operating Systems
    Good morning/afternoon Mr. Chairman. I thank you and the committee 
for asking me to share my views of the issues raised by the two tragic 
737 MAX accidents.
    In my 50 years in aviation, and 33 as an aircraft accident 
investigator, I have not seen a more complex accident than Lion Air 
flight 610. Sadly, it was a forewarning of unanticipated conditions 
that existed, which could lead to another accident. Ethiopian Airlines 
flight 302 was that flight.
    For an investigator the most difficult accident is when there is a 
recurrence of a previous accident. I saw this in the mid 90s in the US 
Air flight 427 accident near Pittsburgh in September 1994. It was a 
recurrence of a fault that had brought down United Airlines flight 585 
three years earlier. We did not learn all we could from it, as a result 
132 perished near Pittsburgh.
    We did not learn all we could from Lion Air 610 before the 
Ethiopian 302 accident. The investigation was not complete, but there 
was compelling evidence of a single failure that could cause multiple 
warning and adversely affect the handling characteristics of the 
airplane. It is crucial that we learn all we can from these accidents 
so that there are no recurrences of the numerous factors that led the 
catastrophic loss of these two flights.
    There are immense complexities in these accidents. They are 
characterized as Loss of Control--Inflight accidents. However, the 
contributing factors are numerous. Since the loss of these flights 
there have been attempts to blame one or two organizations or 
individuals, but this is inaccurate and misguided. Only with the 
consideration of all contributing factors can we learn all the lessons.
    In the Lion Air accident there are contributing factors from 
aircraft design, certification/oversight, maintenance execution, pilot 
performance, pilot dependence on automation, human factors, culture and 
regulatory oversight of the operator. Within each of the contributors 
are numerous issues. This why I make the statement it is the most 
complex accident I have seen in 33 years.
    As the committee is aware, the National Transportation Safety Board 
and the Joint Authorities Technical Review have both recommended that 
future certification of aircraft include review of multiple warning 
caused by a single failure. This was a critical factor in both 
accidents. The flight crews had multiple warning occurring 
simultaneously, including one that is very distracting, the stick 
shaker. During the ensuing pandemonium, recognition of inappropriate 
stabilizer trim movement would be difficult. This is one reason that 
the runaway trim procedure was not immediately completed.
    Aviation is the safest form of public transportation. We will fly 
nearly 4.5 billion passengers this year on 45 million flights safely. 
We have gotten progressively better since that first flight in 1903. 
While that record is exceptional, it is not good enough for tomorrow or 
the day after. Aviation has to continue to be safer.
    I frequently am asked the question ``Is the MAX going to be safe 
when it returns to service?'' My answer is yes, for I have great 
confidence in the FAA and in Boeing. Additionally, I have confidence 
that the recommendations from the Indonesian National Transportation 
Safety Committee, the US National Transportation Safety Board, and the 
Joint Authorities Technical Review. These are recommendations for 
safety enhancements not only for the MAX, but for aviation overall.
    We have a chance to take the lessons from these calamities, and 
make our skies safer. Let us not squander this opportunity. Let us 
carefully review each of the contributing factors of these accidents 
and improved design and certification processes to better address human 
factors, better failure analysis for multiple system failures, better 
pilot training with improved emphasis on manual flying skills and 
improved organizational culture where the focus is on safety first.
    This committee's recommendation and actions can improve aviation 
safety. We can enhance the FAA's ability to improve failure analysis, 
and system safety analysis, which may prevent a future accident.
    Let me conclude with an observation. I first soloed in 1970, had we 
maintained the same accident rate to today there would have been 
hundreds more accidents with thousands more fatalities. We were not 
satisfied with that safety record, nor should be with today's much 
improved safety record. Let us learn all we can from the MAX accidents 
to improve aviation's safety record.
    I look forward to your questions.
    Thank you Mr. Chairman.

    Mr. DeFazio. Thank you for that testimony.
    We have three votes coming up on the floor of the House 
right now, we're in process, so the committee will adjourn, and 
I will return immediately after the votes. Let's say, I mean, 
they drag out votes around here. Yes, OK, recess. Sorry, we are 
going to take a break. I would say 30 minutes. So we will give 
you 30 minutes, you can run down to the cafeteria. I hope you 
can all come back, please. Thank you.
    [Recess.]
    Mr. DeFazio. I apologize. I was almost all the way back 
here, and then the Republicans called a, ``Doomed to Fail'' 
procedural vote and I had to go all the way back to the floor 
again, so we waste a lot of time around here.
    So, let's proceed to questions. Since I just got back and I 
want to gather myself for a minute, Rick, are you ready to 
question? OK.
    Mr. Larsen. I presume it will be 5 minutes.
    Mr. DeFazio. Yes.
    Mr. Larsen. Five minutes on the clock?
    Mr. DeFazio. Oh, yeah. Five minutes.
    Mr. Larsen. Yeah.
    Mr. DeFazio. Yeah.
    Mr. Larsen. OK. I had to ask, thanks. So, thanks. I want to 
thank the folks for being here.
    Dr. Endsley, in your discussion with regards to human 
factors, one of the issues we are looking at is, going forward, 
if we should change, and I think we should, but how we change 
the certification process and what changes ought to be made. 
How should we think about incorporating human factors analysis 
into the certification of airplanes?
    Ms. Endsley. The JATR report talks quite a bit about that, 
and we certainly concur with their recommendations to emphasize 
human factors more in the certification process.
    The real value of certification is getting a second set of 
eyes on what is going on. It is way too easy for even very 
knowledgeable, well-intentioned engineers to make incorrect 
assumptions or errors in their analysis, and the ability to 
have that independent set of eyes looking at what is going on 
and the processes that are being used, and the outcomes of the 
results I think is extraordinarily valuable.
    We need to make sure that those teams are equipped with 
well-qualified human factors engineers who understand a lot of 
the complexities of human behavior that are involved in these 
sorts of events, particularly with things like automation and 
alarm situations such as we saw here.
    Mr. Larsen. Yeah. In your opinion, and you may not have an 
opinion or knowledge. Maybe if someone else does have an answer 
to this, I would welcome that. Does the FAA currently have 
people in line to conduct human factors analysis of airplane 
designs and of system designs?
    Ms. Endsley. Yes. The FAA has some very well qualified 
human factors professionals. Dr. Kathy Abbott is in charge of 
certification on the human factors side and she is very 
knowledgeable about this. I think the issue is one of having 
enough people and having those people involved in that process 
such that they are getting the information they need and are 
involved all along the way.
    That is really the most valuable way to incorporate human 
factors. You can't just put a stamp at the end. You have really 
got to be involved early on it and continuously.
    Mr. Larsen. Yeah. Anyone else want to answer that question 
on human factors about type, numbers of people, skills, 
capabilities within the FAA?
    All right. OK. Nothing? OK.
    Mr. Pierson, in your written testimony, you alleged that 
last year, the 737 program's vice president and general manager 
agreed to conduct a thorough engineering and quality analysis 
to determine if the production environment has caused safety 
risks. To your knowledge, was that analysis conducted? Are you 
at the microphone, please?
    Mr. Pierson. Not to my knowledge.
    Mr. Larsen. ``Not to your knowledge''? Did you yourself do 
any follow up on that, or was that your role? Or whose role 
would have been to follow up on that in your organization?
    Mr. Pierson. That would have the general manager's 
responsibility with the appropriate leaders of the other 
organizations like engineering and quality.
    Mr. Larsen. Mm-hmm. In that circumstance, was Mr. Campbell 
within the ODA, and was your concern made into the ODA at 
Boeing for this question? Or was this outside of that?
    Mr. Pierson. This was a discussion that I had with him one-
on-one. It wasn't involving anybody else in the ODA.
    Mr. Larsen. OK. All right. Is your argument, is the point 
that you are making in your testimony that this is a problem 
with production pressure because of economic factors, or a 
problem with the way Boeing is organized to build and to 
certify airplanes?
    Mr. Pierson. Could you rephrase that again, Congressman?
    Mr. Larsen. Yeah. Is your argument, or the point you are 
making with your testimony is a very good point. Is it because 
of economic pressures only, or is it a problem with how Boeing 
uses the ODA?
    Mr. Pierson. You know, I really don't have a comment about 
the ODA. As far as economic factors go, I am obviously not an 
economist. My issues were really what I saw in the factory and 
the environment, and the things that were happening at the time 
when those planes were being built, and then I wasn't there 
when the second plane was built. I had retired just prior to 
that, but----
    Mr. Larsen. Yeah----
    Mr. Pierson. That was my concern, and----
    Mr. Larsen. Right. All right.
    Mr. Pierson. I will say----
    Mr. Larsen. Yeah----
    Mr. Pierson. Just on the topic, if I may.
    Mr. Larsen. Sure.
    Mr. Pierson. There has been a lot of discussion about 
certification, and the certification process, and a lot of 
discussion on the left side, if you will, of the process which 
is the design and the flight training and things like that.
    Mr. Larsen. Right. Right.
    Mr. Pierson. The right is on the far right is what is 
called the production part, and Boeing is issued a production 
certificate that expects to have every plane built with the 
same level of repeatable quality. And so, that is a really 
important part of the airplane certification process that we 
shouldn't forget.
    Mr. Larsen. All right. Thank you.
    Thank you, Mr. Chairman. I yield back.
    Mr. DeFazio. I thank the gentleman. I will recognize myself 
now.
    Captain Cox, we have heard from some through these hearings 
who have said, ``Well, if this had happened with U.S. or 
European pilots, it would not have been a problem because they 
have superior training.'' Yet I believe you are aware of U.S. 
and European pilots who knew this problem was coming in a 
simulator and were unsuccessful in managing it. Is that 
correct?
    Mr. Cox. Yes, sir. I am aware of some anecdotal tests that 
were done with some European and North American pilots that 
also let the airplane get to a quite high speed, over speed 
condition. So, I don't believe there is evidence that can 
support a premise that it is exclusively due to their being 
developing world countries that these accidents were caused by 
this.
    Mr. DeFazio. Right, and also, I think was it you used the 
word, ``pandemonium''?
    Mr. Cox. Yes, sir.
    Mr. DeFazio. Yeah. Now, what are you referring to there?
    Mr. Cox. The fact that when this situation occurs, that 
when the airplane breaks ground, you get somewhere around seven 
simultaneous failures, one of which is very, very distracting. 
The stick shaker. Literally the column in your hand is shaking 
and it is very loud. So, you as a pilot, the training comes in 
to, how do you sort through that? Where do you go back to the 
commonality and sort through that, and in what priority?
    But with that much noise going on, and with these 
simultaneous failures, the word ``pandemonium'' is appropriate, 
sir.
    Mr. DeFazio. OK. Yeah, I think NTSB said, ``cacophony,'' I 
think is the word they used, but similar.
    Mr. Cox. I have had a stick shaker go off in an airplane 
with passengers, and it, by itself, is enough of a challenge, 
much less now compounded with six to seven other simultaneous 
warnings and failures. It would be a real handful.
    Mr. DeFazio. Dr. Endsley, wouldn't that sort of fit into 
the human factors approach in terms of solving how quickly a 
pilot could solve that?
    Ms. Endsley. Yes. That was a big factor. The idea that 
pilots could respond in 3 seconds is based on a lot of things, 
but it would have to be a well-recognized cue for a well-
trained procedure, and that was not the case here. They had all 
kinds of multiple competing alerts which will really slow down 
decisionmaking time.
    Mr. DeFazio. OK. Mr. Pierson, you mentioned it in your 
statement, but I would just like to revisit it. I think after 
your extraordinary persistence when you finally got in to see 
the general manager of the 737 program, would you just please 
give us a little color on that meeting? A little more than in 
your testimony? Yeah.
    Mr. Pierson. Congressman, you are referring to, I believe, 
our July 2018 meeting.
    As far as just color, if you will, commentary is when the 
meeting started, it was a follow up to the email that I had 
written requesting a shutdown of the factory. I met with him, 
and I walked into the office and he asked me, ``Why are you 
here?'' And I said, ``I am here to follow up to my earlier 
communication with you.'' And he asked me how it was going. And 
I explained that it was getting worse in my opinion, and that I 
echoed my recommendations.
    I had a bit of a difference of opinion at that point, and 
then we talked, and at the end, he agreed that he would pull 
the overtime records and look at how much work we were asking 
of our union employees, and I emphasized that not only that is 
obviously really important, because they are the ones doing the 
lion's share of the work, but also the managers that are 
overseeing them. And then, the engineering quality analysis 
that I had requested be done to see if there was any possible 
issues that may have required us to alert our customers.
    Mr. DeFazio. And nothing changed?
    Mr. Pierson. Not to my knowledge.
    Mr. DeFazio. OK.
    Mr. Pierson. I retired in August.
    Mr. DeFazio. Right, and we asked the CEO in the last 
hearing after he got that recommendation from you, and, ``Did 
you close down the line?'' ``No.'' ``Did you slow down the 
line?'' ``No.'' And apparently, none of the engineering reviews 
that you asked for or overtime reviews, if they were reviewed, 
they were disregarded. So, and when you posited that, from your 
experience in the Navy, this would say, ``No. We have got to 
stop and revisit this and fix it,'' but he did say to you 
something about, ``The Navy isn't a profit-making----''? What 
was that?
    Mr. Pierson. He said when I explained to him that, ``In the 
military operations, if we have these kinds of indications of 
unstable safety type of things, we would stop.'' And he said 
that, ``The military is not a profit-making organization.'' 
That's what he said.
    Mr. DeFazio. Now, Mr. Collins, your involvement in the 
issue regarding the placement of, and/or lack of, additional 
protection for the rudder control cable, as I understand it, I 
mean, in the end, there were how many people involved in the--
what do you call it? A nonconcur?
    Mr. Collins. A nonconcurrence. Well, there was the issue 
paper nonconcurrence, and then there was the SRP panel, whose 
recommendation was rejected, and the board recommendation. So, 
I think it was a total of 13 engineers, 1 project pilot, and 4 
managers documented that they did not agree with the decision.
    Mr. DeFazio. And this was, to the best of your knowledge, 
overruled by a single manager who is in the office in 
Washington State?
    Mr. Collins. Yeah. He is in the consolidated office. He was 
the transport airplane director manager at the time. He is the 
one that signed it and took responsibility.
    Mr. DeFazio. Mm-hmm.
    Mr. Collins. Others supported it. Other managers supported 
him.
    Mr. DeFazio. And there were questions raised by the 
minority that they think, ``Well, we should bring in former FAA 
Administrator Huerta or somebody else.'' To the best of your 
knowledge, did the decision on--because this is only one 
decision, and there have been others, and we are going to track 
these things down, but do you think that anyone higher up, like 
in the national office, was involved in the rudder cable issue 
or even aware of it?
    Mr. Collins. Well, the safety SRP report of the board's 
recommendation, the manager had to come back and explain why he 
disagreed with that, and that went up to Air2, the deputy 
director of aircraft certification.
    Mr. DeFazio. Oh.
    Mr. Collins. In the earlier decision, it has been my 
experience in issues like this that they are discussed with the 
aircraft certification deputy or director.
    Mr. DeFazio. And that is someone based in Washington?
    Mr. Collins. Yes, in Washington, DC.
    Mr. DeFazio. OK. Good. Then, that is a string to follow for 
us, and then, we will see where it goes from there. Thank you. 
That is helpful.
    With that, I don't have any other questions at the moment, 
and I recognize Representative Norton.
    Ms. Norton. Thank you, Mr. Chairman. I appreciate your 
inviting these witnesses as well because they broaden our 
understanding. And I think I'd like to begin with Mr. Pierson 
because your testimony, as I understood it, focused primarily 
on the Renton, Washington, factory, but, in past hearings, I've 
raised concerns about the North Charleston, South Carolina, 
factory, which makes the Boeing 787 Dreamliner.
    There we have reports of concerns from employees of 
defective manufacturing, even pressure not to report 
violations. Each time my office raised concerns with Boeing 
representatives they have assured me and my staff that the 
problems found in South Carolina were not systemic. Your 
testimony indicates some of the same issues were present in 
Renton, Washington. To your knowledge, how widespread were or 
are these issues, do you believe, Mr. Pierson?
    Mr. Pierson. Yes. Congresswoman, I have no experience at 
the South Carolina facility, but what you speak of I did 
witness at the Renton factory. There was certainly an 
inordinate amount of schedule pressure being placed on 
employees, and we had a lot of challenges with parts. I mean, 
normally, when the factory is running fine, everything is going 
well, but then we had kind of a cascading problem, and it just 
kind of got out of hand.
    Ms. Norton. I don't know why we'd want to trust Boeing 
without making sure that the FAA should go farther. In fact, 
would you favor that, the FAA going farther and doing an 
investigation of U.S. Boeing factories?
    Mr. Pierson. I fully support that. I'm encouraged to hear 
the FAA go in and do a thorough investigation. I really think 
that's necessary. And again, as I mentioned before, not only go 
and investigate, identify problems and fix them but maintain 
that presence that you need to have into the future.
    Ms. Norton. I'm going to suggest that following this 
hearing. Mr. Collins, you say that the culture at FAA shifted 
from supporting FAA technical specialists to favoring industry 
positions. This is something that concerned me in my questions 
this morning. I'd like to know what immediate steps you think 
FAA leadership can take to return the agency to a culture of 
safety you apparently experienced when you first began there.
    Mr. Collins. I think that the culture has evolved, so it 
would take something to turn it around. I had experience 
working with Flight Standards for a bit, and they rewarded 
employees who raised safety issues. I think rewarding employees 
and managers who address safety issues might be a good help. I 
mean, I've heard--I don't have evidence, but I've heard in the 
past managers' bonuses and things were based on, in part, 
applicants' schedules.
    Ms. Norton. Applicants' what?
    Mr. Collins. Schedules for projects to complete a project 
on time.
    Ms. Norton. Well, isn't that what leadership is all about? 
I mean, you can't change in any comprehensive way if you don't 
have somebody at the top for complicated organizations forcing 
change down. Do you think that the present leadership, for 
example, at FAA has the capacity to bring that kind of change 
or make sure that kind of change happens at Boeing?
    Mr. Collins. And I can speak to the FAA. At the FAA, I 
think they have the ability to do it. It's going to take work 
to change the culture at all the different levels that has 
evolved over time.
    Ms. Norton. And apparently this is by now built into the 
culture at places like Boeing. That's why my question to Mr. 
Pierson was about not assuming that what you see at one Boeing 
factory won't be the case at another. It seems to me that given 
what we have learned, the recalcitrance of Boeing, it is going 
to be on us if we do not take the steps to systematically look 
at Boeing factories across the United States. Thank you, Mr. 
Chairman.
    Mr. DeFazio. I thank the gentlelady. The gentlelady from 
West Virginia, Mrs. Miller, is recognized.
    Mrs. Miller. Thank you, Chairman DeFazio. Dr. Endsley, the 
FAA is looking into incorporating human factors into 
considerations throughout the design and certification process. 
Can you tell me about that?
    Ms. Endsley. Yes. That was one of the recommendations of 
the JATR, and we certainly concur with that. What needs to be 
done is to increase the staff that's available. We also need to 
increase some of the research that's needed to look at some of 
these issues that they're having challenges with such as 
multiple alerting situations and human automation interaction. 
There are a number of those kind of steps that can be done.
    To enable the certification to really consider human 
factors, I think it's really important that they are there as 
part of that team and that they get the kind of data that's 
needed all through the process from the analysis to looking at 
the designs to reviewing test procedures and test results. 
That's a really important thing to be incorporated all the way 
through.
    Mrs. Miller. That was sort of my second question as well. 
So you're talking about multiple factors, multiple human 
factors in the beginning of your statement?
    Ms. Endsley. Yes. Human factors is really looking at every 
aspect of how humans perceive, think, how they move, the 
anthropometry, really all human characteristics and human 
capabilities and limitations and then designing the systems to 
be compatible with how we work and to guard against some of 
where our known failure points are.
    So it's a systematic way of designing systems based on the 
research on how people work, and that's the way to really 
improve human performance. It works to not only improve the 
efficiency of your system but also guard against the kind of 
errors that lead to accidents.
    Mrs. Miller. Some people freeze. Other people the adrenalin 
starts to flow. So that will be difficult unless they are 
trained consistently how to react to specific problems, don't 
you think?
    Ms. Endsley. Training is extremely important, and it's a 
part of what we look at in human factors. So the first thing 
you want to do is design the system appropriately because it's 
very hard to train for bad designs. So you want to design it 
appropriately first, and then you want to train people, and 
training people on what to do in emergency situations is 
extremely important. It's very important for dealing with 
things like automation, automation failures and getting into 
these sorts of edges of the envelope where the automation 
doesn't behave properly.
    And you have to really expose people to that so they know 
what cues look like, how to prioritize information, how to 
respond, how to communicate, and those well-learned behaviors 
then can be executed much more smoothly when the real thing 
happens.
    Mrs. Miller. How do we tackle that automation surprise?
    Ms. Endsley. We try to avoid it. So the way we have to 
address it is, one, training. So people actually get good 
training on the automation, which didn't occur in these 
accidents but we know is extremely important for automation 
because it's very complex. You can find even very experienced 
pilots don't actually know how the system is going to operate 
in a wide variety of circumstances. So training is important.
    The other thing is really the displays we provide. Even 
well-trained pilots aren't going to do the right thing if they 
don't get the right information. For example, here they didn't 
have information or not what MCAS was really doing. They didn't 
have the information they needed to even understand that the 
angle-of-attack sensors disagreed or had a problem with it. So 
they didn't have the information they needed.
    Mrs. Miller. How to override it, so to speak?
    Ms. Endsley. So they could override it, right. So having 
all the procedures, having all the training won't work if you 
don't have the situational awareness you need to make the right 
decision.
    Mrs. Miller. OK. Thank you. I yield back my time.
    Mr. DeFazio. I thank the gentlelady. Albio Sires.
    Mr. Sires. Thank you, Mr. Chairman. Mr. Pierson, thank you 
very much for being here today. It gives me a great deal of 
comfort to know that there are people like yourself out there 
that when you see something wrong you're willing to speak up 
and let people know what is going on and how you feel. I think 
as someone who travels on planes it's very comforting to know 
that you would try to do the right thing. You went through the 
management. They ignored you.
    And this morning I just can't believe that after all we 
have gone through this morning we finally got a commitment from 
Mr. Dickson that they're going to investigate all your emails 
and the reasons that it happened. That's amazing to me after 
all this time. It took this hearing for them just to even look 
and investigate what your comments were. So I thank you.
    Mr. Pierson. You're welcome, Congressman. It's just the 
right thing to do.
    Mr. Sires. Was this pressure unique on employees at Boeing, 
or was it just this because of the 737 MAX, and they had to get 
them out, or was this something that was all the time at 
Boeing? Is this the culture, just keep pressuring the employees 
to push, push, push?
    Mr. Pierson. In my experience at Boeing, the other 
positions I was in at Boeing I didn't see that. In my vantage 
point, it was the factory. It was in the production facility. 
It's just the pressure and the schedule and scheduling. In 30 
years in the military, I never saw that level of schedule 
pressure being put on people. When you put people in that kind 
of pressure and they're tired, mistakes are made, and I think 
the doctor would agree with that.
    Mr. Sires. Can you give me other examples of what was going 
on? Because I'm not well-versed on the factory or some of the 
issues that you talked about. What you saw, what you saw that 
was wrong.
    Mr. Pierson. Well, maybe it would be best to just very 
quickly give a--in the factory, everything is planned. 
Everything is planned and is supposed to be done in accordance 
with our FAA-approved production certificate. And when things 
are working fine, parts are getting delivered on time, the 
people are working in position, the plane moves down the line 
and then eventually is properly flight tested, et cetera.
    End of 2017 and 2018 what I started observing--again, I 
wasn't alone, and this is why I've been adamant about talking 
to other employees at the site. We started having problems with 
our parts being delivered, and it wasn't just big parts like 
the engines, which was a chronic problem. We had other things 
that were really very important. Every part in a plane is 
important, but wiring, wire bundles, things like that, these 
are really important things.
    This starts to lead to a lot of out-of-sequence work, and 
so resources are stretched. People that are used to working in 
one position or two are now being asked to kind of work all the 
way down through the factory and maybe even outside, and of 
course that means their managers are also stretched, and the 
equipment is stretched. There's a lot of stuff going on, and 
it's very challenging, in my opinion, to maintain the level of 
quality that we really are expected to maintain.
    Mr. Sires. Do you stay in touch with some of your former 
workers, coworkers?
    Mr. Pierson. I'm sorry. Say again?
    Mr. Sires. Do you stay in touch with some of your 
coworkers?
    Mr. Pierson. I have a lot of friends at Boeing, and I for 
the most part with the exception of two employees I've been in 
contact with, I decided it wasn't really the right thing to do 
to talk to them about what I was trying to do and get the 
investigators to go look. So I haven't really talked to them.
    Mr. Sires. Because I was just wondering if that same 
practice continues today, what you observed while you were 
there. Has anything changed?
    Mr. Pierson. That's a great question. Again, I'm really 
encouraged the FAA is going to go in and do a thorough 
investigation, talk to employees and start with the employees 
that are actually building the plane, the people that are the 
mechanics and the electricians and the quality inspectors. 
Those are the people who are going to give the best perspective 
overall of how things are going. And looking at all the data in 
the production reports there's a lot to look at. I am 
encouraged by that, though, that they're committed to doing 
that.
    Mr. Sires. You're encouraged by what Mr. Dickson said this 
morning, that he's going to follow up on this?
    Mr. Pierson. I'm encouraged that they're going to do it. 
I'm a healthy skeptic right now, Congressman.
    Mr. Sires. Well, Mr. Chairman, I hope our committee follows 
up and makes sure that Mr. Dickson does what he committed to us 
this morning.
    Mr. DeFazio. I can assure the gentleman we will be 
following that very closely. We want to see that commitment 
delivered on, and I appreciate Mr. Pierson's persistence in 
this matter.
    Mr. Sires. Thank you, Mr. Pierson.
    Mr. DeFazio. With that I recognize Representative Brownley.
    Ms. Brownley. Thank you, Mr. Chairman. I just wanted to 
also note to the committee that's concerning to me is that Mr. 
Pierson also reached out to NTSB and to the Department of 
Transportation in his effort to get someone's attention, and in 
both cases with NTSB and Department of Transportation they did 
not take any action from your notifications. Is that correct?
    Mr. Pierson. It's correct, Congresswoman, that it was an 
effort to try to get the investigators. I was trying to get to 
them and share information, and it took over 3 months before 
they'd even agree to meet with me. They didn't want to receive 
the documents. Eventually, they did meet with me. They offered 
to give me 15 minutes. My attorneys and myself said that's not 
nearly enough time.
    They only gave an hour and a half, and at the end of it 
all, they referred us to Department of Transportation IG and 
said that it was outside their scope. We had asked them again 
to pass the information to the Indonesian and Ethiopian 
investigators, and their take on the matter was that it was 
beyond the scope of their responsibilities and those 
investigations.
    Ms. Brownley. Thank you. I heard a podcast on Boeing 
probably 6 or 8 months ago. I can't remember how long it was, 
but it was another Boeing whistleblower who was talking about 
production of the airplanes and the intensity that Boeing was 
putting on the employees to produce and produce in a timely 
way.
    And in this podcast, they referenced the fact that they 
were directed at one particular time that there were engines 
that were not allegedly fully functioned engines. That they 
were marked and painted in a way that said there was some 
malfunction going on with the engine, and in this push to move 
the assembly line, that they actually were instructed to go use 
an engine off of that. I don't know if you ever observed 
anything like that.
    The podcast went on to say, too, that there were tools and 
so forth left in the belly of the plane or in the tail of the 
plane. Just sort of sloppy work that wasn't being inspected, 
and I don't know if you witnessed anything like that?
    Mr. Pierson. Congresswoman, again, I didn't work in South 
Carolina. I will say that.
    Ms. Brownley. That was in South Carolina.
    Mr. Pierson. If you are asking about the Renton facility, I 
don't ever recall anybody ever saying, ``Go get a part,'' that 
wasn't approved. I never saw that.
    Ms. Brownley. OK. OK, very good.
    And Mr. Collins, in terms of talking about the FAA culture 
and how it really needs to change, was there a crash that 
occurred when you were employed by FAA?
    Mr. Collins. Yes. I actually investigated two accidents. 
One was an Air France in Tahiti that ran off the runway and 
nobody was hurt, and the other was the TWA 800 accident where 
everybody died, and so, I was at the hangar. I was the lead FAA 
engineer on it when it became clear it was a fuel tank 
explosion.
    Ms. Brownley. And when you were at the FAA and those 
incidences occurred, did you see changes in the way FAA 
operated? Did you see changes in the culture of the 
organization?
    Mr. Collins. I was kind of under the initial culture. We 
did a lot of work. We did two rulemakings to improve the 
safety. There were hundreds of airworthiness directives as we 
learned about different failures that could create ignition 
sources. It was really after implementation of the 2001 fuel 
tank safety rule a few years later where I saw industry 
resistance and management supporting it start to creep in.
    Ms. Brownley. Would you say that was the beginning of a 
cultural change starting to happen?
    Mr. Collins. Yeah. That was when we first started seeing 
engineers nonconcurring on issue papers. I really don't 
remember it before then, so 2002, 2003ish.
    Ms. Brownley. And this culture is not just with the Boeing 
organization. It is with any manufacturer.
    Mr. Collins. No. It is across the board with manufacturers. 
It is not just Boeing.
    Ms. Brownley. Thank you, sir.
    I yield back, Mr. Chairman.
    Mr. Collins. If I could add, the example of the rudder was 
the one that was the most dramatic because it was really 
unprecedented to have that many people document a disagreement 
like that.
    Ms. Brownley. Thank you.
    Mr. DeFazio. I thank the gentlelady.
    Yeah, Mr. Collins, just to follow up on that, you mentioned 
the name of one individual who we are going to seek to discuss 
this with. You mentioned there were others. Do you happen to 
recall their names?
    Mr. Collins. On the----?
    Mr. DeFazio. When they overruled everybody and said----
    Mr. Collins. On the rudder control issue?
    Mr. DeFazio. Yeah, yeah.
    Mr. Collins. Yeah. One of the managers is Victor Wicklund. 
He was the transport standard staff manager.
    Mr. DeFazio. Mm-hmm. OK. All right, because we are looking 
to pursue more interviews with FAA, and----
    Mr. Collins. Right----
    Mr. DeFazio [continuing]. I think we would want to discuss 
this with them, because----
    Mr. Collins. Yeah, and the other one was the transport 
airplane directorate manager which was Jeff Duven.
    Mr. DeFazio. All right. Yeah, because I mean, the rationale 
I saw was that the NG engine was slightly smaller than previous 
versions, and therefore, and had not had an uncontained 
failure, so therefore, even though the MAX engine was much 
larger, they thought it would be very dependable and never have 
an uncontained failure, which is like, ``It's a new engine. How 
do you know that?''
    Mr. Collins. I agree. I mean, as a propulsion engineer, I 
didn't see validity in that argument.
    Mr. DeFazio. You didn't?
    Mr. Collins. On a higher energy rudder.
    Mr. DeFazio. Yeah.
    Mr. Collins. And you have to, on the airplane side, assume 
you get the uncontained failure, and then protect against it. 
When the engine is being approved, their job is to show that it 
is not going to eject parts, but on the airplane side on the 
installation, you have to assume it is going to have those 
failures, and then protect the airplane from the failure.
    Mr. DeFazio. Yeah. Thank you. So, you would say that during 
your lengthy tenure with FAA, and you just mentioned it in 
response to Representative Brownley, that you saw a change 
after you began. It was unusual to see nonconcurs before we 
went through the fuel tank issue.
    Mr. Collins. Correct. Yes.
    Mr. DeFazio. Yeah.
    Mr. Collins. This just kind of creeped in after that.
    Mr. DeFazio. Interesting, and you never saw, in your 30 
years, one where this many people nonconcurred and got 
overruled?
    Mr. Collins. No, and then, we had the additional part of 
the new voluntary safety reporting process. They brought in his 
specialists that weren't working on the project and reviewed it 
and came to the same conclusion as those that didn't agree with 
the issue paper. And then, that was overruled. So, it was 
disappointing for it to go through that process and not see any 
change.
    Mr. DeFazio. What do you think is--I mean, we have some 
will say, ``Well, it would be impossible without ODA,'' and I 
agree. If you are going into minor aspects of the planes. My 
concern is anything that would take a plane down, FAA should be 
directly and fully informed of, and directly involved in, but I 
mean, what do you think about the current process, and how 
might we change it?
    Mr. Collins. Well, and I agree. When I first started, I was 
taught that the Federal Aviation Regulations defined the 
minimum level of safety for the airplane, and this is where the 
means of compliance and lessons learned from accidents should 
be incorporated in showing compliance with that.
    Mr. DeFazio. Mm-hmm.
    Mr. Collins. And there are a lot of exceptions under 21-101 
where new rules aren't incorporated in amended type of design, 
and then exemptions also where too often to me, it seemed the 
interest of the applicant was, again, over the interest of the 
traveling public.
    Mr. DeFazio. Mm-hmm.
    Mr. Collins. One example in my testimony is about an 
exemption that was granted for fuel quantity indicating wires, 
ignition prevention in the fuel tank where a 4-year time 
limited exemption was granted on the 737 NGs and, well, 5 years 
is all it takes for a new type design approval.
    At the end of the 4 years, no change had been made, and 
then a permanent exemption was granted instead of making the 
manufacturer fix it.
    Mr. DeFazio. OK.
    Captain Cox, you have a lot of years in the air and I think 
you flew earlier versions of the '37. In one of the hearings, I 
showed an image of a flight deck from 100, and then an image of 
a flight deck from the MAX, and it just really didn't look like 
the same plane. I mean do you think we should consider how many 
times you can amend a certificate versus actually going through 
certification?
    Mr. Cox. It is an incremental step process so that pilots--
and I flew the 200 and 300 and there was quite a bit of 
difference between those two, to the point that we finally 
split the fleet where only 200 pilots would fly the 73-200 
and----
    Mr. DeFazio. Really?
    Mr. Cox [continuing]. So we in essence treated it like a 
separate airplane. And some airlines have been willing to do 
that and others, for economic reasons have elected not to. 
There is a lot of difference between a MAX and the first-
generation 737. I think it would be unreasonable to ask a pilot 
to fly a 100 or 200 on Monday, Wednesday, Friday and on 
Tuesday, Thursday go fly a MAX.
    Mr. DeFazio. Right.
    Mr. Cox. But as the incremental steps that we are taking, I 
can understand how the FAA approved it, but I think the 737 is 
a bit unique because I don't think we have another airplane in 
the fleet that has as many derivative type certificates or that 
has been in service as long, and I don't think there will be 
another version of the 737. I think the MAX is the last one.
    Mr. DeFazio. Right.
    Mr. Cox. So, I think the problem is, to some degree, going 
to cure itself.
    Mr. DeFazio. Yeah, and I don't know if anybody could answer 
this, but they are trying to amend the type certificate for the 
777 with folding wings and say that this doesn't require 
recertification. I am not aware of any commercial transport 
aircraft that have folding wings. It seems like a pretty 
radical departure.
    Mr. Cox. It is, but as an example, the Airbus, and I flew 
the 319, 20, and 21, there were subtle differences between the 
three airplanes but for the most part, they flew virtually 
identically.
    Mr. DeFazio. Mm-hmm.
    Mr. Cox. The 737, 300, and 400 were very close.
    Mr. DeFazio. Mm-hmm.
    Mr. Cox. 737, 700, and 800 are very close.
    Mr. DeFazio. Mm-hmm.
    Mr. Cox. So, there are cases where the differences are 
minor, but there are some that the differences are significant.
    Mr. DeFazio. OK. I guess at that point, I don't think I 
have further questions. Well, maybe staff has a further 
question, which is this? OK. Where? Which one? Where am I? OK.
    OK. Captain Cox, as a former pilot and safety consultant, 
how important is it for a pilot to be knowledge and trained on 
new flight control systems, particularly something that is 
novel or unique, such as MCAS?
    Mr. Cox. I think the training is critical in the fact that 
the assumption was made that the pilots would instantly 
recognize inappropriate stabilizer trend movement.
    Mr. DeFazio. Mm-hmm.
    Mr. Cox. With 737, starting with the 300 series, that trim 
system moves because of a system known as the speed trim 
system. So, you would have to recognize that movement in and of 
itself, uncommanded movement by the pilots in and of itself 
would not necessarily be a trim runaway, and when you have 
multiple failures that are going on, the recognition of an MCAS 
activation would be much more difficult. Hence, that needs to 
be trained as a possibility that if you see a stick shaker that 
comes on with multiple failures, recognize at the moment the 
flaps are retracted, you may get a significant nose-down input.
    That was not done, and that training, I think that lack of 
or the failure of that training to be widely disseminated is a 
contributor here.
    Mr. DeFazio. OK. Thank you.
    And Dr. Endsley, again, human factors. MCAS, at least in 
the first flight, first accident, not in the manual. I mean, do 
you think in terms of a human factors approach that pilots 
should have been made aware if something is running in the 
background that can radically alter the behavior of the 
airplane?
    Ms. Endsley. Absolutely.
    Mr. DeFazio. Yeah.
    Ms. Endsley. It is very hard to understand and diagnose 
what the plane is doing when it is a system you have never even 
heard of. They didn't have any information about why it was 
acting erratically, and as Captain Cox just pointed out, they 
didn't even have good cues that would match up to running the 
procedure that Boeing assumed they would be able to run very 
rapidly.
    Mr. DeFazio. Mm-hmm.
    Ms. Endsley. So, it was really this whole combination of 
factors of no information on the flight manual, no training, 
and no adequate displays that were just the worst possible 
combination.
    Mr. DeFazio. Thank you. So then, and we have kept you a 
long time. This will be the last question, and I would ask 
anybody or everybody who wants to respond. What do you think is 
the biggest concern this committee should focus on regarding 
the FAA's capability of overseeing Boeing production and novel 
systems, given everything you have heard here today? I will 
start with Captain Cox.
    Mr. Cox. I think, based on the things that I have heard 
today and what I have learned over the months of watching this, 
I would encourage the committee: Don't get too focused. The 
JATR report was very good in taking a holistic view.
    There is not a single cause to this accident, and you have 
a rare opportunity if the committee will view it in its 
entirety of the complexity, you can help really significantly 
promote aviation safety going forward, and I think that that 
was reinforced today here. There is an awful lot of focus on 
the FAA. There is an awful lot of focus on Boeing, and they are 
two of the major contributors to these tragedies, but they are 
not the only ones.
    And so, I would encourage in the strongest possible term, 
sir, keep the focus broad.
    Mr. DeFazio. Right. Well, and I would agree, and in terms 
of the AOA, we did have a company that hadn't repaired the AOA 
that was on--was that on Lion Air, I think, that they had even 
lost their license.
    Mr. Cox. Yes, sir, and if I might, the installation of the 
angle-of-attack sensor----
    Mr. DeFazio. Mm-hmm----
    Mr. Cox [continuing]. On the Lion Air airplane. There is a 
calibration procedure that has to be followed, and the 
maintenance department signed off that they did it. It is not 
possible that they did.
    Mr. DeFazio. Right, because it immediately was----
    Mr. Cox. Because that is very specifically what the 
procedure is for----
    Mr. DeFazio. Mm-hmm----
    Mr. Cox [continuing]. Is to determine the accuracy of the 
sensor output.
    Mr. DeFazio. Mm-hmm.
    Mr. Cox. So, this is, to come full circle----
    Mr. DeFazio. Yeah----
    Mr. Cox [continuing]. This is the reason I say, ``There is 
a lot of contributing factors.''
    Mr. DeFazio. Right. I get that.
    Dr. Endsley, do you----?
    Ms. Endsley. Yes. There has been considerable discussion 
here today and also previously in the press about concerns 
about safety culture at both Boeing and the FAA that sort of 
underlie a lot of the failures we saw in good process and ended 
up being in good design.
    The FAA Administrator and Boeing have made a number of 
announcements of things they are going to do to try to fix 
that, and we are glad to see that, but changing culture is 
really hard. You can't just give a one-shot and it is done. It 
is something you have to do every day.
    It has a lot more to do with actions than with words, and 
so, the importance of really following up on those actions of 
taking safety issues very seriously, of reprioritizing safety 
with regard to production and cost in schedule, those changes 
are going to require a lot of continued interaction by 
management, and it is going to require bringing in a lot of 
people who are knowledgeable about these things to get those 
changes moved through the organization, and the NTSB has been 
talking about the importance of safety culture for the last 20 
years. It is something we really need to emphasize as well as 
solving some of these basic process problems.
    Mr. DeFazio. And I agree with you on that 100 percent. At 
my first meeting with Mr. Dickson when he was nominated, I 
talked to him on what I view as the principalities within FAA 
who seem resistant to Administrators and changes from that 
level, and he assured me that he was going to be reaching down 
in the organization and trying to change the culture.
    So, Mr. Collins.
    Mr. Collins. I agree with everything she said about 
changing the safety culture, and what Administrator Dickson 
talked about was all hands meetings and things. I think he 
needs to get down in the working level more, talk to groups of 
people. I was a union rep. The union reps usually feel a little 
more free and a little more protected in discussing issues than 
most employees but, you know, talk to them in the offices. The 
Seattle office for sure.
    We always hear the conversation about resources and sure, 
you could use more aerospace engineers and maybe manage the 
resources better, but the lesson that I would like to leave is 
that when you have those resources and they identify safety 
issues, that really concerns me. The ones that are missed, you 
can do improvements and better oversight, but when managers are 
made aware of safety issues and compliance issues, I wish there 
would be a culture shift so that they would give more 
credibility and more thought to compliance versus production 
schedules and things.
    Mr. DeFazio. OK. Thank you.
    And finally, Mr. Pierson.
    Mr. Pierson. Congressman, I think just to try to keep it 
simple. First, an investigation. A detailed investigation of 
the production facility I think is definitely in order, and a 
very important thing is to maintain a presence in the factory. 
I should have mentioned earlier that I was there for 3 years 
and honestly, I had never saw, I never met an FAA employee in 
my 3 years in----
    Mr. DeFazio. Really?
    Mr. Pierson. Yes, and I never actually remember any of my 
employees saying they talked to an FAA employee. Now, they may 
have been there, but they certainly weren't visible and 
present. My son said, ``Shouldn't they be wearing a jacket or 
something?'' Or maybe they should know that this is FAA people 
so if we are not getting the problem resolved by our normal 
chain, we need the regulators to do that.
    And the last thing I would say is that you could have the 
most amazing design by the most brilliant engineers and flown 
by the most talented pilots, but if you have a tired mechanic 
or electrician that is overworked or a technician that is 
stressed because they haven't had a chance to take care of 
their family because they have been working so many hours, it 
could all be for naught.
    So, don't lose sight of the fact that, again, we have to do 
the whole thing. Some from the design all the way out to 
ongoing production into the future.
    Mr. DeFazio. Thanks, and yeah. Just on reflecting on your 
comment about not seeing an FAA employee on the floor, I mean, 
a number of years ago, I raised concerns when, as we moved more 
to an agency which, and this was more in terms of maintenance 
than production, but where they were spending much less time at 
maintenance facilities and more time reviewing paperwork they 
received from maintenance facilities, and I think it is vital 
for them to actually have a presence and they may not 
personally observe something while they are there, but it may 
be some employee who would want to come up to them and say, 
``Hey, I have got some concerns here. You are from the FAA. I 
want you to hear this.''
    Mr. Pierson. Absolutely.
    Mr. DeFazio. Yeah. OK. Well, thank you all. Thanks for your 
generous allowance of time. I appreciate your testimony, and we 
are going to continue with this investigation. I want to, 
again, give my condolences to the families, and thank you for 
your constructive--and I have to do some stuff, so just hang on 
for a second. My script.
    OK. I assume this has got the right days here. We remain 
open until such a time as our witnesses have provided answers 
to any questions that may be submitted to them in writing.
    So ordered.
    I ask unanimous consent that the record remain open for 15 
days for any additional comments, and information submitted by 
Members or witnesses to be included in the record of today's 
hearing.
    Without objection, so ordered.
    And again, I thank you, and I have nothing else to add, so 
the committee stands adjourned.
    [Whereupon, at 3:35 p.m., the committee was adjourned.]


 
                       Submissions for the Record

                              ----------                              


 Prepared Statement of Hon. Eddie Bernice Johnson, a Representative in 
                    Congress from the State of Texas
    I thank the Chairman and Ranking Member for having this hearing 
today, as it allows us to examine issues related to the design, 
development, and certification of the 737 MAX. I am eager to hear from 
our panel of witnesses and receive testimony from Federal Aviation 
Administration (FAA) officials; a member of the Technical Advisory 
Board, which is an independent review panel established by the FAA to 
issue recommendations related to the certification of the 737 MAX; 
whistleblowers; and aviation safety experts.
    My interests are specific as to how we as a legislative body can 
adequately address the promotion of aviation safety; potential avenues 
of reform in the agency certification processes; and simply, how we can 
prevent these accidents in the future.
    As to safety, the Boeing 737 MAX was marketed as a safe, modern 
airplane; however, after two major failures and hundreds of people 
losing their lives, we now know that the 737 MAX is not a safe plane 
and consequently has been grounded. The safety systems and backup 
systems on the Boeing 737 MAX failed to work properly and resulted in 
356 deaths, including 8 Americans.
    As to the agency certification process, we must ensure that the 
planes that are certified to fly go through the most comprehensive 
certification process modernly available, so that we may avoid these 
tragic failures in flight. As I have noted before, we are experiencing 
a serious crisis of trust in aviation safety. The importance of an 
appropriate certification process for large aircraft in the United 
States is now more pertinent than ever. If the safety certification 
process merits reexamination and reform, we must advocate for 
transparency. This will avert not only the reduction of the United 
States' position of authority on aviation safety, but also the 
endangerment of hundreds of lives in preventable accidents. It is clear 
that the certification of this aircraft failed to detect technical 
problems from which even experienced pilots could not recover.
    My district in Texas is a major hub for aviation, and with the 
significance of this industry and the jobs that the airline industry 
provides, I am dedicated to addressing the imminent and long-term 
concerns regarding the grounding and ensuing safety concerns of the 737 
MAX aircraft. This is of significant concern to me, as both American 
Airlines and Southwest Airlines are prominent entities at the Dallas 
Fort Worth International Airport and the Dallas Love Field Airport and 
had previously employed a significant number of this aircraft model. 
Therefore, the operational implications of the grounding and safety 
certification of the Boeing 737 MAX are literally a matter of life and 
death. My heart truly goes out to the families who have lost loved ones 
in these tragedies.
    Again, I look forward to the testimony of the witnesses and the 
answers to my questions. With this hearing, I join the efforts of my 
colleagues in Congress to meaningfully and comprehensively address 
these urgent concerns as we work to regain the trust of the American 
people in the airline industry.

                                 
  Prepared Statement of Hon. Frederica S. Wilson, a Representative in 
                   Congress from the State of Florida
    Thank you, Chairman DeFazio.
    Thank you to our witnesses for being here.
    I want to begin by extending my deepest condolences to the families 
and communities that lost loved ones in the Lion Air and Ethiopian 
Airlines crashes.
    News reports and investigations have uncovered systematic failures 
that must be addressed at every level and I am committed to 
understanding each failure that led to the loss of 346 lives.
    I am also committed to honoring the victims by using the full power 
of this committee to ensure the flying public's safety.
    Based on the testimony set before me, I am concerned that actions 
and decisions were taken that ultimately abused legislation passed 
through this committee.
    The FAA has routinely lauded its safety record with zero fatalities 
over the last decade.
    These accidents must serve as a wake-up call to remind us that none 
of us can rest on our laurels.
    In light of the information that has surfaced in the last few 
weeks, the decisions that we come to through this hearing must extend 
beyond fixing the MCAS system or a few lines of code to address the 
negligence that led us here.
    We must address the Organization Designation Authorization program 
and the cozy relationship between Boeing and the FAA.
    Our citizens deserve that.
    The families who lost loved ones deserve that, too.
    With that I will begin my questions.

                                 
                Lists A and B, Submitted by Hon. DeFazio
Lists A and B:
      9/11/2015 EASA letter to FAA
      3/21/1997 Issue Paper
      2/11/2015 FAA Letter to Boeing
      FAA-DeFazio--28834-28842 TAD Corrective Action Review 
Board (CARB) Presentation Form
      FAA-DeFazio--28843-28860 Safety Review Board information
      FAA-DeFazio--32891-32938 Presentation: BCA Airplane 
Programs, Organization Designation Authorization Technical Review Board
                      9/11/2015 easa letter to faa

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                         3/21/1997 issue paper

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                     2/11/2015 faa letter to boeing

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

  faa-defazio--28834-28842 tad corrective action review board (carb) 
                           presentation form

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        faa-defazio--28843-28860 safety review board information

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

     faa-defazio--32891-32938 presentation: bca airplane programs, 
     organization designation authorization technical review board

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


                                Appendix

                              ----------                              


   Questions from Hon. Peter A. DeFazio for Hon. Stephen M. Dickson, 
             Administrator, Federal Aviation Administration

    Question 1. According to a recent news report, in an email sent by 
an official at Transport Canada to the FAA, the European Union Aviation 
Safety Agency (EASA), and Brazil's civil aviation authority, the 
official stated that ``[t]he only way I see moving forward at this 
point'' with the 737 MAX was that MCAS ``has to go.'' \1\ Do you agree 
with this view? Do you believe the 737 MAX can be certified by the FAA 
if MCAS is removed altogether?
---------------------------------------------------------------------------
    \1\ Allison Lampert & David Shepardson, ``Canadian official's email 
says 737 MAX software must go reflects `working-level' view--
regulator,'' Reuters (Nov. 22, 2019), available at: https://
fr.reuters.com/article/industrialsSector/idUKL2N2821HI
---------------------------------------------------------------------------
    Answer. The FAA's first priority is safety. The agency will not 
approve the aircraft for return to service until it has completed 
rigorous testing and we are satisfied that it is safe.
    The FAA understands that Transport Canada Civil Aviation put out a 
statement clarifying that the statement quoted in this question did not 
necessarily represent the views of their agency.
    The FAA has a transparent and collaborative relationship with other 
civil aviation authorities as we all review and collaborate on the 
changes to software on the Boeing 737 MAX. The FAA and its 
international partners have engaged in robust discussions at various 
stages in this process as part of the thorough scrutiny of Boeing's 
work. We value and support constructive debate and candor in the 
exchange of information and perspective between our technical experts. 
The excerpted email is an example of those exchanges.
    Stability augmentation systems are not new in aviation or aircraft 
design. MCAS is one part of the flight control system design. As 
specified by Boeing, MCAS is intended to help pilots in narrow regimes 
of the flight envelope and to meet part 25 airworthiness requirements.
    The changes that are being made to MCAS software will prevent the 
system from making uncommanded pitch corrections based on errant inputs 
and causing the same type of problem that occurred during the two 
accident flights.
    The FAA does not make design-level decisions for manufacturers. We 
certify submitted designs based on their conformity to FARs and safety 
evaluations. As stated above, the Agency will not approve the aircraft 
for return to service until the design changes have been rigorously 
tested and we are satisfied the aircraft is safe.

    Question 2. An FAA Flight Standardization Board (FSB) develops 
pilot training criteria and requirements for pilots for a particular 
aircraft. At our May 15, 2019, Aviation Subcommittee hearing on the 737 
MAX, then-Acting Administrator Elwell testified that the FAA had 
recently solicited public comment on a draft report prepared by the FSB 
for the Boeing 737 MAX. Deputy Administrator Elwell stated that ``[t]he 
FAA will review this input before making a final assessment.'' Where is 
the FAA in the FSB process? Can the FAA make an assessment at this time 
regarding the pilot training that will be required after ungrounding 
the 737 MAX?
    Answer. The FAA will carry out the FSB function after the 
completion of the Joint Operations Evaluation Board (JOEB). The JOEB is 
a multi-authority body, the outcomes of which will be documented in the 
FSB report. The FSB report was initially posted for public comment last 
April. The JOEB work will commence once critical certification 
milestones have been completed. Once the JOEB completes its evaluation 
of Boeing's proposed training requirements, the JOEB conclusions will 
be included in an updated FSB report. That report will be posted for 
public comment.

    Question 3. According to the Joint Authorities Technical Review 
(JATR), the FAA ``extensively delegated compliance findings . . . to 
[the] Boeing [Organization Designation Authority] ODA. Safety critical 
areas, including system safety documents related to MCAS, were 
initially retained by the FAA and then delegated to the Boeing ODA.'' 
\2\
---------------------------------------------------------------------------
    \2\ Joint Authorities Technical Review, October 11, 2019, p. 26, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. In your opinion, did the FAA over-delegate review of certain 
safety-critical functions, like MCAS, to Boeing?
    Answer. A large, transport category aircraft such as the MAX 
consists of many thousands of parts and systems, all of which must be 
certified to meet FAA standards. The transport category aircraft 
certification process comprises four functions: 1) certification basis, 
2) planning and standards, 3) analysis and testing, and 4) final 
decision and certification of design.
    The certification work FAA typically delegates primarily relates to 
a single portion of the process-the third function outlined above-
analysis and testing. About 94% of work in this area, for all aircraft, 
is delegated, and much of that work involves lower risk and routine 
items such as interior reconfigurations for seats, lavatories, galleys, 
etc. FAA also delegates analysis and testing of aircraft systems and 
airframe components when the applicant is using established and proven 
compliance methods and the organization or designee is authorized and 
has demonstrated the ability to perform the work to FAA's satisfaction.
    The FAA determines the certification basis, identifies the 
standards, and makes all key and final decisions. The FAA is directly 
involved in the testing of new and novel features and technologies. The 
FAA does not delegate the other portions of the certification process.
    For the software update efforts of the 737 MAX, FAA has retained 
all findings. No part of the review has been delegated to Boeing.
    The FAA is reviewing how we structure our approach to delegation, 
while complying with the requirements mandated by Congress in the FAA 
Reauthorization Act of 2018. In addition, the FAA is in the process of 
reevaluating our delegation decisions for other current certification 
projects.

    b. The JATR goes on to state that it is their belief that ``FAA 
involvement in the certification of MCAS would likely have resulted in 
design changes that would have improved safety.'' \3\ Do you agree with 
that assessment?
---------------------------------------------------------------------------
    \3\ Joint Authorities Technical Review, October 11, 2019, p. 27, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    Answer. MCAS is not a stand-alone system, it is an element of the 
Speed Trim System. The Speed Trim System has been part of the flight 
control system on all prior 737 models. Thus, there was no 
certification of MCAS, but rather the flight control system.
    The FAA is focused is on improving the certification system and 
considering the findings of the JATR and other independent reviews. As 
noted above, for software update efforts, the FAA has retained the 
approvals process for the flight control systems and is not delegating 
anything to Boeing. As part of the initial return to service effort, 
the FAA will retain authority to issue airworthiness certificates and 
export certificates of airworthiness for the grounded fleet and 737 MAX 
airplanes manufactured since the grounding. When the 737 MAX is 
returned to service, it will be because the safety issues have been 
addressed and pilots have received all of the training they need to 
safely operate the aircraft.

    c. What steps is the FAA currently taking, if any, to review and 
make changes administratively to the current ODA program?
    Answer. The Organization Designation Authorization (ODA) has long 
been a key part of the FAA's use of delegation. As the role ODA has 
played in FAA's safety programs has increased and the technical and 
compliance assurance capabilities of ODA holders have matured, it has 
become clear that FAA's approach to oversight must also evolve. ODA 
holders provide an effective compliment to FAA oversight and 
certification responsibilities during the certification process for a 
new or amended type certificate. Using ODAs during the certification 
process allows the FAA to focus on critical or new and novel 
technologies during the certification process.
    In the FAA Reauthorization Act of 2018, Congress mandated that FAA 
establish an ODA Office within AVS. The intent of this mandate is to 
achieve standardization and consistency of oversight functions of the 
ODA program across AVS and facilitate risk based, system-level 
oversight for:
      Standardized application of policy;
      Proficiency of ODA Office and field staff in executing 
oversight processes;
      Monitoring of risk and performance issues; and
      Continuous improvement of AVS ODA program performance.
    To this end, in March 2019, then Acting Administrator Dan Elwell 
approved the establishment of the AVS ODA Office in the Aircraft 
Certification Service's (AIR) System Oversight Division (AIR-800). We 
continue to operationalize the office with temporary staff. The 
Department of Transportation requested $7 million in the President's 
FY21 budget in order to permanently and effectively staff and resource 
this office.
    Additionally, the FAA recently completed the charter for the ODA 
expert panel as required in the FAA Reauthorization Act of 2018. We 
have also completed the initial steps for the Panel to conduct an ODA 
Survey under the requirements of the Paperwork Reduction Act. Once the 
Panel has drafted the survey and conducted their review, the report 
will be developed and submitted to Congress as well as numerous FAA 
offices and advisory committees for consideration.
    One area of focus is to improve the information flow and 
coordination between the operational and certification functions during 
the certification process. Thus, we are placing greater emphasis on 
operational involvement within the certification process and, more 
importantly, how design and operational assumptions are documented and 
communicated as part of type design. This is occurring for all 
certification projects currently under review by the agency.
    The Aircraft Certification Service (AIR) and Flight Standards (AFX) 
are working cohesively and collaboratively to address structural 
organizational changes. Examples include appointing a single program 
manager for all certification projects; this program manager will have 
program oversight over both AIR and AFX. Our agency will also focus on 
strategic and tactical program management efforts, to include fostering 
better communication between all stakeholders. These efforts are among 
the most important process improvements we are implementing to our 
certification processes. They are of significant focus and are ongoing.
    The FAA has much work to do to evaluate the many recommendations we 
have received to date from the various investigations, including 
recommendations related to the ODA program. Additional recommendations 
are expected from reviews still underway. The FAA is committed to 
reviewing all recommendations and improving its ODA program.

    Question 4. On November 7, 2018, just days after the Lion Air 
crash, the FAA issued an Emergency Airworthiness Directive (AD) to 
provide critical information to pilots. This followed Boeing's issuance 
of a Flight Crew Operations Manual Bulletin the day before--which 
provided similar, critical information to pilots. Neither of these 
documents mentioned ``MCAS'' by name and apparently this omission was 
deliberate. According to the New York Times, at the last minute, an FAA 
manager told agency engineers to remove the only mention of MCAS in 
FAA's Emergency AD.\4\
---------------------------------------------------------------------------
    \4\ Natalie Kitroeff, David Gelles and Jack Nicas, ``The Roots of 
Boeing's 737 Max Crisis: A Regulator Relaxes Its Oversight,'' NEW YORK 
TIMES (July 27, 2019), accessed at: https://www.nytimes.com/2019/07/27/
business/boeing-737-max-faa.html?searchResultPosition=2
---------------------------------------------------------------------------
    a. Is this news reporting accurate?
    b. If so, please explain why the FAA removed reference to MCAS from 
this Emergency AD?
    c. If not, please explain why the FAA chose not to mention MCAS in 
the Emergency AD in the first place?
    Boeing has told our Committee that it worked very closely with the 
FAA on the contents of both the Bulletin and FAA's Emergency AD.
    d. Did Boeing ever ask, or in any way recommend or request, that 
the FAA NOT mention MCAS in the Emergency AD?
    Answer (a.-d.). Airworthiness Directives (AD) are used to address 
unsafe conditions in aircraft and mandate fleet-wide corrective 
actions. An AD must address any unsafe conditions and avoid introducing 
new safety hazards. In this case, the FAA decided that an AD was 
necessary to address a runaway stabilizer event. Although in the time 
since, it has become clear that MCAS functionality was involved in two 
accidents, at the time of the Emergency AD decision, we were still in 
the early stages of an accident investigation. Furthermore, the FAA's 
opinion at the time was that introducing a new system name that did not 
exist in the aircraft documentation available to pilots had the 
potential to cause confusion in an emergency situation. MCAS is not a 
stand-alone system, but rather a name given to a section of code in the 
flight control computer, which is, in turn, part of the flight control 
system. The FAA therefore decided to remove the MCAS reference from the 
draft AD so that flight crews would focus on runaway stabilizer 
recognition instead of attempting to troubleshoot MCAS. In an emergency 
situation, it was more important for a crew to recognize and respond to 
a runaway stabilizer event than it was to troubleshoot MCAS.

    We know from a Boeing ``Coordination Sheet'' released at our MAX 
hearing in October 2019 that Boeing had long known that if a pilot 
failed to respond to unintended MCAS activation within 10 seconds, the 
result could be catastrophic. Boeing apparently knew this at least by 
March 2016, and re-affirmed it in June 2018, more than one year after 
the 737 MAX had been certified by the FAA and just four months before 
the Lion Air accident.
    e. When the FAA issued its Emergency AD, was the FAA aware that 
Boeing had determined that a failure to respond to unanticipated MCAS 
activation within 10 seconds could be catastrophic? If not, when did 
the FAA first become aware that if a pilot responded in 10 seconds or 
more to unanticipated MCAS activation it could be catastrophic?
    Answer. At the time of original 737MAX certification, the FAA knew 
an MCAS failure could present itself as a runaway trim stab event, 
which is a well-known procedure in which pilots are trained. The FAA's 
analysis of the accidents and recommendations of several independent 
panels indicate that assumptions concerning MCAS used during 
certification need to be re-evaluated and adjusted to better reflect 
present-day cockpit conditions and pilot response expectations.

    f. Do you believe it would have been helpful for 737 MAX pilots to 
know that if they failed to respond to unanticipated MCAS activation 
within 10 seconds the result could be catastrophic? If not, please 
explain why you believe that to be the case.
    Answer. Pilots operating aircraft must be fully prepared and 
appropriately trained for known failure scenarios that may be 
encountered in service as documented in engineering hazard analysis and 
required by regulation.

    g. In hindsight, do you believe Boeing provided adequate 
information to the FAA regarding MCAS when the FAA was preparing the 
Emergency AD?
    Answer. After the Lion Air accident, the FAA knew there was a 
faulty AOA sensor which sent incorrect information to the aircraft 
flight control computer which then erroneously attempted to correct a 
nonexistent high angle of attack situation by trimming the aircraft 
nose down via the MCAS system. From the cockpit, the situation 
presented as a runaway stabilizer. The emergency AD was drafted to 
alert flight crews how to react when the aircraft attempted to trim 
nose down.
    At the time of the emergency AD, the FAA was aware of MCAS. Boeing 
provided answers to questions related to the Lion Air accident and MCAS 
in general. We believed we had all the necessary information to issue 
an Emergency AD meant to immediately bring attention to a potentially 
unsafe condition and provide for interim corrective actions while the 
agency continued to investigate the accident.
    The FAA requires manufacturers to provide any and all pertinent 
information to our safety specialists whenever a serious aircraft 
safety event or accident occurs.

    Question 5. In the Flight Crew Operations Manual Bulletin that 
Boeing issued following the Lion Air crash, Boeing describes how 
erroneous angle of attack (AOA) can potentially cause many indications 
and effects in the cockpit, including: continuous or intermittent stick 
shaker; increasing nose down control forces; and as many as four 
different alerts or lights (IAS DISAGREE, ALT DISAGREE, AOA DISAGREE, 
and FEEL DIFF PRESS light).
    a. It is my understanding that every newly type certificated 
aircraft since 1982 includes an ``engine-indicating and crew-alerting 
system'' (EICAS)--a system that can show pilots a list of messages, 
rather than lights indicating failure of a system, in order to help 
pilots prioritize responding to multiple simultaneous indications that 
may lead to pilot confusion. Why was this system not included in the 
737 MAX during its original certification?
    Answer. EICAS is not required to meet FAA regulations. 14 CFR Sec.  
25.1322, Flightcrew Alerting, describes what alerts must be included on 
a transport category airplane. It is a performance-based rule, meaning 
that the airplane must meet the required performance as stated in the 
rule and no specific means of meeting the requirements are stated. The 
decision to use EICAS as a way to show compliance with the requirements 
of Sec.  25.1322 is a design choice made by the manufacturer.

    b. Is the FAA evaluating whether an EICAS or similar system should 
be included in a re-certified 737 MAX before it is ungrounded?
    Answer. The FAA is taking the external review recommendations into 
consideration in our evaluation of the changes to the 737 MAX. We will 
be conducting further reviews in this area for potential changes to our 
processes going forward.

    Question 6. Please provide a detailed account of all communication 
between Boeing and FAA's Associate Administrator for Aviation Safety 
between the Lion Air crash on October 29, 2018, and the Ethiopian 
Airlines crash on March 10, 2019, including:
    a. the date, time, and mode (telephone, email, letter, in person 
meeting, etc.) of each communication;
    b. the job title of the individual(s) at Boeing with whom the 
Associate Administrator communicated;
    c. the subject of each communication;
    d. copies of all communications to the extent they were in writing; 
and
    e. a summary of all communications that were not in writing.
    Answer (a.-e.). The Associate Administrator for Aviation Safety 
communicates regularly with Boeing representatives on a variety of 
aviation safety topics via different modes of communication, including 
during the time period referenced.
    The Associate Administrator for Aviation Safety provided more 
detailed information about his communications with Boeing during his 
transcribed interview with Committee staff on December 5, 2019.

    Question 7. Did FAA's Associate Administrator for Aviation Safety 
have any discussions with Boeing about the potential grounding of the 
737 MAX prior to the Ethiopian Airlines crash? If so, please:
    a. provide the date, time, and mode (telephone, email, letter, in 
person meeting, etc.) of each such discussion;
    b. identify the job title of the individual(s) at FAA who conducted 
such discussions with Boeing;
    c. provide copies of any such discussions to the extent they were 
in writing;
    d. provide a summary of all such discussions to the extent they 
that were not in writing;
    e. indicate, for each discussion, whether the economic and/or 
financial impact that grounding the 737 MAX would have had on Boeing 
was discussed.
    Answer (a.-e.). The Associate Administrator previously provided 
information about his communications with Boeing during a transcribed 
interview your staff conducted on December 5, 2019.

    Question 8. In December 2018, after the Lion Air crash, the FAA 
produced a Quantitative Risk Assessment Random Transport Airplane Risk 
Analysis (R-TARA), based on the Transport Airplane Risk Assessment 
Methodology (TARAM), that calculated the estimated risk of another 
catastrophic 737 MAX accident during the lifetime of the fleet without 
a technical fix to the MCAS software. Please provide a list of all 
staff within the FAA's Aviation Safety (AVS) branch and the Office of 
the Administrator (AOA) who received, prior to the Ethiopian Air crash 
on March 10, 2019, a copy of this R-TARA analysis, or any memoranda, 
summaries, e-mails, or presentations about this analysis, and the date 
upon which each individual received it.
    Answer. The FAA senior staff who prepared the TARAM were 
interviewed by Committee Staff. They answered staff questions related 
to the TARAM.
    A TARAM is a scientific risk-assessment tool. It weighs a number of 
factors and is used to help the FAA quantify risk. It is not the FAA's 
sole decision-making tool; rather, its purpose is to assist the 
Corrective Action Review Board (CARB)--comprised of experts in their 
field--in making decisions about how to reduce or eliminate risk. The 
FAA would never accept a risk of additional accidents without taking 
immediate action, and in fact, the agency acted immediately--with 
interim and permanent steps--to respond to the Lion Air accident. The 
FAA issued an emergency AD reminding pilots how to deal with runaway 
speed trim eight days after the Lion Air accident and before the TARAM 
analysis was complete. When the AD was issued, the FAA determined the 
permanent action was to require a design change to address MCAS. That 
effort also was underway before the TARAM was prepared in December 
2018.
    The TARAM analysis of the 737 MAX MCAS safety issue was presented 
to the Seattle ACO Corrective Action Review Board (CARB) on November 
28, 2018, December 12, 2018, and February 6, 2019. After reviewing the 
available information, the Seattle ACO recommended an Emergency 
Airworthiness Directive, AD 2018-23-51. The Seattle ACO then followed 
FAA's standard coordination process prior to formalizing the decision.

    Question 9. Following up on Mr. Earl Lawrence's response to Rep. 
Sean Patrick Maloney, please provide a list of all workers at Boeing's 
Renton, Washington, facility by title, who have been interviewed by the 
FAA regarding production, quality, safety, or related matters 
concerning the 737 MAX since the Lion Air crash on October 29, 2018, as 
well as the dates of such interviews.
    Answer. Since the Lion Air accident on October 29, 2018, the FAA 
has increased its oversight activities and conducted more than 115 
investigations at the Boeing production facility in Renton, Washington. 
A majority of these investigations were conducted as part of the FAA's 
certificate management activities that focused on Boeing products and 
processes. While conducting these certificate management-related 
investigations, the FAA questioned numerous Boeing employees, but as 
these interactions are not considered formal interviews, the titles of 
those questioned are not recorded.
    In addition to the certificate management-related investigations, 
the FAA conducted nine Aviation Safety Hotline/Whistleblower 
investigations related to the Model 737 MAX following the Lion Air 
accident. In support of those nine Aviation Safety Hotline/
Whistleblower investigations, the FAA interviewed the following Boeing 
employees, by title:

------------------------------------------------------------------------
                                               Date of Interview (A) =
           Boeing Employee Title                    Approximately
------------------------------------------------------------------------
Assembly Inspector.........................  4/10/2019
------------------------------------------------------------------------
Engineer...................................  4/10/2019
------------------------------------------------------------------------
Assembly Inspector.........................  4/15/2019 (A)
------------------------------------------------------------------------
Quality Manager............................  4/15/2019 (A)
------------------------------------------------------------------------
Test Area Manager..........................  4/15/2019 (A)
------------------------------------------------------------------------
Quality Manager............................  4/15/2019 (A)
------------------------------------------------------------------------
Aviation Technician........................  4/18/2019 (A)
------------------------------------------------------------------------
Aviation Maintenance Technician Inspector    4/18/2019 (A)
 Lead.
------------------------------------------------------------------------
Preflight Manager..........................  4/18/2019 (A)
------------------------------------------------------------------------
Materials Processor........................  5/3/2019
------------------------------------------------------------------------
Lead Technician............................  5/13/2019
------------------------------------------------------------------------
Software Test Engineer (Contractor)........  5/15/2019
------------------------------------------------------------------------
Kitting Team Lead..........................  5/16/2019
------------------------------------------------------------------------
Local Receiving Area Manager...............  5/16/2019
------------------------------------------------------------------------
Local Receiving Area Team Lead.............  5/16/2019
------------------------------------------------------------------------
Warehouse Team Lead........................  5/16/2019
------------------------------------------------------------------------
Operations Delivery Manager................  5/23/2019
------------------------------------------------------------------------
Preflight Quality Manager..................  5/23/2019
------------------------------------------------------------------------
Preflight Quality Manager..................  5/23/2019
------------------------------------------------------------------------
Quality Manager............................  5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Liaison Engineer...  5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Liaison Engineer...  5/23/2019
------------------------------------------------------------------------
Seattle Delivery Center Quality Manager....  5/23/2019
------------------------------------------------------------------------
Mechanic...................................  5/29/2019 (A)
------------------------------------------------------------------------
Mechanic...................................  5/29/2019 (A)
------------------------------------------------------------------------
Mechanic...................................  5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector..........................  5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector..........................  5/29/2019 (A)
------------------------------------------------------------------------
Quality Inspector..........................  5/29/2019 (A)
------------------------------------------------------------------------
Flight Management System Software Engineer.  6/5/2019 (A)
------------------------------------------------------------------------
Structural Engineer........................  9/3/2019
------------------------------------------------------------------------
Propulsion Structures Engineer.............  9/19/2019
------------------------------------------------------------------------


    In addition to the Boeing employees listed above, during the course 
of these Aviation Safety Hotline/Whistleblower investigations, the FAA 
interviewed two additional complainants that had worked at Boeing, but 
the FAA was not provided with their titles. One complainant was 
interviewed on April 10, 2019, and the other on April 16, 2019.
    During the December 11, 2019, Congressional hearing the FAA 
Administrator committed to conduct additional interviews with Boeing 
employees in the Renton, Washington, production facility related to 
matters concerning manufacturing of the Boeing Model 737 MAX airplane. 
The FAA conducted interviews of the following Boeing employees on 
January 28 and 29, 2020:
      3 manufacturing technicians
      2 manufacturing engineers
      3 quality technicians
      2 Boeing ODA unit members
      1 ODA manager
      2 manufacturing managers
    Lastly, it should be noted that the FAA has an office co-located at 
the Renton, Washington facility and aviation safety inspectors are on 
the production floor daily conducting safety oversight.

Amended Type Certificates

    Question 10. The 737 MAX is a vastly different airplane than the 
original 737, yet the MAX did not require a new type certificate. The 
737 fuselage is based on the 707-fuselage introduced in 1958. And the 
original 737 itself was type-certified in 1967. The trim wheel in the 
737 MAX--an important part of the story of these crashes--also dates to 
the 1967 version. The MAX is also significantly different from the 
737NG. It has new fly by wire spoilers, new winglets, new engines and 
revisions to the Flight Deck. Boeing has designed 14 variations of the 
737 aircraft since the original was certified in 1967.
    I have serious concerns that the amended type certificate is a 
strategic tactic to shortcut the FAA certification process--allowing 
the manufacturer to shave-off time during the review of its new 
aircraft by relying on data, tests, or assumptions used for the 
previous model made years (or even decades) earlier. In the case of the 
737 MAX it was based on the design of an aircraft certified by the FAA 
half-a-century earlier.
    At what point should all substantial design and technological 
changes make the FAA regard an aircraft as a new plane, requiring a new 
type certificate?
    Answer. Amended type certificates are not intended to shortcut the 
certification process. Rather, they allow manufacturers to build on 
successful and safe prior designs while incorporating new or novel 
design changes. Amended type certificates allow the FAA to focus our 
certification resources on the proposed changes between models. The 
certification of the MAX took five years which is typical for new and 
amended type certificates.
    Additionally, whether a manufacturer applies for an amended TC or a 
new TC, the project receives a current certification basis. A 
certification basis is the formal determination of the standards in FAA 
regulations that will apply to the project.
    The determination to classify the Model 737-8 airplane as an 
amended type certificate is consistent with current guidance, as well 
as determinations made on previous certification programs.
    Boeing applied for an amended TC for the Model 737-8 airplane in 
January 2012. The FAA established the certification basis for the Model 
737-8 airplane in February 2014. The FAA classified the Model 737-8 
airplane as an amended TC based on a review of the airplane design 
changes in accordance with 14 CFR Sec.  21.19. Accordingly, the FAA 
concluded that the design changes for the Model 737-8 airplane did not 
require a new TC.

    Question 11. Boeing applied for amended type certificates for the 
777X, which will include two variants: the 777-9 (a derivative model of 
the 777-300ER) and 777-8 (a derivative model of the 777-9). Most 
notably, these planes will be constructed with new carbon-fiber-
reinforced plastic wings with folding wingtips.
    The FAA determined that the folding wingtips are ``novel or unusual 
design features'' and the agency issued ``special conditions'' 
containing ``additional safety standards'' for Boeing to meet to prove 
these wingtips are safe to operate.\5\ Boeing determined that a 
catastrophic event could occur if the wingtips are not properly 
positioned and secured for takeoff or during flight.
---------------------------------------------------------------------------
    \5\ FAA, Final Special Conditions, 83 Fed. Reg. 23209 (May 18, 
2018).
---------------------------------------------------------------------------
    However, in addition to these new wingtips--not contemplated before 
on commercial aircraft--the 777X will have a stretched fuselage, new 
engines, modified landing gear, and a new fuel system compared to its 
predecessor 777 model. And yet, the FAA has permitted Boeing to proceed 
with an amended type certificate, rather than requiring Boeing receive 
a completely new type certificate, which would involve a more 
extensive, top-to-bottom review of the design.
    a. What is the FAA's estimate of the overall portion of commonality 
between the 777-9 and the 777-300ER?
    Answer. We do not evaluate an applicant's proposal in terms of 
degree or percentage of commonality. Rather, we initially focus on the 
changes to the aircraft proposed by the applicant, and we work to 
ensure those areas meet the current requirements as described in 
response to question 10. We are still evaluating the system in its 
entirety to ensure that the aircraft meet FAA requirements and is safe 
to operate in accordance with our regulations.

    b. How can tests or data from the prior model be used to certify 
the 777X given that the new wings, engines, materials, and other 
features may affect the handling and performance of the aircraft?
    Answer. Prior to installation, there is a series of engineering 
evaluations and research and development testing that new components 
undergo, to include a wide range of inspection and testing prior to 
installation.
    According to FAA Order 8110.4, Type Certification, certification 
tests are used by the FAA to verify the flight test data reported by 
the applicant or to obtain compliance data for flight testing conducted 
concurrently with the applicant. Certification tests may include 
flight, ground, functional, and reliability testing, along with 
engineering testing.
    The FAA uses the certification tests to evaluate the aircraft's 
performance, flight characteristics, operational qualities, and 
equipment operation. The tests also determine operational limitations, 
procedures, and pilot information.
    FAA Order 8110.4, Type Certification, provides an allowance for use 
of prior aircraft data in new designs, provided that strict conditions 
are met by the applicant. Use of prior data is helpful to understand 
what aspects of the new design need further review, regardless of any 
credit given for prior data in a new design. In the case of the 777x 
and the substantial changes to the wing design, we anticipate that 
Boeing will be developing extensive new data and will be required to 
conduct a robust amount of flight testing.

    Presumably there will be new checklists for pilots to ensure the 
wingtips are properly configured before takeoff, and potentially 
caution lights, warning lights, or other functions associated with 
wingtip configuration or misconfigurations, requiring pilots to take 
specific actions in response. As you know, the FAA only required Level 
B (non-simulator) pilot training for the 737 MAX, despite a completely 
new software system (MCAS) on the plane.
    c. Does the FAA expect there to be simulator training required for 
pilots transitioning from the 777-300ER to the 777X?
    Answer. The FAA is currently engaged with Boeing to determine the 
level of training required for pilots transitioning from the B777 300ER 
to the 777X. The final determination of minimum training is ongoing, in 
accordance with the FSB process in AC 120-53, which will conclude with 
FAA's final determination of the minimum level of training after a 
draft FSB report is published for public comment.
Joint Authorities Technical Review

    Question 12. The JATR found that FAA's Boeing Aviation Safety 
Oversight Office (BASOO) is severely outnumbered by Boeing's ODA 
office--45 to 1,500 people respectively,\6\ and many BASOO employees 
are junior engineers.
---------------------------------------------------------------------------
    \6\ Joint Authorities Technical Review, October 11, 2019, p. 27, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Do you believe that the FAA can adequately oversee the Boeing 
ODA with this employee ratio?
    Answer. The approximately 45 BASOO employees oversee the Boeing 
ODA, not the 1500 individual Boeing employees. The FAA oversees the 
Boeing system as outlined in Boeing's FAA-approved procedures manual. 
Boeing, as the ODA holder, oversees, trains, and manages its 1500 ODA 
unit members. The purpose of organizational delegation is to transfer 
the burden on individual oversight from the FAA to the ODA holder. This 
is why the criteria for ODA appointment are stringent.
    Additionally, in order to sustain the workforce needed by the FAA, 
we are recruiting engineers and training them for specialized functions 
within the agency. The workforce in the BASOO has completed training 
specific to their positions and is led by multiple senior engineers 
that oversee and advise the entire workforce. All FAA engineers and 
inspectors also have access to FAA resources like our Chief Scientific 
and Technical Advisors who are renowned in their respective fields of 
specialization.

    b. In the wake of the 737 MAX crashes is the FAA taking any action 
to review the technical skills, expertise, and capacity of the BASOO to 
adequately perform certification and oversight duties of Boeing? If so, 
please explain what actions the FAA has already taken, is currently 
taking, or plans to take.
    Answer. We are reviewing the structure of the BASOO to ensure 
appropriate oversight of the Boeing ODA and to identify opportunities 
to strengthen cross organizational coordination on our oversight 
efforts. We have also increased involvement in key areas such as system 
safety, AEG evaluation of installed systems and equipment evaluations 
and software development processes.

    Question 13. As you know, the FAA oversight of the certification 
process for the B737 MAX was performed by the FAA's BASOO. Based on the 
JATR team's observations and findings, JATR recommended that the FAA 
conduct a workforce review of the BASOO engineer staffing level to 
ensure there is a sufficient number of experienced specialists to 
adequately perform certification and oversight duties, commensurate 
with the extent of work being performed by Boeing.\7\
---------------------------------------------------------------------------
    \7\ Joint Authorities Technical Review, October 11, 2019, p. VIII, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Has the FAA conducted this review? If yes, please provide a copy 
of this review to the Committee.
    b. If not, does the FAA plan to accept this recommendation and 
conduct a review?
    Answer. The aerospace industry is a competitive workspace as 
employers like the FAA and Boeing compete for talented employees with 
the requisite training, skills and experience. The FAA is conducting a 
workforce review of the engineering staffing levels at the BASOO. The 
FAA regularly conducts recurrent reviews of positions throughout all of 
the offices, to include the BASOO. Staffing and hiring plan reviews are 
held on a recurring schedule and include review of a number of 
positions for each office to ensure adequate workload and staff 
distribution, analysis of specific job analysis tools which outline 
specific job duties, and validation of appropriate pay levels for the 
specific positions. This effort will allow the FAA to recruit and 
retain the most qualified personnel with the right skillsets to 
evaluate complex automation technologies. The focus of our hiring in 
the future will include various dynamic and safety-critical positions 
(e.g. system safety engineers and human factors systems engineers). 
Skillsets like these are becoming more important, as the integration of 
aircraft systems and the interaction of aircraft with the National 
Airspace System (NAS) continues to increase. Personnel with these 
skillsets will further enable our ability to be a data driven 
organization.

    Question 14. The JATR found that while issues in human-machine 
interaction are at the core of all recent aviation accidents and are 
implicated in the two B737 MAX accidents, the FAA has very few human 
factors and human system integration experts on its certification 
staff. As a result, the JATR recommended the FAA expand its aircraft 
certification resources in human factors and human system 
integration.\8\
---------------------------------------------------------------------------
    \8\ Joint Authorities Technical Review, October 11, 2019, p. IX, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Does the FAA plan to adopt this recommendation?
    i. If yes, has the FAA determined how many new human factors 
experts it requires? Please detail the number and types of human 
factors experts the FAA plans to hire and when.
    ii. If no, please explain why not.
    Answer. The FAA is planning to expand its aircraft certification 
resources in human factors and human system integration. We are still 
in the process of determining the number and types of experts that the 
FAA plans to hire, as well as a timeline to hire new personnel.
    The President's FY21 Budget request $7.5 million to help boost the 
FAA's human factors research on flight deck, maintenance, and system 
integration and requests $5 million towards recruiting individuals with 
specialized skillsets.

    Question 15. The JATR report states that MCAS ``used the stabilizer 
trim to change the column force feel, not trim the aircraft . . . and 
that this is a case of using the control surface in a new way that the 
regulations never accounted for.'' \9\
---------------------------------------------------------------------------
    \9\ Joint Authorities Technical Review, October 11, 2019, p. 14, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    Boeing maintains that it complied with all FAA regulations, and the 
aircraft, including MCAS, was compliant with the FAA's regulations and 
the company followed the appropriate FAA certification process. This 
signals to me that the certification process is broken or at least 
severely flawed if a manufacturer can develop an unsafe airplane that 
still meets all of the FAA's regulatory criteria. Do you agree that the 
FAA certification process is flawed?
    Answer. The FAA certification process is well established and has 
contributed to consistently improving the safety record of transport 
category aircraft over the past 50 years. The FAA acknowledges that our 
processes, policies, guidance, and regulations do need to be updated 
periodically, and we are committed to continually improving the 
aircraft certification process along with our other processes. We are 
reviewing the recommendations presented by the JATR and other 
independent reviews in an effort to increase safety.

    Question 16. The JATR found that Boeing submitted to the FAA's 
Aircraft Evaluation Group (AEG) a list of features of the B-737-8 MAX 
cockpit which were changed from the base model B737-800. After the FAA 
initially raised concerns that the cumulative effects of system changes 
from the B-737 NG to the B737 MAX could require additional pilot 
training, Boeing responded by pointing out that current FAA rules 
(Advisory Circular 120-53B) did not require the cumulative effects on 
system changes to be considered, a response the FAA later accepted.\10\
---------------------------------------------------------------------------
    \10\ Joint Authorities Technical Review, October 11, 2019, p. 43, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Please explain why the FAA ignored these initial concerns and 
ultimately acquiesced to Boeing?
    Answer. The FAA did not ignore any initial concerns. The FAA 
carefully reviewed all design changes submitted by Boeing. The FAA 
followed established advisory guidance, as described in AC 120-53, 
during the FSB process. The FAA AEG continued to analyze all 
information supplied by the applicant (Boeing) throughout the FSB 
process as required by AC 120-53 until the final JOEB evaluation--which 
validated that the proposed training was adequate.

    b. Does the FAA plan to revise Advisory Circular 120-53B and FAA 
Order 8900.1, per JATR's recommendations, to include an assessment of 
the cumulative effects of changed products, such as differences in 
aircraft systems, displays, flight characteristics, and procedures?
    Answer. The FAA intends to comprehensively review and revise AC 
120-53B and associated FAA Order 8900.1 guidance to improve the process 
for conducting and using FSB evaluations. To build upon the JATR 
findings, the FAA tasked the Air Carrier Training Aviation Rulemaking 
Committee (ACT ARC) to recommend changes to the process outlined in AC 
120-53B to ensure that the current guidance is clear and to recommend 
changes where needed. The ACT ARC's work is in progress.

    Question 17. The JATR report identified that the design process for 
the B737 MAX's flight control system ``was not sufficient to identify 
all the potential MCAS hazards.'' \11\
---------------------------------------------------------------------------
    \11\ Joint Authorities Technical Review, October 11, 2019, p. 30, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. How did the FAA's current certification process--widely touted 
as the safest and most trusted in the world--fail to identify the full 
range of potential MCAS hazards for the B737 MAX?
    b. What steps is the FAA taking to ensure that the design process 
for future flight control systems adequately identifies all potential 
hazards?
    Answer (a.-b.). We are evaluating the assumptions Boeing used in 
the original integrated Systems Safety Assessment (iSSA). The purpose 
of the safety assessment process is to identify potential safety issues 
early in the aircraft design through hazard classification and 
probability of occurrence. The underlying assumptions used during the 
system safety assessment process were well established. However, the 
recommendations from the JATR report and other independent reviews 
suggest that the full range of pilot reactions across all global 
operators should be re-assessed. As a result, we intend to assess our 
policy with other authorities for both evaluating and validating the 
underlying assumptions used in the safety assessment process.

    Question 18. The JATR found that the fragmented submission of 
certification documents by Boeing could lead to FAA's BASOO, which is 
responsible for overseeing the Boeing ODA process and certification of 
Boeing products, having trouble successfully transferring critical 
information regarding MCAS to the Seattle Aircraft Certification Office 
(SACO), which is responsible for overseeing continued operational 
safety management of Boeing products once they are certificated.\12\
---------------------------------------------------------------------------
    \12\ Joint Authorities Technical Review, October 11, 2019, pp. 50-
51, available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    The JATR also noted that test pilots working in the certification 
process may not always have complete knowledge of operational issues, 
while pilots working in the operational evaluation process may not have 
complete knowledge of certification issues. This gap may contribute to 
limited communication between the two processes, creating the potential 
for a lack of operational insight into the certification process.\13\
---------------------------------------------------------------------------
    \13\ Joint Authorities Technical Review, October 11, 2019, p. XI, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    What steps, if any, is the FAA taking to evaluate and improve 
internal FAA communications problems regarding the FAA's certification 
processes that have been observed and documented by independent 
reviews?
    Answer. We are placing greater emphasis on operational involvement 
within the certification process and, more importantly, how design and 
operational assumptions are documented and communicated as part of type 
design. This is occurring for all certification projects currently 
under review by the agency.
    The Aircraft Certification Service (AIR) and Flight Standards (AFX) 
are working cohesively and collaboratively to address structural 
organizational changes. Examples include appointing a single program 
manager for all certification projects; this program manager will have 
program oversight over both AIR and AFX. Our agency will also focus on 
strategic and tactical program management efforts, to include fostering 
better communication between all stakeholders. These efforts are among 
the most important process improvements we are implementing to our 
certification processes. They are of significant focus and are ongoing.

    Question 19. The JATR recommended that the FAA's Changed Product 
Rules (e.g., 14 CFR Sec. Sec.  21.19 & 21.101) and associated guidance 
(e.g., Advisory Circular 21.101-1B and FAA Orders 8110.4C) should be 
revised to require a top-down approach whereby every change to an 
aircraft is evaluated from an integrated whole aircraft system 
perspective.\14\
---------------------------------------------------------------------------
    \14\ Joint Authorities Technical Review, October 11, 2019, p. IV, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Does the FAA believe that its certification of the B737 MAX 
lacked this integrated whole aircraft system evaluation?
    b. Does the FAA plan to adopt these recommendations or take other 
steps to require a more holistic approach to evaluating changes to 
aircraft?
    Answer (a.-b.). Multiple investigations and reviews of the Boeing 
737 MAX, have been conducted, some of which are still underway. We will 
consider all reports and recommendations--including those that come 
from the open investigations and reviews--in formulating possible 
updates to our regulations, policy, and guidance. The FAA is always 
looking for ways to improve our processes. The Changed Product Rule is 
a top-down approach that we have harmonized with EASA, Transport Canada 
and ANAC (the Brazilian authority). Changes and suggested improvements 
to this process, along with updated policy and guidance, will need to 
be worked with our international partners to ensure common 
understanding and common application.

    Question 20. According to the JATR, the B737-8 MAX accident 
scenarios were not properly identified during the testing and 
certification process.\15\
---------------------------------------------------------------------------
    \15\ Joint Authorities Technical Review, October 11, 2019, p. 41, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Why weren't these scenarios properly identified?
    b. Does the FAA plan to change the certification process to ensure 
the agency is identifying the full range of accident scenarios? If so, 
what kind of changes does the agency intend to make?
    Answer (a.-b.). The FAA certification process is well established 
and has contributed to consistently improving the safety record of 
transport category aircraft over the last 50 years and longer. Still, 
we acknowledge the need to continually improve our certification 
process along with our other processes.
    Uncommanded stabilizer movement was identified as a potential 
failure scenario during the testing and certification. Possible crew 
response times to failures and emergency situations were based on 
industry-wide assumptions, but failed to take into account the full 
range of pilot experience across the global operating fleet. The FAA is 
in the process of reevaluating assumptions related to crew response for 
current certification projects and is reviewing our guidance for 
changes that will consider the level of aircrew training and 
proficiency globally.

    Question 21. The JATR recommended the FAA should review training 
programs to ensure flight crews are competent in the handling of mis-
trim events.\16\
---------------------------------------------------------------------------
    \16\ Joint Authorities Technical Review, October 11, 2019, p. XII, 
available at: https://www.faa.gov/news/media/attachments/
Final_JATR_Submittal_to_FAA_Oct_2019.pdf
---------------------------------------------------------------------------
    a. Does the FAA plan to conduct this review? If so, does the FAA 
have a timetable on conducting this review?
    Answer. The FAA plans to evaluate pilot performance during runaway 
stabilizer events, and pilot competency using manual trim during normal 
and abnormal conditions. For the 737 MAX, this evaluation will occur 
during the Joint Operational Evaluation Board (JOEB) evaluation this 
year. The FAA will analyze the results of the evaluation and training 
recommendations will be documented in the 737 FSB report that will be 
published for public comment before being finalized. The FAA will then 
approve U.S. carrier training programs to ensure the minimum level of 
training is met prior to any return to service.

    b. How does the FAA plan to ensure all 737 MAX flight crews are 
fully competent in handling potential mis-trim events?
    Answer. The FAA is currently evaluating a proposal submitted by 
Boeing. Once the FAA validates that this training is appropriate, the 
training requirements will be documented in the 737 MAX FSB report 
recommendations that are published for public comment prior to being 
finalized. Any U.S. operator's training programs will then be reviewed 
and approved by the FAA. The FAA will oversee the training programs to 
ensure they are delivered in a manner that is acceptable.

National Transportation Safety Board

    Question 22. The National Transportation Safety Board (NTSB) has 
issued several recommendations to the FAA responding to the crash of 
Lion Air flight 610.\17\ Implementation of these recommendations will 
save lives.
---------------------------------------------------------------------------
    \17\ National Transportation Safety Board Safety Recommendation 
Report, ``Assumptions Used in the Safety Assessment Process and the 
Effects of Multiple Alerts and Indications on Pilot Performance,'' 
(Sept. 19, 2019), pp. 12-13, accessed at: https://www.ntsb.gov/
investigations/AccidentReports/Reports/ASR1901.pdf
---------------------------------------------------------------------------
    a. The NTSB recommended that the FAA require Boeing to ensure its 
assumptions regarding pilot responses to uncommanded flight control 
inputs fully account for the effects of a cacophony of flight deck 
cautions, warnings, and other indications on pilot recognition and 
response. Has the FAA informed Boeing that this will now be required, 
and if so what is the timeline for Boeing's compliance? If not, why 
not?
    b. The NTSB recommended that the FAA develop robust tools and 
methods to validate assumptions about pilot recognition and response to 
significant failures. Has the FAA taken steps to address this 
recommendation and if so what steps has the agency taken?
    c. The NTSB recommended that the FAA develop design standards for 
aircraft diagnostic systems that improve how quickly and effectively 
pilots respond to failures. Does the FAA intend to develop these 
standards and what steps has the agency taken to do so?
    Answer (a.-c.). The FAA is continuing to review and address this 
NTSB recommendation along with all recommendations received. We are 
fully committed to ensuring that the lessons learned from the 737 MAX 
accidents are incorporated into the software updates and included in 
all future certification projects as appropriate.
    The FAA has included this review as part of our testing for the 737 
MAX software updates by conducting an evaluation of its Installed 
Systems and Equipment for Use by the Flight Crew (14 CFR Sec.  25.1302) 
and Minimum Flight Crew evaluation (14 CFR Sec.  25.1523). These 
evaluations are focused on minimizing the occurrence of design related 
errors, enabling the crew to detect and manage errors if they do occur, 
and crew requirements for safe operation considering crew workload and 
controls.
    Currently, there is no timeline for Boeing's compliance. We are 
considering recommendations from all independent reviews in addition to 
the NTSB recommendations received. The 737 MAX will not be returned to 
service until it is in compliance.
    The FAA is continuing to review and address this NTSB 
recommendation along with all recommendations received. We are fully 
committed to ensuring that the lessons learned from the 737 MAX 
accidents are incorporated into the software updates of the 737 MAX and 
included in all future certification projects as appropriate. We are 
committed to the evolution of FAA regulations, programs, and 
initiatives so they are in sync with emerging technologies, while 
addressing associated human factors and global impact. We are also 
increasing program coordination with Flight Standards, including its 
Aircraft Evaluation Group, to ensure that operation and training issues 
are fully addressed.
    As always, the FAA intends to work closely with stakeholders and 
industry standards groups (including SAE, AIA, and GAMA) for their 
collective input to update existing, and develop new, aviation 
standards.

 Questions from Hon. Frederica S. Wilson for Hon. Stephen M. Dickson, 
             Administrator, Federal Aviation Administration

Pilot Training

    Question 1. Administrator Dickson, ensuring that our nation's 
transportation workforce is highly trained has been a priority for me 
both as a member of this committee and as chair of the Subcommittee on 
Health, Employment, Labor, and Pension of the Committee on Education 
and Labor.
    It was very disturbing to read numerous reports on Boeing decisions 
such as designing MCAS to rely on input from a single angle-of-attack 
sensor, removing MCAS references from the flight crew operation 
manuals, and downplaying the system to regulators. These decisions and 
other efforts to minimize training requirements for the 737 Max left 
pilots in the dark and jeopardized the flying public's safety.
    Given what we have learned from the two crashes, the NTSB finding 
that the pilots ``lacked the tools to identify the most effective 
response'' to the crises they faced, and the catastrophic implications 
of an MCAS failure, do you now support additional training for 737 Max 
pilots?
    Answer. The FAA Aircraft Evaluation Group (AEG) is responsible for 
determining the minimum level of training necessary to safely operate 
an aircraft and oversee implementation of pilot training. The FAA plans 
to evaluate pilot performance during runaway stabilizer events, and 
pilot competency using manual trim during normal and abnormal 
conditions. This evaluation will occur during the Joint Operational 
Evaluation Board (JOEB) which includes the FAA, EASA and TCCA. The FAA 
will then analyze the results of the evaluation and training 
recommendations will be documented in the 737 Flight Standardization 
Board (FSB) report which will be published for public comment before 
being finalized. The FAA will then approve U.S. carrier training 
programs to ensure the minimum level of training is met prior to any 
return to service.
    The FAA is also currently evaluating a proposal submitted by 
Boeing, which will include both Computer Based Training (CBT) and 
simulator training. Once the FAA validates that this training is 
appropriate, the training requirements will be documented in the 737 
MAX FSB report recommendations that are published for public comment 
prior to being finalized. Any U.S. operator's training programs will 
then be reviewed and approved by the FAA. The FAA will oversee the 
training programs to ensure they are delivered in a manner that is 
acceptable.

    Question 2. Administrator Dickson, the final report on the Lion Air 
flight 610 found that Boeing did not simulate, as part of its 
functional hazard assessment validation tests, an erroneously high 
angle-of-attack input leading to uncommanded MCAS activation.
    When renowned airline Captain, Chelsey ``Sully'' Sullenberger, the 
Hudson River Hero, testified before this committee about the status of 
the 737 Max, he made the following assertion regarding pilot training, 
``We should all want pilots to experience these challenging situations 
for the first time in a simulator and not in flight with passengers and 
crew on board . . . reading about it on an iPad is not even close to 
sufficient. They need to develop a muscle memory of their experiences 
so that it will be immediately accessible to them in the future, even 
years from now, when they face such a crisis.''
    Knowing what you know now, do you agree with Captain Sully that 737 
Max pilots should be provided Level-D simulator training?
    Answer. Pilots operating aircraft must be fully prepared and 
appropriately trained for all known failure scenarios that may be 
encountered in service, as documented in engineering hazard analysis 
and required by regulation. For the MCAS software updates of the MAX, 
the FAA is currently evaluating updated training proposals to determine 
appropriate training requirements.

    Question 3. Administrator Dickson, the NTSB recommended that the 
FAA develop standards for improved aircraft system diagnostic tools 
that help pilots better identify and respond to failures.
    Will you provide this committee with your absolute assurance that 
any future Boeing airplane will include such a system?
    Answer. The FAA has received recommendations from several 
investigative teams, including the Secretary's Special Committee, the 
Joint Authorities Technical Review (JATR), and the KNKT accident 
report. We are reviewing all of these recommendations, along with those 
from the NTSB, to ensure that process changes, where needed, are made, 
lessons learned are institutionalized, training programs are reviewed, 
and adequate guidance is available to manufacturers and operators. The 
FAA is also reviewing assumptions related to present-day cockpit 
conditions and pilot response expectations.

    Question 4. Administrator Dickson, the NTSB recommended that the 
FAA reexamine its assumption that pilots will always recognize a non-
normal condition in 1 second and respond within 3 seconds.
    Do you support that recommendation?
    Answer. The FAA is addressing this NTSB recommendation, to include 
examining the human factors aspects of current type certificated 
aircraft, as well as addressing future human factor challenges to help 
mitigate associated risks and promote improved situational awareness 
and safety.
    Assumptions regarding design and aircraft-pilot interaction are 
currently being reviewed and addressed for the 737 MAX and other 
certification projects. As an example, during review and testing of 
Boeing's proposed software design changes last year, it was determined 
a broader review of how MCAS functions within the Speed Trim System was 
warranted considering past assumptions. This led to more extensive 
design changes.
    Advancements in aircraft automation have contributed to an 
unprecedented level of safety in our domestic aviation system, but 
technology advancements necessitate continuous review. By further 
considering human factors and the interface between aircraft pilots and 
systems during certification, we will be moving toward a holistic 
approach to aircraft certification.

    Question 5. Administrator Dickson, Boeing and the FAA assumed that 
the pilots would recognize a non-normal condition within one second and 
respond to that non-normal condition within three seconds. But the 
National Transportation Safety Board concluded that Boeing's 
assumptions in its assessment ``of uncommanded MCAS (em-cass) function 
for the 737 MAX did not adequately consider and account for the impact 
that multiple flight deck alerts and indications could have on pilots' 
responses to the hazard.''
    Do you accept that finding?
    Answer. We have taken the comments into consideration, as we are 
evaluating the changes to the 737 MAX for return to service. We intend 
to conduct further reviews in this area for potential changes to our 
processes going forward.
    As mentioned, assumptions regarding design and aircraft-pilot 
interaction are currently being reviewed and addressed for the 737 MAX 
and other certification projects. As an example, during review and 
testing of Boeing's proposed software design changes last year, it was 
determined a broader review of how MCAS functions within the Speed Trim 
System was warranted considering past assumptions. This led to more 
extensive design changes.
    Advancements in aircraft automation have contributed to an 
unprecedented level of safety in our domestic aviation system, but 
technology advancements necessitate continuous review. By further 
considering human factors and the interface between aircraft pilots and 
systems during certification, we will be moving toward a holistic 
approach to aircraft certification.

    What are you doing to ensure FAA adequately considers pilot 
response times in designing future airplanes?
    Answer. Pilot recognition and response times are one part of the 
safe design of the system. Another important part is the quality and 
timeliness of the aircraft information that is provided to the flight 
crews. The FAA is working to ensure flight crews receive aircraft 
information in a manner which is useful and to which a flightcrew can 
quickly respond. At times, a flightcrew's response will be a memory 
item and at other times the flightcrew's response will require 
additional diagnosis and reaction before countermeasures can be 
started.
    The FAA has received several recommendations on pilot response 
times and how system safety assessments are conducted. We are reviewing 
all of the recommendations to identify where process changes are needed 
and ensure that we have adequate guidance for our employees and for 
designers/manufacturers. Design assumptions related to pilot reaction 
times must be substantiated and take the cockpit environment into 
consideration. Empirical data collected during our Joint Operational 
Evaluation Board (JOEB) process for aircraft certification projects 
will also be considered in our review.

NTSB Recommendations

    Question 6. Mr. Dickson, the NTSB recommended that the FAA require 
Boeing to incorporate design enhancements, pilot procedures, and/or 
training requirements, where needed, to minimize the potential that 
pilots would respond to multiple cautions and warnings in a manner 
different from the manner that Boeing has assumed.
    When do you plan to implement this recommendation?
    Answer. The FAA is taking these recommendations into consideration 
for the redesign of the MAX. The FAA has completed multiple reviews of 
system safety assessments (SSA) for the Boeing 737 MAX and is in the 
process of certifying the design changes to address causal factors 
associated with the Lion Air and Ethiopian Airlines accidents, as well 
as additional changes to improve functionality.
    The evaluation of the final design change will include a workload 
assessment, using revised pilot procedures, to minimize the potential 
for manufacturer assumptions to be inconsistent with pilot actions. The 
FAA will further assess these pilot procedures as part of an 
operational evaluation, to ensure that appropriate procedures and 
training requirements are included in the project approval. These 
activities will occur prior to the return to service.

     Questions from Hon. Andre Carson for Hon. Stephen M. Dickson, 
             Administrator, Federal Aviation Administration

    Question 1. Administrator Dickson, please let me know who at FAA 
met with Boeing to discuss the information underlying the TARAM 
(Transport Airplane Risk Assessment Methodology) report.
    a. Where did any such briefing, discussion or presentation on the 
TARAM take place?
    b. Who received this information?
    Answer (a.-b.). A TARAM is a scientific risk-assessment tool. It 
weighs a number of factors and is used to help the FAA quantify risk. 
It is not the FAA's sole decision-making tool; rather, its purpose is 
to assist the Corrective Action Review Board (CARB)--comprised of 
experts in their field--in making decisions about how to reduce or 
eliminate risk. The FAA would never accept a risk of additional 
accidents without taking immediate action, and in fact, the agency 
acted immediately--with interim and permanent steps--to respond to the 
Lion Air accident. The FAA issued an emergency AD reminding pilots how 
to deal with runaway speed trim eight days after the Lion Air accident 
and before the TARAM analysis was complete. When the AD was issued, the 
FAA determined the permanent action was to require a design change to 
address MCAS. That effort was also underway before the TARAM was 
prepared in December 2018.
    The TARAM analysis of the 737 MAX MCAS safety issue was presented 
to the Seattle ACO Corrective Action Review Board (CARB) on November 
28, 2018, December 12, 2018, and February 6, 2019. Boeing's Airplane 
Safety Engineering Focal attended each of the CARB meetings as an 
observer. The meetings were held at the FAA Regional Office in Des 
Moines, Washington. On February 13, 2019, the Seattle ACO Office 
Manager met with the Boeing 737 MAX Chief Project Engineer to discuss 
and sign the TARAM-derived risk-based corrective action schedule.

    c. Who made the decision to act on the Airworthiness Directive?
    Answer. After reviewing the available information, the Seattle ACO 
recommended an Emergency Airworthiness Directive, AD 2018-23-51. The 
Seattle ACO then followed FAA's standard coordination process prior to 
formalizing the decision.

    d. Who had the authority to ground the MAX based on the TARAM last 
December?
    Answer. The decision to ground the 737MAX was not based solely on 
the December 2018 TARAM.
    The Administrator of the Federal Aviation Administration carries 
out statutory duties and powers related to aviation safety, including 
the authority to ground aircraft.

    e. Did Mr. Ali Bahrami have the TARAM information in December 2018? 
If not Mr. Bahrami, who did?
    Answer. The Associate Administrator previously answered this 
question during a transcribed interview your staff conducted on 
December 5, 2019.
    The FAA followed the recommendation of the technical experts in 
Seattle following the Lion Air accident and issued an emergency AD 
within days of the accident. When additional data and information 
became available after the Ethiopian Airlines accident, the Associate 
Administrator for Aviation Safety recommended grounding the 737 MAX 
fleet.

 Questions from Hon. Brian K. Fitzpatrick for Hon. Stephen M. Dickson, 
             Administrator, Federal Aviation Administration

    Question 1. Administrator Dickson, my top aviation priority has 
been safety--I know that you and the FAA share that priority, but so 
far, the FAA has shown little intention of implementing the secondary 
barriers provision that was included in the FAA Reauthorization Act of 
2018.
    Currently, the Aviation Rule Making Council (ARAC) has dragged 
their feet. Can you speak to a realistic timeline of when this critical 
safety barrier will be implemented on new aircraft?
    Answer. The FAA takes cockpit security seriously and is committed 
to meeting the intent of section 336 of the FAA Reauthorization Act of 
2018 regarding secondary cockpit barriers. On June 20, 2019, the FAA 
tasked our Aviation Rulemaking Advisory Committee (ARAC) to provide 
information and recommendations on this topic. The ARAC formed a Flight 
Deck Secondary Barrier Working Group to address the tasking. We expect 
the Flight Deck Secondary Barrier Working Group to provide the ARAC 
with a report in early 2020 and expect the ARAC to consider that report 
at their March 2020 meeting. The ARAC's recommendations will help the 
FAA develop an approach that provides manufacturers with necessary 
technical information to enable implementation, as well as other 
information on costs and benefits required by the rulemaking process.
    Under the Administrative Procedure Act (APA), the FAA must engage 
in a rulemaking proceeding to issue an order requiring installation of 
a secondary cockpit barrier on each new aircraft that is manufactured 
for delivery to a passenger air carrier in the United States operating 
under the provisions of part 121 of title 14, Code of Federal 
Regulations.

    Questions from Hon. Paul Mitchell for Hon. Stephen M. Dickson, 
             Administrator, Federal Aviation Administration

    Question 2. The various investigations of the Boeing 737 MAX 
accidents--including those by Congress, the FAA, Boeing, and the 
press--have shown many assumptions were made during the design and 
certification of the 737 MAX. With hindsight, it is clear some of those 
assumptions were faulty. It also appears that not every potential input 
and variable was entered into these assumptions.
    a. What can and will the FAA do to reassess the assumptions it uses 
during aircraft certification?
    b. What new internal processes--either via new procedures or 
staffing changes--can and will the FAA pursue to ensure robust testing 
of and counterpoints to assumptions it utilizes?
    Answer (a.-b.). Assumptions regarding design and aircraft-pilot 
interaction are currently being reviewed and addressed for the 737 MAX 
and other certification projects. As an example, during review and 
testing of Boeing's proposed software design changes last year, it was 
determined a broader review of how MCAS functions within the Speed Trim 
System was warranted considering past assumptions. This led to more 
extensive design changes.
    Advancements in aircraft automation have contributed to an 
unprecedented level of safety in our domestic aviation system, but 
technology advancements necessitate continuous review. By further 
considering human factors and the interface between aircraft pilots and 
systems during certification, we will be moving toward a holistic 
approach to aircraft certification.
    Additionally, the FAA is reviewing how we structure our approach to 
delegation. In the case of Boeing, we have reduced the amount of 
delegation, and we have pulled back some of the previously delegated 
items. Specifically regarding the 737 MAX, the FAA has retained all 
aspects of the review. No part of the review has been delegated to the 
manufacturer. In addition, the FAA is in the process of reevaluating 
our delegation decisions for other current Boeing projects.
    We are carefully reviewing the recommendations received to date and 
are identifying the FAA and external stakeholders who would be 
responsible for the development and implementation of proposals to 
address the recommendations. This includes items like Recommendation R9 
of the Joint Authorities Technical Review (JATR) report, which 
discusses operational design assumption of crew response.

    Question 3. In the submitted written testimony from Mr. Edward 
Pierson, he noted that during a 13-month timeframe from 5/12/18 to 3/
26/19, the Boeing 737 line had 15 emergencies, leading to 2 crashes and 
13 incidents.
    a. Is this statistic consistent with the FAA statistics on the 737 
line?
    b. If so, how does this record compare with other aircraft types?
    c. If this statistic is an outlier, what accounts for this 
inconsistency?
    Answer (a.-c.). The FAA's understanding of Mr. Pierson's comments 
is that he is referring to the two accidents that led to the grounding 
and current redesign of the 737 MAX, and 13 Service Difficulty Reports 
(SDR) received on the MAX aircraft. It is not unusual for transport 
aircraft to have 13 SDRs in the stated reporting time period.
    The FAA reviewed the SDRs raised by Mr. Pierson and determined that 
none of them required an Airworthiness Directive (AD) mandating 
corrective actions for the airplane.

  Questions from Hon. Peter A. DeFazio for G. Michael Collins, Former 
 Aerospace Engineer, Federal Aviation Administration, appearing in his 
                          individual capacity

    Question 1. Mr. Collins, delegating authority to entities such as 
Boeing has been a long-standing practice which can be beneficial to the 
Federal Aviation Administration (FAA) in leveraging the technical 
expertise of manufacturers to help make key determinations concerning 
the safety of aircraft. However, there is a risk of over-delegation 
that can lead to regulatory capture where the FAA favors industry's 
interests at the expense of its regulatory responsibilities.
    a. Over your three-decade career at the FAA, what are your 
observations on how the FAA has managed its relationship with the 
entities it regulates?
    Answer. Delegating authority to entities such as Boeing has changed 
dramatically over my three-decade career as an FAA aerospace engineer 
in the Aircraft Certification Service. Thirty years ago, the system 
provided for direct oversight of and open communications between FAA 
technical specialists and those in industry to whom FAA delegated 
authority to make compliance findings under the Designated Engineering 
Representative (DER) system. Now, under the ``Organization Designation 
Authorization'' (ODA) system there is no direct oversight of and very 
limited \1\ communication between FAA specialists and those in the ODA 
who are authorized to make compliance findings for the FAA (``unit 
members''). Instead of using FAA oversight to identify and correct 
safety issues (non-compliances) before certification, the FAA has been 
moving toward identifying safety issues during audits after a design 
has been certificated and is in production The concept of auditing 
after the certification to determine if the compliance finding was 
appropriate and process used to make the finding needs improvement is 
an ineffective and inefficient. The process leads to the flying public 
being exposed to potentially unsafe designs until or if the deficiency 
is found during an audit or disclosure by the company. Direct 
involvement of the FAA safety engineers and collaboratively working 
with the DERs resulted in identifying and fixing non compliances before 
the airplanes entered service.
---------------------------------------------------------------------------
    \1\ Boeing implemented internal procedures that required their ARs 
to get permission before talking with FAA certification engineers. This 
practice stifled a collaborative oversight and compliance working 
relationship.
---------------------------------------------------------------------------
    In addition to the changes in delegation, FAA management has 
changed their focus from one that prioritized compliance to regulations 
and policy thirty years ago to a management culture that gives priority 
to applicants' positions, their costs and schedules over compliance to 
FAA regulations and policy. There are several examples of this shift in 
management focus in my written testimony such as the 737 MAX rudder 
control, 737 MAX fuel tank surface temperature, 737 MAX fuel pump 
circuit protection, the 787 lithium-ion battery containment as well as 
the issue of FAA issuing exemptions that are more in the economic 
interests of the applicant than in the interest of the Public.
    Regarding exemptions, Title 14 Code of Federal Regulations (14 CFR) 
section Sec. 11.81 is titled ``What information must I include in my 
petition for an exemption?'': Paragraphs (d) and (e) state:

        (d) The reasons why granting your request would be in the 
        public interest; that is, how it would benefit the public as a 
        whole;

        (e) The reasons why granting the exemption would not adversely 
        affect safety, or how the exemption would provide a level of 
        safety at least equal to that provided by the rule from which 
        you seek the exemption;

    However, FAA management often grants exemptions to petitioners 
(type design applicants) that allow designs that do not provide a level 
of safety at least equal to that provided by the rule. Those exemptions 
allow the applicant to produce a design that has a level of safety 
below that required by the FARs. Further, those exemptions are only in 
the financial interest of the applicant; they do not benefit the public 
as a whole as stated in the regulation.

    b. What is the ``right'' amount of authority for the FAA to 
delegate to industry?
    Answer. There is no numerical answer that defines the right amount 
of authority to delegate to industry. The right amount depends on the 
scope and potential safety impact of the certification project and each 
applicant's technical expertise, knowledge of Federal Aviation 
Regulations (FARs), the regulation's intent and published FAA policy.
    One factor should be the applicant's compliance culture which is 
demonstrated by their ability to follow FAA regulations and policy. If 
an applicant repeatedly presents designs that clearly do not comply 
with the regulations and policy, and often argues with the FAA over the 
intent of the FAA's regulations, that does not demonstrate a good 
compliance culture. A designee is supposed to demonstrate the knowledge 
and ability to follow FAA regulations and policy.
    Another factor should be the safety culture of the applicant. The 
Federal Aviation Regulations (FARs) define the minimum level of safety 
for obtaining an FAA type certificate. They do not define a maximum 
level of safety that should be included in a design. Applicants should 
demonstrate a safety culture that values presenting designs that not 
only meet the FARs but exceed the safety level required by the FARs for 
those critical safety designs where an additional safety level is in 
the public interest; as well as in the interest of the applicant to 
produce a safe product and maintain a high safety reputation with the 
public.

    c. Would you say that the FAA has yielded too much authority to 
Boeing? Why or why not?
    Answer. Yes, it does seem the FAA has yielded too much authority to 
Boeing; especially since granting Boeing an Organizational Delegation 
Authority (ODA). This has been demonstrated by the grounding of two 
type design approvals Boeing obtained under their ODA in each model's 
first year of operations. The first Boeing model approved under their 
ODA, the 787, was grounded for several months because the design of the 
lithium-ion battery installation approved under the ODA process was 
unsafe. As presented in my written testimony, an FAA technical 
specialist had proposed the FAA require a steel containment structure 
be required but was overruled. A steel containment structure was part 
of the design change that allowed the lifting of the grounding of the 
787.
    The second model approved under Boeing's ODA, the 737 MAX, series 
has now been grounded for nearly one year following the second of two 
catastrophic crashes. Those failures of the ODA demonstrate a lack of a 
good compliance culture and safety culture necessary for the authority 
FAA has yielded to Boeing.
    In both instances, delegation decisions were made based upon 
management pressure and their desire to support Boeing's schedule 
needs. For instance, on the 787, the delegation should have been 
limited due to the significant amount of new technology incorporated 
into the design and the new global supply network and business model 
used to develop and manufacture the airplane. Rather than limit the 
delegation authority, FAA managers made decisions to delegate over 95 
percent of the findings. On the 737 MAX managers made similar 
delegation decisions based upon resources and program schedule needs. 
Even then, the 737 MAX received type certification ahead of Boeing's 
schedule.
    In addition, these are examples of how FAA has yielded too much 
authority to Boeing and other ODAs:
    i.  The Boeing ODA manual restricts what FAA aerospace engineers 
can look at technically and restricts what can be challenged by the FAA 
aerospace engineers.
    ii.  FAA management directed (forced) FAA technical specialists to 
delegate 90% and more of engineering safety findings to the Boeing ODA.

    d. What does the FAA need to do to ensure that it is able to 
adequately oversee the work it delegates?
    Answer. Delegation works best when there is direct communication, 
trust, integrity, and professionalism on both sides. The FAA aerospace 
certification engineers should be able to work directly with the 
designee (in this case, the ODA unit members) to establish and maintain 
trust. The FAA aerospace certification engineer must be able to review 
and approve novel and safety critical test plans and witness novel and 
safety critical testing to conduct proper oversight the of designee's 
knowledge of FAA regulations and policy as well as designee's 
professionalism. The designee must be allowed to directly communicate 
with the FAA aerospace certification engineers (and vice versa) at any 
time and to freely discuss engineering safety concerns and tackle in-
service problems in a professional and collaborative manner.
    FAA should be required to establish a formalized delegation 
decision process that is based upon factors noted above regarding the 
ODA performance, and the technical risk of the particular design 
aspect. The technical risk should be established by a team of experts 
consisting of FAA technical experts and outside experts if additional 
expertise is needed to address new technology aspects of a product. The 
retention status of an item would be established at the beginning of 
the program and it could not be changed without a formal decision by 
the technical team. Managers should not be able to override the team 
decision due to pressures by applicants later in the program due to 
schedule related concerns. Delegation decisions could be reviewed by 
the technical team and delegation authorized in consideration of new 
information provided by the applicant justifying delegation. FAA 
management should not direct delegation of authority to an applicant 
based on any arbitrary numerical value.
    Current FAA policy for ODAs, including Order FAA Order 8100.15B, 
``Organization Designation Authorization Procedures,'' allows for FAA 
to determine how much to delegate to an ODA and allow for evaluating 
proposed unit members. However, a change in the 2018 FAA 
Reauthorization removes that ability. The change essentially made 
delegation a right of the ODA holder instead of a privilege. Section 
212(a) requires the FAA to ``delegate fully'' to an ODA holder the 
functions specified in the ODA holder's procedures manual. The FAA can 
limit any function only after the delegation if investigation shows 
that public interest and safety require such a limitation. This is in 
contrast with current policy, which requires the FAA to retain certain 
inherently governmental functions, such as interpretations of 
airworthiness standards, and specific compliance findings if the ODA 
either has no experience with the issue or has demonstrated previously 
that it can't be relied on, e.g., by not following FAA policy in making 
a compliance finding. (See FAA Order 8100.15B, paragraphs 8-4, 
Limitations, and 8-6, Type Certification Programs.) Section 212(a) also 
requires the FAA, at the ``request'' of an existing ODA holder, to 
approve revisions to its procedures manual and to delegate fully each 
function described in the manual, with the same restrictions on 
limiting functions.
    In addition, the FAA should dedicate additional resources 
(aerospace engineers) to the oversight function during certification 
instead of dedicating new resources to audit type functions.

    Question 2. Mr. Collins, you were a member of the Safety Oversight 
Board that was responsible for reviewing safety concerns raised by FAA 
employees. One of the issues the board considered was the design of the 
rudder cable on the 737 MAX. According to several FAA technical staff, 
the rudder cable is at risk of being damaged--meaning that the plane 
could no longer be steered--from debris in the event of an uncontained 
engine failure. However, Boeing felt that the design changes were 
impractical, and FAA managers ultimately sided with Boeing over the 
agency's technical experts.
    a. In the case of the 737 MAX rudder cable issue, was it unusual 
for so many experts to express their concerns over the FAA's reticence 
to have Boeing change the design?
    Answer. Yes; it was very unusual for so many FAA technical experts 
as well as several FAA managers to disagree with the decision of some 
FAA managers on a means of compliance to the Federal Aviation 
Regulations. Even more unusual that they would document their 
disagreement in writing.
    FAA management was not only reticent toward the end of the 737 MAX 
certification project to have Boeing change the design of the rudder 
controls from the original 1960's design; FAA managers actively 
developed the FAA position in the issue paper and their response to the 
SRP Oversight Board/SME Panel's determination to try to present a 
reason the old rudder control design could be found as compliant to the 
FARs in spite of the lessons learned from the 1989 DC-10 accident. The 
result is the rudder control of the 737 MAX, as documented by the SME 
Panel report, is subject to a single failure causing a catastrophic 
accident as happened in the DC-10 accident. FAA management's reasons 
were found unacceptable by all those who documented their disagreement, 
including the independent SRP Subject Matter Expert Panel and the SRP 
Oversight Board.
    The FAA management position at the end of the certification project 
is in stark contrast to their position earlier in the certification 
project when those same FAA managers signed FAA letters and the FAA 
issue paper stating Boeing needed to change the rudder control design 
in order to be compliant with the Federal Aviation Regulations. In 
effect, at the FAA management position early in the 737 MAX 
certification process agreed with the later position of the FAA 
technical specialists, SRP SME Panel and the SRP Oversight Board.

    b. How concerned are you that the voices of the FAA's technical 
experts are not being heard and how do you believe that can undermine 
aviation safety?
    Answer. I am very concerned that these days FAA managers more often 
spend time looking for ways justify accepting industry proposals while 
overruling the FAA technical specialists who have determined the 
industry proposal does not demonstrate compliance to the Federal 
Aviation Regulations (FAR). The technical specialists I worked with 
consider themselves public servants who want to make sure designs 
approved by the FAA do comply with the minimum standards in the FARs or 
truly provide an equivalent level of safety to the relevant FARs. As 
public servants, they know their decisions affect the safety of the 
flying public as well as those on the ground if an aircraft crashes.
    When designs are approved that do not meet the minimum safety 
standards, it clearly undermines aviation safety. As I stated in my 
written testimony, it is also demoralizing to FAA technical specialists 
when managers continually overrule their technical findings.
    I believe that those FAA managers who often overrule technical 
specialists are in many cases violating the regulations and policies 
and putting the public safety at risk. In order to send a message that 
the FAA has a just safety culture and will not accept this behavior, 
these managers should be held accountable.

    c. What are your recommendations for ensuring the Safety Review 
Process (SRP) strikes the right balance between safety concerns and the 
industry's business interests?
    Answer. The SRP process was created to provide a voluntary safety 
reporting process that provides the opportunity for FAA employees to 
report safety issues and for those issues to be evaluated using a 
collaborative process, rather than a unilateral FAA management process. 
It isn't intended to strike a balance between a safety concern and 
industry's business interests. It is intended to evaluate a safety 
concern, for example a concern an FAA decision allows a design that 
does not comply with the FAA regulations, and determine if the safety 
concern is valid. If the safety concern is valid, then the SRP process 
is intended to make recommendations to correct the safety issue.
    When the issue involves a decision made regarding an applicant's 
proposed method of compliance, such as the 737 MAX rudder control issue 
I discussed in my written testimony, the SRP process evaluates the 
applicant's position and the FAA's decision against the FAA safety 
regulations and policy. When the SRP collaborative process determines 
an FAA decision was contrary to FAA regulations and policy, FAA 
management should take the Oversight Board's decision seriously instead 
of being defensive about it and just restating their support for their 
prior decision. This was the same difficulty the current Administrator 
had during your December 11, 2019 hearing in admitting the FAA made a 
mistake regarding the approval of MCAS on the 737 MAX..
    With regard to striking a balance between safety and industry's 
business (cost) interests, when the FAA proposes a change to the 
regulations (FARs) they are required to perform an extensive cost-
benefit analysis. The rulemaking process evaluates the cost of 
implementing the change to future designs against the safety benefit to 
the public as a whole. This process includes a public comment period 
and review of the rulemaking by the Department of Transportation. In 
additions, significant rulemaking is reviewed by the Office of 
Management and Budget before it is issued. It is during the rulemaking 
process that the FAA strikes the balance between safety and industry's 
cost interests. Therefore, when a design is non-compliant with FARs the 
FAA has not achieved the right balance between industry and public 
interest that was previously determined during the rulemaking process.
    In addition, FAA regulations already have methods to try to balance 
compliance to the regulations with the cost to the applicant for 
changed products (e.g., amended type certificate projects like the 737 
MAX). When evaluating the application of newer regulations to a changed 
product, the Changed Product rule allows FAA to consider the cost of 
applying a new regulation verses the safety benefit. Using that process 
the FAA may decide to allow the applicant to continue to use the older 
regulations that applied to the baseline model by granting an 
``exception'' or the FAA may decide it is in the public interest to 
require the applicant apply the latest regulation.
    Advisory Circular (AC) 21.101-1B, ``Establishing the Certification 
Basis of Changed Aeronautical Products'' describes the use of 
exceptions. In section 2.2.1 it states ``Section 21.101(a) requires a 
change to a TC and the area affected by the change to comply with the 
latest requirements, unless the change meets the criteria for the 
exceptions identified in Sec.  21.101(b) or (c). The intent of Sec.  
21.101 is to enhance safety by incorporating the latest requirements 
into the type certification basis for the changed product to the 
greatest extent practicable.''
    For example, the FAA can evaluate if the newer cockpit display 
rules should be applied to a changed product such as the 737 MAX, or 
should an exception be granted that allows the applicant to use the 
regulations in the previous (baseline) model's certification basis. 
This is not a public process like rulemaking or petitions for 
exemption. I believe FAA Management has too often placed their priority 
on industry cost concerns verses the safety of the public as a whole 
when granting exceptions under the Changed Product Rule. Therefore, I 
recommend the FAA change the process for granting an exception to 
include an opportunity for the public to comment on proposed 
exceptions. The notice to the public requesting comment on a proposed 
exception should include all justification used by the applicant in 
their request for the exception; similar to the public exemption 
process.
    In the case of the 737 MAX rudder control, the regulations had not 
been updated since the 737 model being changed. In fact, the FAA policy 
had not changed since the certification of the baseline 737 NG models. 
Therefore, a better way for FAA management to respond to a decision and 
recommendation by the SRP Oversight Process when it determines the 
method of compliance was not appropriate would be to use an existing 
tool the FAA has in the regulations to evaluate a design that does not 
comply with the regulations; the Exemption process defined under 14 CFR 
Section 11. FAA management should have required the applicant submit a 
petition for exemption and then FAA should have evaluated the petition 
using the process defined in Section 11. This was one of the SRP Panel/
Oversight Board recommendations.
    When evaluating the exemption, FAA should use a collaborative 
process between the local manager and the FAA technical specialists. 
Any exemption granted should be in the interest of the public as a 
whole, as stated in the regulations, and clearly provide an equivalent 
level of protection to the regulations, as stated in the regulation. 
Exemptions should not be granted solely on the basis of the financial 
interests of the applicant. As discussed above, when each regulation 
was issued it went through an evaluation of the cost to industry verses 
the safety benefit of the regulation. Exemptions should not be used as 
a method to circumvent the public cost benefit evaluation used when 
regulations were adopted.
    In using the exemption process for the 737 MAX rudder cable issue, 
FAA Management could have granted a time-limited partial exemption to 
give Boeing additional time to modify the rudder design so that it 
complies with the regulations. This seems similar to how EASA worked 
with Airbus on the similar A320neo rudder design. Alternatively, FAA 
management could have granted Boeing a full exemption so Boeing could 
continue to produce the 737 MAX with the 1960s rudder design for 
another 30 years or however long the 737 MAX remains in production, 
although in my opinion that would not have been in the interest of the 
public as a whole.
    Prior to the SRP being developed, I was on a joint Union-Management 
collaborative team that recommended a different type of voluntary 
safety reporting process that was similar to the very successful Air 
Traffic Safety Action Program (ATSAP). The proposal from the team 
included a third independent party in addition to Union representatives 
and Aircraft Certification Managers in the group evaluating the SRP 
report and making recommendations. Later, I was in a meeting when FAA 
management in Washington, D.C. (AVS-1 at the time) expressed her 
concern with having a third party in the process and would not agree to 
this proposal. Unfortunately, the SRP system that is in place today has 
once again demonstrated that FAA managers refuse to admit any fault in 
a past decision and correct poor safety decisions.
    The existing SRP process could be improved by requiring upper level 
management (e.g., AIR-1) document their decision to either accept the 
SRP Oversight Board's recommendation or accept the FAA Division 
manager's decision to reject the Oversight Board's recommendation.
    A further improvement to the SRP could be to add an independent 
review process for those SRP reports where FAA Management rejects the 
SRP Oversight Board recommendation. The issue could be submitted to the 
NTSB using a process like the existing Airman Appeal process. FAA could 
be required to submit the FAA Management justification together with 
the SRP report and Oversight Board recommendations to the NTSB for 
review. Such an independent review step could help develop a just 
safety culture in FAA Aircraft Certification Service management from 
the highest levels of management to the line managers.

   Questions from Hon. Peter A. DeFazio for Mica R. Endsley, Ph.D., 
    appearing on behalf of the Human Factors and Ergonomics Society

    Question 1. Dr. Endsley, in your testimony you note that pilots 
were not aware of or trained on the maneuvering characteristics 
augmentation system (MCAS), and that ``[e]ffective training on how to 
overcome automation failures involves not only a written notice or 
description of automation, but also actual experience in detecting, 
diagnosing, and responding of such events.''
    a. Does this mean you believe 737 MAX pilots should have had 
simulator-based training before flying the aircraft?
    Answer. Scientific research shows that training pilots on fight 
deck automation is critical for developing a robust understanding of 
how it works. This mental model is needed to support pilots in 
understanding automation modes and accurately predicting its behaviors 
under both normal and non-normal conditions. An accurate mental model 
of how automation works is critical to developing good situation 
awareness and performance in flight operations.
    While there was an expectation by Boeing that pilots did not need 
simulator training because the MCAS automation would be acting in the 
background, this expectation did not consider the challenges of 
abnormal events such as was experienced in these accidents. Simulator-
based training on MCAS should have been provided to all pilots prior to 
flying the aircraft to allow them to develop the needed understanding 
of the behavior of the MCAS automation under both normal and non-normal 
events, such as degraded or inoperative sensors.

    b. When the 737 MAX is ungrounded, do you think pilots should have 
to go through some kind of simulator-based training before being 
allowed to fly the aircraft again?
    Answer. Prior to flying the 737-MAX, pilots should be provided with 
training on the MCAS system regarding how the newly revised system 
works as well as its limitations and potential failure modes. They 
should also be provided with the opportunity to fly a 737-MAX 
configured flight simulator and to experience potential failure 
conditions. The simulator training should include identification of 
critical cues that indicate a failure mode, differentiation between 
MCAS failure and other failure conditions, and execution of the proper 
response to any MCAS failures.
    While some pilot training can be provided via classroom or 
computer-based training programs, it is important that flight 
simulators are also employed to ensure that pilots can recognize 
automation behaviors and failure conditions in context, can accurately 
carry out the appropriate procedures, and can experience aircraft 
flight handling changes to gain proficiency. Training programs should 
be tested and validated to show that they are successful in providing 
the needed skills to line pilots.

    Question 2. Dr. Endsley, it has now been more than one year since 
Boeing admitted that it concealed from both the Federal Aviation 
Administration (FAA) and 737 MAX operators the fact that the angle of 
attack (AOA) disagree alert wasn't functioning properly on the vast 
majority of the 737 MAX fleet in service. Yet, the FAA hasn't taken any 
kind of enforcement action against Boeing for its failure to divulge 
this to the FAA or its customers. The FAA has issued no fines or 
penalties--despite the fact that this was a clear violation of FAA 
regulation.
    Do you think the FAA should propose some kind of penalty against 
Boeing for its handling of the AOA disagree alert, and if it doesn't, 
what kind of message do you believe that sends to Boeing and industry?
    Answer. Companies are responsible for establishing a strong safety 
culture that promotes the application of safety and human factors 
practices, and the open reporting of any system problems and 
appropriate remedial safety actions that are needed. This includes 
design changes, training, and communications with regulatory 
authorities and customers. While the Human Factors and Ergonomics 
Society strongly endorses such activities based on scientifically 
supported best practices, it is not our role take a position with 
regard to punitive actions or penalties pertaining to regulatory 
compliance. It is the purview of the government to determine the 
appropriate proactive and/or reactive measures that should be taken in 
regards to regulatory compliance.

    Question 3. Dr. Endsley, do you believe the FAA's November 7, 2018, 
Emergency Airworthiness Directive was insufficient for preventing the 
second 737 MAX accident. If so, why?
    Answer. The Emergency Airworthiness Directive (AD) was clearly 
insufficient for preventing the second accident in the 737 MAX. While 
the AD addressed the issue of blocked AOA sensors affecting aircraft 
performance, it did not address the MCAS by name, nor did it explain 
how the MCAS used the sensor inputs to control the aircraft's pitch, 
leaving pilots with an insufficient mental model of MCAS in normal and 
abnormal situations. More importantly, it failed to mandate training on 
the MCAS, on correctly identifying problems with improper MCAS 
operations, and on proper procedure execution.
    The revisions to the flight manual in the AD provide only a long 
list of potential problems that were not sufficiently diagnostic of the 
MCAS failure condition. The cues received by the pilots due to degraded 
sensors affecting MCAS were significantly different than the cues 
received with a runaway stabilizer trim, the procedure that Boeing and 
the AD instructed pilots to use, slowing diagnosis of the problem.
    While the Indonesian Airlines crew was able to correctly identify 
the need to use the runaway stabilizer trim procedure (in that the 
first officer had completed initial training on the aircraft after the 
AD was issued), they were not able to correctly perform the execution 
of the procedure. A mis-trim was still in place after the crew set the 
system to CUT-OUT. Additionally, they were unaware of the disconnect of 
the auto-throttle system, leading to loss of situation awareness on 
airspeed. The combined mis-trim and high airspeed created a pitch 
problem that was uncontrollable.

Questions from Hon. Frederica S. Wilson to John M. Cox, Chief Executive 
                   Officer, Safety Operating Systems

Joint Authorities Technical Review (JATR)

    Question 1. Mr. Cox, the JATR found that the MCAS system was not 
evaluated as a ``complete and integrated'' function in the 
certification documents that were submitted to the FAA, that the safety 
analysis was fragmented among several documents, and parts of the 
System Safety Analysis (SSA) from the B737 NG were reused in the B737 
MAX without sufficient evaluation.
    How important is it to evaluate new flight systems and technology 
as a ``complete and integrated function'' of the aircraft?
    Answer. In today's modern, complex airliners it is vital that the 
entire system be evaluated, not just individual components. This is the 
purpose of the System Safety Analysis. It is my understanding that 
Boeing evaluated MCAS with a System Safety Analysis in the original 
state (.6 degrees of stabilizer movement per activation) but not when 
the authority was increased (2.4 degrees of stabilizer movement per 
activation). This was a significant oversight or error.
    I agree with the JATR that is very important that a complete and 
integrated system should be evaluated. Furthermore, each component 
should be evaluated for failure and the effect on the overall system. 
As an example; if an Angle of Attack sensor fails the system will be 
affected with the activation of the stick shaker, IAS Disagree, ALT 
Disagree, FEEL DIFF PRES, warnings plus the disengagement of the 
autopilot and autothrottles. Pilot response to these numerous and 
simultaneous warnings should be carefully evaluated for risk severity.
    Certification criteria can be improved to be more inclusive of 
component failures that affect systems.

Boeing-FAA, Boeing-Airlines, Boeing-Pilots Communications

    Question 2. Captain Cox, the Committee's investigation has revealed 
that Boeing communicated important information about MCAS and related 
systems to the FAA and airlines either in a fragmented way or not at 
all. Does that raise alarm in your view?
    The Joint Authorities Technical Review found, and I quote, that 
``Aircraft functions should be assessed, not in an incremental and 
fragmented manner, but holistically at the aircraft level.'' Do you 
agree?
    Answer. Boeing viewed MCAS as a subsystem of the Speed Trim System, 
and not of importance to the operator or crew. I respectfully disagree 
with this assessment. Any system that can move a major flight control, 
such as the stabilizer trim, should be explained to the operator and 
flight crew. It does concern me that the Boeing evaluation did not 
adequately take into account the simultaneous failures that could occur 
which, could slow crew response and complicate diagnosing the problem.
    I fully agree with the JATR that aircraft functions should be 
assessed in a holistic manner. With increasing complexity and 
increasing interrelation between systems (computers exchanging 
information with other computers) it is very important that system 
performance be evaluated carefully when a failure occurs.

Questions from Hon. Conor Lamb to John M. Cox, Chief Executive Officer, 
                        Safety Operating Systems

    Question 1. Captain Cox, you worked on the investigation of the 
USAir flight 427 accident in 1994, which tragically occurred in my 
district. As you know, USAir 427 was the second crash attributable to 
the same design flaw in the Boeing 737 rudder power control unit. In 
your testimony, you spoke to the fact that it is unacceptable to have 
two successive crashes related to the same design flaw.
    Does it give you concern that, 25 years later, two 737s have again 
crashed due to a common design flaw?
    Answer. I, along with numerous other investigators, spent five 
years solving the US Air 427 accident. The industry did not learn 
everything possible from the United Airline accident four years earlier 
in Colorado Springs (UAL 585). It does concern me that there were two 
MAX accidents in which there were many similar causal and contributing 
factors.
    Due to the short time between the Lion Air and Ethiopian Airlines 
accident the investigation of Lion Air was not complete. However, there 
was compelling evidence of a serious problem with MCAS activation and 
the resulting impact on controllability.
    A review of the assumptions of pilot actions following MCAS 
activation should have been undertaken after Lion Air.
    An accident that is due to the reoccurrence of problem known from a 
previous accident or incident is the most difficult for accident 
investigators.

    Question 2. Do you recall that pilots were blamed after the first 
and second accidents in the 1990s? What are your thoughts on this?
    Answer. There were some people and organizations that attempted to 
blame the pilots for the United 585 and US Air 427 accidents. NTSB did 
not agree that the pilots were the cause of these accidents.
    Some organizations quickly blame pilots because they are the last 
people that could have stopped the accident sequence. As an experience 
accident investigator I have learned that this is simplistic and does 
not address all of the issues.
    All accidents are the result of a complex series of events. 
Preventing future accidents requires understanding and mitigating all 
of these contributing factors. Sometimes assessments should be done 
before the final report is released to ensure continued safety of the 
fleet.
    If human error is a causal factor, evaluation of what caused the 
error should be done. Human factors and human performance are important 
parts of accident investigation.

    Question 3. What recommendations do you have to ensure that 
corrective action is taken after an initial crash before a subsequent 
crash occurs?
    Answer. Early in an investigation an evaluation of aircraft and 
crew performance compared to expected performance should be done. If 
there are discrepancies in either crew performance or aircraft 
performance an evaluation of the risk to the fleet should be conducted. 
Could this happen again? Are the assumptions of crew performance the 
same as accident crew's actual performance? Did the airplane perform as 
expected?
    Conduct a review of fleet history to determine if similar events 
occurred, even if they did not result in an accident. This information 
provides data for the likelihood of a future occurrence. This review 
should be transparent and shared with all parties to the investigation.



                                 [all]