    [Senate Hearing 116-353]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 116-353

     THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION

    =======================================================================

                                    HEARING

                                   before the

                       SUBCOMMITTEE ON AVIATION AND SPACE

                                     of the

                             COMMITTEE ON COMMERCE,
                          SCIENCE, AND TRANSPORTATION
                              UNITED STATES SENATE

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 MARCH 27, 2019

                                   __________

        Printed for the use of the Committee on Commerce, Science, and
                                 Transportation

                     [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                    Available online: http://www.govinfo.gov

                                   ______

                     U.S. GOVERNMENT PUBLISHING OFFICE

    42-445 PDF                WASHINGTON : 2023

           SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                      ROGER WICKER, Mississippi, Chairman

    JOHN THUNE, South Dakota             MARIA CANTWELL, Washington,
    ROY BLUNT, Missouri                      Ranking
    TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota
    DEB FISCHER, Nebraska                RICHARD BLUMENTHAL, Connecticut
    JERRY MORAN, Kansas                  BRIAN SCHATZ, Hawaii
    DAN SULLIVAN, Alaska                 EDWARD MARKEY, Massachusetts
    CORY GARDNER, Colorado               TOM UDALL, New Mexico
    MARSHA BLACKBURN, Tennessee          GARY PETERS, Michigan
    SHELLEY MOORE CAPITO, West Virginia  TAMMY BALDWIN, Wisconsin
    MIKE LEE, Utah                       TAMMY DUCKWORTH, Illinois
    RON JOHNSON, Wisconsin               JON TESTER, Montana
    TODD YOUNG, Indiana                  KYRSTEN SINEMA, Arizona
    RICK SCOTT, Florida                  JACKY ROSEN, Nevada

                           John Keast, Staff Director
                      Crystal Tully, Deputy Staff Director
                          Steven Wall, General Counsel
                     Kim Lipsky, Democratic Staff Director
                  Chris Day, Democratic Deputy Staff Director
                          Renae Black, Senior Counsel

                                     ------

                       SUBCOMMITTEE ON AVIATION AND SPACE

    TED CRUZ, Texas, Chairman            KYRSTEN SINEMA, Arizona, Ranking
    JOHN THUNE, South Dakota             BRIAN SCHATZ, Hawaii
    ROY BLUNT, Missouri                  TOM UDALL, New Mexico
    JERRY MORAN, Kansas                  GARY PETERS, Michigan
    CORY GARDNER, Colorado               TAMMY DUCKWORTH, Illinois
    MARSHA BLACKBURN, Tennessee          JON TESTER, Montana
    SHELLEY MOORE CAPITO, West Virginia  JACKY ROSEN, Nevada
    MIKE LEE, Utah

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on March 27, 2019...................................     1
    Statement of Senator Cruz........................................     1
    Statement of Senator Sinema......................................     2
    Statement of Senator Wicker......................................     3
    Statement of Senator Cantwell....................................     4
    Statement of Senator Thune.......................................    37
    Statement of Senator Klobuchar...................................    39
    Statement of Senator Moran.......................................    41
    Statement of Senator Blumenthal..................................    43
    Statement of Senator Blunt.......................................    44
    Statement of Senator Duckworth...................................    47
    Statement of Senator Moore Capito................................    49
    Statement of Senator Markey......................................    51
    Statement of Senator Rosen.......................................    53
    Statement of Senator Udall.......................................    56
        Article dated June 15, 2018 from the Seattle Times entitled,
          ``Troublesome advanced engines for Boeing, Airbus jets have
          disrupted airlines and shaken travelers''..................    57

                                   Witnesses

    Hon. Daniel K. Elwell, Acting Administrator, Federal Aviation
      Administration.................................................     6
        Prepared statement...........................................     7
    Hon. Robert L. Sumwalt III, Chairman, National Transportation
      Safety Board...................................................    11
        Prepared statement...........................................    12
    Hon. Calvin L. Scovel III, Inspector General, U.S. Department of
      Transportation.................................................    19
        Prepared statement...........................................    21

                                    Appendix

    Response to written questions submitted to Hon. Daniel K. Elwell
      by:
        Hon. John Thune..............................................    73
        Hon. Maria Cantwell..........................................    74
        Hon. Amy Klobuchar...........................................    74
        Hon. Tom Udall...............................................    74
        Hon. Tammy Duckworth.........................................    76
        Hon. Jon Tester..............................................    79
    Response to written questions submitted to Hon. Calvin L. Scovel
      III by:
        Hon. John Thune..............................................    81
        Hon. Maria Cantwell..........................................    81
        Hon. Tammy Duckworth.........................................    82
        Hon. Jon Tester..............................................    83

     THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION

                                  ----------

                           WEDNESDAY, MARCH 27, 2019

                                   U.S. Senate,
                    Subcommittee on Aviation and Space,
            Committee on Commerce, Science, and Transportation,
                                                        Washington, DC.
        The Subcommittee met, pursuant to notice, at 3:02 p.m. in
    room SH-216, Hart Senate Office Building, Hon. Ted Cruz,
    Chairman of the Subcommittee, presiding.
        Present: Senators Cruz [presiding], Wicker, Thune, Blunt,
    Moran, Moore Capito, Sinema, Cantwell, Blumenthal, Markey,
    Duckworth, Klobuchar, Udall, and Rosen.

                  OPENING STATEMENT OF HON. TED CRUZ,
                        U.S. SENATOR FROM TEXAS

        Senator Cruz. Well, good afternoon. The subcommittee will
    come to order.
        Our hearing is entitled The State of Airline Safety:
    Federal Oversight of Commercial aviation. Welcome to each of
    the witnesses.
        On March 10, 2019, Ethiopian Airlines Flight 302 departed
    Addis Ababa Airport with 157 souls onboard. Among them were
    parents and children, reverends and international aid workers,
    and college students with their entire lives ahead of them, but
    at 8:44 a.m., 6 minutes after takeoff, what should have been a
    routine two-hour flight turned into a tragedy. Flight 302
    crashed, killing all 157 people.
        Although devastating on its own, the tragedy of Flight 302
    was compounded by the fact that something like this had
    happened less than six months earlier.
        Lion Air Flight 610 had been in the air just 12 minutes
    before plunging into the Java Sea at 6:32 a.m. on October 29,
    2018, killing all 189 people onboard.
        The 346 men, women, and children lost in these tragic
    crashes came from 35 different countries, ranged in age from
    the elderly to the unborn, and had professions as diverse as
    their backgrounds, but they did have one thing in common. They
    were all traveling on a brand-new plane, a Boeing 737 Max.
        It is truly unfortunate that today's hearing is necessary
    and I wish we didn't have to be here today, but our first
    priority in aviation must always be the safety of the flying
    public.
        The fact of the matter is that these crashes and subsequent
    reports on how the 737 Max was approved have badly shaken
    consumer confidence.
        In aviation, as in other industries, where a small mistake
    can have catastrophic consequences, trust is the currency of
    the realm. Trust of the flying public in the safety of the
    aircraft they step onto, trust of our international partners in
    the diligence and thoroughness of our regulatory bodies, and
    increasingly trust of our regulatory bodies in the quality and
    truthfulness of the data and certifications provided and
    performed by industry.
        Not only have the recent crashes shaken the confidence of
    the public but the questions that have been raised in the
    aftermath about FAA's oversight of aircraft manufacturers, the
    certification process for planes, and the close relationship
    between industry and regulator threaten to erode trust in the
    entire system.
        It is incumbent on us as legislators, as regulators, and as
    industry leaders to work to ensure that that does not occur.
        Today's hearing takes the first step down that road by
    seeking to answer some fundamental questions.
        First, we need to understand exactly what happened, both in
    these specific crashes and with the certification process for
    the Max aircraft, so that we can take action to keep something
    like these tragic crashes from occurring again.
        Second, we need to look at the aviation safety space more
    broadly and identify where we can and should make improvements.
    We need to answer, at least begin to answer questions like is
    the FAA taking the right approach to the oversight and
    certification of aircraft manufacturing, operations, and
    repair, particularly with regard to designated authority.
        Also answering how safe is commercial aviation, both in the
    United States and internationally, and how can we increase the
    level of safety even further, and how can we restore the
    confidence and trust of the flying public, both in the United
    States and internationally?
        As our witnesses today will highlight in their testimony,
    commercial aviation in the United States today is as safe as it
    ever has been worldwide and particularly in the United States.
        The likelihood of being in a fatal commercial plane crash
    is infinitesimally low and this is a record that we can and
    should be proud of, but this record is also exactly what makes
    the recent crashes and reports of lenient oversight by the FAA
    so frustrating.
        As a nation, we have been on such a promising upward trend
    in safety that, although these crashes occurred in foreign
    countries, the questions that have been raised about the
    integrity of our regulatory processes strikes right to the
    heart of aviation safety here at home.
        We need to do better and I firmly believe that we can. With
    that, I'll recognize the Ranking Member of the Aviation and
    Space Subcommittee, Senator Sinema.

                   STATEMENT OF HON. KYRSTEN SINEMA,
                       U.S. SENATOR FROM ARIZONA

        Senator Sinema. Well, thank you, Chairman Cruz, for holding
    this timely and important hearing.
        I look forward to building a strong relationship and
    working closely with you on this and other issues in our
    Subcommittee's jurisdiction.
        Thank you to our witnesses for joining us today.
        The United States airspace and U.S. aviation are the safest
    in the world. The United States is the leader in aviation and
    aviation safety, thanks to the dedication of thousands of
    skilled individuals on the manufacturing floor, on the ground
    at airports, in control towers, and in the air.
        Our safety also relies on the advocacy of concerned
    citizens, like the families of Continental Flight 3407, who
    tirelessly advocate for safer skies. Thank you for being here
    today and for your work on this important issue.
        The aviation industry is a major economic driver. Safe,
    affordable, and convenient air travel is critical to the well-
    being of industry, job creation, and economic growth. The
    system is successful because it is safe and people know and
    trust that it is safe.
        Tragedies, like the Ethiopian Airlines and Lion Air crashes
    are unimaginable in the U.S. and must remain so, but they and
    other recent incidents raise important questions about
    maintaining a safe national airspace system and U.S. leadership
    in aviation and safety.
        It's imperative that we quickly fix any problems within
    FAA's oversight, evaluation, and approval processes to ensure
    safety in American skies, restore trust, and maintain U.S.
    global leadership in aviation and aviation safety.
        Thank you, Mr. Chairman. I yield back.
        Senator Cruz. I now recognize the Chairman of the Full
    Committee, Senator Wicker.

                    STATEMENT OF HON. ROGER WICKER,
                     U.S. SENATOR FROM MISSISSIPPI

        Senator Wicker. Thank you, Senator Cruz, and I want to
    thank Senator Cruz and Senator Sinema for holding this
    Subcommittee hearing on the timely subject of aviation safety.
        As both the Chair and Ranking Member mentioned in their
    remarks, the remarkable safety record of U.S. passenger airline
    travel is a testament to decades of hard work and painful
    lessons learned by a great many stakeholders.
        Today's hearing represents the beginning of this year's
    work in this area. The Committee intends to hold a second
    hearing on aviation safety to hear from non-government
    witnesses, including Boeing.
        We understand that the investigations into the Ethiopian
    Airlines and Lion Air crashes are ongoing and may limit certain
    details from being discussed in this forum. However, our
    witnesses can cover a lot of information today, including
    addressing the FAA's response to these tragedies, the
    certification process, pilot training, and broader concerns
    about the increasing complexity and automation of aircraft
    systems.
        The FAA has long been considered the gold standard
    internationally when it comes to safety. It is vital that we
    work with our partners throughout the world to promote safe air
    transportation. The committee will continue to discuss robust
    oversight to ensure the safety of our aviation system.
        Thank you, Mr. Chairman.
        Senator Cruz. I now recognize the Ranking Member of the
    Full Committee, Senator Cantwell.

                   STATEMENT OF HON. MARIA CANTWELL,
                      U.S. SENATOR FROM WASHINGTON

        Senator Cantwell. Thank you, Mr. Chairman, and thank you
    for holding this important hearing today to discuss the
    paramount issue of aviation safety here in the United States
    and around the world.
        I thank the witnesses for being here and their insights
    today and I, too, want to recognize the families of the Colgan
    Air Flight 3407 who are here today because it is their
    continued persistence about getting aviation right that is so
    admirable. I thank them and thank you all for being here.
        The incidents that led us here today of the crash of Lion
    Air 610 last October and the Ethiopian Flight 302 are horrible
    human tragedies. I want to extend my deepest sympathies to the
    families and everyone impacted by this horrific incident.
        These two accidents cost 346 lives, leaving behind
    countless individuals and loved ones who I know want to make
    sure this is never repeated.
        The human toll is why we work every day to ensure that
    every possible step is taken to determine the causes that
    contributed to these incidents and through the crash
    investigations, other Federal investigations, and ongoing
    congressional oversight, I believe we all share the same goal,
    to make sure these accidents are never repeated.
        It is critical that all those involved look at the causes
    of the accident and work so that everyone has the full picture
    of what happened.
        Investigators in Indonesia and Ethiopia, with the help from
    NTSB and FAA and other international partners, are working
    through the evidence to determine the causes of these accidents
    and even though, as my colleagues have mentioned, global
    commercial aviation has experienced unprecedented periods of
    safety over the last decade, these two accidents are horrific
    reminders that we must remain vigilant in our oversight and
    focus on safety.
        So I look forward to hearing the information from the
    witnesses that is available for us today and I also commend
    yesterday's Secretary Chao's indication that she will seek a
    previously authorized authority by the last 2018 FAA bill which
    authorizes the establishment of a special committee of aviation
    experts to review the recommendations on the Federal Aviation
    Administration procedure process.
        So I look forward to their analysis as I do the analysis of
    all the investigations that are ongoing. Safety remains
    paramount and I look forward to working with all my colleagues
    on this very serious issue.
        Senator Cruz. Thank you.
        I'll now introduce each of the witnesses. The first witness
    is Mr. Daniel K. Elwell, who is currently the Acting
    Administrator of the Federal Aviation Administration. Before
    becoming Acting Administrator, Mr. Elwell served as the Deputy
    Administrator of the FAA from June 2017 to January 2018, and as
    a Senior Advisor to the Secretary of Transportation Elaine Chao
    prior to that.
        Mr. Elwell began his career in aviation in the United
    States Air Force where he received his Bachelor of Science
    degree in International Affairs from the U.S. Air Force
    Academy. He achieved the rank of Lieutenant Colonel and retired
    from military service as a command pilot.
        After retiring from the military, Mr. Elwell was a
    commercial pilot for 16 years with American Airlines, flying
    DC-10, MD-80, and Boeing 757-767 aircraft, and he then served
    at the FAA as Assistant Administrator for Policy, Planning, and
    Environment from 2006 to 2008.
        From 2008 to 2013, Mr. Elwell served as Vice President of
    the Aerospace Industries Association and from 2013 to 2015 as
    Senior Vice President for Safety, Security, and Operations at
    Airlines for America.
        Our second witness is the Honorable Robert Sumwalt.
    Following his nomination by President Trump and confirmation by
    the Senate, Robert L. Sumwalt was sworn in as Chairman of the
    National Transportation Safety Board on August 10, 2017.
        Prior to joining the NTSB, Chairman Sumwalt was a pilot for
    more than 30 years, during which time he flew for commercial
    carriers that included Piedmont Airlines and U.S. Airways and
    accumulated over 14,000 flight hours.
        He began his tenure at the NTSB in August 2006 when he was
    appointed to the Board by President George W. Bush and
    designated as Vice Chairman. In 2011, he was reappointed for an
    additional five-year term as a board member by President Obama.
        Chairman Sumwalt earned his undergraduate degree from the
    University of South Carolina and a Master's of Aeronautical
    Science with Distinction from Embry-Riddle Aeronautical
    University.
        He has been awarded an Honorary Doctor of Science degree
    from the University of South Carolina and an Honorary Doctorate
    from Embry-Riddle.
        Our third witness is the Honorable Calvin Scovel. Mr.
    Scovel was sworn in as Inspector General of the Department of
    Transportation on October 26, 2006.
        Prior to joining the DOT, he served 29 years of Active Duty
    service in the U.S. Marine Corps where he retired as a
    Brigadier General.
        During his military career, he served as a senior judge on
    the U.S. Navy Marine Corps Court of Appeals and as an Assistant
    Judge Advocate General of the Navy for Military Justice and as
    a senior advisor for the 4th Marine Expeditionary Brigade.
        His tenure as the DOT Inspector General has spanned the
    Administrations of three Presidents and four Secretaries of
    Transportation, during which time he has overseen audits and
    investigations dealing with all aspects of the Nation's
    transportation system.
        Mr. Scovel received a law degree from Duke University, a
    Bachelor's degree from the University of North Carolina at
    Chapel Hill, a Master's degree from the Naval War College, and
    he is a recipient of the Secretary of Transportation's Gold
    Medal for Outstanding Achievement.
        Administrator Elwell, we'll begin with your testimony.

       STATEMENT OF HON. DANIEL K. ELWELL, ACTING ADMINISTRATOR,
                    FEDERAL AVIATION ADMINISTRATION

        Mr. Elwell. Chairman Cruz, Chairman Wicker, Ranking Member
    Sinema, Members of the Subcommittee, thank you for the
    opportunity to appear before you today.
        On behalf of the U.S. Department of Transportation and the
    Federal Aviation Administration, I extend our deepest sympathy
    to the families of the passengers and the crews of Ethiopian
    Airlines 302 and Lion Air 610.
        Safety is at the core of the FAA's mission. It is our first
    priority. We have worked tirelessly to take a more proactive
    data-driven approach to oversight that instills a safety above
    all else culture at the FAA and the aviation community we
    regulate.
        This approach has made the U.S. aviation system the safest
    in the world. Since 1997, the risk of a fatal commercial
    aviation accident in the United States has been cut by 94
    percent and in the past 10 years, we've experienced one
    commercial airline passenger fatality in the United States in
    over 90 million flights. That's a remarkable record, but we
    know we must never stop pursuing improvement. We must never
    become complacent because one fatality is one too many.
        I speak to you today as both a former military and airline
    pilot and as a public servant who has dedicated his life to the
    pursuit of aviation safety. I am proud to lead the dedicated
    professionals of the FAA who share the same passion and sense
    of mission to make America's aviation system the safest.
        Because we know our fact-based data-driven approach works,
    we have applied this guiding principle in our response to the
    recent Boeing 737 Max accidents.
        I would like to provide you with an overview of the FAA's
    certification and oversight processes as well as our current
    actions with respect to the 737 Max and the next steps the FAA
    will take to foster safety enhancements here and abroad.
        Safety is not just a set of programs that can be
    established or implemented. It is a way of living and working
    and it requires the open and transparent exchange of
    information. It takes collaboration, communication, and common
    safety objectives to allow the FAA and the aviation community
    to jointly identify system hazards and to implement safety
    solutions.
        Decades of experience have proven that this approach yields
    knowledge that we would not otherwise obtain. FAA aircraft
    certification has always relied on the exchange of information
    and technical data with industry.
        Some version of our certification process has been in place
    for over 60 years. This does not mean that the process remains
    static. To keep pace with technology and advances in safety,
    the general regulations have been modified more than 90 times.
    The rules applicable to large transport aircraft, like the 737
    Max, have been amended more than 130 times.
        The FAA focuses its efforts on those areas that present the
    highest risk within the system. Our certification processes are
    extensive, well-established, and have consistently produced
    safe aircraft designs for decades.
        Boeing first applied for an amended certificate for the 737
    Max in January 2012. From initial application to final
    certification, it took about 5 years. The FAA was fully
    involved in the process, including participation in 133 of the
    297 flight tests, some of which encompassed tests of the
    aircraft MCAS system which has been the subject of recent
    attention.
        In the immediate aftermath of the Lion Air accident, the
    FAA issued an Emergency Airworthiness Directive that requires
    operators of the 737 Max to revise their flight manuals to
    reinforce to flight crews how to recognize and respond to
    uncommanded stabilizer trim movement.
        The FAA continues to seek and evaluate any additional data
    that might help us understand the underlying factors that led
    to the recent 737 Max accidents.
        We will take immediate and appropriate action based on the
    facts. U.S. and international operators of the 737 Max are
    relying on the FAA to get it right.
        I want to assure you and everyone else that the FAA will go
    wherever the facts lead us in our pursuit of safety. The 737
    Max will return to service for U.S. carriers only when the
    FAA's analysis of the facts and technical data indicate that it
    is appropriate to do so.
        In our quest for continuous safety improvement, the FAA
    welcomes external review of our systems, processes, and
    recommendations. As recent events have reminded us, aviation
    safety has no borders or boundaries. The FAA is resolute in its
    commitment to maintaining the U.S. air transportation system as
    the gold standard of the world.
        That concludes my statement. I'm ready to answer any
    questions.
        [The prepared statement of Mr. Elwell follows:]

      Prepared Statement of Hon. Daniel K. Elwell, Acting Administrator,
                        Federal Aviation Administration
        Chairman Cruz, Ranking Member Sinema, Members of the Subcommittee:

        Thank you for the opportunity to appear before you today to discuss
    the current state of aviation safety. On behalf of the United States
    Department of Transportation and the Federal Aviation Administration,
    we extend our deepest sympathy to the families of the victims of the
    recent Ethiopian Airlines accident, as well as the Lion Air accident.
        Safety is the core of the Federal Aviation Administration's mission
    and our top priority. With the support of this Committee, we have
    worked tirelessly to take a more proactive, data-driven approach to
    oversight that instills a safety above all approach inside the FAA and
    within the aviation community that we regulate. The result of this
    approach is that the United States has the safest air transportation
    system in the world. Since 1997, the risk of a fatal commercial
    aviation accident in the United States has been cut by 95 percent. And
    in the past ten years, there has only been one commercial airline
    passenger fatality in the United States in over 90 million flights. But
    a healthy safety culture requires commitment to continuous improvement.
        Our commitment to safety and fact-based, data-driven decision
    making has been the guiding principle in the FAA's response to the two
    fatal accidents involving the Boeing 737 MAX airplane outside the
    United States. Today, I would like to provide you with an overview of
    the FAA's certification and oversight processes, our current actions
    with respect to the 737 MAX, and the next steps that the FAA will take
    to foster safety enhancements here and abroad.
    The FAA is a Data-Driven Agency Focused on Safety
        As the aerospace system and its components become increasingly more
    complex, we know that our oversight approach needs to evolve to ensure
    that the FAA remains the global leader in achieving aviation safety. In
    order to maintain the safest air transportation system in the world,
    during the past two decades the FAA has been evolving from a
    prescriptive and more reactive approach for its safety oversight
    responsibilities to one that is performance-based, proactive, centered
    on managing risk, and focused on continuous improvement. A key part of
    this transition has been the adoption of safety management systems, or
    SMS, within the FAA. The evolution toward SMS began internally at the
    FAA more than 15 years ago, starting with the FAA's Air Traffic
    Organization and expanding across the FAA to include all of our lines
    of business. Consistent with recommendations of the International Civil
    Aviation Organization (ICAO), we have been working with industry
    towards implementation of SMS in various sectors. For example, as of
    March 9, 2018, scheduled commercial air carriers, regulated under 14
    CFR part 121, are required to have an SMS.
        Safety is not just a set of programs that can be ``established'' or
    ``implemented.'' It is a way of living and working, and it requires the
    open and transparent exchange of information. We know that it takes
    collaboration, communication, and common safety objectives to allow the
    FAA and the aviation community to come together, to identify system
    hazards, and to implement safety solutions. This approach gives us
    knowledge that we would not otherwise have about events and risks.
    Sharing safety issues, trends, and lessons learned is critical to
    recognizing whatever might be emerging as a risk in the system. The
    more data we have, the more we can learn about the system, which in
    turn allows us to better manage and improve the system.
        To be clear, the SMS approach does not diminish the FAA's role as a
    safety regulator. Any party that the FAA regulates remains responsible
    for compliance with the FAA's regulatory standards, and the FAA does
    not hesitate to take enforcement action when it is warranted.
    Aircraft Certification
        One of the FAA's core functions, aircraft certification, has always
    relied on the exchange of information and technical data. The FAA
    certifies the design of aircraft and components that are used in civil
    aviation operations. Some version of our certification process has been
    in place and served us well for over 60 years. This does not mean the
    process has remained static. To the contrary, since 1964, the
    regulations covering certification processes have been under constant
    review. As a result, the general regulations have been modified over 90
    times, and the rules applicable to large transport aircraft, like the
    Boeing 737 MAX, have been amended over 130 times. The regulations and
    our policies have evolved in order to adapt to an ever-changing
    industry that uses global partnerships to develop new, more efficient,
    and safer aviation products and technologies.
        The FAA focuses its efforts on areas that present the highest risk
    within the system. The FAA reviews the applicant's design descriptions
    and project plans, determines where FAA involvement will derive the
    most safety benefit, and coordinates its intentions with the applicant.
    When a particular decision or event is critical to the safety of the
    product or to the determination of compliance, the FAA is involved
    either directly or through the use of our designee system.
        The designee program was originally authorized by Congress in 1958
    and is critical to the success and effectiveness of the certification
    process. Under this program, the FAA may delegate a matter related to
    aircraft certification to a qualified private person. This is not self-
    certification; the FAA retains strict oversight authority. The program
    allows the FAA to leverage its resources through delegation. Last fall,
    Congress specifically directed the FAA to make full use of this
    authority in the FAA Reauthorization Act of 2018. In aircraft
    certification, both individual and organizational designees support the
    FAA. The FAA determines the level of involvement of the designees and
    the level of FAA participation needed based on many variables. These
    variables include the designee's understanding of the compliance
    policy; consideration of any novel or unusual certification areas; or
    instances where adequate standards may not be in place.
        The Organization Designation Authorization (ODA) program is the
    means by which the FAA may authorize an organization to act as a
    representative of the FAA, allowing that organization to conduct
    inspections and tests and issue certificates on behalf of the FAA.
    Currently, there are 79 ODA holders. ODA certification processes allow
    an applicant greater flexibility and control over schedules than
    applicants whose projects are directly managed by the FAA. The FAA has
    a rigorous process for issuing an ODA. ODA holders must have
    demonstrated experience and expertise in FAA certification processes, a
    qualified staff, and an FAA-approved procedures manual before they are
    appointed. The procedures manual defines an ODA holder's authority and
    limitations, and identifies the functions it may perform.
        The FAA determines its level of involvement on a project-by-project
    basis. There are many issues that will always require direct FAA
    involvement, including equivalent level of safety determinations, and
    rulemakings required to approve special conditions. The FAA may choose
    to be involved in other project areas after considering factors such as
    our confidence in the applicant, the applicant's experience, the
    applicant's internal processes, and confidence in the designees.
        Something that is not well understood about the certification
    process is that it is the applicant's responsibility to ensure that an
    aircraft conforms to FAA safety regulations. It is the applicant who is
    required to develop aircraft design plans and specifications, and
    perform the appropriate inspections and tests necessary to establish
    that an aircraft design complies with the regulations. The FAA is
    responsible for determining that the applicant has shown that the
    overall design meets the safety standards. We do that by reviewing data
    and by conducting risk-based evaluations of the applicant's work.
        The FAA is directly involved in the testing and certification of
    new and novel features and technologies. When a new design, or a change
    to an existing design, of aircraft is being proposed, the designer must
    apply to the FAA for a design approval. While an applicant usually
    works on its design before discussing it with the FAA, we encourage
    collaborative discussions well in advance of presenting a formal
    application. Once an applicant approaches us, a series of meetings are
    held both to familiarize the FAA with the proposed design, and to
    familiarize the applicant with the certification requirements. A number
    of formal and informal meetings are held on issues ranging from
    technical to procedural. Once the application is made, issue papers are
    developed to provide a structured way of documenting the resolution of
    technical, regulatory, and administrative issues that are identified
    during the process.
        Once the certification basis is established for a proposed design,
    the FAA and the applicant develop and agree to a certification plan and
    initial schedule. In order to receive a type certificate, the applicant
    must conduct an extensive series of tests and reviews to show that the
    product is compliant with existing standards and any special
    conditions, including lab tests, flight tests, and conformity
    inspections. These analyses, tests, and inspections happen at a
    component-level and an airplane-level, all of which are subject to FAA
    oversight. If the FAA finds that a proposed new type of aircraft
    complies with safety standards, it issues a type certificate. Or, in
    the case of a change to an existing aircraft design, the FAA issues an
    amended type certificate.
    Facts Concerning the Boeing 737 MAX
        The certification processes described above are extensive, well-
    established, and have consistently produced safe aircraft designs for
    decades. The Boeing Company has designed and built 14 variations of its
    original model 737 since the FAA issued the original type certificate
    in 1967. The FAA followed its standard procedures in determining that
    the 737 MAX project would qualify as an amended type certificate
    project, and identifying what items would be delegated to the Boeing
    ODA to approve and which would be retained by the FAA for approval.
    Boeing first applied for an amended type certificate for this aircraft
    in January 2012. As a result of regular meetings between the FAA and
    Boeing teams, the FAA determined in February 2012 that the project
    qualified as an amended type certificate project eligible for
    management by the Boeing ODA. The FAA was directly involved in the
    System Safety Review of the Maneuvering Characteristics Augmentation
    System (MCAS).
        The process from initial application to final certification took
    five years; the FAA added the 737 MAX to the 737 type certificate in
    March 2017. The process included 297 certification flight tests, some
    of which encompassed tests of the MCAS functions. FAA engineers and
    flight test pilots were involved in the MCAS operational evaluation
    flight test. The certification process was detailed and thorough, but,
    as is the case with newly certified products, time yields more data to
    be applied for continued analysis and improvement. As we obtain
    pertinent information, identify potential risk, or learn of a system
    failure, we analyze it, we find ways to mitigate the risk, and we
    require operators to implement the mitigation. And that is what has
    happened in the case of the 737 MAX.
    737 MAX Accidents and the Decision to Ground the Fleet
        On October 29, 2018, a Boeing 737 MAX operated by Lion Air as
    flight JT610 crashed after taking off from Soekarno-Hatta Airport in
    Jakarta, Indonesia. Flight JT610 departed from Jakarta with an intended
    destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20
    a.m. (local time), and crashed into the Java Sea approximately 13
    minutes later. One hundred and eighty-four passengers and five
    crewmembers were on board. There were no survivors. An Indonesian-led
    investigation into the cause of this accident is ongoing, supported by
    the National Transportation Safety Board (NTSB), FAA, and Boeing.
        On November 7, 2018, based on all available and relevant
    information, including evidence from the Lion Air accident
    investigation and analysis performed by Boeing, the FAA issued an
    Emergency Airworthiness Directive. The airworthiness directive requires
    operators of the 737 MAX to revise their flight manuals to reinforce to
    flight crews how to recognize and respond to uncommanded stabilizer
    trim movement and MCAS events. The FAA continued to evaluate the need
    for software and/or other design changes to the aircraft including
    operating procedures and training as additional information was
    received from the ongoing Lion Air accident investigation. On January
    21, 2019, Boeing submitted a proposed MCAS software enhancement to the
    FAA for certification. To date, the FAA has tested this enhancement to
    the 737 MAX flight control system in both the simulator and the
    aircraft. The testing, which was conducted by FAA flight test engineers
    and flight test pilots, included aerodynamic stall situations and
    recovery procedures. The FAA's ongoing review of this software
    installation and training is an agency priority, as will be the roll-
    out of any software, training, or other measures to operators of the
    737 MAX.
        On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing
    737 MAX, crashed at 8:44 a.m. (local time), six minutes after takeoff.
    The flight departed from Bole International Airport in Addis Ababa,
    Ethiopia with an intended destination of Nairobi, Kenya. The accident
    site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers
    and eight crewmembers were on board. None survived. An Ethiopian-led
    investigation into the cause of this accident is ongoing, supported by
    the NTSB, FAA, and Boeing.
        Following the second accident, the FAA gathered all of the data it
    had and continued to review information from the investigation as it
    became available. On March 11, 2019, the FAA issued a Continuous
    Airworthiness Notification to the International Community (CANIC) for
    737 MAX operators. The CANIC included a list of all of the activities
    the FAA had completed in support of the continued operational safety of
    the 737 MAX fleet. These activities included the airworthiness
    directive issued on November 7, 2018, ongoing oversight of Boeing's
    flight control system enhancements, and updated training requirements
    and flight crew manuals.
        After issuing the CANIC, the FAA continued to evaluate all
    available data and aggregate safety performance from operators and
    pilots of the 737 MAX, none of which provided any data to support
    grounding the aircraft. The FAA's initial review of flight safety data
    for U.S. operators showed no systemic performance issues and provided
    no basis to order grounding the aircraft. This review included analysis
    of recent Aviation Safety Reporting System reports that reference MCAS
    and/or controllability issues with the Boeing 737 MAX. In no case did
    the reporting party state that the problems experienced were due to the
    MCAS system. Also, at that time, other civil aviation authorities had
    not provided any data to the FAA that warranted action.
        On March 13, 2019, however, the Ethiopian Airlines investigation
    developed new information from the wreckage concerning the aircraft's
    configuration just after takeoff that, taken together with newly
    refined data from satellite-based tracking of the aircraft's flight
    path, indicated some similarities between the Ethiopian Airlines and
    Lion Air accidents that warranted further investigation of the
    possibility of a shared cause that needed to be better understood and
    addressed. Accordingly, the FAA made the decision to ground all 737 MAX
    airplanes operated by U.S. airlines or in U.S. territory pending
    further investigation, including examination of information from the
    aircraft's flight data recorders and cockpit voice recorders.
    Next Steps
        The FAA will continue to support the ongoing Lion Air and Ethiopian
    Airlines accident investigations, review the evidence and data
    obtained, and take immediate and appropriate action based on the facts.
    U.S. and international operators of the 737 MAX are relying on the FAA
    to get it right. I want to assure this Committee and everyone else
    concerned that the FAA will go wherever the facts lead us, in the
    interest of safety. The 737 MAX will return to service for U.S.
    carriers and in U.S. airspace only when the FAA's analysis of the facts
    and technical data indicate that it is appropriate. In our quest for
    continuous safety improvement, the FAA welcomes external review of our
    systems, processes, and recommendations. We will work with the newly
    established Special Committee to Review FAA's Aircraft Certification
    Process, cooperate fully with the Inspector General's review, and
    continue our work with the congressionally-mandated Safety Oversight
    and Certification Advisory Committee and ODA Expert Review Panel.
        As recent events have reminded us, aviation does not have borders
    or boundaries. The FAA is focused on continuous safety improvement here
    at home and internationally through our ongoing engagement with other
    civil aviation authorities and industry stakeholders throughout the
    world. Aviation remains the safest mode of transportation globally, and
    we promote this level of safety by sharing issues, trends, and lessons
    learned throughout the world. The United States is the gold standard in
    aviation safety. The FAA is resolute in its commitment to maintaining
    that standard.
        This concludes my prepared statement. I will be happy to answer
    your questions.

        Senator Cruz. Thank you.
        Mr. Sumwalt.

      STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL
                      TRANSPORTATION SAFETY BOARD

        Mr. Sumwalt. Thank you, Chairman Wicker, Chairman Cruz,
    Ranking Member Cantwell, Ranking Member Sinema, and Members of
    the Subcommittee.
        Thank you for allowing the NTSB to testify today about this
    very important topic.
        As you are well aware, in the past five months, there have
    been two crashes involving the Boeing 737 Max and tragically
    these two accidents have claimed 346 lives.
        My testimony this afternoon will focus on the NTSB's
    involvement with each of these crash investigations.
        Now unlike the NTSB's involvement in domestic aviation
    accidents where we have the statutory responsibility to
    investigate each and every accident that occurs in this
    country, our involvement with international investigations is
    vastly different.
        The NTSB's role in accidents outside the U.S. is governed
    by Annex 13 to the Convention on International Civil Aviation,
    to which 192 countries, including the U.S., are signatories.
        Annex 13 states that a safety investigation is to be led by
    the country in which the accident occurs, known as the state of
    occurrence. Thus, the National Transportation Safety Committee
    of Indonesia is leading the investigation into last year's Lion
    Air crash, and likewise the Ethiopia Accident Investigation
    Bureau is leading the investigation into this month's Ethiopian
    Airlines crash.
        When the accident involves a U.S.-operated or U.S.-
    registered aircraft or U.S.-designed or manufactured aircraft,
    as these aircraft were, the NTSB appoints an accredited
    representative. This is a highly skilled NTSB investigator
    whose purpose is to coordinate the input of all U.S. interests,
    including the NTSB, the FAA, and companies, such as
    manufacturers, and others that can provide technical
    assistance.
        It's important to note that the state of occurrence leads
    the investigation and controls the release of information from
    that investigation, not the NTSB.
        Although the state of occurrence is responsible for leading
    the investigation, NTSB participation in foreign accident
    investigations enables safety deficiencies to be promptly
    addressed by the FAA, the manufacturer, or the operator as well
    as through NTSB safety recommendations, when necessary.
        Following last year's Lion Air crash, we immediately
    dispatched investigators to Indonesia to participate in the
    Indonesian Government's investigation. An NTSB investigator was
    stationed onboard one of the search vessels to help identify
    recovered aircraft components.
        Once the cockpit voice recorder was recovered in January,
    we recalled four investigators who were furloughed during the
    partial government shutdown. Their role was to assist with the
    recorder download and analysis.
        We responded immediately to the Ethiopian Airlines crash by
    sending a team of investigators to Ethiopia and once the
    recorders were sent to our aviation counterparts in France, the
    BEA, we dispatched investigators to France to assist with the
    recorder download and readout.
        Because the U.S. is the state of design and certification
    of the Boeing 737, we are also examining the U.S. design
    certification process as part of our participation in these
    foreign-led investigations. As always, if we uncover safety
    deficiencies, we are poised to quickly issue safety
    recommendations.
        Now here at home, the scheduled passenger airlines have
    displayed a remarkable safety record over the past decade but
    as we know too well at the NTSB, complacency is an unforgiving
    enemy.
        My written testimony outlines other areas of NTSB aviation-
    related concerns which I've submitted for the record, and I'll
    be delighted to answer questions about those issues as well as
    the issue at hand.
        Thank you very much.
        [The prepared statement of Mr. Sumwalt follows:]

          Prepared Statement of Hon. Robert L. Sumwalt III, Chairman,
                      National Transportation Safety Board
        Good afternoon, Chairman Cruz, Ranking Member Sinema, and the
    Members of the Subcommittee. Thank you for inviting the National
    Transportation Safety Board (NTSB) to testify before you today.
        The NTSB is an independent Federal agency charged by Congress with
    investigating every civil aviation accident in the United States and
    significant accidents in other modes of transportation--highway, rail,
    marine, and pipeline. We determine the probable cause of the accidents
    we investigate, and we issue safety recommendations aimed at preventing
    future accidents. In addition, we conduct special transportation safety
    studies and special investigations and coordinate the resources of the
    Federal Government and other organizations to assist victims and their
    family members who have been impacted by major transportation
    disasters.
        Our Office of Aviation Safety investigates all civil domestic air
    carrier, commuter, and air taxi accidents; general aviation accidents;
    and certain public-use aircraft accidents, amounting to approximately
    1,400 investigations annually. We also participate in the investigation
    of major airline accidents in foreign countries that involve U.S.
    carriers, US-manufactured or -designed equipment, or US-registered
    aircraft.
        This testimony will provide information regarding our role in
    international investigations and our current participation in both
    recent accidents involving Boeing 737 MAX 8 (MAX 8) aircraft in
    Indonesia and Ethiopia. I will also address the state of aviation
    safety from the NTSB's perspective based on our investigations,
    including a description of safety issues we have identified and
    recommendations we have made, as well as a description of the work we
    are doing with emerging transportation technologies in aviation.
    Foreign Investigations of Boeing 737-MAX 8 Crashes
        The NTSB participates in the investigation of aviation accidents
    and serious incidents outside the United States in accordance with the
    Chicago Convention of the International Civil Aviation Organization
    (ICAO) and the Standards and Recommended Practices (SARPS) provided in
    Annex 13 to the Convention.\1\ If an accident or serious incident
    occurs in a foreign state involving a civil aircraft of U.S. Registry,
    a U.S. operator, or an aircraft of U.S. design or U.S. manufacture,
    where the foreign state is a signatory to the ICAO Convention, that
    state is responsible for the investigation and controls the release of
    all information regarding the investigation.
    ---------------------------------------------------------------------------
        \1\ ICAO is a UN specialized agency, which manages the
    administration and governance of the Convention on International Civil
    Aviation (Chicago Convention), (https://www.icao.int/about-icao/Pages/
    default.aspx).
    ---------------------------------------------------------------------------
        In accordance with the ICAO Annex 13 SARPS, upon receipt of a
    formal notification of the accident or serious incident that may
    involve significant issues, the NTSB may designate a U.S. Accredited
    Representative and appoint advisors to carry out the obligations,
    receive the investigative information and updates in accordance with
    the Annex, provide consultation, and receive safety recommendations
    from the state of occurrence. The advisors may include NTSB
    investigators with subject matter expertise, as well as others from
    U.S. manufacturers, operators, and the Federal Aviation Administration
    (FAA).
        The key objectives of our participation in international aviation
    accident investigations are to:

       Identify safety deficiencies affecting U.S. aviation
            interests;

       Capture safety lessons learned to prevent accidents in the
            US; and

       Enable credible and comprehensive accident investigations
            where U.S. interests are concerned.

        Given the international nature of air transportation and the
    leading role the United States plays in developing aviation
    technologies, our participation in foreign investigations is essential
    to enhancing aviation safety worldwide. In 2018, we appointed
    Accredited Representatives to 324 international investigations and
    traveled to support work on 17 of these investigations.\2\
    ---------------------------------------------------------------------------
        \2\ There were 202 accidents in 2018 where the NTSB appointed an
    Accredited Representative, 97 incidents, and 25 other safety-related
    occurrences. NTSB traveled in support of 8 of these accidents, 8
    incidents, and one safety-related occurrence.
    ---------------------------------------------------------------------------
        On October 29, 2018, a MAX 8, operated by Lion Air, crashed into
    the Java Sea shortly after takeoff from Soekamo-Hatta International
    Airport, in Jakarta, Indonesia. All 189 passengers and crew on board
    died. The National Transportation Safety Committee of Indonesia is
    leading the investigation and released a preliminary report on November
    27, 2018.\3\ On March 10, 2019, a MAX 8, operated by Ethiopian
    Airlines, crashed after takeoff from Addis Ababa Bole International
    Airport in Ethiopia. All 157 passengers and crew, including 8 American
    citizens, died. The investigation is being led by the Ethiopia Accident
    Investigation Bureau.
    ---------------------------------------------------------------------------
        \3\ National Transportation Safety Committee of Indonesia,
    Preliminary Report No. KNKT.18.10.35.04.
    ---------------------------------------------------------------------------
        Because the MAX 8 was designed and manufactured in the US, in
    accordance with ICAO Annex 13, the U.S. has a right to participate in
    both of these investigations. Accordingly, the NTSB appointed
    Accredited Representatives to assist both of the ongoing foreign
    investigations involving MAX 8 aircraft.
        Following last year's Lion Air crash, the NTSB immediately
    dispatched investigators to Indonesia to participate in the Indonesian
    government's investigation. During the search for the critical ``black
    boxes''--flight data recorder (FDR) and cockpit voice recorder (CVR)--
    an NTSB investigator was stationed onboard one of the search vessels.
    Once the CVR was recovered on January 14, 2019, NTSB recalled four
    investigators from furlough due to the partial government shutdown to
    assist with proper transcription of that recorder's content.\4\
    ---------------------------------------------------------------------------
        \4\ Due to lapse of appropriations from December 22, 2018, through
    January 25, 2019, the NTSB furloughed all investigative staff. In
    accordance with provisions of the Anti-Deficiency Act (including
    sections 1341(a)(1)(B) and 1342 of Title 31, United States Code),
    allowable agency functions were limited to those where ``failure to
    perform those functions would result in an imminent threat to the
    safety of human life or the protection of property.'' Due to the
    potential safety issues associated with the Lion Air crash, the NTSB
    responded by recalling from furlough four investigative staff to
    participate in the CVR readout.
    ---------------------------------------------------------------------------
        In response to the Ethiopian Airlines crash, the NTSB also
    appointed an Accredited Representative, and dispatched him with a team
    of investigators to Ethiopia. Furthermore, we sent recorder, flight
    crew operations and human factors investigators to France once the
    recorders were sent to the Bureau d'Enquetes et d'Analyses pour la
    Securite de l'Aviation Civile (BEA) for download and readout.
        Also in accordance with ICAO Annex 13, technical advisors from the
    FAA, Boeing, and General Electric have accompanied NTSB investigators
    to the Lion Air and Ethiopian Air accident sites to provide their
    specialized technical knowledge regarding the aircraft and its systems.
        Although the NTSB is actively involved in these investigations,
    ICAO Annex 13 requires that, as the states of occurrence, Indonesia and
    Ethiopia are responsible for their respective investigations. As such,
    they control the release of all investigative information related to
    those accidents. Although the state of occurrence is responsible for
    leading the investigation, NTSB participation in foreign accident
    investigations enables safety deficiencies to be promptly addressed by
    the FAA, the manufacturer, or the operator, as well as through NTSB
    safety recommendations when necessary. As the state of design and
    certification of the aircraft involved in these accidents, we are
    examining the U.S. design certification process to ensure any
    deficiencies are captured and addressed, potentially up to and
    including NTSB safety recommendations.
    Commercial Aviation Safety in the United States
        For the last decade, the U.S. aviation system has experienced a
    record level of safety, and an overall decline in the number of US-
    registered civil aviation accidents.\5\ Aviation deaths in the United
    States decreased from 412 in 2016 to 350 in 2017. Nearly 94 percent of
    aviation fatalities (330 instances in 2017) occur in general aviation
    accidents, with the remainder primarily in Title 14 Code of Federal
    Regulations (CFR) Part 135 operations, which includes charters, air
    taxis, and air medical services flights. Until 2018, there had been no
    passenger fatalities as a result of accidents involving U.S. air
    carriers operating under the provisions of 14 CFR Part 121 since the
    crash of Colgan Air flight 3407 in 2009.\6\ Over the last several
    decades, significant advances in technology, important legislative and
    regulatory changes, and more comprehensive crew training have
    contributed to the current level of aviation safety. Following the
    Colgan Air crash, in 2010 Congress required FAA to make substantive
    regulatory changes addressing airline pilot fatigue, as well as airline
    pilot qualifications; FAA pilot records; airline flight crew and
    dispatcher training; FAA oversight and surveillance of air carriers;
    pilot mentoring, professional development and leadership; and flight
    crewmember pairing and crew resource management techniques.\7\ There
    are still provisions related to NTSB recommendations from our
    investigation of flight 3407 that have not been implemented, such as
    the creation of a pilot training records database. We continue to see
    accidents and incidents that remind us of the need to be ever-vigilant
    in improving safety.
    ---------------------------------------------------------------------------
        \5\ National Transportation Safety Board, 2017 preliminary aviation
    statistics. Accident data for calendar year 2018 are still being
    validated and have not yet been released.
        \6\ National Transportation Safety Board, Loss of Control on
    Approach, Colgan Air, Inc., Operating as Continental Connection Flight
    3407, Bombardier DHC 8 400, N200WQ, Rpt. No. AAR-10/01 (Washington, DC:
    NTSB, 2012). In 2013, there were two fatal accidents involving
    nonscheduled cargo flights operating under Part 121--National Air Cargo
    crash after takeoff at Bagram Air Base, Afghanistan, and United Parcel
    Service flight 1354 crash during approach in Birmingham, Alabama.
        \7\ The Airline Safety and Federal Aviation Administration
    Extension Act of 2010 (Pub. L. 111-216). Congressional Research
    Service, Federal Civil Aviation Programs: In Brief, R42781.
    ---------------------------------------------------------------------------
    Most Wanted List--Improve the Safety of Part 135 Aircraft Flight
            Operations
        On February 4, 2019, we announced our Most Wanted List of
    Transportation Safety Improvements for 2019-2020.\8\ This list
    identifies 10 focus areas for transportation safety improvements based
    on safety issues identified through our investigations. Many of the
    issues on the Most Wanted List address multimodal challenges for
    improving safety, including many that have been identified in some of
    our aviation accident investigations, such as alcohol and other drug
    impairment, distraction, occupant protection, fatigue, medical fitness,
    and safe shipment of hazardous materials. One issue area is specific to
    aviation: improving the safety of Part 135 aircraft flight operations.
    ---------------------------------------------------------------------------
        \8\ National Transportation Safety Board, 2019-2020 Most Wanted
    List.
    ---------------------------------------------------------------------------
        Regardless of the purpose of the flight or the type of aircraft,
    all passenger-carrying flights should be safe. However, currently, air
    medical service, air taxi, charter, and on-demand operators are not
    required to meet some of the same safety requirements as commercial
    airline operators. On March 12, 2019, the NTSB issued three new safety
    recommendations and reiterated six previous safety recommendations to
    the FAA as a result of the investigation of an accident that occurred
    on May 15, 2017, in Teterboro, New Jersey.\9\ In this accident, a
    Learjet 35A, operated by a Part 135 operator, departed controlled
    flight while on a circling approach to Teterboro Airport, and impacted
    a commercial building and parking lot. The pilot-in-command and the
    second-in-command died; there were no passengers on the aircraft and no
    one on the ground was injured. While the aircraft was operating as a
    Part 91 positioning flight at the time of the accident, the accident
    raised concerns about the safety of Part 135 operations and the need
    for effective flight data monitoring (FDM) programs, safety management
    systems (SMS), procedures to identify pilots who do not comply with
    standard operating procedures, programs to address pilots with
    performance deficiencies, and the need for enhanced guidance for crew
    resource management training and leadership training for upgrading
    captains.
    ---------------------------------------------------------------------------
        \9\ National Transportation Safety Board, Departure From Controlled
    Flight, Trans-Pacific Air Charter, LLC, Learjet 35A, N452DA, Teterboro,
    New Jersey (Abstract), Rpt. No. AAR-19/02 (Washington, D.C.: NTSB,
    2019)
    ---------------------------------------------------------------------------
        The safety issues identified in the Teterboro accident were not
    new; the NTSB previously identified these issues and made
    recommendations to address FDM equipment and programs and SMS as a
    result of the investigation of the November 10, 2015, crash of
    Execuflight flight 1526 in Akron, Ohio.\10\ The recommendations were
    reiterated following the October 26, 2016, crash of Ravn Connect flight
    3153 in Togiak, Alaska, and we have again reiterated these important
    recommendations.\11\ A list of the safety recommendations we have made
    regarding these operations is appended to this testimony.
    Implementation of these and other recommendations could prevent or
    mitigate many of the Part 135 crashes that the NTSB investigates, and
    that is why improving the safety of Part 135 aircraft operations is
    included on the Most Wanted List.
    ---------------------------------------------------------------------------
        \10\ National Transportation Safety Board, Crash During
    Nonprecision Instrument Approach to Landing, Execuflight Flight 1526,
    British Aerospace HS 125-700A, N237WR, Rpt. No. AAR 16/02 (Washington,
    D.C.: NTSB 2016).
        \11\ National Transportation Safety Board, Collision with Terrain,
    Hageland Aviation Services, Inc., dba Ravn Connect Flight 3153, Cessna
    208B, N208SD, Rpt. No. AAR 18/02 (Washington, D.C.: NTSB 2018).
    ---------------------------------------------------------------------------
    Most Wanted List--Reduce Fatigue-Related Accidents
        Fatigue is a pervasive problem in transportation that degrades a
    person's ability to stay awake, alert, and attentive to the demands of
    safely controlling a vehicle, vessel, aircraft, or train. By including
    ``Reduce Fatigue-Related Accidents'' on our Most Wanted List, we are
    calling for a comprehensive approach to combatting fatigue in
    transportation, focusing on research, education, and training;
    technology; sleep disorder treatment; hours-of-service regulations; and
    on-and off-duty scheduling policies and practices.
        Over the last 20 years, NTSB has investigated many air carrier
    accidents involving fatigued flight crews, including Colgan Air flight
    3407. As a result of that investigation, we recommended that the FAA
    require operators to address fatigue risks associated with
    commuting.\12\ The FAA's final rule for Fatigue Risk Management Plans
    for Part 121 Air Carriers did not address this recommendation. In 2006,
    we issued a safety recommendation to the FAA as a result of our
    investigation of the October 19, 2004 aviation crash in Kirksville,
    Missouri, to ``Modify and simplify the flight crew hours-of-service
    regulations to take into consideration factors such as length of duty
    day, starting time, workload and other factors shown by recent
    research, scientific evidence, and current industry experience to
    affect crew alertness.'' \13\ On January 4, 2012, the FAA published a
    final rule which prescribed new flight-and duty-time regulations for
    all flight crewmembers and certificate holders conducting passenger
    operations under Part 121, but excluded operators who conduct cargo
    operations.\14\ The NTSB disagrees with this exclusion, as many of the
    fatigue-related accidents that we have investigated over the years
    involved cargo operators. We also believe that, because of the time of
    day that cargo operations typically occur, such operations are in
    greater need of these requirements. The NTSB believes that the FAA
    should include all Part 121, including cargo operations, under these
    requirements.
    ---------------------------------------------------------------------------
        \12\ National Transportation Safety Board, Safety Recommendation A-
    10-016.
        \13\ National Transportation Safety Board, Collision with Trees and
    Crash Short of the Runway, Corporate Airlines Flight 5966 BAE Systems
    BAE-J3201, N875JX Kirksville, Missouri, Rpt. No. AAR-06/01 (Washington,
    D.C.: NTSB, 2006. Safety Recommendation A-06-010.
        \14\ Federal Aviation Administration, Flightcrew Member Duty and
    Rest Requirements, 14 CFR Parts 117, 119, and 121.
    ---------------------------------------------------------------------------
    Current Part 121 Investigations
        The NTSB is currently investigating two fatal accidents involving
    Part 121 operations.

        Southwest Flight 1380 Engine Failure--Philadelphia, Pennsylvania

        On April 17, 2018, Southwest Airlines flight 1380, a Boeing 737-
    700, experienced a failure of the left engine after departing New
    York's LaGuardia Airport.\15\ A fan blade in the left engine failed,
    which resulted in the loss of the engine inlet and cowling. Fragments
    from the cowling and engine inlet struck the fuselage and a window,
    causing a rapid depressurization. The crew conducted an emergency
    descent and diverted to Philadelphia International Airport. There were
    144 passengers and five crewmembers onboard. One passenger was fatally
    injured and eight passengers had minor injuries.
    ---------------------------------------------------------------------------
        \15\ National Transportation Safety Board, Southwest Airlines
    Engine Accident.
    ---------------------------------------------------------------------------
        On November 14, 2018, the NTSB held an investigative hearing to
    obtain more information regarding the engine fan blade design and
    development history, engine fan blade inspection methods and
    procedures, and engine fan blade containment design and certification
    criteria.\16\ The investigation into this accident is ongoing.
    ---------------------------------------------------------------------------
        \16\ National Transportation Safety Board, Investigative Hearing:
    CFM International engine failure on Southwest Airlines flight 1380.
    ---------------------------------------------------------------------------

                  Atlas Air Flight 3591 Crash--Baytown, Texas

        On February 23, 2019, Atlas Air flight 3591, a Boeing 767-375BCF,
    entered a rapid descent from 6,000 feet and crashed into Trinity Bay,
    about 40 miles southeast of its intended destination, George Bush
    Intercontinental Airport, in Houston, Texas.\17\ The two pilots and one
    nonrevenue jumpseat pilot were killed, and the airplane was highly
    fragmented after impact. The flight was being operated as a Part 121
    domestic cargo flight, which originated from Miami International
    Airport.
    ---------------------------------------------------------------------------
        \17\ National Transportation Safety Board, Atlas Air #3591 crashed
    into Trinity Bay.
    ---------------------------------------------------------------------------
        Based on data from the cockpit voice recorder, the flight data
    recorder, radar data, and other sources, the flight was normal from
    Miami to the Houston terminal area. As the flight approached Houston,
    the pilots were advised of an area of light to heavy precipitation
    along the flight route and that they could expect vectors around the
    weather. About one minute before the crash, data indicated some small
    vertical accelerations during descent. Shortly after, the engine thrust
    increased to maximum thrust, and the airplane pitched nose up. The
    airplane then pitched nose down over the next 18 seconds in response to
    nose-down elevator deflection. The stall warning (stick shaker) did not
    activate. Data indicated that the airplane entered a rapid descent,
    reaching an airspeed of about 430 knots. A security camera video
    captured the airplane in a steep, generally wings-level attitude until
    impact with the bay. The investigation into this accident is ongoing.
    Emerging Transportation Technologies
        Advances in technology are transforming transportation and hold
    promise for improving transportation safety, but they also pose new
    challenges. Among those advancing technologies are commercial space
    transportation and unmanned aircraft systems (UASs).
    Commercial Space
        We have been involved in commercial space accident investigations
    for over 25 years, since leading the investigation of a procedural
    anomaly associated with the launch of an Orbital Sciences Corporation
    Pegasus expendable launch vehicle in 1993.\18\ Most recently, we led
    the investigation of the fatal in-flight breakup of SpaceShipTwo in
    October 2014.\19\ Foremost among the safety issues identified in the
    2014 accident was the need to consider and protect against human error
    for safe manned spaceflight, which is the responsibility of designers,
    operators, and regulators. We made recommendations to the FAA and the
    commercial spaceflight industry to establish human factors guidance for
    commercial space operators and to strengthen the FAA's evaluation
    process for experimental permit applications by promoting stronger
    collaboration between FAA technical staff and commercial space vehicle
    operators.
    ---------------------------------------------------------------------------
        \18\ National Transportation Safety Board, Commercial Space Launch
    Incident, Launch Procedure Anomaly, Orbital Sciences Corporation,
    Pegaus/SCD-1, Rpt. No. SIR 93/02 (Washington, D.C.: NTSB 1993).
        \19\ National Transportation Safety Board. In-Flight Breakup During
    Test Flight, Scaled Composites SpaceShipTwo, N339SS, Near Koehn Dry
    Lake, California, October 31, 2014, Rpt. No. AAR 15/02 (Washington,
    D.C.: NTSB 2015).
    ---------------------------------------------------------------------------
        Our work in commercial space transportation supports our broader
    mission of improving transportation safety through investigating
    accidents and serious incidents, collaborating with others to conduct
    outreach and education related to commercial space vehicles, and
    developing and disseminating accident investigation techniques in
    commercial space within the international community. To develop and
    maintain the necessary investigative expertise and tools in this
    emerging segment of transportation, we are focused on training for NTSB
    staff and continuing outreach with commercial space stakeholders.
    Unmanned Aircraft Systems
        The growing number of UASs and reports of near-collisions with
    manned aircraft have raised safety concerns regarding UAS integration
    into the national airspace system. In August 2010, we revised our 14
    CFR Part 830 regulations to indicate that accident and incident
    notification requirements also apply to unmanned aircraft.\20\ An
    advisory to operators was released in July 2016 clarifying the
    reporting requirements (i.e., if there is death or serious injury, the
    aircraft weighs more than 300 pounds and sustains substantial damage,
    or other specific serious incidents occur).\21\
    ---------------------------------------------------------------------------
        \20\ 49 CFR Sec. 830.2 (2010).
        \21\ National Transportation Safety Board, Advisory to Operators of
    Civil Unmanned Aircraft Systems in the United States, July 29, 2016.
    ---------------------------------------------------------------------------
        On September 21, 2017, the pilot of a U.S. Army UH-60 helicopter
    reported an in-flight collision with a small UAS just east of Midland
    Beach, Staten Island, New York. The helicopter sustained damage to its
    main rotor blade, window frame, and transmission deck. We determined
    that the probable cause of the incident was the failure of the UAS
    pilot to see and avoid the helicopter due to his intentional flight
    beyond visual line of sight. Contributing to the incident was the UAS
    pilot's incomplete knowledge of regulations and safe operating
    practices.\22\ As the number and complexity of UAS operations continues
    to grow, it is inevitable that the number of NTSB UAS investigations
    will also increase.
    ---------------------------------------------------------------------------
        \22\ National Transportation Safety Board, Inflight collision of
    UAS and helicopter, Staten Island, NY.
    ---------------------------------------------------------------------------
        We are also using UASs as an accident investigation tool in all
    modes. The NTSB appreciates this Committee's and Congress' support of a
    provision in our 2018 reauthorization that authorized the agency to
    acquire small UASs for investigative purposes.\23\ UASs are rapidly
    becoming a standard tool in the domestic and international accident
    investigation community. Small UASs can be very rapidly deployed, which
    allows wreckage fields to be documented quickly and thoroughly when the
    accident area must be cleared expeditiously for safety or operational
    purposes. In addition, small UASs can access unique points of view
    useful to the investigator as well as areas otherwise inaccessible.
    Data collected is shared immediately, allowing investigators, managers,
    and support staff in distant locations instant access to accident site
    information in order to help focus the investigation on critical
    aspects of the accident.
    ---------------------------------------------------------------------------
        \23\ 49 USC Sec. 1113(b)(1)(J) (2018).
    ---------------------------------------------------------------------------
    Conclusion
        Thank you again for the opportunity to be here today to discuss the
    work that the NTSB is doing to make transportation safer. I will be
    happy to answer any questions.
                                     ______

      Appendix to NTSB Chairman Sumwalt's Testimony Concerning Commercial
      Aviation Safety--Recommendations to Improve the Safety of Part 135
                           Aircraft Flight Operations
    A-10-029 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require Title 14 Code of Federal Regulations Part 121,
    135, and 91K operators to (1) routinely download and analyze all
    available sources of safety information, as part of their flight
    operational quality assurance program, to identify deviations from
    established norms and procedures; (2) provide appropriate protections
    to ensure the confidentiality of the deidentified aggregate data; and
    (3) ensure that this information is used for safety-related and not
    punitive purposes.

    A-13-012 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require the installation of a crash-resistant flight
    recorder system on all newly manufactured turbine-powered,
    nonexperimental, nonrestricted-category aircraft that are not equipped
    with a flight data recorder and a cockpit voice recorder and are
    operating under Title 14 Code of Federal Regulations Parts 91, 121, or
    135. The crash-resistant flight recorder system should record cockpit
    audio and images with a view of the cockpit environment to include as
    much of the outside view as possible, and parametric data per aircraft
    and system installation, all as specified in Technical Standard Order
    C197, ``Information Collection and Monitoring Systems.''

    A-13-013 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require all existing turbine-powered, nonexperimental,
    nonrestricted-category aircraft that are not equipped with a flight
    data recorder or cockpit voice recorder and are operating under Title
    14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted
    with a crash-resistant flight recorder system. The crash-resistant
    flight recorder system should record cockpit audio and images with a
    view of the cockpit environment to include as much of the outside view
    as possible, and parametric data per aircraft and system installation,
    all as specified in Technical Standard Order C197, ``Information
    Collection and Monitoring Systems.''

    A-15-007 Open--Unacceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require that all existing aircraft operated under Title
    14 Code of Federal Regulations (CFR) Part 121 or 135 and currently
    required to have a cockpit voice recorder and a flight data recorder be
    retrofitted with a crash-protected cockpit image recording system
    compliant with Technical Standard Order TSOC176a, ``Cockpit Image
    Recorder Equipment,'' TSO-C176a or equivalent. The cockpit image
    recorder should be equipped with an independent power source consistent
    with that required for cockpit voice recorders in 14 CFR 25.1457.

    A-15-008 Open--Unacceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require that all newly manufactured aircraft operated
    under Title 14 Code of Federal Regulations (CFR) Part 121 or 135 and
    required to have a cockpit voice recorder and a flight data recorder
    also be equipped with a crash-protected cockpit image recording system
    compliant with Technical Standard Order TSO-C176a, ``Cockpit Image
    Recorder Equipment,'' or equivalent. The cockpit image recorder should
    be equipped with an independent power source consistent with that
    required for cockpit voice recorders in 14 CFR 25.1457.

    A-16-034 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part
    135 operators to install flight data recording devices capable of
    supporting a flight data monitoring program.

    A-16-035 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION
    ADMINISTRATION: After the action in Safety Recommendation A-16-34 is
    completed, require all Title 14 Code of Federal Regulations Part 135
    operators to establish a structured flight data monitoring program that
    reviews all available data sources to identify deviations from
    established norms and procedures and other potential safety issues.

    A-16-036 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part
    135 operators to establish safety management system programs.

    A-17-035 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Implement ways to provide effective terrain awareness
    and warning system (TAWS) protections while mitigating nuisance alerts
    for single-engine airplanes operated under Title 14 Code of Federal
    Regulations Part 135 that frequently operate at altitudes below their
    respective TAWS class design alerting threshold.

    A-17-038 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Expand the application of Federal Aviation
    Administration Order 8900.1, volume 3, chapter 19, section 6, ``Safety
    Assurance System: Flight Training Curriculum Segments,'' paragraphs 3-
    1251(B) and 3-1252, which address controlled flight into terrain-
    avoidance training programs for Title 14 Code of Federal Regulations
    (CFR) Part 135 helicopter operations, to all 14 CFR Part 135
    operations.

    A-18-013 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Although controlled flight into terrain (CFIT)-
    avoidance training programs are not required by Federal regulation for
    Title 14 Code of Federal Regulations Part 135 fixed-wing operations,
    work with Part 135 operators in Alaska to improve any voluntarily
    implemented training programs aimed at reducing the risk of CFIT
    accidents involving continuation of flight under visual flight rules
    (VFR) into instrument meteorological conditions, with special attention
    paid to the human factors issues identified in recent Alaska accident
    investigations, including, but not limited to, (1) the challenges of
    flying in mountainous terrain in Alaska and low-altitude VFR flight in
    an area subject to rapid changes in weather; and (2) limitations of the
    Alaska infrastructure, particularly weather observations,
    communications, and navigation aids.

    A-18-014 Open--Acceptable Response TO THE FEDERAL AVIATION
    ADMINISTRATION: Work with Title 14 Code of Federal Regulations Part 135
    certificate holders that operate under visual flight rules in the
    aircraft's required terrain awareness and warning system (TAWS) class
    to (1) ensure that management and pilots are aware of the risks
    associated with distraction (from continuous nuisance alerts) and
    complacency (brought about by routine use of the terrain inhibit
    feature); (2) develop plans for mitigating those risks and minimizing
    nuisance alerts; and (3) develop procedures that specifically address
    when pilots should test, inhibit, and uninhibit the TAWS alerts,
    considering the operator's typical operations and the TAWS
    manufacturer's guidance.

    A-18-017 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
    Ensure that Alaska airports that are served by Title 14 Code of Federal
    Regulations (CFR) Part 135 operators and have instrument approaches are
    equipped with weather-reporting capabilities to enable instrument
    flight rules operations in accordance with 14 CFR 135.225(a).

    A-19-007 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
    Require all Title 14 Code of Federal Regulations Part 135 operators to
    establish programs for flight crewmembers who have demonstrated
    performance deficiencies or experienced failures during training and
    administer additional oversight and training to address and correct
    performance deficiencies.

    A-19-008 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
    Develop guidance for Title 14 Code of Federal Regulations Part 135
    operators to help them create and implement effective crew resource
    management training programs.

        Senator Cruz. Thank you.
        Mr. Scovel.

    STATEMENT OF HON. CALVIN L. SCOVEL III, INSPECTOR GENERAL, U.S.
                      DEPARTMENT OF TRANSPORTATION

        Mr. Scovel. Chairman Wicker, Ranking Member Cantwell,
    Chairman Cruz, Ranking Member Sinema, Members of the
    Subcommittee, thank you for inviting me to testify on the
    Federal Aviation Administration's Oversight of Commercial
    Aviation.
        As you know, FAA is charged with safely overseeing the
    busiest and most complex aviation system in the world. Yet
    recent accidents highlight important concerns about FAA's
    safety oversight. Most notable are the two devastating crashes
    of Boeing 737 Max 8 aircraft in Indonesia and Ethiopia.
        In addition, last April, a Southwest Airlines engine
    failure resulted in the first passenger fatality at a U.S. air
    carrier in over 9 years.
        On behalf of the Office of Inspector General, we grieve the
    victims of these accidents and express our deep condolences to
    their families.
        Secretary Elaine L. Chao, along with several Members of
    Congress, including Senator Blumenthal, recently requested that
    my office audit FAA's certification process for the Max 8
    aircraft. We appreciate the Secretary's and your continued
    confidence in our independence and objectivity. We have already
    begun this work and will keep you informed on our results.
        Today, my statement will focus on our recent and ongoing
    work related to a number of important aviation safety
    challenges.
        First, FAA must take steps to reduce hazards associated
    with flight deck automation. Pilots now rely on automated
    flight systems as much as 90 percent of the time. While
    airlines have long used automation safely, FAA is responsible
    for ensuring air carriers meet requirements for these systems.
    This includes ensuring pilots are trained, tested, and
    proficient in the use of automation.
        Notably, FAA now requires U.S. commercial pilots to be
    trained in how to respond to abnormal flight conditions, such
    as recovering from a stall or other unexpected event. Air
    carriers should have implemented these requirements earlier
    this month. Providing effective oversight of this training will
    be vital to maintain the margin of safety.
        Second, FAA must remain vigilant as its systems and
    strategies for safety oversight evolve. Over the years, FAA has
    increasingly shifted toward working with industry to meet
    shared safety goals.
        For example, FAA now delegates more of its aircraft
    certification to approved manufacturers through its
    congressionally authorized Organization Designation
    Authorization Program or ODA.
        However, my office has identified weaknesses with FAA's
    oversight of ODA. For example, in 2015, we reported that its
    oversight was not based on risk. In response to our
    recommendations, FAA plans to revamp its ODA oversight process
    by the end of July 2019. Sustained management attention will
    remain essential to ensure that ODA companies comply with
    safety regulations.
        In addition, FAA now requires air carriers to play a larger
    role in identifying and mitigating safety risks. For example,
    in 2015, FAA required U.S. commercial carriers to establish
    safety management systems to proactively manage risks.
        However, recent events, including last year's Southwest
    engine failure, have raised concerns that FAA's oversight may
    not ensure that carriers meet their responsibilities under
    these systems.
        FAA also introduced its new Compliance Program in 2015. The
    program calls for FAA to work with air carriers to address the
    root causes of safety violations rather than imposing
    enforcement actions. This is a significant change in the way
    FAA and the carriers conduct business.
        As it works to leverage both collaboration and enforcement,
    FAA must be able to accurately assess whether an air carrier is
    willing and able to take timely corrective actions.
        Finally, I want to note other critical safety areas that
    require FAA's attention. For example, FAA must continue its
    work to reduce safety risks in the air and on the ground at
    airports, including preventing near-misses on the runway.
        In addition, FAA faces challenges in safely integrating
    unmanned aircraft systems in the same airspace as manned
    aircraft. Furthermore, FAA must protect its flight-critical and
    safety-critical IT systems from a growing number of cyber
    threats, and, last, FAA can do more to ensure essential
    aircraft parts, such as landing gear, meet safety standards by
    carefully implementing the Suspected Unapproved Parts program.
        As always, my office remains committed to supporting FAA
    and the Secretary as they work to maintain aviation safety and
    protect the traveling public.
        This concludes my prepared statement. I'd be happy to
    answer any questions you or members of the Subcommittee may
    have.
        [The prepared statement of Mr. Scovel follows:]

      Prepared Statement of Hon. Calvin L. Scovel III, Inspector General,
                       U.S. Department of Transportation

                     Perspectives on Overseeing the Safety
                     of the U.S. Air Transportation System

        Chairman Cruz, Ranking Member Sinema, and Members of the
    Subcommittee:

        Thank you for inviting me to testify on the state of aviation
    safety and the Federal Aviation Administration's (FAA) oversight of
    commercial aviation. FAA is charged with safely overseeing the busiest
    and most complex air transportation system in the world, which carries
    over 2.5 million people on approximately 45,000 flights every day.
    However, recent events have brought new attention to FAA's safety
    oversight and its regulatory role. Most notable are the two fatal
    accidents involving Boeing 737 MAX 8 aircraft that occurred in October
    2018 and earlier this month. The Office of Inspector General expresses
    our deepest condolences to the families of the victims of these
    accidents. A number of other incidents have also raised safety
    concerns. These include the April 2018 Southwest Airlines engine
    failure--which resulted in the first fatality at a U.S. commercial
    passenger air carrier \1\ in over 9 years--and several safety incidents
    at airports, such as the near miss of an Air Canada Flight in San
    Francisco in July 2017.
    ---------------------------------------------------------------------------
        \1\ This was the first passenger fatality at a part 121 air carrier
    since February 12, 2009 (14 CFR Part 121, Operating Requirements:
    Domestic, Flag, and Supplemental Operations).
    ---------------------------------------------------------------------------
        As Secretary of Transportation Elaine L. Chao has stated, safety is
    and must remain the Department's top priority. Last week, Secretary
    Chao requested that our office audit the activities that resulted in
    the certification of the Boeing 737 MAX 8 aircraft. In addition, we
    have received requests from Congress to examine other related issues,
    including FAA's decision-making process that led to grounding the MAX 8
    aircraft in the United States. My office has already begun this work
    and will keep you apprised of our results.
        As the Nation's regulator of aviation safety, FAA is responsible
    for effectively overseeing a vast range of safety-critical areas. To
    its credit, FAA has taken steps in recent years to help its safety
    efforts keep pace with a rapidly evolving and diverse aviation
    industry. Yet, as my office's work has shown, both new and longstanding
    safety issues present significant challenges to FAA's oversight of the
    National Airspace System (NAS).
        My testimony today will focus on FAA's efforts related to (1)
    reducing hazards associated with flight deck automation, (2)
    implementing FAA and industry's evolving safety oversight systems, and
    (3) addressing other safety-critical watch items.
    Summary
        Notwithstanding the Nation's safety record, important safety
    issues--both new and longstanding--need FAA's attention. First, with
    pilots relying on automated flight systems as much as 90 percent of the
    time, it is critical that FAA ensure that air carriers meet its
    requirements for these systems, including training pilots on how to
    respond to abnormal flight conditions when automation or other systems
    fail. Second, FAA faces new challenges as its systems and strategies
    for safety oversight evolve and air carriers take on a larger role in
    identifying and mitigating safety risks. To maintain the highest level
    of safety, FAA must implement effective risk-based oversight of
    organizations that perform certification work on the Agency's behalf,
    effectively leverage collaboration and enforcement, and maintain a
    strong safety culture. At the same time, our recent and ongoing work
    has also identified other watch areas that are essential to enhancing
    oversight of the NAS. These include reducing safety risks on the ground
    and in the air at airports, integrating Unmanned Aircraft Systems (UAS)
    in the same airspace as manned aircraft, protecting safety-critical
    information technology systems, and eliminating suspected unapproved
    parts from the aviation supply chain.
    Strengthening FAA Oversight To Reduce Hazards Associated With Flight
            Deck Automation
        Advances in aircraft automation have significantly contributed to
    safety and changed the way airline pilots perform their duties. Rather
    than manually flying an aircraft, pilots now monitor flight deck
    systems. Generally, new automation technologies are added to gain
    operational or efficiency advantages, such as reducing pilot workload,
    adding more capability, increasing fuel economy, and allowing access to
    airports surrounded by challenging terrain. FAA has estimated that
    automation is used 90 percent of the time in flight.\2\ Figure 1 below
    shows the advances in flight deck technology between the Boeing 737-200
    (pictured left) and 737 MAX 8 aircraft (pictured right).
    ---------------------------------------------------------------------------
        \2\ Estimates according to FAA senior officials, as noted in our
    2016 report (see footnote 2).

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    ---------------------------------------------------------------------------
        Source: Copyright  Boeing

        While airlines have long used automation safely, our 2016 report
    \3\ noted accidents in which pilots who typically fly with automation
    made errors when confronted with an unexpected event or transitioning
    to manual flying.\4\ As a result, reliance on automation is a growing
    concern among industry experts, who have questioned whether pilots
    receive enough training and experience to maintain manual flying
    proficiency. In addition, preliminary reports on the recent Boeing 737
    MAX 8 accidents have suggested a possible link to one of the aircraft's
    automation systems, raising concerns about pilots' abilities to
    recognize and react to unexpected events.
    ---------------------------------------------------------------------------
        \3\ Enhanced FAA Oversight Could Reduce Hazards Associated With
    Increased Use of Flight Deck Automation (OIG Report No. AV2016013),
    January 7, 2016. Requested by the Ranking Members of the House
    Committee on Transportation and Infrastructure and its Subcommittee on
    Aviation. OIG reports as well as the current status of our
    recommendations are available at http://www.oig.dot.gov/.
        \4\ For example, in July 2013, Asiana Airlines Flight 214 crashed
    short of a runway at San Francisco International Airport. The National
    Transportation Safety Board determined that the crew did not
    appropriately understand the aircraft's automation systems, allowed
    airspeed to decay due to improper monitoring, and failed to perform a
    proper go-around response.
    ---------------------------------------------------------------------------
        As shown in table 1, pilots' use of automation may range from none
    to high. While no single level of automation is appropriate for all
    flight environments, pilots must understand automated systems and make
    appropriate decisions when encountering unusual situations, such as
    when automation fails or an emergency arises.

                                        Table 1. Levels of Flight Deck Automation
    ----------------------------------------------------------------------------------------------------------------
                                      Auto-pilot a
                Level                   Engaged       Auto-throttle b Engaged                 Overview
    ----------------------------------------------------------------------------------------------------------------
    Full Auto-flight                               X                        X  The aircraft's control is fully
                                                                                automated based on information
                                                                                preprogrammed by the pilots.
    ----------------------------------------------------------------------------------------------------------------
    Tactical Auto-flight                           X                        X  The aircraft's autopilot is engaged,
                                                                                but pilots can direct changes to
                                                                                heading, speed, and altitude using a
                                                                                control panel.
    ----------------------------------------------------------------------------------------------------------------
    Manual                                                                  X  The pilot is manually controlling the
                                                                                aircraft based on guidance
                                                                                assistance from the preprogrammed
                                                                                flight directors. This is primarily
                                                                                used for takeoff, initial departure,
                                                                                and landings.
    ----------------------------------------------------------------------------------------------------------------
    All Automation Off/Full                                                    The pilot is manually controlling the
     Manual                                                                     aircraft without the assistance of
                                                                                flight directors. This would be used
                                                                                to avoid collisions with other
                                                                                aircraft or to recover from an
                                                                                undesired aircraft state such as a
                                                                                stall.
    ----------------------------------------------------------------------------------------------------------------
    a Auto-pilot helps automate the process of guiding and controlling an aircraft.
    b Modern auto-throttles can control power from takeoff to touchdown. Source: OIG analysis of air carrier and
      manufacturer data.

        To promote safety and provide a basis for oversight while
    maintaining flexibility for different aircraft and systems, FAA has
    established certain requirements governing the use of flight deck
    automation during commercial operations. In particular, FAA developed
    limitations regarding minimum altitudes at which autopilot can be
    engaged and how automated systems within the cockpit are configured.
    For example, during takeoff and climb below 500 feet, FAA restricts the
    use of autopilot unless the carrier is granted explicit FAA
    authorization to use it sooner. Further, air carriers must obtain FAA
    authorization in order to use certain advanced flight procedures \5\
    that rely on automation.
    ---------------------------------------------------------------------------
        \5\ These include Area Navigation (known as RNAV), a method of
    flying in which aircraft use satellite signals to fly any desired
    flight path, as well as Required Navigation Performance (RNP)
    procedures, which add monitoring and alerting capabilities for pilots
    that allow aircraft to fly more precise flight paths.
    ---------------------------------------------------------------------------
        In addition, FAA requires that pilots be trained, tested, and
    proficient in all aircraft they operate, including any onboard
    automated flight deck systems. The Agency also now requires all part
    121 \6\ pilots to be trained in specific abnormal flight conditions,
    which include stall and upset recovery and loss of reliable airspeed
    (see table 2 for an overview of FAA's new requirements). These FAA
    requirements were based on accident investigations and National
    Transportation Safety Board (NTSB) recommendations. Air carriers had to
    comply with this rule by March 12, 2019.
    ---------------------------------------------------------------------------
        \6\ 14 CFR Part 121, Operating Requirements: Domestic, Flag, and
    Supplemental Operations.

            Table 2. New Manual Flying Training Requirements for 2019
    ------------------------------------------------------------------------
         Training Maneuvers                        Overview
    ------------------------------------------------------------------------
    Upset Prevention and         Aircraft upset is an unsafe condition that
     Recovery                     may result in loss of control (LOC).
                                  Training focuses on the pilot's manual
                                  handling skills to prevent upset, as well
                                  as training to recover from this
                                  condition.
    ------------------------------------------------------------------------
    Manually Controlled Arrival  Pilots will be both trained and evaluated
     and Departure                on their ability to manually fly a
                                  departure sequence and arrival into an
                                  airport.
    ------------------------------------------------------------------------
    Slow Flight                  Pilots will be trained to understand the
                                  performance of the aircraft and the way it
                                  handles at airspeeds just above the stall
                                  warning.
    ------------------------------------------------------------------------
    Loss of Reliable Airspeed    Training will focus on the recognition and
                                  appropriate response to an automation
                                  system malfunction that results in a loss
                                  of reliable airspeed, which increases risk
                                  of aircraft stall and/or upset.
    ------------------------------------------------------------------------
    Recovery From Stall/         Training will provide pilots the knowledge
     Stickpusher Activation       and skills to avoid undesired aircraft
                                  conditions that increase the risk of
                                  encountering a stall or, if not avoided,
                                  to respond correctly and promptly.
    ------------------------------------------------------------------------
    Recovery From Bounced        A poorly executed approach and touchdown
     Landing                      can generate a shallow bounce (skip) or a
                                  high, hard bounce that can quickly develop
                                  into a hard landing accident.
    ------------------------------------------------------------------------
    Source: OIG analysis of FAA requirements

        FAA requires these training maneuvers to be performed in flight
    simulators. However, the recent Boeing 737 MAX 8 accidents have raised
    questions about the availability and capabilities of these training
    simulators. For example, FAA determined training for the new Boeing MAX
    series could be completed in existing simulators. However, according to
    FAA, existing simulators do not fully replicate the 737 MAX aircraft,
    and no U.S. airline currently has a MAX simulator.
        Overall, FAA has taken steps to emphasize the importance of pilots'
    manual flying and monitoring skills, as we recommended in 2016.
    Continued vigilance in these areas can help ensure that air carriers
    create and maintain a culture that emphasizes pilots' authority and
    manual flying skills.
    Remaining Vigilant as FAA and Industry Safety Oversight Systems Evolve
        In recent years, FAA has worked to revamp its strategy for
    overseeing the safety of the aviation industry. In particular, FAA has
    increasingly shifted to working with industry to meet shared safety
    goals, including delegating responsibilities for aircraft certification
    and requiring air carriers to proactively identify and mitigate their
    safety risks. Enhancing risk-based oversight, effectively leveraging
    industry collaboration and enforcement, and fostering a strong safety
    culture will remain key challenges for FAA as it works to implement its
    new oversight strategies and ensure the safety of the traveling public.
    Enhancing FAA's Oversight of the Aircraft Certification Process
        The U.S. civil aviation industry is vital to the Nation's economy
    and encompasses more than 230,000 aircraft, 1,600 approved
    manufacturers, and 5,200 aircraft operators, among others. Recognizing
    that it is not possible for FAA employees to oversee every facet of
    such a large industry, public law \7\ allows the Agency to delegate
    certain functions, such as approving new aircraft designs and
    certifying aircraft components, to private individuals or
    organizations. In 2009, FAA fully implemented the Organization
    Designation Authorization (ODA) program to standardize its oversight of
    organizations (e.g., manufacturers) that are approved to perform
    certain functions on its behalf.
    ---------------------------------------------------------------------------
        \7\ 49 U.S.C. Sec. 44702(d).
    ---------------------------------------------------------------------------
        While delegation is an essential part of meeting FAA's
    certification goals, robust oversight is essential to ensure that ODA
    companies maintain high standards and comply with FAA safety
    regulations. However, our work over the years on the ODA program has
    identified management weaknesses with a number of FAA's oversight
    processes. To its credit, the Agency has taken action to improve its
    oversight in response to our recommendations. For example, our 2011
    report \8\ identified inconsistencies in how FAA aircraft certification
    offices interpreted FAA's role and tracked ODA personnel. In
    particular, not all FAA offices consulted FAA's database to pre-screen
    performance histories of prospective ODA personnel. In addition, under
    ODA, FAA engineers have expanded enforcement responsibilities, but the
    Agency had not ensured that they were adequately trained to perform
    these duties. In response to our findings, FAA clarified guidance on
    tracking ODA employee performance history and improved its training and
    guidance for enforcement. As a result, FAA engineers responsible for
    overseeing ODA employees were better positioned to detect instances of
    regulatory noncompliance and take enforcement actions.
    ---------------------------------------------------------------------------
        \8\ FAA Needs To Strengthen Its Risk Assessment and Oversight
    Approach for Organization Designation Authorization and Risk-Based
    Resource Targeting Programs (OIG Report No. AV2011136), June 29, 2011.
    Requested by Representative Daniel Lipinski.
    ---------------------------------------------------------------------------
        In 2015,\9\ we reported that FAA's oversight of ODA program
    controls was not systems- and risk-based,\10\ as recommended by an
    aviation rulemaking committee.\11\ For example, FAA had not provided
    oversight teams with tools or guidance on data they should use to
    identify the highest-risk areas. Another gap in FAA's oversight
    pertained to companies that produce and supply components to other
    manufacturers. FAA performed oversight of only 4 percent of personnel
    conducting certification work on the Agency's behalf at suppliers in
    the period we reviewed.
    ---------------------------------------------------------------------------
        \9\ FAA Lacks an Effective Staffing Model and Risk-Based Oversight
    Process for Organization Designation Authorization (OIG Report No.
    AV2016001), October 15, 2015. Requested by Representative Peter
    DeFazio.
        \10\ Systems-based oversight shifts from focusing on individual
    project engineering work to holistically assessing whether ODA
    companies have the people, processes, procedures, and facilities in
    place to produce safe products. This allows FAA to focus its oversight
    on the highest-risk areas, such as new, innovative aircraft designs.
        \11\ The Aircraft Certification Process Review and Reform (ACPRR)
    Aviation Rulemaking Committee, a joint FAA and industry group, was
    formed in response to a congressional mandate to study the aircraft
    certification process.
    ---------------------------------------------------------------------------
        In responding to our 2015 report, FAA recognized the need to
    improve its oversight of organizations performing certifications or
    other functions on its behalf. By July 2019, FAA plans to introduce a
    new process that represents a significant change in its oversight
    approach. For example, FAA's new process will include identifying
    system elements (such as training and company self-audit processes) and
    developing new evaluation criteria. While revamping FAA's oversight
    process will be an important step, continued management attention will
    be key to ensure the Agency identifies and monitors the highest-risk
    areas of aircraft certification.
    Overseeing Air Carriers' New Systems for Managing Safety Risks
        FAA's safety oversight strategy depends, in part, on air carriers'
    ability to identify hazards and implement corrective actions that
    mitigate risk. For example, in 2015, FAA established requirements \12\
    for U.S. part 121 air carriers to implement a formal, top-down approach
    to managing safety risks, known as a safety management system (SMS).
    Specifically, under SMS, air carriers must identify root causes for
    hazards and proactively manage risk to prevent accidents.
    ---------------------------------------------------------------------------
        \12\ 14 CFR Part 5, Safety Management Systems. This requires part
    121 carriers to implement SMS.
    ---------------------------------------------------------------------------
        While air carriers were required to implement SMS by March 2018,
    recent events--including the April 2018 Southwest Airlines fatal engine
    failure--have raised concerns that FAA's oversight may not ensure air
    carriers sufficiently meet their risk-mitigation responsibilities. NTSB
    is currently investigating the accident, but its preliminary reports
    indicate similarities with a 2016 engine incident on a Southwest
    Airlines aircraft. We are currently assessing \13\ FAA's oversight of
    Southwest Airlines' systems for managing risk, including a focus on
    aircraft weight and balance issues that can affect critical phases of
    flight, as well as other matters. We expect to report on our findings
    later this year. Ultimately, while air carriers' SMS are an important
    part of maintaining the safety of the NAS, FAA must exercise
    appropriate regulatory oversight and intervene in a timely manner to
    ensure air carriers take sufficient actions to identify and reduce
    safety risks.
    ---------------------------------------------------------------------------
        \13\ Audit Initiated of FAA's Safety Oversight of Southwest
    Airlines, June 20, 2018. Self-initiated.
    ---------------------------------------------------------------------------
    Effectively Leveraging Collaboration and Enforcement in FAA's New Air
            Carrier Safety Oversight Program
        As FAA continues to move towards allowing air carriers to play a
    more collaborative role in safety oversight, strong management
    attention is critical to ensure the Agency's evolving strategy advances
    its safety goals. In particular, in 2015, FAA implemented a new
    ``Compliance Philosophy'' as part of its safety oversight strategy. The
    Compliance Program, as it is now known, is based on the premise that
    the greatest safety risk in the industry does not arise from a specific
    event or its outcome, but rather from an operator who is unwilling or
    unable to comply with rules and best practices for safety. The
    overarching goals of the new program are to achieve rapid compliance,
    eliminate a safety risk or deviation, and ensure positive and permanent
    changes.
        FAA's Compliance Program emphasizes the Agency's preference for
    collaborating with air carriers through education and training instead
    of penalizing carriers as a means to address discrepancies. This
    program calls for FAA to work with air carriers to address the root
    causes of violations of safety regulations rather than to impose
    enforcement actions--a significant change in the way FAA and the
    airlines previously addressed compliance and safety issues. A key issue
    we will assess in upcoming audits is whether the Compliance Program is
    suitable for all air carriers, regardless of current working
    relationships or unique business models and operating environments.
        An important component of the Compliance Program is working with
    carriers to identify the root cause of a violation. However, our
    ongoing audit \14\ related to Allegiant Airlines has highlighted the
    complex challenges FAA faces in implementing its new oversight approach
    and addressing the root cause of the air carrier's maintenance
    violations. Specifically, a longstanding maintenance issue at Allegiant
    Airlines resulted in a series of mid-air engine shutdowns, aborted
    takeoffs, and unscheduled landings. Our ongoing work focuses on the
    degree to which FAA's inspectors documented adjustments to their
    surveillance, effectively examined the root cause, or convinced the
    airline through collaboration to perform additional tests to operate at
    a higher level of safety. Overall, while FAA's Compliance Program
    offers a new strategy for addressing risk, such as potentially
    insufficient maintenance, the Agency's oversight must remain robust to
    ensure airlines implement effective corrective actions. A key challenge
    FAA faces moving forward is effectively leveraging both collaboration
    and enforcement and accurately assessing whether an air carrier is
    willing and able to correct its deficiencies.
    ---------------------------------------------------------------------------
        \14\ Revised Notification--Review of FAA's Oversight of Air Carrier
    Maintenance Programs, May 9, 2018. Requested by Representatives Peter
    DeFazio, Rick Larsen, Nita Lowey, David Price, Mike Quigley, Katherine
    Clark, Pete Aguilar, Jacky Rosen, and Cheri Bustos and Senator Bill
    Nelson.
    ---------------------------------------------------------------------------
    Maintaining a Strong Safety Culture To Adequately Support FAA's
            Changing Oversight Methods
        The success of FAA's evolving oversight methods depends on a strong
    safety culture within both the Agency and industry. According to FAA, a
    positive safety culture is one that is actively promoted by all levels
    of management and demonstrates a commitment to safety over competing
    goals and demands. Within such a culture, people acknowledge their
    accountability and act on their individual responsibility for
    safety.\15\
    ---------------------------------------------------------------------------
        \15\ FAA Order 8000.369B, Safety Management System, March 18, 2016.
    ---------------------------------------------------------------------------
        However, as early as 2015, FAA's Office of Audit and Evaluation
    cautioned about changes in airline safety culture and the potential
    impacts on safety and airline maintenance workforces. FAA guidance
    recognizes the impact that a single inspector can have on safety
    culture and establishes standards that require inspectors to act
    impartially and avoid the appearance of preferential treatment when
    they perform their official duties. Nonetheless, our recent work \16\
    identified concerns regarding an FAA inspector's oversight of American
    Airlines' flight test program, which is used to verify the
    airworthiness of aircraft following major repairs. We found that an
    inspector had developed a personal relationship with the head of the
    carrier's flight test program and appeared to give the carrier
    preferential treatment when safety concerns were raised. The inspector
    also worked with the carrier to suppress future complaints. Ensuring
    that FAA's inspector workforce meets standards of impartiality remains
    a key oversight challenge for the Agency to strengthen its safety
    culture and effectively identify and mitigate risks.
    ---------------------------------------------------------------------------
        \16\ FAA Has Not Fully Addressed Safety Concerns Regarding the
    American Airlines Flight Test Program (OIG Report No. AV2018060), July
    10, 2018. Self-initiated.
    ---------------------------------------------------------------------------
    Addressing Other New and Longstanding Safety Challenges
        While working to address the urgent safety concerns highlighted by
    the recent Boeing 737 MAX 8 accidents, FAA must remain vigilant about
    other emerging and longstanding areas that are critical to maintaining
    the safety of the NAS. These include improving safety on the ground and
    in the air at airports, integrating UAS in the same airspace as manned
    aircraft, protecting flight-critical systems that directly affect the
    safety of aviation passengers from cyberattacks, and identifying and
    removing suspected unapproved parts from the aviation supply chain.
    Reducing Runway Safety Risks at Airports
        Incidents in which collisions between passenger aircraft were
    narrowly avoided at our Nation's major airports have renewed attention
    to runway safety. For example, in July 2017, a commercial pilot at the
    San Francisco International Airport attempted to land on a taxiway
    where four other aircraft were awaiting takeoff.\17\ Much of our work
    in this area has focused on FAA's efforts to reduce runway incursions--
    incidents involving unauthorized aircraft, vehicles, or people on a
    runway--which has been a longstanding challenge for FAA.
    ---------------------------------------------------------------------------
        \17\ NTSB News Release, Flight Crew Misidentifies Runway, Causes
    Taxiway Overflight, September 25, 2018. NTSB determined an Air Canada
    flight crew's lack of awareness caused the overflight of the taxiway.
    ---------------------------------------------------------------------------
        While FAA has undertaken a number of safety initiatives since 2007,
    reports of incursions have increased, with a 92-percent rise in total
    incursions reported between Fiscal Years 2011 and 2018 (see figure
    2).\18\ In addition, while the number of serious runway incursions is
    relatively low, there have been several incidents where two aircraft
    have come within a few feet of colliding with each other, posing
    significant safety risks.
    ---------------------------------------------------------------------------
        \18\ We have not analyzed how factors such as changes in
    operational levels and new reporting systems may have contributed to
    the increase in runway incursions.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    ---------------------------------------------------------------------------
        Source: OIG analysis of FAA data

        Last year, we reported \19\ that FAA had completed 10 of the 22
    runway safety initiatives recommended during a joint Government-
    industry forum,\20\ including educating pilots on signs, markings, and
    other visual aids at airports with identified risk factors.\21\
    However, the Agency faces challenges in fully implementing the
    initiatives still in progress, including dedicating funding and fully
    implementing new technologies,\22\ which could take years to complete.
    In addition, FAA did not establish quantifiable goals to measure the
    initiatives' effectiveness in reducing runway incursions. As a result,
    FAA will be limited in its ability to prioritize and adjust the
    initiatives based on their effectiveness. We made three
    recommendations, including updating target action dates for initiatives
    still in progress and developing metrics to measure their
    effectiveness. FAA plans to implement these recommendations by May
    2019. Effectively analyzing data, identifying risks, and tracking
    mitigation actions will remain critical to reduce runway risks.
    ---------------------------------------------------------------------------
        \19\ FAA Faces Challenges in Implementing and Measuring the
    Effectiveness of Its 2015 Runway Safety Call to Action Initiatives (OIG
    Report No. AV2018058), June 27, 2018. Self-initiated.
        \20\ FAA initiated a Call to Action forum in 2015 with
    representatives from industry, labor, and Government. The forum
    resulted in 22 initiatives intended to mitigate runway incursions and
    improve safety.
        \21\ According to FAA, risk factors that contribute to runway
    incursions may include unclear taxiway markings, airport signage, and
    more complex issues such as the runway or taxiway layout.
        \22\ For example, one initiative calls for testing and using new
    Next Generation Air Transportation System technologies for issuing taxi
    instructions, such as Data Communications.
    ---------------------------------------------------------------------------
    Strengthening Oversight of UAS in the NAS
        The growing demand for UAS commercial operations--ranging from
    filmmaking and precision agriculture to package delivery--represents a
    substantial economic opportunity for the United States but also
    presents one of FAA's most significant safety challenges. Since
    initiating UAS registrations in December 2015, FAA has processed more
    than 1.1 million UAS registrations for commercial operators and
    hobbyists. Reports of UAS sightings by pilots and other sources have
    increased significantly in the past few years--from 238 in 2014 to more
    than 2,350 in 2018.
        The Agency has taken many steps to accommodate UAS in the NAS, such
    as passing a rule \23\ permitting small UAS (i.e., under 55 lbs.) to
    fly commercially, with a number of operational restrictions.\24\
    However, much work remains to safely integrate UAS into the same
    airspace as manned aircraft. For example, FAA's rule allows commercial
    UAS operators to apply for a waiver to conduct higher-risk operations
    at night, over people, and/or beyond visual line of sight, if the
    Agency determines the proposed operations can be performed safely. Yet,
    as we reported last year,\25\ our analysis of FAA inspections found
    multiple instances of commercial operators flying their UAS over people
    and in airspace with manned aircraft without authorization to do so,
    including over exhibitions and concerts and while performing building
    inspections.\26\
    ---------------------------------------------------------------------------
        \23\ 14 CFR Part 107 (June 2016).
        \24\ The rule does not permit several potential UAS operations that
    are highly valued by industry but considered to be higher risk by FAA,
    such as operating a small UAS beyond line of sight or over people.
        \25\ Opportunities Exist for FAA To Strengthen Its Review and
    Oversight Processes for Unmanned Aircraft System Waivers (OIG Report
    No. AV2019005), November 7, 2018. Self-initiated.
        \26\ Our analysis of FAA's inspection record database shows no
    indication that formal enforcement actions were pursued for any of
    these specific incidents.
    ---------------------------------------------------------------------------
        Moreover, we found that FAA faces several challenges in developing
    a risk-based oversight system for commercial UAS operations. While the
    Agency had developed guidance for its inspectors in planning annual
    inspections of some UAS operators, FAA's UAS oversight was neither
    data-driven nor proactive and lacked key elements of a risk-based
    oversight system. For example, we reported that FAA's guidance did not
    include risk or operational factors (e.g., operating location or
    frequency of operations) to consider when choosing operators for
    inspection. Furthermore, FAA had not yet collected sufficient
    inspection data to conduct a meaningful assessment of safety hazards
    and develop an overall, baseline risk profile of commercial UAS
    operating in the NAS. In response to our recommendations, FAA has
    recently required new, mandated inspections of UAS operators based on
    data. The Agency must continue to enhance its data collection and
    analysis to mitigate safety risks in this rapidly evolving industry.
    Implementing Congressionally Mandated Aviation Cybersecurity
            Initiatives To Protect Safety-Critical Systems
        Enhancing the safety and security of the NAS also depends on
    strengthening the Agency's ability to protect against a growing number
    of cybersecurity threats to FAA's safety-critical systems.
    Specifically, FAA operates a network of more than 300 information
    technology systems. This complex network has evolved over the years
    into an amalgam of diverse legacy radars and newer satellite-based
    systems for tracking aircraft, as well as a new initiative for
    controllers and pilots to share information through data link
    communications.
        In 2016, the FAA Extension, Safety, and Security Act \27\ directed
    FAA to establish a new ``total systems'' approach to enhance its
    ongoing cybersecurity efforts for securing the NAS, including aircraft
    systems. Our recent work \28\ shows that FAA has taken initial steps to
    address the act's requirements, such as completing a strategic plan
    with cybersecurity goals and objectives, developing a risk model to
    assess FAA operations, and establishing a research and development
    (R&D) plan to outline further cyber initiatives. However, FAA will be
    challenged to continue to implement the risk model across all of its
    lines of operations, establish priorities for its cyber R&D efforts,
    and coordinate ongoing efforts with other agencies (such as the
    Departments of Defense [DOD] and Homeland Security [DHS]) to maximize
    the Federal investment in cybersecurity research and implement
    corrective actions to protect the NAS. Accordingly, we will soon begin
    a review \29\ of FAA's role and authority in the Aviation Cybersecurity
    Initiative, a joint taskforce that includes DOD and DHS aimed at
    identifying and mitigating cyber vulnerabilities in the aviation
    industry.
    ---------------------------------------------------------------------------
        \27\ Pub. L. No. 114-190 (2016).
        \28\ FAA Has Made Progress but Additional Actions Remain To
    Implement Congressionally Mandated Cyber Initiatives (OIG Report No.
    AV2019021), March 20, 2019. Requested by the House Committee on
    Transportation and Infrastructure.
        \29\ This was requested by the Chairman of the House Committee on
    Transportation and Infrastructure.
    ---------------------------------------------------------------------------
    Strengthening the Investigative Process and Proactively Removing
            Suspected Unapproved Parts From the Aviation Supply Chain
        The safety of the NAS also depends on efforts by FAA and the
    aviation industry to ensure that U.S. aircraft are properly maintained
    and airworthy. A single passenger aircraft can contain as many as
    400,000 parts, and FAA and the aviation industry are responsible for
    ensuring that all these parts meet established standards and are safe
    for use. Part of this responsibility is to detect and monitor for
    Suspected Unapproved Parts (SUPs)--aircraft parts that may have been
    manufactured without FAA approval, including counterfeit parts.
    However, our work has identified longstanding challenges with FAA's
    processes for overseeing and reducing the risk of SUPs. For example, we
    reported in 2017 \30\ that FAA's process for monitoring and
    investigating SUPs was not as effective as it could be because of
    recordkeeping weaknesses and the lack of management controls to capture
    and accurately report the number of SUPs cases. As a result, FAA could
    not accurately account for the number of SUPs or track safety-related
    trends about the risks posed by unapproved parts.
    ---------------------------------------------------------------------------
        \30\ Enhancements Are Needed to FAA's Oversight of the Suspected
    Unapproved Parts Program (OIG Report No. AV2017049), May 30, 2017.
    Requested by the Ranking Members of the House Committee on
    Transportation and Infrastructure and its Subcommittee on Aviation.
    ---------------------------------------------------------------------------
        Furthermore, FAA's oversight of industry actions to remove
    unapproved parts was ineffective because the Agency did not confirm
    that operators took appropriate action to remove unapproved parts from
    their inventories. For example, an FAA inspector investigated a case to
    determine whether tens of thousands of privately owned commercial
    aircraft parts, which were for sale online, were unapproved. These
    included safety-critical parts, such as landing gear. However, the
    inspector did not physically account for the location and quantities of
    the parts but instead accepted a letter from the owner stating that he
    had removed the ad from his eBay site and had not sold any parts. FAA
    concurred with all 11 of our recommendations to strengthen its SUPs
    program and is working to complete actions to address the remaining
    three open recommendations by the end of May. Going forward, enhancing
    the margin of safety will require FAA's sustained management attention
    to ensure that the hundreds of thousands of aircraft parts installed on
    airplanes are manufactured or repaired according to safety standards.
    Conclusion
        From certifying a new aircraft to aircraft maintenance to pilot
    training and beyond, aviation safety is a complex, wide-reaching effort
    with many moving parts. As the recent Boeing 737 MAX 8 and other
    accidents draw significant attention to FAA's safety oversight, and as
    the aviation industry continues to evolve, FAA must ensure it can
    proactively adapt to new oversight challenges, while also addressing
    longstanding concerns in safety-critical areas. A strong commitment to
    risk-based oversight--built on the foundation of a rock-solid safety
    culture--will be vital to ensure FAA continues to maintain one of the
    safest aviation systems in the world. As always, we remain committed to
    supporting FAA and the Secretary as they seek to uphold and enhance the
    safety of the NAS and protect the traveling public. We will continue to
    update you on our work on these and related matters.
        This concludes my prepared statement. I would be happy to address
    any questions from you or Members of the Subcommittee at this time.

        Senator Cruz. Thank you, gentlemen. We appreciate your
    testimony.
        Acting Administrator Elwell, although the investigations of
    both of these crashes are still ongoing, the investigators have
    gathered enough data to confirm similarities between the two
    crashes.
        The most prominent link seems to be a new software unique
    to the Boeing 737 Max called the Maneuvering Characteristics
    Augmentation System, more commonly known as MCAS.
        From the FAA's perspective, was there any information on
    this new MCAS System that was required to be included or was
    included in the ``short self-administered online course'' that
    pilots are required to go through before flying the Max?
        Mr. Elwell. Mr. Chairman, thank you for that question.
        The MCAS System is indeed, as I mentioned, of great
    attention in both of these tragic accidents and the MCAS is
    actually a sub-device to a system called the Speed Trim System
    that is in the NG, a prior 737.
        What the MCAS does is it--the 737 Max is a fly-by-wire
    aircraft. Fly-by-wire aircraft, the controls, the yoke, the
    controls, the flight controls needs to feel right to a pilot
    and so what the MCAS does is it gives inputs to the flight
    controls when necessary in a very thin envelope, thin piece of
    the flight envelope and certain regimes so that the pilots, the
    yoke feels exactly like it should, and in this case, the MCAS
    made the Max feel exactly like the NG to fly.
        So for that reason, we gave it an amended type certificate
    because of its similarity to the NG, because of what the MCAS
    System aided the pilots in the feel and the flight of the
    airplane.
        We have for a certification of this type a Flight
    Standardization Board comprised of pilots from Europe, Canada,
    the United States, who come together and fly the aircraft that
    is being amended, in this case 737 NG, and the new aircraft,
    and they fly it and are monitored by engineers and experts
    specifically to see if they have or notice differences in the
    flight characteristics, the handling characteristics of the new
    airplane because that would trigger us to need flight training
    for this new device.
        Senator Cruz. Administrator Elwell, let me try to refocus
    you back on the specific question I asked, which is, was there
    any information on the MCAS that was included in the short
    self-administered online course the pilots were required to go
    through?
        Mr. Elwell. There was not specific instruction on the MCAS
    to my knowledge specifically because it was not a system that
    went directly to what the pilots flew on the Max, the
    difference between the Max and the NG.
        Senator Cruz. Well, that might be true in ordinary
    circumstances, but as I understand it on previous versions of
    the 737, when the pilot pulled back on the yoke, it cutoff the
    electronic control of the stabilizers but with the MCAS, it did
    not, and presumably pilots would not know this if it was not
    included in their training and they were not made aware of
    that, is that correct?
        Mr. Elwell. So, Senator, the MCAS gives input to the flight
    controls, as I said, in a very small flight envelope.
        In this case we're talking about here, errant information
    to that system would make it give input where it's not needed
    and where it's not wanted and only in manual flight and pilots
    are trained when they get an input into their flight controls
    that they did not ask for, that is not appropriate for the
    regime of flight, then they go through procedures.
        In this case, it's called runaway stabilizer trim procedure
    and that is what would be done in this instance. In normal
    operation for the MCAS, you would never----
        Senator Cruz. Did these pilots'----
        Mr. Elwell.--feel the input.
        Senator Cruz.--training or procedure let them know that
    pulling back the yoke would not disengage this system?
        Mr. Elwell. I'm not quite sure what you're referring to
    about pulling back the yoke and stopping it because that's not
    actually----
        Senator Cruz. So I'm reading a quote from the New York
    Times on February 3, 2019, where the Times reported ``Older
    737s had a way of addressing certain control problems with the
    stabilizers. Pulling back on the yoke or control column would
    cutoff electronic control of the stabilizers, allowing the
    pilots to control them manually,'' and that was not true with
    the 737 Max.
        Now is that correct factually? I'm relying on the Times
    reporting here.
        Mr. Elwell. So I don't believe that's correct. The same
    ways to deal with the MCAS inappropriate input is the same
    thing a pilot would do for runaway stab trim for an NG. It's
    the same input and the same procedure. In fact, the procedure
    for runaway stab trim does not change from the NG to the Max.
    It presents itself the same way and it's dealt with the same
    way.
        Senator Cruz. Now the MCAS System itself relied on angle of
    attack sensors that, as the Washington Post reported, ``angle
    of attack sensors have been flagged as problems on more than 50
    times on U.S. commercial airplanes over the past five years.''
        How did the FAA come to the conclusion that it was
    appropriate to certify an anti-stall software system, the MCAS,
    that not only drew data from a sensor that had a history of
    problems but also that didn't have redundancy?
        Mr. Elwell. So the AOA vanes are an input to the MCAS
    System. The MCAS System is actually not an anti-stall system.
    It's not a system unto itself. It is a supplement to, as I
    said, the speed trim system that existed in the NG, does the
    same thing that the STS does in the NG.
        I am not aware of AOAs being a problem, 50 malfunctions of
    an AOA or 50 maintenance procedures to an AOA across the gamut
    of flight where AOA vanes are in all the flights that use AOA.
    It is not in--you talk about numbers of hundreds of thousands
    of flights.
        Senator Cruz. Unless there is a system where the
    malfunction then causes the plane to crash, then that is a
    serious issue.
        Mr. Elwell. Well, sir, it is still yet to be determined if
    the malfunctioning of the AOA caused the crash. We actually
    don't know the cause of the crash. There's a lot more to find
    out through the investigation.
        But I am confident in--well, I'm confident in the AOA vanes
    that are produced and put on airplanes and I'm confident in the
    MCAS System. Now where we need to go is we need to get all the
    information, all the data from the accident to determine the
    interaction between all of them, and it isn't just airframe or
    it isn't just the AOA. It isn't just the MCAS.
        There's quite a few more factors in any investigation that
    we have to determine. We have to gather the data. We're a data-
    driven organization and we make our decisions based on the data
    collected. We still have a lot of data to collect, sir.
        Senator Cruz. Senator Sinema.
        Senator Sinema. Thank you, Mr. Chair.
        My first question is for Mr. Elwell, but I welcome
    responses from any of our guests.
        According to media reports, the initial failure
    classification for the MCAS enabled its safety evaluation to be
    delegated to Boeing and during--well, according to media
    reports, during testing, FAA did not completely and properly
    review technical documents provided by Boeing.
        So how do we ensure that FAA can take over safety
    evaluation if issues are discovered during the testing and
    evaluation phase?
        Mr. Elwell. Thank you for that question, Senator.
        What you're referring to is the Organizational Designation
    Authorization. In the course of a certification, such as an
    amended type cert that the 737 Max went through, the FAA
    determines what aspects of the delegation or what aspects of
    the certification can be delegated and usually those are normal
    well-known legacy-type systems, and in the case of the 737 Max,
    we, the FAA, retained MCAS for review at the beginning of the
    certification process.
        As the process goes on, ODA is amended and is amended many
    times in the course of a certification as the FAA reviews and
    certifies the expertise of the manufacturer to take on more of
    the delegated authority under very strict review by the FAA and
    we at times in the course of a certification will find areas
    that we want to pay more attention to and we will retain those
    items.
        So it is an active constantly changing dynamic in a
    certification and that's what happened during the certification
    of the Max.
        Senator Sinema. A second question then for you, Mr. Elwell.
        So MCAS is new to the Boeing Max aircraft and I was
    wondering if you could talk to us about why the system was not
    included in pilot training materials and who makes the
    determination regarding what is included in pilot training
    materials?
        Mr. Elwell. So when we're doing a new certification,
    whether it's an amended or a new type, there's a Flight
    Standardization Board that is a group of experts and pilots and
    engineers whose responsibility it is to determine, and in this
    case an amended type certificate, if the handling
    characteristics of the new aircraft require flight training or
    if the differences between the new aircraft and the one that
    it's amending does not require flight training.
        What the MCAS did was correct for some very slight
    modifications that the Max had. The Max has slightly larger
    diameter engines with not a whole lot of extra thrust, similar
    thrust, but because of the width of the engines, they had to go
    forward on the wing, and because of the diameter of the
    engines, the nose wheel had to be extended six inches.
        These are not big changes as far as the FAA's concerned for
    an amended certificate, but what we need to do is put pilots in
    simulators and fly the aircraft that's being amended and the
    new aircraft and after many scenarios, flights in all regimes,
    sim flights in all regimes with these pilots, there was a
    consensus opinion from the pilots, European, Canadian, American
    pilots, that there was no market difference in the handling
    characteristics of these two aircraft and that is what we need
    to determine what kind of flight training or not is needed and
    there was, by the recommendation of the Flight Standardization
    Board--understand this is a Board that has been used dozens and
    dozens of times, and their unanimous opinion was flight
    training was not needed.
        They didn't flight test the MCAS per se because, as I said,
    the MCAS is a device that is a supplement to another system
    that is designed, specifically designed for the yoke to feel
    correctly to the pilot in all regimes of flight.
        Senator Sinema. My last question is for each of the
    witnesses and I wonder if you have suggestions for legislative
    or regulatory changes that can ensure an aircraft is
    independently and appropriately evaluated for operational
    safety. Is there more we need to do?
        Mr. Scovel. Thank you, Senator Sinema.
        Yes, there may be. However, for me as Inspector General to
    offer suggestions today would be entirely premature.
        As you know, Secretary Chao, Senator Blumenthal, and other
    congressional requesters have asked my office to start at the
    very beginning thinking of these as bookends. First, we want to
    look at the certification process.
        I can outline very quickly for you what that will entail.
    We want to look at the key decisions made by FAA when
    certifying the airplane and the timeline. We want to determine
    when MCAS was added to the aircraft and why FAA approved it or
    the extent of FAA's involvement in Boeing's decision to approve
    it, how FAA reached the decision that pilots did not need
    additional training or that the details about the new system
    did not need to be included in the airplane's manual. That's
    the first bookend.
        The second bookend in my view will be how FAA responded to
    the recent accidents and that's specifically Senator
    Blumenthal's question.
        Clearly, confidence in FAA as the gold standard for
    aviation safety has been shaken. We can help provide
    information to the Secretary and to the Congress to determine
    how best to restore FAA to that position.
        The second bookend we hope will shed some light on the
    obvious question as to why FAA was the last safety regulator to
    decide to ground the 737 Max.
        Other safety regulators around the world decided that in
    their role as safety regulators they needed to drive risk to
    zero and they did that by grounding the aircraft.
        Acting Administrator Elwell has testified that they were
    continuing the hunt for data in order to inform that decision.
    So that disparity, that apparent disparity in the safety
    regulator's role should be another question, I respectfully
    submit, for the Congress and the Secretary.
        We hope to present information to all of you to help inform
    your decisionmaking.
        Mr. Sumwalt. Ranking Member Sinema, thank you for your
    question.
        The NTSB has looked at that issue as it relates to
    particular crashes. For example, coming out of the 2013 Asiana
    crash at San Francisco, we recommended that the FAA convene a
    special certification design review of how the Boeing 777
    Automated Flight Control System controls air speed and we
    wanted the FAA to look at that and we've classified that
    recommendation as open alternate acceptable response.
        Coming out of the 787 battery fire event that we
    investigated that same year, we talked about the use of
    engineering designees. Since 1999, we've issued eight
    recommendations to the FAA concerning the use of engineering
    designees. Three are still open. The remaining four have been
    closed acceptably.
        We do want the FAA to provide certification to engineers
    with written guidance and training to address opportunities to
    improve the certification process outcomes and so that would be
    where we stand on that.
        Senator Sinema. Thank you. Thank you.
        Senator Cruz. Mr. Elwell, you told Senator Sinema that part
    of certification was based on pilots flying simulators in
    multiple different scenarios.
        Did any of those scenarios include angle of attack sensors
    malfunctioning and reporting the wrong data to the MCAS System?
        Mr. Elwell. Sir, I can get an answer for you on that, but I
    don't believe so. I believe that they were all in the normal,
    the full range of the flight envelope for flight
    characteristics.
        Again, the issue of an AOA vane giving the MCAS the wrong
    information causing it to give nose down input to the
    stabilizer trim presents as a scenario. All pilots are trained
    on it and familiar with it. It's called runaway stabilizer trim
    and the actions that they take to defeat it are the same as
    they would find in any other cause of a stab trim malfunction
    which would be the motor going off when it shouldn't. So it is
    indistinguishable to the pilot.
        [Mr. Elwell's answer follows:]

        The flight control system, of which the Maneuvering Characteristics
    Augmentation System (MCAS) is a part, was extensively tested, including
    in potential failure modes of MCAS and stalls.

        Senator Cruz. Chairman Wicker.
        Chairman Wicker. Thank you, Senator Cruz.
        Mr. Sumwalt, the Indonesian Civil Aviation Authority has
    issued a preliminary report. How long did that take after the
    Lion Air crash?
        Mr. Sumwalt. The accident occurred, Senator, on October 29
    and I believe the preliminary report was issued on November 27,
    so about 30 days.
        Chairman Wicker. Do you think we can expect a preliminary
    report, then, from Ethiopia within about a month?
        Mr. Sumwalt. I do. Our investigators are very engaged with
    the Ethiopian Government. We're working very closely with them,
    providing assistance in the development of a draft report, and
    we do expect it in the very near future.
        Chairman Wicker. I assume you're getting all the
    cooperation you need from the Ethiopian Government----
        Mr. Sumwalt. Yes, sir, we are.
        Chairman Wicker.--and from the Indonesian Government?
        Mr. Sumwalt. Absolutely.
        Chairman Wicker. What do you know about the Lion Air crash
    that you don't know about the Ethiopian Air crash at this
    point?
        Mr. Sumwalt. Well, I've read the Lion Air preliminary
    report that was issued in November. I will say a very ticklish
    issue is that there's a law, an actual law, 49 U.S.C. 1114
    subsection f, that prohibits anyone from disclosing information
    concerning a foreign investigation unless that information has
    been cleared by the host country.
        So I am not the one to speak about either of those two
    accidents.
        Chairman Wicker. Mr. Scovel, are you going to have a
    recommendation about that law? Do you have an opinion about
    that law? Is it a problem?
        Mr. Scovel. Conceivably, it might be. Certainly in the
    desire of the Congress and the Administration to foster
    transparency and determine the best route ahead. At this point,
    I certainly don't have a recommendation for you.
        Chairman Wicker. OK. Well, if the witnesses would get back
    to us on that, we'd appreciate it. You have some time to
    consider that.
        Now there was a nose-down input, Mr. Sumwalt. In other
    words, the pilots experienced the MCAS System kicking in and
    pushing the nose down. I understand it was some 21 times before
    the plane eventually crashed. Is that your understanding, sir?
        Mr. Sumwalt. Which accident are you referring to?
        Senator Wicker. Lion Air.
        Mr. Sumwalt. I think that's about right, based on my read.
        Chairman Wicker. Over what period of time would that have
    been?
        Mr. Sumwalt. I'm not sure, sir.
        Chairman Wicker. What should the pilots have done there?
        Mr. Sumwalt. Well, I flew the 737 for 10 years and I do
    believe that there is a procedure, at least for the Flintstone
    version of the 737 I flew, a very old 737, but I do believe
    that the first thing you would do is oppose that motion by
    pulling the yoke back and that should engage a stab brake. Now
    apparently that feature is not on the Max----
        Chairman Wicker. Mr. Elwell, what should they have done?
    What should the pilot have done, based on 21 times of the
    system kicking in and pushing the nose down?
        Mr. Elwell. Mr. Chairman, I did not fly the 737, so I can
    only speak to the airplane--all the different airplanes I flew,
    but----
        Chairman Wicker. Oh, I'm actually asking about this
    aircraft. Do you know? If you don't know, that's fine.
        Mr. Elwell. Sir, I'll have to get back to you on the
    specifics. There is a non-normal checklist, an NNC on runway--
    --
        Chairman Wicker. I think that would be helpful for us to
    know, based on the expertise at this table, what should have
    occurred in the cockpit, based on that nose-down input?
        Mr. Elwell, then discuss, if you don't mind, the point that
    Mr. Scovel mentioned and a lot of us have about the decision
    made by other countries initially to ground the aircraft, what
    data they had. Was this just an abundance of caution or was it
    based on facts that these agencies had that we didn?t have here
    in the United States? Help us understand the decision there.
        Mr. Elwell. Yes, sir. It is a very important question.
        The FAA, to make a decision to ground a fleet of aircraft,
    is going to do that on data-based information that we have to
    warrant grounding. I can't speak to the reasoning that the
    other nations took. I know that in communication with those
    countries, they, in our request of what data they might have,
    they did not have any data for us. In fact, there were several
    countries in communications with us who, after grounding the
    aircraft, asked us what data we had and what we might suggest
    for them for ungrounding when the time was right.
        Chairman Wicker. Was your decision based on data or just--
    --
        Mr. Elwell. Our decision----
        Chairman Wicker.--what everybody else was doing? What was
    that data?
        Mr. Elwell. So on that Wednesday morning, mid-morning, we
    received data that gave us refined flight track. We had initial
    flight track data Monday that was unreliable and it was
    actually--we were not able to interpret it and to create a
    flight track.
        That data was refined on Tuesday night into Wednesday by
    the company that actually produced the data or received the
    data through their satellite system and with the help of the
    NTSB and Boeing, that data was refined to the point where we
    could have a flight track, a 6-minute flight track of the
    Ethiopian Air flight, and we found information on the ground
    that corroborated for us in a briefing on Wednesday morning
    that the flight track of Ethiopian Airlines was very similar to
    the flight track of Lion Air and that data told us that there
    was very possibly a link between the two flights and when you
    have the possibility of a link between two accidents of the
    same type aircraft, it's prudent to ground them until you find
    what that link is, mitigate that link.
        The important thing to know about using data, we may have
    been, I think someone said, the last country to ground the
    aircraft, but the United States and Canada were the first
    countries to ground the aircraft with data for cause and
    purpose and that's important because when you ground a fleet of
    aircraft for a reason, a definable reason, then you have
    something by which to unground them when you've mitigated that
    or you've solved it or you've found that link.
        Chairman Wicker. Mr. Chairman, I know we're over, but Mr.
    Sumwalt seems to be nodding his head.
        Are you in agreement with the approach that Mr. Elwell has
    outlined as having been taken by the FAA?
        Mr. Sumwalt. Well, the NTSB was not involved in the
    grounding decision.
        Chairman Wicker. Right.
        Mr. Sumwalt. We supplied data that they could use to make
    that decision.
        Chairman Wicker. Thank you. Thank you, Mr. Chair.
        Senator Cruz. Senator Cantwell.
        Senator Cantwell. Thank you, Mr. Chairman.
        Administrator Elwell, did you say in answering an earlier
    question of Senator Sinema that the FAA retained the authority
    over the MCAS System, that it wasn't delegated?
        Mr. Elwell. I said that originally we retained it as a new
    system and then released it to the ODA, to the delegation
    designation.
        Senator Cantwell. So if someone is characterizing it as
    delegated, then it was delegated?
        Mr. Elwell. Right. So initially as a new system or a new
    device on the amended type certificate, we retained the
    oversight of that and then over time released that to the ODA
    when we had the comfort level and the oversight and we've
    examined it thoroughly and we were able to assure that the ODA
    members of Boeing had the expertise and the knowledge of the
    system to continue going forward.
        Senator Cantwell. And so that kind of information is
    something you can make available to members now or is that
    something that will be part of the investigation?
        Mr. Elwell. I'm sure, Senator, that we could get that
    information to you on exactly the timing and how that went,
    and, of course, in the investigations and the audits that are
    ongoing about the certification process here, this will all be
    very transparent and clear.
        Senator Cantwell. Well, I do think transparency is
    important.
        Mr. Elwell. Absolutely.
        Senator Cantwell. So I read statements where you're saying
    it wasn't delegated or I hear your answer here and then I read
    things in the press that say it was delegated and I think the
    public wants to understand the system and obviously Mr. Scovel
    and various IG reports is reviewing that and I appreciate those
    reports and that review.
        As I mentioned in my opening statement, I appreciate
    Secretary Chao convening some experts of aviation analysis to
    also look at that system and review.
        So, anyway, we'll look forward to getting that information
    from you on what that looked like as the FAA retains that
    oversight and then once they were certain then delegated. I'm
    not sure what they delegated but you will get that to us.
        This larger question in my mind is Mr. Scovel also
    mentioned that pilots rely on automated flight systems, that
    the FAA ensure that carriers meet its requirements to train
    pilots on how to respond to abnormal flight conditions, and I
    think you also, Mr. Scovel, mentioned stall situations.
        So how is the FAA making sure that that is achieved in
    particularly this area of human and machine interface? I think
    that the public wants to understand, and I think it's probably
    across a lot of transportation sectors, want to understand what
    we're doing on testing to make sure that these safety factors
    of functionality are there, particularly when the functionality
    is between a machine and a human interface, how are we testing
    for that, and in this case, how were we testing?
        Mr. Elwell. Yes, Senator. The FAA is intensely interested
    in the interface between the pilot and the machine and over
    time that relationship has changed and as aircraft become more
    automated, we have this--clearly automation is one of the most
    important aspects for the amazing increase in improvement in
    safety we've seen over decades.
        But automation brings with it certain challenges and as the
    IG has pointed out, if most of the time automation is on in an
    aircraft, there's always been this concern that, well, then
    pilot skills degrade.
        So when I was flying in the airlines, we had within the
    airline itself, we had some rules about making sure that you
    hand flew frequently enough to keep that sharpness but
    certainly we look very, very closely at the training
    requirements and the human interface and what automation does,
    the safety benefits, and what the challenges are with it. So we
    watch that very closely.
        Senator Cantwell. And so you think there was enough of that
    training involved here?
        Mr. Elwell. Senator, I do, I do, because the MCAS,
    remember, the MCAS operates in manual mode. It's not automated.
    It's not during with autopilot on. It actually--as I said
    earlier, it makes the--its whole purpose is to give the pilot
    the proper feel with a fly by-wire yoke while he or she is
    flying.
        So it interjects in manual mode. It does not interject in
    automatic mode, and as I said, when that MCAS is doing things
    that it's not supposed to do, pilots feel it. It presents
    itself as uncommanded pitch trim and pilots of large aircraft
    are trained from the beginning of their careers how to handle
    that.
        Senator Cantwell. Well, I mention this and I mentioned the
    Colgan Air families who are here because I think that's been
    their main mantra, that there wasn't enough training on that
    particular system or at least from a co-pilot perspective, and
    I think I saw that Captain Sully had also made similar comments
    recently.
        We've had a lot of debate here about this as it relates to
    making sure that two pilots are, but I really do want to
    understand the FAA's role and certainly Mr. Scovel's review of
    that human-machine interface because my guess is we're going to
    continue to move forward but we have to get this right. We have
    to get this right.
        So thank you, Mr. Chairman. I see my time has expired.
        Senator Cruz. Senator Thune.

                     STATEMENT OF HON. JOHN THUNE,
                     U.S. SENATOR FROM SOUTH DAKOTA

        Senator Thune. Thank you, Mr. Chairman.
        Mr. Elwell, as you know, the FAA Reauthorization Act of
    2018 contains several bipartisan provisions aimed at improving
    and modernizing FAA's aircraft certification process, to
    include the establishment of an organization designation
    authorization office within FAA's Office of Aviation Safety
    designed to improve operational safety by strengthening
    oversight of ODA holders delegated to perform certain functions
    on behalf of FAA.
        Could you provide a timeline on when you expect this office
    to be fully established?
        Mr. Elwell. Thank you for that question, Senator Thune.
        Absolutely. In fact, we already established the new ODA
    Office, as you mentioned, prescribed in last year's FAA bill.
    On March 5, we created and stood up the office.
        Senator Thune. And as a followup, the FAA bill also
    established an expert review panel to survey ODA holders and
    evaluate the effectiveness of the ODA process.
        You have an update on when you expect this review panel to
    be established?
        Mr. Elwell. I don't have it off the top of my head,
    Senator, but I will certainly get that information to you. It
    may already be in place, but I don't have that in my notes.
        Senator Thune. Thank you. That would be great if you could
    get us that information.
        Boeing recently--I would direct this to you, Mr. Elwell,
    too. Boeing recently stated that the 737 Max Series aircraft
    was certified, and I quote, ``Certified in accordance with the
    identical FAA requirements and processes that have governed
    certification of all previous new airplanes and derivatives.''
        Could you provide some examples of other aircraft models
    where the FAA has certified a variant aircraft in a manner
    similar to the process that was used for the 737 Max?
        Mr. Elwell. Well, Senator, the process to determine whether
    it is an amended type certificate or a new type is the same,
    regardless of the manufacturer, the type which you're amending,
    or making that determination, and it goes to the points I made
    earlier about flyability.
        So, first and foremost, the criteria to examine as to
    whether there's a fundamental difference in the thrust, weight,
    flight characteristics of the applicant for an amended type.
    Those, as I said, are tried and true methods that we've used
    for decades on amended certificates.
        I know sometimes, in my case when I flew the Super 80, we
    added to our fleet type the Super 80s from another airline in a
    merger. They had a different cockpit layout but the plane was
    fundamentally the same. There are a couple of different options
    but it handled the same.
        So it was an amended type and we went through differences
    training because the flight deck had some different things in
    it that we needed to get used to, but that's the fundamental
    things that we look at.
        Senator Thune. You look at--so as a follow up, was there
    anything specific about the design of the 737 Max that
    differentiates the model certification process from some of
    those examples that you just mentioned?
        Mr. Elwell. Well, sir, the 737 Max is and required
    certainly an amended type certificate and again primarily
    because of the new modern complexities that it brought to the
    table. It did bring the MCAS into the equation but the MCAS was
    a supplement or an addition to a system that already existed in
    the NG.
        The engine position on the wing was different and it's what
    required actually--it's what necessitated the addition of MCAS
    and there was some differences in the screens, what was on the
    screens, but fundamentally the aircraft layout, the handling
    and the performance of the aircraft was the same, and thus the
    decision to make it an amended type certificate.
        Senator Thune. OK. Mr. Sumwalt, you mentioned in your
    testimony both the benefits and safety concerns related to the
    integration of UAFs in the Nation's airspace.
        As you know, the FAA Reauthorization Act of 2018 included
    numerous provisions related to the safe operation of this
    emerging technology.
        Are there any pending regulatory actions that the FAA in
    particular that you see as most important to ensuring the safe
    integration of drones into our airspace?
        Mr. Sumwalt. Thank you for that question, Senator Thune.
        As you're aware, the FAA recently enacted Part 107 to the
    Federal Aviation Regulations which imposes more regulatory
    requirements for drone operators and we see that as a positive.
        Senator Thune. OK. All right. Thank you. I see my time's
    expired, Mr. Chairman. Thank you all for your willingness to be
    here today and take questions.
        Senator Cruz. Senator Klobuchar.

                   STATEMENT OF HON. AMY KLOBUCHAR,
                      U.S. SENATOR FROM MINNESOTA

        Senator Klobuchar. Thank you very much, Mr. Chairman. Thank
    you to all of you.
        The two tragic airplane crashes included, by the way, a
    beloved community member from St. Cloud, Minnesota, Mucaad
    Hussein, and I know his family is grief stricken, and following
    these crashes, as many of my colleagues have talked about, it
    is very important that we figure out our certification process
    and get it right so we can prevent similar tragedies in the
    future.
        Mr. Elwell, I know you've been asked about this but let me
    try it a different way.
        Are there any safety measures the FAA may have
    miscalculated when evaluating the safety features of the Boeing
    737 Max?
        Mr. Elwell. Well, Senator Klobuchar, thank you for that
    question.
        We certify aircraft in a way that we have refined, as I
    said, for large aircraft, large commercial aircraft. It has
    been refined 130 times, over 130 times since we started doing
    these.
        In every certification we learn something new, from every
    IG audit, from every----
        Senator Klobuchar. Was this consistent with how you've done
    other certifications in other situations, the Boeing situation?
        Mr. Elwell. Yes, ma'am. This was an amended type
    certification that followed the procedures we use to determine
    and then to execute----
        Senator Klobuchar. But if you learn something else after
    this investigation or other things come out, you may change
    that process?
        Mr. Elwell. Absolutely. That's how we get better.
        Senator Klobuchar. And, Mr. Scovel, what is your office's
    timeline for this audit?
        Mr. Scovel. Thanks, Senator.
        We always shoot for 10 months. This is a very tall order
    for us, as I'm sure you can appreciate. We have a highly
    skilled team of aviation safety auditors who we'll turn to. If
    we can meet 10 months, I optimistically say great. It may well
    be some months after that. We will get to it as soon as we
    possibly can because we really truly appreciate your interest
    on all these matters.
        Senator Klobuchar. Thank you.
        Mr. Scovel. Thanks.
        Senator Klobuchar. Mr. Elwell, back to you, according to a
    recent New York Times article, Boeing charged airlines extra
    for critical safety features. These were optional add-ons.
        Following the crashes, does the FAA plan to update the
    requirements for aircraft safety features or take other action
    to mandate that these features are not optional?
        Mr. Elwell. Well, Senator Klobuchar, when we certify an
    aircraft, whether it's amended or a new type, critical safety
    features, that's an important term. If something is a critical
    safety feature on an aircraft, a passenger aircraft that we
    certify, it's not optional.
        So critical safety features----
        Senator Klobuchar. I see.
        Mr. Elwell.--are part of the certification package and I
    think what you're referring to is AOA displays on the CRTs in
    the cockpit, and I can tell you as a pilot that's flown
    aircraft, several aircraft in the military and the civilian
    world, I had aircraft that had AOA displays in the cockpit and
    I had aircraft that didn't, and it all depends on what the rest
    of the display says.
        In today's modern airplanes, and you've got 12-inch CRTs in
    the cockpit,----
        Senator Klobuchar. But is it possible this could be decided
    that these aren't just optional, that they should be mandatory
    if it's discovered after these investigations?
        Mr. Elwell. Absolutely.
        Senator Klobuchar. OK. And then do you know an estimate of
    how many safety features that the FAA lists as optional right
    now that detects sensor malfunctions or could you tell it to me
    later in writing?
        Mr. Elwell. I could tell it to you later, Senator
    Klobuchar.
        Senator Klobuchar. OK. All right. Chairman Sumwalt, what
    role does the U.S. play in setting international safety
    standards when it comes to training for foreign pilots?
        I know you'd answered some questions about training for my
    colleagues, but do we have any role there? I'm just thinking
    because we had someone from Minnesota was killed.
        Mr. Sumwalt. Sure. Senator Klobuchar, we are, as I've
    mentioned, we are member state to the International Civil
    Aviation Organization that sets recommended practices and
    standards and so it would be ICAO that would outline those
    international training standards that other member states would
    be expected to comply with.
        Senator Klobuchar. And could you weigh in on those training
    standards?
        Mr. Sumwalt. We could. The FAA is officially the U.S.
    representative to ICAO, but we work closely with them with our
    relationship with ICAO.
        Senator Klobuchar. I see. So you'd be involved in that, Mr.
    Elwell?
        Mr. Elwell. Yes, Senator, we would.
        Senator Klobuchar. OK. I'll follow up on that later.
        One last question I had of you, Chairman Sumwalt. In your
    testimony, you highlighted reducing fatigue-related accidents
    as one of the NTSB's most wanted transportation safety
    improvements for 2019 to 2020.
        As you know, I've led the Safe Skies Act, supported by
    Captain Sullenberger, among many, along with Senators Cantwell,
    Blumenthal, Markey, and Duckworth, to take the rest
    requirements that we put in place for passenger pilots and
    apply them to cargo pilots.
        This is something unrelated to these two crashes but part
    of airline safety and something that I know the Colgan families
    have also supported. So could you comment on that?
        Mr. Sumwalt. Absolutely. I want to thank you and Senator
    Blumenthal for your advocacy on that.
        The NTSB does not agree that there should be a different
    standard for passenger-carrying airlines and cargo airlines
    with respect to the fatigue rules. The FAA, as you know, did
    enact a fatigue rule in 2012 for passenger carriers that did
    not relate to cargo carriers, and we disagree with that
    disconnect.
        Senator Klobuchar. OK. Well, I hope you win. So we're going
    to keep pushing for this bill.
        Mr. Sumwalt. Thank you.
        Senator Klobuchar. Thank you.
        Senator Cruz. Senator Moran.

                    STATEMENT OF HON. JERRY MORAN,
                        U.S. SENATOR FROM KANSAS

        Senator Moran. Chairman, thank you very much. Thank you for
    conducting this hearing.
        Press and media reports, Mr. Elwell, indicate that Boeing
    was implementing changes in the Max after the first crash and
    that is at least an explanation for why they may be close to
    having a ``fix'' for that Max.
        Is there anything, a requirement that--first of all, is the
    FAA notified of that effort to make corrections to the Max
    after the first crash?
        Mr. Elwell. Senator, yes, the Boeing Company submitted an
    application for a software update to the MCAS, an MCAS software
    update after the Lion Air accident.
        Senator Moran. And is there a corresponding duty to warn
    either on the part of Boeing Corporation or the FAA either
    pilots or airlines, a duty to warn or a notification that there
    may be something wrong and a fix is on its way?
        Mr. Elwell. So nine days after the Lion Air accident, the
    FAA put out an Emergency Airworthiness Directive followed by a
    communique to all authorities around the world who fly the Max
    and what we pointed out was--back up a little bit.
        The FAA's role, primary role in any accident investigation
    is for continual operational safety. In other words, if in the
    course of an accident something of immediate import is
    discovered, we don't wait for the end of the accident for the
    final report. We act immediately and in this case, the initial
    data suggested that a reminder was needed and that's what the
    Emergency AD was, a reminder was needed for pilots and
    operators of this aircraft to apply standard runaway stab trim
    procedures should this be encountered and that's what the
    Emergency AD was.
        Now the software update that you're referring to is Boeing
    came to us with this and we talked to them about it. We
    accepted their application. They began work, but we determined
    that the issues that this software update was making, the
    things that it was improving upon for MCAS, did not warrant
    anything more than the announcement that this was in progress.
        Senator Moran. OK. Mr. Elwell, I'll stay with you for a
    moment longer.
        I suppose that there's always a question of why we would
    have a private company certify their product. In this instance,
    it happens in the aviation world. It happens all the time.
        What's the justification for that? We use ODAs,
    Organization Designation Authorizations, regularly. Would the
    FAA be able to certify aircraft without the use of that
    designation?
        Mr. Elwell. Senator Moran, that is a very important
    question, but let me go back to what you said in the question
    that we allow companies to certify their aircraft.
        Senator Moran. I know I misspoke in the way that you would
    phrase it and I understand the distinction. I'm not trying to
    discount the importance of an ODA.
        In fact, I'm hoping that you'll confirm to me the
    importance with proper oversight, with FAA certification
    required, the actions that are taken by private companies to
    provide the information necessary to certify is important and
    how would we do this in aviation without that process?
        Mr. Elwell. So the concept of ODA, as I said, has been
    around for 60 years and some form of delegation has been around
    since the 1920s. It is part of the fabric of what we've used to
    become as safe as we are today, and I don't want to give the
    impression that ODA is some resource, a way for us to sort of
    stretch our resources.
        We have very strict oversight on every participant in an
    ODA program and we make sure that they are experts in the
    field, that they have the appropriate understanding of FAA regs
    and manuals, they have professional integrity is checked,
    everything.
        But to your point, if we had no ODA at all, it would be an
    estimation that would require roughly 10,000 more employees to
    do that role at the FAA and about $1.8 billion for our
    Certification Office in the FAA.
        Senator Moran. How does that compare with--that process,
    that designation process compare to Europe and others across
    the globe when it comes to the use of that process?
        Mr. Elwell. So it's another excellent question. The
    European Aviation Safety Agency is the next, you know, biggest
    certification body in the world and they leverage ODA much more
    than we do. So it's used around the world.
        Senator Moran. So in this arena, there's nothing unusual to
    this process?
        Mr. Elwell. No.
        Senator Moran. It has been ongoing a long time and used
    globally, is that true?
        Mr. Elwell. Couldn't have said it better myself.
        Senator Moran. Thank you. Thank you, Mr. Chairman.
        Senator Cruz. Senator Blumenthal.

                 STATEMENT OF HON. RICHARD BLUMENTHAL,
                     U.S. SENATOR FROM CONNECTICUT

        Senator Blumenthal. Thanks, Mr. Chairman, and I want to
    thank the leadership of the Committee for having this hearing.
    Thank you for being here today, gentlemen, and I want to thank
    particularly the Inspector General, Calvin Scovel. We are lucky
    to have a professional of your caliber doing this investigation
    and I look forward to the results.
        I've been deeply disappointed, in fact shocked, that in
    grounding these aircraft, American safety officials in effect
    lagged instead of led the world. The same information was
    available to our FAA as was accessible to every other country
    that grounded its airline days ahead of us and that put
    American passengers in peril.
        But as important, maybe more so, is the system that led to
    in effect outsourcing safety to the manufacturers of these
    aircraft. Call it delegation or shifting, as you did. The fact
    is that the FAA decided to do safety on the cheap, which is
    neither cheap nor safe, and put the fox in charge of the
    henhouse. That was true of the 737 Max 8.
        In its rush to produce that aircraft because of competition
    from Airbus, critical safety features were disregarded, and I'm
    going to be introducing legislation that will reform this
    system which is so fatally riddled with flaws. There needs to
    be rigorous reform so that the FAA is put back in charge of
    safety.
        You said, Mr. Elwell, that the system is fact-based and
    data-driven. The FAA should have the facts and should be
    driving the data and making decisions. If the manufacturer has
    the facts and the data, not the FAA, if its employees chosen,
    hired, paid, fired by the manufacturer are the ones making
    these critical decisions and the FAA lacks all of the facts and
    data necessary to properly oversee them and overrule them, this
    system of oversight is failing.
        I will tell you I read some of the pilot reports. They're
    public. NASA has them. They provided them to me. They are
    chilling. If I'd been a passenger on one of those planes and I
    knew about these incidents, I would have wanted a parachute.
        Pilots of the airlines struggled to regain control of those
    aircraft in the same way that the pilots of the fatally crashed
    aircraft did. They succeeded, the others didn't.
        So I look forward to your support for legislation that will
    fundamentally change this flawed system.
        Mr. Elwell, have you reviewed those pilot reports?
        Mr. Elwell. Senator, thank you for your comments.
        I reviewed the reports. There were----
        Senator Blumenthal. Did you review them at the time that
    they were received by NASA?
        Mr. Elwell. The reports--I did not personally. The reports
    were reviewed as they were written and received. There were 24
    reports.
        Senator Blumenthal. Were they reported to you after the
    first crash because many of them followed the first crash?
        Mr. Elwell. The ASRS reports were reviewed and compared
    against the FDR data or FOQA data that we look at. ASRS reports
    are reports from pilots on experiences when they are on a trip.
    We take them very seriously. We review them. We have event
    review teams that sit down with the pilot and none of the 24
    reports associated with the Max related to the MCAS or related
    to what the pilots experienced in either accident.
        Senator Blumenthal. Well, I am familiar with the reports
    that were given to me----
        Mr. Elwell. Yes, sir.
        Senator Blumenthal.--and my time is limited here. Let me
    just ask you. Were you contacted by anyone in the
    Administration before making your decision to ground those
    aircraft?
        Mr. Elwell. From the moment, Senator, of the Ethiopian
    accident until we grounded on Wednesday morning, I kept
    Secretary Chao and the President briefed and fully apprised on
    all of our activities, which included, I would add, a full----
        Senator Blumenthal. Did she order you to ground the
    aircraft?
        Mr. Elwell. I'm sorry?
        Senator Blumenthal. Did she order you or otherwise
    recommend what your decision should be in grounding the
    aircraft?
        Mr. Elwell. Senator, the decision to ground, to make an
    emergency grounding of a fleet of aircraft is vested in the
    FAA. I made that decision.
        Senator Blumenthal. And one last question. I don't know
    whether you've seen a ProPublica report. It's just come to my
    attention. I think it came out today, which reports your
    contacts with airlines.
        Could you provide us copies of the e-mails between yourself
    and industry representatives and also a copy of your financial
    disclosure forms? I understand you had a consulting business
    while you were a part of the FAA, is that correct?
        Mr. Elwell. That's not correct, Senator. I'm happy to
    supply any and all communications.
        Senator Blumenthal. I want to give you a full opportunity
    to respond to the article that's just been provided to me, but
    it says that on those financial disclosure forms, you reported
    some income as a special government employee while you were a
    member of the FAA.
        Mr. Elwell. Happy to provide any and all information.
        Senator Blumenthal. Thank you. Thank you, Mr. Chairman.
        Senator Cruz. Senator Blunt.

                     STATEMENT OF HON. ROY BLUNT,
                       U.S. SENATOR FROM MISSOURI

        Senator Blunt. Thank you, Mr. Chairman.
        So, Mr. Elwell, I think established in the questions with
    Senator Moran the long history of delegating certification. Let
    me ask a couple more questions about that.
        The Seattle Times recently reported that FAA technical
    experts and safety engineers said in interviews that they were
    urged to delegate more responsibility to Boeing during the 737
    Max certification process or to speed it up.
        Does the FAA still retain the mandate to certify aviation
    technologies that are new or novel?
        Mr. Elwell. Yes, Senator, we do. That is our authority and
    it's our sole authority. We do not allow self-certification of
    any kind.
        Senator Blunt. Were there any deviations from that policy
    in regards to the Boeing 737 Max?
        Mr. Elwell. Sir, none of which I'm aware. We have a very
    good whistleblower program at the FAA. We encourage all levels
    of employees to report any activity that they find that doesn't
    go with our safety culture and I looked into this personally.
    There were no comments made by employees to our knowledge. I
    can't speak to the Seattle Times article.
        Senator Blunt. And it's your view that FAA managers did
    conduct the kind of reviews of that delegated authority that
    they're expected to conduct?
        Mr. Elwell. Absolutely. Yes, sir.
        Senator Blunt. Well, let's go back to the investigation
    going on right now. I think, Mr. Sumwalt, you said that--I
    think you said that we were cooperating closely with the
    investigation, the Ethiopian investigation.
        Is that cooperating closely, is that the right phrase?
        Mr. Sumwalt. Well, I'd actually say we're actively engaged.
    We have investigators on the ground in Ethiopia that are
    assisting and advising the Ethiopian Government as well as
    helping them to put together a draft interim report.
        Senator Blunt. Are they cooperating closely with you then?
        Mr. Sumwalt. Yes, sir, they are.
        Senator Blunt. And are you getting access to all the
    information you'd like to have access to?
        Mr. Sumwalt. At this time, we are.
        Senator Blunt. I know it's a much smaller agency than your
    agency in terms of budget and size and experience. How would
    you compare this investigation to other investigations you've
    been involved in and what are you doing to make up differences,
    if there are differences?
        Mr. Sumwalt. Well, I don't want to sound like I'm bragging
    because I'm not. The NTSB has a lot of experience with
    investigating crashes. We've been in business for 52 years. So
    we have a lot of experience, but as an accredited
    representative to foreign investigations, we often find that
    other countries do not have the resources that we do. So we are
    very experienced with working with other countries, other
    states to help them, and I think that this investigation is
    going as it should.
        The Ethiopians, again this is, like I wasn't bragging and
    this next statement is not a derogatory statement, they don't
    have the experience that we have because they haven't
    investigated the number of crashes that we have over the years.
    They're a relatively new agency. So they are proceeding very
    deliberately and very cautiously.
        Senator Blunt. There was another comment made earlier about
    a prohibition unless information's been cleared by the host
    country. I believe the way I heard that, that was for you to
    share that information with others.
        Does that suggest that there's information that's not being
    shared with you?
        Mr. Sumwalt. I have no indication at all that the
    Ethiopians are not sharing with us the information that we need
    to make sure that we are aware of the safety-related
    information that we need to feed back to the FAA or feed back
    to Boeing to ensure continued airworthiness safety.
        Senator Blunt. And those earlier comments were about
    whether you could publicly share that information without the
    host government agreeing with that, is that right?
        Mr. Sumwalt. That is correct. However, the law does further
    state that nothing in this subsection shall restrict the Board
    at any time from referring to a foreign accident investigation
    information in making safety recommendations.
        So, in other words, if we identify safety-related
    information that we need to make a safety recommendation, then
    we can use that information, but we would always want to
    coordinate that ahead of time with the state of occurrence.
        Senator Blunt. So you don't feel unduly restricted by that
    prohibition of releasing information?
        Mr. Sumwalt. I do not, but it is--and to be clear, as
    you've characterized it, it is for the public release of
    information is what the law is specifically calling for.
        Senator Blunt. That's helpful for me.
        Mr. Scovel, do you want to comment on that?
        Mr. Scovel. Thank you, Senator Blunt.
        Not on that particular question. Thanks for recognizing my
    signal just for a moment. I may have information that may help
    you and the Committee in understanding the Seattle Times point
    that you mentioned in an earlier question, and I want to refer
    back to our 2015 Audit Report on ODA.
        In the course of that work, we reviewed four ODA company
    self audits that identified employee concerns about undue
    pressure which could lead to rushing safety-critical tasks to
    meet production schedules.
        Now I want to clarify these were not U.S. DOT Inspector
    General audits. These were company self audits that were
    required by FAA as part of its oversight process for ODA.
        It's unclear to us what FAA may have known about those
    company self audits. As I mentioned, there were four of them.
    Two involved Boeing in fact, one in the Seattle area dating to
    2013 and the other was from Boeing's Charleston, South
    Carolina, facility in 2014. The remaining two concerned Bell
    Helicopter, both in Ft. Worth, 2013 and 2014.
        We didn't step into the shoes of the safety regulator. It's
    not in our lane to do that, but when we learned about the self
    audits, we determined that it would be appropriate for us to
    make a recommendation to FAA that they find the best way to use
    those company self audits in order to enhance their oversight
    of the companies' ODA processes.
        Senator Blunt. When would you have made that
    recommendation?
        Mr. Scovel. That was in 2015, sir.
        Senator Blunt. Mr. Elwell, do you know what the follow up
    from the FAA was on that recommendation?
        Mr. Scovel. I can help you on that, too, sir. I'll pass to
    my colleague to take an answer on that, but I also have what is
    the auditor's answer, as well.
        Senator Blunt. And what was it?
        Mr. Scovel. We made the recommendation and FAA concurred.
    They took action to our satisfaction to address the
    recommendation, the intent behind it, and so we closed that
    recommendation.
        What remains to be done, and this is the typical audit
    process, is to see how it's effectively implemented going
    forward. So when we close a recommendation, it means that the
    agency is poised to execute it but it may in some cases be a
    matter of years before we return to see the effectiveness of
    that implementation.
        Senator Blunt. Mr. Elwell, do you want to add anything?
        Mr. Elwell. I'd like to thank the Inspector General. We did
    an audit of our whistleblower program and so I need to go back
    and look at this self audit information that General Scovel's
    talking about and----
        Senator Blunt. Then you'll respond to the record with what
    you find?
        Mr. Elwell. Absolutely.
        Senator Blunt. Thank you.
        Senator Cruz. Senator Duckworth.

                  STATEMENT OF HON. TAMMY DUCKWORTH,
                       U.S. SENATOR FROM ILLINOIS

        Senator Duckworth. Thank you, Mr. Chairman.
        And, Mr. Elwell, I want to touch on the training aspect of
    pilots in general of aircraft certified by the FAA and then
    also about the specific Max 8 aircraft.
        Would it be a true statement to say that U.S. pilots
    properly trained would know how to respond to an uncommanded
    nose-down pitch rate on an aircraft with an automated--I'll
    give you an example. I flew the Blackhawk.
        Mr. Elwell. Yes, ma'am.
        Senator Duckworth. It went through a real problem in the
    beginning of its development and to this day, I know the
    procedure for uncommanded nose-down rate, right.
        Mr. Elwell. Mm-hmm.
        Senator Duckworth. So I know it by heart. I will always
    know it until the day I die.
        Is that something that most pilots would be able to
    basically say what those steps or those memory items if they're
    properly trained under U.S. system?
        Mr. Elwell. Yes, Senator Duckworth, our American U.S.-
    trained pilots of large commercial aircraft know that procedure
    and if I might,----
        Senator Duckworth. Yes.
        Mr. Elwell.--I wanted to amplify what we were doing prior
    to the grounding on Wednesday, one of the things we were doing,
    I was doing, is talking to the heads of all of the pilot groups
    that flew the Max and asking did they have reservations about
    the Max.
        This is in addition to data we got from 57--over 50,000 Max
    flights in North America, Canada and the U.S., and in those
    data reports, and those are data reports that are coming right
    off the airplanes, there was not a single case in North America
    of an MCAS malfunction or what we found happened in Lion Air,
    but that wasn't enough.
        I called and talked to the presidents of the Southwest
    Airline Pilots Organization, ALPA, over 53,000 pilots, and APA,
    the American Airlines Pilots Group, and asked them what is your
    experience flying the Max? What are your pilots saying? They
    said to a person, to a group we are absolutely confident in the
    safety of this aircraft and our pilots' level of training in
    flying it.
        If I hadn't had that information, the data, and the
    affidavits from those unions or from those pilot groups, I
    would not have been able--that's part of the data package I had
    to wait for the data from the accidents to justify a grounding.
        Senator Duckworth. Let me then ask you about--so we talked
    a bit about just responding to an uncommanded nose-down
    attitude. That aside, there's another procedure. My experience
    as a Blackhawk pilot, we have the stabilator that would slow
    down, killed a bunch of pilots, hurt a bunch of people, but the
    automatic control system, the basic procedure is reset. If it
    doesn't reset, turn it off, manual control, slow to zero at
    about 40 knots indicated airspeed. I know nothing you ever flew
    ever went as slow as 40 knots indicated airspeed as I did, slow
    and low pilots.
        The question I have for you is, while the MCAS is not
    specifically referenced in the aircraft manual for the Max 8,
    the procedure to shut off stabilizer trim switches are in the
    manual as a response to this, is that correct, and this is
    something that American pilots would be trained on?
        Mr. Elwell. Yes, ma'am.
        Senator Duckworth. Is this something that FAA, through
    ICAO, would ensure that other pilots in other countries should
    also be trained on?
        Mr. Elwell. When we interact at ICAO, it is usually not to
    the specificity of a fleet type, but we do use our influence at
    ICAO and our influence at the International Civil Aviation
    Organization is substantial and we use it at any opportunity we
    get to raise the safety level around the world.
        In fact, we don't have the final reports on either of these
    accidents, but I have already set in motion at the FAA
    activities to go to the Assembly and, as you know, I'm sure,
    ICAO meets every 3 years and we're already examining what we
    bring to the Assembly this year, our country, our pilots, to
    help raise the safety bar, which is, as you know, we're
    responsible for aviation safety in the United States, but there
    are no boundaries, there's no border. It's a global endeavor.
        We care deeply about other countries and we have over a
    hundred technical assistance agreements around the world. We
    have 20 bilateral aviation safety agreements with 47 countries.
    We're very, very passionate not just about safety in the U.S.
    but that every country raises their safety bar.
        Senator Duckworth. So are you saying that we need to look
    at strengthening the International Aviation Safety Assessment
    Program and do you plan on doing that in the next ICAO meeting?
        Mr. Elwell. The International Aviation Safety Assessment
    Program, I think, is sound. It's very good. The IASA that we do
    with countries around the world--because what we do is we
    evaluate the Civil Aviation Authority and a healthy Civil
    Aviation Authority tells you that that country has a good
    culture for everything--airports, pilots, airlines--but by
    working to help raise the standards overall, then when we do an
    IASA in a country and we do a rating, we'll be rating against
    higher standards and I think that that's appropriate and it's
    well worth our attention.
        Senator Duckworth. Thank you. I'm out of time, Mr.
    Chairman. Thank you.
        Senator Cruz. Senator Capito.

                STATEMENT OF HON. SHELLEY MOORE CAPITO,
                    U.S. SENATOR FROM WEST VIRGINIA

        Senator Moore Capito. Thank you, Mr. Chairman. Thank all of
    you for being here.
        Mr. Elwell, let me just make sure I understand exactly
    because some of the questioning from Senator Duckworth is
    similar to what I was going to ask you.
        So the plane, the 737 Max 8 with MCAS, has been flying
    since 2017, is that correct?
        Mr. Elwell. Yes, ma'am.
        Senator Moore Capito. OK. And you said, and I have a report
    here that says, in the wake of the Airworthiness Directive and
    discovery of possible issue with MCAS on Boeing 737 Max, this
    is quoted from an article in Bloomberg, I believe, it says, ``A
    number of pilot groups raised concerns over whether or not
    pilots had been sufficiently made aware of the system that is
    unique to that aircraft.''
        Did you just say that nobody had raised issues about this
    system previous to either one of these accidents or maybe in
    between the two of them?
        Mr. Elwell. Senator, what I was remarking upon is we look
    at the data that comes off aircraft that's called FOQA data and
    please don't ask me what the letters mean, but what that is, is
    data that literally comes off the flight data recorder. It's
    ones and zeroes that come off of aircraft and airlines get that
    data.
        They use that data in their safety management systems and
    when we ask for that data and we ask for it to be filtered on
    certain parameters, they give that data to us and what I'm
    saying is there were no incidents on Max flights in North
    America. There was no incident of this happening.
        Now when I say also that the pilot reports that Senator
    Blumenthal mentioned earlier, the ASRS or the NASA reports, I
    personally read--there were 24 of them. I read every one of
    them and I'm not the key expert in this determination, but they
    were all looked at and determined and I concurred none of them
    went to the MCAS. None of them demonstrated an MCAS malfunction
    and that's what I meant.
        Now what you're referring to----
        Senator Moore Capito. What am I referring to?
        Mr. Elwell. Senator, I believe what you're referring to is
    when the accident first happened, there were some pilots who
    said we would have liked to have read about that MCAS. We would
    liked to have known that. That wasn't in the manual. One of the
    things that we did in our Emergency AD was direct to have MCAS
    explained in the flight operating manual.
        Senator Moore Capito. OK. So that was in between the first
    accident and the second accident?
        Mr. Elwell. Yes, ma'am.
        Senator Moore Capito. OK. Then let me ask then you about
    the training then that occurred after that. It's given in a
    short self-administered online course. How does that work? Are
    you in a testing center? Are you on your own in your own laptop
    and you just check box, box, box? How's that administered? How
    is a self--I mean, we've all taken self-administered computer
    tests. How do you ensure that this is absorbed and that the
    person actually taking it is the person taking it?
        Mr. Elwell. Well, first of all, as a former pilot myself, I
    will tell you that when you go through differences training and
    that's what that is, differences training,----
        Senator Moore Capito. Mm-hmm.
        Mr. Elwell.--that isn't something you pencil with because
    it's the aircraft you fly.
        Senator Moore Capito. Right.
        Mr. Elwell And our pilots in the United States are
    incredible professionals. Now they can do that. They can do
    that when they go to the Academy, when they go to the school--
    --
        Senator Moore Capito: Right.
        Mr. Elwell.--for their respective airline. They can do that
    in recurrent training. They can do it in initial training. I
    imagine, and although I can't tell you now if this is the case,
    that they could also do it on their computers at home, but all
    of that training has a test at the end, a quiz at the end to
    test for knowledge, and the important thing to note here is
    that the determination was made because of the flying
    characteristics of the Max versus the NG that this iPad
    training that you read about was what was needed by pilots to
    be able to fly the plane.
        Senator Moore Capito. So was that required then in between
    the two in the United States?
        Mr. Elwell. It was always required.
        Senator Moore Capito. It was always required.
        Mr. Elwell. Yes, ma'am.
        Senator Moore Capito. Let me ask you about another sort of
    thing that you've seen out in the press and I don't really have
    it specifically here and in terms of the fix to the airplane.
        There are certain fixes that are going to be offered to
    certain airlines and there may be different pricing and how
    much is it going to be. There has been sort of a conflicting
    story in the media. How do you respond to that? Do you know
    anything about that?
        Mr. Elwell. So, Senator, I read those reports or I read
    those articles, and those I don't believe were characterized as
    fixes. Those are options.
        When an airline or anybody purchases an airplane like
    anything else, there are options. As I was explaining before,
    if it is a safety-critical display in the cockpit and we
    certify it, it's required. It's not an option.
        Senator Moore Capito. Right.
        Mr. Elwell. So, you know, AOA displays, some airlines and
    some pilot training, the pilots and pilot training groups, for
    instance, the Navy, you know, love AOA displays in the
    cockpits. The Air Force not so much.
        It is a matter of every piece of real estate in a cockpit
    is precious and you put one gauge up there, you're sacrificing
    another.
        Senator Moore Capito. Right.
        Mr. Elwell. These are important distinctions and in this
    case, those displays are not safety-critical because there are
    other ways for pilots to gauge their energy state and that's
    what an AOA gauge does. It tells you your energy state.
        Senator Moore Capito. Well, not understanding the
    technicalities of it, I would say that being a member of the
    general flying public, it's hard to believe that a safety item
    that could possibly be connected to taking down two jets and
    killing over 300 people would ever be characterized as any kind
    of an option.
        Mr. Elwell. Right.
        Senator Moore Capito. So I want you to have the chance to--
    and I understand it is more technically involved than what I'm
    representing, but that's how it's perceived to the flying
    public.
        Thank you.
        Mr. Elwell. Thank you.
        Senator Cruz. Senator Markey.

                   STATEMENT OF HON. EDWARD MARKEY,
                    U.S. SENATOR FROM MASSACHUSETTS

        Senator Markey. Thank you, Mr. Chairman.
        Mr. Elwell, as the safety agency entrusted to provide the
    safest, most efficient aerospace system in the world, the FAA
    must ensure that aviation safety is not a luxury that can be
    bought and sold for an extra fee, but for Boeing, critical
    safety features that could have saved the lives of 346 souls on
    two of their 737 Max 8s were yet another profit center deemed
    optional, like premium seats or extra bathrooms or fancy
    lighting. That's wrong, just plain wrong, Mr. Elwell.
        Boeing sold two safety features, the angle of attack
    indicator and the warning lights, to the airlines for an
    additional fee, not as a standard part of the aircraft. These
    features could have alerted the pilots and aviation mechanics
    that the doomed aircraft had faulty sensors which preliminary
    findings suggest are the cause of these two aviation disasters.
        Let's be clear. In our automobiles, we don't pay more for
    seatbelts, for airbags, or in medicine for childproof caps.
    Those aren't optional. Those are all built-in as safety
    features to protect people, to protect families, and so should
    all critical safety features on aircraft.
        Administrator Elwell, do you believe that Boeing's practice
    of selling the angle of attack indicator and warning lights as
    separate optional features may have contributed to the Lion Air
    and Ethiopian Airline crashes? Yes or no?
        Mr. Elwell. Well, Senator, thank you for that question.
        The AOA indicator, the AOA vane is not an optional piece of
    equipment on the airplane. We look in the certification process
    that we've been using for decades that we've refined over 130
    times is geared toward one thing, the safest possible----
        Senator Markey. Should all of the safety features have been
    mandatory that could have alerted pilots and mechanics to
    issues with the sensors? Should they have been mandatory? Yes
    or no?
        Mr. Elwell. Senator, safety-critical pieces of equipment on
    an aircraft are mandatory. That's what certification does. If
    it's safety-critical,----
        Senator Markey. So you don't think that they should have
    been mandatory? Is that what you're saying? Is that what you
    just said? They should not have been mandatory?
        Mr. Elwell. Sir, I'm saying that any----
        Senator Markey. Yes or no? Should they have been mandatory?
    Yes or no?
        Mr. Elwell. Sir, the distinction between what goes in a
    flight deck and what stays out is a discussion and whether or
    not a display is safety-critical or not is a distinction that
    FAA is qualified to make.
        Senator Markey. Do you believe that charging additional
    fees for these safety features and other safety features, like
    backup fire extinguishers in the cargo hole and oxygen masks
    for flight crews, may discourage airlines from equipping their
    airlines with important safety systems? Yes or no?
        Mr. Elwell. Well, Senator Markey, I find it hard to believe
    that a safety company like an airline would save a couple
    thousand dollars on an option that might improve safety on a--
    --
        Senator Markey. It may be hard for you to believe, but it's
    happening and as a result, the safety agency has a
    responsibility to make sure that an airline doesn't place----
        Mr. Elwell. Absolutely.
        Senator Markey.--profit over people's safety. Do you agree
    with that?
        Mr. Elwell. Senator Markey, I would tell you that----
        Senator Markey. Do you think the FAA has the responsibility
    to tell these airlines that they cannot change safety for
    profits when it's clear that that safety device plays a huge
    role in protecting the plane and its passengers? Yes or no?
        Mr. Elwell. Senator Markey, that is our fundamental
    responsibility.
        Senator Markey. Yes or no? Should that be mandatory?
        Mr. Elwell. Senator Markey, the fundamental role of the FAA
    is to determine what the safety-critical aspects of every part
    on that airplane----
        Senator Markey. Should the FAA ban the practice of airlines
    selling safety features ala carte to the airlines? Yes or no?
        Mr. Elwell. Senator Markey, I will tell you that if there
    is any manufacturer that sells a safety-critical part ala
    carte, we will not permit it.
        Senator Markey. Well, if you change the rules so that they
    cannot do this, then that will be progress, but if business as
    usual continues, then passengers are going to continue to be
    vulnerable. So from my perspective, safety should never be ala
    carte. Safety should never be optional. Safety should always be
    mandatory and that's why I have sent a letter with 16 of my
    colleagues to Boeing demanding that they never again have any
    safety option as something that is discretionary with their own
    profit model.
        It is absolutely unacceptable and it's unacceptable for the
    FAA to delegate to an airline what is safe, what is not, what
    they can afford, what they cannot. This should not be an
    option. Seatbelts, airbags, or whatever's in an airline should
    never be optional.
        So my view is that until the FAA finally stands up and says
    that this is something that must change, then we are going to
    have problems, big problems, and that's why I'm introducing
    legislation with my colleagues to ensure that this never
    happens again and that when something is determined to be a
    safety feature that it no longer is an option for the airline
    to include it or else we will just continue to see continued
    repetition of what is happening because ultimately
    overconfidence breeds complacency and complacency breeds
    disaster.
        We've seen it here and we'll see it again, unless we
    mandate safety as something which is not optional.
        Thank you, Mr. Chairman.
        Senator Cruz. Senator Rosen.

                    STATEMENT OF HON. JACKY ROSEN,
                        U.S. SENATOR FROM NEVADA

        Senator Rosen. Thank you, Chairman Cruz, and thank you to
    all the witnesses for being here.
        You know, I spent most of my career working as a computer
    programmer and systems analyst with the focus on software. In
    fact, in the 1980s, I worked for Hughes Aviation working out of
    the General Aviation Terminal in Las Vegas, helping them write
    programming that would assist in airplane maintenance and
    inventory.
        So from that perspective, I am very concerned about what
    I've read and heard regarding the software for the 737 Max 8s
    and Max 9s. Pilots have told me that there's significantly more
    new software on these planes than usual and this is because
    planes don't actually fly like a 737 without the software. The
    physics of the plane is just a little bit different.
        So, Mr. Scovel, let's talk a little bit about new
    certification. Is this really a 737 or does it require a new
    original certificate, and given that this plane, which is
    equipped with highly advanced software and is flying today in
    2019, I just want to say today is 2019, is flying off an
    original certificate that was issued, and I'm sure you know
    this well, in 1967. The Beatles were the top of the charts in
    1967, no cell phones, no technology, very different, so
    different kind of plane.
        So do you think there could be some loopholes in the
    current certification system that makes it perhaps a little bit
    too easy for an airplane manufacturer to continue to buy this
    or get a new original certificate?
        I want to ask one other thing. If you can or supply this in
    writing, can you tell us how many derivative certificates have
    been issued for the 737 since it's originally been certified
    over 50 years ago? It kind of seems like we had a canoe in 1967
    and today you're certifying the cruise ship. They're not the
    same.
        Mr. Scovel. Thank you, Senator.
        To your second question, I will defer to Mr. Elwell. I
    believe he and FAA are in a better position than I am or my
    office is to give you that particular number.
        Senator Rosen. You can supply that in writing.
        Mr. Scovel. Yes, ma'am.
        Senator Rosen. That would be fine. Thank you.
        Mr. Scovel. Be happy to.
        Senator Rosen. And then you can answer the first question
    about running off the 1967 certification.
        Mr. Scovel. Right. I don't know the answer to your
    question. We have not completed that audit work yet. We can
    include it as a point that we will cover and we'd be happy to
    report back to you and the rest of Congress and the Secretary.
        Senator Rosen. Does it seem reasonable to think that you
    should have a new certification or some updates since 1967,
    except updates to the user manual, and that's fine. I'll look
    for that in writing.
        I want to go on to enforcement versus compliance at the
    FAA. So some have argued that in recent years, the FAA's safety
    philosophy has moved from one of enforcement to one of
    compliance where, instead of penalizing safety violations
    without penalty, the agency has instead given industry the
    opportunity to correct the safety violations without penalty in
    order to comply with FAA regulations.
        So, Mr. Elwell, would you say that this is an accurate
    characterization of the FAA's current approach?
        Mr. Elwell. Thank you, Senator Rosen.
        Compliance is the end game, enforcement is a tool, and when
    we have a stakeholder in the system that is unwilling or unable
    to comply with our regulations, enforcement is aggressively----
        Senator Rosen. So would you say that this is the current
    approach, enforcement versus compliance? Yes or no? Do you
    think?
        Mr. Elwell. Senator Rosen, what I'm saying is that
    compliance is the end game and that's why it's called the
    Compliance Program because we have enforcement as a tool but we
    also work with people to fix their problems because it's much--
    we've found in our years of safety regulation that it is a much
    more productive model, and this is not something that we just
    changed a couple years ago. This is an organic development of
    our safety philosophy over decades, that when you work with
    somebody who has made an honest mistake to get----
        Senator Rosen. So we're going to say that's a no. So you're
    working on compliance. So if that's not the case and the FAA's
    robustly enforcing safety regulations, what steps can we now
    take to ensure that rules are in place to prevent this from
    happening again, and if proactive enforcement is paramount, why
    did it take the first Max 8 crash for the FAA even to begin the
    process of requiring Boeing to make software changes to prevent
    these deadly malfunctions?
        Mr. Elwell. Senator Rosen, the process by which we improve
    safety is an oversight process that it is constantly refined,
    ongoing. It involves compliance activities and it involves
    enforcement.
        What we have with Lion Air and Ethiopia are two tragic
    accidents, the reasons for which we still don't know.
        You can be assured by the FAA and by me that when the
    results of these accidents come out, anything that we can
    change and make better, we will. That's what we do. That is the
    primary reason for our existence is to improve safety, but we
    have to get all the data. We have to get all of the results
    from the accident investigation. We don't know the cause, the
    primary causes of these accidents, but when we do, you have my
    assurance that we will take the action necessary that they
    don't happen again.
        Senator Rosen. Thank you. I have one last question about
    the software.
        You mentioned that it masks, it masks the problem for the
    pilots, so that the pilots feel like the plane is flying the
    way it should. It'd be like if I was driving my car and a wheel
    flew off but my steering wheel still felt as if I had four
    wheels.
        So why would you have software that would mask a problem
    like this? Can you explain?
        Mr. Elwell. Senator Rosen, thank you for asking that
    question because if that's the impression I gave on what MCAS
    does, then I'm sorry because that's not what it does. It
    doesn't mask a problem.
        Senator Rosen. Well, you said it makes the plane feel like
    it's flying to the pilot like it should.
        Mr. Elwell. Well, see, what fly-by-wire technology does and
    that's what the Max is, you know, when planes were first
    designed and flown, the yoke was connected to cables and
    pulleys and so you had direct interaction, physical interaction
    with the flight controls. Pilots had the feel, sort of like
    when you're driving your car, you turn the wheel.
        Senator Rosen. Right. So the instrument's telling you one
    thing and the feel's telling you another with the MCAS?
        Mr. Elwell. No, that's not quite how it works. What the
    MCAS does is it is a computer program that feeds information to
    the yoke so that the input the pilot makes to the yoke is
    proportional to what the flight controls do. It doesn't mask
    any problem. What it does is give the proper feel to a pilot
    because he doesn't have those cables and pulleys.
        Senator Rosen. So he would feel as if the nose were going
    down, going up, whatever he would feel?
        Mr. Elwell. He would feel it and in fact that is what
    happened and that's what happens if any computer or any device,
    even the pitch trim motor, does something to the nose of the
    airplane, the pilot's going to feel it.
        Senator Rosen. Would feel that in his----
        Mr. Elwell. Yes, yes, absolutely.
        Senator Rosen. Thank you very much. I appreciate it.
        Senator Cruz. Senator Udall.

                     STATEMENT OF HON. TOM UDALL,
                      U.S. SENATOR FROM NEW MEXICO

        Senator Udall. Thank you, Chairman Cruz and Ranking Member
    Sinema, for holding this important hearing, and I know you guys
    have been here for two hours. So I'll try to just get to the
    point here.
        I first requested an aviation hearing on aviation safety
    last April when in Albuquerque we lost a shining light, a woman
    by the name of Jennifer Riordan. She was flying home from
    Philadelphia on a Southwest Airlines flight when a fan blade
    caused an engine to fail, you guys are nodding you understand
    this one, shattered a window and partially pulled Mrs. Riordan
    out of the plane.
        This incident was shocking but it was not the first time
    this engine type failed, and I know that this is just a first
    of a series of conversations on how we can improve the
    oversight of the Federal Aviation Administration, including
    rethinking, if necessary, the airworthiness certification
    process.
        Another important issue we must discuss is the integrity of
    the engines that are used. Many of us may not be aware but
    yesterday, Southwest Airlines 727 Max engine, a CFM Leap 1B,
    had an emergency landing during a flight to the Southern
    California Logistics Airport. This is at least the third
    Southwest Airlines that has had an emergency airline caused by
    engine troubles, all stemming from the same manufacturer of
    engines.
        Mr. Chairman, I would seek unanimous consent to add an
    article on these engine troubles from the Seattle Times to the
    record.
        Senator Cruz. Without objection.
        [Seattle Times newspaper article follows:]

      The Seattle Times--Originally published June 15, 2018 at 6:00 am /
                       Updated June 18, 2018 at 10:37 am

      Troublesome advanced engines for Boeing, Airbus jets have disrupted
                         airlines and shaken travelers

               By Dominic Gates--Seattle Times aerospace reporter

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        In 2014, Air New Zealand and Boeing showed off the first delivered
    787-9 Dreamliner at Paine Field in Everett as finishing touches were
    put on the casing of a Rolls-Royce Trent 1000 engine. (Mike Siegel/The
    Seattle Times)

        A slew of technical problems with the three latest-technology jet
    engines is widely disrupting operations at airlines, bleeding cash from
    the engine makers and grounding significant numbers of Airbus and
    Boeing jets.
        A slew of technical problems with the three most advanced models of
    jet aircraft engines is widely disrupting operations at airlines,
    bleeding cash from the engine makers and grounding significant numbers
    of Airbus and Boeing jets.
        The most difficult of the issues has this month left almost 50
    Boeing 787 Dreamliners sold to some of the world's top airlines sitting
    powerless on the ground, waiting for engines before they can fly again.
        And if the problem isn't contained, it could derail Boeing's plan
    to raise the 787 production rate next year.
        British engine manufacturer Rolls-Royce has been inspecting its
    Trent 1000 engines on the Dreamliners for cracked turbine blades deep
    inside, and taking off those with cracks for repair.
        The number discovered to have problems has ``outstripped our
    ability to support the customers with spare engines,'' said Trent 1000
    project director Gary Moore in an interview.
        ``We are causing a very disproportionate amount of disruption at
    this moment.''
        Steve Udvar-Hazy, chairman of Air Lease Corp. and a leading figure
    in the airline world, said disruption from the grounded jets is
    compounded by airlines having to reroute some of the Dreamliners they
    can still fly.
        Flights across the Pacific, in particular, can no longer fly normal
    routes because, in case of an engine emergency, safety agencies now
    limit Dreamliners powered by one of the Trent 1000 engine models under
    scrutiny to flying no more than 2.3 hours from the nearest airport--
    down from 5.5 hours previously.
        ``It's having a huge impact. It affects a lot of the key 787
    operators,'' said Udvar-Hazy. ``There's a lot of scrambling going on.''

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    No quick fixes
        The impact won't be short term.
        Rolls is returning the repaired engines to airlines with only a
    temporary fix. A permanent modification won't be available until the
    end of the year at the earliest.
        ``Those engines will have to come back to us when the final fix is
    available,'' said Moore.
        Meanwhile, repeated technical problems with another engine--Pratt &
    Whitney's Geared Turbofan (GTF), the innovative new design that will
    power close to half of the Airbus A320neo fleet--have caused Pratt to
    fall way behind in deliveries, leaving engineless planes to stack up on
    the ground at Airbus factories.
        At a gathering of the world's top airline executives in Sydney this
    month, Guillaume Faury, the new president of Airbus Commercial
    Aircraft, said that by the end of June the European jetmaker will have
    about 100 otherwise completed A320neos sitting grounded without engines
    outside its final-assembly plants in Toulouse, France, and Hamburg,
    Germany.
        ``We have an industrial crisis to manage,'' Faury told trade
    publication Aviation Week.
        In comparison, the problems with the third engine--CFM
    International's LEAP engine, which powers the rest of the Airbus
    A320neos and all of Boeing's 737 MAXs--are less severe.
        Boeing says it's been able to minimize the impact on MAX
    deliveries. But CFM had to remove dozens of LEAP engines from A320neos
    for repair, and LEAP deliveries to Airbus are running up to six weeks
    behind schedule.
    Problems emerge late
        These latest engines, all marvels of sophisticated engineering,
    incorporate significantly new technologies: new alloys in the Trent
    1000, a gearbox to slow the fan speed in the GTF, ceramics in the
    hottest part of the LEAP.
        All were certified as safe by the Federal Aviation Administration
    (FAA) and its European equivalent, the European Aviation Safety Agency
    (EASA).
        And all three are powering the latest generation of fuel-efficient
    Airbus and Boeing aircraft where production rates are rising sharply to
    levels never before anticipated: heading up to 14 jets per month for
    the widebody 787, and to 60 jets per month and higher for the
    narrowbody 737 and A320 aircraft.
        ``The new technology aircraft bring tremendous economics and
    operating performance to the airlines, but they are only as good as the
    engines,'' said Udvar-Hazy. ``We have never seen this unprecedented
    number of aircraft scheduled to be produced at the very time when we
    have all these engine issues.''
        Unfortunately, so-called ``teething problems'' with new technology
    may not show up until the engines have been used for several thousand
    hours in all kinds of climate conditions.
        ``The issue with engine certification is that's there's really no
    substitute for in-service experience,'' Hazy said.
        FAA spokesman Les Dorr said the safety agency monitors newly
    certified engines after they enter service for issues ``that were not
    evident in the certification phase.''
    Most Read Business Stories

      1  Apple says it plans to turn Seattle into `key engineering hub'
            with 2,000 new workers

      2  Seattle is `a notable exception' for stalled home prices

      3  Sellers in Amazon's bookstore feel beaten up by counterfeit Wild
            West

      4  Housing crunch sends bigger populations to smaller towns

      5  Nintendo's Doug Bowser begins his reign, enjoying jokes about his
            namesake Mario nemesis

        And when engine makers come up with fixes to such issues, they
    cannot be installed on airplanes until the FAA analyzes, tests and
    certifies the changes.
        ``Engine modifications undergo the same scrutiny. . .as original
    designs,'' Dorr said.
    Airline trouble
        The public's belief in airplane and jet-engine safety is
    understandably shaken by terrifying accidents such as the April engine
    explosion on a Southwest Airlines 737 that killed a female passenger
    when shrapnel from the engine shattered the window by her seat,
    depressurizing the plane and partially sucking her out of the aircraft.
        Yet that was the first U.S. airline-passenger fatality due to an
    accident in more than nine years, and the first in Southwest's history.
    The engine that exploded, the CFM-56, has been in service since 1997,
    has flown for some 350 million flight hours and has a reliability
    record second to none.
        Statistically, flying is the safest form of modern travel.
        Jet engines have become so immensely reliable that four-engine
    airliners are fading into the past. Planes with just two engines safely
    traverse vast expanses of oceans every day. If one engine fails in
    flight, those jets readily fly for hours on the remaining engine to the
    nearest airport.
        And all the newest engines send critical performance data to the
    ground in real time while in the air, so any irregularities are quickly
    detected.
        The latest engine issues have produced in-flight engine shutdowns
    and aborted take-offs but no incidents that put passengers at risk. So
    for the airlines, the risk is more to the reliable operation of the
    airplanes than their safety.
        Still, even the potential for the flaws to affect both engines of a
    twin-engine plane while in flight was enough to spook safety regulators
    to issue directives restricting flights on both the Rolls and Pratt
    engines.
        And the trouble created for the airlines, for Airbus and Boeing,
    and especially for the engine makers, is serious and very expensive.
        To satisfy the safety regulators and mitigate the impact on airline
    operations, Rolls, Pratt and CFM are throwing engineering resources and
    money at the technical problems.
        ``It's a very painful thing for all of them,'' said Udvar-Hazy.
        On Friday, Rolls updated its projection of the cost of dealing with
    the Trent engine crisis to a total of almost $950 million.
    787 engine flaw
        The latest hit to Rolls came when it was still dealing with the
    fallout from an earlier Trent 1000 technical problem: corroded turbine
    blades in the hot rear section of the engine.
        After redesigning those blades with a new base metal and a new
    coating, retrofitting the engines in service is still ongoing.
        The more recent, and now more pressing, problem showed up when
    cracks were found in the roots of the blades of the Intermediate-
    Pressure Compressor (IPC), behind the fan at the front of the engine.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Technicians make adjustments to a Rolls-Royce. . . (Mike Siegel/The
    Seattle Times) More

        Moore pointed to a design flaw: The vibrating frequency of the
    compressor blades resonated with the frequency of the engine at high
    thrust, magnifying the vibration to a level that over time caused the
    cracks to develop.
        The immediate need was to inspect the susceptible engines--
    initially the ``Package C'' version of the Trent 1000, a total of 383
    engines--and remove any with cracks for repair.
        The problem intensified when fractured blades and excessive
    vibration led to several inflight engine shutdowns and aborted
    takeoffs.
        In response, safety regulators gave Rolls until June 9 to complete
    an initial set of inspections on Package C engines that have clocked
    more than 300 flights, though all will have to be inspected eventually.
        Two days after that deadline passed, Rolls announced that the
    problem had spread: It found cracks in the IPC blades in a small number
    of engines that are a different Trent 1000 variant, the ``Package B''
    model.
        That adds another 166 Dreamliner engines that must be inspected.
    Intense response
        Rolls must act fast or its rival GE, which also builds Dreamliner
    engines, will grab its market share.
        Within a month of finding the original IPC problem, Rolls engineers
    developed and certified an ultrasonic inspection method to detect the
    invisible cracks in the interior of the blades without taking the
    engines off the wing.
        It opened facilities in Singapore and the U.K. dedicated solely to
    those repairs--dismantling the engines, replacing the cracked blades,
    treating the remaining blades to close up any invisible micro-cracks,
    and applying a protective lubricant.
        British Airways, Air New Zealand, Virgin Atlantic, Norwegian and
    LATAM Airlines of Chile were among the airlines forced to ground jets
    when engines were removed for repair with no replacements.
        Willie Walsh, chief executive of British Airways parent IAG, said
    six of the airline's 26 Dreamliners are currently grounded, and he now
    expects he won't get all of those back in service until late July.
        ``I have no issue with Boeing, who have been proactive and
    supportive . . . I am however, very unhappy with Rolls-Royce,'' Walsh
    said, via e-mail. ``They have yet to give us confidence that they are
    on top of the problem.''
        British Airways and Virgin Atlantic leased Airbus A330 aircraft to
    fill the schedule gap. Air New Zealand leased two Boeing 777s to fill
    in. Norwegian leased a four-engine Airbus A340 gas-guzzler to fly its
    Paris-Los Angeles route.
        Rolls hopes by year end to certify a permanent fix--a redesigned
    blade with tolerances tweaked to shift its resonant frequency.
    More on Aerospace
        Bombardier sells CRJ jet program to Mitsubishi for $550M
        SpaceX launches hefty rocket with 24 satellites, experiments
        `I'm having a bad dream': Air Canada reviews how crew left
    passenger on parked plane
        The inside story of MCAS: How Boeing's 737 MAX system gained power
    and lost safeguards / Times Watchdog
        Trump shifts to talk of Air Force One
        SpaceX, Boeing continue to struggle with spacecraft designs, as
    watchdog raises safety concerns
        Moore said Rolls engineers are now testing the first modified
    hardware in a development engine at a facility in Derby, U.K., to
    verify that ``we have moved the blade's frequency to a point where I no
    longer have concerns.''
        A second test engine will be used to confirm that the engine's
    overall operation is unaffected by the change to the blades.
        Next year, Rolls plans to gradually remove all those repaired
    engines once again to install the permanent modifications.
        Meanwhile, Boeing deployed teams worldwide with Rolls-Royce to try
    to mitigate the disruption at affected airlines and tapped senior
    executive Keith Leverkuhn to work directly with Rolls.
        ``Keith and I talk every day,'' said Moore.
    Knife-edge seal
        For Pratt & Whitney's new GTF engine, developed starting in the
    early 2000s at a cost of more than $10 billion, the advance worry was
    that it might run into trouble with the engine's big technology
    innovation: the gearbox that allows the fan to run slower and more
    efficiently.
        It turns out the gearbox has operated smoothly with no issues.
    However, the GTF did run into a rash of other ``teething problems.''
        Though Pratt developed fixes for all of them and the latest engines
    it's building are up to date with those fixes, GTF production has been
    hampered and delayed, and deliveries to Airbus were interrupted.
        Spokeswoman Jenny Dervin said the latest problem arose after a
    batch of engineering changes were introduced last December to improve
    the durability of the High Pressure Compressor (HPC).
        Instead, the changes caused ``the knife-edge seal'' in the HPC's
    aft hub to fracture, resulting in sudden vibration and engine stall in
    some A320neos. This led to several inflight engine shutdowns and
    aborted take-offs.
        ``By the end of January, we knew we'd have to recall the engines,''
    Dervin said.
        Only 98 engines had been built with the defective seals--43 in
    service and another 55 still at the Airbus final assembly plants.
        In February, EASA issued an airworthiness directive prohibiting
    airlines from flying any plane that had the defect on both engines.
    India's air-safety regulator grounded planes having even one such
    engine.
        By now, no GTF engines flying anywhere have the defective seal. For
    Pratt, what remains is to clear the backlog of engines to be delivered
    to Airbus.
    Loss of a thin coating
        For CFM's LEAP engine, and specifically for Boeing's 737 MAX, the
    introduction into service has been smoother. On the MAX and the Airbus
    A320neo, LEAP engines are now powering 342 aircraft with 56 airlines.
        However, the LEAP was hit by one technical glitch related to a key
    innovation: a ceramic composite lining that shrouds the hottest part of
    the engine, the first rotor of the High-Pressure Turbine just aft of
    the fuel combustion chamber.
        This ceramic material requires a thin protective coating. Rick
    Lowden, a research scientist at Oak Ridge National Laboratory, which
    developed the ceramic material, said that without such a coating,
    moisture in the gas emerging from the combustor will oxidize the
    ceramics and gradually ``eat it away.''
        CFM spokeswoman Jamie Jewell said engineers found a ``premature
    loss'' of this coating in service.
        ``This is not a safety or operational issue,'' Jewell said, adding
    that the problem hasn't caused any incidents during thousands of hours
    of engine tests and more than a million engine in-service flight hours.
        To fix it, CFM designed a new coating. That's being introduced into
    full-rate production for aircraft deliveries starting this month.
        And about 60 LEAP engines were removed from A320neos for
    modification, none from 737 MAXs.
        ``Each of those removals were scheduled in advance and we are
    supporting the removals with around 70 spare engines,'' Jewell said.
        Boeing said that there have been some delays in delivery of MAX
    engines but so far no airplane deliveries are late.
    Flying hotter, tighter and harder
        Airlines today operate jet engines harder than ever before. They're
    built to tighter tolerances and operate at higher pressures and hotter
    temperatures.
        They fly many more flights and much longer flights than in the
    past.
        Boeing projects that the 2016 worldwide airliner fleet of 23,500
    jets will double in the next two decades, swelling the number of
    engines in the sky.
        But near term, the plans by Airbus and Boeing to hike A320neo, 737
    MAX and 787 production significantly in the next two years cannot
    happen until the engine makers sort out their problems and ramp up
    production.
        To deliver the reliability airlines demand on the narrowbody jets,
    Pratt & Whitney and CFM must hope no further teething pains develop.
        Rolls-Royce faces a more existential crisis.
        It's separately going through a drastic financial and corporate
    restructuring costing $670 million and on Thursday announced layoffs of
    4,600 employees over the next two years.
        A Rolls nightmare would be if the same blade-durability problems
    show up later on the remaining variants of the Trent engine: the newest
    version for the 787 the Trent TEN, or the Trent XWB for the Airbus
    A350, or the Trent 7000 for the Airbus A330neo.
        To survive, Rolls needs to convince airlines soon that the Trent's
    technical problems are finally contained.

        Senator Udall. My first question will be to Mr. Scovel.
        As you heard, a constituent of mine was killed last year in
    the Southwest Airlines accident because of a CFM engine
    failure. You have initiated an audit of the safety practices.
        What is your timeline for completing this audit and will
    you include this most recent engine failure in your inquiry?
        Mr. Scovel. Thank you, Senator.
        For your first question, our timeline, we anticipate
    completing our review of Southwest Airlines maintenance
    practices by the end of this summer. We're looking not only at
    maintenance practices but also at certain operational issues to
    include and weight balance questions, and also a concern that
    was brought to our attention about Southwest's acquisition of a
    certain number of used aircraft and the fact that they may be
    flying in the United States reportedly without proper
    documentation. We don't know. That's one of the things that we
    need to look into to complete our audit.
        Senator Udall. And are you going to use the most recent
    engine failure in your inquiry?
        Mr. Scovel. We'll see what we can derive from that. The one
    last night, sir, off the 737?
        Senator Udall. All three of the ones I mentioned.
        Mr. Scovel. For the first two, yes and we'll see what
    information is available to us regarding the most recent one.
    Yes, sir.
        Senator Udall. Chairman Sumwalt, in your testimony, you
    referenced a Southwest Airlines accident that took the life of
    Ms. Riordan. I know the initial investigative hearing was held
    in November, but I'm concerned about the impact that the
    government shutdown may have had on the investigation. As you
    can imagine, the Riordan family is anxious to receive the
    information from the investigation.
        Can you tell me when the final report will be ready?
        Mr. Sumwalt. Yes, sir. Thank you for that question.
        I was the board member on scene in Philadelphia. I'm very
    familiar with that tragic event. In November, we pointed out in
    the investigative hearing that we had some modeling and some
    structural analysis to do. We have completed that. We're in the
    process now of drafting the final report.
        So the report will be completed later this year. I will say
    if we find any need for any urgent safety recommendations, we
    are postured to be able to do that.
        Senator Udall. Great. Thank you.
        Mr. Scovel, one other question for you. As you know, Boeing
    is one of the largest, most powerful companies in the country,
    and a major government contractor with deep and wide
    connections in Washington. This plane was key to Boeing's
    future financial success. The company was locked in an intense
    competition with Airbus. Reporting has indicated that the FAA
    faced vigorous lobbying to approve the design and features of
    this plane so it could get it to market as soon as possible.
        Political appointees were urging career staff to get the
    work done and a huge portion of that safety review work was
    taken on by Boeing itself so that it was self-certifying its
    own safety.
        Given the size of Boeing and their political power, do you
    think the FAA is truly capable of regulating them in an
    independent way, and what changes need to be made in the
    relationship between this company and its regulator to ensure
    that the safety of the flying public remains the paramount
    interest, not the quarterly profits of this company?
        Mr. Scovel. Senator, FAA has authority, complete authority
    currently to exercise responsibility over----
        Senator Udall. Are they too cozy? Are they too cozy? That's
    my pointed question right there with the industry.
        Mr. Scovel. I don't have information yet to directly answer
    your question. The focus of the first part of our ongoing audit
    will be the certification process that FAA and Boeing employed
    to approve the 737 Max. We hope to have some information
    that'll inform your decisionmaking on that when we complete our
    audits.
        Senator Udall. Well, it is good. It's really important and
    in this age where we talk about captured regulators and things
    like that that you weigh in on these kinds of issues about are
    they truly capable of doing their job.
        Thank you, and thank you for the courtesies, Mr. Chairman,
    for going over.
        Senator Cruz. Thank you, Senator Udall.
        Mr. Elwell, there were a couple of factual issues that came
    up during the course of the hearing that we're going to follow
    up with written questions and ask you to clarify.
        One factual issue on which there was dispute, as you and I
    discussed, the New York Times and others have reported that on
    the earlier versions of the 737 when you pull back the yoke
    that it disengaged the stabilization system but that that did
    not happen on the 737 Max.
        Your testimony to me, if I understood correctly, was that
    that was not correct, although I heard Chairman Sumwalt
    disagree on that point.
        So we're going to ask you in writing to clarify how the
    system operates. I think it's important to have a shared set
    of--an agreed set of facts and to understand.
        Likewise, when I asked you about the simulations that
    pilots did as part of the certification, I asked in particular
    if any of those simulations involved a faulty sensor producing
    faulty data and how to respond to it.
        My recollection is you were not certain as to the answer of
    that. So I'm going you to go and verify and give us a clear
    answer to that.
        [Mr. Ellwell's answer follows:]

        The MCAS system is designed to assist pilots during manual
    operation. On earlier versions of the 737, and on the 737 MAX, pulling
    back on the yoke disables the speed trim system, but does not disable
    the MCAS on the 737 MAX.

        Senator Cruz. I want to read to you some portions of an
    article from Reuters from March 19, 2019, that purports to
    describe what happened on the Lion Air crash and Reuters
    reported, ``The pilots of the doomed Lion Air Boeing 737 Max
    scrambled through a handbook to understand why the jet was
    lurching downwards in the final minutes before it hit the
    water, killing all 189 people onboard, three people with
    knowledge of the cockpit voice recorder contents said.''
        The article goes on to describe, ``The captain was at the
    controls of Lion Air Flight JT610 when the nearly new jet took
    off from Jakarta and the first officer was handling the radio,
    according to preliminary report issued in November. Just two
    minutes into the flight, the first officer reported a ``flight
    control problem'' to the air traffic control and said the
    pilots intended to maintain an altitude of 5,000 feet.
        First officer did not specify the problem but one source
    said airspeed was mentioned on the cockpit voice recording and
    a second source said an indicator showed a problem on the
    captain's display but not on the first officer's. The captain
    asked the first officer to check the Quick Reference Handbook,
    which contains checklists for abnormal events, the first source
    said.
        For the next nine minutes, the jet warned the pilot it was
    in a stall and pushed the nose down in response, the report
    showed. A stall is when the air flow over a plane's wing is too
    weak to generate lift and keep it flying.
        The captain fought to climb but the computer still
    incorrectly sensing a stall continued to push the nose down
    using the plane's trim system. Normally trim adjusts an
    aircraft's control surfaces to ensure it flies straight and
    level.
        They didn?t seem to know that the trim was moving down, the
    third source said. They talked only about airspeed and
    altitude. That was the only thing they talked about.''
        Do you have any reason to doubt that account of what
    occurred in the final minutes of that flight?
        Mr. Elwell. Well, Senator, the information I have is that
    actually there has not been--and I would defer to Chairman
    Sumwalt on this, but----
        Senator Cruz. Please chime in, as well.
        Mr. Elwell.--that the cockpit voice recorder is not
    available to--I certainly haven't seen a readout and if I did,
    to Chairman Sumwalt's point earlier, I wouldn't be at the
    liberty to even talk about it.
        But I would--and this actually is linked to what you said
    earlier about the confusion about whether the 737 Max, when you
    pull back, it stops, and I will admit to not having flown it
    and maybe not getting that right, but what certainly--and I
    will react to what you read, but I will qualify it by saying it
    is entirely possible that what was written is not accurate.
        But I will tell you, as I said numerous times in this
    hearing, pilots of large aircraft are trained from day one when
    the pitch of the aircraft is doing something you're not telling
    it to do, you do runaway pitch trim checklist and in every
    plane I've ever flown, it's called the Memory Item. You're not
    fumbling through books. It's a time-critical procedure and you
    go to that. You do it in the sim when you fly. It's a memory
    item.
        So some of what you read there, I can't tell you if that's
    accurate. I can't tell you if that's straight from the
    investigation or CVR. It disturbs me because it is not the way
    I was trained and what I would expect pilots to do in that
    situation.
        Senator Cruz. You have any explanation for why something
    like this might have happened, if the report is accurate?
        Look, I'm not a pilot, but certainly the picture that is
    painted there of the pilot frantically looking through the
    checklist as the nose continues to adjust downward and as the
    pilot is unable to correct that problem, that is not an image
    that instills comfort or confidence, and it does not suggest
    that the pilot is aware of how to correct for the system that
    is adjusting the nose downward.
        Do you have any explanation in terms of the training that
    pilots undergo, how that would come to be?
        Mr. Elwell. Mr. Chairman, it would be inappropriate for me
    to comment any further on, first, an article whose veracity I
    can't ascertain right now, and I've no comment on--other than,
    yes, it sounds like a terrible situation, but I have no way of
    knowing that that account is accurate. So it would be
    inappropriate for me to comment on it.
        Senator Cruz. But there's nothing in the pilot training
    that the FAA required about the MCAS System and how to correct
    for it, is that accurate?
        Mr. Elwell. Senator, the MCAS is not something you fly.
    It's not something you would get in a simulator and fly the
    MCAS.
        Senator Cruz. I didn't say you'd fly the MCAS. I said
    there's nothing in the pilot training about the MCAS System
    adjusting the nose of the plane downward and how to compensate
    for that in the event of a malfunctioning sensor. Is that
    accurate that the training does not include that?
        Mr. Elwell. Senator, Senator, I would actually say that it
    is accounted for in the training and the accounting for that in
    the training is that that MCAS--inappropriate input of the MCAS
    is runaway pitch trim and runaway pitch trim is trained and
    trained and trained by every pilot who flies a large aircraft.
        Senator Cruz. Chairman Sumwalt, do you have any additional
    points on this line of inquiry?
        Mr. Sumwalt. No, sir, I do not.
        Senator Cruz. OK. One final avenue of questions, Mr.
    Scovel.
        I want to draw your attention to a June 22, 2012,
    memorandum from your office titled FAA Transport Airplane
    Directorate, Seattle, Washington. Are you familiar with this
    document?
        Mr. Scovel. Yes, I am, Mr. Chairman.
        Senator Cruz. Good. The 2012 memorandum specifically states
    that your office's investigation ``substantiated employee
    allegations that TAD,'' which is the FAA's Transport Airplane
    Directorate, ``and FAA Headquarters managers have not always
    supported TAD employee efforts to hold Boeing accountable,''
    and it further discusses TAD employee concerns that Boeing
    employees in the Boeing Certificate Office might have
    ``delivery of airplanes as part of their performance
    standards.''
        The concerns described in that memo paint a troubling
    picture of agency capture. Do the concerns in the 2012 memo, do
    you still have those concerns, and do you see an ongoing
    pattern like that described in the 2012 memo?
        Mr. Scovel. Mr. Chairman, I'm confident they fully describe
    my office's findings at the time in 2010, 2011, and early 2012,
    when we were doing the investigation work that led to that
    memorandum from the Office of Inspector General to FAA.
        I don't know in 2019 whether those conditions still
    prevail.
        Senator Cruz. Well, this Subcommittee will eagerly await
    your investigation and assessment of that question because it
    is a critical question for evaluating ongoing safety.
        Senator Blumenthal.
        Senator Blumenthal. Thanks, Mr. Chairman.
        Let me just ask a few questions pursuing that same avenue,
    Inspector General Scovel.
        I'm assuming that that issue of agency capture or improper
    influence will be part of the investigation you're doing in
    response to my request, correct?
        Mr. Scovel. Yes, it certainly will be, and I should add
    we're always on the lookout for it. We've called it out in the
    past.
        Senator Blumenthal. That's your job.
        Mr. Scovel. It is. We've done it several times with
    individual FAA employees in their roles as inspectors at
    Southwest, at American most recently, and in a report that we
    issued last summer, and in the 2012 report involving FAA
    employees at the FAA ODA Oversight Office in Seattle.
        Senator Blumenthal. So you'll be looking for any calls or
    contacts from Boeing or airlines or anyone else that may have
    impacted the FAA decisionmaking?
        Mr. Scovel. It's part of the certification process and
    that's what you and the Secretary and others have requested.
    That's the mail we're going to answer, sir.
        Senator Blumenthal. Mr. Elwell, when we finished, we were
    talking about the decision to ground the airplanes, which you
    said was your own exclusively, correct? How did it happen then
    that it was announced by the President?
        Mr. Elwell. Senator Blumenthal, as I testified earlier,
    from the moment of the Ethiopian accident and I became first
    aware of it till I grounded the airplanes, I briefed and kept
    the Secretary and the President apprised of all of our actions,
    as I would always do with something this significant, and
    shortly after--leading up to and then shortly after making the
    decision to ground the aircraft, I again briefed the Secretary
    and the President and the President, it came to my attention,
    was very shortly thereafter going to an already-planned press
    event and as is his prerogative as Commander-in-Chief, he
    talked about the briefing that I gave and what my intentions
    were and it actually preceded the official announcement of the
    Emergency Order.
        Senator Blumenthal. So you briefed him----
        Mr. Elwell. So that was the timing.
        Senator Blumenthal. You briefed him directly?
        Mr. Elwell. I briefed the President and the Secretary on my
    decision and the data and the actions that led up to it.
        Senator Blumenthal. Had he contacted you or anyone else in
    the White House contacted you previously to that time?
        Mr. Elwell. I kept the White House or the President and the
    Secretary fully briefed and apprised of my actions leading up
    to the grounding.
        Senator Blumenthal. So between the time of the second crash
    and the announcement of your decision, there were contacts
    between you and the White House?
        Mr. Elwell. I briefed the Secretary and the President on
    the developments and kept them apprised.
        Senator Blumenthal. And they gave you their views as to
    whether the plane should be grounded?
        Mr. Elwell. Well, sir, I briefed them on where I was going
    with my data collection and my thinking right up until I
    grounded the aircraft.
        Senator Blumenthal. And let me repeat my question in case
    it wasn't clear.
        Mr. Elwell. Yes, sir.
        Senator Blumenthal. Did they indicate to you, did they
    express to you their views on whether that plane should be
    grounded?
        Mr. Elwell. Well, Secretary Chao never gave me any--told me
    to ground or anything like that and consistent with
    longstanding Executive Branch practice over many
    Administrations, I'm not going to go into details of
    conversations I had with the President.
        Senator Blumenthal. Well, what's your claim of the reason
    to refuse to answer that question?
        Mr. Elwell. Well,----
        Senator Blumenthal. Is that executive privilege? There is
    no executive privilege.
        Mr. Elwell. No, Senator. No, Senator. I'm just saying that
    consistent with longstanding Executive Branch practice, many,
    many Administrations, I'm not going to sit and get into details
    about my conversations with the President. It's a longstanding
    Executive Branch practice.
        Senator Blumenthal. Really?
        Mr. Elwell. Yes, sir.
        Senator Blumenthal. Well, are you telling me that you are
    not going to tell this committee what the President told you
    about grounding the aircraft before you made that decision?
        Mr. Elwell. Senator, I am just simply saying that I'm not
    going to get into details about conversations I had with the
    President. It's a longstanding Executive Branch practice.
        Senator Blumenthal. I'm not aware of that longstanding--is
    that grounded in law and, if so, what law?
        Mr. Elwell. Well, sir, I am not a lawyer, but I'm not going
    to talk about conversations that I had with the President.
        Senator Blumenthal. Well, I can't force you to. I don't
    think we can order you because we don't have that authority as
    of right now, but I'm going to pursue that issue.
        Mr. Elwell. Yes, sir.
        Senator Blumenthal. Let me ask you. Under the ODA, is there
    protection for whistleblowers if and when they come forward?
        Mr. Elwell. Sir, it is my understanding that there's
    protection for whistleblowers at all times, ODA or otherwise.
        Senator Blumenthal. Well, let me rephrase it. Is there
    protection for whistleblowers at Boeing? In other words, the
    Boeing employees who have responsibility, they're hired, fired,
    potentially disciplined, if they make decisions adverse to the
    company' interests?
        Mr. Elwell. Well, Senator Blumenthal, that is an excellent
    question, and I'm not sitting here knowing. I don't know
    Boeing's policies with regard to employee whistleblowers. There
    may in fact be in the agreement, the ODA Agreement that we have
    with the manufacturer a requirement for them to take on our
    whistleblower protections, but I will get back to you. I'm not
    sure sitting here.
        Senator Blumenthal. I appreciate your getting back to me.
    You're not aware of any protection for whistleblowers as you
    sit here?
        Mr. Elwell. I'm not aware that there is or there aren't,
    but I will get back to you, sir.
        Senator Blumenthal. Are you aware of any whistleblowers
    coming forward about the Boeing 737 Max 8?
        Mr. Elwell. I'm not aware of whistleblower complaints
    particularly to what was being discussed earlier about
    management pressure particularly. I've not gotten any from FAA
    employees. In fact, one charge that was in one article that it
    was claimed that FAA employees in Seattle were being rated
    against production rates and I did look into that to see if
    there was any evidence of that or any complaints in that area
    and the answer was no.
        Senator Blumenthal. Are you aware of any incentive bonuses
    or payments by Boeing for certification decisions?
        Mr. Elwell. You mean Boeing incentives to their employees?
        Senator Blumenthal. Well, they're the ones who are employed
    in this Certification Program, the ODA, right?
        Mr. Elwell. Correct. And I'm not aware of that.
        Senator Blumenthal. OK. I just have a couple more
    questions. I really appreciate it, Mr. Chairman.
        You and I talked in a briefing that you were kind enough to
    provide some time ago and you indicated in response to one of
    my questions about the government shutdown that it was not in
    any way responsible for the delays in the development of new
    software for the MCAS System, correct?
        Mr. Elwell. Yes, sir.
        Senator Blumenthal. So you are saying that any reports of
    the impact of the government shutdown on any of the issues
    involved here is not true?
        Mr. Elwell. Well, Senator Blumenthal, I remember the
    question and we actually got the question. The reason I was
    able to answer you is because we had had that inquiry earlier
    and we checked and for the work that we had to do on the
    software update, we actually recalled the individuals. There
    was no delay in the certification or the work on that and
    because of our role of continuous operational safety, there
    was--the shutdown did not impact our examination or
    participation in continual operational safety post Lion Air.
        Senator Blumenthal. And I think you explained to me that
    the reason was that those employees were deemed to be essential
    to safety----
        Mr. Elwell. Yes, sir.
        Senator Blumenthal.--and therefore essential employees, as
    well.
        Mr. Elwell. Yes, sir.
        Senator Blumenthal. Just a couple more questions. On the
    issue of training, and I appreciate the courage and strength of
    the families coming to Congress and I'm struck by I guess the
    feeling I would have that the training here really could and
    should have been better for these pilots, and I know that the
    investigation will go into the technical issues, but as a
    passenger and a layman, my feeling was the training should have
    been better. Would you agree?
        Mr. Elwell. Senator Blumenthal, foreign accidents, as
    Chairman Sumwalt mentioned, bring with them investigative
    challenges. We are at the very earliest stage in the Ethiopian
    accident.
        Our responsibility of continuous operational safety means
    that if anything comes out of these investigations that goes
    directly to training, we would know about it so that we could
    relay that information to the pilots and the system we oversee.
        Of course, we don't oversee and regulate the training of
    foreign practices but we do audit the Civil Aviation
    Authorities of countries that fly to the U.S. and I believe
    that this is an area that we will look into very, very
    carefully because I believe we can use the FAA's credibility
    internationally and despite what you might read in the press, I
    believe that the FAA still is the gold standard, still has the
    credibility around the world to make change.
        We fight for it all the time. Our goal is to raise the
    safety bar everywhere and that?s what I'm going to try to do
    for the rest of my time in government service.
        Senator Blumenthal. Well, I'm hoping and I am going to take
    that answer as a yes because I think very unequivocally the
    training should have been better and I welcome steps to make
    sure it is better in the future. Thank you.
        Senator Cruz. And let me follow up on Senator Blumenthal's
    questions, both about training and whistleblowers. I want to
    ask in particular about a March 12 article in the Dallas
    Morning News that was entitled Several Boeing 737 Max 8 Pilots
    in the U.S. Complained About Suspected Safety Flaw, and the
    article begins by saying, ``Pilots repeatedly voiced safety
    concerns about the Boeing 737 Max 8 fleet to Federal
    authorities with one captain calling the flight manual
    ``inadequate and almost criminally insufficient'' several
    months before Sunday's Ethiopian air crash that killed 157
    people.
        Are you familiar with these pilot complaints that are being
    referenced in the Dallas Morning News story?
        Mr. Elwell. Mr. Chairman, I am. That is a report, part of
    the group of 24 reports that I reviewed personally and that the
    FAA has reviewed. They are ASRS reports, otherwise known as
    NASA reports. They were the first foray in our efforts to have
    voluntary reporting and the history is important on voluntary
    reporting with regard to ASRS reports.
        I wrote many of them in my time as a commercial airline
    pilot and the reason that they were in place is we wanted to
    see if pilots could make reports of mistakes that they've made
    in the field out in the system and be indemnified as long as it
    was an honest mistake. Could we gather enough data and
    information to make safety enhancements and make the system
    better? It's been one of the most successful programs that
    we've issued.
        Now when I did them, I handwrote them. They weren't
    Flintstone but they were--I handwrote them. Now they're
    computer-entered and we looked at every one of those reports.
    Now I don't know if the one you just quoted went to an event
    review team, but when we find in these reports charges or
    problems that need to be addressed more robustly, that's what
    we have. We have an event review team. We bring the person who
    made the report in with airline officials, with FAA officials,
    and we sit down and we review the report.
        That particular report, as I said, there have been 57,000
    flights since we introduced the Max in the U.S. and that, to my
    knowledge, is the only report of its kind from a pilot about
    the inadequacy of the manuals. Like anything, we do a risk-
    based analysis. We look at the body of reports and the body of
    data.
        I will look into whether or not that individual and his
    complaint was addressed appropriately and get back to you.
        Senator Cruz. OK. I would very much appreciate that. I will
    say as someone who flies myself every week on commercial
    airlines and my family flies every week and millions of
    Americans fly regularly on these planes, we need the flying
    public to have confidence about safety and I'll also note in
    the state of Texas, tens of thousands, if not hundreds of
    thousands of jobs depend upon the aviation industry and so that
    confidence is critically important, and I have to say as a
    passenger, I would certainly find it troubling.
        [Mr. Elwell's answer follows:]

        ASRS report 1593017 notes that a Boeing 737 MAX Captain expressed
    concern that the flight manual did not fully describe the Maneuvering
    Characteristics Augmentation System (MCAS) and the Angle of Attack
    (AOA) system. Although we investigated this report and determined the
    assertions were not actionable, the certification of the MCAS software
    fix will include additional information on the MCAS function.

        Senator Cruz. This is according to the Dallas Morning News,
    a captain, if the captain is describing the training manual as
    ``inadequate and almost criminally insufficient,'' that is a
    pretty serious charge and so I would appreciate your getting
    back with the basis of that.
        Does that complaint that is referenced and those other
    complaints, does that trouble--I want to give Chairman Sumwalt
    and Mr. Scovel an opportunity to comment on that story and
    those allegations.
        Mr. Sumwalt. Chairman Cruz, in a former life, I was a
    consultant to the NASA Aviation Safety Reporting System and one
    of the caveats that ASRS puts around their data is that they
    are unverified and that there are various reporting biases
    known and unknown. They put these caveats on every ASRS
    request.
        If you were to request data, they would put those caveats
    there and it would not surprise me if, after the Lion Air
    crash, when pilots said, oh, my goodness, I never knew about
    this MCAS System and this really bothers me and I'm going to
    fill out the report.
        So I think it's imposrtant to keep all of this in
    perspective. So that report in its own doesn't necessarily
    concern me, but what we do want to look at is to look at the
    training adequacy overall.
        Senator Cruz. Mr. Scovel.
        Mr. Scovel. Thanks, and I appreciate the perspectives of
    both the Administrator and the Chairman.
        We will be looking, as I mentioned at the very beginning of
    the hearing, into documentation, what was included in the
    manuals and the decisionmaking that went into that and beyond
    that to the actual training for pilots.
        I am aware of the ASRS entry that you mentioned. My staff
    and I were reviewing that the other week. So we're factoring it
    into our questions.
        Senator Cruz. Are you able to shed any light on those
    complaints?
        Mr. Scovel. I'm not.
        Senator Cruz. That one in particular certainly stands out.
        Mr. Scovel. I'm not, but it does go to the question of what
    did they know and when did they know it. So this is after the
    Lion Air incident. Some things were bubbling up within ASRS, as
    both my colleagues have testified. Was that factored into FAA's
    decisionmaking going forward? We can consider all that fairly,
    I think.
        Senator Cruz. Well, I want to thank each of you for being
    here, for testifying on very short notice. These issues are of
    grave concerns to Americans across the country and to the
    Senate. So I appreciate your testimony.
        The hearing record is going to remain open for two weeks
    and during that time, Senators are asked to submit any
    questions for the record and upon receipt, each of the
    witnesses are requested to submit your written answers to the
    Committee as soon as possible.
        And with that, this hearing is adjourned.
        [Whereupon, at 5:35 p.m., the hearing was adjourned.]

                                A P P E N D I X

         Response to Written Questions Submitted by Hon. John Thune to
                             Hon. Daniel K. Elwell
        Question 1. Mr. Elwell, you mentioned in your testimony that in
    response to the October 29 Lion Air Crash, FAA issued an Emergency
    Airworthiness Directive on November 7 requiring 737 MAX operators to
    revise flight manuals to reinforce training on how to recognize and
    respond to stabilizer trim movement not initiated by the crew.
        Could you describe current training procedures for recognition and
    response to these ``runaway'' stabilizer trim events on Boeing 737
    models?
        Answer. The procedure for runaway stabilizer trim directs the pilot
    to perform the following tasks:

      1.  Control Column, hold firmly

      2.  Disengage autopilot and control airplane pitch manually with
            control column and electric trim

      3.  Disengage autothrottle

      4.  If runaway trim continues, turn off both of the stab trim cutout
            switches

          a.  If runaway trim continues, grasp the trim wheel and perform
                stabilizer trim manually

        This procedure is to be performed immediately by either memory or
    by quick reference checklist and as such training for this procedure is
    covered in initial ground training and on a recurrent basis thereafter.
    The training program is developed by the air carrier and approved by
    the FAA.

        Question 2. How did the training procedures required by the
    Emergency Airworthiness Directive issued in November 2018 differ from
    the procedures described above?
        Answer. The Emergency Airworthiness Directive issued on November 7,
    2018, reinforced the application of existing flight crew procedures to
    be used in those circumstances when uncommanded stabilizer trim is
    encountered.

        Question 3. Mr. Elwell, the notice of proposed rulemaking for
    Remote Identification of Unmanned Aircraft Systems was delayed from May
    1 of this year to July 21. As you know, this rulemaking is a critical
    component of integrating unmanned aircraft systems into U.S. airspace.
        Could you speak to how this delay might affect other pending
    regulatory actions related to UAS?
        Answer. The FAA plans to finalize its policy concerning remote
    identification of small UAS--by way of rulemaking, standards
    development, or other activities that other Federal agencies may
    propose--prior to finalizing the proposed rule permitting operations of
    small UAS over people and operations at night, published in the Federal
    Register on February 13, 2019.

        Question 4. As a follow-up, do you foresee any potential challenges
    related to this rulemaking that could cause further delays?
        Answer. The remote identification of UAS is a complex issue. The
    rulemaking the FAA is developing must ensure that the safety and
    security of the National Airspace System is maintained, while proposing
    requirements for the identification of UAS that are technologically
    feasible and not cost prohibitive. This balancing requires
    consideration of the interests and concerns of many diverse
    stakeholders, including our Federal interagency security partners;
    State and local law enforcement; the development and production
    timelines of UAS manufacturers; UAS operators ranging from large
    industry to small businesses to recreational flyers, and more. We are
    working to ensure that the rule we propose addresses the concerns we
    have heard from our interagency security partners, while also
    reflecting the current and future state of UAS development, innovation,
    and industry/public adoption.
                                     ______

       Response to Written Questions Submitted by Hon. Maria Cantwell to
                             Hon. Daniel K. Elwell
        Question. Please provide additional detail on the work that FAA did
    on MCAS, and the work that was then delegated.
        Answer. The FAA conducted several types of technical reviews
    associated with the Stabilizer Trim System (STS) and related
    Maneuvering Characteristics Augmentation System (MCAS) functionality.
    These included project scope reviews (known as familiarization),
    reviews of System Functionality and aspects of Software Development
    Assurance, and reviews of the System Safety Assessment (SSA) status for
    the STS.
        These reviews allowed us to consider intended function, evaluate
    the related guidance material, and assess system failure conditions and
    appropriate crew actions. These reviews and further discussions with
    Boeing did not identify any unique or new/novel regulatory aspects,
    areas outside of ODA authorization, or other areas requiring FAA
    involvement. As a result, the FAA delegated the responsibility for
    determining MCAS regulatory compliance to the ODA.
        Aggressive maneuvers (wind up turns) and full stalls were flown by
    FAA test pilots during FAA certification testing in simulators and in
    the aircraft. Several dozen FAA certification flights were flown by FAA
    test pilots in the aircraft between May 2016 and November 2016 to
    evaluate: Maneuvering Characteristics, Stall Characteristics, Stall
    Identification and various failure modes of the flight control system,
    including failures to the speed trim (MCAS) system. In all of these
    tests, MCAS was active and routinely performing its intended function.
                                     ______

        Response to Written Question Submitted by Hon. Amy Klobuchar to
                             Hon. Daniel K. Elwell
        Question. At the hearing, we discussed how the FAA allows
    manufacturers to sell certain safety features as optional add-ons to
    airlines for an additional charge. As you know, neither of the two
    Boeing 737 Max aircraft involved in the recent Ethiopian Airlines and
    Lion Air crashes had an angle of attack indicator or a disagree light.
    How many safety features listed by the FAA as ``optional'' detect
    sensor malfunctions like we saw in these recent crashes?
        Answer. Required safety standards and features for large aircraft
    are established in 14 CFR part 25 (``Airworthiness Standards: Transport
    Category Airplanes''). Features required to meet those safety standards
    are mandatory on all FAA-certified aircraft, including the Boeing 737
    MAX. There are no optional safety standards or features.
                                     ______

         Response to Written Questions Submitted by Hon. Tom Udall to
                             Hon. Daniel K. Elwell
        Question 1. The Boeing 737 first made flight in 1967 and there have
    been a significant number of changes to the original configuration of
    the 737. Can you outline the number of different air craft
    certification configurations that Boeing has applied for?
        Answer. Boeing has applied for 14 models of the 737.

      (1)  737-100 Series (1967)

      (2)  737-200 Series (1967)

      (3)  737-200C Series (1968)

      (4)  737-300 Series (1984)

      (5)  737-400 Series (1988)

      (6)  737-500 Series (1990)

      (7)  737-700 Series (1997)

      (8)  737-800 Series (1998)

      (9)  737-600 Series (1998)

      (10)  737-700C Series (2000)

      (11)  737-900 Series (2001)

      (12)  737-900ER Series (2007)

      (13)  737-8 MAX (March 2017)

      (14)  737-9 MAX (February 2018)

        Question 2. Administrator Elwell, Mr. Scovel pointed out in his
    testimony that the 2015 DOT Inspector General report found that the
    QUOTE ``FAA performed oversight of only 4 percent of personnel
    conduction certification work on the Agency's behalf at suppliers in
    the period [it] reviewed.'' It is my understanding that the FAA is
    revamping this process. But do you have the staffing necessary to
    increase the oversight necessary?
        Answer. Yes. The FAA has the personnel necessary to perform the
    referenced oversight functions under current processes.

        What are the FAA's plans to increase training opportunities to
    ensure that staff with these responsibilities will have the expertise
    necessary to perform oversight of highly technical systems?
        Answer. The FAA supports its technical staff through access to
    leading providers of training and through engagement opportunities with
    other technical experts, including standards bodies, industry
    associations, conferences, and universities. The FAA also has Chief
    Scientific and Technical Advisors (CSTA) who provide in-depth seminars
    and workshops for their individual areas of expertise. The CSTA program
    was established in 2002 to address rapid technological advances in
    aviation safety. CSTAs possess high levels of knowledge and skill in
    specialized disciplines. When needed, the CSTAs support FAA
    certification staff in evaluating complex technical issues.

        Question 3. What are you doing to retain current employees?
        Answer. Retaining employees when industry is doing well is a
    challenge. There are, however, many factors as to why employees may
    choose to stay with the agency. One of these factors is the clarity and
    importance of the mission. We also utilize internal and external
    resources to provide professional development and training
    opportunities. We have several programs to provide mentoring and
    temporary management assignments for employees actively seeking
    advancement.

        Do you have resources to bring on additional staff?
        Answer. The Aircraft Certification Service has the resources to
    hire sufficient staff under current processes.

        And, if so, what are you doing by way of recruitment efforts to
    bring more of these employees on board?
        Answer. The FAA is collaborating with academic partners to provide
    a focused curriculum related to aviation safety to facilitate job
    opportunities for qualified candidates. We participate in job fairs,
    seminars, and science and technology conferences. In addition, we
    support science, technology, engineering, and mathematics (STEM)
    activities across the Nation to promote aviation safety and
    certification professions.

        Question 4. If you are able, please tell us the direct chain of
    reporting for the Boeing Max 800 process and if the managers who were
    responsible for this certification are still charged with these
    responsibilities.
        Answer. The Boeing Aviation Safety Oversight Office, Boeing
    Certificate Management Office, Seattle Aircraft Evaluation Group, and
    Northwest Flight Test Section are the FAA offices responsible for the
    airplane level certification and production of the 737 MAX. The
    development of the certification basis for the 737 MAX, including any
    applicable regulation or policy developed during a certification
    project, e.g., through issue papers, also involves the FAA Transport
    Standards Branch.
        The office responsible for the oversight of the Boeing Organization
    Designation Authorization (ODA) and related certification projects is
    the Boeing Aviation Safety Oversight Office. There are three first line
    managers and one branch manager for the office. The 737 MAX
    certification was a 5-year project that started in 2012. Since 2012, we
    have had a number of changes in personnel, consistent with any large
    organization.

        Question 5. It is important to receive clarification on some issues
    that circulated about the Boeing Max 8 jets. I will ask you a series of
    Yes/No questions. The New York Times reported on March 19th that senior
    FAA employees were unaware of the changes in the software that is in
    question. Can you confirm if this software was certified by the FAA?
        Answer. Yes, the software described in the article was approved by
    the FAA.

        Did any FAA employees sign off on training manuals?
        Answer. Yes, the recommended training was approved by the FAA.

        Question 6. Boeing has said the redundancy for the system in
    question were the pilots--even though many pilots were unaware of the
    changes made to the 737 Max. Given your experience as a pilot, are you
    aware of another example of any other component with critical safety
    mission not to have some kind of redundancy built-in?
        Answer. In reference to system failures that can jeopardize
    controlled flight, there are single failures that require pilot
    response or action, including:

       Engine failure (at any time, but especially during takeoff
            ground roll)

       Landing gear failure to deploy

       Engine or cargo fire

       Failure of an air data computer

       Flight control surface jam

       Failure of certain components in flight control systems
            (actuator, control structural items such as a rod or actuator
            mount, cable break, etc.)

        Question 7. Does FAA still maintain the others grounded ``too
    early?''
        Answer. The FAA made its grounding decision on March 13 based on
    refined satellite data and evidence found at the accident scene. This
    information solidified the similarities between the Lion Air and
    Ethiopian Airlines accidents. The FAA stands by its decision-making on
    grounding the 737 MAX.

        Question 8. Is it appropriate for the POTUS and the CEO of Boeing
    to be discussing a matter like this vs leaving it up to the career
    expert?
        Answer. The FAA's primary focus is safety. We value and rely upon
    the advice of FAA career aviation safety experts.

       Were the same people who approved the design the ones
            deciding to ground?
        Answer. The decision to ground the 737 MAX was made by me after
    receiving enhanced satellite data showing the flight path of Ethiopian
    Flight 302 and conferring with FAA safety experts. I was not with the
    FAA at the time the 737 MAX design was approved.
                                     ______

      Response to Written Questions Submitted by Hon. Tammy Duckworth to
                             Hon. Daniel K. Elwell
        Question 1. Please describe the Federal regulatory rules, process
    and procedures for addressing an aircraft design single-point-of-
    failure, including the threshold for grounding such aircraft.
        Answer. 14 CFR Sec. Sec. 25.1309, 25.671, and 25.901, advisory
    circulars, and other FAA guidance material prevent the FAA from
    approving proposed designs in which a single system failure (non-
    structural) would be catastrophic or prevent continued safe flight and
    landing. Beyond this, single system points-of-failure that are not
    catastrophic are governed by the reliability requirements of 14 CFR
    Sec. 25.1309.
        Manufacturers must show proposed airplane systems meet safety
    standards through a FAA hazard assessment and safety analysis. As part
    of this analysis, the manufacturer must show that ``catastrophic''
    failure conditions are extremely improbable.
        The FAA makes safety-based, data-driven decisions. In determining
    whether a condition discovered after certification is unsafe, we employ
    a standardized process called Monitor Safety/Analyze Data (MSAD) for
    determining mandatory design changes and appropriate timeframes to
    implement those changes based on risk exposure. The results of the risk
    assessments conducted under MSAD could lead to an aircraft grounding
    decision.

        Question 2. What is the basis for certification by FAA of a
    derivative aircraft and how does FAA determine pilot training
    requirements for derivative aircraft?
        Answer. The FAA decides whether to process an application as an
    amended type certificate (ATC) based on an evaluation of the airplane
    design changes in accordance with 14 CFR Sec. 21.19, which describes
    changes requiring a new type certificate. The FAA evaluates the
    proposed design changes, considers the examples in the guidance
    material, and reviews determinations made on previous certification
    programs.
        The FAA determines pilot training requirements for derivative
    aircraft using the Flight Standardization Board (FSB) in accordance
    with established processes outlined in FAA Order 8900.1 and FAA
    Advisory Circular (AC) 120-53B. Aircraft operational suitability is
    determined in accordance with FAA Order 8110.4C.

        Question 3. For the purposes of FAA aircraft certification, who
    determines whether a design change is ``significant'' such that it
    would preclude the aircraft from a derivative certification? Please
    describe in detail precisely how FAA make this determination and what
    constitutes a requirement for a new type certificate?
        Answer. The managing Aircraft Certification Office (ACO) determines
    if the proposed design is eligible for an amended type certificate
    (ATC) (derivative aircraft certification) or if the proposed design
    changes require a new type certificate. The FAA decides to process an
    application as an ATC based on an evaluation of the proposed airplane
    design changes in accordance with 14 CFR Sec. 21.19, which describes
    proposed changes that will require a new type certificate.
    Additionally, AC 21.101-1B, ``Establishing the Certification Basis of
    Changed Aeronautical Products,'' provides examples of substantial
    design changes for transport airplanes.
        The FAA evaluates the proposed design changes, considers the
    examples in the advisory circular, and reviews determinations made on
    previous certification programs in order to determine eligibility for
    an ATC.

        Question 4. When a new system(s) for a derivative aircraft is
    disclosed to the FAA by an Original Equipment Manufacturer (OEM), how
    does the FAA evaluate that system(s) to determine changes to pilot
    training, aircraft and pilot manuals and handbooks, and the potential
    nullification of the derivative certification of the aircraft?
        Answer. The OEM presents technical briefings on new systems to the
    FAA. The OEM proposes a pilot type rating determination and pilot
    training recommendations after formally identifying differences between
    the base aircraft (old) and candidate aircraft (new) using the process
    outlined in Advisory Circular (AC) 120-53B. The Flight Standardization
    Board then evaluates the proposed training in accordance with this AC
    (AC 120-53B).

        Question 5. When a system is implemented on a derivative aircraft
    design with the intention of artificially retaining the handling
    qualities of the original design, what Federal requirements govern the
    publication and training of that system?
        Answer. At all times, the aircraft must meet the existing design
    and performance requirements. The FAA evaluates handling qualities in
    accordance with AC 120-53B using the T2 Test (handling qualities
    comparison), between the base and candidate aircraft. Any additional
    training requirements are evaluated during T3 Test (differences) by the
    Flight Standardization Board.

        Question 6. When the FAA certifies a derivative aircraft, which
    type certificated aircraft is considered as the baseline for design
    change comparisons? In the case of the Boeing 737 MAX, was it the most
    recent type certified aircraft like the 737 NG or the original type
    design?
        Answer. When an applicant applies for an amended type certificate
    (ATC) of a previously certificated model, it is responsible for
    proposing the baseline. That baseline may or may not be the most
    recently certificated model of that aircraft. Since the baseline 737-
    800 model was introduced in 1998, many enhancements have been
    implemented in derivative models. In the case of the 737 MAX, the 737
    NG was the baseline model.

        Question 7. Are derivative aircraft required to comply with 14 CFR
    Part 25 regulations at the time the amended type certificate is awarded
    or at the time of the original type certificate?
        Answer. Only the proposed design change and areas affected by the
    change must comply with the 14 CFR regulations in place at the time of
    application, in accordance with 14 CFR Sec. 21.101 and FAA AC 21.101-
    1B. The applicant also can petition the FAA for an exemption or
    ``equivalent level of safety determination'' for particular
    requirements. These are addressed on a case-by-case basis.

        Question 8. Please point to the safeguards that FAA has in place to
    ensure that external pressures, such as time or competition, do not
    play any role in the quality of the certification or evaluation of a
    derivative aircraft.
        Answer. Through our public rulemaking process, the FAA prevents
    special interests from having undue influence in the development of
    standards and agency decisions regarding whether proposed designs meet
    those standards. Additionally, we have established processes for all
    FAA employees to elevate concerns if they feel that safety is being
    compromised. The FAA Office of Audit and Evaluation, established by
    Congress, provides a whistleblower hotline to report safety concerns.
    Complaints are investigated and responses to any findings are provided
    to this office. 14 CFR 183.57(c) and FAA Order 8100.15 place
    responsibility on the ODA holder to ensure that ODA unit members can
    perform their authorized functions without conflicting restraints or
    interference. ODA unit members also regularly interact with their FAA
    counterparts during certification projects and are able to communicate
    concerns directly. During regular FAA evaluations of ODAs, unit members
    are questioned about undue pressure and if they have the latitude to
    perform their duties appropriately.
        The FAA may also suspend or terminate an ODA at any time. Some
    reasons why the FAA may suspend or terminate an ODA include:

       ODA holder fails to properly perform the duties granted in
            the authorization;

       ODA holder does not exercise the care or judgment required
            to properly exercise the ODA;

       ODA holder displays a lack of integrity;

       ODA holder qualifications lapse;

       ODA holder does not take corrective action as required by
            the FAA;

       ODA holder or ODA unit does not complete required FAA
            training;

       Misconduct including, but not limited to, carelessness,
            collusion, conflict of interest, compromise or any other act
            that would jeopardize the proper functioning of the delegated
            functions.

        FAA Order 8100.15B, Ch. 7-2. ODA holders have limited
    administrative appeal rights within the FAA to appeal the suspension or
    termination of an ODA.

        Question 9. Is FAA considering any changes to its existing
    certification process for aircraft currently in certification and for
    future designs?
        Answer. Safety is the core of FAA's mission and our top priority.
    We have a longstanding, well-established, data-driven certification
    process that consistently results in safe aircraft and we remain
    committed to our proven processes. We continue to evaluate the
    information we learn from the 737 MAX accident investigations to
    determine if certification process changes may be needed. The
    Department of Transportation's Office of the Inspector General is
    conducting an audit of the FAA's certification processes, and the
    Secretary of Transportation has established a Special Committee to
    Review FAA's Aircraft Certification Process. We look forward to
    assessing any recommendations for improvements these activities may
    identify.

        Question 10. Is the pitch stability of the Boeing 737 MAX series
    aircraft equal to the pitch stability of older models of the Boeing 737
    aircraft?
        Answer. The pitch stability and pitch maneuvering characteristics
    were flight tested and determined to meet part 25 requirements and
    equivalent to the previous 737 NG model.

        Question 11. Did Boeing implement the Maneuvering Characteristics
    Augmentation System (MCAS) flight control law on the 737 MAX series to
    improve aircraft handling characteristics and achieve the pitch
    stability that FAA requires to certify an aircraft for use as a
    passenger aircraft? Did Boeing implement MCAS to allow pilots' type
    certificate to transfer from 737 NG to 737 MAX aircraft? Please provide
    the Committee with any associated documentation for the purpose or
    justification for MCAS.
        Answer. The purpose of MCAS is to make the 737 MAX compliant with
    FAA regulations on performance and handling characteristics, for
    example, maneuvering stability and aerodynamic stall characteristics.
    The MCAS provides performance and handling characteristics consistent
    with the predecessor Boeing 737 NG models. As part of the flight
    control system, MCAS was determined to be compliant with FAA
    regulations.

        Question 12. During the certification process, did the FAA or
    Boeing under delegated authority, determine that it could not certify
    the Boeing 737 MAX series aircraft to be used as a passenger aircraft
    because of the lack of pitch stability?
        Answer. No. The FAA flight tested the 737 MAX in all regimes of
    flight, including stalls, and no lack of pitch stability was found. If
    a lack of pitch stability was found, the FAA would have required Boeing
    to address the issue prior to the amended type certificate being
    issued.

        Question 13. Did the FAA require Boeing to install an automated
    stability system in order to receive certification for the Boeing 737
    MAX series to be used as a passenger aircraft?
        Answer. The FAA did not require the installation of an automated
    stability system. Boeing, as the applicant, defines the scope of
    changes at the airplane level. The FAA through its Certification Basis
    determination concurred with the scope of the changes.

        Question 14. When a pilot overrides the MCAS flight control law and
    manually controls the 737 MAX, does the pitch stability of the 737 MAX,
    while being manually operated, change to unsafe levels for a passenger
    aircraft?
        Answer. An aircraft is required to be controllable in all regimes
    of flight. The MCAS operates as part of the flight control system, not
    independently. The MCAS function is active only during manual flight,
    when the flaps are up and the aircraft is at an elevated angle-of
    attack. Manual flight with MCAS active was extensively flight tested
    and found to be safe and compliant with part 25.
                                     ______

         Response to Written Questions Submitted by Hon. Jon Tester to
                             Hon. Daniel K. Elwell
    Safety Features as Options and Transparency
        Question 1. Did FAA know which safety features on the 737 MAX were
    offered by Boeing as options versus as mandatory equipment?
        Answer. Features and equipment that are required for safety are not
    optional on any aircraft the FAA certifies. 14 CFR part 25
    ``Airworthiness Standards: Transport Category Airplanes'' contains the
    design standards.

        Question 2. Does FAA know what the cost is to Boeing for AOA
    redundancy and pilot alert equipment? And what Boeing charges customers
    to install on the 737 MAX?
        Answer. The FAA does not have information on pricing related to
    optional equipment on Boeing aircraft.

        Question 3. Did FAA determine that any Boeing-designated
    ``options'' should to be installed as mandatory equipment? If yes,
    which equipment was switched to be mandatory standard equipment?
        Answer. Required safety standards and features for large aircraft
    are established in 14 CFR part 25 (``Airworthiness Standards: Transport
    Category Airplanes''). Features required to meet those safety standards
    are mandatory on all FAA-certified aircraft, including the Boeing 737
    MAX. There are no optional safety standards or features.

        Question 4. Has FAA ever gone back to the manufacturer and required
    that equipment that the manufacturer identified as ``optional'' instead
    be included as standard for safety reasons? If so, what equipment for
    which plane?
        Answer. The FAA has the statutory authority to promulgate new rules
    to mandate equipment enhancements and updates based on new data and
    operational experience. There are cases where optional equipment later
    became mandatory on transport category aircraft after specific safety
    benefits were established. For example, the FAA promulgated new rules
    to mandate new equipment including terrain awareness and warning
    systems (TAWS), enhanced ground proximity warning systems (EGPWS), and
    traffic collision avoidance systems (TCAS).

        Question 5. Does FAA plan to require that AOA redundancy and pilot
    alert equipment be standard equipment? Why/why not?
        Answer. We continue to evaluate the information we learn from the
    737 MAX accident investigations to determine if certification process
    changes or specific equipment capabilities may be needed. The
    Department of Transportation's Office of the Inspector General is
    conducting an audit of the FAA's certification processes, and the
    Secretary of Transportation has established a Special Committee to
    Review FAA's Aircraft Certification Process. We look forward to
    assessing any recommendations for improvements these activities may
    identify.

        Question 6. Should air passengers know in advance which safety
    options airlines opt NOT to pay for on planes in their fleet? Why or
    Why not?
        Answer. Features and equipment that are required for safety are not
    optional on any aircraft the FAA certifies. 14 CFR part 25 contains the
    design standards for transport category aircraft. This is a single
    level of safety, and the same requirements apply to all aircraft
    certified under part 25. The FAA does not regulate the cost of, or
    communicate to passengers on, optional equipment the operator has or
    has not chosen to install.
    Pilot Training and Documentation
        Question 7. On what basis did FAA determine that no additional
    training for the 737 MAX 8 was needed?
        Answer. The FAA did require additional training for the 737 MAX 8.
    The FAA has processes and procedures to determine requirements for
    pilot training and type rating. During certification of the 737 MAX,
    the FAA followed its standard process in establishing a Flight
    Standardization Board (FSB) as the mechanism to evaluate manufacturer-
    proposed training for a new aircraft or type derivative. FSBs are
    chaired by FAA experts and utilize qualified pilots from the FAA,
    industry, and other aviation authorities to evaluate the aircraft. The
    FAA conducted this FSB as a joint evaluation with Transport Canada
    (TCCA), the European Aviation Safety Agency (EASA) and participation
    from U.S. operators. FSB pilots unanimously concluded that for the 737
    MAX, additional computer-based training was necessary beyond the
    training required for a Boeing 737 NG pilot to fly the 737 MAX.
    Instrumentation, Performance and Certification
        Question 8. Did FAA know about the lack of simultaneous and cross-
    check readings of the AOA sensors on the 737-MAX 8, i.e., the absence
    of displaying the readings of both sensors (versus just one at a time)
    and the lack of a ``disagree light'' being activated if the sensors are
    at odds with one another?
        Answer. When the AOA indicator display is present on a 737 model,
    the left primary flight display (PFD) shows the left AOA reading, and
    the right PFD shows the right AOA reading. These readings do not
    display side-by-side on one display. It is important to note that AOA
    and other air data inputs (i.e., airspeed and calculated Mach) are
    direct inputs to the MCAS flight control function within the flight
    control computers and not dependent on any display of information on
    the pilots' PFDs. There is no regulatory requirement for the AOA
    indicators or the AOA disagree message.

        Is that configuration consistent with current standards?
        Answer. The AOA indicator display and AOA DISAGREE message were
    consistent with current standards.

        Did anyone raise any concerns about this configuration?
        Answer. FAA carefully considered the configuration before
    determining it met applicable standards.

        Did FAA raise this point of vulnerability with Boeing? If no, why
    not?
        Answer. There is no regulatory requirement for manufacturers to
    install an AOA disagree message because there are no pilot procedures
    associated with the display of the message.

        Question 9. Who determined that the introduction of enlarged
    engines and their changed placement did not require a new certification
    for the aircraft? What were the factors/rationale justifying that
    decision?
        Answer. The managing Aircraft Certification Office (ACO) followed
    FAA regulations and policy in making the determination that the
    proposed design was eligible for an Amended Type Certificate (ATC). The
    FAA issued an ATC based on the evaluation of the proposed airplane
    design changes in accordance with 14 CFR Sec. 21.19, which describes
    changes requiring a new type certificate. Additionally, FAA Advisory
    Circular (AC) 21.101-1B, ``Establishing the Certification Basis of
    Changed Aeronautical Products,'' provides examples of substantial
    design changes for transport airplanes.
        In making a determination of a proposed type certification, the FAA
    evaluates the proposed design changes, considers the examples in the
    advisory circular, and reviews determinations made on previous
    certification programs.

        Question 10. FAA statements re: the functioning of MCAS appear to
    be conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
        Answer. MCAS is an integrated sub-system of the flight control
    system and cannot be disabled by itself. Automatic movement of the
    horizontal stabilizer--including that caused by MCAS--can be disabled
    through use of the STAB TRIM cut-off switches. When automatic movement
    of the horizontal stabilizer is disabled, MCAS cannot move the
    horizontal stabilizer. The pilot can still move the stabilizer
    manually, if necessary.

        Question 11. How does FAA decide which systems are delegated to
    firms for certification?
        Answer. The FAA determines the level of involvement during an
    Organization Designation Authorization (ODA) project based on many
    variables. These include the ODA's performance and experience with the
    compliance requirements, consideration of any novel or unusual
    certification areas, or instances where adequate standards may not be
    in place.

        Question 12. In the hearing, you testified that FAA managers did
    review the delegation of authority as required. Does that mean that the
    role of FAA managers is to review the delegation of authority OR do FAA
    managers review/verify that a firm's certification decision is
    appropriate? If the latter, on what basis does the FAA make a
    determination that a certification done by a firm meets U.S.
    requirements?
        Answer. The FAA reviews delegation of authority and appropriateness
    of certification decisions, including individual delegation decisions.
    This is accomplished in response to review of applicant certification
    proposals. The FAA responses are reviewed by management or by delegated
    staff on behalf of FAA management. The basis for ascertaining that the
    ODA makes certification decisions that meet FAA requirements is
    accomplished through approval of the ODA procedures and oversight of
    the ODA. FAA managers approve the ODA manual, which defines an ODA
    holder's authority and limitations and identifies the functions it may
    perform. The FAA-approved ODA manual establishes criteria for FAA
    involvement on each certification project. The FAA reviews the ODA's
    system for making decisions through oversight of system, personnel,
    procedures, activities and overall performance. FAA managers ensure the
    FAA's oversight program for the ODA is in place and is operating in
    accordance with FAA Order 8100.15. The ODA holder is responsible as the
    project applicant to show compliance to the airworthiness standards.
                                     ______

         Response to Written Question Submitted by Hon. John Thune to
                           Hon. Calvin L. Scovel III
        Question. Inspector General Scovel, the recent Federal Aviation
    Administration (FAA) Reauthorization Act of 2018 contained several
    bipartisan provisions aimed at improving and modernizing FAA's aircraft
    certification process. This included the establishment of an
    Organization Designation Authorization Office within FAA's Office of
    Aviation Safety, improving operational safety by strengthening
    oversight of ODA holders delegated to perform certain functions on
    behalf of the FAA.
        Additionally, you mentioned in your testimony that FAA has taken
    several steps to improve certification oversight in response to
    recommendations made by the Department of Transportation Office of
    Inspector General (DOT OIG), some of which were due to be implemented
    earlier this year.
        Beyond the work done in both the FAA Reauthorization and in
    response to recommendations made by DOT OIG, do see a need for further
    action to be taken regarding FAA's aircraft certification process, and
    if so, what are those actions?
        Answer. The actions FAA has already taken to address our prior
    recommendations are steps in the right direction. The key will be FAA's
    effective implementation of those recommendations and provisions of the
    FAA Reauthorization Act of 2018, which we will be reviewing during our
    audit of FAA's certification of the Boeing 737 MAX aircraft. We have
    just begun our latest audit work, and as such, it is too early to say
    what additional actions the FAA needs to take to improve its
    certification processes. We will keep the Committee apprised of our
    progress.
                                     ______

       Response to Written Questions Submitted by Hon. Maria Cantwell to
                           Hon. Calvin L. Scovel III
        General Scovel, your office has examined the performance of the ODA
    system and other issues within the certification system many times.
    Several times, including in 2011 and 2015, your office issued
    recommendations to FAA on ways to improve the system.
        Question 1. Did FAA adopt the recommendations from your office?
        Answer. Yes. Overall, FAA has been responsive to and adopted our
    recommendations. However, one key recommendation--for FAA to implement
    a new, more systems-and risk-based oversight approach--remains open.
    The Agency expects to complete implementing our recommendation in July
    2019.

        Question 2. Overall, would you call the ODA system safe? Are there
    improvements that still need to be implemented?
        Answer. Overall, the U.S. air transportation system is remarkably
    safe. However, recent events have raised concerns about FAA's oversight
    of the ODA program and its effectiveness. Improvements such as fully
    implementing our open recommendation will be a good start. We initiated
    an audit of FAA's certification of the Boeing 737 MAX on March 27,
    2019. While our audit is still in the early stages, we plan to address
    this issue in our review. We will be available to provide your office
    with more substantive information once we have an opportunity to
    develop our observations and findings.

        Question 3. What would happen if delegation ended--does FAA have
    the tools it would need to continue to carry out its certification
    responsibilities?
        Answer. Currently there are about 80 companies with delegated
    authority. The practice of delegation has served the industry well for
    years. ODA offers the Agency the opportunity to leverage outside
    expertise that it might not otherwise have access to and make the best
    use of limited resources and expertise. According to FAA, if ODA did
    not exist, the Agency would have to hire roughly 10,000 more employees
    to fulfill its aircraft certification mission.

        Question 4. Has your office compared the way the ODA system works
    with the way certification happens in Europe? Which system has a more
    rigorous degree of oversight agency involvement?
        Answer. We have not conducted a comparative analysis of how FAA's
    ODA process compares to systems used in Europe.
                                     ______

      Response to Written Questions Submitted by Hon. Tammy Duckworth to
                           Hon. Calvin L. Scovel III
        Question 1. Please describe the Federal regulatory rules, process
    and procedures for addressing an aircraft design single-point-of-
    failure, including the threshold for grounding such aircraft.
        Answer. FAA is responsible for ensuring the safety of the traveling
    public, including eliminating single points of failure and grounding
    aircraft for safety reasons. We initiated an audit of FAA's
    certification of the Boeing 737 MAX on March 27, 2019. While our audit
    is still in the early stages, our ongoing work will shed additional
    light on the processes, policies, and procedures for addressing these
    issues.

        Question 2. What is the basis for certification by FAA of a
    derivative aircraft and how does FAA determine pilot training
    requirements for derivative aircraft?
        Answer. FAA is responsible for determining the classification and
    certification of derivative aircraft. Also, in conjunction with
    manufacturers, FAA determines training requirements for pilots. We will
    explore these issues in greater detail in our ongoing review of how the
    Boeing 737 MAX was certified.

        Question 3. For the purposes of FAA aircraft certification, who
    determines whether a design change is ``significant'' such that it
    would preclude the aircraft from a derivative certification? Please
    describe in detail precisely how FAA make this determination and what
    constitutes a requirement for a new type certificate?
        Answer. FAA has the ultimate authority to determine whether a
    design change is significant and whether it would preclude the aircraft
    from being certified as a derivative. This is an issue we will examine
    in our ongoing review of how the Boeing 737 MAX was certified. We will
    be available to provide your office with more substantive information
    once we have an opportunity to develop our observations and findings.

        Question 4. When a new system(s) for a derivative aircraft is
    disclosed to the FAA by an Original Equipment Manufacturer (OEM), how
    does the FAA evaluate that system(s) to determine changes to pilot
    training, aircraft and pilot manuals and handbooks, and the potential
    nullification of the derivative certification of the aircraft?
        Answer. FAA works closely with the aircraft manufacturer to
    determine changes to pilot training as well as manuals and handbooks.
    This is an important question that has been raised with the Boeing 737
    MAX incidents. We will examine this and related issues in our ongoing
    review.

        Question 5. When a system is implemented on a derivative aircraft
    design with the intention of artificially retaining the handling
    qualities of the original design, what Federal requirements govern the
    publication and training of that system?
        Answer. We are in the early stages of our review of the
    certification of the Boeing 737 MAX, and as such, it is too early to
    say whether our review will address this issue. But please be assured
    that we will keep the Committee apprised of our progress.

        Question 6. When the FAA certifies a derivative aircraft, which
    type certificated aircraft is considered as the baseline for design
    change comparisons? In the case of the Boeing 737 MAX, was it the most
    recent type certified aircraft like the 737 NG or the original type
    design?
        Answer. FAA certifies derivative aircraft, but we have just begun
    our review of the 737 MAX certification. While our audit is still in
    the early stages, we plan to examine what make/model is considered as
    the ``baseline'' for the desired change and what other factors the
    Agency considers when making certification decisions for derivative
    aircraft.

        Question 7. Are derivative aircraft required to comply with 14 CFR
    Part 25 regulations at the time the amended type certificate is awarded
    or at the time of the original type certificate?
        Answer. This is an issue we will explore in detail in our ongoing
    audit of the Boeing 737 MAX certification.

        Question 8. Please point to the safeguards that FAA has in place to
    ensure that external pressures, such as time or competition, do not
    play any role in the quality of the certification or evaluation of a
    derivative aircraft.
        Answer. Safeguards against external pressures such as time and
    competition are important. FAA addresses this issue in its oversight
    procedures, but we do not know the effectiveness of any controls or
    safeguards in place. This is an issue we will explore in greater detail
    as we examine the certification of the Boeing 737 MAX.

        Question 9. Is FAA considering any changes to its existing
    certification process for aircraft currently in certification and for
    future designs?
        Answer. We are unaware of any changes FAA may be considering at
    this time. However, given the attention to this issue and the number of
    external reviews that are ongoing, there could be a number of changes
    to FAA's processes in the future.

        Question 10. Is the pitch stability of the Boeing 737 MAX series
    aircraft equal to the pitch stability of older models of the Boeing 737
    aircraft?
        Answer. The issue of pitch stability is an important question in
    the recent 737 MAX accidents. Preliminary reports suggest that there
    may be a difference in stability compared to earlier models. This is an
    issue we will examine in our ongoing review of the 737 MAX
    certification.

        Question 11. Did Boeing implement the Maneuvering Characteristics
    Augmentation System (MCAS) flight control law on the 737 MAX series to
    improve aircraft handling characteristics and achieve the pitch
    stability that FAA requires to certify an aircraft for use as a
    passenger aircraft? Did Boeing implement MCAS to allow pilots' type
    certificate to transfer from 737 NG to 737 MAX aircraft? Please provide
    the Committee with any associated documentation for the purpose or
    justification for MCAS.
        Answer. Based on reports, it appears that Boeing implemented MCAS
    to improve aircraft handling characteristics and to address concerns
    about pitch stability to certify the aircraft. We will look into all
    the reasons Boeing implemented MCAS in our review of the 737 MAX
    certification.

        Question 12. During the certification process, did the FAA or
    Boeing under delegated authority, determine that it could not certify
    the Boeing 737 MAX series aircraft to be used as a passenger aircraft
    because of the lack of pitch stability?
        Answer. We have just begun our review of 737 MAX certification. We
    are aware of concerns regarding the pitch stability of the 737 MAX, and
    will examine these issues in greater detail during our review.

        Question 13. Did the FAA require Boeing to install an automated
    stability system in order to receive certification for the Boeing 737
    MAX series to be used as a passenger aircraft?
        Answer. We do not know at this juncture exactly what FAA required
    Boeing to do, but we will determine whether FAA required Boeing to
    install an automated system to obtain certification.

        Question 14. When a pilot overrides the MCAS flight control law and
    manually controls the 737 MAX, does the pitch stability of the 737 MAX,
    while being manually operated, change to unsafe levels for a passenger
    aircraft?
        Answer. We are in the early stages of our review of the 737 MAX,
    but we will address the issue of whether or not the pilot can manually
    override MCAS. We recognize this is an important question in resolving
    problems with the Boeing 737 MAX.
                                     ______

         Response to Written Questions Submitted by Hon. Jon Tester to
                           Hon. Calvin L. Scovel III
    Scope of OIG Review
        Question 1. What factors will the OIG examine to determine if the
    FAA's relationship with Boeing was appropriate to fulfill its oversight
    role and responsibilities?
        Answer. In addition to assembling a timeline of the Boeing 737 MAX
    certification, we will examine the ODA process, including the roles and
    responsibilities between FAA and Boeing and how key decisions were
    made.

        Question 2. Is the OIG investigating if FAA allowed Boeing to take
    shortcuts to improve its competitiveness vis-a-vis international
    aircraft suppliers?
        Answer. Our ongoing audit if FAA's certification of the Boeing 737
    MAX will be reviewing all of the factors that went into the
    certification of the 737 MAX and will be alert for any factors that
    indicate shortcuts were taken.

        Question 3. Is the OIG looking at the impact and implications of
    market competition on:

        a. Boeings' decision-making and production schedules of the 737-MAX
    8?

        b. FAA's delegation of self-certification to Boeing?

        Answer. Our current review is focused on building a timeline for
    the certification of the 737 MAX and delegated authority. We will
    examine any factors that may have influenced key decisions.

        Question 4. Are reports that the number of aircrafts delivered is a
    factor in employees' performance reviews (and presumably bonus awards)
    true? If so, how will you determine if that situation impacted the
    planes' safety-related systems and pilot training requirements?
        Answer. We do not know whether the number of aircraft delivered was
    a factor in performance reviews at Boeing. This is an issue we will
    examine in our ongoing review of how the Boeing 737 MAX was certified.
    We will be available to provide your office with more substantive
    information once we have an opportunity to develop our observations and
    findings.
    Instrumentation, Performance and Certification
        Question 5. Did FAA know about the lack of simultaneous and cross-
    check readings of the AOA sensors on the 737-MAX 8, i.e., the absence
    of displaying the readings of both sensors (versus just one at a time)
    and the lack of a ``disagree light'' being activated if the sensors are
    at odds with one another?

        a. Is that configuration consistent with current standards?

        b. Did anyone raise any concerns about this configuration?

        c. Did FAA raise this point of vulnerability with Boeing? If no,
    why not?
        Answer. We cannot say at this time what Boeing and FAA knew given
    that we are in the early stages of our review of the 737 MAX
    certification. The issues raised about instrumentation and warnings are
    important questions that we will explore in our review.

        Question 6. Who determined that the introduction of enlarged
    engines and their changed placement did not require a new certification
    for the aircraft? What were the factors/rationale justifying that
    decision?
        Answer. FAA is ultimately responsible for decisions about
    certification. We do not yet know the factors that drove these
    decisions. However, we will explore these questions in our review of
    the 737 MAX certification.

        Question 7. FAA statements re: the functioning of MCAS appear to be
    conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
        Answer. After careful review and consideration, DOT-OIG believes
    FAA is most appropriately situated to provide a response to this
    question.

        Question 8. How does FAA decide which systems are delegated to
    firms for certification?
        Answer. FAA works closely with the manufacturer and decides what
    systems are delegated for certification. According to FAA, factors such
    as performance issues and areas critical to safety would lead to a
    higher level of FAA involvement and oversight.

        Question 9. In the hearing, Acting Administrator Elwell testified
    that FAA managers did review the delegation of authority as required.
    Does that mean that the role of FAA managers is to review the
    delegation of authority OR do FAA managers review/verify that a firm's
    certification decision is appropriate? If the latter, on what basis
    does the FAA make a determination that a certification done by a firm
    meets U.S. requirements?
        Answer. After careful review and consideration, DOT-OIG believes
    FAA is most appropriately situated to provide a response to this
    question.

                                    [all]