[Senate Hearing 116-353]
[From the U.S. Government Publishing Office]




                                                        S. Hrg. 116-353

 THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION

=======================================================================

                                HEARING

                               before the

                   SUBCOMMITTEE ON AVIATION AND SPACE

                                 of the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                               __________

                             MARCH 27, 2019

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation





                 [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
               
               




                Available online: http://www.govinfo.gov

                               ______
                                 

                 U.S. GOVERNMENT PUBLISHING OFFICE

42-445 PDF                WASHINGTON : 2023















       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                  ROGER WICKER, Mississippi, Chairman

JOHN THUNE, South Dakota             MARIA CANTWELL, Washington, 
ROY BLUNT, Missouri                      Ranking
TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska                RICHARD BLUMENTHAL, Connecticut
JERRY MORAN, Kansas                  BRIAN SCHATZ, Hawaii
DAN SULLIVAN, Alaska                 EDWARD MARKEY, Massachusetts
CORY GARDNER, Colorado               TOM UDALL, New Mexico
MARSHA BLACKBURN, Tennessee          GARY PETERS, Michigan
SHELLEY MOORE CAPITO, West Virginia  TAMMY BALDWIN, Wisconsin
MIKE LEE, Utah                       TAMMY DUCKWORTH, Illinois
RON JOHNSON, Wisconsin               JON TESTER, Montana
TODD YOUNG, Indiana                  KYRSTEN SINEMA, Arizona
RICK SCOTT, Florida                  JACKY ROSEN, Nevada

                       John Keast, Staff Director
                  Crystal Tully, Deputy Staff Director
                      Steven Wall, General Counsel
                 Kim Lipsky, Democratic Staff Director
              Chris Day, Democratic Deputy Staff Director
                      Renae Black, Senior Counsel

                                 ------                                

                   SUBCOMMITTEE ON AVIATION AND SPACE

TED CRUZ, Texas, Chairman            KYRSTEN SINEMA, Arizona, Ranking
JOHN THUNE, South Dakota             BRIAN SCHATZ, Hawaii
ROY BLUNT, Missouri                  TOM UDALL, New Mexico
JERRY MORAN, Kansas                  GARY PETERS, Michigan
CORY GARDNER, Colorado               TAMMY DUCKWORTH, Illinois
MARSHA BLACKBURN, Tennessee          JON TESTER, Montana
SHELLEY MOORE CAPITO, West Virginia  JACKY ROSEN, Nevada
MIKE LEE, Utah







                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on March 27, 2019...................................     1
Statement of Senator Cruz........................................     1
Statement of Senator Sinema......................................     2
Statement of Senator Wicker......................................     3
Statement of Senator Cantwell....................................     4
Statement of Senator Thune.......................................    37
Statement of Senator Klobuchar...................................    39
Statement of Senator Moran.......................................    41
Statement of Senator Blumenthal..................................    43
Statement of Senator Blunt.......................................    44
Statement of Senator Duckworth...................................    47
Statement of Senator Moore Capito................................    49
Statement of Senator Markey......................................    51
Statement of Senator Rosen.......................................    53
Statement of Senator Udall.......................................    56
    Article dated June 15, 2018 from the Seattle Times entitled, 
      ``Troublesome advanced engines for Boeing, Airbus jets have 
      disrupted airlines and shaken travelers''..................    57

                               Witnesses

Hon. Daniel K. Elwell, Acting Administrator, Federal Aviation 
  Administration.................................................     6
    Prepared statement...........................................     7
Hon. Robert L. Sumwalt III, Chairman, National Transportation 
  Safety Board...................................................    11
    Prepared statement...........................................    12
Hon. Calvin L. Scovel III, Inspector General, U.S. Department of 
  Transportation.................................................    19
    Prepared statement...........................................    21

                                Appendix

Response to written questions submitted to Hon. Daniel K. Elwell 
  by:
    Hon. John Thune..............................................    73
    Hon. Maria Cantwell..........................................    74
    Hon. Amy Klobuchar...........................................    74
    Hon. Tom Udall...............................................    74
    Hon. Tammy Duckworth.........................................    76
    Hon. Jon Tester..............................................    79
Response to written questions submitted to Hon. Calvin L. Scovel 
  III by:
    Hon. John Thune..............................................    81
    Hon. Maria Cantwell..........................................    81
    Hon. Tammy Duckworth.........................................    82
    Hon. Jon Tester..............................................    83









 
 THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION

                              ----------                              


                       WEDNESDAY, MARCH 27, 2019

                               U.S. Senate,
                Subcommittee on Aviation and Space,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 3:02 p.m. in 
room SH-216, Hart Senate Office Building, Hon. Ted Cruz, 
Chairman of the Subcommittee, presiding.
    Present: Senators Cruz [presiding], Wicker, Thune, Blunt, 
Moran, Moore Capito, Sinema, Cantwell, Blumenthal, Markey, 
Duckworth, Klobuchar, Udall, and Rosen.

              OPENING STATEMENT OF HON. TED CRUZ, 
                    U.S. SENATOR FROM TEXAS

    Senator Cruz. Well, good afternoon. The subcommittee will 
come to order.
    Our hearing is entitled The State of Airline Safety: 
Federal Oversight of Commercial aviation. Welcome to each of 
the witnesses.
    On March 10, 2019, Ethiopian Airlines Flight 302 departed 
Addis Ababa Airport with 157 souls onboard. Among them were 
parents and children, reverends and international aid workers, 
and college students with their entire lives ahead of them, but 
at 8:44 a.m., 6 minutes after takeoff, what should have been a 
routine two-hour flight turned into a tragedy. Flight 302 
crashed, killing all 157 people.
    Although devastating on its own, the tragedy of Flight 302 
was compounded by the fact that something like this had 
happened less than six months earlier.
    Lion Air Flight 610 had been in the air just 12 minutes 
before plunging into the Java Sea at 6:32 a.m. on October 29, 
2018, killing all 189 people onboard.
    The 346 men, women, and children lost in these tragic 
crashes came from 35 different countries, ranged in age from 
the elderly to the unborn, and had professions as diverse as 
their backgrounds, but they did have one thing in common. They 
were all traveling on a brand-new plane, a Boeing 737 Max.
    It is truly unfortunate that today's hearing is necessary 
and I wish we didn't have to be here today, but our first 
priority in aviation must always be the safety of the flying 
public.
    The fact of the matter is that these crashes and subsequent 
reports on how the 737 Max was approved have badly shaken 
consumer confidence.
    In aviation, as in other industries, where a small mistake 
can have catastrophic consequences, trust is the currency of 
the realm. Trust of the flying public in the safety of the 
aircraft they step onto, trust of our international partners in 
the diligence and thoroughness of our regulatory bodies, and 
increasingly trust of our regulatory bodies in the quality and 
truthfulness of the data and certifications provided and 
performed by industry.
    Not only have the recent crashes shaken the confidence of 
the public but the questions that have been raised in the 
aftermath about FAA's oversight of aircraft manufacturers, the 
certification process for planes, and the close relationship 
between industry and regulator threaten to erode trust in the 
entire system.
    It is incumbent on us as legislators, as regulators, and as 
industry leaders to work to ensure that that does not occur.
    Today's hearing takes the first step down that road by 
seeking to answer some fundamental questions.
    First, we need to understand exactly what happened, both in 
these specific crashes and with the certification process for 
the Max aircraft, so that we can take action to keep something 
like these tragic crashes from occurring again.
    Second, we need to look at the aviation safety space more 
broadly and identify where we can and should make improvements. 
We need to answer, at least begin to answer questions like is 
the FAA taking the right approach to the oversight and 
certification of aircraft manufacturing, operations, and 
repair, particularly with regard to designated authority.
    Also answering how safe is commercial aviation, both in the 
United States and internationally, and how can we increase the 
level of safety even further, and how can we restore the 
confidence and trust of the flying public, both in the United 
States and internationally?
    As our witnesses today will highlight in their testimony, 
commercial aviation in the United States today is as safe as it 
ever has been worldwide and particularly in the United States.
    The likelihood of being in a fatal commercial plane crash 
is infinitesimally low and this is a record that we can and 
should be proud of, but this record is also exactly what makes 
the recent crashes and reports of lenient oversight by the FAA 
so frustrating.
    As a nation, we have been on such a promising upward trend 
in safety that, although these crashes occurred in foreign 
countries, the questions that have been raised about the 
integrity of our regulatory processes strikes right to the 
heart of aviation safety here at home.
    We need to do better and I firmly believe that we can. With 
that, I'll recognize the Ranking Member of the Aviation and 
Space Subcommittee, Senator Sinema.

               STATEMENT OF HON. KYRSTEN SINEMA, 
                   U.S. SENATOR FROM ARIZONA

    Senator Sinema. Well, thank you, Chairman Cruz, for holding 
this timely and important hearing.
    I look forward to building a strong relationship and 
working closely with you on this and other issues in our 
Subcommittee's jurisdiction.
    Thank you to our witnesses for joining us today.
    The United States airspace and U.S. aviation are the safest 
in the world. The United States is the leader in aviation and 
aviation safety, thanks to the dedication of thousands of 
skilled individuals on the manufacturing floor, on the ground 
at airports, in control towers, and in the air.
    Our safety also relies on the advocacy of concerned 
citizens, like the families of Continental Flight 3407, who 
tirelessly advocate for safer skies. Thank you for being here 
today and for your work on this important issue.
    The aviation industry is a major economic driver. Safe, 
affordable, and convenient air travel is critical to the well-
being of industry, job creation, and economic growth. The 
system is successful because it is safe and people know and 
trust that it is safe.
    Tragedies, like the Ethiopian Airlines and Lion Air crashes 
are unimaginable in the U.S. and must remain so, but they and 
other recent incidents raise important questions about 
maintaining a safe national airspace system and U.S. leadership 
in aviation and safety.
    It's imperative that we quickly fix any problems within 
FAA's oversight, evaluation, and approval processes to ensure 
safety in American skies, restore trust, and maintain U.S. 
global leadership in aviation and aviation safety.
    Thank you, Mr. Chairman. I yield back.
    Senator Cruz. I now recognize the Chairman of the Full 
Committee, Senator Wicker.

                STATEMENT OF HON. ROGER WICKER, 
                 U.S. SENATOR FROM MISSISSIPPI

    Senator Wicker. Thank you, Senator Cruz, and I want to 
thank Senator Cruz and Senator Sinema for holding this 
Subcommittee hearing on the timely subject of aviation safety.
    As both the Chair and Ranking Member mentioned in their 
remarks, the remarkable safety record of U.S. passenger airline 
travel is a testament to decades of hard work and painful 
lessons learned by a great many stakeholders.
    Today's hearing represents the beginning of this year's 
work in this area. The Committee intends to hold a second 
hearing on aviation safety to hear from non-government 
witnesses, including Boeing.
    We understand that the investigations into the Ethiopian 
Airlines and Lion Air crashes are ongoing and may limit certain 
details from being discussed in this forum. However, our 
witnesses can cover a lot of information today, including 
addressing the FAA's response to these tragedies, the 
certification process, pilot training, and broader concerns 
about the increasing complexity and automation of aircraft 
systems.
    The FAA has long been considered the gold standard 
internationally when it comes to safety. It is vital that we 
work with our partners throughout the world to promote safe air 
transportation. The committee will continue to discuss robust 
oversight to ensure the safety of our aviation system.
    Thank you, Mr. Chairman.
    Senator Cruz. I now recognize the Ranking Member of the 
Full Committee, Senator Cantwell.

               STATEMENT OF HON. MARIA CANTWELL, 
                  U.S. SENATOR FROM WASHINGTON

    Senator Cantwell. Thank you, Mr. Chairman, and thank you 
for holding this important hearing today to discuss the 
paramount issue of aviation safety here in the United States 
and around the world.
    I thank the witnesses for being here and their insights 
today and I, too, want to recognize the families of the Colgan 
Air Flight 3407 who are here today because it is their 
continued persistence about getting aviation right that is so 
admirable. I thank them and thank you all for being here.
    The incidents that led us here today of the crash of Lion 
Air 610 last October and the Ethiopian Flight 302 are horrible 
human tragedies. I want to extend my deepest sympathies to the 
families and everyone impacted by this horrific incident.
    These two accidents cost 346 lives, leaving behind 
countless individuals and loved ones who I know want to make 
sure this is never repeated.
    The human toll is why we work every day to ensure that 
every possible step is taken to determine the causes that 
contributed to these incidents and through the crash 
investigations, other Federal investigations, and ongoing 
congressional oversight, I believe we all share the same goal, 
to make sure these accidents are never repeated.
    It is critical that all those involved look at the causes 
of the accident and work so that everyone has the full picture 
of what happened.
    Investigators in Indonesia and Ethiopia, with the help from 
NTSB and FAA and other international partners, are working 
through the evidence to determine the causes of these accidents 
and even though, as my colleagues have mentioned, global 
commercial aviation has experienced unprecedented periods of 
safety over the last decade, these two accidents are horrific 
reminders that we must remain vigilant in our oversight and 
focus on safety.
    So I look forward to hearing the information from the 
witnesses that is available for us today and I also commend 
yesterday's Secretary Chao's indication that she will seek a 
previously authorized authority by the last 2018 FAA bill which 
authorizes the establishment of a special committee of aviation 
experts to review the recommendations on the Federal Aviation 
Administration procedure process.
    So I look forward to their analysis as I do the analysis of 
all the investigations that are ongoing. Safety remains 
paramount and I look forward to working with all my colleagues 
on this very serious issue.
    Senator Cruz. Thank you.
    I'll now introduce each of the witnesses. The first witness 
is Mr. Daniel K. Elwell, who is currently the Acting 
Administrator of the Federal Aviation Administration. Before 
becoming Acting Administrator, Mr. Elwell served as the Deputy 
Administrator of the FAA from June 2017 to January 2018, and as 
a Senior Advisor to the Secretary of Transportation Elaine Chao 
prior to that.
    Mr. Elwell began his career in aviation in the United 
States Air Force where he received his Bachelor of Science 
degree in International Affairs from the U.S. Air Force 
Academy. He achieved the rank of Lieutenant Colonel and retired 
from military service as a command pilot.
    After retiring from the military, Mr. Elwell was a 
commercial pilot for 16 years with American Airlines, flying 
DC-10, MD-80, and Boeing 757-767 aircraft, and he then served 
at the FAA as Assistant Administrator for Policy, Planning, and 
Environment from 2006 to 2008.
    From 2008 to 2013, Mr. Elwell served as Vice President of 
the Aerospace Industries Association and from 2013 to 2015 as 
Senior Vice President for Safety, Security, and Operations at 
Airlines for America.
    Our second witness is the Honorable Robert Sumwalt. 
Following his nomination by President Trump and confirmation by 
the Senate, Robert L. Sumwalt was sworn in as Chairman of the 
National Transportation Safety Board on August 10, 2017.
    Prior to joining the NTSB, Chairman Sumwalt was a pilot for 
more than 30 years, during which time he flew for commercial 
carriers that included Piedmont Airlines and U.S. Airways and 
accumulated over 14,000 flight hours.
    He began his tenure at the NTSB in August 2006 when he was 
appointed to the Board by President George W. Bush and 
designated as Vice Chairman. In 2011, he was reappointed for an 
additional five-year term as a board member by President Obama.
    Chairman Sumwalt earned his undergraduate degree from the 
University of South Carolina and a Master's of Aeronautical 
Science with Distinction from Embry-Riddle Aeronautical 
University.
    He has been awarded an Honorary Doctor of Science degree 
from the University of South Carolina and an Honorary Doctorate 
from Embry-Riddle.
    Our third witness is the Honorable Calvin Scovel. Mr. 
Scovel was sworn in as Inspector General of the Department of 
Transportation on October 26, 2006.
    Prior to joining the DOT, he served 29 years of Active Duty 
service in the U.S. Marine Corps where he retired as a 
Brigadier General.
    During his military career, he served as a senior judge on 
the U.S. Navy Marine Corps Court of Appeals and as an Assistant 
Judge Advocate General of the Navy for Military Justice and as 
a senior advisor for the 4th Marine Expeditionary Brigade.
    His tenure as the DOT Inspector General has spanned the 
Administrations of three Presidents and four Secretaries of 
Transportation, during which time he has overseen audits and 
investigations dealing with all aspects of the Nation's 
transportation system.
    Mr. Scovel received a law degree from Duke University, a 
Bachelor's degree from the University of North Carolina at 
Chapel Hill, a Master's degree from the Naval War College, and 
he is a recipient of the Secretary of Transportation's Gold 
Medal for Outstanding Achievement.
    Administrator Elwell, we'll begin with your testimony.

   STATEMENT OF HON. DANIEL K. ELWELL, ACTING ADMINISTRATOR, 
                FEDERAL AVIATION ADMINISTRATION

    Mr. Elwell. Chairman Cruz, Chairman Wicker, Ranking Member 
Sinema, Members of the Subcommittee, thank you for the 
opportunity to appear before you today.
    On behalf of the U.S. Department of Transportation and the 
Federal Aviation Administration, I extend our deepest sympathy 
to the families of the passengers and the crews of Ethiopian 
Airlines 302 and Lion Air 610.
    Safety is at the core of the FAA's mission. It is our first 
priority. We have worked tirelessly to take a more proactive 
data-driven approach to oversight that instills a safety above 
all else culture at the FAA and the aviation community we 
regulate.
    This approach has made the U.S. aviation system the safest 
in the world. Since 1997, the risk of a fatal commercial 
aviation accident in the United States has been cut by 94 
percent and in the past 10 years, we've experienced one 
commercial airline passenger fatality in the United States in 
over 90 million flights. That's a remarkable record, but we 
know we must never stop pursuing improvement. We must never 
become complacent because one fatality is one too many.
    I speak to you today as both a former military and airline 
pilot and as a public servant who has dedicated his life to the 
pursuit of aviation safety. I am proud to lead the dedicated 
professionals of the FAA who share the same passion and sense 
of mission to make America's aviation system the safest.
    Because we know our fact-based data-driven approach works, 
we have applied this guiding principle in our response to the 
recent Boeing 737 Max accidents.
    I would like to provide you with an overview of the FAA's 
certification and oversight processes as well as our current 
actions with respect to the 737 Max and the next steps the FAA 
will take to foster safety enhancements here and abroad.
    Safety is not just a set of programs that can be 
established or implemented. It is a way of living and working 
and it requires the open and transparent exchange of 
information. It takes collaboration, communication, and common 
safety objectives to allow the FAA and the aviation community 
to jointly identify system hazards and to implement safety 
solutions.
    Decades of experience have proven that this approach yields 
knowledge that we would not otherwise obtain. FAA aircraft 
certification has always relied on the exchange of information 
and technical data with industry.
    Some version of our certification process has been in place 
for over 60 years. This does not mean that the process remains 
static. To keep pace with technology and advances in safety, 
the general regulations have been modified more than 90 times. 
The rules applicable to large transport aircraft, like the 737 
Max, have been amended more than 130 times.
    The FAA focuses its efforts on those areas that present the 
highest risk within the system. Our certification processes are 
extensive, well-established, and have consistently produced 
safe aircraft designs for decades.
    Boeing first applied for an amended certificate for the 737 
Max in January 2012. From initial application to final 
certification, it took about 5 years. The FAA was fully 
involved in the process, including participation in 133 of the 
297 flight tests, some of which encompassed tests of the 
aircraft MCAS system which has been the subject of recent 
attention.
    In the immediate aftermath of the Lion Air accident, the 
FAA issued an Emergency Airworthiness Directive that requires 
operators of the 737 Max to revise their flight manuals to 
reinforce to flight crews how to recognize and respond to 
uncommanded stabilizer trim movement.
    The FAA continues to seek and evaluate any additional data 
that might help us understand the underlying factors that led 
to the recent 737 Max accidents.
    We will take immediate and appropriate action based on the 
facts. U.S. and international operators of the 737 Max are 
relying on the FAA to get it right.
    I want to assure you and everyone else that the FAA will go 
wherever the facts lead us in our pursuit of safety. The 737 
Max will return to service for U.S. carriers only when the 
FAA's analysis of the facts and technical data indicate that it 
is appropriate to do so.
    In our quest for continuous safety improvement, the FAA 
welcomes external review of our systems, processes, and 
recommendations. As recent events have reminded us, aviation 
safety has no borders or boundaries. The FAA is resolute in its 
commitment to maintaining the U.S. air transportation system as 
the gold standard of the world.
    That concludes my statement. I'm ready to answer any 
questions.
    [The prepared statement of Mr. Elwell follows:]

  Prepared Statement of Hon. Daniel K. Elwell, Acting Administrator, 
                    Federal Aviation Administration
    Chairman Cruz, Ranking Member Sinema, Members of the Subcommittee:

    Thank you for the opportunity to appear before you today to discuss 
the current state of aviation safety. On behalf of the United States 
Department of Transportation and the Federal Aviation Administration, 
we extend our deepest sympathy to the families of the victims of the 
recent Ethiopian Airlines accident, as well as the Lion Air accident.
    Safety is the core of the Federal Aviation Administration's mission 
and our top priority. With the support of this Committee, we have 
worked tirelessly to take a more proactive, data-driven approach to 
oversight that instills a safety above all approach inside the FAA and 
within the aviation community that we regulate. The result of this 
approach is that the United States has the safest air transportation 
system in the world. Since 1997, the risk of a fatal commercial 
aviation accident in the United States has been cut by 95 percent. And 
in the past ten years, there has only been one commercial airline 
passenger fatality in the United States in over 90 million flights. But 
a healthy safety culture requires commitment to continuous improvement.
    Our commitment to safety and fact-based, data-driven decision 
making has been the guiding principle in the FAA's response to the two 
fatal accidents involving the Boeing 737 MAX airplane outside the 
United States. Today, I would like to provide you with an overview of 
the FAA's certification and oversight processes, our current actions 
with respect to the 737 MAX, and the next steps that the FAA will take 
to foster safety enhancements here and abroad.
The FAA is a Data-Driven Agency Focused on Safety
    As the aerospace system and its components become increasingly more 
complex, we know that our oversight approach needs to evolve to ensure 
that the FAA remains the global leader in achieving aviation safety. In 
order to maintain the safest air transportation system in the world, 
during the past two decades the FAA has been evolving from a 
prescriptive and more reactive approach for its safety oversight 
responsibilities to one that is performance-based, proactive, centered 
on managing risk, and focused on continuous improvement. A key part of 
this transition has been the adoption of safety management systems, or 
SMS, within the FAA. The evolution toward SMS began internally at the 
FAA more than 15 years ago, starting with the FAA's Air Traffic 
Organization and expanding across the FAA to include all of our lines 
of business. Consistent with recommendations of the International Civil 
Aviation Organization (ICAO), we have been working with industry 
towards implementation of SMS in various sectors. For example, as of 
March 9, 2018, scheduled commercial air carriers, regulated under 14 
CFR part 121, are required to have an SMS.
    Safety is not just a set of programs that can be ``established'' or 
``implemented.'' It is a way of living and working, and it requires the 
open and transparent exchange of information. We know that it takes 
collaboration, communication, and common safety objectives to allow the 
FAA and the aviation community to come together, to identify system 
hazards, and to implement safety solutions. This approach gives us 
knowledge that we would not otherwise have about events and risks. 
Sharing safety issues, trends, and lessons learned is critical to 
recognizing whatever might be emerging as a risk in the system. The 
more data we have, the more we can learn about the system, which in 
turn allows us to better manage and improve the system.
    To be clear, the SMS approach does not diminish the FAA's role as a 
safety regulator. Any party that the FAA regulates remains responsible 
for compliance with the FAA's regulatory standards, and the FAA does 
not hesitate to take enforcement action when it is warranted.
Aircraft Certification
    One of the FAA's core functions, aircraft certification, has always 
relied on the exchange of information and technical data. The FAA 
certifies the design of aircraft and components that are used in civil 
aviation operations. Some version of our certification process has been 
in place and served us well for over 60 years. This does not mean the 
process has remained static. To the contrary, since 1964, the 
regulations covering certification processes have been under constant 
review. As a result, the general regulations have been modified over 90 
times, and the rules applicable to large transport aircraft, like the 
Boeing 737 MAX, have been amended over 130 times. The regulations and 
our policies have evolved in order to adapt to an ever-changing 
industry that uses global partnerships to develop new, more efficient, 
and safer aviation products and technologies.
    The FAA focuses its efforts on areas that present the highest risk 
within the system. The FAA reviews the applicant's design descriptions 
and project plans, determines where FAA involvement will derive the 
most safety benefit, and coordinates its intentions with the applicant. 
When a particular decision or event is critical to the safety of the 
product or to the determination of compliance, the FAA is involved 
either directly or through the use of our designee system.
    The designee program was originally authorized by Congress in 1958 
and is critical to the success and effectiveness of the certification 
process. Under this program, the FAA may delegate a matter related to 
aircraft certification to a qualified private person. This is not self-
certification; the FAA retains strict oversight authority. The program 
allows the FAA to leverage its resources through delegation. Last fall, 
Congress specifically directed the FAA to make full use of this 
authority in the FAA Reauthorization Act of 2018. In aircraft 
certification, both individual and organizational designees support the 
FAA. The FAA determines the level of involvement of the designees and 
the level of FAA participation needed based on many variables. These 
variables include the designee's understanding of the compliance 
policy; consideration of any novel or unusual certification areas; or 
instances where adequate standards may not be in place.
    The Organization Designation Authorization (ODA) program is the 
means by which the FAA may authorize an organization to act as a 
representative of the FAA, allowing that organization to conduct 
inspections and tests and issue certificates on behalf of the FAA. 
Currently, there are 79 ODA holders. ODA certification processes allow 
an applicant greater flexibility and control over schedules than 
applicants whose projects are directly managed by the FAA. The FAA has 
a rigorous process for issuing an ODA. ODA holders must have 
demonstrated experience and expertise in FAA certification processes, a 
qualified staff, and an FAA-approved procedures manual before they are 
appointed. The procedures manual defines an ODA holder's authority and 
limitations, and identifies the functions it may perform.
    The FAA determines its level of involvement on a project-by-project 
basis. There are many issues that will always require direct FAA 
involvement, including equivalent level of safety determinations, and 
rulemakings required to approve special conditions. The FAA may choose 
to be involved in other project areas after considering factors such as 
our confidence in the applicant, the applicant's experience, the 
applicant's internal processes, and confidence in the designees.
    Something that is not well understood about the certification 
process is that it is the applicant's responsibility to ensure that an 
aircraft conforms to FAA safety regulations. It is the applicant who is 
required to develop aircraft design plans and specifications, and 
perform the appropriate inspections and tests necessary to establish 
that an aircraft design complies with the regulations. The FAA is 
responsible for determining that the applicant has shown that the 
overall design meets the safety standards. We do that by reviewing data 
and by conducting risk-based evaluations of the applicant's work.
    The FAA is directly involved in the testing and certification of 
new and novel features and technologies. When a new design, or a change 
to an existing design, of aircraft is being proposed, the designer must 
apply to the FAA for a design approval. While an applicant usually 
works on its design before discussing it with the FAA, we encourage 
collaborative discussions well in advance of presenting a formal 
application. Once an applicant approaches us, a series of meetings are 
held both to familiarize the FAA with the proposed design, and to 
familiarize the applicant with the certification requirements. A number 
of formal and informal meetings are held on issues ranging from 
technical to procedural. Once the application is made, issue papers are 
developed to provide a structured way of documenting the resolution of 
technical, regulatory, and administrative issues that are identified 
during the process.
    Once the certification basis is established for a proposed design, 
the FAA and the applicant develop and agree to a certification plan and 
initial schedule. In order to receive a type certificate, the applicant 
must conduct an extensive series of tests and reviews to show that the 
product is compliant with existing standards and any special 
conditions, including lab tests, flight tests, and conformity 
inspections. These analyses, tests, and inspections happen at a 
component-level and an airplane-level, all of which are subject to FAA 
oversight. If the FAA finds that a proposed new type of aircraft 
complies with safety standards, it issues a type certificate. Or, in 
the case of a change to an existing aircraft design, the FAA issues an 
amended type certificate.
Facts Concerning the Boeing 737 MAX
    The certification processes described above are extensive, well-
established, and have consistently produced safe aircraft designs for 
decades. The Boeing Company has designed and built 14 variations of its 
original model 737 since the FAA issued the original type certificate 
in 1967. The FAA followed its standard procedures in determining that 
the 737 MAX project would qualify as an amended type certificate 
project, and identifying what items would be delegated to the Boeing 
ODA to approve and which would be retained by the FAA for approval. 
Boeing first applied for an amended type certificate for this aircraft 
in January 2012. As a result of regular meetings between the FAA and 
Boeing teams, the FAA determined in February 2012 that the project 
qualified as an amended type certificate project eligible for 
management by the Boeing ODA. The FAA was directly involved in the 
System Safety Review of the Maneuvering Characteristics Augmentation 
System (MCAS).
    The process from initial application to final certification took 
five years; the FAA added the 737 MAX to the 737 type certificate in 
March 2017. The process included 297 certification flight tests, some 
of which encompassed tests of the MCAS functions. FAA engineers and 
flight test pilots were involved in the MCAS operational evaluation 
flight test. The certification process was detailed and thorough, but, 
as is the case with newly certified products, time yields more data to 
be applied for continued analysis and improvement. As we obtain 
pertinent information, identify potential risk, or learn of a system 
failure, we analyze it, we find ways to mitigate the risk, and we 
require operators to implement the mitigation. And that is what has 
happened in the case of the 737 MAX.
737 MAX Accidents and the Decision to Ground the Fleet
    On October 29, 2018, a Boeing 737 MAX operated by Lion Air as 
flight JT610 crashed after taking off from Soekarno-Hatta Airport in 
Jakarta, Indonesia. Flight JT610 departed from Jakarta with an intended 
destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20 
a.m. (local time), and crashed into the Java Sea approximately 13 
minutes later. One hundred and eighty-four passengers and five 
crewmembers were on board. There were no survivors. An Indonesian-led 
investigation into the cause of this accident is ongoing, supported by 
the National Transportation Safety Board (NTSB), FAA, and Boeing.
    On November 7, 2018, based on all available and relevant 
information, including evidence from the Lion Air accident 
investigation and analysis performed by Boeing, the FAA issued an 
Emergency Airworthiness Directive. The airworthiness directive requires 
operators of the 737 MAX to revise their flight manuals to reinforce to 
flight crews how to recognize and respond to uncommanded stabilizer 
trim movement and MCAS events. The FAA continued to evaluate the need 
for software and/or other design changes to the aircraft including 
operating procedures and training as additional information was 
received from the ongoing Lion Air accident investigation. On January 
21, 2019, Boeing submitted a proposed MCAS software enhancement to the 
FAA for certification. To date, the FAA has tested this enhancement to 
the 737 MAX flight control system in both the simulator and the 
aircraft. The testing, which was conducted by FAA flight test engineers 
and flight test pilots, included aerodynamic stall situations and 
recovery procedures. The FAA's ongoing review of this software 
installation and training is an agency priority, as will be the roll-
out of any software, training, or other measures to operators of the 
737 MAX.
    On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing 
737 MAX, crashed at 8:44 a.m. (local time), six minutes after takeoff. 
The flight departed from Bole International Airport in Addis Ababa, 
Ethiopia with an intended destination of Nairobi, Kenya. The accident 
site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers 
and eight crewmembers were on board. None survived. An Ethiopian-led 
investigation into the cause of this accident is ongoing, supported by 
the NTSB, FAA, and Boeing.
    Following the second accident, the FAA gathered all of the data it 
had and continued to review information from the investigation as it 
became available. On March 11, 2019, the FAA issued a Continuous 
Airworthiness Notification to the International Community (CANIC) for 
737 MAX operators. The CANIC included a list of all of the activities 
the FAA had completed in support of the continued operational safety of 
the 737 MAX fleet. These activities included the airworthiness 
directive issued on November 7, 2018, ongoing oversight of Boeing's 
flight control system enhancements, and updated training requirements 
and flight crew manuals.
    After issuing the CANIC, the FAA continued to evaluate all 
available data and aggregate safety performance from operators and 
pilots of the 737 MAX, none of which provided any data to support 
grounding the aircraft. The FAA's initial review of flight safety data 
for U.S. operators showed no systemic performance issues and provided 
no basis to order grounding the aircraft. This review included analysis 
of recent Aviation Safety Reporting System reports that reference MCAS 
and/or controllability issues with the Boeing 737 MAX. In no case did 
the reporting party state that the problems experienced were due to the 
MCAS system. Also, at that time, other civil aviation authorities had 
not provided any data to the FAA that warranted action.
    On March 13, 2019, however, the Ethiopian Airlines investigation 
developed new information from the wreckage concerning the aircraft's 
configuration just after takeoff that, taken together with newly 
refined data from satellite-based tracking of the aircraft's flight 
path, indicated some similarities between the Ethiopian Airlines and 
Lion Air accidents that warranted further investigation of the 
possibility of a shared cause that needed to be better understood and 
addressed. Accordingly, the FAA made the decision to ground all 737 MAX 
airplanes operated by U.S. airlines or in U.S. territory pending 
further investigation, including examination of information from the 
aircraft's flight data recorders and cockpit voice recorders.
Next Steps
    The FAA will continue to support the ongoing Lion Air and Ethiopian 
Airlines accident investigations, review the evidence and data 
obtained, and take immediate and appropriate action based on the facts. 
U.S. and international operators of the 737 MAX are relying on the FAA 
to get it right. I want to assure this Committee and everyone else 
concerned that the FAA will go wherever the facts lead us, in the 
interest of safety. The 737 MAX will return to service for U.S. 
carriers and in U.S. airspace only when the FAA's analysis of the facts 
and technical data indicate that it is appropriate. In our quest for 
continuous safety improvement, the FAA welcomes external review of our 
systems, processes, and recommendations. We will work with the newly 
established Special Committee to Review FAA's Aircraft Certification 
Process, cooperate fully with the Inspector General's review, and 
continue our work with the congressionally-mandated Safety Oversight 
and Certification Advisory Committee and ODA Expert Review Panel.
    As recent events have reminded us, aviation does not have borders 
or boundaries. The FAA is focused on continuous safety improvement here 
at home and internationally through our ongoing engagement with other 
civil aviation authorities and industry stakeholders throughout the 
world. Aviation remains the safest mode of transportation globally, and 
we promote this level of safety by sharing issues, trends, and lessons 
learned throughout the world. The United States is the gold standard in 
aviation safety. The FAA is resolute in its commitment to maintaining 
that standard.
    This concludes my prepared statement. I will be happy to answer 
your questions.

    Senator Cruz. Thank you.
    Mr. Sumwalt.

  STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL 
                  TRANSPORTATION SAFETY BOARD

    Mr. Sumwalt. Thank you, Chairman Wicker, Chairman Cruz, 
Ranking Member Cantwell, Ranking Member Sinema, and Members of 
the Subcommittee.
    Thank you for allowing the NTSB to testify today about this 
very important topic.
    As you are well aware, in the past five months, there have 
been two crashes involving the Boeing 737 Max and tragically 
these two accidents have claimed 346 lives.
    My testimony this afternoon will focus on the NTSB's 
involvement with each of these crash investigations.
    Now unlike the NTSB's involvement in domestic aviation 
accidents where we have the statutory responsibility to 
investigate each and every accident that occurs in this 
country, our involvement with international investigations is 
vastly different.
    The NTSB's role in accidents outside the U.S. is governed 
by Annex 13 to the Convention on International Civil Aviation, 
to which 192 countries, including the U.S., are signatories.
    Annex 13 states that a safety investigation is to be led by 
the country in which the accident occurs, known as the state of 
occurrence. Thus, the National Transportation Safety Committee 
of Indonesia is leading the investigation into last year's Lion 
Air crash, and likewise the Ethiopia Accident Investigation 
Bureau is leading the investigation into this month's Ethiopian 
Airlines crash.
    When the accident involves a U.S.-operated or U.S.-
registered aircraft or U.S.-designed or manufactured aircraft, 
as these aircraft were, the NTSB appoints an accredited 
representative. This is a highly skilled NTSB investigator 
whose purpose is to coordinate the input of all U.S. interests, 
including the NTSB, the FAA, and companies, such as 
manufacturers, and others that can provide technical 
assistance.
    It's important to note that the state of occurrence leads 
the investigation and controls the release of information from 
that investigation, not the NTSB.
    Although the state of occurrence is responsible for leading 
the investigation, NTSB participation in foreign accident 
investigations enables safety deficiencies to be promptly 
addressed by the FAA, the manufacturer, or the operator as well 
as through NTSB safety recommendations, when necessary.
    Following last year's Lion Air crash, we immediately 
dispatched investigators to Indonesia to participate in the 
Indonesian Government's investigation. An NTSB investigator was 
stationed onboard one of the search vessels to help identify 
recovered aircraft components.
    Once the cockpit voice recorder was recovered in January, 
we recalled four investigators who were furloughed during the 
partial government shutdown. Their role was to assist with the 
recorder download and analysis.
    We responded immediately to the Ethiopian Airlines crash by 
sending a team of investigators to Ethiopia and once the 
recorders were sent to our aviation counterparts in France, the 
BEA, we dispatched investigators to France to assist with the 
recorder download and readout.
    Because the U.S. is the state of design and certification 
of the Boeing 737, we are also examining the U.S. design 
certification process as part of our participation in these 
foreign-led investigations. As always, if we uncover safety 
deficiencies, we are poised to quickly issue safety 
recommendations.
    Now here at home, the scheduled passenger airlines have 
displayed a remarkable safety record over the past decade but 
as we know too well at the NTSB, complacency is an unforgiving 
enemy.
    My written testimony outlines other areas of NTSB aviation-
related concerns which I've submitted for the record, and I'll 
be delighted to answer questions about those issues as well as 
the issue at hand.
    Thank you very much.
    [The prepared statement of Mr. Sumwalt follows:]

      Prepared Statement of Hon. Robert L. Sumwalt III, Chairman, 
                  National Transportation Safety Board
    Good afternoon, Chairman Cruz, Ranking Member Sinema, and the 
Members of the Subcommittee. Thank you for inviting the National 
Transportation Safety Board (NTSB) to testify before you today.
    The NTSB is an independent Federal agency charged by Congress with 
investigating every civil aviation accident in the United States and 
significant accidents in other modes of transportation--highway, rail, 
marine, and pipeline. We determine the probable cause of the accidents 
we investigate, and we issue safety recommendations aimed at preventing 
future accidents. In addition, we conduct special transportation safety 
studies and special investigations and coordinate the resources of the 
Federal Government and other organizations to assist victims and their 
family members who have been impacted by major transportation 
disasters.
    Our Office of Aviation Safety investigates all civil domestic air 
carrier, commuter, and air taxi accidents; general aviation accidents; 
and certain public-use aircraft accidents, amounting to approximately 
1,400 investigations annually. We also participate in the investigation 
of major airline accidents in foreign countries that involve U.S. 
carriers, US-manufactured or -designed equipment, or US-registered 
aircraft.
    This testimony will provide information regarding our role in 
international investigations and our current participation in both 
recent accidents involving Boeing 737 MAX 8 (MAX 8) aircraft in 
Indonesia and Ethiopia. I will also address the state of aviation 
safety from the NTSB's perspective based on our investigations, 
including a description of safety issues we have identified and 
recommendations we have made, as well as a description of the work we 
are doing with emerging transportation technologies in aviation.
Foreign Investigations of Boeing 737-MAX 8 Crashes
    The NTSB participates in the investigation of aviation accidents 
and serious incidents outside the United States in accordance with the 
Chicago Convention of the International Civil Aviation Organization 
(ICAO) and the Standards and Recommended Practices (SARPS) provided in 
Annex 13 to the Convention.\1\ If an accident or serious incident 
occurs in a foreign state involving a civil aircraft of U.S. Registry, 
a U.S. operator, or an aircraft of U.S. design or U.S. manufacture, 
where the foreign state is a signatory to the ICAO Convention, that 
state is responsible for the investigation and controls the release of 
all information regarding the investigation.
---------------------------------------------------------------------------
    \1\ ICAO is a UN specialized agency, which manages the 
administration and governance of the Convention on International Civil 
Aviation (Chicago Convention), (https://www.icao.int/about-icao/Pages/
default.aspx).
---------------------------------------------------------------------------
    In accordance with the ICAO Annex 13 SARPS, upon receipt of a 
formal notification of the accident or serious incident that may 
involve significant issues, the NTSB may designate a U.S. Accredited 
Representative and appoint advisors to carry out the obligations, 
receive the investigative information and updates in accordance with 
the Annex, provide consultation, and receive safety recommendations 
from the state of occurrence. The advisors may include NTSB 
investigators with subject matter expertise, as well as others from 
U.S. manufacturers, operators, and the Federal Aviation Administration 
(FAA).
    The key objectives of our participation in international aviation 
accident investigations are to:

   Identify safety deficiencies affecting U.S. aviation 
        interests;

   Capture safety lessons learned to prevent accidents in the 
        US; and

   Enable credible and comprehensive accident investigations 
        where U.S. interests are concerned.

    Given the international nature of air transportation and the 
leading role the United States plays in developing aviation 
technologies, our participation in foreign investigations is essential 
to enhancing aviation safety worldwide. In 2018, we appointed 
Accredited Representatives to 324 international investigations and 
traveled to support work on 17 of these investigations.\2\
---------------------------------------------------------------------------
    \2\ There were 202 accidents in 2018 where the NTSB appointed an 
Accredited Representative, 97 incidents, and 25 other safety-related 
occurrences. NTSB traveled in support of 8 of these accidents, 8 
incidents, and one safety-related occurrence.
---------------------------------------------------------------------------
    On October 29, 2018, a MAX 8, operated by Lion Air, crashed into 
the Java Sea shortly after takeoff from Soekamo-Hatta International 
Airport, in Jakarta, Indonesia. All 189 passengers and crew on board 
died. The National Transportation Safety Committee of Indonesia is 
leading the investigation and released a preliminary report on November 
27, 2018.\3\ On March 10, 2019, a MAX 8, operated by Ethiopian 
Airlines, crashed after takeoff from Addis Ababa Bole International 
Airport in Ethiopia. All 157 passengers and crew, including 8 American 
citizens, died. The investigation is being led by the Ethiopia Accident 
Investigation Bureau.
---------------------------------------------------------------------------
    \3\ National Transportation Safety Committee of Indonesia, 
Preliminary Report No. KNKT.18.10.35.04.
---------------------------------------------------------------------------
    Because the MAX 8 was designed and manufactured in the US, in 
accordance with ICAO Annex 13, the U.S. has a right to participate in 
both of these investigations. Accordingly, the NTSB appointed 
Accredited Representatives to assist both of the ongoing foreign 
investigations involving MAX 8 aircraft.
    Following last year's Lion Air crash, the NTSB immediately 
dispatched investigators to Indonesia to participate in the Indonesian 
government's investigation. During the search for the critical ``black 
boxes''--flight data recorder (FDR) and cockpit voice recorder (CVR)--
an NTSB investigator was stationed onboard one of the search vessels. 
Once the CVR was recovered on January 14, 2019, NTSB recalled four 
investigators from furlough due to the partial government shutdown to 
assist with proper transcription of that recorder's content.\4\
---------------------------------------------------------------------------
    \4\ Due to lapse of appropriations from December 22, 2018, through 
January 25, 2019, the NTSB furloughed all investigative staff. In 
accordance with provisions of the Anti-Deficiency Act (including 
sections 1341(a)(1)(B) and 1342 of Title 31, United States Code), 
allowable agency functions were limited to those where ``failure to 
perform those functions would result in an imminent threat to the 
safety of human life or the protection of property.'' Due to the 
potential safety issues associated with the Lion Air crash, the NTSB 
responded by recalling from furlough four investigative staff to 
participate in the CVR readout.
---------------------------------------------------------------------------
    In response to the Ethiopian Airlines crash, the NTSB also 
appointed an Accredited Representative, and dispatched him with a team 
of investigators to Ethiopia. Furthermore, we sent recorder, flight 
crew operations and human factors investigators to France once the 
recorders were sent to the Bureau d'Enquetes et d'Analyses pour la 
Securite de l'Aviation Civile (BEA) for download and readout.
    Also in accordance with ICAO Annex 13, technical advisors from the 
FAA, Boeing, and General Electric have accompanied NTSB investigators 
to the Lion Air and Ethiopian Air accident sites to provide their 
specialized technical knowledge regarding the aircraft and its systems.
    Although the NTSB is actively involved in these investigations, 
ICAO Annex 13 requires that, as the states of occurrence, Indonesia and 
Ethiopia are responsible for their respective investigations. As such, 
they control the release of all investigative information related to 
those accidents. Although the state of occurrence is responsible for 
leading the investigation, NTSB participation in foreign accident 
investigations enables safety deficiencies to be promptly addressed by 
the FAA, the manufacturer, or the operator, as well as through NTSB 
safety recommendations when necessary. As the state of design and 
certification of the aircraft involved in these accidents, we are 
examining the U.S. design certification process to ensure any 
deficiencies are captured and addressed, potentially up to and 
including NTSB safety recommendations.
Commercial Aviation Safety in the United States
    For the last decade, the U.S. aviation system has experienced a 
record level of safety, and an overall decline in the number of US-
registered civil aviation accidents.\5\ Aviation deaths in the United 
States decreased from 412 in 2016 to 350 in 2017. Nearly 94 percent of 
aviation fatalities (330 instances in 2017) occur in general aviation 
accidents, with the remainder primarily in Title 14 Code of Federal 
Regulations (CFR) Part 135 operations, which includes charters, air 
taxis, and air medical services flights. Until 2018, there had been no 
passenger fatalities as a result of accidents involving U.S. air 
carriers operating under the provisions of 14 CFR Part 121 since the 
crash of Colgan Air flight 3407 in 2009.\6\ Over the last several 
decades, significant advances in technology, important legislative and 
regulatory changes, and more comprehensive crew training have 
contributed to the current level of aviation safety. Following the 
Colgan Air crash, in 2010 Congress required FAA to make substantive 
regulatory changes addressing airline pilot fatigue, as well as airline 
pilot qualifications; FAA pilot records; airline flight crew and 
dispatcher training; FAA oversight and surveillance of air carriers; 
pilot mentoring, professional development and leadership; and flight 
crewmember pairing and crew resource management techniques.\7\ There 
are still provisions related to NTSB recommendations from our 
investigation of flight 3407 that have not been implemented, such as 
the creation of a pilot training records database. We continue to see 
accidents and incidents that remind us of the need to be ever-vigilant 
in improving safety.
---------------------------------------------------------------------------
    \5\ National Transportation Safety Board, 2017 preliminary aviation 
statistics. Accident data for calendar year 2018 are still being 
validated and have not yet been released.
    \6\ National Transportation Safety Board, Loss of Control on 
Approach, Colgan Air, Inc., Operating as Continental Connection Flight 
3407, Bombardier DHC 8 400, N200WQ, Rpt. No. AAR-10/01 (Washington, DC: 
NTSB, 2012). In 2013, there were two fatal accidents involving 
nonscheduled cargo flights operating under Part 121--National Air Cargo 
crash after takeoff at Bagram Air Base, Afghanistan, and United Parcel 
Service flight 1354 crash during approach in Birmingham, Alabama.
    \7\ The Airline Safety and Federal Aviation Administration 
Extension Act of 2010 (Pub. L. 111-216). Congressional Research 
Service, Federal Civil Aviation Programs: In Brief, R42781.
---------------------------------------------------------------------------
Most Wanted List--Improve the Safety of Part 135 Aircraft Flight 
        Operations
    On February 4, 2019, we announced our Most Wanted List of 
Transportation Safety Improvements for 2019-2020.\8\ This list 
identifies 10 focus areas for transportation safety improvements based 
on safety issues identified through our investigations. Many of the 
issues on the Most Wanted List address multimodal challenges for 
improving safety, including many that have been identified in some of 
our aviation accident investigations, such as alcohol and other drug 
impairment, distraction, occupant protection, fatigue, medical fitness, 
and safe shipment of hazardous materials. One issue area is specific to 
aviation: improving the safety of Part 135 aircraft flight operations.
---------------------------------------------------------------------------
    \8\ National Transportation Safety Board, 2019-2020 Most Wanted 
List.
---------------------------------------------------------------------------
    Regardless of the purpose of the flight or the type of aircraft, 
all passenger-carrying flights should be safe. However, currently, air 
medical service, air taxi, charter, and on-demand operators are not 
required to meet some of the same safety requirements as commercial 
airline operators. On March 12, 2019, the NTSB issued three new safety 
recommendations and reiterated six previous safety recommendations to 
the FAA as a result of the investigation of an accident that occurred 
on May 15, 2017, in Teterboro, New Jersey.\9\ In this accident, a 
Learjet 35A, operated by a Part 135 operator, departed controlled 
flight while on a circling approach to Teterboro Airport, and impacted 
a commercial building and parking lot. The pilot-in-command and the 
second-in-command died; there were no passengers on the aircraft and no 
one on the ground was injured. While the aircraft was operating as a 
Part 91 positioning flight at the time of the accident, the accident 
raised concerns about the safety of Part 135 operations and the need 
for effective flight data monitoring (FDM) programs, safety management 
systems (SMS), procedures to identify pilots who do not comply with 
standard operating procedures, programs to address pilots with 
performance deficiencies, and the need for enhanced guidance for crew 
resource management training and leadership training for upgrading 
captains.
---------------------------------------------------------------------------
    \9\ National Transportation Safety Board, Departure From Controlled 
Flight, Trans-Pacific Air Charter, LLC, Learjet 35A, N452DA, Teterboro, 
New Jersey (Abstract), Rpt. No. AAR-19/02 (Washington, D.C.: NTSB, 
2019)
---------------------------------------------------------------------------
    The safety issues identified in the Teterboro accident were not 
new; the NTSB previously identified these issues and made 
recommendations to address FDM equipment and programs and SMS as a 
result of the investigation of the November 10, 2015, crash of 
Execuflight flight 1526 in Akron, Ohio.\10\ The recommendations were 
reiterated following the October 26, 2016, crash of Ravn Connect flight 
3153 in Togiak, Alaska, and we have again reiterated these important 
recommendations.\11\ A list of the safety recommendations we have made 
regarding these operations is appended to this testimony. 
Implementation of these and other recommendations could prevent or 
mitigate many of the Part 135 crashes that the NTSB investigates, and 
that is why improving the safety of Part 135 aircraft operations is 
included on the Most Wanted List.
---------------------------------------------------------------------------
    \10\ National Transportation Safety Board, Crash During 
Nonprecision Instrument Approach to Landing, Execuflight Flight 1526, 
British Aerospace HS 125-700A, N237WR, Rpt. No. AAR 16/02 (Washington, 
D.C.: NTSB 2016).
    \11\ National Transportation Safety Board, Collision with Terrain, 
Hageland Aviation Services, Inc., dba Ravn Connect Flight 3153, Cessna 
208B, N208SD, Rpt. No. AAR 18/02 (Washington, D.C.: NTSB 2018).
---------------------------------------------------------------------------
Most Wanted List--Reduce Fatigue-Related Accidents
    Fatigue is a pervasive problem in transportation that degrades a 
person's ability to stay awake, alert, and attentive to the demands of 
safely controlling a vehicle, vessel, aircraft, or train. By including 
``Reduce Fatigue-Related Accidents'' on our Most Wanted List, we are 
calling for a comprehensive approach to combatting fatigue in 
transportation, focusing on research, education, and training; 
technology; sleep disorder treatment; hours-of-service regulations; and 
on-and off-duty scheduling policies and practices.
    Over the last 20 years, NTSB has investigated many air carrier 
accidents involving fatigued flight crews, including Colgan Air flight 
3407. As a result of that investigation, we recommended that the FAA 
require operators to address fatigue risks associated with 
commuting.\12\ The FAA's final rule for Fatigue Risk Management Plans 
for Part 121 Air Carriers did not address this recommendation. In 2006, 
we issued a safety recommendation to the FAA as a result of our 
investigation of the October 19, 2004 aviation crash in Kirksville, 
Missouri, to ``Modify and simplify the flight crew hours-of-service 
regulations to take into consideration factors such as length of duty 
day, starting time, workload and other factors shown by recent 
research, scientific evidence, and current industry experience to 
affect crew alertness.'' \13\ On January 4, 2012, the FAA published a 
final rule which prescribed new flight-and duty-time regulations for 
all flight crewmembers and certificate holders conducting passenger 
operations under Part 121, but excluded operators who conduct cargo 
operations.\14\ The NTSB disagrees with this exclusion, as many of the 
fatigue-related accidents that we have investigated over the years 
involved cargo operators. We also believe that, because of the time of 
day that cargo operations typically occur, such operations are in 
greater need of these requirements. The NTSB believes that the FAA 
should include all Part 121, including cargo operations, under these 
requirements.
---------------------------------------------------------------------------
    \12\ National Transportation Safety Board, Safety Recommendation A-
10-016.
    \13\ National Transportation Safety Board, Collision with Trees and 
Crash Short of the Runway, Corporate Airlines Flight 5966 BAE Systems 
BAE-J3201, N875JX Kirksville, Missouri, Rpt. No. AAR-06/01 (Washington, 
D.C.: NTSB, 2006. Safety Recommendation A-06-010.
    \14\ Federal Aviation Administration, Flightcrew Member Duty and 
Rest Requirements, 14 CFR Parts 117, 119, and 121.
---------------------------------------------------------------------------
Current Part 121 Investigations
    The NTSB is currently investigating two fatal accidents involving 
Part 121 operations.

    Southwest Flight 1380 Engine Failure--Philadelphia, Pennsylvania

    On April 17, 2018, Southwest Airlines flight 1380, a Boeing 737-
700, experienced a failure of the left engine after departing New 
York's LaGuardia Airport.\15\ A fan blade in the left engine failed, 
which resulted in the loss of the engine inlet and cowling. Fragments 
from the cowling and engine inlet struck the fuselage and a window, 
causing a rapid depressurization. The crew conducted an emergency 
descent and diverted to Philadelphia International Airport. There were 
144 passengers and five crewmembers onboard. One passenger was fatally 
injured and eight passengers had minor injuries.
---------------------------------------------------------------------------
    \15\ National Transportation Safety Board, Southwest Airlines 
Engine Accident.
---------------------------------------------------------------------------
    On November 14, 2018, the NTSB held an investigative hearing to 
obtain more information regarding the engine fan blade design and 
development history, engine fan blade inspection methods and 
procedures, and engine fan blade containment design and certification 
criteria.\16\ The investigation into this accident is ongoing.
---------------------------------------------------------------------------
    \16\ National Transportation Safety Board, Investigative Hearing: 
CFM International engine failure on Southwest Airlines flight 1380.
---------------------------------------------------------------------------

              Atlas Air Flight 3591 Crash--Baytown, Texas

    On February 23, 2019, Atlas Air flight 3591, a Boeing 767-375BCF, 
entered a rapid descent from 6,000 feet and crashed into Trinity Bay, 
about 40 miles southeast of its intended destination, George Bush 
Intercontinental Airport, in Houston, Texas.\17\ The two pilots and one 
nonrevenue jumpseat pilot were killed, and the airplane was highly 
fragmented after impact. The flight was being operated as a Part 121 
domestic cargo flight, which originated from Miami International 
Airport.
---------------------------------------------------------------------------
    \17\ National Transportation Safety Board, Atlas Air #3591 crashed 
into Trinity Bay.
---------------------------------------------------------------------------
    Based on data from the cockpit voice recorder, the flight data 
recorder, radar data, and other sources, the flight was normal from 
Miami to the Houston terminal area. As the flight approached Houston, 
the pilots were advised of an area of light to heavy precipitation 
along the flight route and that they could expect vectors around the 
weather. About one minute before the crash, data indicated some small 
vertical accelerations during descent. Shortly after, the engine thrust 
increased to maximum thrust, and the airplane pitched nose up. The 
airplane then pitched nose down over the next 18 seconds in response to 
nose-down elevator deflection. The stall warning (stick shaker) did not 
activate. Data indicated that the airplane entered a rapid descent, 
reaching an airspeed of about 430 knots. A security camera video 
captured the airplane in a steep, generally wings-level attitude until 
impact with the bay. The investigation into this accident is ongoing.
Emerging Transportation Technologies
    Advances in technology are transforming transportation and hold 
promise for improving transportation safety, but they also pose new 
challenges. Among those advancing technologies are commercial space 
transportation and unmanned aircraft systems (UASs).
Commercial Space
    We have been involved in commercial space accident investigations 
for over 25 years, since leading the investigation of a procedural 
anomaly associated with the launch of an Orbital Sciences Corporation 
Pegasus expendable launch vehicle in 1993.\18\ Most recently, we led 
the investigation of the fatal in-flight breakup of SpaceShipTwo in 
October 2014.\19\ Foremost among the safety issues identified in the 
2014 accident was the need to consider and protect against human error 
for safe manned spaceflight, which is the responsibility of designers, 
operators, and regulators. We made recommendations to the FAA and the 
commercial spaceflight industry to establish human factors guidance for 
commercial space operators and to strengthen the FAA's evaluation 
process for experimental permit applications by promoting stronger 
collaboration between FAA technical staff and commercial space vehicle 
operators.
---------------------------------------------------------------------------
    \18\ National Transportation Safety Board, Commercial Space Launch 
Incident, Launch Procedure Anomaly, Orbital Sciences Corporation, 
Pegaus/SCD-1, Rpt. No. SIR 93/02 (Washington, D.C.: NTSB 1993).
    \19\ National Transportation Safety Board. In-Flight Breakup During 
Test Flight, Scaled Composites SpaceShipTwo, N339SS, Near Koehn Dry 
Lake, California, October 31, 2014, Rpt. No. AAR 15/02 (Washington, 
D.C.: NTSB 2015).
---------------------------------------------------------------------------
    Our work in commercial space transportation supports our broader 
mission of improving transportation safety through investigating 
accidents and serious incidents, collaborating with others to conduct 
outreach and education related to commercial space vehicles, and 
developing and disseminating accident investigation techniques in 
commercial space within the international community. To develop and 
maintain the necessary investigative expertise and tools in this 
emerging segment of transportation, we are focused on training for NTSB 
staff and continuing outreach with commercial space stakeholders.
Unmanned Aircraft Systems
    The growing number of UASs and reports of near-collisions with 
manned aircraft have raised safety concerns regarding UAS integration 
into the national airspace system. In August 2010, we revised our 14 
CFR Part 830 regulations to indicate that accident and incident 
notification requirements also apply to unmanned aircraft.\20\ An 
advisory to operators was released in July 2016 clarifying the 
reporting requirements (i.e., if there is death or serious injury, the 
aircraft weighs more than 300 pounds and sustains substantial damage, 
or other specific serious incidents occur).\21\
---------------------------------------------------------------------------
    \20\ 49 CFR Sec. 830.2 (2010).
    \21\ National Transportation Safety Board, Advisory to Operators of 
Civil Unmanned Aircraft Systems in the United States, July 29, 2016.
---------------------------------------------------------------------------
    On September 21, 2017, the pilot of a U.S. Army UH-60 helicopter 
reported an in-flight collision with a small UAS just east of Midland 
Beach, Staten Island, New York. The helicopter sustained damage to its 
main rotor blade, window frame, and transmission deck. We determined 
that the probable cause of the incident was the failure of the UAS 
pilot to see and avoid the helicopter due to his intentional flight 
beyond visual line of sight. Contributing to the incident was the UAS 
pilot's incomplete knowledge of regulations and safe operating 
practices.\22\ As the number and complexity of UAS operations continues 
to grow, it is inevitable that the number of NTSB UAS investigations 
will also increase.
---------------------------------------------------------------------------
    \22\ National Transportation Safety Board, Inflight collision of 
UAS and helicopter, Staten Island, NY.
---------------------------------------------------------------------------
    We are also using UASs as an accident investigation tool in all 
modes. The NTSB appreciates this Committee's and Congress' support of a 
provision in our 2018 reauthorization that authorized the agency to 
acquire small UASs for investigative purposes.\23\ UASs are rapidly 
becoming a standard tool in the domestic and international accident 
investigation community. Small UASs can be very rapidly deployed, which 
allows wreckage fields to be documented quickly and thoroughly when the 
accident area must be cleared expeditiously for safety or operational 
purposes. In addition, small UASs can access unique points of view 
useful to the investigator as well as areas otherwise inaccessible. 
Data collected is shared immediately, allowing investigators, managers, 
and support staff in distant locations instant access to accident site 
information in order to help focus the investigation on critical 
aspects of the accident.
---------------------------------------------------------------------------
    \23\ 49 USC Sec. 1113(b)(1)(J) (2018).
---------------------------------------------------------------------------
Conclusion
    Thank you again for the opportunity to be here today to discuss the 
work that the NTSB is doing to make transportation safer. I will be 
happy to answer any questions.
                                 ______
                                 
  Appendix to NTSB Chairman Sumwalt's Testimony Concerning Commercial 
  Aviation Safety--Recommendations to Improve the Safety of Part 135 
                       Aircraft Flight Operations
A-10-029 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require Title 14 Code of Federal Regulations Part 121, 
135, and 91K operators to (1) routinely download and analyze all 
available sources of safety information, as part of their flight 
operational quality assurance program, to identify deviations from 
established norms and procedures; (2) provide appropriate protections 
to ensure the confidentiality of the deidentified aggregate data; and 
(3) ensure that this information is used for safety-related and not 
punitive purposes.

A-13-012 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require the installation of a crash-resistant flight 
recorder system on all newly manufactured turbine-powered, 
nonexperimental, nonrestricted-category aircraft that are not equipped 
with a flight data recorder and a cockpit voice recorder and are 
operating under Title 14 Code of Federal Regulations Parts 91, 121, or 
135. The crash-resistant flight recorder system should record cockpit 
audio and images with a view of the cockpit environment to include as 
much of the outside view as possible, and parametric data per aircraft 
and system installation, all as specified in Technical Standard Order 
C197, ``Information Collection and Monitoring Systems.''

A-13-013 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require all existing turbine-powered, nonexperimental, 
nonrestricted-category aircraft that are not equipped with a flight 
data recorder or cockpit voice recorder and are operating under Title 
14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted 
with a crash-resistant flight recorder system. The crash-resistant 
flight recorder system should record cockpit audio and images with a 
view of the cockpit environment to include as much of the outside view 
as possible, and parametric data per aircraft and system installation, 
all as specified in Technical Standard Order C197, ``Information 
Collection and Monitoring Systems.''

A-15-007 Open--Unacceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require that all existing aircraft operated under Title 
14 Code of Federal Regulations (CFR) Part 121 or 135 and currently 
required to have a cockpit voice recorder and a flight data recorder be 
retrofitted with a crash-protected cockpit image recording system 
compliant with Technical Standard Order TSOC176a, ``Cockpit Image 
Recorder Equipment,'' TSO-C176a or equivalent. The cockpit image 
recorder should be equipped with an independent power source consistent 
with that required for cockpit voice recorders in 14 CFR 25.1457.

A-15-008 Open--Unacceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require that all newly manufactured aircraft operated 
under Title 14 Code of Federal Regulations (CFR) Part 121 or 135 and 
required to have a cockpit voice recorder and a flight data recorder 
also be equipped with a crash-protected cockpit image recording system 
compliant with Technical Standard Order TSO-C176a, ``Cockpit Image 
Recorder Equipment,'' or equivalent. The cockpit image recorder should 
be equipped with an independent power source consistent with that 
required for cockpit voice recorders in 14 CFR 25.1457.

A-16-034 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part 
135 operators to install flight data recording devices capable of 
supporting a flight data monitoring program.

A-16-035 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION 
ADMINISTRATION: After the action in Safety Recommendation A-16-34 is 
completed, require all Title 14 Code of Federal Regulations Part 135 
operators to establish a structured flight data monitoring program that 
reviews all available data sources to identify deviations from 
established norms and procedures and other potential safety issues.

A-16-036 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part 
135 operators to establish safety management system programs.

A-17-035 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Implement ways to provide effective terrain awareness 
and warning system (TAWS) protections while mitigating nuisance alerts 
for single-engine airplanes operated under Title 14 Code of Federal 
Regulations Part 135 that frequently operate at altitudes below their 
respective TAWS class design alerting threshold.

A-17-038 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Expand the application of Federal Aviation 
Administration Order 8900.1, volume 3, chapter 19, section 6, ``Safety 
Assurance System: Flight Training Curriculum Segments,'' paragraphs 3-
1251(B) and 3-1252, which address controlled flight into terrain-
avoidance training programs for Title 14 Code of Federal Regulations 
(CFR) Part 135 helicopter operations, to all 14 CFR Part 135 
operations.

A-18-013 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Although controlled flight into terrain (CFIT)-
avoidance training programs are not required by Federal regulation for 
Title 14 Code of Federal Regulations Part 135 fixed-wing operations, 
work with Part 135 operators in Alaska to improve any voluntarily 
implemented training programs aimed at reducing the risk of CFIT 
accidents involving continuation of flight under visual flight rules 
(VFR) into instrument meteorological conditions, with special attention 
paid to the human factors issues identified in recent Alaska accident 
investigations, including, but not limited to, (1) the challenges of 
flying in mountainous terrain in Alaska and low-altitude VFR flight in 
an area subject to rapid changes in weather; and (2) limitations of the 
Alaska infrastructure, particularly weather observations, 
communications, and navigation aids.

A-18-014 Open--Acceptable Response TO THE FEDERAL AVIATION 
ADMINISTRATION: Work with Title 14 Code of Federal Regulations Part 135 
certificate holders that operate under visual flight rules in the 
aircraft's required terrain awareness and warning system (TAWS) class 
to (1) ensure that management and pilots are aware of the risks 
associated with distraction (from continuous nuisance alerts) and 
complacency (brought about by routine use of the terrain inhibit 
feature); (2) develop plans for mitigating those risks and minimizing 
nuisance alerts; and (3) develop procedures that specifically address 
when pilots should test, inhibit, and uninhibit the TAWS alerts, 
considering the operator's typical operations and the TAWS 
manufacturer's guidance.

A-18-017 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION: 
Ensure that Alaska airports that are served by Title 14 Code of Federal 
Regulations (CFR) Part 135 operators and have instrument approaches are 
equipped with weather-reporting capabilities to enable instrument 
flight rules operations in accordance with 14 CFR 135.225(a).

A-19-007 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION: 
Require all Title 14 Code of Federal Regulations Part 135 operators to 
establish programs for flight crewmembers who have demonstrated 
performance deficiencies or experienced failures during training and 
administer additional oversight and training to address and correct 
performance deficiencies.

A-19-008 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION: 
Develop guidance for Title 14 Code of Federal Regulations Part 135 
operators to help them create and implement effective crew resource 
management training programs.

    Senator Cruz. Thank you.
    Mr. Scovel.

STATEMENT OF HON. CALVIN L. SCOVEL III, INSPECTOR GENERAL, U.S. 
                  DEPARTMENT OF TRANSPORTATION

    Mr. Scovel. Chairman Wicker, Ranking Member Cantwell, 
Chairman Cruz, Ranking Member Sinema, Members of the 
Subcommittee, thank you for inviting me to testify on the 
Federal Aviation Administration's Oversight of Commercial 
Aviation.
    As you know, FAA is charged with safely overseeing the 
busiest and most complex aviation system in the world. Yet 
recent accidents highlight important concerns about FAA's 
safety oversight. Most notable are the two devastating crashes 
of Boeing 737 Max 8 aircraft in Indonesia and Ethiopia.
    In addition, last April, a Southwest Airlines engine 
failure resulted in the first passenger fatality at a U.S. air 
carrier in over 9 years.
    On behalf of the Office of Inspector General, we grieve the 
victims of these accidents and express our deep condolences to 
their families.
    Secretary Elaine L. Chao, along with several Members of 
Congress, including Senator Blumenthal, recently requested that 
my office audit FAA's certification process for the Max 8 
aircraft. We appreciate the Secretary's and your continued 
confidence in our independence and objectivity. We have already 
begun this work and will keep you informed on our results.
    Today, my statement will focus on our recent and ongoing 
work related to a number of important aviation safety 
challenges.
    First, FAA must take steps to reduce hazards associated 
with flight deck automation. Pilots now rely on automated 
flight systems as much as 90 percent of the time. While 
airlines have long used automation safely, FAA is responsible 
for ensuring air carriers meet requirements for these systems. 
This includes ensuring pilots are trained, tested, and 
proficient in the use of automation.
    Notably, FAA now requires U.S. commercial pilots to be 
trained in how to respond to abnormal flight conditions, such 
as recovering from a stall or other unexpected event. Air 
carriers should have implemented these requirements earlier 
this month. Providing effective oversight of this training will 
be vital to maintain the margin of safety.
    Second, FAA must remain vigilant as its systems and 
strategies for safety oversight evolve. Over the years, FAA has 
increasingly shifted toward working with industry to meet 
shared safety goals.
    For example, FAA now delegates more of its aircraft 
certification to approved manufacturers through its 
congressionally authorized Organization Designation 
Authorization Program or ODA.
    However, my office has identified weaknesses with FAA's 
oversight of ODA. For example, in 2015, we reported that its 
oversight was not based on risk. In response to our 
recommendations, FAA plans to revamp its ODA oversight process 
by the end of July 2019. Sustained management attention will 
remain essential to ensure that ODA companies comply with 
safety regulations.
    In addition, FAA now requires air carriers to play a larger 
role in identifying and mitigating safety risks. For example, 
in 2015, FAA required U.S. commercial carriers to establish 
safety management systems to proactively manage risks.
    However, recent events, including last year's Southwest 
engine failure, have raised concerns that FAA's oversight may 
not ensure that carriers meet their responsibilities under 
these systems.
    FAA also introduced its new Compliance Program in 2015. The 
program calls for FAA to work with air carriers to address the 
root causes of safety violations rather than imposing 
enforcement actions. This is a significant change in the way 
FAA and the carriers conduct business.
    As it works to leverage both collaboration and enforcement, 
FAA must be able to accurately assess whether an air carrier is 
willing and able to take timely corrective actions.
    Finally, I want to note other critical safety areas that 
require FAA's attention. For example, FAA must continue its 
work to reduce safety risks in the air and on the ground at 
airports, including preventing near-misses on the runway.
    In addition, FAA faces challenges in safely integrating 
unmanned aircraft systems in the same airspace as manned 
aircraft. Furthermore, FAA must protect its flight-critical and 
safety-critical IT systems from a growing number of cyber 
threats, and, last, FAA can do more to ensure essential 
aircraft parts, such as landing gear, meet safety standards by 
carefully implementing the Suspected Unapproved Parts program.
    As always, my office remains committed to supporting FAA 
and the Secretary as they work to maintain aviation safety and 
protect the traveling public.
    This concludes my prepared statement. I'd be happy to 
answer any questions you or members of the Subcommittee may 
have.
    [The prepared statement of Mr. Scovel follows:]

  Prepared Statement of Hon. Calvin L. Scovel III, Inspector General, 
                   U.S. Department of Transportation

                 Perspectives on Overseeing the Safety 
                 of the U.S. Air Transportation System

    Chairman Cruz, Ranking Member Sinema, and Members of the 
Subcommittee:

    Thank you for inviting me to testify on the state of aviation 
safety and the Federal Aviation Administration's (FAA) oversight of 
commercial aviation. FAA is charged with safely overseeing the busiest 
and most complex air transportation system in the world, which carries 
over 2.5 million people on approximately 45,000 flights every day. 
However, recent events have brought new attention to FAA's safety 
oversight and its regulatory role. Most notable are the two fatal 
accidents involving Boeing 737 MAX 8 aircraft that occurred in October 
2018 and earlier this month. The Office of Inspector General expresses 
our deepest condolences to the families of the victims of these 
accidents. A number of other incidents have also raised safety 
concerns. These include the April 2018 Southwest Airlines engine 
failure--which resulted in the first fatality at a U.S. commercial 
passenger air carrier \1\ in over 9 years--and several safety incidents 
at airports, such as the near miss of an Air Canada Flight in San 
Francisco in July 2017.
---------------------------------------------------------------------------
    \1\ This was the first passenger fatality at a part 121 air carrier 
since February 12, 2009 (14 CFR Part 121, Operating Requirements: 
Domestic, Flag, and Supplemental Operations).
---------------------------------------------------------------------------
    As Secretary of Transportation Elaine L. Chao has stated, safety is 
and must remain the Department's top priority. Last week, Secretary 
Chao requested that our office audit the activities that resulted in 
the certification of the Boeing 737 MAX 8 aircraft. In addition, we 
have received requests from Congress to examine other related issues, 
including FAA's decision-making process that led to grounding the MAX 8 
aircraft in the United States. My office has already begun this work 
and will keep you apprised of our results.
    As the Nation's regulator of aviation safety, FAA is responsible 
for effectively overseeing a vast range of safety-critical areas. To 
its credit, FAA has taken steps in recent years to help its safety 
efforts keep pace with a rapidly evolving and diverse aviation 
industry. Yet, as my office's work has shown, both new and longstanding 
safety issues present significant challenges to FAA's oversight of the 
National Airspace System (NAS).
    My testimony today will focus on FAA's efforts related to (1) 
reducing hazards associated with flight deck automation, (2) 
implementing FAA and industry's evolving safety oversight systems, and 
(3) addressing other safety-critical watch items.
Summary
    Notwithstanding the Nation's safety record, important safety 
issues--both new and longstanding--need FAA's attention. First, with 
pilots relying on automated flight systems as much as 90 percent of the 
time, it is critical that FAA ensure that air carriers meet its 
requirements for these systems, including training pilots on how to 
respond to abnormal flight conditions when automation or other systems 
fail. Second, FAA faces new challenges as its systems and strategies 
for safety oversight evolve and air carriers take on a larger role in 
identifying and mitigating safety risks. To maintain the highest level 
of safety, FAA must implement effective risk-based oversight of 
organizations that perform certification work on the Agency's behalf, 
effectively leverage collaboration and enforcement, and maintain a 
strong safety culture. At the same time, our recent and ongoing work 
has also identified other watch areas that are essential to enhancing 
oversight of the NAS. These include reducing safety risks on the ground 
and in the air at airports, integrating Unmanned Aircraft Systems (UAS) 
in the same airspace as manned aircraft, protecting safety-critical 
information technology systems, and eliminating suspected unapproved 
parts from the aviation supply chain.
Strengthening FAA Oversight To Reduce Hazards Associated With Flight 
        Deck Automation
    Advances in aircraft automation have significantly contributed to 
safety and changed the way airline pilots perform their duties. Rather 
than manually flying an aircraft, pilots now monitor flight deck 
systems. Generally, new automation technologies are added to gain 
operational or efficiency advantages, such as reducing pilot workload, 
adding more capability, increasing fuel economy, and allowing access to 
airports surrounded by challenging terrain. FAA has estimated that 
automation is used 90 percent of the time in flight.\2\ Figure 1 below 
shows the advances in flight deck technology between the Boeing 737-200 
(pictured left) and 737 MAX 8 aircraft (pictured right).
---------------------------------------------------------------------------
    \2\ Estimates according to FAA senior officials, as noted in our 
2016 report (see footnote 2).


[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

---------------------------------------------------------------------------
    Source: Copyright  Boeing

    While airlines have long used automation safely, our 2016 report 
\3\ noted accidents in which pilots who typically fly with automation 
made errors when confronted with an unexpected event or transitioning 
to manual flying.\4\ As a result, reliance on automation is a growing 
concern among industry experts, who have questioned whether pilots 
receive enough training and experience to maintain manual flying 
proficiency. In addition, preliminary reports on the recent Boeing 737 
MAX 8 accidents have suggested a possible link to one of the aircraft's 
automation systems, raising concerns about pilots' abilities to 
recognize and react to unexpected events.
---------------------------------------------------------------------------
    \3\ Enhanced FAA Oversight Could Reduce Hazards Associated With 
Increased Use of Flight Deck Automation (OIG Report No. AV2016013), 
January 7, 2016. Requested by the Ranking Members of the House 
Committee on Transportation and Infrastructure and its Subcommittee on 
Aviation. OIG reports as well as the current status of our 
recommendations are available at http://www.oig.dot.gov/.
    \4\ For example, in July 2013, Asiana Airlines Flight 214 crashed 
short of a runway at San Francisco International Airport. The National 
Transportation Safety Board determined that the crew did not 
appropriately understand the aircraft's automation systems, allowed 
airspeed to decay due to improper monitoring, and failed to perform a 
proper go-around response.
---------------------------------------------------------------------------
    As shown in table 1, pilots' use of automation may range from none 
to high. While no single level of automation is appropriate for all 
flight environments, pilots must understand automated systems and make 
appropriate decisions when encountering unusual situations, such as 
when automation fails or an emergency arises.

                                    Table 1. Levels of Flight Deck Automation
----------------------------------------------------------------------------------------------------------------
                                  Auto-pilot a
            Level                   Engaged       Auto-throttle b Engaged                 Overview
----------------------------------------------------------------------------------------------------------------
Full Auto-flight                               X                        X  The aircraft's control is fully
                                                                            automated based on information
                                                                            preprogrammed by the pilots.
----------------------------------------------------------------------------------------------------------------
Tactical Auto-flight                           X                        X  The aircraft's autopilot is engaged,
                                                                            but pilots can direct changes to
                                                                            heading, speed, and altitude using a
                                                                            control panel.
----------------------------------------------------------------------------------------------------------------
Manual                                                                  X  The pilot is manually controlling the
                                                                            aircraft based on guidance
                                                                            assistance from the preprogrammed
                                                                            flight directors. This is primarily
                                                                            used for takeoff, initial departure,
                                                                            and landings.
----------------------------------------------------------------------------------------------------------------
All Automation Off/Full                                                    The pilot is manually controlling the
 Manual                                                                     aircraft without the assistance of
                                                                            flight directors. This would be used
                                                                            to avoid collisions with other
                                                                            aircraft or to recover from an
                                                                            undesired aircraft state such as a
                                                                            stall.
----------------------------------------------------------------------------------------------------------------
a Auto-pilot helps automate the process of guiding and controlling an aircraft.
b Modern auto-throttles can control power from takeoff to touchdown. Source: OIG analysis of air carrier and
  manufacturer data.

    To promote safety and provide a basis for oversight while 
maintaining flexibility for different aircraft and systems, FAA has 
established certain requirements governing the use of flight deck 
automation during commercial operations. In particular, FAA developed 
limitations regarding minimum altitudes at which autopilot can be 
engaged and how automated systems within the cockpit are configured. 
For example, during takeoff and climb below 500 feet, FAA restricts the 
use of autopilot unless the carrier is granted explicit FAA 
authorization to use it sooner. Further, air carriers must obtain FAA 
authorization in order to use certain advanced flight procedures \5\ 
that rely on automation.
---------------------------------------------------------------------------
    \5\ These include Area Navigation (known as RNAV), a method of 
flying in which aircraft use satellite signals to fly any desired 
flight path, as well as Required Navigation Performance (RNP) 
procedures, which add monitoring and alerting capabilities for pilots 
that allow aircraft to fly more precise flight paths.
---------------------------------------------------------------------------
    In addition, FAA requires that pilots be trained, tested, and 
proficient in all aircraft they operate, including any onboard 
automated flight deck systems. The Agency also now requires all part 
121 \6\ pilots to be trained in specific abnormal flight conditions, 
which include stall and upset recovery and loss of reliable airspeed 
(see table 2 for an overview of FAA's new requirements). These FAA 
requirements were based on accident investigations and National 
Transportation Safety Board (NTSB) recommendations. Air carriers had to 
comply with this rule by March 12, 2019.
---------------------------------------------------------------------------
    \6\ 14 CFR Part 121, Operating Requirements: Domestic, Flag, and 
Supplemental Operations.

        Table 2. New Manual Flying Training Requirements for 2019
------------------------------------------------------------------------
     Training Maneuvers                        Overview
------------------------------------------------------------------------
Upset Prevention and         Aircraft upset is an unsafe condition that
 Recovery                     may result in loss of control (LOC).
                              Training focuses on the pilot's manual
                              handling skills to prevent upset, as well
                              as training to recover from this
                              condition.
------------------------------------------------------------------------
Manually Controlled Arrival  Pilots will be both trained and evaluated
 and Departure                on their ability to manually fly a
                              departure sequence and arrival into an
                              airport.
------------------------------------------------------------------------
Slow Flight                  Pilots will be trained to understand the
                              performance of the aircraft and the way it
                              handles at airspeeds just above the stall
                              warning.
------------------------------------------------------------------------
Loss of Reliable Airspeed    Training will focus on the recognition and
                              appropriate response to an automation
                              system malfunction that results in a loss
                              of reliable airspeed, which increases risk
                              of aircraft stall and/or upset.
------------------------------------------------------------------------
Recovery From Stall/         Training will provide pilots the knowledge
 Stickpusher Activation       and skills to avoid undesired aircraft
                              conditions that increase the risk of
                              encountering a stall or, if not avoided,
                              to respond correctly and promptly.
------------------------------------------------------------------------
Recovery From Bounced        A poorly executed approach and touchdown
 Landing                      can generate a shallow bounce (skip) or a
                              high, hard bounce that can quickly develop
                              into a hard landing accident.
------------------------------------------------------------------------
Source: OIG analysis of FAA requirements

    FAA requires these training maneuvers to be performed in flight 
simulators. However, the recent Boeing 737 MAX 8 accidents have raised 
questions about the availability and capabilities of these training 
simulators. For example, FAA determined training for the new Boeing MAX 
series could be completed in existing simulators. However, according to 
FAA, existing simulators do not fully replicate the 737 MAX aircraft, 
and no U.S. airline currently has a MAX simulator.
    Overall, FAA has taken steps to emphasize the importance of pilots' 
manual flying and monitoring skills, as we recommended in 2016. 
Continued vigilance in these areas can help ensure that air carriers 
create and maintain a culture that emphasizes pilots' authority and 
manual flying skills.
Remaining Vigilant as FAA and Industry Safety Oversight Systems Evolve
    In recent years, FAA has worked to revamp its strategy for 
overseeing the safety of the aviation industry. In particular, FAA has 
increasingly shifted to working with industry to meet shared safety 
goals, including delegating responsibilities for aircraft certification 
and requiring air carriers to proactively identify and mitigate their 
safety risks. Enhancing risk-based oversight, effectively leveraging 
industry collaboration and enforcement, and fostering a strong safety 
culture will remain key challenges for FAA as it works to implement its 
new oversight strategies and ensure the safety of the traveling public.
Enhancing FAA's Oversight of the Aircraft Certification Process
    The U.S. civil aviation industry is vital to the Nation's economy 
and encompasses more than 230,000 aircraft, 1,600 approved 
manufacturers, and 5,200 aircraft operators, among others. Recognizing 
that it is not possible for FAA employees to oversee every facet of 
such a large industry, public law \7\ allows the Agency to delegate 
certain functions, such as approving new aircraft designs and 
certifying aircraft components, to private individuals or 
organizations. In 2009, FAA fully implemented the Organization 
Designation Authorization (ODA) program to standardize its oversight of 
organizations (e.g., manufacturers) that are approved to perform 
certain functions on its behalf.
---------------------------------------------------------------------------
    \7\ 49 U.S.C. Sec. 44702(d).
---------------------------------------------------------------------------
    While delegation is an essential part of meeting FAA's 
certification goals, robust oversight is essential to ensure that ODA 
companies maintain high standards and comply with FAA safety 
regulations. However, our work over the years on the ODA program has 
identified management weaknesses with a number of FAA's oversight 
processes. To its credit, the Agency has taken action to improve its 
oversight in response to our recommendations. For example, our 2011 
report \8\ identified inconsistencies in how FAA aircraft certification 
offices interpreted FAA's role and tracked ODA personnel. In 
particular, not all FAA offices consulted FAA's database to pre-screen 
performance histories of prospective ODA personnel. In addition, under 
ODA, FAA engineers have expanded enforcement responsibilities, but the 
Agency had not ensured that they were adequately trained to perform 
these duties. In response to our findings, FAA clarified guidance on 
tracking ODA employee performance history and improved its training and 
guidance for enforcement. As a result, FAA engineers responsible for 
overseeing ODA employees were better positioned to detect instances of 
regulatory noncompliance and take enforcement actions.
---------------------------------------------------------------------------
    \8\ FAA Needs To Strengthen Its Risk Assessment and Oversight 
Approach for Organization Designation Authorization and Risk-Based 
Resource Targeting Programs (OIG Report No. AV2011136), June 29, 2011. 
Requested by Representative Daniel Lipinski.
---------------------------------------------------------------------------
    In 2015,\9\ we reported that FAA's oversight of ODA program 
controls was not systems- and risk-based,\10\ as recommended by an 
aviation rulemaking committee.\11\ For example, FAA had not provided 
oversight teams with tools or guidance on data they should use to 
identify the highest-risk areas. Another gap in FAA's oversight 
pertained to companies that produce and supply components to other 
manufacturers. FAA performed oversight of only 4 percent of personnel 
conducting certification work on the Agency's behalf at suppliers in 
the period we reviewed.
---------------------------------------------------------------------------
    \9\ FAA Lacks an Effective Staffing Model and Risk-Based Oversight 
Process for Organization Designation Authorization (OIG Report No. 
AV2016001), October 15, 2015. Requested by Representative Peter 
DeFazio.
    \10\ Systems-based oversight shifts from focusing on individual 
project engineering work to holistically assessing whether ODA 
companies have the people, processes, procedures, and facilities in 
place to produce safe products. This allows FAA to focus its oversight 
on the highest-risk areas, such as new, innovative aircraft designs.
    \11\ The Aircraft Certification Process Review and Reform (ACPRR) 
Aviation Rulemaking Committee, a joint FAA and industry group, was 
formed in response to a congressional mandate to study the aircraft 
certification process.
---------------------------------------------------------------------------
    In responding to our 2015 report, FAA recognized the need to 
improve its oversight of organizations performing certifications or 
other functions on its behalf. By July 2019, FAA plans to introduce a 
new process that represents a significant change in its oversight 
approach. For example, FAA's new process will include identifying 
system elements (such as training and company self-audit processes) and 
developing new evaluation criteria. While revamping FAA's oversight 
process will be an important step, continued management attention will 
be key to ensure the Agency identifies and monitors the highest-risk 
areas of aircraft certification.
Overseeing Air Carriers' New Systems for Managing Safety Risks
    FAA's safety oversight strategy depends, in part, on air carriers' 
ability to identify hazards and implement corrective actions that 
mitigate risk. For example, in 2015, FAA established requirements \12\ 
for U.S. part 121 air carriers to implement a formal, top-down approach 
to managing safety risks, known as a safety management system (SMS). 
Specifically, under SMS, air carriers must identify root causes for 
hazards and proactively manage risk to prevent accidents.
---------------------------------------------------------------------------
    \12\ 14 CFR Part 5, Safety Management Systems. This requires part 
121 carriers to implement SMS.
---------------------------------------------------------------------------
    While air carriers were required to implement SMS by March 2018, 
recent events--including the April 2018 Southwest Airlines fatal engine 
failure--have raised concerns that FAA's oversight may not ensure air 
carriers sufficiently meet their risk-mitigation responsibilities. NTSB 
is currently investigating the accident, but its preliminary reports 
indicate similarities with a 2016 engine incident on a Southwest 
Airlines aircraft. We are currently assessing \13\ FAA's oversight of 
Southwest Airlines' systems for managing risk, including a focus on 
aircraft weight and balance issues that can affect critical phases of 
flight, as well as other matters. We expect to report on our findings 
later this year. Ultimately, while air carriers' SMS are an important 
part of maintaining the safety of the NAS, FAA must exercise 
appropriate regulatory oversight and intervene in a timely manner to 
ensure air carriers take sufficient actions to identify and reduce 
safety risks.
---------------------------------------------------------------------------
    \13\ Audit Initiated of FAA's Safety Oversight of Southwest 
Airlines, June 20, 2018. Self-initiated.
---------------------------------------------------------------------------
Effectively Leveraging Collaboration and Enforcement in FAA's New Air 
        Carrier Safety Oversight Program
    As FAA continues to move towards allowing air carriers to play a 
more collaborative role in safety oversight, strong management 
attention is critical to ensure the Agency's evolving strategy advances 
its safety goals. In particular, in 2015, FAA implemented a new 
``Compliance Philosophy'' as part of its safety oversight strategy. The 
Compliance Program, as it is now known, is based on the premise that 
the greatest safety risk in the industry does not arise from a specific 
event or its outcome, but rather from an operator who is unwilling or 
unable to comply with rules and best practices for safety. The 
overarching goals of the new program are to achieve rapid compliance, 
eliminate a safety risk or deviation, and ensure positive and permanent 
changes.
    FAA's Compliance Program emphasizes the Agency's preference for 
collaborating with air carriers through education and training instead 
of penalizing carriers as a means to address discrepancies. This 
program calls for FAA to work with air carriers to address the root 
causes of violations of safety regulations rather than to impose 
enforcement actions--a significant change in the way FAA and the 
airlines previously addressed compliance and safety issues. A key issue 
we will assess in upcoming audits is whether the Compliance Program is 
suitable for all air carriers, regardless of current working 
relationships or unique business models and operating environments.
    An important component of the Compliance Program is working with 
carriers to identify the root cause of a violation. However, our 
ongoing audit \14\ related to Allegiant Airlines has highlighted the 
complex challenges FAA faces in implementing its new oversight approach 
and addressing the root cause of the air carrier's maintenance 
violations. Specifically, a longstanding maintenance issue at Allegiant 
Airlines resulted in a series of mid-air engine shutdowns, aborted 
takeoffs, and unscheduled landings. Our ongoing work focuses on the 
degree to which FAA's inspectors documented adjustments to their 
surveillance, effectively examined the root cause, or convinced the 
airline through collaboration to perform additional tests to operate at 
a higher level of safety. Overall, while FAA's Compliance Program 
offers a new strategy for addressing risk, such as potentially 
insufficient maintenance, the Agency's oversight must remain robust to 
ensure airlines implement effective corrective actions. A key challenge 
FAA faces moving forward is effectively leveraging both collaboration 
and enforcement and accurately assessing whether an air carrier is 
willing and able to correct its deficiencies.
---------------------------------------------------------------------------
    \14\ Revised Notification--Review of FAA's Oversight of Air Carrier 
Maintenance Programs, May 9, 2018. Requested by Representatives Peter 
DeFazio, Rick Larsen, Nita Lowey, David Price, Mike Quigley, Katherine 
Clark, Pete Aguilar, Jacky Rosen, and Cheri Bustos and Senator Bill 
Nelson.
---------------------------------------------------------------------------
Maintaining a Strong Safety Culture To Adequately Support FAA's 
        Changing Oversight Methods
    The success of FAA's evolving oversight methods depends on a strong 
safety culture within both the Agency and industry. According to FAA, a 
positive safety culture is one that is actively promoted by all levels 
of management and demonstrates a commitment to safety over competing 
goals and demands. Within such a culture, people acknowledge their 
accountability and act on their individual responsibility for 
safety.\15\
---------------------------------------------------------------------------
    \15\ FAA Order 8000.369B, Safety Management System, March 18, 2016.
---------------------------------------------------------------------------
    However, as early as 2015, FAA's Office of Audit and Evaluation 
cautioned about changes in airline safety culture and the potential 
impacts on safety and airline maintenance workforces. FAA guidance 
recognizes the impact that a single inspector can have on safety 
culture and establishes standards that require inspectors to act 
impartially and avoid the appearance of preferential treatment when 
they perform their official duties. Nonetheless, our recent work \16\ 
identified concerns regarding an FAA inspector's oversight of American 
Airlines' flight test program, which is used to verify the 
airworthiness of aircraft following major repairs. We found that an 
inspector had developed a personal relationship with the head of the 
carrier's flight test program and appeared to give the carrier 
preferential treatment when safety concerns were raised. The inspector 
also worked with the carrier to suppress future complaints. Ensuring 
that FAA's inspector workforce meets standards of impartiality remains 
a key oversight challenge for the Agency to strengthen its safety 
culture and effectively identify and mitigate risks.
---------------------------------------------------------------------------
    \16\ FAA Has Not Fully Addressed Safety Concerns Regarding the 
American Airlines Flight Test Program (OIG Report No. AV2018060), July 
10, 2018. Self-initiated.
---------------------------------------------------------------------------
Addressing Other New and Longstanding Safety Challenges
    While working to address the urgent safety concerns highlighted by 
the recent Boeing 737 MAX 8 accidents, FAA must remain vigilant about 
other emerging and longstanding areas that are critical to maintaining 
the safety of the NAS. These include improving safety on the ground and 
in the air at airports, integrating UAS in the same airspace as manned 
aircraft, protecting flight-critical systems that directly affect the 
safety of aviation passengers from cyberattacks, and identifying and 
removing suspected unapproved parts from the aviation supply chain.
Reducing Runway Safety Risks at Airports
    Incidents in which collisions between passenger aircraft were 
narrowly avoided at our Nation's major airports have renewed attention 
to runway safety. For example, in July 2017, a commercial pilot at the 
San Francisco International Airport attempted to land on a taxiway 
where four other aircraft were awaiting takeoff.\17\ Much of our work 
in this area has focused on FAA's efforts to reduce runway incursions--
incidents involving unauthorized aircraft, vehicles, or people on a 
runway--which has been a longstanding challenge for FAA.
---------------------------------------------------------------------------
    \17\ NTSB News Release, Flight Crew Misidentifies Runway, Causes 
Taxiway Overflight, September 25, 2018. NTSB determined an Air Canada 
flight crew's lack of awareness caused the overflight of the taxiway.
---------------------------------------------------------------------------
    While FAA has undertaken a number of safety initiatives since 2007, 
reports of incursions have increased, with a 92-percent rise in total 
incursions reported between Fiscal Years 2011 and 2018 (see figure 
2).\18\ In addition, while the number of serious runway incursions is 
relatively low, there have been several incidents where two aircraft 
have come within a few feet of colliding with each other, posing 
significant safety risks.
---------------------------------------------------------------------------
    \18\ We have not analyzed how factors such as changes in 
operational levels and new reporting systems may have contributed to 
the increase in runway incursions.


[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

---------------------------------------------------------------------------
    Source: OIG analysis of FAA data

    Last year, we reported \19\ that FAA had completed 10 of the 22 
runway safety initiatives recommended during a joint Government-
industry forum,\20\ including educating pilots on signs, markings, and 
other visual aids at airports with identified risk factors.\21\ 
However, the Agency faces challenges in fully implementing the 
initiatives still in progress, including dedicating funding and fully 
implementing new technologies,\22\ which could take years to complete. 
In addition, FAA did not establish quantifiable goals to measure the 
initiatives' effectiveness in reducing runway incursions. As a result, 
FAA will be limited in its ability to prioritize and adjust the 
initiatives based on their effectiveness. We made three 
recommendations, including updating target action dates for initiatives 
still in progress and developing metrics to measure their 
effectiveness. FAA plans to implement these recommendations by May 
2019. Effectively analyzing data, identifying risks, and tracking 
mitigation actions will remain critical to reduce runway risks.
---------------------------------------------------------------------------
    \19\ FAA Faces Challenges in Implementing and Measuring the 
Effectiveness of Its 2015 Runway Safety Call to Action Initiatives (OIG 
Report No. AV2018058), June 27, 2018. Self-initiated.
    \20\ FAA initiated a Call to Action forum in 2015 with 
representatives from industry, labor, and Government. The forum 
resulted in 22 initiatives intended to mitigate runway incursions and 
improve safety.
    \21\ According to FAA, risk factors that contribute to runway 
incursions may include unclear taxiway markings, airport signage, and 
more complex issues such as the runway or taxiway layout.
    \22\ For example, one initiative calls for testing and using new 
Next Generation Air Transportation System technologies for issuing taxi 
instructions, such as Data Communications.
---------------------------------------------------------------------------
Strengthening Oversight of UAS in the NAS
    The growing demand for UAS commercial operations--ranging from 
filmmaking and precision agriculture to package delivery--represents a 
substantial economic opportunity for the United States but also 
presents one of FAA's most significant safety challenges. Since 
initiating UAS registrations in December 2015, FAA has processed more 
than 1.1 million UAS registrations for commercial operators and 
hobbyists. Reports of UAS sightings by pilots and other sources have 
increased significantly in the past few years--from 238 in 2014 to more 
than 2,350 in 2018.
    The Agency has taken many steps to accommodate UAS in the NAS, such 
as passing a rule \23\ permitting small UAS (i.e., under 55 lbs.) to 
fly commercially, with a number of operational restrictions.\24\ 
However, much work remains to safely integrate UAS into the same 
airspace as manned aircraft. For example, FAA's rule allows commercial 
UAS operators to apply for a waiver to conduct higher-risk operations 
at night, over people, and/or beyond visual line of sight, if the 
Agency determines the proposed operations can be performed safely. Yet, 
as we reported last year,\25\ our analysis of FAA inspections found 
multiple instances of commercial operators flying their UAS over people 
and in airspace with manned aircraft without authorization to do so, 
including over exhibitions and concerts and while performing building 
inspections.\26\
---------------------------------------------------------------------------
    \23\ 14 CFR Part 107 (June 2016).
    \24\ The rule does not permit several potential UAS operations that 
are highly valued by industry but considered to be higher risk by FAA, 
such as operating a small UAS beyond line of sight or over people.
    \25\ Opportunities Exist for FAA To Strengthen Its Review and 
Oversight Processes for Unmanned Aircraft System Waivers (OIG Report 
No. AV2019005), November 7, 2018. Self-initiated.
    \26\ Our analysis of FAA's inspection record database shows no 
indication that formal enforcement actions were pursued for any of 
these specific incidents.
---------------------------------------------------------------------------
    Moreover, we found that FAA faces several challenges in developing 
a risk-based oversight system for commercial UAS operations. While the 
Agency had developed guidance for its inspectors in planning annual 
inspections of some UAS operators, FAA's UAS oversight was neither 
data-driven nor proactive and lacked key elements of a risk-based 
oversight system. For example, we reported that FAA's guidance did not 
include risk or operational factors (e.g., operating location or 
frequency of operations) to consider when choosing operators for 
inspection. Furthermore, FAA had not yet collected sufficient 
inspection data to conduct a meaningful assessment of safety hazards 
and develop an overall, baseline risk profile of commercial UAS 
operating in the NAS. In response to our recommendations, FAA has 
recently required new, mandated inspections of UAS operators based on 
data. The Agency must continue to enhance its data collection and 
analysis to mitigate safety risks in this rapidly evolving industry.
Implementing Congressionally Mandated Aviation Cybersecurity 
        Initiatives To Protect Safety-Critical Systems
    Enhancing the safety and security of the NAS also depends on 
strengthening the Agency's ability to protect against a growing number 
of cybersecurity threats to FAA's safety-critical systems. 
Specifically, FAA operates a network of more than 300 information 
technology systems. This complex network has evolved over the years 
into an amalgam of diverse legacy radars and newer satellite-based 
systems for tracking aircraft, as well as a new initiative for 
controllers and pilots to share information through data link 
communications.
    In 2016, the FAA Extension, Safety, and Security Act \27\ directed 
FAA to establish a new ``total systems'' approach to enhance its 
ongoing cybersecurity efforts for securing the NAS, including aircraft 
systems. Our recent work \28\ shows that FAA has taken initial steps to 
address the act's requirements, such as completing a strategic plan 
with cybersecurity goals and objectives, developing a risk model to 
assess FAA operations, and establishing a research and development 
(R&D) plan to outline further cyber initiatives. However, FAA will be 
challenged to continue to implement the risk model across all of its 
lines of operations, establish priorities for its cyber R&D efforts, 
and coordinate ongoing efforts with other agencies (such as the 
Departments of Defense [DOD] and Homeland Security [DHS]) to maximize 
the Federal investment in cybersecurity research and implement 
corrective actions to protect the NAS. Accordingly, we will soon begin 
a review \29\ of FAA's role and authority in the Aviation Cybersecurity 
Initiative, a joint taskforce that includes DOD and DHS aimed at 
identifying and mitigating cyber vulnerabilities in the aviation 
industry.
---------------------------------------------------------------------------
    \27\ Pub. L. No. 114-190 (2016).
    \28\ FAA Has Made Progress but Additional Actions Remain To 
Implement Congressionally Mandated Cyber Initiatives (OIG Report No. 
AV2019021), March 20, 2019. Requested by the House Committee on 
Transportation and Infrastructure.
    \29\ This was requested by the Chairman of the House Committee on 
Transportation and Infrastructure.
---------------------------------------------------------------------------
Strengthening the Investigative Process and Proactively Removing 
        Suspected Unapproved Parts From the Aviation Supply Chain
    The safety of the NAS also depends on efforts by FAA and the 
aviation industry to ensure that U.S. aircraft are properly maintained 
and airworthy. A single passenger aircraft can contain as many as 
400,000 parts, and FAA and the aviation industry are responsible for 
ensuring that all these parts meet established standards and are safe 
for use. Part of this responsibility is to detect and monitor for 
Suspected Unapproved Parts (SUPs)--aircraft parts that may have been 
manufactured without FAA approval, including counterfeit parts. 
However, our work has identified longstanding challenges with FAA's 
processes for overseeing and reducing the risk of SUPs. For example, we 
reported in 2017 \30\ that FAA's process for monitoring and 
investigating SUPs was not as effective as it could be because of 
recordkeeping weaknesses and the lack of management controls to capture 
and accurately report the number of SUPs cases. As a result, FAA could 
not accurately account for the number of SUPs or track safety-related 
trends about the risks posed by unapproved parts.
---------------------------------------------------------------------------
    \30\ Enhancements Are Needed to FAA's Oversight of the Suspected 
Unapproved Parts Program (OIG Report No. AV2017049), May 30, 2017. 
Requested by the Ranking Members of the House Committee on 
Transportation and Infrastructure and its Subcommittee on Aviation.
---------------------------------------------------------------------------
    Furthermore, FAA's oversight of industry actions to remove 
unapproved parts was ineffective because the Agency did not confirm 
that operators took appropriate action to remove unapproved parts from 
their inventories. For example, an FAA inspector investigated a case to 
determine whether tens of thousands of privately owned commercial 
aircraft parts, which were for sale online, were unapproved. These 
included safety-critical parts, such as landing gear. However, the 
inspector did not physically account for the location and quantities of 
the parts but instead accepted a letter from the owner stating that he 
had removed the ad from his eBay site and had not sold any parts. FAA 
concurred with all 11 of our recommendations to strengthen its SUPs 
program and is working to complete actions to address the remaining 
three open recommendations by the end of May. Going forward, enhancing 
the margin of safety will require FAA's sustained management attention 
to ensure that the hundreds of thousands of aircraft parts installed on 
airplanes are manufactured or repaired according to safety standards.
Conclusion
    From certifying a new aircraft to aircraft maintenance to pilot 
training and beyond, aviation safety is a complex, wide-reaching effort 
with many moving parts. As the recent Boeing 737 MAX 8 and other 
accidents draw significant attention to FAA's safety oversight, and as 
the aviation industry continues to evolve, FAA must ensure it can 
proactively adapt to new oversight challenges, while also addressing 
longstanding concerns in safety-critical areas. A strong commitment to 
risk-based oversight--built on the foundation of a rock-solid safety 
culture--will be vital to ensure FAA continues to maintain one of the 
safest aviation systems in the world. As always, we remain committed to 
supporting FAA and the Secretary as they seek to uphold and enhance the 
safety of the NAS and protect the traveling public. We will continue to 
update you on our work on these and related matters.
    This concludes my prepared statement. I would be happy to address 
any questions from you or Members of the Subcommittee at this time.

    Senator Cruz. Thank you, gentlemen. We appreciate your 
testimony.
    Acting Administrator Elwell, although the investigations of 
both of these crashes are still ongoing, the investigators have 
gathered enough data to confirm similarities between the two 
crashes.
    The most prominent link seems to be a new software unique 
to the Boeing 737 Max called the Maneuvering Characteristics 
Augmentation System, more commonly known as MCAS.
    From the FAA's perspective, was there any information on 
this new MCAS System that was required to be included or was 
included in the ``short self-administered online course'' that 
pilots are required to go through before flying the Max?
    Mr. Elwell. Mr. Chairman, thank you for that question.
    The MCAS System is indeed, as I mentioned, of great 
attention in both of these tragic accidents and the MCAS is 
actually a sub-device to a system called the Speed Trim System 
that is in the NG, a prior 737.
    What the MCAS does is it--the 737 Max is a fly-by-wire 
aircraft. Fly-by-wire aircraft, the controls, the yoke, the 
controls, the flight controls needs to feel right to a pilot 
and so what the MCAS does is it gives inputs to the flight 
controls when necessary in a very thin envelope, thin piece of 
the flight envelope and certain regimes so that the pilots, the 
yoke feels exactly like it should, and in this case, the MCAS 
made the Max feel exactly like the NG to fly.
    So for that reason, we gave it an amended type certificate 
because of its similarity to the NG, because of what the MCAS 
System aided the pilots in the feel and the flight of the 
airplane.
    We have for a certification of this type a Flight 
Standardization Board comprised of pilots from Europe, Canada, 
the United States, who come together and fly the aircraft that 
is being amended, in this case 737 NG, and the new aircraft, 
and they fly it and are monitored by engineers and experts 
specifically to see if they have or notice differences in the 
flight characteristics, the handling characteristics of the new 
airplane because that would trigger us to need flight training 
for this new device.
    Senator Cruz. Administrator Elwell, let me try to refocus 
you back on the specific question I asked, which is, was there 
any information on the MCAS that was included in the short 
self-administered online course the pilots were required to go 
through?
    Mr. Elwell. There was not specific instruction on the MCAS 
to my knowledge specifically because it was not a system that 
went directly to what the pilots flew on the Max, the 
difference between the Max and the NG.
    Senator Cruz. Well, that might be true in ordinary 
circumstances, but as I understand it on previous versions of 
the 737, when the pilot pulled back on the yoke, it cutoff the 
electronic control of the stabilizers but with the MCAS, it did 
not, and presumably pilots would not know this if it was not 
included in their training and they were not made aware of 
that, is that correct?
    Mr. Elwell. So, Senator, the MCAS gives input to the flight 
controls, as I said, in a very small flight envelope.
    In this case we're talking about here, errant information 
to that system would make it give input where it's not needed 
and where it's not wanted and only in manual flight and pilots 
are trained when they get an input into their flight controls 
that they did not ask for, that is not appropriate for the 
regime of flight, then they go through procedures.
    In this case, it's called runaway stabilizer trim procedure 
and that is what would be done in this instance. In normal 
operation for the MCAS, you would never----
    Senator Cruz. Did these pilots'----
    Mr. Elwell.--feel the input.
    Senator Cruz.--training or procedure let them know that 
pulling back the yoke would not disengage this system?
    Mr. Elwell. I'm not quite sure what you're referring to 
about pulling back the yoke and stopping it because that's not 
actually----
    Senator Cruz. So I'm reading a quote from the New York 
Times on February 3, 2019, where the Times reported ``Older 
737s had a way of addressing certain control problems with the 
stabilizers. Pulling back on the yoke or control column would 
cutoff electronic control of the stabilizers, allowing the 
pilots to control them manually,'' and that was not true with 
the 737 Max.
    Now is that correct factually? I'm relying on the Times 
reporting here.
    Mr. Elwell. So I don't believe that's correct. The same 
ways to deal with the MCAS inappropriate input is the same 
thing a pilot would do for runaway stab trim for an NG. It's 
the same input and the same procedure. In fact, the procedure 
for runaway stab trim does not change from the NG to the Max. 
It presents itself the same way and it's dealt with the same 
way.
    Senator Cruz. Now the MCAS System itself relied on angle of 
attack sensors that, as the Washington Post reported, ``angle 
of attack sensors have been flagged as problems on more than 50 
times on U.S. commercial airplanes over the past five years.''
    How did the FAA come to the conclusion that it was 
appropriate to certify an anti-stall software system, the MCAS, 
that not only drew data from a sensor that had a history of 
problems but also that didn't have redundancy?
    Mr. Elwell. So the AOA vanes are an input to the MCAS 
System. The MCAS System is actually not an anti-stall system. 
It's not a system unto itself. It is a supplement to, as I 
said, the speed trim system that existed in the NG, does the 
same thing that the STS does in the NG.
    I am not aware of AOAs being a problem, 50 malfunctions of 
an AOA or 50 maintenance procedures to an AOA across the gamut 
of flight where AOA vanes are in all the flights that use AOA. 
It is not in--you talk about numbers of hundreds of thousands 
of flights.
    Senator Cruz. Unless there is a system where the 
malfunction then causes the plane to crash, then that is a 
serious issue.
    Mr. Elwell. Well, sir, it is still yet to be determined if 
the malfunctioning of the AOA caused the crash. We actually 
don't know the cause of the crash. There's a lot more to find 
out through the investigation.
    But I am confident in--well, I'm confident in the AOA vanes 
that are produced and put on airplanes and I'm confident in the 
MCAS System. Now where we need to go is we need to get all the 
information, all the data from the accident to determine the 
interaction between all of them, and it isn't just airframe or 
it isn't just the AOA. It isn't just the MCAS.
    There's quite a few more factors in any investigation that 
we have to determine. We have to gather the data. We're a data-
driven organization and we make our decisions based on the data 
collected. We still have a lot of data to collect, sir.
    Senator Cruz. Senator Sinema.
    Senator Sinema. Thank you, Mr. Chair.
    My first question is for Mr. Elwell, but I welcome 
responses from any of our guests.
    According to media reports, the initial failure 
classification for the MCAS enabled its safety evaluation to be 
delegated to Boeing and during--well, according to media 
reports, during testing, FAA did not completely and properly 
review technical documents provided by Boeing.
    So how do we ensure that FAA can take over safety 
evaluation if issues are discovered during the testing and 
evaluation phase?
    Mr. Elwell. Thank you for that question, Senator.
    What you're referring to is the Organizational Designation 
Authorization. In the course of a certification, such as an 
amended type cert that the 737 Max went through, the FAA 
determines what aspects of the delegation or what aspects of 
the certification can be delegated and usually those are normal 
well-known legacy-type systems, and in the case of the 737 Max, 
we, the FAA, retained MCAS for review at the beginning of the 
certification process.
    As the process goes on, ODA is amended and is amended many 
times in the course of a certification as the FAA reviews and 
certifies the expertise of the manufacturer to take on more of 
the delegated authority under very strict review by the FAA and 
we at times in the course of a certification will find areas 
that we want to pay more attention to and we will retain those 
items.
    So it is an active constantly changing dynamic in a 
certification and that's what happened during the certification 
of the Max.
    Senator Sinema. A second question then for you, Mr. Elwell.
    So MCAS is new to the Boeing Max aircraft and I was 
wondering if you could talk to us about why the system was not 
included in pilot training materials and who makes the 
determination regarding what is included in pilot training 
materials?
    Mr. Elwell. So when we're doing a new certification, 
whether it's an amended or a new type, there's a Flight 
Standardization Board that is a group of experts and pilots and 
engineers whose responsibility it is to determine, and in this 
case an amended type certificate, if the handling 
characteristics of the new aircraft require flight training or 
if the differences between the new aircraft and the one that 
it's amending does not require flight training.
    What the MCAS did was correct for some very slight 
modifications that the Max had. The Max has slightly larger 
diameter engines with not a whole lot of extra thrust, similar 
thrust, but because of the width of the engines, they had to go 
forward on the wing, and because of the diameter of the 
engines, the nose wheel had to be extended six inches.
    These are not big changes as far as the FAA's concerned for 
an amended certificate, but what we need to do is put pilots in 
simulators and fly the aircraft that's being amended and the 
new aircraft and after many scenarios, flights in all regimes, 
sim flights in all regimes with these pilots, there was a 
consensus opinion from the pilots, European, Canadian, American 
pilots, that there was no market difference in the handling 
characteristics of these two aircraft and that is what we need 
to determine what kind of flight training or not is needed and 
there was, by the recommendation of the Flight Standardization 
Board--understand this is a Board that has been used dozens and 
dozens of times, and their unanimous opinion was flight 
training was not needed.
    They didn't flight test the MCAS per se because, as I said, 
the MCAS is a device that is a supplement to another system 
that is designed, specifically designed for the yoke to feel 
correctly to the pilot in all regimes of flight.
    Senator Sinema. My last question is for each of the 
witnesses and I wonder if you have suggestions for legislative 
or regulatory changes that can ensure an aircraft is 
independently and appropriately evaluated for operational 
safety. Is there more we need to do?
    Mr. Scovel. Thank you, Senator Sinema.
    Yes, there may be. However, for me as Inspector General to 
offer suggestions today would be entirely premature.
    As you know, Secretary Chao, Senator Blumenthal, and other 
congressional requesters have asked my office to start at the 
very beginning thinking of these as bookends. First, we want to 
look at the certification process.
    I can outline very quickly for you what that will entail. 
We want to look at the key decisions made by FAA when 
certifying the airplane and the timeline. We want to determine 
when MCAS was added to the aircraft and why FAA approved it or 
the extent of FAA's involvement in Boeing's decision to approve 
it, how FAA reached the decision that pilots did not need 
additional training or that the details about the new system 
did not need to be included in the airplane's manual. That's 
the first bookend.
    The second bookend in my view will be how FAA responded to 
the recent accidents and that's specifically Senator 
Blumenthal's question.
    Clearly, confidence in FAA as the gold standard for 
aviation safety has been shaken. We can help provide 
information to the Secretary and to the Congress to determine 
how best to restore FAA to that position.
    The second bookend we hope will shed some light on the 
obvious question as to why FAA was the last safety regulator to 
decide to ground the 737 Max.
    Other safety regulators around the world decided that in 
their role as safety regulators they needed to drive risk to 
zero and they did that by grounding the aircraft.
    Acting Administrator Elwell has testified that they were 
continuing the hunt for data in order to inform that decision. 
So that disparity, that apparent disparity in the safety 
regulator's role should be another question, I respectfully 
submit, for the Congress and the Secretary.
    We hope to present information to all of you to help inform 
your decisionmaking.
    Mr. Sumwalt. Ranking Member Sinema, thank you for your 
question.
    The NTSB has looked at that issue as it relates to 
particular crashes. For example, coming out of the 2013 Asiana 
crash at San Francisco, we recommended that the FAA convene a 
special certification design review of how the Boeing 777 
Automated Flight Control System controls air speed and we 
wanted the FAA to look at that and we've classified that 
recommendation as open alternate acceptable response.
    Coming out of the 787 battery fire event that we 
investigated that same year, we talked about the use of 
engineering designees. Since 1999, we've issued eight 
recommendations to the FAA concerning the use of engineering 
designees. Three are still open. The remaining four have been 
closed acceptably.
    We do want the FAA to provide certification to engineers 
with written guidance and training to address opportunities to 
improve the certification process outcomes and so that would be 
where we stand on that.
    Senator Sinema. Thank you. Thank you.
    Senator Cruz. Mr. Elwell, you told Senator Sinema that part 
of certification was based on pilots flying simulators in 
multiple different scenarios.
    Did any of those scenarios include angle of attack sensors 
malfunctioning and reporting the wrong data to the MCAS System?
    Mr. Elwell. Sir, I can get an answer for you on that, but I 
don't believe so. I believe that they were all in the normal, 
the full range of the flight envelope for flight 
characteristics.
    Again, the issue of an AOA vane giving the MCAS the wrong 
information causing it to give nose down input to the 
stabilizer trim presents as a scenario. All pilots are trained 
on it and familiar with it. It's called runaway stabilizer trim 
and the actions that they take to defeat it are the same as 
they would find in any other cause of a stab trim malfunction 
which would be the motor going off when it shouldn't. So it is 
indistinguishable to the pilot.
    [Mr. Elwell's answer follows:]

    The flight control system, of which the Maneuvering Characteristics 
Augmentation System (MCAS) is a part, was extensively tested, including 
in potential failure modes of MCAS and stalls.

    Senator Cruz. Chairman Wicker.
    Chairman Wicker. Thank you, Senator Cruz.
    Mr. Sumwalt, the Indonesian Civil Aviation Authority has 
issued a preliminary report. How long did that take after the 
Lion Air crash?
    Mr. Sumwalt. The accident occurred, Senator, on October 29 
and I believe the preliminary report was issued on November 27, 
so about 30 days.
    Chairman Wicker. Do you think we can expect a preliminary 
report, then, from Ethiopia within about a month?
    Mr. Sumwalt. I do. Our investigators are very engaged with 
the Ethiopian Government. We're working very closely with them, 
providing assistance in the development of a draft report, and 
we do expect it in the very near future.
    Chairman Wicker. I assume you're getting all the 
cooperation you need from the Ethiopian Government----
    Mr. Sumwalt. Yes, sir, we are.
    Chairman Wicker.--and from the Indonesian Government?
    Mr. Sumwalt. Absolutely.
    Chairman Wicker. What do you know about the Lion Air crash 
that you don't know about the Ethiopian Air crash at this 
point?
    Mr. Sumwalt. Well, I've read the Lion Air preliminary 
report that was issued in November. I will say a very ticklish 
issue is that there's a law, an actual law, 49 U.S.C. 1114 
subsection f, that prohibits anyone from disclosing information 
concerning a foreign investigation unless that information has 
been cleared by the host country.
    So I am not the one to speak about either of those two 
accidents.
    Chairman Wicker. Mr. Scovel, are you going to have a 
recommendation about that law? Do you have an opinion about 
that law? Is it a problem?
    Mr. Scovel. Conceivably, it might be. Certainly in the 
desire of the Congress and the Administration to foster 
transparency and determine the best route ahead. At this point, 
I certainly don't have a recommendation for you.
    Chairman Wicker. OK. Well, if the witnesses would get back 
to us on that, we'd appreciate it. You have some time to 
consider that.
    Now there was a nose-down input, Mr. Sumwalt. In other 
words, the pilots experienced the MCAS System kicking in and 
pushing the nose down. I understand it was some 21 times before 
the plane eventually crashed. Is that your understanding, sir?
    Mr. Sumwalt. Which accident are you referring to?
    Senator Wicker. Lion Air.
    Mr. Sumwalt. I think that's about right, based on my read.
    Chairman Wicker. Over what period of time would that have 
been?
    Mr. Sumwalt. I'm not sure, sir.
    Chairman Wicker. What should the pilots have done there?
    Mr. Sumwalt. Well, I flew the 737 for 10 years and I do 
believe that there is a procedure, at least for the Flintstone 
version of the 737 I flew, a very old 737, but I do believe 
that the first thing you would do is oppose that motion by 
pulling the yoke back and that should engage a stab brake. Now 
apparently that feature is not on the Max----
    Chairman Wicker. Mr. Elwell, what should they have done? 
What should the pilot have done, based on 21 times of the 
system kicking in and pushing the nose down?
    Mr. Elwell. Mr. Chairman, I did not fly the 737, so I can 
only speak to the airplane--all the different airplanes I flew, 
but----
    Chairman Wicker. Oh, I'm actually asking about this 
aircraft. Do you know? If you don't know, that's fine.
    Mr. Elwell. Sir, I'll have to get back to you on the 
specifics. There is a non-normal checklist, an NNC on runway--
--
    Chairman Wicker. I think that would be helpful for us to 
know, based on the expertise at this table, what should have 
occurred in the cockpit, based on that nose-down input?
    Mr. Elwell, then discuss, if you don't mind, the point that 
Mr. Scovel mentioned and a lot of us have about the decision 
made by other countries initially to ground the aircraft, what 
data they had. Was this just an abundance of caution or was it 
based on facts that these agencies had that we didn?t have here 
in the United States? Help us understand the decision there.
    Mr. Elwell. Yes, sir. It is a very important question.
    The FAA, to make a decision to ground a fleet of aircraft, 
is going to do that on data-based information that we have to 
warrant grounding. I can't speak to the reasoning that the 
other nations took. I know that in communication with those 
countries, they, in our request of what data they might have, 
they did not have any data for us. In fact, there were several 
countries in communications with us who, after grounding the 
aircraft, asked us what data we had and what we might suggest 
for them for ungrounding when the time was right.
    Chairman Wicker. Was your decision based on data or just--
--
    Mr. Elwell. Our decision----
    Chairman Wicker.--what everybody else was doing? What was 
that data?
    Mr. Elwell. So on that Wednesday morning, mid-morning, we 
received data that gave us refined flight track. We had initial 
flight track data Monday that was unreliable and it was 
actually--we were not able to interpret it and to create a 
flight track.
    That data was refined on Tuesday night into Wednesday by 
the company that actually produced the data or received the 
data through their satellite system and with the help of the 
NTSB and Boeing, that data was refined to the point where we 
could have a flight track, a 6-minute flight track of the 
Ethiopian Air flight, and we found information on the ground 
that corroborated for us in a briefing on Wednesday morning 
that the flight track of Ethiopian Airlines was very similar to 
the flight track of Lion Air and that data told us that there 
was very possibly a link between the two flights and when you 
have the possibility of a link between two accidents of the 
same type aircraft, it's prudent to ground them until you find 
what that link is, mitigate that link.
    The important thing to know about using data, we may have 
been, I think someone said, the last country to ground the 
aircraft, but the United States and Canada were the first 
countries to ground the aircraft with data for cause and 
purpose and that's important because when you ground a fleet of 
aircraft for a reason, a definable reason, then you have 
something by which to unground them when you've mitigated that 
or you've solved it or you've found that link.
    Chairman Wicker. Mr. Chairman, I know we're over, but Mr. 
Sumwalt seems to be nodding his head.
    Are you in agreement with the approach that Mr. Elwell has 
outlined as having been taken by the FAA?
    Mr. Sumwalt. Well, the NTSB was not involved in the 
grounding decision.
    Chairman Wicker. Right.
    Mr. Sumwalt. We supplied data that they could use to make 
that decision.
    Chairman Wicker. Thank you. Thank you, Mr. Chair.
    Senator Cruz. Senator Cantwell.
    Senator Cantwell. Thank you, Mr. Chairman.
    Administrator Elwell, did you say in answering an earlier 
question of Senator Sinema that the FAA retained the authority 
over the MCAS System, that it wasn't delegated?
    Mr. Elwell. I said that originally we retained it as a new 
system and then released it to the ODA, to the delegation 
designation.
    Senator Cantwell. So if someone is characterizing it as 
delegated, then it was delegated?
    Mr. Elwell. Right. So initially as a new system or a new 
device on the amended type certificate, we retained the 
oversight of that and then over time released that to the ODA 
when we had the comfort level and the oversight and we've 
examined it thoroughly and we were able to assure that the ODA 
members of Boeing had the expertise and the knowledge of the 
system to continue going forward.
    Senator Cantwell. And so that kind of information is 
something you can make available to members now or is that 
something that will be part of the investigation?
    Mr. Elwell. I'm sure, Senator, that we could get that 
information to you on exactly the timing and how that went, 
and, of course, in the investigations and the audits that are 
ongoing about the certification process here, this will all be 
very transparent and clear.
    Senator Cantwell. Well, I do think transparency is 
important.
    Mr. Elwell. Absolutely.
    Senator Cantwell. So I read statements where you're saying 
it wasn't delegated or I hear your answer here and then I read 
things in the press that say it was delegated and I think the 
public wants to understand the system and obviously Mr. Scovel 
and various IG reports is reviewing that and I appreciate those 
reports and that review.
    As I mentioned in my opening statement, I appreciate 
Secretary Chao convening some experts of aviation analysis to 
also look at that system and review.
    So, anyway, we'll look forward to getting that information 
from you on what that looked like as the FAA retains that 
oversight and then once they were certain then delegated. I'm 
not sure what they delegated but you will get that to us.
    This larger question in my mind is Mr. Scovel also 
mentioned that pilots rely on automated flight systems, that 
the FAA ensure that carriers meet its requirements to train 
pilots on how to respond to abnormal flight conditions, and I 
think you also, Mr. Scovel, mentioned stall situations.
    So how is the FAA making sure that that is achieved in 
particularly this area of human and machine interface? I think 
that the public wants to understand, and I think it's probably 
across a lot of transportation sectors, want to understand what 
we're doing on testing to make sure that these safety factors 
of functionality are there, particularly when the functionality 
is between a machine and a human interface, how are we testing 
for that, and in this case, how were we testing?
    Mr. Elwell. Yes, Senator. The FAA is intensely interested 
in the interface between the pilot and the machine and over 
time that relationship has changed and as aircraft become more 
automated, we have this--clearly automation is one of the most 
important aspects for the amazing increase in improvement in 
safety we've seen over decades.
    But automation brings with it certain challenges and as the 
IG has pointed out, if most of the time automation is on in an 
aircraft, there's always been this concern that, well, then 
pilot skills degrade.
    So when I was flying in the airlines, we had within the 
airline itself, we had some rules about making sure that you 
hand flew frequently enough to keep that sharpness but 
certainly we look very, very closely at the training 
requirements and the human interface and what automation does, 
the safety benefits, and what the challenges are with it. So we 
watch that very closely.
    Senator Cantwell. And so you think there was enough of that 
training involved here?
    Mr. Elwell. Senator, I do, I do, because the MCAS, 
remember, the MCAS operates in manual mode. It's not automated. 
It's not during with autopilot on. It actually--as I said 
earlier, it makes the--its whole purpose is to give the pilot 
the proper feel with a fly by-wire yoke while he or she is 
flying.
    So it interjects in manual mode. It does not interject in 
automatic mode, and as I said, when that MCAS is doing things 
that it's not supposed to do, pilots feel it. It presents 
itself as uncommanded pitch trim and pilots of large aircraft 
are trained from the beginning of their careers how to handle 
that.
    Senator Cantwell. Well, I mention this and I mentioned the 
Colgan Air families who are here because I think that's been 
their main mantra, that there wasn't enough training on that 
particular system or at least from a co-pilot perspective, and 
I think I saw that Captain Sully had also made similar comments 
recently.
    We've had a lot of debate here about this as it relates to 
making sure that two pilots are, but I really do want to 
understand the FAA's role and certainly Mr. Scovel's review of 
that human-machine interface because my guess is we're going to 
continue to move forward but we have to get this right. We have 
to get this right.
    So thank you, Mr. Chairman. I see my time has expired.
    Senator Cruz. Senator Thune.

                 STATEMENT OF HON. JOHN THUNE, 
                 U.S. SENATOR FROM SOUTH DAKOTA

    Senator Thune. Thank you, Mr. Chairman.
    Mr. Elwell, as you know, the FAA Reauthorization Act of 
2018 contains several bipartisan provisions aimed at improving 
and modernizing FAA's aircraft certification process, to 
include the establishment of an organization designation 
authorization office within FAA's Office of Aviation Safety 
designed to improve operational safety by strengthening 
oversight of ODA holders delegated to perform certain functions 
on behalf of FAA.
    Could you provide a timeline on when you expect this office 
to be fully established?
    Mr. Elwell. Thank you for that question, Senator Thune.
    Absolutely. In fact, we already established the new ODA 
Office, as you mentioned, prescribed in last year's FAA bill. 
On March 5, we created and stood up the office.
    Senator Thune. And as a followup, the FAA bill also 
established an expert review panel to survey ODA holders and 
evaluate the effectiveness of the ODA process.
    You have an update on when you expect this review panel to 
be established?
    Mr. Elwell. I don't have it off the top of my head, 
Senator, but I will certainly get that information to you. It 
may already be in place, but I don't have that in my notes.
    Senator Thune. Thank you. That would be great if you could 
get us that information.
    Boeing recently--I would direct this to you, Mr. Elwell, 
too. Boeing recently stated that the 737 Max Series aircraft 
was certified, and I quote, ``Certified in accordance with the 
identical FAA requirements and processes that have governed 
certification of all previous new airplanes and derivatives.''
    Could you provide some examples of other aircraft models 
where the FAA has certified a variant aircraft in a manner 
similar to the process that was used for the 737 Max?
    Mr. Elwell. Well, Senator, the process to determine whether 
it is an amended type certificate or a new type is the same, 
regardless of the manufacturer, the type which you're amending, 
or making that determination, and it goes to the points I made 
earlier about flyability.
    So, first and foremost, the criteria to examine as to 
whether there's a fundamental difference in the thrust, weight, 
flight characteristics of the applicant for an amended type. 
Those, as I said, are tried and true methods that we've used 
for decades on amended certificates.
    I know sometimes, in my case when I flew the Super 80, we 
added to our fleet type the Super 80s from another airline in a 
merger. They had a different cockpit layout but the plane was 
fundamentally the same. There are a couple of different options 
but it handled the same.
    So it was an amended type and we went through differences 
training because the flight deck had some different things in 
it that we needed to get used to, but that's the fundamental 
things that we look at.
    Senator Thune. You look at--so as a follow up, was there 
anything specific about the design of the 737 Max that 
differentiates the model certification process from some of 
those examples that you just mentioned?
    Mr. Elwell. Well, sir, the 737 Max is and required 
certainly an amended type certificate and again primarily 
because of the new modern complexities that it brought to the 
table. It did bring the MCAS into the equation but the MCAS was 
a supplement or an addition to a system that already existed in 
the NG.
    The engine position on the wing was different and it's what 
required actually--it's what necessitated the addition of MCAS 
and there was some differences in the screens, what was on the 
screens, but fundamentally the aircraft layout, the handling 
and the performance of the aircraft was the same, and thus the 
decision to make it an amended type certificate.
    Senator Thune. OK. Mr. Sumwalt, you mentioned in your 
testimony both the benefits and safety concerns related to the 
integration of UAFs in the Nation's airspace.
    As you know, the FAA Reauthorization Act of 2018 included 
numerous provisions related to the safe operation of this 
emerging technology.
    Are there any pending regulatory actions that the FAA in 
particular that you see as most important to ensuring the safe 
integration of drones into our airspace?
    Mr. Sumwalt. Thank you for that question, Senator Thune.
    As you're aware, the FAA recently enacted Part 107 to the 
Federal Aviation Regulations which imposes more regulatory 
requirements for drone operators and we see that as a positive.
    Senator Thune. OK. All right. Thank you. I see my time's 
expired, Mr. Chairman. Thank you all for your willingness to be 
here today and take questions.
    Senator Cruz. Senator Klobuchar.

               STATEMENT OF HON. AMY KLOBUCHAR, 
                  U.S. SENATOR FROM MINNESOTA

    Senator Klobuchar. Thank you very much, Mr. Chairman. Thank 
you to all of you.
    The two tragic airplane crashes included, by the way, a 
beloved community member from St. Cloud, Minnesota, Mucaad 
Hussein, and I know his family is grief stricken, and following 
these crashes, as many of my colleagues have talked about, it 
is very important that we figure out our certification process 
and get it right so we can prevent similar tragedies in the 
future.
    Mr. Elwell, I know you've been asked about this but let me 
try it a different way.
    Are there any safety measures the FAA may have 
miscalculated when evaluating the safety features of the Boeing 
737 Max?
    Mr. Elwell. Well, Senator Klobuchar, thank you for that 
question.
    We certify aircraft in a way that we have refined, as I 
said, for large aircraft, large commercial aircraft. It has 
been refined 130 times, over 130 times since we started doing 
these.
    In every certification we learn something new, from every 
IG audit, from every----
    Senator Klobuchar. Was this consistent with how you've done 
other certifications in other situations, the Boeing situation?
    Mr. Elwell. Yes, ma'am. This was an amended type 
certification that followed the procedures we use to determine 
and then to execute----
    Senator Klobuchar. But if you learn something else after 
this investigation or other things come out, you may change 
that process?
    Mr. Elwell. Absolutely. That's how we get better.
    Senator Klobuchar. And, Mr. Scovel, what is your office's 
timeline for this audit?
    Mr. Scovel. Thanks, Senator.
    We always shoot for 10 months. This is a very tall order 
for us, as I'm sure you can appreciate. We have a highly 
skilled team of aviation safety auditors who we'll turn to. If 
we can meet 10 months, I optimistically say great. It may well 
be some months after that. We will get to it as soon as we 
possibly can because we really truly appreciate your interest 
on all these matters.
    Senator Klobuchar. Thank you.
    Mr. Scovel. Thanks.
    Senator Klobuchar. Mr. Elwell, back to you, according to a 
recent New York Times article, Boeing charged airlines extra 
for critical safety features. These were optional add-ons.
    Following the crashes, does the FAA plan to update the 
requirements for aircraft safety features or take other action 
to mandate that these features are not optional?
    Mr. Elwell. Well, Senator Klobuchar, when we certify an 
aircraft, whether it's amended or a new type, critical safety 
features, that's an important term. If something is a critical 
safety feature on an aircraft, a passenger aircraft that we 
certify, it's not optional.
    So critical safety features----
    Senator Klobuchar. I see.
    Mr. Elwell.--are part of the certification package and I 
think what you're referring to is AOA displays on the CRTs in 
the cockpit, and I can tell you as a pilot that's flown 
aircraft, several aircraft in the military and the civilian 
world, I had aircraft that had AOA displays in the cockpit and 
I had aircraft that didn't, and it all depends on what the rest 
of the display says.
    In today's modern airplanes, and you've got 12-inch CRTs in 
the cockpit,----
    Senator Klobuchar. But is it possible this could be decided 
that these aren't just optional, that they should be mandatory 
if it's discovered after these investigations?
    Mr. Elwell. Absolutely.
    Senator Klobuchar. OK. And then do you know an estimate of 
how many safety features that the FAA lists as optional right 
now that detects sensor malfunctions or could you tell it to me 
later in writing?
    Mr. Elwell. I could tell it to you later, Senator 
Klobuchar.
    Senator Klobuchar. OK. All right. Chairman Sumwalt, what 
role does the U.S. play in setting international safety 
standards when it comes to training for foreign pilots?
    I know you'd answered some questions about training for my 
colleagues, but do we have any role there? I'm just thinking 
because we had someone from Minnesota was killed.
    Mr. Sumwalt. Sure. Senator Klobuchar, we are, as I've 
mentioned, we are member state to the International Civil 
Aviation Organization that sets recommended practices and 
standards and so it would be ICAO that would outline those 
international training standards that other member states would 
be expected to comply with.
    Senator Klobuchar. And could you weigh in on those training 
standards?
    Mr. Sumwalt. We could. The FAA is officially the U.S. 
representative to ICAO, but we work closely with them with our 
relationship with ICAO.
    Senator Klobuchar. I see. So you'd be involved in that, Mr. 
Elwell?
    Mr. Elwell. Yes, Senator, we would.
    Senator Klobuchar. OK. I'll follow up on that later.
    One last question I had of you, Chairman Sumwalt. In your 
testimony, you highlighted reducing fatigue-related accidents 
as one of the NTSB's most wanted transportation safety 
improvements for 2019 to 2020.
    As you know, I've led the Safe Skies Act, supported by 
Captain Sullenberger, among many, along with Senators Cantwell, 
Blumenthal, Markey, and Duckworth, to take the rest 
requirements that we put in place for passenger pilots and 
apply them to cargo pilots.
    This is something unrelated to these two crashes but part 
of airline safety and something that I know the Colgan families 
have also supported. So could you comment on that?
    Mr. Sumwalt. Absolutely. I want to thank you and Senator 
Blumenthal for your advocacy on that.
    The NTSB does not agree that there should be a different 
standard for passenger-carrying airlines and cargo airlines 
with respect to the fatigue rules. The FAA, as you know, did 
enact a fatigue rule in 2012 for passenger carriers that did 
not relate to cargo carriers, and we disagree with that 
disconnect.
    Senator Klobuchar. OK. Well, I hope you win. So we're going 
to keep pushing for this bill.
    Mr. Sumwalt. Thank you.
    Senator Klobuchar. Thank you.
    Senator Cruz. Senator Moran.

                STATEMENT OF HON. JERRY MORAN, 
                    U.S. SENATOR FROM KANSAS

    Senator Moran. Chairman, thank you very much. Thank you for 
conducting this hearing.
    Press and media reports, Mr. Elwell, indicate that Boeing 
was implementing changes in the Max after the first crash and 
that is at least an explanation for why they may be close to 
having a ``fix'' for that Max.
    Is there anything, a requirement that--first of all, is the 
FAA notified of that effort to make corrections to the Max 
after the first crash?
    Mr. Elwell. Senator, yes, the Boeing Company submitted an 
application for a software update to the MCAS, an MCAS software 
update after the Lion Air accident.
    Senator Moran. And is there a corresponding duty to warn 
either on the part of Boeing Corporation or the FAA either 
pilots or airlines, a duty to warn or a notification that there 
may be something wrong and a fix is on its way?
    Mr. Elwell. So nine days after the Lion Air accident, the 
FAA put out an Emergency Airworthiness Directive followed by a 
communique to all authorities around the world who fly the Max 
and what we pointed out was--back up a little bit.
    The FAA's role, primary role in any accident investigation 
is for continual operational safety. In other words, if in the 
course of an accident something of immediate import is 
discovered, we don't wait for the end of the accident for the 
final report. We act immediately and in this case, the initial 
data suggested that a reminder was needed and that's what the 
Emergency AD was, a reminder was needed for pilots and 
operators of this aircraft to apply standard runaway stab trim 
procedures should this be encountered and that's what the 
Emergency AD was.
    Now the software update that you're referring to is Boeing 
came to us with this and we talked to them about it. We 
accepted their application. They began work, but we determined 
that the issues that this software update was making, the 
things that it was improving upon for MCAS, did not warrant 
anything more than the announcement that this was in progress.
    Senator Moran. OK. Mr. Elwell, I'll stay with you for a 
moment longer.
    I suppose that there's always a question of why we would 
have a private company certify their product. In this instance, 
it happens in the aviation world. It happens all the time.
    What's the justification for that? We use ODAs, 
Organization Designation Authorizations, regularly. Would the 
FAA be able to certify aircraft without the use of that 
designation?
    Mr. Elwell. Senator Moran, that is a very important 
question, but let me go back to what you said in the question 
that we allow companies to certify their aircraft.
    Senator Moran. I know I misspoke in the way that you would 
phrase it and I understand the distinction. I'm not trying to 
discount the importance of an ODA.
    In fact, I'm hoping that you'll confirm to me the 
importance with proper oversight, with FAA certification 
required, the actions that are taken by private companies to 
provide the information necessary to certify is important and 
how would we do this in aviation without that process?
    Mr. Elwell. So the concept of ODA, as I said, has been 
around for 60 years and some form of delegation has been around 
since the 1920s. It is part of the fabric of what we've used to 
become as safe as we are today, and I don't want to give the 
impression that ODA is some resource, a way for us to sort of 
stretch our resources.
    We have very strict oversight on every participant in an 
ODA program and we make sure that they are experts in the 
field, that they have the appropriate understanding of FAA regs 
and manuals, they have professional integrity is checked, 
everything.
    But to your point, if we had no ODA at all, it would be an 
estimation that would require roughly 10,000 more employees to 
do that role at the FAA and about $1.8 billion for our 
Certification Office in the FAA.
    Senator Moran. How does that compare with--that process, 
that designation process compare to Europe and others across 
the globe when it comes to the use of that process?
    Mr. Elwell. So it's another excellent question. The 
European Aviation Safety Agency is the next, you know, biggest 
certification body in the world and they leverage ODA much more 
than we do. So it's used around the world.
    Senator Moran. So in this arena, there's nothing unusual to 
this process?
    Mr. Elwell. No.
    Senator Moran. It has been ongoing a long time and used 
globally, is that true?
    Mr. Elwell. Couldn't have said it better myself.
    Senator Moran. Thank you. Thank you, Mr. Chairman.
    Senator Cruz. Senator Blumenthal.

             STATEMENT OF HON. RICHARD BLUMENTHAL, 
                 U.S. SENATOR FROM CONNECTICUT

    Senator Blumenthal. Thanks, Mr. Chairman, and I want to 
thank the leadership of the Committee for having this hearing. 
Thank you for being here today, gentlemen, and I want to thank 
particularly the Inspector General, Calvin Scovel. We are lucky 
to have a professional of your caliber doing this investigation 
and I look forward to the results.
    I've been deeply disappointed, in fact shocked, that in 
grounding these aircraft, American safety officials in effect 
lagged instead of led the world. The same information was 
available to our FAA as was accessible to every other country 
that grounded its airline days ahead of us and that put 
American passengers in peril.
    But as important, maybe more so, is the system that led to 
in effect outsourcing safety to the manufacturers of these 
aircraft. Call it delegation or shifting, as you did. The fact 
is that the FAA decided to do safety on the cheap, which is 
neither cheap nor safe, and put the fox in charge of the 
henhouse. That was true of the 737 Max 8.
    In its rush to produce that aircraft because of competition 
from Airbus, critical safety features were disregarded, and I'm 
going to be introducing legislation that will reform this 
system which is so fatally riddled with flaws. There needs to 
be rigorous reform so that the FAA is put back in charge of 
safety.
    You said, Mr. Elwell, that the system is fact-based and 
data-driven. The FAA should have the facts and should be 
driving the data and making decisions. If the manufacturer has 
the facts and the data, not the FAA, if its employees chosen, 
hired, paid, fired by the manufacturer are the ones making 
these critical decisions and the FAA lacks all of the facts and 
data necessary to properly oversee them and overrule them, this 
system of oversight is failing.
    I will tell you I read some of the pilot reports. They're 
public. NASA has them. They provided them to me. They are 
chilling. If I'd been a passenger on one of those planes and I 
knew about these incidents, I would have wanted a parachute.
    Pilots of the airlines struggled to regain control of those 
aircraft in the same way that the pilots of the fatally crashed 
aircraft did. They succeeded, the others didn't.
    So I look forward to your support for legislation that will 
fundamentally change this flawed system.
    Mr. Elwell, have you reviewed those pilot reports?
    Mr. Elwell. Senator, thank you for your comments.
    I reviewed the reports. There were----
    Senator Blumenthal. Did you review them at the time that 
they were received by NASA?
    Mr. Elwell. The reports--I did not personally. The reports 
were reviewed as they were written and received. There were 24 
reports.
    Senator Blumenthal. Were they reported to you after the 
first crash because many of them followed the first crash?
    Mr. Elwell. The ASRS reports were reviewed and compared 
against the FDR data or FOQA data that we look at. ASRS reports 
are reports from pilots on experiences when they are on a trip. 
We take them very seriously. We review them. We have event 
review teams that sit down with the pilot and none of the 24 
reports associated with the Max related to the MCAS or related 
to what the pilots experienced in either accident.
    Senator Blumenthal. Well, I am familiar with the reports 
that were given to me----
    Mr. Elwell. Yes, sir.
    Senator Blumenthal.--and my time is limited here. Let me 
just ask you. Were you contacted by anyone in the 
Administration before making your decision to ground those 
aircraft?
    Mr. Elwell. From the moment, Senator, of the Ethiopian 
accident until we grounded on Wednesday morning, I kept 
Secretary Chao and the President briefed and fully apprised on 
all of our activities, which included, I would add, a full----
    Senator Blumenthal. Did she order you to ground the 
aircraft?
    Mr. Elwell. I'm sorry?
    Senator Blumenthal. Did she order you or otherwise 
recommend what your decision should be in grounding the 
aircraft?
    Mr. Elwell. Senator, the decision to ground, to make an 
emergency grounding of a fleet of aircraft is vested in the 
FAA. I made that decision.
    Senator Blumenthal. And one last question. I don't know 
whether you've seen a ProPublica report. It's just come to my 
attention. I think it came out today, which reports your 
contacts with airlines.
    Could you provide us copies of the e-mails between yourself 
and industry representatives and also a copy of your financial 
disclosure forms? I understand you had a consulting business 
while you were a part of the FAA, is that correct?
    Mr. Elwell. That's not correct, Senator. I'm happy to 
supply any and all communications.
    Senator Blumenthal. I want to give you a full opportunity 
to respond to the article that's just been provided to me, but 
it says that on those financial disclosure forms, you reported 
some income as a special government employee while you were a 
member of the FAA.
    Mr. Elwell. Happy to provide any and all information.
    Senator Blumenthal. Thank you. Thank you, Mr. Chairman.
    Senator Cruz. Senator Blunt.

                 STATEMENT OF HON. ROY BLUNT, 
                   U.S. SENATOR FROM MISSOURI

    Senator Blunt. Thank you, Mr. Chairman.
    So, Mr. Elwell, I think established in the questions with 
Senator Moran the long history of delegating certification. Let 
me ask a couple more questions about that.
    The Seattle Times recently reported that FAA technical 
experts and safety engineers said in interviews that they were 
urged to delegate more responsibility to Boeing during the 737 
Max certification process or to speed it up.
    Does the FAA still retain the mandate to certify aviation 
technologies that are new or novel?
    Mr. Elwell. Yes, Senator, we do. That is our authority and 
it's our sole authority. We do not allow self-certification of 
any kind.
    Senator Blunt. Were there any deviations from that policy 
in regards to the Boeing 737 Max?
    Mr. Elwell. Sir, none of which I'm aware. We have a very 
good whistleblower program at the FAA. We encourage all levels 
of employees to report any activity that they find that doesn't 
go with our safety culture and I looked into this personally. 
There were no comments made by employees to our knowledge. I 
can't speak to the Seattle Times article.
    Senator Blunt. And it's your view that FAA managers did 
conduct the kind of reviews of that delegated authority that 
they're expected to conduct?
    Mr. Elwell. Absolutely. Yes, sir.
    Senator Blunt. Well, let's go back to the investigation 
going on right now. I think, Mr. Sumwalt, you said that--I 
think you said that we were cooperating closely with the 
investigation, the Ethiopian investigation.
    Is that cooperating closely, is that the right phrase?
    Mr. Sumwalt. Well, I'd actually say we're actively engaged. 
We have investigators on the ground in Ethiopia that are 
assisting and advising the Ethiopian Government as well as 
helping them to put together a draft interim report.
    Senator Blunt. Are they cooperating closely with you then?
    Mr. Sumwalt. Yes, sir, they are.
    Senator Blunt. And are you getting access to all the 
information you'd like to have access to?
    Mr. Sumwalt. At this time, we are.
    Senator Blunt. I know it's a much smaller agency than your 
agency in terms of budget and size and experience. How would 
you compare this investigation to other investigations you've 
been involved in and what are you doing to make up differences, 
if there are differences?
    Mr. Sumwalt. Well, I don't want to sound like I'm bragging 
because I'm not. The NTSB has a lot of experience with 
investigating crashes. We've been in business for 52 years. So 
we have a lot of experience, but as an accredited 
representative to foreign investigations, we often find that 
other countries do not have the resources that we do. So we are 
very experienced with working with other countries, other 
states to help them, and I think that this investigation is 
going as it should.
    The Ethiopians, again this is, like I wasn't bragging and 
this next statement is not a derogatory statement, they don't 
have the experience that we have because they haven't 
investigated the number of crashes that we have over the years. 
They're a relatively new agency. So they are proceeding very 
deliberately and very cautiously.
    Senator Blunt. There was another comment made earlier about 
a prohibition unless information's been cleared by the host 
country. I believe the way I heard that, that was for you to 
share that information with others.
    Does that suggest that there's information that's not being 
shared with you?
    Mr. Sumwalt. I have no indication at all that the 
Ethiopians are not sharing with us the information that we need 
to make sure that we are aware of the safety-related 
information that we need to feed back to the FAA or feed back 
to Boeing to ensure continued airworthiness safety.
    Senator Blunt. And those earlier comments were about 
whether you could publicly share that information without the 
host government agreeing with that, is that right?
    Mr. Sumwalt. That is correct. However, the law does further 
state that nothing in this subsection shall restrict the Board 
at any time from referring to a foreign accident investigation 
information in making safety recommendations.
    So, in other words, if we identify safety-related 
information that we need to make a safety recommendation, then 
we can use that information, but we would always want to 
coordinate that ahead of time with the state of occurrence.
    Senator Blunt. So you don't feel unduly restricted by that 
prohibition of releasing information?
    Mr. Sumwalt. I do not, but it is--and to be clear, as 
you've characterized it, it is for the public release of 
information is what the law is specifically calling for.
    Senator Blunt. That's helpful for me.
    Mr. Scovel, do you want to comment on that?
    Mr. Scovel. Thank you, Senator Blunt.
    Not on that particular question. Thanks for recognizing my 
signal just for a moment. I may have information that may help 
you and the Committee in understanding the Seattle Times point 
that you mentioned in an earlier question, and I want to refer 
back to our 2015 Audit Report on ODA.
    In the course of that work, we reviewed four ODA company 
self audits that identified employee concerns about undue 
pressure which could lead to rushing safety-critical tasks to 
meet production schedules.
    Now I want to clarify these were not U.S. DOT Inspector 
General audits. These were company self audits that were 
required by FAA as part of its oversight process for ODA.
    It's unclear to us what FAA may have known about those 
company self audits. As I mentioned, there were four of them. 
Two involved Boeing in fact, one in the Seattle area dating to 
2013 and the other was from Boeing's Charleston, South 
Carolina, facility in 2014. The remaining two concerned Bell 
Helicopter, both in Ft. Worth, 2013 and 2014.
    We didn't step into the shoes of the safety regulator. It's 
not in our lane to do that, but when we learned about the self 
audits, we determined that it would be appropriate for us to 
make a recommendation to FAA that they find the best way to use 
those company self audits in order to enhance their oversight 
of the companies' ODA processes.
    Senator Blunt. When would you have made that 
recommendation?
    Mr. Scovel. That was in 2015, sir.
    Senator Blunt. Mr. Elwell, do you know what the follow up 
from the FAA was on that recommendation?
    Mr. Scovel. I can help you on that, too, sir. I'll pass to 
my colleague to take an answer on that, but I also have what is 
the auditor's answer, as well.
    Senator Blunt. And what was it?
    Mr. Scovel. We made the recommendation and FAA concurred. 
They took action to our satisfaction to address the 
recommendation, the intent behind it, and so we closed that 
recommendation.
    What remains to be done, and this is the typical audit 
process, is to see how it's effectively implemented going 
forward. So when we close a recommendation, it means that the 
agency is poised to execute it but it may in some cases be a 
matter of years before we return to see the effectiveness of 
that implementation.
    Senator Blunt. Mr. Elwell, do you want to add anything?
    Mr. Elwell. I'd like to thank the Inspector General. We did 
an audit of our whistleblower program and so I need to go back 
and look at this self audit information that General Scovel's 
talking about and----
    Senator Blunt. Then you'll respond to the record with what 
you find?
    Mr. Elwell. Absolutely.
    Senator Blunt. Thank you.
    Senator Cruz. Senator Duckworth.

              STATEMENT OF HON. TAMMY DUCKWORTH, 
                   U.S. SENATOR FROM ILLINOIS

    Senator Duckworth. Thank you, Mr. Chairman.
    And, Mr. Elwell, I want to touch on the training aspect of 
pilots in general of aircraft certified by the FAA and then 
also about the specific Max 8 aircraft.
    Would it be a true statement to say that U.S. pilots 
properly trained would know how to respond to an uncommanded 
nose-down pitch rate on an aircraft with an automated--I'll 
give you an example. I flew the Blackhawk.
    Mr. Elwell. Yes, ma'am.
    Senator Duckworth. It went through a real problem in the 
beginning of its development and to this day, I know the 
procedure for uncommanded nose-down rate, right.
    Mr. Elwell. Mm-hmm.
    Senator Duckworth. So I know it by heart. I will always 
know it until the day I die.
    Is that something that most pilots would be able to 
basically say what those steps or those memory items if they're 
properly trained under U.S. system?
    Mr. Elwell. Yes, Senator Duckworth, our American U.S.-
trained pilots of large commercial aircraft know that procedure 
and if I might,----
    Senator Duckworth. Yes.
    Mr. Elwell.--I wanted to amplify what we were doing prior 
to the grounding on Wednesday, one of the things we were doing, 
I was doing, is talking to the heads of all of the pilot groups 
that flew the Max and asking did they have reservations about 
the Max.
    This is in addition to data we got from 57--over 50,000 Max 
flights in North America, Canada and the U.S., and in those 
data reports, and those are data reports that are coming right 
off the airplanes, there was not a single case in North America 
of an MCAS malfunction or what we found happened in Lion Air, 
but that wasn't enough.
    I called and talked to the presidents of the Southwest 
Airline Pilots Organization, ALPA, over 53,000 pilots, and APA, 
the American Airlines Pilots Group, and asked them what is your 
experience flying the Max? What are your pilots saying? They 
said to a person, to a group we are absolutely confident in the 
safety of this aircraft and our pilots' level of training in 
flying it.
    If I hadn't had that information, the data, and the 
affidavits from those unions or from those pilot groups, I 
would not have been able--that's part of the data package I had 
to wait for the data from the accidents to justify a grounding.
    Senator Duckworth. Let me then ask you about--so we talked 
a bit about just responding to an uncommanded nose-down 
attitude. That aside, there's another procedure. My experience 
as a Blackhawk pilot, we have the stabilator that would slow 
down, killed a bunch of pilots, hurt a bunch of people, but the 
automatic control system, the basic procedure is reset. If it 
doesn't reset, turn it off, manual control, slow to zero at 
about 40 knots indicated airspeed. I know nothing you ever flew 
ever went as slow as 40 knots indicated airspeed as I did, slow 
and low pilots.
    The question I have for you is, while the MCAS is not 
specifically referenced in the aircraft manual for the Max 8, 
the procedure to shut off stabilizer trim switches are in the 
manual as a response to this, is that correct, and this is 
something that American pilots would be trained on?
    Mr. Elwell. Yes, ma'am.
    Senator Duckworth. Is this something that FAA, through 
ICAO, would ensure that other pilots in other countries should 
also be trained on?
    Mr. Elwell. When we interact at ICAO, it is usually not to 
the specificity of a fleet type, but we do use our influence at 
ICAO and our influence at the International Civil Aviation 
Organization is substantial and we use it at any opportunity we 
get to raise the safety level around the world.
    In fact, we don't have the final reports on either of these 
accidents, but I have already set in motion at the FAA 
activities to go to the Assembly and, as you know, I'm sure, 
ICAO meets every 3 years and we're already examining what we 
bring to the Assembly this year, our country, our pilots, to 
help raise the safety bar, which is, as you know, we're 
responsible for aviation safety in the United States, but there 
are no boundaries, there's no border. It's a global endeavor.
    We care deeply about other countries and we have over a 
hundred technical assistance agreements around the world. We 
have 20 bilateral aviation safety agreements with 47 countries. 
We're very, very passionate not just about safety in the U.S. 
but that every country raises their safety bar.
    Senator Duckworth. So are you saying that we need to look 
at strengthening the International Aviation Safety Assessment 
Program and do you plan on doing that in the next ICAO meeting?
    Mr. Elwell. The International Aviation Safety Assessment 
Program, I think, is sound. It's very good. The IASA that we do 
with countries around the world--because what we do is we 
evaluate the Civil Aviation Authority and a healthy Civil 
Aviation Authority tells you that that country has a good 
culture for everything--airports, pilots, airlines--but by 
working to help raise the standards overall, then when we do an 
IASA in a country and we do a rating, we'll be rating against 
higher standards and I think that that's appropriate and it's 
well worth our attention.
    Senator Duckworth. Thank you. I'm out of time, Mr. 
Chairman. Thank you.
    Senator Cruz. Senator Capito.

            STATEMENT OF HON. SHELLEY MOORE CAPITO, 
                U.S. SENATOR FROM WEST VIRGINIA

    Senator Moore Capito. Thank you, Mr. Chairman. Thank all of 
you for being here.
    Mr. Elwell, let me just make sure I understand exactly 
because some of the questioning from Senator Duckworth is 
similar to what I was going to ask you.
    So the plane, the 737 Max 8 with MCAS, has been flying 
since 2017, is that correct?
    Mr. Elwell. Yes, ma'am.
    Senator Moore Capito. OK. And you said, and I have a report 
here that says, in the wake of the Airworthiness Directive and 
discovery of possible issue with MCAS on Boeing 737 Max, this 
is quoted from an article in Bloomberg, I believe, it says, ``A 
number of pilot groups raised concerns over whether or not 
pilots had been sufficiently made aware of the system that is 
unique to that aircraft.''
    Did you just say that nobody had raised issues about this 
system previous to either one of these accidents or maybe in 
between the two of them?
    Mr. Elwell. Senator, what I was remarking upon is we look 
at the data that comes off aircraft that's called FOQA data and 
please don't ask me what the letters mean, but what that is, is 
data that literally comes off the flight data recorder. It's 
ones and zeroes that come off of aircraft and airlines get that 
data.
    They use that data in their safety management systems and 
when we ask for that data and we ask for it to be filtered on 
certain parameters, they give that data to us and what I'm 
saying is there were no incidents on Max flights in North 
America. There was no incident of this happening.
    Now when I say also that the pilot reports that Senator 
Blumenthal mentioned earlier, the ASRS or the NASA reports, I 
personally read--there were 24 of them. I read every one of 
them and I'm not the key expert in this determination, but they 
were all looked at and determined and I concurred none of them 
went to the MCAS. None of them demonstrated an MCAS malfunction 
and that's what I meant.
    Now what you're referring to----
    Senator Moore Capito. What am I referring to?
    Mr. Elwell. Senator, I believe what you're referring to is 
when the accident first happened, there were some pilots who 
said we would have liked to have read about that MCAS. We would 
liked to have known that. That wasn't in the manual. One of the 
things that we did in our Emergency AD was direct to have MCAS 
explained in the flight operating manual.
    Senator Moore Capito. OK. So that was in between the first 
accident and the second accident?
    Mr. Elwell. Yes, ma'am.
    Senator Moore Capito. OK. Then let me ask then you about 
the training then that occurred after that. It's given in a 
short self-administered online course. How does that work? Are 
you in a testing center? Are you on your own in your own laptop 
and you just check box, box, box? How's that administered? How 
is a self--I mean, we've all taken self-administered computer 
tests. How do you ensure that this is absorbed and that the 
person actually taking it is the person taking it?
    Mr. Elwell. Well, first of all, as a former pilot myself, I 
will tell you that when you go through differences training and 
that's what that is, differences training,----
    Senator Moore Capito. Mm-hmm.
    Mr. Elwell.--that isn't something you pencil with because 
it's the aircraft you fly.
    Senator Moore Capito. Right.
    Mr. Elwell And our pilots in the United States are 
incredible professionals. Now they can do that. They can do 
that when they go to the Academy, when they go to the school--
--
    Senator Moore Capito: Right.
    Mr. Elwell.--for their respective airline. They can do that 
in recurrent training. They can do it in initial training. I 
imagine, and although I can't tell you now if this is the case, 
that they could also do it on their computers at home, but all 
of that training has a test at the end, a quiz at the end to 
test for knowledge, and the important thing to note here is 
that the determination was made because of the flying 
characteristics of the Max versus the NG that this iPad 
training that you read about was what was needed by pilots to 
be able to fly the plane.
    Senator Moore Capito. So was that required then in between 
the two in the United States?
    Mr. Elwell. It was always required.
    Senator Moore Capito. It was always required.
    Mr. Elwell. Yes, ma'am.
    Senator Moore Capito. Let me ask you about another sort of 
thing that you've seen out in the press and I don't really have 
it specifically here and in terms of the fix to the airplane.
    There are certain fixes that are going to be offered to 
certain airlines and there may be different pricing and how 
much is it going to be. There has been sort of a conflicting 
story in the media. How do you respond to that? Do you know 
anything about that?
    Mr. Elwell. So, Senator, I read those reports or I read 
those articles, and those I don't believe were characterized as 
fixes. Those are options.
    When an airline or anybody purchases an airplane like 
anything else, there are options. As I was explaining before, 
if it is a safety-critical display in the cockpit and we 
certify it, it's required. It's not an option.
    Senator Moore Capito. Right.
    Mr. Elwell. So, you know, AOA displays, some airlines and 
some pilot training, the pilots and pilot training groups, for 
instance, the Navy, you know, love AOA displays in the 
cockpits. The Air Force not so much.
    It is a matter of every piece of real estate in a cockpit 
is precious and you put one gauge up there, you're sacrificing 
another.
    Senator Moore Capito. Right.
    Mr. Elwell. These are important distinctions and in this 
case, those displays are not safety-critical because there are 
other ways for pilots to gauge their energy state and that's 
what an AOA gauge does. It tells you your energy state.
    Senator Moore Capito. Well, not understanding the 
technicalities of it, I would say that being a member of the 
general flying public, it's hard to believe that a safety item 
that could possibly be connected to taking down two jets and 
killing over 300 people would ever be characterized as any kind 
of an option.
    Mr. Elwell. Right.
    Senator Moore Capito. So I want you to have the chance to--
and I understand it is more technically involved than what I'm 
representing, but that's how it's perceived to the flying 
public.
    Thank you.
    Mr. Elwell. Thank you.
    Senator Cruz. Senator Markey.

               STATEMENT OF HON. EDWARD MARKEY, 
                U.S. SENATOR FROM MASSACHUSETTS

    Senator Markey. Thank you, Mr. Chairman.
    Mr. Elwell, as the safety agency entrusted to provide the 
safest, most efficient aerospace system in the world, the FAA 
must ensure that aviation safety is not a luxury that can be 
bought and sold for an extra fee, but for Boeing, critical 
safety features that could have saved the lives of 346 souls on 
two of their 737 Max 8s were yet another profit center deemed 
optional, like premium seats or extra bathrooms or fancy 
lighting. That's wrong, just plain wrong, Mr. Elwell.
    Boeing sold two safety features, the angle of attack 
indicator and the warning lights, to the airlines for an 
additional fee, not as a standard part of the aircraft. These 
features could have alerted the pilots and aviation mechanics 
that the doomed aircraft had faulty sensors which preliminary 
findings suggest are the cause of these two aviation disasters.
    Let's be clear. In our automobiles, we don't pay more for 
seatbelts, for airbags, or in medicine for childproof caps. 
Those aren't optional. Those are all built-in as safety 
features to protect people, to protect families, and so should 
all critical safety features on aircraft.
    Administrator Elwell, do you believe that Boeing's practice 
of selling the angle of attack indicator and warning lights as 
separate optional features may have contributed to the Lion Air 
and Ethiopian Airline crashes? Yes or no?
    Mr. Elwell. Well, Senator, thank you for that question.
    The AOA indicator, the AOA vane is not an optional piece of 
equipment on the airplane. We look in the certification process 
that we've been using for decades that we've refined over 130 
times is geared toward one thing, the safest possible----
    Senator Markey. Should all of the safety features have been 
mandatory that could have alerted pilots and mechanics to 
issues with the sensors? Should they have been mandatory? Yes 
or no?
    Mr. Elwell. Senator, safety-critical pieces of equipment on 
an aircraft are mandatory. That's what certification does. If 
it's safety-critical,----
    Senator Markey. So you don't think that they should have 
been mandatory? Is that what you're saying? Is that what you 
just said? They should not have been mandatory?
    Mr. Elwell. Sir, I'm saying that any----
    Senator Markey. Yes or no? Should they have been mandatory? 
Yes or no?
    Mr. Elwell. Sir, the distinction between what goes in a 
flight deck and what stays out is a discussion and whether or 
not a display is safety-critical or not is a distinction that 
FAA is qualified to make.
    Senator Markey. Do you believe that charging additional 
fees for these safety features and other safety features, like 
backup fire extinguishers in the cargo hole and oxygen masks 
for flight crews, may discourage airlines from equipping their 
airlines with important safety systems? Yes or no?
    Mr. Elwell. Well, Senator Markey, I find it hard to believe 
that a safety company like an airline would save a couple 
thousand dollars on an option that might improve safety on a--
--
    Senator Markey. It may be hard for you to believe, but it's 
happening and as a result, the safety agency has a 
responsibility to make sure that an airline doesn't place----
    Mr. Elwell. Absolutely.
    Senator Markey.--profit over people's safety. Do you agree 
with that?
    Mr. Elwell. Senator Markey, I would tell you that----
    Senator Markey. Do you think the FAA has the responsibility 
to tell these airlines that they cannot change safety for 
profits when it's clear that that safety device plays a huge 
role in protecting the plane and its passengers? Yes or no?
    Mr. Elwell. Senator Markey, that is our fundamental 
responsibility.
    Senator Markey. Yes or no? Should that be mandatory?
    Mr. Elwell. Senator Markey, the fundamental role of the FAA 
is to determine what the safety-critical aspects of every part 
on that airplane----
    Senator Markey. Should the FAA ban the practice of airlines 
selling safety features ala carte to the airlines? Yes or no?
    Mr. Elwell. Senator Markey, I will tell you that if there 
is any manufacturer that sells a safety-critical part ala 
carte, we will not permit it.
    Senator Markey. Well, if you change the rules so that they 
cannot do this, then that will be progress, but if business as 
usual continues, then passengers are going to continue to be 
vulnerable. So from my perspective, safety should never be ala 
carte. Safety should never be optional. Safety should always be 
mandatory and that's why I have sent a letter with 16 of my 
colleagues to Boeing demanding that they never again have any 
safety option as something that is discretionary with their own 
profit model.
    It is absolutely unacceptable and it's unacceptable for the 
FAA to delegate to an airline what is safe, what is not, what 
they can afford, what they cannot. This should not be an 
option. Seatbelts, airbags, or whatever's in an airline should 
never be optional.
    So my view is that until the FAA finally stands up and says 
that this is something that must change, then we are going to 
have problems, big problems, and that's why I'm introducing 
legislation with my colleagues to ensure that this never 
happens again and that when something is determined to be a 
safety feature that it no longer is an option for the airline 
to include it or else we will just continue to see continued 
repetition of what is happening because ultimately 
overconfidence breeds complacency and complacency breeds 
disaster.
    We've seen it here and we'll see it again, unless we 
mandate safety as something which is not optional.
    Thank you, Mr. Chairman.
    Senator Cruz. Senator Rosen.

                STATEMENT OF HON. JACKY ROSEN, 
                    U.S. SENATOR FROM NEVADA

    Senator Rosen. Thank you, Chairman Cruz, and thank you to 
all the witnesses for being here.
    You know, I spent most of my career working as a computer 
programmer and systems analyst with the focus on software. In 
fact, in the 1980s, I worked for Hughes Aviation working out of 
the General Aviation Terminal in Las Vegas, helping them write 
programming that would assist in airplane maintenance and 
inventory.
    So from that perspective, I am very concerned about what 
I've read and heard regarding the software for the 737 Max 8s 
and Max 9s. Pilots have told me that there's significantly more 
new software on these planes than usual and this is because 
planes don't actually fly like a 737 without the software. The 
physics of the plane is just a little bit different.
    So, Mr. Scovel, let's talk a little bit about new 
certification. Is this really a 737 or does it require a new 
original certificate, and given that this plane, which is 
equipped with highly advanced software and is flying today in 
2019, I just want to say today is 2019, is flying off an 
original certificate that was issued, and I'm sure you know 
this well, in 1967. The Beatles were the top of the charts in 
1967, no cell phones, no technology, very different, so 
different kind of plane.
    So do you think there could be some loopholes in the 
current certification system that makes it perhaps a little bit 
too easy for an airplane manufacturer to continue to buy this 
or get a new original certificate?
    I want to ask one other thing. If you can or supply this in 
writing, can you tell us how many derivative certificates have 
been issued for the 737 since it's originally been certified 
over 50 years ago? It kind of seems like we had a canoe in 1967 
and today you're certifying the cruise ship. They're not the 
same.
    Mr. Scovel. Thank you, Senator.
    To your second question, I will defer to Mr. Elwell. I 
believe he and FAA are in a better position than I am or my 
office is to give you that particular number.
    Senator Rosen. You can supply that in writing.
    Mr. Scovel. Yes, ma'am.
    Senator Rosen. That would be fine. Thank you.
    Mr. Scovel. Be happy to.
    Senator Rosen. And then you can answer the first question 
about running off the 1967 certification.
    Mr. Scovel. Right. I don't know the answer to your 
question. We have not completed that audit work yet. We can 
include it as a point that we will cover and we'd be happy to 
report back to you and the rest of Congress and the Secretary.
    Senator Rosen. Does it seem reasonable to think that you 
should have a new certification or some updates since 1967, 
except updates to the user manual, and that's fine. I'll look 
for that in writing.
    I want to go on to enforcement versus compliance at the 
FAA. So some have argued that in recent years, the FAA's safety 
philosophy has moved from one of enforcement to one of 
compliance where, instead of penalizing safety violations 
without penalty, the agency has instead given industry the 
opportunity to correct the safety violations without penalty in 
order to comply with FAA regulations.
    So, Mr. Elwell, would you say that this is an accurate 
characterization of the FAA's current approach?
    Mr. Elwell. Thank you, Senator Rosen.
    Compliance is the end game, enforcement is a tool, and when 
we have a stakeholder in the system that is unwilling or unable 
to comply with our regulations, enforcement is aggressively----
    Senator Rosen. So would you say that this is the current 
approach, enforcement versus compliance? Yes or no? Do you 
think?
    Mr. Elwell. Senator Rosen, what I'm saying is that 
compliance is the end game and that's why it's called the 
Compliance Program because we have enforcement as a tool but we 
also work with people to fix their problems because it's much--
we've found in our years of safety regulation that it is a much 
more productive model, and this is not something that we just 
changed a couple years ago. This is an organic development of 
our safety philosophy over decades, that when you work with 
somebody who has made an honest mistake to get----
    Senator Rosen. So we're going to say that's a no. So you're 
working on compliance. So if that's not the case and the FAA's 
robustly enforcing safety regulations, what steps can we now 
take to ensure that rules are in place to prevent this from 
happening again, and if proactive enforcement is paramount, why 
did it take the first Max 8 crash for the FAA even to begin the 
process of requiring Boeing to make software changes to prevent 
these deadly malfunctions?
    Mr. Elwell. Senator Rosen, the process by which we improve 
safety is an oversight process that it is constantly refined, 
ongoing. It involves compliance activities and it involves 
enforcement.
    What we have with Lion Air and Ethiopia are two tragic 
accidents, the reasons for which we still don't know.
    You can be assured by the FAA and by me that when the 
results of these accidents come out, anything that we can 
change and make better, we will. That's what we do. That is the 
primary reason for our existence is to improve safety, but we 
have to get all the data. We have to get all of the results 
from the accident investigation. We don't know the cause, the 
primary causes of these accidents, but when we do, you have my 
assurance that we will take the action necessary that they 
don't happen again.
    Senator Rosen. Thank you. I have one last question about 
the software.
    You mentioned that it masks, it masks the problem for the 
pilots, so that the pilots feel like the plane is flying the 
way it should. It'd be like if I was driving my car and a wheel 
flew off but my steering wheel still felt as if I had four 
wheels.
    So why would you have software that would mask a problem 
like this? Can you explain?
    Mr. Elwell. Senator Rosen, thank you for asking that 
question because if that's the impression I gave on what MCAS 
does, then I'm sorry because that's not what it does. It 
doesn't mask a problem.
    Senator Rosen. Well, you said it makes the plane feel like 
it's flying to the pilot like it should.
    Mr. Elwell. Well, see, what fly-by-wire technology does and 
that's what the Max is, you know, when planes were first 
designed and flown, the yoke was connected to cables and 
pulleys and so you had direct interaction, physical interaction 
with the flight controls. Pilots had the feel, sort of like 
when you're driving your car, you turn the wheel.
    Senator Rosen. Right. So the instrument's telling you one 
thing and the feel's telling you another with the MCAS?
    Mr. Elwell. No, that's not quite how it works. What the 
MCAS does is it is a computer program that feeds information to 
the yoke so that the input the pilot makes to the yoke is 
proportional to what the flight controls do. It doesn't mask 
any problem. What it does is give the proper feel to a pilot 
because he doesn't have those cables and pulleys.
    Senator Rosen. So he would feel as if the nose were going 
down, going up, whatever he would feel?
    Mr. Elwell. He would feel it and in fact that is what 
happened and that's what happens if any computer or any device, 
even the pitch trim motor, does something to the nose of the 
airplane, the pilot's going to feel it.
    Senator Rosen. Would feel that in his----
    Mr. Elwell. Yes, yes, absolutely.
    Senator Rosen. Thank you very much. I appreciate it.
    Senator Cruz. Senator Udall.

                 STATEMENT OF HON. TOM UDALL, 
                  U.S. SENATOR FROM NEW MEXICO

    Senator Udall. Thank you, Chairman Cruz and Ranking Member 
Sinema, for holding this important hearing, and I know you guys 
have been here for two hours. So I'll try to just get to the 
point here.
    I first requested an aviation hearing on aviation safety 
last April when in Albuquerque we lost a shining light, a woman 
by the name of Jennifer Riordan. She was flying home from 
Philadelphia on a Southwest Airlines flight when a fan blade 
caused an engine to fail, you guys are nodding you understand 
this one, shattered a window and partially pulled Mrs. Riordan 
out of the plane.
    This incident was shocking but it was not the first time 
this engine type failed, and I know that this is just a first 
of a series of conversations on how we can improve the 
oversight of the Federal Aviation Administration, including 
rethinking, if necessary, the airworthiness certification 
process.
    Another important issue we must discuss is the integrity of 
the engines that are used. Many of us may not be aware but 
yesterday, Southwest Airlines 727 Max engine, a CFM Leap 1B, 
had an emergency landing during a flight to the Southern 
California Logistics Airport. This is at least the third 
Southwest Airlines that has had an emergency airline caused by 
engine troubles, all stemming from the same manufacturer of 
engines.
    Mr. Chairman, I would seek unanimous consent to add an 
article on these engine troubles from the Seattle Times to the 
record.
    Senator Cruz. Without objection.
    [Seattle Times newspaper article follows:]

  The Seattle Times--Originally published June 15, 2018 at 6:00 am / 
                   Updated June 18, 2018 at 10:37 am

  Troublesome advanced engines for Boeing, Airbus jets have disrupted 
                     airlines and shaken travelers

           By Dominic Gates--Seattle Times aerospace reporter


[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    In 2014, Air New Zealand and Boeing showed off the first delivered 
787-9 Dreamliner at Paine Field in Everett as finishing touches were 
put on the casing of a Rolls-Royce Trent 1000 engine. (Mike Siegel/The 
Seattle Times)

    A slew of technical problems with the three latest-technology jet 
engines is widely disrupting operations at airlines, bleeding cash from 
the engine makers and grounding significant numbers of Airbus and 
Boeing jets.
    A slew of technical problems with the three most advanced models of 
jet aircraft engines is widely disrupting operations at airlines, 
bleeding cash from the engine makers and grounding significant numbers 
of Airbus and Boeing jets.
    The most difficult of the issues has this month left almost 50 
Boeing 787 Dreamliners sold to some of the world's top airlines sitting 
powerless on the ground, waiting for engines before they can fly again.
    And if the problem isn't contained, it could derail Boeing's plan 
to raise the 787 production rate next year.
    British engine manufacturer Rolls-Royce has been inspecting its 
Trent 1000 engines on the Dreamliners for cracked turbine blades deep 
inside, and taking off those with cracks for repair.
    The number discovered to have problems has ``outstripped our 
ability to support the customers with spare engines,'' said Trent 1000 
project director Gary Moore in an interview.
    ``We are causing a very disproportionate amount of disruption at 
this moment.''
    Steve Udvar-Hazy, chairman of Air Lease Corp. and a leading figure 
in the airline world, said disruption from the grounded jets is 
compounded by airlines having to reroute some of the Dreamliners they 
can still fly.
    Flights across the Pacific, in particular, can no longer fly normal 
routes because, in case of an engine emergency, safety agencies now 
limit Dreamliners powered by one of the Trent 1000 engine models under 
scrutiny to flying no more than 2.3 hours from the nearest airport--
down from 5.5 hours previously.
    ``It's having a huge impact. It affects a lot of the key 787 
operators,'' said Udvar-Hazy. ``There's a lot of scrambling going on.''

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

No quick fixes
    The impact won't be short term.
    Rolls is returning the repaired engines to airlines with only a 
temporary fix. A permanent modification won't be available until the 
end of the year at the earliest.
    ``Those engines will have to come back to us when the final fix is 
available,'' said Moore.
    Meanwhile, repeated technical problems with another engine--Pratt & 
Whitney's Geared Turbofan (GTF), the innovative new design that will 
power close to half of the Airbus A320neo fleet--have caused Pratt to 
fall way behind in deliveries, leaving engineless planes to stack up on 
the ground at Airbus factories.
    At a gathering of the world's top airline executives in Sydney this 
month, Guillaume Faury, the new president of Airbus Commercial 
Aircraft, said that by the end of June the European jetmaker will have 
about 100 otherwise completed A320neos sitting grounded without engines 
outside its final-assembly plants in Toulouse, France, and Hamburg, 
Germany.
    ``We have an industrial crisis to manage,'' Faury told trade 
publication Aviation Week.
    In comparison, the problems with the third engine--CFM 
International's LEAP engine, which powers the rest of the Airbus 
A320neos and all of Boeing's 737 MAXs--are less severe.
    Boeing says it's been able to minimize the impact on MAX 
deliveries. But CFM had to remove dozens of LEAP engines from A320neos 
for repair, and LEAP deliveries to Airbus are running up to six weeks 
behind schedule.
Problems emerge late
    These latest engines, all marvels of sophisticated engineering, 
incorporate significantly new technologies: new alloys in the Trent 
1000, a gearbox to slow the fan speed in the GTF, ceramics in the 
hottest part of the LEAP.
    All were certified as safe by the Federal Aviation Administration 
(FAA) and its European equivalent, the European Aviation Safety Agency 
(EASA).
    And all three are powering the latest generation of fuel-efficient 
Airbus and Boeing aircraft where production rates are rising sharply to 
levels never before anticipated: heading up to 14 jets per month for 
the widebody 787, and to 60 jets per month and higher for the 
narrowbody 737 and A320 aircraft.
    ``The new technology aircraft bring tremendous economics and 
operating performance to the airlines, but they are only as good as the 
engines,'' said Udvar-Hazy. ``We have never seen this unprecedented 
number of aircraft scheduled to be produced at the very time when we 
have all these engine issues.''
    Unfortunately, so-called ``teething problems'' with new technology 
may not show up until the engines have been used for several thousand 
hours in all kinds of climate conditions.
    ``The issue with engine certification is that's there's really no 
substitute for in-service experience,'' Hazy said.
    FAA spokesman Les Dorr said the safety agency monitors newly 
certified engines after they enter service for issues ``that were not 
evident in the certification phase.''
Most Read Business Stories

  1  Apple says it plans to turn Seattle into `key engineering hub' 
        with 2,000 new workers

  2  Seattle is `a notable exception' for stalled home prices

  3  Sellers in Amazon's bookstore feel beaten up by counterfeit Wild 
        West

  4  Housing crunch sends bigger populations to smaller towns

  5  Nintendo's Doug Bowser begins his reign, enjoying jokes about his 
        namesake Mario nemesis

    And when engine makers come up with fixes to such issues, they 
cannot be installed on airplanes until the FAA analyzes, tests and 
certifies the changes.
    ``Engine modifications undergo the same scrutiny. . .as original 
designs,'' Dorr said.
Airline trouble
    The public's belief in airplane and jet-engine safety is 
understandably shaken by terrifying accidents such as the April engine 
explosion on a Southwest Airlines 737 that killed a female passenger 
when shrapnel from the engine shattered the window by her seat, 
depressurizing the plane and partially sucking her out of the aircraft.
    Yet that was the first U.S. airline-passenger fatality due to an 
accident in more than nine years, and the first in Southwest's history. 
The engine that exploded, the CFM-56, has been in service since 1997, 
has flown for some 350 million flight hours and has a reliability 
record second to none.
    Statistically, flying is the safest form of modern travel.
    Jet engines have become so immensely reliable that four-engine 
airliners are fading into the past. Planes with just two engines safely 
traverse vast expanses of oceans every day. If one engine fails in 
flight, those jets readily fly for hours on the remaining engine to the 
nearest airport.
    And all the newest engines send critical performance data to the 
ground in real time while in the air, so any irregularities are quickly 
detected.
    The latest engine issues have produced in-flight engine shutdowns 
and aborted take-offs but no incidents that put passengers at risk. So 
for the airlines, the risk is more to the reliable operation of the 
airplanes than their safety.
    Still, even the potential for the flaws to affect both engines of a 
twin-engine plane while in flight was enough to spook safety regulators 
to issue directives restricting flights on both the Rolls and Pratt 
engines.
    And the trouble created for the airlines, for Airbus and Boeing, 
and especially for the engine makers, is serious and very expensive.
    To satisfy the safety regulators and mitigate the impact on airline 
operations, Rolls, Pratt and CFM are throwing engineering resources and 
money at the technical problems.
    ``It's a very painful thing for all of them,'' said Udvar-Hazy.
    On Friday, Rolls updated its projection of the cost of dealing with 
the Trent engine crisis to a total of almost $950 million.
787 engine flaw
    The latest hit to Rolls came when it was still dealing with the 
fallout from an earlier Trent 1000 technical problem: corroded turbine 
blades in the hot rear section of the engine.
    After redesigning those blades with a new base metal and a new 
coating, retrofitting the engines in service is still ongoing.
    The more recent, and now more pressing, problem showed up when 
cracks were found in the roots of the blades of the Intermediate-
Pressure Compressor (IPC), behind the fan at the front of the engine.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    Technicians make adjustments to a Rolls-Royce. . . (Mike Siegel/The 
Seattle Times) More

    Moore pointed to a design flaw: The vibrating frequency of the 
compressor blades resonated with the frequency of the engine at high 
thrust, magnifying the vibration to a level that over time caused the 
cracks to develop.
    The immediate need was to inspect the susceptible engines--
initially the ``Package C'' version of the Trent 1000, a total of 383 
engines--and remove any with cracks for repair.
    The problem intensified when fractured blades and excessive 
vibration led to several inflight engine shutdowns and aborted 
takeoffs.
    In response, safety regulators gave Rolls until June 9 to complete 
an initial set of inspections on Package C engines that have clocked 
more than 300 flights, though all will have to be inspected eventually.
    Two days after that deadline passed, Rolls announced that the 
problem had spread: It found cracks in the IPC blades in a small number 
of engines that are a different Trent 1000 variant, the ``Package B'' 
model.
    That adds another 166 Dreamliner engines that must be inspected.
Intense response
    Rolls must act fast or its rival GE, which also builds Dreamliner 
engines, will grab its market share.
    Within a month of finding the original IPC problem, Rolls engineers 
developed and certified an ultrasonic inspection method to detect the 
invisible cracks in the interior of the blades without taking the 
engines off the wing.
    It opened facilities in Singapore and the U.K. dedicated solely to 
those repairs--dismantling the engines, replacing the cracked blades, 
treating the remaining blades to close up any invisible micro-cracks, 
and applying a protective lubricant.
    British Airways, Air New Zealand, Virgin Atlantic, Norwegian and 
LATAM Airlines of Chile were among the airlines forced to ground jets 
when engines were removed for repair with no replacements.
    Willie Walsh, chief executive of British Airways parent IAG, said 
six of the airline's 26 Dreamliners are currently grounded, and he now 
expects he won't get all of those back in service until late July.
    ``I have no issue with Boeing, who have been proactive and 
supportive . . . I am however, very unhappy with Rolls-Royce,'' Walsh 
said, via e-mail. ``They have yet to give us confidence that they are 
on top of the problem.''
    British Airways and Virgin Atlantic leased Airbus A330 aircraft to 
fill the schedule gap. Air New Zealand leased two Boeing 777s to fill 
in. Norwegian leased a four-engine Airbus A340 gas-guzzler to fly its 
Paris-Los Angeles route.
    Rolls hopes by year end to certify a permanent fix--a redesigned 
blade with tolerances tweaked to shift its resonant frequency.
More on Aerospace
    Bombardier sells CRJ jet program to Mitsubishi for $550M
    SpaceX launches hefty rocket with 24 satellites, experiments
    `I'm having a bad dream': Air Canada reviews how crew left 
passenger on parked plane
    The inside story of MCAS: How Boeing's 737 MAX system gained power 
and lost safeguards / Times Watchdog
    Trump shifts to talk of Air Force One
    SpaceX, Boeing continue to struggle with spacecraft designs, as 
watchdog raises safety concerns
    Moore said Rolls engineers are now testing the first modified 
hardware in a development engine at a facility in Derby, U.K., to 
verify that ``we have moved the blade's frequency to a point where I no 
longer have concerns.''
    A second test engine will be used to confirm that the engine's 
overall operation is unaffected by the change to the blades.
    Next year, Rolls plans to gradually remove all those repaired 
engines once again to install the permanent modifications.
    Meanwhile, Boeing deployed teams worldwide with Rolls-Royce to try 
to mitigate the disruption at affected airlines and tapped senior 
executive Keith Leverkuhn to work directly with Rolls.
    ``Keith and I talk every day,'' said Moore.
Knife-edge seal
    For Pratt & Whitney's new GTF engine, developed starting in the 
early 2000s at a cost of more than $10 billion, the advance worry was 
that it might run into trouble with the engine's big technology 
innovation: the gearbox that allows the fan to run slower and more 
efficiently.
    It turns out the gearbox has operated smoothly with no issues. 
However, the GTF did run into a rash of other ``teething problems.''
    Though Pratt developed fixes for all of them and the latest engines 
it's building are up to date with those fixes, GTF production has been 
hampered and delayed, and deliveries to Airbus were interrupted.
    Spokeswoman Jenny Dervin said the latest problem arose after a 
batch of engineering changes were introduced last December to improve 
the durability of the High Pressure Compressor (HPC).
    Instead, the changes caused ``the knife-edge seal'' in the HPC's 
aft hub to fracture, resulting in sudden vibration and engine stall in 
some A320neos. This led to several inflight engine shutdowns and 
aborted take-offs.
    ``By the end of January, we knew we'd have to recall the engines,'' 
Dervin said.
    Only 98 engines had been built with the defective seals--43 in 
service and another 55 still at the Airbus final assembly plants.
    In February, EASA issued an airworthiness directive prohibiting 
airlines from flying any plane that had the defect on both engines. 
India's air-safety regulator grounded planes having even one such 
engine.
    By now, no GTF engines flying anywhere have the defective seal. For 
Pratt, what remains is to clear the backlog of engines to be delivered 
to Airbus.
Loss of a thin coating
    For CFM's LEAP engine, and specifically for Boeing's 737 MAX, the 
introduction into service has been smoother. On the MAX and the Airbus 
A320neo, LEAP engines are now powering 342 aircraft with 56 airlines.
    However, the LEAP was hit by one technical glitch related to a key 
innovation: a ceramic composite lining that shrouds the hottest part of 
the engine, the first rotor of the High-Pressure Turbine just aft of 
the fuel combustion chamber.
    This ceramic material requires a thin protective coating. Rick 
Lowden, a research scientist at Oak Ridge National Laboratory, which 
developed the ceramic material, said that without such a coating, 
moisture in the gas emerging from the combustor will oxidize the 
ceramics and gradually ``eat it away.''
    CFM spokeswoman Jamie Jewell said engineers found a ``premature 
loss'' of this coating in service.
    ``This is not a safety or operational issue,'' Jewell said, adding 
that the problem hasn't caused any incidents during thousands of hours 
of engine tests and more than a million engine in-service flight hours.
    To fix it, CFM designed a new coating. That's being introduced into 
full-rate production for aircraft deliveries starting this month.
    And about 60 LEAP engines were removed from A320neos for 
modification, none from 737 MAXs.
    ``Each of those removals were scheduled in advance and we are 
supporting the removals with around 70 spare engines,'' Jewell said.
    Boeing said that there have been some delays in delivery of MAX 
engines but so far no airplane deliveries are late.
Flying hotter, tighter and harder
    Airlines today operate jet engines harder than ever before. They're 
built to tighter tolerances and operate at higher pressures and hotter 
temperatures.
    They fly many more flights and much longer flights than in the 
past.
    Boeing projects that the 2016 worldwide airliner fleet of 23,500 
jets will double in the next two decades, swelling the number of 
engines in the sky.
    But near term, the plans by Airbus and Boeing to hike A320neo, 737 
MAX and 787 production significantly in the next two years cannot 
happen until the engine makers sort out their problems and ramp up 
production.
    To deliver the reliability airlines demand on the narrowbody jets, 
Pratt & Whitney and CFM must hope no further teething pains develop.
    Rolls-Royce faces a more existential crisis.
    It's separately going through a drastic financial and corporate 
restructuring costing $670 million and on Thursday announced layoffs of 
4,600 employees over the next two years.
    A Rolls nightmare would be if the same blade-durability problems 
show up later on the remaining variants of the Trent engine: the newest 
version for the 787 the Trent TEN, or the Trent XWB for the Airbus 
A350, or the Trent 7000 for the Airbus A330neo.
    To survive, Rolls needs to convince airlines soon that the Trent's 
technical problems are finally contained.

    Senator Udall. My first question will be to Mr. Scovel.
    As you heard, a constituent of mine was killed last year in 
the Southwest Airlines accident because of a CFM engine 
failure. You have initiated an audit of the safety practices.
    What is your timeline for completing this audit and will 
you include this most recent engine failure in your inquiry?
    Mr. Scovel. Thank you, Senator.
    For your first question, our timeline, we anticipate 
completing our review of Southwest Airlines maintenance 
practices by the end of this summer. We're looking not only at 
maintenance practices but also at certain operational issues to 
include and weight balance questions, and also a concern that 
was brought to our attention about Southwest's acquisition of a 
certain number of used aircraft and the fact that they may be 
flying in the United States reportedly without proper 
documentation. We don't know. That's one of the things that we 
need to look into to complete our audit.
    Senator Udall. And are you going to use the most recent 
engine failure in your inquiry?
    Mr. Scovel. We'll see what we can derive from that. The one 
last night, sir, off the 737?
    Senator Udall. All three of the ones I mentioned.
    Mr. Scovel. For the first two, yes and we'll see what 
information is available to us regarding the most recent one. 
Yes, sir.
    Senator Udall. Chairman Sumwalt, in your testimony, you 
referenced a Southwest Airlines accident that took the life of 
Ms. Riordan. I know the initial investigative hearing was held 
in November, but I'm concerned about the impact that the 
government shutdown may have had on the investigation. As you 
can imagine, the Riordan family is anxious to receive the 
information from the investigation.
    Can you tell me when the final report will be ready?
    Mr. Sumwalt. Yes, sir. Thank you for that question.
    I was the board member on scene in Philadelphia. I'm very 
familiar with that tragic event. In November, we pointed out in 
the investigative hearing that we had some modeling and some 
structural analysis to do. We have completed that. We're in the 
process now of drafting the final report.
    So the report will be completed later this year. I will say 
if we find any need for any urgent safety recommendations, we 
are postured to be able to do that.
    Senator Udall. Great. Thank you.
    Mr. Scovel, one other question for you. As you know, Boeing 
is one of the largest, most powerful companies in the country, 
and a major government contractor with deep and wide 
connections in Washington. This plane was key to Boeing's 
future financial success. The company was locked in an intense 
competition with Airbus. Reporting has indicated that the FAA 
faced vigorous lobbying to approve the design and features of 
this plane so it could get it to market as soon as possible.
    Political appointees were urging career staff to get the 
work done and a huge portion of that safety review work was 
taken on by Boeing itself so that it was self-certifying its 
own safety.
    Given the size of Boeing and their political power, do you 
think the FAA is truly capable of regulating them in an 
independent way, and what changes need to be made in the 
relationship between this company and its regulator to ensure 
that the safety of the flying public remains the paramount 
interest, not the quarterly profits of this company?
    Mr. Scovel. Senator, FAA has authority, complete authority 
currently to exercise responsibility over----
    Senator Udall. Are they too cozy? Are they too cozy? That's 
my pointed question right there with the industry.
    Mr. Scovel. I don't have information yet to directly answer 
your question. The focus of the first part of our ongoing audit 
will be the certification process that FAA and Boeing employed 
to approve the 737 Max. We hope to have some information 
that'll inform your decisionmaking on that when we complete our 
audits.
    Senator Udall. Well, it is good. It's really important and 
in this age where we talk about captured regulators and things 
like that that you weigh in on these kinds of issues about are 
they truly capable of doing their job.
    Thank you, and thank you for the courtesies, Mr. Chairman, 
for going over.
    Senator Cruz. Thank you, Senator Udall.
    Mr. Elwell, there were a couple of factual issues that came 
up during the course of the hearing that we're going to follow 
up with written questions and ask you to clarify.
    One factual issue on which there was dispute, as you and I 
discussed, the New York Times and others have reported that on 
the earlier versions of the 737 when you pull back the yoke 
that it disengaged the stabilization system but that that did 
not happen on the 737 Max.
    Your testimony to me, if I understood correctly, was that 
that was not correct, although I heard Chairman Sumwalt 
disagree on that point.
    So we're going to ask you in writing to clarify how the 
system operates. I think it's important to have a shared set 
of--an agreed set of facts and to understand.
    Likewise, when I asked you about the simulations that 
pilots did as part of the certification, I asked in particular 
if any of those simulations involved a faulty sensor producing 
faulty data and how to respond to it.
    My recollection is you were not certain as to the answer of 
that. So I'm going you to go and verify and give us a clear 
answer to that.
    [Mr. Ellwell's answer follows:]

    The MCAS system is designed to assist pilots during manual 
operation. On earlier versions of the 737, and on the 737 MAX, pulling 
back on the yoke disables the speed trim system, but does not disable 
the MCAS on the 737 MAX.

    Senator Cruz. I want to read to you some portions of an 
article from Reuters from March 19, 2019, that purports to 
describe what happened on the Lion Air crash and Reuters 
reported, ``The pilots of the doomed Lion Air Boeing 737 Max 
scrambled through a handbook to understand why the jet was 
lurching downwards in the final minutes before it hit the 
water, killing all 189 people onboard, three people with 
knowledge of the cockpit voice recorder contents said.''
    The article goes on to describe, ``The captain was at the 
controls of Lion Air Flight JT610 when the nearly new jet took 
off from Jakarta and the first officer was handling the radio, 
according to preliminary report issued in November. Just two 
minutes into the flight, the first officer reported a ``flight 
control problem'' to the air traffic control and said the 
pilots intended to maintain an altitude of 5,000 feet.
    First officer did not specify the problem but one source 
said airspeed was mentioned on the cockpit voice recording and 
a second source said an indicator showed a problem on the 
captain's display but not on the first officer's. The captain 
asked the first officer to check the Quick Reference Handbook, 
which contains checklists for abnormal events, the first source 
said.
    For the next nine minutes, the jet warned the pilot it was 
in a stall and pushed the nose down in response, the report 
showed. A stall is when the air flow over a plane's wing is too 
weak to generate lift and keep it flying.
    The captain fought to climb but the computer still 
incorrectly sensing a stall continued to push the nose down 
using the plane's trim system. Normally trim adjusts an 
aircraft's control surfaces to ensure it flies straight and 
level.
    They didn?t seem to know that the trim was moving down, the 
third source said. They talked only about airspeed and 
altitude. That was the only thing they talked about.''
    Do you have any reason to doubt that account of what 
occurred in the final minutes of that flight?
    Mr. Elwell. Well, Senator, the information I have is that 
actually there has not been--and I would defer to Chairman 
Sumwalt on this, but----
    Senator Cruz. Please chime in, as well.
    Mr. Elwell.--that the cockpit voice recorder is not 
available to--I certainly haven't seen a readout and if I did, 
to Chairman Sumwalt's point earlier, I wouldn't be at the 
liberty to even talk about it.
    But I would--and this actually is linked to what you said 
earlier about the confusion about whether the 737 Max, when you 
pull back, it stops, and I will admit to not having flown it 
and maybe not getting that right, but what certainly--and I 
will react to what you read, but I will qualify it by saying it 
is entirely possible that what was written is not accurate.
    But I will tell you, as I said numerous times in this 
hearing, pilots of large aircraft are trained from day one when 
the pitch of the aircraft is doing something you're not telling 
it to do, you do runaway pitch trim checklist and in every 
plane I've ever flown, it's called the Memory Item. You're not 
fumbling through books. It's a time-critical procedure and you 
go to that. You do it in the sim when you fly. It's a memory 
item.
    So some of what you read there, I can't tell you if that's 
accurate. I can't tell you if that's straight from the 
investigation or CVR. It disturbs me because it is not the way 
I was trained and what I would expect pilots to do in that 
situation.
    Senator Cruz. You have any explanation for why something 
like this might have happened, if the report is accurate?
    Look, I'm not a pilot, but certainly the picture that is 
painted there of the pilot frantically looking through the 
checklist as the nose continues to adjust downward and as the 
pilot is unable to correct that problem, that is not an image 
that instills comfort or confidence, and it does not suggest 
that the pilot is aware of how to correct for the system that 
is adjusting the nose downward.
    Do you have any explanation in terms of the training that 
pilots undergo, how that would come to be?
    Mr. Elwell. Mr. Chairman, it would be inappropriate for me 
to comment any further on, first, an article whose veracity I 
can't ascertain right now, and I've no comment on--other than, 
yes, it sounds like a terrible situation, but I have no way of 
knowing that that account is accurate. So it would be 
inappropriate for me to comment on it.
    Senator Cruz. But there's nothing in the pilot training 
that the FAA required about the MCAS System and how to correct 
for it, is that accurate?
    Mr. Elwell. Senator, the MCAS is not something you fly. 
It's not something you would get in a simulator and fly the 
MCAS.
    Senator Cruz. I didn't say you'd fly the MCAS. I said 
there's nothing in the pilot training about the MCAS System 
adjusting the nose of the plane downward and how to compensate 
for that in the event of a malfunctioning sensor. Is that 
accurate that the training does not include that?
    Mr. Elwell. Senator, Senator, I would actually say that it 
is accounted for in the training and the accounting for that in 
the training is that that MCAS--inappropriate input of the MCAS 
is runaway pitch trim and runaway pitch trim is trained and 
trained and trained by every pilot who flies a large aircraft.
    Senator Cruz. Chairman Sumwalt, do you have any additional 
points on this line of inquiry?
    Mr. Sumwalt. No, sir, I do not.
    Senator Cruz. OK. One final avenue of questions, Mr. 
Scovel.
    I want to draw your attention to a June 22, 2012, 
memorandum from your office titled FAA Transport Airplane 
Directorate, Seattle, Washington. Are you familiar with this 
document?
    Mr. Scovel. Yes, I am, Mr. Chairman.
    Senator Cruz. Good. The 2012 memorandum specifically states 
that your office's investigation ``substantiated employee 
allegations that TAD,'' which is the FAA's Transport Airplane 
Directorate, ``and FAA Headquarters managers have not always 
supported TAD employee efforts to hold Boeing accountable,'' 
and it further discusses TAD employee concerns that Boeing 
employees in the Boeing Certificate Office might have 
``delivery of airplanes as part of their performance 
standards.''
    The concerns described in that memo paint a troubling 
picture of agency capture. Do the concerns in the 2012 memo, do 
you still have those concerns, and do you see an ongoing 
pattern like that described in the 2012 memo?
    Mr. Scovel. Mr. Chairman, I'm confident they fully describe 
my office's findings at the time in 2010, 2011, and early 2012, 
when we were doing the investigation work that led to that 
memorandum from the Office of Inspector General to FAA.
    I don't know in 2019 whether those conditions still 
prevail.
    Senator Cruz. Well, this Subcommittee will eagerly await 
your investigation and assessment of that question because it 
is a critical question for evaluating ongoing safety.
    Senator Blumenthal.
    Senator Blumenthal. Thanks, Mr. Chairman.
    Let me just ask a few questions pursuing that same avenue, 
Inspector General Scovel.
    I'm assuming that that issue of agency capture or improper 
influence will be part of the investigation you're doing in 
response to my request, correct?
    Mr. Scovel. Yes, it certainly will be, and I should add 
we're always on the lookout for it. We've called it out in the 
past.
    Senator Blumenthal. That's your job.
    Mr. Scovel. It is. We've done it several times with 
individual FAA employees in their roles as inspectors at 
Southwest, at American most recently, and in a report that we 
issued last summer, and in the 2012 report involving FAA 
employees at the FAA ODA Oversight Office in Seattle.
    Senator Blumenthal. So you'll be looking for any calls or 
contacts from Boeing or airlines or anyone else that may have 
impacted the FAA decisionmaking?
    Mr. Scovel. It's part of the certification process and 
that's what you and the Secretary and others have requested. 
That's the mail we're going to answer, sir.
    Senator Blumenthal. Mr. Elwell, when we finished, we were 
talking about the decision to ground the airplanes, which you 
said was your own exclusively, correct? How did it happen then 
that it was announced by the President?
    Mr. Elwell. Senator Blumenthal, as I testified earlier, 
from the moment of the Ethiopian accident and I became first 
aware of it till I grounded the airplanes, I briefed and kept 
the Secretary and the President apprised of all of our actions, 
as I would always do with something this significant, and 
shortly after--leading up to and then shortly after making the 
decision to ground the aircraft, I again briefed the Secretary 
and the President and the President, it came to my attention, 
was very shortly thereafter going to an already-planned press 
event and as is his prerogative as Commander-in-Chief, he 
talked about the briefing that I gave and what my intentions 
were and it actually preceded the official announcement of the 
Emergency Order.
    Senator Blumenthal. So you briefed him----
    Mr. Elwell. So that was the timing.
    Senator Blumenthal. You briefed him directly?
    Mr. Elwell. I briefed the President and the Secretary on my 
decision and the data and the actions that led up to it.
    Senator Blumenthal. Had he contacted you or anyone else in 
the White House contacted you previously to that time?
    Mr. Elwell. I kept the White House or the President and the 
Secretary fully briefed and apprised of my actions leading up 
to the grounding.
    Senator Blumenthal. So between the time of the second crash 
and the announcement of your decision, there were contacts 
between you and the White House?
    Mr. Elwell. I briefed the Secretary and the President on 
the developments and kept them apprised.
    Senator Blumenthal. And they gave you their views as to 
whether the plane should be grounded?
    Mr. Elwell. Well, sir, I briefed them on where I was going 
with my data collection and my thinking right up until I 
grounded the aircraft.
    Senator Blumenthal. And let me repeat my question in case 
it wasn't clear.
    Mr. Elwell. Yes, sir.
    Senator Blumenthal. Did they indicate to you, did they 
express to you their views on whether that plane should be 
grounded?
    Mr. Elwell. Well, Secretary Chao never gave me any--told me 
to ground or anything like that and consistent with 
longstanding Executive Branch practice over many 
Administrations, I'm not going to go into details of 
conversations I had with the President.
    Senator Blumenthal. Well, what's your claim of the reason 
to refuse to answer that question?
    Mr. Elwell. Well,----
    Senator Blumenthal. Is that executive privilege? There is 
no executive privilege.
    Mr. Elwell. No, Senator. No, Senator. I'm just saying that 
consistent with longstanding Executive Branch practice, many, 
many Administrations, I'm not going to sit and get into details 
about my conversations with the President. It's a longstanding 
Executive Branch practice.
    Senator Blumenthal. Really?
    Mr. Elwell. Yes, sir.
    Senator Blumenthal. Well, are you telling me that you are 
not going to tell this committee what the President told you 
about grounding the aircraft before you made that decision?
    Mr. Elwell. Senator, I am just simply saying that I'm not 
going to get into details about conversations I had with the 
President. It's a longstanding Executive Branch practice.
    Senator Blumenthal. I'm not aware of that longstanding--is 
that grounded in law and, if so, what law?
    Mr. Elwell. Well, sir, I am not a lawyer, but I'm not going 
to talk about conversations that I had with the President.
    Senator Blumenthal. Well, I can't force you to. I don't 
think we can order you because we don't have that authority as 
of right now, but I'm going to pursue that issue.
    Mr. Elwell. Yes, sir.
    Senator Blumenthal. Let me ask you. Under the ODA, is there 
protection for whistleblowers if and when they come forward?
    Mr. Elwell. Sir, it is my understanding that there's 
protection for whistleblowers at all times, ODA or otherwise.
    Senator Blumenthal. Well, let me rephrase it. Is there 
protection for whistleblowers at Boeing? In other words, the 
Boeing employees who have responsibility, they're hired, fired, 
potentially disciplined, if they make decisions adverse to the 
company' interests?
    Mr. Elwell. Well, Senator Blumenthal, that is an excellent 
question, and I'm not sitting here knowing. I don't know 
Boeing's policies with regard to employee whistleblowers. There 
may in fact be in the agreement, the ODA Agreement that we have 
with the manufacturer a requirement for them to take on our 
whistleblower protections, but I will get back to you. I'm not 
sure sitting here.
    Senator Blumenthal. I appreciate your getting back to me. 
You're not aware of any protection for whistleblowers as you 
sit here?
    Mr. Elwell. I'm not aware that there is or there aren't, 
but I will get back to you, sir.
    Senator Blumenthal. Are you aware of any whistleblowers 
coming forward about the Boeing 737 Max 8?
    Mr. Elwell. I'm not aware of whistleblower complaints 
particularly to what was being discussed earlier about 
management pressure particularly. I've not gotten any from FAA 
employees. In fact, one charge that was in one article that it 
was claimed that FAA employees in Seattle were being rated 
against production rates and I did look into that to see if 
there was any evidence of that or any complaints in that area 
and the answer was no.
    Senator Blumenthal. Are you aware of any incentive bonuses 
or payments by Boeing for certification decisions?
    Mr. Elwell. You mean Boeing incentives to their employees?
    Senator Blumenthal. Well, they're the ones who are employed 
in this Certification Program, the ODA, right?
    Mr. Elwell. Correct. And I'm not aware of that.
    Senator Blumenthal. OK. I just have a couple more 
questions. I really appreciate it, Mr. Chairman.
    You and I talked in a briefing that you were kind enough to 
provide some time ago and you indicated in response to one of 
my questions about the government shutdown that it was not in 
any way responsible for the delays in the development of new 
software for the MCAS System, correct?
    Mr. Elwell. Yes, sir.
    Senator Blumenthal. So you are saying that any reports of 
the impact of the government shutdown on any of the issues 
involved here is not true?
    Mr. Elwell. Well, Senator Blumenthal, I remember the 
question and we actually got the question. The reason I was 
able to answer you is because we had had that inquiry earlier 
and we checked and for the work that we had to do on the 
software update, we actually recalled the individuals. There 
was no delay in the certification or the work on that and 
because of our role of continuous operational safety, there 
was--the shutdown did not impact our examination or 
participation in continual operational safety post Lion Air.
    Senator Blumenthal. And I think you explained to me that 
the reason was that those employees were deemed to be essential 
to safety----
    Mr. Elwell. Yes, sir.
    Senator Blumenthal.--and therefore essential employees, as 
well.
    Mr. Elwell. Yes, sir.
    Senator Blumenthal. Just a couple more questions. On the 
issue of training, and I appreciate the courage and strength of 
the families coming to Congress and I'm struck by I guess the 
feeling I would have that the training here really could and 
should have been better for these pilots, and I know that the 
investigation will go into the technical issues, but as a 
passenger and a layman, my feeling was the training should have 
been better. Would you agree?
    Mr. Elwell. Senator Blumenthal, foreign accidents, as 
Chairman Sumwalt mentioned, bring with them investigative 
challenges. We are at the very earliest stage in the Ethiopian 
accident.
    Our responsibility of continuous operational safety means 
that if anything comes out of these investigations that goes 
directly to training, we would know about it so that we could 
relay that information to the pilots and the system we oversee.
    Of course, we don't oversee and regulate the training of 
foreign practices but we do audit the Civil Aviation 
Authorities of countries that fly to the U.S. and I believe 
that this is an area that we will look into very, very 
carefully because I believe we can use the FAA's credibility 
internationally and despite what you might read in the press, I 
believe that the FAA still is the gold standard, still has the 
credibility around the world to make change.
    We fight for it all the time. Our goal is to raise the 
safety bar everywhere and that?s what I'm going to try to do 
for the rest of my time in government service.
    Senator Blumenthal. Well, I'm hoping and I am going to take 
that answer as a yes because I think very unequivocally the 
training should have been better and I welcome steps to make 
sure it is better in the future. Thank you.
    Senator Cruz. And let me follow up on Senator Blumenthal's 
questions, both about training and whistleblowers. I want to 
ask in particular about a March 12 article in the Dallas 
Morning News that was entitled Several Boeing 737 Max 8 Pilots 
in the U.S. Complained About Suspected Safety Flaw, and the 
article begins by saying, ``Pilots repeatedly voiced safety 
concerns about the Boeing 737 Max 8 fleet to Federal 
authorities with one captain calling the flight manual 
``inadequate and almost criminally insufficient'' several 
months before Sunday's Ethiopian air crash that killed 157 
people.
    Are you familiar with these pilot complaints that are being 
referenced in the Dallas Morning News story?
    Mr. Elwell. Mr. Chairman, I am. That is a report, part of 
the group of 24 reports that I reviewed personally and that the 
FAA has reviewed. They are ASRS reports, otherwise known as 
NASA reports. They were the first foray in our efforts to have 
voluntary reporting and the history is important on voluntary 
reporting with regard to ASRS reports.
    I wrote many of them in my time as a commercial airline 
pilot and the reason that they were in place is we wanted to 
see if pilots could make reports of mistakes that they've made 
in the field out in the system and be indemnified as long as it 
was an honest mistake. Could we gather enough data and 
information to make safety enhancements and make the system 
better? It's been one of the most successful programs that 
we've issued.
    Now when I did them, I handwrote them. They weren't 
Flintstone but they were--I handwrote them. Now they're 
computer-entered and we looked at every one of those reports. 
Now I don't know if the one you just quoted went to an event 
review team, but when we find in these reports charges or 
problems that need to be addressed more robustly, that's what 
we have. We have an event review team. We bring the person who 
made the report in with airline officials, with FAA officials, 
and we sit down and we review the report.
    That particular report, as I said, there have been 57,000 
flights since we introduced the Max in the U.S. and that, to my 
knowledge, is the only report of its kind from a pilot about 
the inadequacy of the manuals. Like anything, we do a risk-
based analysis. We look at the body of reports and the body of 
data.
    I will look into whether or not that individual and his 
complaint was addressed appropriately and get back to you.
    Senator Cruz. OK. I would very much appreciate that. I will 
say as someone who flies myself every week on commercial 
airlines and my family flies every week and millions of 
Americans fly regularly on these planes, we need the flying 
public to have confidence about safety and I'll also note in 
the state of Texas, tens of thousands, if not hundreds of 
thousands of jobs depend upon the aviation industry and so that 
confidence is critically important, and I have to say as a 
passenger, I would certainly find it troubling.
    [Mr. Elwell's answer follows:]

    ASRS report 1593017 notes that a Boeing 737 MAX Captain expressed 
concern that the flight manual did not fully describe the Maneuvering 
Characteristics Augmentation System (MCAS) and the Angle of Attack 
(AOA) system. Although we investigated this report and determined the 
assertions were not actionable, the certification of the MCAS software 
fix will include additional information on the MCAS function.

    Senator Cruz. This is according to the Dallas Morning News, 
a captain, if the captain is describing the training manual as 
``inadequate and almost criminally insufficient,'' that is a 
pretty serious charge and so I would appreciate your getting 
back with the basis of that.
    Does that complaint that is referenced and those other 
complaints, does that trouble--I want to give Chairman Sumwalt 
and Mr. Scovel an opportunity to comment on that story and 
those allegations.
    Mr. Sumwalt. Chairman Cruz, in a former life, I was a 
consultant to the NASA Aviation Safety Reporting System and one 
of the caveats that ASRS puts around their data is that they 
are unverified and that there are various reporting biases 
known and unknown. They put these caveats on every ASRS 
request.
    If you were to request data, they would put those caveats 
there and it would not surprise me if, after the Lion Air 
crash, when pilots said, oh, my goodness, I never knew about 
this MCAS System and this really bothers me and I'm going to 
fill out the report.
    So I think it's imposrtant to keep all of this in 
perspective. So that report in its own doesn't necessarily 
concern me, but what we do want to look at is to look at the 
training adequacy overall.
    Senator Cruz. Mr. Scovel.
    Mr. Scovel. Thanks, and I appreciate the perspectives of 
both the Administrator and the Chairman.
    We will be looking, as I mentioned at the very beginning of 
the hearing, into documentation, what was included in the 
manuals and the decisionmaking that went into that and beyond 
that to the actual training for pilots.
    I am aware of the ASRS entry that you mentioned. My staff 
and I were reviewing that the other week. So we're factoring it 
into our questions.
    Senator Cruz. Are you able to shed any light on those 
complaints?
    Mr. Scovel. I'm not.
    Senator Cruz. That one in particular certainly stands out.
    Mr. Scovel. I'm not, but it does go to the question of what 
did they know and when did they know it. So this is after the 
Lion Air incident. Some things were bubbling up within ASRS, as 
both my colleagues have testified. Was that factored into FAA's 
decisionmaking going forward? We can consider all that fairly, 
I think.
    Senator Cruz. Well, I want to thank each of you for being 
here, for testifying on very short notice. These issues are of 
grave concerns to Americans across the country and to the 
Senate. So I appreciate your testimony.
    The hearing record is going to remain open for two weeks 
and during that time, Senators are asked to submit any 
questions for the record and upon receipt, each of the 
witnesses are requested to submit your written answers to the 
Committee as soon as possible.
    And with that, this hearing is adjourned.
    [Whereupon, at 5:35 p.m., the hearing was adjourned.]

                            A P P E N D I X

     Response to Written Questions Submitted by Hon. John Thune to 
                         Hon. Daniel K. Elwell
    Question 1. Mr. Elwell, you mentioned in your testimony that in 
response to the October 29 Lion Air Crash, FAA issued an Emergency 
Airworthiness Directive on November 7 requiring 737 MAX operators to 
revise flight manuals to reinforce training on how to recognize and 
respond to stabilizer trim movement not initiated by the crew.
    Could you describe current training procedures for recognition and 
response to these ``runaway'' stabilizer trim events on Boeing 737 
models?
    Answer. The procedure for runaway stabilizer trim directs the pilot 
to perform the following tasks:

  1.  Control Column, hold firmly

  2.  Disengage autopilot and control airplane pitch manually with 
        control column and electric trim

  3.  Disengage autothrottle

  4.  If runaway trim continues, turn off both of the stab trim cutout 
        switches

      a.  If runaway trim continues, grasp the trim wheel and perform 
            stabilizer trim manually

    This procedure is to be performed immediately by either memory or 
by quick reference checklist and as such training for this procedure is 
covered in initial ground training and on a recurrent basis thereafter. 
The training program is developed by the air carrier and approved by 
the FAA.

    Question 2. How did the training procedures required by the 
Emergency Airworthiness Directive issued in November 2018 differ from 
the procedures described above?
    Answer. The Emergency Airworthiness Directive issued on November 7, 
2018, reinforced the application of existing flight crew procedures to 
be used in those circumstances when uncommanded stabilizer trim is 
encountered.

    Question 3. Mr. Elwell, the notice of proposed rulemaking for 
Remote Identification of Unmanned Aircraft Systems was delayed from May 
1 of this year to July 21. As you know, this rulemaking is a critical 
component of integrating unmanned aircraft systems into U.S. airspace.
    Could you speak to how this delay might affect other pending 
regulatory actions related to UAS?
    Answer. The FAA plans to finalize its policy concerning remote 
identification of small UAS--by way of rulemaking, standards 
development, or other activities that other Federal agencies may 
propose--prior to finalizing the proposed rule permitting operations of 
small UAS over people and operations at night, published in the Federal 
Register on February 13, 2019.

    Question 4. As a follow-up, do you foresee any potential challenges 
related to this rulemaking that could cause further delays?
    Answer. The remote identification of UAS is a complex issue. The 
rulemaking the FAA is developing must ensure that the safety and 
security of the National Airspace System is maintained, while proposing 
requirements for the identification of UAS that are technologically 
feasible and not cost prohibitive. This balancing requires 
consideration of the interests and concerns of many diverse 
stakeholders, including our Federal interagency security partners; 
State and local law enforcement; the development and production 
timelines of UAS manufacturers; UAS operators ranging from large 
industry to small businesses to recreational flyers, and more. We are 
working to ensure that the rule we propose addresses the concerns we 
have heard from our interagency security partners, while also 
reflecting the current and future state of UAS development, innovation, 
and industry/public adoption.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. Maria Cantwell to 
                         Hon. Daniel K. Elwell
    Question. Please provide additional detail on the work that FAA did 
on MCAS, and the work that was then delegated.
    Answer. The FAA conducted several types of technical reviews 
associated with the Stabilizer Trim System (STS) and related 
Maneuvering Characteristics Augmentation System (MCAS) functionality. 
These included project scope reviews (known as familiarization), 
reviews of System Functionality and aspects of Software Development 
Assurance, and reviews of the System Safety Assessment (SSA) status for 
the STS.
    These reviews allowed us to consider intended function, evaluate 
the related guidance material, and assess system failure conditions and 
appropriate crew actions. These reviews and further discussions with 
Boeing did not identify any unique or new/novel regulatory aspects, 
areas outside of ODA authorization, or other areas requiring FAA 
involvement. As a result, the FAA delegated the responsibility for 
determining MCAS regulatory compliance to the ODA.
    Aggressive maneuvers (wind up turns) and full stalls were flown by 
FAA test pilots during FAA certification testing in simulators and in 
the aircraft. Several dozen FAA certification flights were flown by FAA 
test pilots in the aircraft between May 2016 and November 2016 to 
evaluate: Maneuvering Characteristics, Stall Characteristics, Stall 
Identification and various failure modes of the flight control system, 
including failures to the speed trim (MCAS) system. In all of these 
tests, MCAS was active and routinely performing its intended function.
                                 ______
                                 
    Response to Written Question Submitted by Hon. Amy Klobuchar to 
                         Hon. Daniel K. Elwell
    Question. At the hearing, we discussed how the FAA allows 
manufacturers to sell certain safety features as optional add-ons to 
airlines for an additional charge. As you know, neither of the two 
Boeing 737 Max aircraft involved in the recent Ethiopian Airlines and 
Lion Air crashes had an angle of attack indicator or a disagree light. 
How many safety features listed by the FAA as ``optional'' detect 
sensor malfunctions like we saw in these recent crashes?
    Answer. Required safety standards and features for large aircraft 
are established in 14 CFR part 25 (``Airworthiness Standards: Transport 
Category Airplanes''). Features required to meet those safety standards 
are mandatory on all FAA-certified aircraft, including the Boeing 737 
MAX. There are no optional safety standards or features.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Tom Udall to 
                         Hon. Daniel K. Elwell
    Question 1. The Boeing 737 first made flight in 1967 and there have 
been a significant number of changes to the original configuration of 
the 737. Can you outline the number of different air craft 
certification configurations that Boeing has applied for?
    Answer. Boeing has applied for 14 models of the 737.

  (1)  737-100 Series (1967)

  (2)  737-200 Series (1967)

  (3)  737-200C Series (1968)

  (4)  737-300 Series (1984)

  (5)  737-400 Series (1988)

  (6)  737-500 Series (1990)

  (7)  737-700 Series (1997)

  (8)  737-800 Series (1998)

  (9)  737-600 Series (1998)

  (10)  737-700C Series (2000)

  (11)  737-900 Series (2001)

  (12)  737-900ER Series (2007)

  (13)  737-8 MAX (March 2017)

  (14)  737-9 MAX (February 2018)

    Question 2. Administrator Elwell, Mr. Scovel pointed out in his 
testimony that the 2015 DOT Inspector General report found that the 
QUOTE ``FAA performed oversight of only 4 percent of personnel 
conduction certification work on the Agency's behalf at suppliers in 
the period [it] reviewed.'' It is my understanding that the FAA is 
revamping this process. But do you have the staffing necessary to 
increase the oversight necessary?
    Answer. Yes. The FAA has the personnel necessary to perform the 
referenced oversight functions under current processes.

    What are the FAA's plans to increase training opportunities to 
ensure that staff with these responsibilities will have the expertise 
necessary to perform oversight of highly technical systems?
    Answer. The FAA supports its technical staff through access to 
leading providers of training and through engagement opportunities with 
other technical experts, including standards bodies, industry 
associations, conferences, and universities. The FAA also has Chief 
Scientific and Technical Advisors (CSTA) who provide in-depth seminars 
and workshops for their individual areas of expertise. The CSTA program 
was established in 2002 to address rapid technological advances in 
aviation safety. CSTAs possess high levels of knowledge and skill in 
specialized disciplines. When needed, the CSTAs support FAA 
certification staff in evaluating complex technical issues.

    Question 3. What are you doing to retain current employees?
    Answer. Retaining employees when industry is doing well is a 
challenge. There are, however, many factors as to why employees may 
choose to stay with the agency. One of these factors is the clarity and 
importance of the mission. We also utilize internal and external 
resources to provide professional development and training 
opportunities. We have several programs to provide mentoring and 
temporary management assignments for employees actively seeking 
advancement.

    Do you have resources to bring on additional staff?
    Answer. The Aircraft Certification Service has the resources to 
hire sufficient staff under current processes.

    And, if so, what are you doing by way of recruitment efforts to 
bring more of these employees on board?
    Answer. The FAA is collaborating with academic partners to provide 
a focused curriculum related to aviation safety to facilitate job 
opportunities for qualified candidates. We participate in job fairs, 
seminars, and science and technology conferences. In addition, we 
support science, technology, engineering, and mathematics (STEM) 
activities across the Nation to promote aviation safety and 
certification professions.

    Question 4. If you are able, please tell us the direct chain of 
reporting for the Boeing Max 800 process and if the managers who were 
responsible for this certification are still charged with these 
responsibilities.
    Answer. The Boeing Aviation Safety Oversight Office, Boeing 
Certificate Management Office, Seattle Aircraft Evaluation Group, and 
Northwest Flight Test Section are the FAA offices responsible for the 
airplane level certification and production of the 737 MAX. The 
development of the certification basis for the 737 MAX, including any 
applicable regulation or policy developed during a certification 
project, e.g., through issue papers, also involves the FAA Transport 
Standards Branch.
    The office responsible for the oversight of the Boeing Organization 
Designation Authorization (ODA) and related certification projects is 
the Boeing Aviation Safety Oversight Office. There are three first line 
managers and one branch manager for the office. The 737 MAX 
certification was a 5-year project that started in 2012. Since 2012, we 
have had a number of changes in personnel, consistent with any large 
organization.

    Question 5. It is important to receive clarification on some issues 
that circulated about the Boeing Max 8 jets. I will ask you a series of 
Yes/No questions. The New York Times reported on March 19th that senior 
FAA employees were unaware of the changes in the software that is in 
question. Can you confirm if this software was certified by the FAA?
    Answer. Yes, the software described in the article was approved by 
the FAA.

    Did any FAA employees sign off on training manuals?
    Answer. Yes, the recommended training was approved by the FAA.

    Question 6. Boeing has said the redundancy for the system in 
question were the pilots--even though many pilots were unaware of the 
changes made to the 737 Max. Given your experience as a pilot, are you 
aware of another example of any other component with critical safety 
mission not to have some kind of redundancy built-in?
    Answer. In reference to system failures that can jeopardize 
controlled flight, there are single failures that require pilot 
response or action, including:

   Engine failure (at any time, but especially during takeoff 
        ground roll)

   Landing gear failure to deploy

   Engine or cargo fire

   Failure of an air data computer

   Flight control surface jam

   Failure of certain components in flight control systems 
        (actuator, control structural items such as a rod or actuator 
        mount, cable break, etc.)

    Question 7. Does FAA still maintain the others grounded ``too 
early?''
    Answer. The FAA made its grounding decision on March 13 based on 
refined satellite data and evidence found at the accident scene. This 
information solidified the similarities between the Lion Air and 
Ethiopian Airlines accidents. The FAA stands by its decision-making on 
grounding the 737 MAX.

    Question 8. Is it appropriate for the POTUS and the CEO of Boeing 
to be discussing a matter like this vs leaving it up to the career 
expert?
    Answer. The FAA's primary focus is safety. We value and rely upon 
the advice of FAA career aviation safety experts.

   Were the same people who approved the design the ones 
        deciding to ground?
    Answer. The decision to ground the 737 MAX was made by me after 
receiving enhanced satellite data showing the flight path of Ethiopian 
Flight 302 and conferring with FAA safety experts. I was not with the 
FAA at the time the 737 MAX design was approved.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Tammy Duckworth to 
                         Hon. Daniel K. Elwell
    Question 1. Please describe the Federal regulatory rules, process 
and procedures for addressing an aircraft design single-point-of-
failure, including the threshold for grounding such aircraft.
    Answer. 14 CFR Sec. Sec. 25.1309, 25.671, and 25.901, advisory 
circulars, and other FAA guidance material prevent the FAA from 
approving proposed designs in which a single system failure (non-
structural) would be catastrophic or prevent continued safe flight and 
landing. Beyond this, single system points-of-failure that are not 
catastrophic are governed by the reliability requirements of 14 CFR 
Sec. 25.1309.
    Manufacturers must show proposed airplane systems meet safety 
standards through a FAA hazard assessment and safety analysis. As part 
of this analysis, the manufacturer must show that ``catastrophic'' 
failure conditions are extremely improbable.
    The FAA makes safety-based, data-driven decisions. In determining 
whether a condition discovered after certification is unsafe, we employ 
a standardized process called Monitor Safety/Analyze Data (MSAD) for 
determining mandatory design changes and appropriate timeframes to 
implement those changes based on risk exposure. The results of the risk 
assessments conducted under MSAD could lead to an aircraft grounding 
decision.

    Question 2. What is the basis for certification by FAA of a 
derivative aircraft and how does FAA determine pilot training 
requirements for derivative aircraft?
    Answer. The FAA decides whether to process an application as an 
amended type certificate (ATC) based on an evaluation of the airplane 
design changes in accordance with 14 CFR Sec. 21.19, which describes 
changes requiring a new type certificate. The FAA evaluates the 
proposed design changes, considers the examples in the guidance 
material, and reviews determinations made on previous certification 
programs.
    The FAA determines pilot training requirements for derivative 
aircraft using the Flight Standardization Board (FSB) in accordance 
with established processes outlined in FAA Order 8900.1 and FAA 
Advisory Circular (AC) 120-53B. Aircraft operational suitability is 
determined in accordance with FAA Order 8110.4C.

    Question 3. For the purposes of FAA aircraft certification, who 
determines whether a design change is ``significant'' such that it 
would preclude the aircraft from a derivative certification? Please 
describe in detail precisely how FAA make this determination and what 
constitutes a requirement for a new type certificate?
    Answer. The managing Aircraft Certification Office (ACO) determines 
if the proposed design is eligible for an amended type certificate 
(ATC) (derivative aircraft certification) or if the proposed design 
changes require a new type certificate. The FAA decides to process an 
application as an ATC based on an evaluation of the proposed airplane 
design changes in accordance with 14 CFR Sec. 21.19, which describes 
proposed changes that will require a new type certificate. 
Additionally, AC 21.101-1B, ``Establishing the Certification Basis of 
Changed Aeronautical Products,'' provides examples of substantial 
design changes for transport airplanes.
    The FAA evaluates the proposed design changes, considers the 
examples in the advisory circular, and reviews determinations made on 
previous certification programs in order to determine eligibility for 
an ATC.

    Question 4. When a new system(s) for a derivative aircraft is 
disclosed to the FAA by an Original Equipment Manufacturer (OEM), how 
does the FAA evaluate that system(s) to determine changes to pilot 
training, aircraft and pilot manuals and handbooks, and the potential 
nullification of the derivative certification of the aircraft?
    Answer. The OEM presents technical briefings on new systems to the 
FAA. The OEM proposes a pilot type rating determination and pilot 
training recommendations after formally identifying differences between 
the base aircraft (old) and candidate aircraft (new) using the process 
outlined in Advisory Circular (AC) 120-53B. The Flight Standardization 
Board then evaluates the proposed training in accordance with this AC 
(AC 120-53B).

    Question 5. When a system is implemented on a derivative aircraft 
design with the intention of artificially retaining the handling 
qualities of the original design, what Federal requirements govern the 
publication and training of that system?
    Answer. At all times, the aircraft must meet the existing design 
and performance requirements. The FAA evaluates handling qualities in 
accordance with AC 120-53B using the T2 Test (handling qualities 
comparison), between the base and candidate aircraft. Any additional 
training requirements are evaluated during T3 Test (differences) by the 
Flight Standardization Board.

    Question 6. When the FAA certifies a derivative aircraft, which 
type certificated aircraft is considered as the baseline for design 
change comparisons? In the case of the Boeing 737 MAX, was it the most 
recent type certified aircraft like the 737 NG or the original type 
design?
    Answer. When an applicant applies for an amended type certificate 
(ATC) of a previously certificated model, it is responsible for 
proposing the baseline. That baseline may or may not be the most 
recently certificated model of that aircraft. Since the baseline 737-
800 model was introduced in 1998, many enhancements have been 
implemented in derivative models. In the case of the 737 MAX, the 737 
NG was the baseline model.

    Question 7. Are derivative aircraft required to comply with 14 CFR 
Part 25 regulations at the time the amended type certificate is awarded 
or at the time of the original type certificate?
    Answer. Only the proposed design change and areas affected by the 
change must comply with the 14 CFR regulations in place at the time of 
application, in accordance with 14 CFR Sec. 21.101 and FAA AC 21.101-
1B. The applicant also can petition the FAA for an exemption or 
``equivalent level of safety determination'' for particular 
requirements. These are addressed on a case-by-case basis.

    Question 8. Please point to the safeguards that FAA has in place to 
ensure that external pressures, such as time or competition, do not 
play any role in the quality of the certification or evaluation of a 
derivative aircraft.
    Answer. Through our public rulemaking process, the FAA prevents 
special interests from having undue influence in the development of 
standards and agency decisions regarding whether proposed designs meet 
those standards. Additionally, we have established processes for all 
FAA employees to elevate concerns if they feel that safety is being 
compromised. The FAA Office of Audit and Evaluation, established by 
Congress, provides a whistleblower hotline to report safety concerns. 
Complaints are investigated and responses to any findings are provided 
to this office. 14 CFR 183.57(c) and FAA Order 8100.15 place 
responsibility on the ODA holder to ensure that ODA unit members can 
perform their authorized functions without conflicting restraints or 
interference. ODA unit members also regularly interact with their FAA 
counterparts during certification projects and are able to communicate 
concerns directly. During regular FAA evaluations of ODAs, unit members 
are questioned about undue pressure and if they have the latitude to 
perform their duties appropriately.
    The FAA may also suspend or terminate an ODA at any time. Some 
reasons why the FAA may suspend or terminate an ODA include:

   ODA holder fails to properly perform the duties granted in 
        the authorization;

   ODA holder does not exercise the care or judgment required 
        to properly exercise the ODA;

   ODA holder displays a lack of integrity;

   ODA holder qualifications lapse;

   ODA holder does not take corrective action as required by 
        the FAA;

   ODA holder or ODA unit does not complete required FAA 
        training;

   Misconduct including, but not limited to, carelessness, 
        collusion, conflict of interest, compromise or any other act 
        that would jeopardize the proper functioning of the delegated 
        functions.

    FAA Order 8100.15B, Ch. 7-2. ODA holders have limited 
administrative appeal rights within the FAA to appeal the suspension or 
termination of an ODA.

    Question 9. Is FAA considering any changes to its existing 
certification process for aircraft currently in certification and for 
future designs?
    Answer. Safety is the core of FAA's mission and our top priority. 
We have a longstanding, well-established, data-driven certification 
process that consistently results in safe aircraft and we remain 
committed to our proven processes. We continue to evaluate the 
information we learn from the 737 MAX accident investigations to 
determine if certification process changes may be needed. The 
Department of Transportation's Office of the Inspector General is 
conducting an audit of the FAA's certification processes, and the 
Secretary of Transportation has established a Special Committee to 
Review FAA's Aircraft Certification Process. We look forward to 
assessing any recommendations for improvements these activities may 
identify.

    Question 10. Is the pitch stability of the Boeing 737 MAX series 
aircraft equal to the pitch stability of older models of the Boeing 737 
aircraft?
    Answer. The pitch stability and pitch maneuvering characteristics 
were flight tested and determined to meet part 25 requirements and 
equivalent to the previous 737 NG model.

    Question 11. Did Boeing implement the Maneuvering Characteristics 
Augmentation System (MCAS) flight control law on the 737 MAX series to 
improve aircraft handling characteristics and achieve the pitch 
stability that FAA requires to certify an aircraft for use as a 
passenger aircraft? Did Boeing implement MCAS to allow pilots' type 
certificate to transfer from 737 NG to 737 MAX aircraft? Please provide 
the Committee with any associated documentation for the purpose or 
justification for MCAS.
    Answer. The purpose of MCAS is to make the 737 MAX compliant with 
FAA regulations on performance and handling characteristics, for 
example, maneuvering stability and aerodynamic stall characteristics. 
The MCAS provides performance and handling characteristics consistent 
with the predecessor Boeing 737 NG models. As part of the flight 
control system, MCAS was determined to be compliant with FAA 
regulations.

    Question 12. During the certification process, did the FAA or 
Boeing under delegated authority, determine that it could not certify 
the Boeing 737 MAX series aircraft to be used as a passenger aircraft 
because of the lack of pitch stability?
    Answer. No. The FAA flight tested the 737 MAX in all regimes of 
flight, including stalls, and no lack of pitch stability was found. If 
a lack of pitch stability was found, the FAA would have required Boeing 
to address the issue prior to the amended type certificate being 
issued.

    Question 13. Did the FAA require Boeing to install an automated 
stability system in order to receive certification for the Boeing 737 
MAX series to be used as a passenger aircraft?
    Answer. The FAA did not require the installation of an automated 
stability system. Boeing, as the applicant, defines the scope of 
changes at the airplane level. The FAA through its Certification Basis 
determination concurred with the scope of the changes.

    Question 14. When a pilot overrides the MCAS flight control law and 
manually controls the 737 MAX, does the pitch stability of the 737 MAX, 
while being manually operated, change to unsafe levels for a passenger 
aircraft?
    Answer. An aircraft is required to be controllable in all regimes 
of flight. The MCAS operates as part of the flight control system, not 
independently. The MCAS function is active only during manual flight, 
when the flaps are up and the aircraft is at an elevated angle-of 
attack. Manual flight with MCAS active was extensively flight tested 
and found to be safe and compliant with part 25.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Jon Tester to 
                         Hon. Daniel K. Elwell
Safety Features as Options and Transparency
    Question 1. Did FAA know which safety features on the 737 MAX were 
offered by Boeing as options versus as mandatory equipment?
    Answer. Features and equipment that are required for safety are not 
optional on any aircraft the FAA certifies. 14 CFR part 25 
``Airworthiness Standards: Transport Category Airplanes'' contains the 
design standards.

    Question 2. Does FAA know what the cost is to Boeing for AOA 
redundancy and pilot alert equipment? And what Boeing charges customers 
to install on the 737 MAX?
    Answer. The FAA does not have information on pricing related to 
optional equipment on Boeing aircraft.

    Question 3. Did FAA determine that any Boeing-designated 
``options'' should to be installed as mandatory equipment? If yes, 
which equipment was switched to be mandatory standard equipment?
    Answer. Required safety standards and features for large aircraft 
are established in 14 CFR part 25 (``Airworthiness Standards: Transport 
Category Airplanes''). Features required to meet those safety standards 
are mandatory on all FAA-certified aircraft, including the Boeing 737 
MAX. There are no optional safety standards or features.

    Question 4. Has FAA ever gone back to the manufacturer and required 
that equipment that the manufacturer identified as ``optional'' instead 
be included as standard for safety reasons? If so, what equipment for 
which plane?
    Answer. The FAA has the statutory authority to promulgate new rules 
to mandate equipment enhancements and updates based on new data and 
operational experience. There are cases where optional equipment later 
became mandatory on transport category aircraft after specific safety 
benefits were established. For example, the FAA promulgated new rules 
to mandate new equipment including terrain awareness and warning 
systems (TAWS), enhanced ground proximity warning systems (EGPWS), and 
traffic collision avoidance systems (TCAS).

    Question 5. Does FAA plan to require that AOA redundancy and pilot 
alert equipment be standard equipment? Why/why not?
    Answer. We continue to evaluate the information we learn from the 
737 MAX accident investigations to determine if certification process 
changes or specific equipment capabilities may be needed. The 
Department of Transportation's Office of the Inspector General is 
conducting an audit of the FAA's certification processes, and the 
Secretary of Transportation has established a Special Committee to 
Review FAA's Aircraft Certification Process. We look forward to 
assessing any recommendations for improvements these activities may 
identify.

    Question 6. Should air passengers know in advance which safety 
options airlines opt NOT to pay for on planes in their fleet? Why or 
Why not?
    Answer. Features and equipment that are required for safety are not 
optional on any aircraft the FAA certifies. 14 CFR part 25 contains the 
design standards for transport category aircraft. This is a single 
level of safety, and the same requirements apply to all aircraft 
certified under part 25. The FAA does not regulate the cost of, or 
communicate to passengers on, optional equipment the operator has or 
has not chosen to install.
Pilot Training and Documentation
    Question 7. On what basis did FAA determine that no additional 
training for the 737 MAX 8 was needed?
    Answer. The FAA did require additional training for the 737 MAX 8. 
The FAA has processes and procedures to determine requirements for 
pilot training and type rating. During certification of the 737 MAX, 
the FAA followed its standard process in establishing a Flight 
Standardization Board (FSB) as the mechanism to evaluate manufacturer-
proposed training for a new aircraft or type derivative. FSBs are 
chaired by FAA experts and utilize qualified pilots from the FAA, 
industry, and other aviation authorities to evaluate the aircraft. The 
FAA conducted this FSB as a joint evaluation with Transport Canada 
(TCCA), the European Aviation Safety Agency (EASA) and participation 
from U.S. operators. FSB pilots unanimously concluded that for the 737 
MAX, additional computer-based training was necessary beyond the 
training required for a Boeing 737 NG pilot to fly the 737 MAX.
Instrumentation, Performance and Certification
    Question 8. Did FAA know about the lack of simultaneous and cross-
check readings of the AOA sensors on the 737-MAX 8, i.e., the absence 
of displaying the readings of both sensors (versus just one at a time) 
and the lack of a ``disagree light'' being activated if the sensors are 
at odds with one another?
    Answer. When the AOA indicator display is present on a 737 model, 
the left primary flight display (PFD) shows the left AOA reading, and 
the right PFD shows the right AOA reading. These readings do not 
display side-by-side on one display. It is important to note that AOA 
and other air data inputs (i.e., airspeed and calculated Mach) are 
direct inputs to the MCAS flight control function within the flight 
control computers and not dependent on any display of information on 
the pilots' PFDs. There is no regulatory requirement for the AOA 
indicators or the AOA disagree message.

    Is that configuration consistent with current standards?
    Answer. The AOA indicator display and AOA DISAGREE message were 
consistent with current standards.

    Did anyone raise any concerns about this configuration?
    Answer. FAA carefully considered the configuration before 
determining it met applicable standards.

    Did FAA raise this point of vulnerability with Boeing? If no, why 
not?
    Answer. There is no regulatory requirement for manufacturers to 
install an AOA disagree message because there are no pilot procedures 
associated with the display of the message.

    Question 9. Who determined that the introduction of enlarged 
engines and their changed placement did not require a new certification 
for the aircraft? What were the factors/rationale justifying that 
decision?
    Answer. The managing Aircraft Certification Office (ACO) followed 
FAA regulations and policy in making the determination that the 
proposed design was eligible for an Amended Type Certificate (ATC). The 
FAA issued an ATC based on the evaluation of the proposed airplane 
design changes in accordance with 14 CFR Sec. 21.19, which describes 
changes requiring a new type certificate. Additionally, FAA Advisory 
Circular (AC) 21.101-1B, ``Establishing the Certification Basis of 
Changed Aeronautical Products,'' provides examples of substantial 
design changes for transport airplanes.
    In making a determination of a proposed type certification, the FAA 
evaluates the proposed design changes, considers the examples in the 
advisory circular, and reviews determinations made on previous 
certification programs.

    Question 10. FAA statements re: the functioning of MCAS appear to 
be conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
    Answer. MCAS is an integrated sub-system of the flight control 
system and cannot be disabled by itself. Automatic movement of the 
horizontal stabilizer--including that caused by MCAS--can be disabled 
through use of the STAB TRIM cut-off switches. When automatic movement 
of the horizontal stabilizer is disabled, MCAS cannot move the 
horizontal stabilizer. The pilot can still move the stabilizer 
manually, if necessary.

    Question 11. How does FAA decide which systems are delegated to 
firms for certification?
    Answer. The FAA determines the level of involvement during an 
Organization Designation Authorization (ODA) project based on many 
variables. These include the ODA's performance and experience with the 
compliance requirements, consideration of any novel or unusual 
certification areas, or instances where adequate standards may not be 
in place.

    Question 12. In the hearing, you testified that FAA managers did 
review the delegation of authority as required. Does that mean that the 
role of FAA managers is to review the delegation of authority OR do FAA 
managers review/verify that a firm's certification decision is 
appropriate? If the latter, on what basis does the FAA make a 
determination that a certification done by a firm meets U.S. 
requirements?
    Answer. The FAA reviews delegation of authority and appropriateness 
of certification decisions, including individual delegation decisions. 
This is accomplished in response to review of applicant certification 
proposals. The FAA responses are reviewed by management or by delegated 
staff on behalf of FAA management. The basis for ascertaining that the 
ODA makes certification decisions that meet FAA requirements is 
accomplished through approval of the ODA procedures and oversight of 
the ODA. FAA managers approve the ODA manual, which defines an ODA 
holder's authority and limitations and identifies the functions it may 
perform. The FAA-approved ODA manual establishes criteria for FAA 
involvement on each certification project. The FAA reviews the ODA's 
system for making decisions through oversight of system, personnel, 
procedures, activities and overall performance. FAA managers ensure the 
FAA's oversight program for the ODA is in place and is operating in 
accordance with FAA Order 8100.15. The ODA holder is responsible as the 
project applicant to show compliance to the airworthiness standards.
                                 ______
                                 
     Response to Written Question Submitted by Hon. John Thune to 
                       Hon. Calvin L. Scovel III
    Question. Inspector General Scovel, the recent Federal Aviation 
Administration (FAA) Reauthorization Act of 2018 contained several 
bipartisan provisions aimed at improving and modernizing FAA's aircraft 
certification process. This included the establishment of an 
Organization Designation Authorization Office within FAA's Office of 
Aviation Safety, improving operational safety by strengthening 
oversight of ODA holders delegated to perform certain functions on 
behalf of the FAA.
    Additionally, you mentioned in your testimony that FAA has taken 
several steps to improve certification oversight in response to 
recommendations made by the Department of Transportation Office of 
Inspector General (DOT OIG), some of which were due to be implemented 
earlier this year.
    Beyond the work done in both the FAA Reauthorization and in 
response to recommendations made by DOT OIG, do see a need for further 
action to be taken regarding FAA's aircraft certification process, and 
if so, what are those actions?
    Answer. The actions FAA has already taken to address our prior 
recommendations are steps in the right direction. The key will be FAA's 
effective implementation of those recommendations and provisions of the 
FAA Reauthorization Act of 2018, which we will be reviewing during our 
audit of FAA's certification of the Boeing 737 MAX aircraft. We have 
just begun our latest audit work, and as such, it is too early to say 
what additional actions the FAA needs to take to improve its 
certification processes. We will keep the Committee apprised of our 
progress.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. Maria Cantwell to 
                       Hon. Calvin L. Scovel III
    General Scovel, your office has examined the performance of the ODA 
system and other issues within the certification system many times. 
Several times, including in 2011 and 2015, your office issued 
recommendations to FAA on ways to improve the system.
    Question 1. Did FAA adopt the recommendations from your office?
    Answer. Yes. Overall, FAA has been responsive to and adopted our 
recommendations. However, one key recommendation--for FAA to implement 
a new, more systems-and risk-based oversight approach--remains open. 
The Agency expects to complete implementing our recommendation in July 
2019.

    Question 2. Overall, would you call the ODA system safe? Are there 
improvements that still need to be implemented?
    Answer. Overall, the U.S. air transportation system is remarkably 
safe. However, recent events have raised concerns about FAA's oversight 
of the ODA program and its effectiveness. Improvements such as fully 
implementing our open recommendation will be a good start. We initiated 
an audit of FAA's certification of the Boeing 737 MAX on March 27, 
2019. While our audit is still in the early stages, we plan to address 
this issue in our review. We will be available to provide your office 
with more substantive information once we have an opportunity to 
develop our observations and findings.

    Question 3. What would happen if delegation ended--does FAA have 
the tools it would need to continue to carry out its certification 
responsibilities?
    Answer. Currently there are about 80 companies with delegated 
authority. The practice of delegation has served the industry well for 
years. ODA offers the Agency the opportunity to leverage outside 
expertise that it might not otherwise have access to and make the best 
use of limited resources and expertise. According to FAA, if ODA did 
not exist, the Agency would have to hire roughly 10,000 more employees 
to fulfill its aircraft certification mission.

    Question 4. Has your office compared the way the ODA system works 
with the way certification happens in Europe? Which system has a more 
rigorous degree of oversight agency involvement?
    Answer. We have not conducted a comparative analysis of how FAA's 
ODA process compares to systems used in Europe.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Tammy Duckworth to 
                       Hon. Calvin L. Scovel III
    Question 1. Please describe the Federal regulatory rules, process 
and procedures for addressing an aircraft design single-point-of-
failure, including the threshold for grounding such aircraft.
    Answer. FAA is responsible for ensuring the safety of the traveling 
public, including eliminating single points of failure and grounding 
aircraft for safety reasons. We initiated an audit of FAA's 
certification of the Boeing 737 MAX on March 27, 2019. While our audit 
is still in the early stages, our ongoing work will shed additional 
light on the processes, policies, and procedures for addressing these 
issues.

    Question 2. What is the basis for certification by FAA of a 
derivative aircraft and how does FAA determine pilot training 
requirements for derivative aircraft?
    Answer. FAA is responsible for determining the classification and 
certification of derivative aircraft. Also, in conjunction with 
manufacturers, FAA determines training requirements for pilots. We will 
explore these issues in greater detail in our ongoing review of how the 
Boeing 737 MAX was certified.

    Question 3. For the purposes of FAA aircraft certification, who 
determines whether a design change is ``significant'' such that it 
would preclude the aircraft from a derivative certification? Please 
describe in detail precisely how FAA make this determination and what 
constitutes a requirement for a new type certificate?
    Answer. FAA has the ultimate authority to determine whether a 
design change is significant and whether it would preclude the aircraft 
from being certified as a derivative. This is an issue we will examine 
in our ongoing review of how the Boeing 737 MAX was certified. We will 
be available to provide your office with more substantive information 
once we have an opportunity to develop our observations and findings.

    Question 4. When a new system(s) for a derivative aircraft is 
disclosed to the FAA by an Original Equipment Manufacturer (OEM), how 
does the FAA evaluate that system(s) to determine changes to pilot 
training, aircraft and pilot manuals and handbooks, and the potential 
nullification of the derivative certification of the aircraft?
    Answer. FAA works closely with the aircraft manufacturer to 
determine changes to pilot training as well as manuals and handbooks. 
This is an important question that has been raised with the Boeing 737 
MAX incidents. We will examine this and related issues in our ongoing 
review.

    Question 5. When a system is implemented on a derivative aircraft 
design with the intention of artificially retaining the handling 
qualities of the original design, what Federal requirements govern the 
publication and training of that system?
    Answer. We are in the early stages of our review of the 
certification of the Boeing 737 MAX, and as such, it is too early to 
say whether our review will address this issue. But please be assured 
that we will keep the Committee apprised of our progress.

    Question 6. When the FAA certifies a derivative aircraft, which 
type certificated aircraft is considered as the baseline for design 
change comparisons? In the case of the Boeing 737 MAX, was it the most 
recent type certified aircraft like the 737 NG or the original type 
design?
    Answer. FAA certifies derivative aircraft, but we have just begun 
our review of the 737 MAX certification. While our audit is still in 
the early stages, we plan to examine what make/model is considered as 
the ``baseline'' for the desired change and what other factors the 
Agency considers when making certification decisions for derivative 
aircraft.

    Question 7. Are derivative aircraft required to comply with 14 CFR 
Part 25 regulations at the time the amended type certificate is awarded 
or at the time of the original type certificate?
    Answer. This is an issue we will explore in detail in our ongoing 
audit of the Boeing 737 MAX certification.

    Question 8. Please point to the safeguards that FAA has in place to 
ensure that external pressures, such as time or competition, do not 
play any role in the quality of the certification or evaluation of a 
derivative aircraft.
    Answer. Safeguards against external pressures such as time and 
competition are important. FAA addresses this issue in its oversight 
procedures, but we do not know the effectiveness of any controls or 
safeguards in place. This is an issue we will explore in greater detail 
as we examine the certification of the Boeing 737 MAX.

    Question 9. Is FAA considering any changes to its existing 
certification process for aircraft currently in certification and for 
future designs?
    Answer. We are unaware of any changes FAA may be considering at 
this time. However, given the attention to this issue and the number of 
external reviews that are ongoing, there could be a number of changes 
to FAA's processes in the future.

    Question 10. Is the pitch stability of the Boeing 737 MAX series 
aircraft equal to the pitch stability of older models of the Boeing 737 
aircraft?
    Answer. The issue of pitch stability is an important question in 
the recent 737 MAX accidents. Preliminary reports suggest that there 
may be a difference in stability compared to earlier models. This is an 
issue we will examine in our ongoing review of the 737 MAX 
certification.

    Question 11. Did Boeing implement the Maneuvering Characteristics 
Augmentation System (MCAS) flight control law on the 737 MAX series to 
improve aircraft handling characteristics and achieve the pitch 
stability that FAA requires to certify an aircraft for use as a 
passenger aircraft? Did Boeing implement MCAS to allow pilots' type 
certificate to transfer from 737 NG to 737 MAX aircraft? Please provide 
the Committee with any associated documentation for the purpose or 
justification for MCAS.
    Answer. Based on reports, it appears that Boeing implemented MCAS 
to improve aircraft handling characteristics and to address concerns 
about pitch stability to certify the aircraft. We will look into all 
the reasons Boeing implemented MCAS in our review of the 737 MAX 
certification.

    Question 12. During the certification process, did the FAA or 
Boeing under delegated authority, determine that it could not certify 
the Boeing 737 MAX series aircraft to be used as a passenger aircraft 
because of the lack of pitch stability?
    Answer. We have just begun our review of 737 MAX certification. We 
are aware of concerns regarding the pitch stability of the 737 MAX, and 
will examine these issues in greater detail during our review.

    Question 13. Did the FAA require Boeing to install an automated 
stability system in order to receive certification for the Boeing 737 
MAX series to be used as a passenger aircraft?
    Answer. We do not know at this juncture exactly what FAA required 
Boeing to do, but we will determine whether FAA required Boeing to 
install an automated system to obtain certification.

    Question 14. When a pilot overrides the MCAS flight control law and 
manually controls the 737 MAX, does the pitch stability of the 737 MAX, 
while being manually operated, change to unsafe levels for a passenger 
aircraft?
    Answer. We are in the early stages of our review of the 737 MAX, 
but we will address the issue of whether or not the pilot can manually 
override MCAS. We recognize this is an important question in resolving 
problems with the Boeing 737 MAX.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Jon Tester to 
                       Hon. Calvin L. Scovel III
Scope of OIG Review
    Question 1. What factors will the OIG examine to determine if the 
FAA's relationship with Boeing was appropriate to fulfill its oversight 
role and responsibilities?
    Answer. In addition to assembling a timeline of the Boeing 737 MAX 
certification, we will examine the ODA process, including the roles and 
responsibilities between FAA and Boeing and how key decisions were 
made.

    Question 2. Is the OIG investigating if FAA allowed Boeing to take 
shortcuts to improve its competitiveness vis-a-vis international 
aircraft suppliers?
    Answer. Our ongoing audit if FAA's certification of the Boeing 737 
MAX will be reviewing all of the factors that went into the 
certification of the 737 MAX and will be alert for any factors that 
indicate shortcuts were taken.

    Question 3. Is the OIG looking at the impact and implications of 
market competition on:

    a. Boeings' decision-making and production schedules of the 737-MAX 
8?

    b. FAA's delegation of self-certification to Boeing?

    Answer. Our current review is focused on building a timeline for 
the certification of the 737 MAX and delegated authority. We will 
examine any factors that may have influenced key decisions.

    Question 4. Are reports that the number of aircrafts delivered is a 
factor in employees' performance reviews (and presumably bonus awards) 
true? If so, how will you determine if that situation impacted the 
planes' safety-related systems and pilot training requirements?
    Answer. We do not know whether the number of aircraft delivered was 
a factor in performance reviews at Boeing. This is an issue we will 
examine in our ongoing review of how the Boeing 737 MAX was certified. 
We will be available to provide your office with more substantive 
information once we have an opportunity to develop our observations and 
findings.
Instrumentation, Performance and Certification
    Question 5. Did FAA know about the lack of simultaneous and cross-
check readings of the AOA sensors on the 737-MAX 8, i.e., the absence 
of displaying the readings of both sensors (versus just one at a time) 
and the lack of a ``disagree light'' being activated if the sensors are 
at odds with one another?

    a. Is that configuration consistent with current standards?

    b. Did anyone raise any concerns about this configuration?

    c. Did FAA raise this point of vulnerability with Boeing? If no, 
why not?
    Answer. We cannot say at this time what Boeing and FAA knew given 
that we are in the early stages of our review of the 737 MAX 
certification. The issues raised about instrumentation and warnings are 
important questions that we will explore in our review.

    Question 6. Who determined that the introduction of enlarged 
engines and their changed placement did not require a new certification 
for the aircraft? What were the factors/rationale justifying that 
decision?
    Answer. FAA is ultimately responsible for decisions about 
certification. We do not yet know the factors that drove these 
decisions. However, we will explore these questions in our review of 
the 737 MAX certification.

    Question 7. FAA statements re: the functioning of MCAS appear to be 
conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
    Answer. After careful review and consideration, DOT-OIG believes 
FAA is most appropriately situated to provide a response to this 
question.

    Question 8. How does FAA decide which systems are delegated to 
firms for certification?
    Answer. FAA works closely with the manufacturer and decides what 
systems are delegated for certification. According to FAA, factors such 
as performance issues and areas critical to safety would lead to a 
higher level of FAA involvement and oversight.

    Question 9. In the hearing, Acting Administrator Elwell testified 
that FAA managers did review the delegation of authority as required. 
Does that mean that the role of FAA managers is to review the 
delegation of authority OR do FAA managers review/verify that a firm's 
certification decision is appropriate? If the latter, on what basis 
does the FAA make a determination that a certification done by a firm 
meets U.S. requirements?
    Answer. After careful review and consideration, DOT-OIG believes 
FAA is most appropriately situated to provide a response to this 
question.

                                [all]