    [Senate Hearing 116-616]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 116-616

                        AVIATION SAFETY AND THE FUTURE
                              OF BOEING'S 737 MAX

    =======================================================================

                                    HEARING

                                   before the

                             COMMITTEE ON COMMERCE,
                          SCIENCE, AND TRANSPORTATION
                              UNITED STATES SENATE

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                OCTOBER 29, 2019

                                   __________

        Printed for the use of the Committee on Commerce, Science, and
                                 Transportation

                      [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                    Available online: http://www.govinfo.gov

                                  ______

                     U.S. GOVERNMENT PUBLISHING OFFICE

    52-795 PDF                WASHINGTON : 2023

           SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                      ROGER WICKER, Mississippi, Chairman

    JOHN THUNE, South Dakota             MARIA CANTWELL, Washington,
    ROY BLUNT, Missouri                      Ranking
    TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota
    DEB FISCHER, Nebraska                RICHARD BLUMENTHAL, Connecticut
    JERRY MORAN, Kansas                  BRIAN SCHATZ, Hawaii
    DAN SULLIVAN, Alaska                 EDWARD MARKEY, Massachusetts
    CORY GARDNER, Colorado               TOM UDALL, New Mexico
    MARSHA BLACKBURN, Tennessee          GARY PETERS, Michigan
    SHELLEY MOORE CAPITO, West Virginia  TAMMY BALDWIN, Wisconsin
    MIKE LEE, Utah                       TAMMY DUCKWORTH, Illinois
    RON JOHNSON, Wisconsin               JON TESTER, Montana
    TODD YOUNG, Indiana                  KYRSTEN SINEMA, Arizona
    RICK SCOTT, Florida                  JACKY ROSEN, Nevada

                           John Keast, Staff Director
                      Crystal Tully, Deputy Staff Director
                          Steven Wall, General Counsel
                     Kim Lipsky, Democratic Staff Director
                  Chris Day, Democratic Deputy Staff Director
                          Renae Black, Senior Counsel

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on October 29, 2019.................................     1
    Statement of Senator Wicker......................................     1
    Statement of Senator Cantwell....................................     3
    Statement of Senator Thune.......................................    13
    Statement of Senator Klobuchar...................................    15
    Statement of Senator Fischer.....................................    16
    Statement of Senator Blumenthal..................................    18
        Poster submitted by Hon. Richard Blumenthal entitled, ``MCAS
          lives in both FCCs''.......................................    20
    Statement of Senator Moran.......................................    21
    Statement of Senator Peters......................................    23
    Statement of Senator Capito......................................    24
    Statement of Senator Udall.......................................    26
    Statement of Senator Markey......................................    28
    Statement of Senator Duckworth...................................    29
        Report dated October 28, 2019 entitled, ``Flawed Assumptions
          Pave a Path to Disaster'' by Peter Lemme...................    70
    Statement of Senator Cruz........................................    31
        Poster submitted by Hon. Ted Cruz............................    33
    Statement of Senator Tester......................................    33
    Statement of Senator Johnson.....................................    35
    Statement of Senator Rosen.......................................    37
    Statement of Senator Blunt.......................................    39
    Statement of Senator Blackburn...................................    40
    Statement of Senator Scott.......................................    42
    Statement of Senator Sullivan....................................    43

                                   Witnesses

    Dennis Muilenburg, President And Chief Executive Officer, The
      Boeing Company.................................................     5
        Prepared statement...........................................     7
    Hon. Robert L. Sumwalt III, Chairman, National Transportation
      Safety Board...................................................    45
        Prepared statement...........................................    46
    Hon. Christopher A. Hart, Chairman, Joint Authorities Technical
      Review (JATR)..................................................    58
        Prepared statement...........................................    60

                                    Appendix

    Response to written questions submitted to Dennis Muilenburg by:
        Hon. Roger Wicker............................................   127
        Hon. John Thune..............................................   129
        Hon. Jerry Moran.............................................   130
        Hon. Maria Cantwell..........................................   130
        Hon. Amy Klobuchar...........................................   139
        Hon. Richard Blumenthal......................................   140
        Hon. Tom Udall...............................................   143
        Hon. Tammy Duckworth.........................................   144
        Hon. Kyrsten Sinema..........................................   150
    Response to written questions submitted to Hon. Robert L. Sumwalt
      III by:
        Hon. John Thune..............................................   153
        Hon. Tom Udall...............................................   154
        Hon. Tammy Duckworth.........................................   154
    Response to written questions submitted to Hon. Christopher A.
      Hart by:
        Hon. Tom Udall...............................................   155

                        AVIATION SAFETY AND THE FUTURE
                              OF BOEING'S 737 MAX

                                  ----------

                           TUESDAY, OCTOBER 29, 2019

                                           U.S. Senate,
            Committee on Commerce, Science, and Transportation,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 10:06 a.m., in
    room SH-216, Hart Senate Office Building, Hon. Roger Wicker,
    Chairman of the Committee, presiding.
        Present: Senators Wicker [presiding], Thune, Blunt, Cruz,
    Fischer, Moran, Sullivan, Gardner, Blackburn, Capito, Johnson,
    Young, Scott, Cantwell, Klobuchar, Blumenthal, Markey, Udall,
    Peters, Baldwin, Duckworth, Tester, Sinema, and Rosen.

                OPENING STATEMENT OF HON. ROGER WICKER,
                     U.S. SENATOR FROM MISSISSIPPI

        The Chairman. This hearing will come to order. Thank you
    all for being here today. One year ago, today, Lion Air Flight
    610 crashed into the sea shortly after takeoff from Jakarta,
    Indonesia. All 189 people onboard perished. Five months later,
    Ethiopian Airlines Flight 302 departed Addis Ababa, Ethiopia.
    Just like Lion Air Flight 610, Ethiopian Airlines Flight 302
    experienced problems shortly after takeoff and crashed. All 157
    persons onboard died. Both of these accidents were entirely
    preventable.
        We cannot fathom the pain experienced by the families of
    those 346 human beings who were lost. Many family members are
    here today, and we appreciate their attendance, and I
    appreciate many of them meeting with members of the Committee
    over time.
        As Chairman of this Committee, I promise their loved ones
    that we are working to obtain a full answer as to how to
    prevent future tragedies. These families deserve answers,
    accountability, and action--and the public deserves to know
    this. The type of aircraft involved in both accidents is the
    737 MAX 8 manufactured by Boeing. International aviation safety
    regulators began grounding the MAX the day after the Ethiopian
    crash.
        On March 13, the Federal Aviation Administration formally
    grounded the aircraft in the United States. The MAX's return to
    service is contingent on Boeing's work with the FAA to test and
    certify fixes to the MCAS flight-control system, which
    activated during both crashes. In order for the MAX to return
    to service, international regulators also need to be satisfied
    that it is safe to fly. As the certification process continues,
    many questions remain about Boeing's actions and the FAA's
    actions during the design, development, and certification
    processes, as well as the operation of the MAX.
        Today's hearing is divided into two panels. Let me note for
    Senators that the Committee will follow regular order of
    recognition for both panels. The five-minute rule will be
    observed strictly because we have so many people who wish to
    participate. On the first panel, Dennis Muilenburg, President
    and CEO of Boeing, will testify on behalf of the aircraft
    manufacturer. He is accompanied by John Hamilton, Chief
    Engineer for Boeing Commercial Airplanes, who will provide
    technical expertise.
        Our second panel will examine these issues from the
    Government's perspective. The witnesses today include National
    Transportation Safety Board Chairman Robert Sumwalt, and
    Chairman of the Joint Authorities Technical Review, or JATR,
    Chris Hart. Chairman Sumwalt oversees NTSB, which recently
    released a report and recommendations regarding the MAX
    certification. Chairman Hart led the JATR, an FAA-commissioned
    body that included the FAA, NASA, and nine foreign aviation
    safety authorities tasked with reviewing the MAX's flight
    control systems.
        The JATR has submitted a broad range of recommendations to
    the FAA. Let me note that Chairman Hart has extensive past
    Government service in aviation safety, but he is a private
    citizen, today, who agreed to lead the JATR. We have many
    concerns that Boeing should address today. We need to know if
    Boeing and the FAA rushed to certify the MAX. In particular,
    critics have focused on the MCAS development and testing. The
    JATR criticized Boeing's communication with the FAA on MCAS's
    development, particularly after the system was modified to
    activate at lower airspeeds.
        The JATR also criticized the FAA for relying on outdated
    regulations, guidance, and certification procedures, and
    failing to incorporate realistic human behavior factors into
    its assumptions. The NTSB also called into question Boeing and
    FAA's assumptions about pilot reaction during MCAS activation.
    These questions were especially important for stressful
    situations with multiple alerts going off in the cockpit.
        Our witnesses should address the company and the safety
    regulators' actions regarding MAX certification in general and
    MCAS in particular. The process for certifying the MAX
    necessitated a close partnership between Boeing and the FAA.
    Under a decades-old system called Organization Designation
    Authorization, or ODA, the FAA has delegated certain
    certification activities to the ODA holder, in this case
    Boeing. While the ODA has been used to certify many aircraft
    over the years, some have criticized the system for permitting
    an inappropriately close relationship between companies and
    their safety regulator. Indeed, e-mail correspondence, dating
    from as early as 2015, between the MAX's former Chief Technical
    Pilot, Mark Forkner, and FAA personnel released on October 18
    reflect a disturbing level of casualness and flippancy that
    seem to corroborate these criticisms.
        I was disappointed to learn of a November 2016 instant
    messenger conversation between Mr. Forkner and a colleague, in
    which he acknowledged misinforming the FAA. Boeing should have
    notified the FAA about that conversation immediately upon its
    discovery. Although the FAA is not testifying today, let me
    express my frustration with the agency's lack of responsiveness
    to my requests dating back to April of this year for documents
    relevant to the 737 MAX as part of the investigation that I
    opened, as Chairman, based on whistleblower disclosures.
        The relationship between regulating agencies and
    organizations they regulate is important, but so are the
    internal reforms that Boeing is implementing. Witnesses should
    provide their views on the ODA system and whether or not
    reforms are needed. I invite Mr. Muilenburg to describe the
    steps Boeing is taking to improve aviation safety and to ensure
    that technical experts never experience undue pressure to put
    profits and relationships ahead of safety. The Committee's
    oversight is not limited to past actions. The reviews by both
    JATR and NTSB note that future aircraft systems are likely to
    be even more complex and interdependent than current models.
    Managing interfaces between humans and machines will become
    even more important as automation increases. At the same time,
    commercial aviation is set to continue expanding around the
    globe.
        Many future pilots will fly in countries without the same
    training requirements and safety standards that we have in the
    United States. We welcome the witnesses' thoughts on how to
    improve design, development, and certification in the future to
    account for these major changes. This hearing will by no means
    be the end of our inquiry. Additional oversight hearings will
    be held. The Committee will carefully review the final Lion Air
    report, which was released on Friday, as well as the Ethiopian
    Airlines report, which is forthcoming.
        The Committee also will consider the findings and
    recommendations from JATR, NTSB, and all other investigations
    and reviews. I now recognize the distinguished Ranking Member,
    Senator Cantwell, for her opening statement.

                   STATEMENT OF HON. MARIA CANTWELL,
                      U.S. SENATOR FROM WASHINGTON

        Senator Cantwell. Thank you, Mr. Chairman, and thank you
    for this important hearing. I too want to take a moment and
    recognize the families who have lost loved ones in both the
    Ethiopian Airlines and Lion Air tragedies, some of whom are
    here with us today. I cannot imagine the loss and the enduring
    pain that you must feel. I thank you for your vigilance on this
    issue, just as we have seen the families of the Colgan Air
    flight vigilance help us improve safety for the future.
        Right now, Mr. Muilenburg, these families, millions of
    airline passengers, and over 150,000 aerospace workers want to
    know what we're doing to fix what went wrong and what did go
    wrong. To date, we have not gotten all those answers. Hopefully
    today's hearing will help provide some. But one thing is
    crystal clear, if you want to be the leader in aviation
    manufacturing, you have to be the leader in aviation safety.
    Aviation demand, especially for 737s and single-aisle planes is
    exploding to 101 percent growth over the next 10 years--
    something like 35,000 planes and $3 trillion. I think that is
    actually 20 years. But we cannot have a race for commercial
    airplanes become a race to the bottom when it comes to safety.
    The company, the Board, cannot prioritize profits over safety.
        Safety always has to be job one. So, it is troubling to
    hear that Boeing may have skirted the FAA certification process
    over a desire by airlines to have more fuel-efficient planes
    but without pilot training. Now this issue of lowering
    standards is permeating through all of aviation. We are dealing
    with it here in the Committee. My Democratic colleagues have
    led the charge to try to stop companies coming here to say they
    do not want to have the same training for co-pilots on the
    regional jets because they do not have enough pilots. Or the
    issue my colleague has championed on rest requirements for
    cargo pilots having the same requirements for rest as passenger
    planes.
        Thank God Captain Sullenberger, the hero of the Hudson,
    made it clear, when you are in an emergency, the pilot and co-
    pilot do not have time, a lot of time, to communicate. So that
    is why today we need answers to how the first 737 MAX
    certification process was done, and we especially need
    transparency on this process of review before the 737 MAX is
    put in the air again. The public needs to know and fully
    understand what testing, what review, what processes were
    conducted both by Boeing and the FAA before this plane is put
    back in the air.
        We also want to know today about Boeing's safety culture,
    whether Boeing employees raised safety concerns that were not
    listened to, whether there was enough testing and complex
    system integration and information into a cockpit alert system
    that we now all know was flawed, and whether there was even
    enough data presented to the FAA. These are all questions that
    are important, including outsourcing of engineering and coding.
    There are many questions about software and cockpit automation
    and overload.
        I guarantee you the FAA codes and laws are clear when it
    comes to the standards for certification. Yes, software and
    automation, flight training, better rest requirements for
    pilots have all led to 10 years between 2009 to 2018 as the
    safest 10 years in aviation history. But, more software and
    more automation without robust third-party testing and
    validation will lead us to where we are today. We should note
    that the last five aviation accidents have all involved this
    issue of automation and pilot response to automation. Whether
    it is Lion Air, Ethiopian, the Asiana, the French, or Qantas
    330 accidents, they were all in response to an automation in a
    command and response from the pilot.
        So that is why last week I introduced legislation with my
    colleagues Senator Duckworth and Senator Blumenthal to
    implement the recommendations of the NTSB safety board and the
    Inspector General report on better safety management systems,
    better cockpit prioritization, and a new FAA Center of
    Excellence on flight automation and human factors. The FAA
    needs the best engineers to understand the engineering
    challenges of the future and stay ahead on this human behavior
    response to new automation.
        We are dealing--I see people here on the transportation,
    automobile side. It is the same issue in advanced vehicles,
    what automation exists and how do humans respond to it? So, I
    also look forward to hearing from Chairman Sumwalt and Chris
    Hart about their findings on improving the safety review
    process that we have included in this legislation. I will just
    say again, our sorrows are nothing like the families who are
    with us today, but I do want to note that 737 MAX accidents
    have struck at the heart of everyone in the Northwest.
        Soon after the Ethiopian crash, a Seattle firefighter
    approached me and asked if I thought he could get a job at
    Boeing. He said, I just want to go there and make sure we get
    the safety right. Everyone feels that way. Generations of
    workers in the Pacific Northwest have dedicated their lives to
    aviation excellence and safety, and that spirit lives on in
    Everett and Renton.
        So, this is not a question about line workers, this is a
    question about the corporate view from Chicago, whether there
    is enough attention to manufacturing and certification. You
    should take, you know, offense to the fact that people say it
    is a great company not being run correctly.
        So, for the 346 people who trusted Boeing without a second
    thought, we need to get this right. These families are counting
    on us. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Cantwell. Mr. Muilenburg,
    you have submitted an extensive written statement. It will be
    entered in full in the record at this point. You are now--and I
    understand Mr. Hamilton will not be making a formal statement.
    So, Mr. Muilenburg, you are recognized at this point to
    summarize your opening statement for five minutes. Thank you
    for being here.

             STATEMENT OF DENNIS MUILENBURG, PRESIDENT AND

              CHIEF EXECUTIVE OFFICER, THE BOEING COMPANY;

            ACCOMPANIED BY JOHN HAMILTON, VICE PRESIDENT AND

              CHIEF ENGINEER, BOEING COMMERCIAL AIRPLANES

        Mr. Muilenburg. Chairman Wicker, Ranking Member Cantwell,
    committee members, thank you for the opportunity to join you
    today and that we share your commitment to aviation safety.
    Before we start today, I would like to speak directly to the
    families of the victims that are here with us. On behalf of
    myself and the Boeing Company, we are sorry, deeply and truly
    sorry.
        As a husband and father, myself, I am heartbroken by your
    losses. I think about you and your loved ones every day, and I
    know our entire Boeing team does as well. I know that probably
    does not offer much comfort and healing at this point, but I
    want you to know that we carry those memories with us every
    day, and every day that drives us to improve the safety of our
    airplanes and our industry and that will never stop.
        I am grateful and humbled to be here today and to be able
    to say these words to the families directly, and I want to
    convey our absolute commitment to safety, our commitment to
    learning, our commitment to rebuilding the public's confidence
    in what we do, and to preventing accidents like this from ever
    ever happening again. We will never forget and that is our
    commitment going forward.
        Mr. Chairman, I know this Committee has many questions
    about the MAX. We will do our best today to answer all of those
    questions. While one of the accidents is still under
    investigation, we know both accidents involve the repeated
    activation of a flight control system called MCAS, which
    responded to erroneous signals from a sensor that measures the
    airplane's angle of attack. Based on that, we have enhanced
    MCAS in three ways. First, it will now compare information for
    both sensors instead of one before activating.
        Second, MCAS will only activate a single time. And third,
    MCAS will never provide more input than a pilot can counteract
    using the control column alone. Pilots will also continue to
    have the ability to override MCAS at any time. We brought the
    best of Boeing to this effort. We spent over 100,000
    engineering and test hours, we have flown more than 800 test
    flights, we conducted simulator sessions with 545 participants
    from 99 customers and 41 global regulators. I have flown on a
    couple of flights myself.
        This has taken longer than expected but we are committed to
    getting it right. During this process, we worked closely with
    the FAA and other regulators, we provided them documentation,
    had them fly the simulators, answered their questions, and
    regulators around the world should rigorously scrutinize the
    MAX and only approve its return to flight when they are
    completely satisfied with its safety. The public deserves
    nothing less. Mr. Chairman, today and everyday over 5 million
    people will board a Boeing airplane and fly safely to their
    destination. Decades of cooperation and innovation by industry
    and regulators and the rigorous oversight of this Committee
    have reduced accidents by more than 95 percent over the last
    twenty years, but no number other than zero accidents is ever
    acceptable. We can and must do better.
        We have been challenged and changed by these accidents. We
    have made mistakes and we got some things wrong. We are
    improving and we are learning, and we are continuing to learn.
    We established a permanent airspace safety committee of our
    Board. We stood up a new safety organization. We strengthened
    our engineering organization so that all engineers now report
    up through Boeing's Chief Engineer. We are also helping to
    rebuild the communities and families impacted by these
    accidents. We pledged $100 million to this effort and have
    hired renowned experts in this area to ensure families can
    access these funds as quickly as possible. No amount of money
    can bring back what was lost but we can at least help the
    families meet their financial needs.
        Mr. Chairman, I started at Boeing more than 30 years ago as
    a summer intern in Seattle. I was a junior at Iowa State
    University studying engineering having grown up on a family
    farm in Iowa. I was awestruck to work at the company that
    brought the jet age to the world and helped land a person on
    the moon. Today I am still inspired by what Boeing does and by
    the remarkable men and women who are committed to its
    outstanding legacy but these heartbreaking accidents and the
    memories of the 346 lives lost are now part of that legacy. It
    is our solemn duty to learn from them and we will.
        Recently there has been much criticism of Boeing and our
    culture. We understand and deserve this scrutiny, but I know
    the people at Boeing. They are more than 150,000 of the most
    dedicated, honest, hard-working men and women in the world, and
    their commitment to safety, quality, and integrity is
    unparalleled and resolute.
        We will stay true to those values because we know our work
    demands the utmost excellence. Mr. Chairman.
        [The prepared statement of Mr. Muilenburg follows:]

    Prepared Statement of Dennis Muilenburg, President and Chief Executive
        Officer, The Boeing Company; Accompanied by John Hamilton, Vice
           President and Chief Engineer, Boeing Commercial Airplanes
        Chairman Wicker, Ranking Member Cantwell, members of the Committee:
    good morning and thank you for inviting me to be here today.
        I'd like to begin by expressing my deepest sympathies to the
    families and loved ones of those who were lost in the Lion Air Flight
    610 and Ethiopian Airlines Flight 302 accidents, including those who
    are here in the room today. I wanted to let you know, on behalf of
    myself and all of the men and women of Boeing, how deeply sorry I am.
    As we observe today the solemn anniversary of the loss of Lion Air
    Flight 610, please know that we carry the memory of these accidents,
    and of your loved ones, with us every day. They will never be
    forgotten, and these tragedies will continue to drive us to do
    everything we can to make our airplanes and our industry safer.
        Mr. Chairman, I know that you and your colleagues have many
    questions about the 737 MAX. My colleague John Hamilton, Chief Engineer
    for Boeing Commercial Airplanes, and I will do our best today to answer
    them. While the Ethiopian Airlines accident is still under
    investigation by authorities in Ethiopia, we know that both accidents
    involved the repeated activation of a flight control software function
    called MCAS, which responded to erroneous signals from a sensor that
    measures the airplane's angle of attack.
        Based on that information, we have developed robust software
    improvements that will, among other things, ensure MCAS cannot be
    activated based on signals from a single sensor, and cannot be
    activated repeatedly. We are also making additional changes to the 737
    MAX's flight control software to eliminate the possibility of even
    extremely unlikely risks that are unrelated to the accidents.
        We have brought the very best of Boeing to this effort. We've
    dedicated all resources necessary to ensure that the improvements to
    the 737 MAX are comprehensive and thoroughly tested. That includes
    spending over 100,000 engineering and test hours on their development.
    We've also flown more than 814 test flights with the updated software
    and conducted numerous simulator sessions with 545 participants from 99
    customers and 41 global regulators. This process has taken longer than
    we originally expected, but we're committed to getting it right, and
    return-to-service timing is completely dependent on answering each and
    every question from the FAA.
        I have flown on two of the demonstration flights myself and seen
    first-hand the expertise and professionalism of our teams. Mr.
    Chairman, I could not be more confident in our solutions--and I could
    not be more grateful to the men and women who have worked so hard to
    develop and test these improvements always with safety at the
    forefront. When the 737 MAX returns to service, it will be one of the
    safest airplanes ever to fly.
        During this process we have been working closely with the FAA and
    other regulators. We've provided documentation, had them fly the
    simulators, and helped them understand our logic and the design for the
    new software. All of their questions are being answered. Regulators
    around the world should approve the return of the MAX to the skies only
    after they have applied the most rigorous scrutiny, and are completely
    satisfied as to the plane's safety. The flying public deserves nothing
    less.
        We know that it's not just regulators that need to be convinced. We
    know the grounding of the MAX is hurting our airline customers, their
    pilots and flight attendants, and most importantly, the people who fly
    on our airplanes. Our airline customers and their pilots have told us
    they don't believe we communicated enough about MCAS--and we've heard
    them. So we have partnered with customers and pilots from around the
    world as we've developed our solutions. We have welcomed and encouraged
    their questions and given them opportunities to test those solutions
    firsthand in simulators. And subject to regulatory approval, additional
    and enhanced training and educational materials will be available for
    pilots who fly the MAX.
        We have learned and are still learning from these accidents, Mr.
    Chairman. We know we made mistakes and got some things wrong. We own
    that, and we are fixing them. We have developed improvements to the 737
    MAX to ensure that accidents like these never happen again. We also are
    learning deeper lessons that will result in improvements in the design
    of future airplanes. As painful as it can be, the process of learning
    from failure, and even from tragedies like these, has been essential to
    the advances in airplane safety since the industry began roughly a
    century ago. And it is one of the reasons that travel on a large
    commercial airplane is the safest form of transportation in human
    history.
        Mr. Chairman, this is something we must not lose sight of. Today
    and every day, over 5 million people will board a Boeing airplane and
    fly safely to their destination. Whether it's their first flight or
    their millionth mile, we want it to be a great experience--and most
    importantly, a safe one. Decades of work and innovation throughout the
    industry, as well as the oversight of the FAA, this Committee, and
    regulators around the world have reduced the risks of air travel by
    more than 95 percent over the last twenty years. But no number, other
    than zero accidents, is ever acceptable.
        For 103 years, Boeing has been dedicated to making the world a
    safer and better place. Our founder, Bill Boeing, established our first
    safety council in 1917, the first full year of the company's existence,
    beginning a commitment to safety that we have carried forward as a core
    value ever since. The engineers who design our airplanes, the
    machinists who work in our factories, and the many others who
    contribute to the extraordinarily complex work of building and
    maintaining commercial airplanes do so with pride and honor. Ensuring
    safe and reliable travel is core to who we are. Our customers and the
    traveling public, including our own families, friends, and loved ones,
    depend on us to keep them safe. That's our promise and our purpose.
        But we also know we can and must do better. We have been challenged
    and changed by these accidents, and we are improving as a company
    because of them. We established a permanent aerospace safety committee
    of our Board of Directors; stood up a new Product and Services Safety
    organization that will review all aspects of product safety and provide
    streamlined reporting and elevation of safety concerns; and
    strengthened our Engineering organization by having all engineers in
    the company report up through Boeing's chief engineer. We also are
    investing in advanced research and development in new safety
    technologies and are exploring ways to strengthen not just the safety
    of our company but our industry as a whole. We have a shared bond of
    safety across the entire aerospace community.
        We recognize it is not just our airplanes and our company that
    needs to be supported and strengthened. We also must help rebuild the
    communities and families affected by these accidents. Our first step
    was our pledge of $100 million to them. We hired Ken Feinberg and
    Camille Biros, renowned experts in this area, to ensure families can
    access this money as quickly as possible. Of course, no amount of money
    can bring back what has been lost. But we can at least help families
    meet their financial needs. Our people also have donated more than
    $750,000 of their own money to these funds--a tremendous example of the
    giving spirit our teams consistently display in the communities where
    they live and work across the globe.
        Mr. Chairman, I've worked at Boeing my entire career. It started
    more than 30 years ago when Boeing offered me a job as a summer intern
    in Seattle. I was a junior at Iowa State University studying
    engineering, having grown up on our family farm in Iowa. It's beautiful
    land with rolling hills where my siblings and I milked cows and baled
    hay. Our parents taught us the value of hard work, integrity, and
    respect for others. Back then, I drove my 1982 Monte Carlo from Iowa to
    Boeing's operations in Seattle, crossing the Rocky Mountains for the
    first time. I was awestruck at the opportunities I had to work on
    projects that mattered at the company that brought the Jet Age to the
    world and helped land a person on the moon. I was amazed by the people
    of Boeing. Today, I'm still inspired every day by what Boeing does and
    by the remarkable men and women who are committed to continuing its
    legacy.
        These heartbreaking accidents--and the memories of the 346 lives
    lost--are now part of that legacy as well. It's our solemn duty to
    learn from them and change our company for the better. I can assure you
    that we have learned from this and will continue learning. We have
    changed from this and will continue changing. The importance of our
    work demands it.
        In the months since the accidents, there has been much criticism of
    Boeing and its culture. We understand and deserve this scrutiny. But I
    also know the people of Boeing, the passion we have for our mission,
    and what we stand for. There are over 150,000 dedicated men and women
    working for Boeing around the world--and their commitment to our
    values, including safety, quality, and integrity, is unparalleled and
    resolute. No matter what, we will stay true to those values because we
    know our work demands the utmost excellence.
        Over the last few months, I've had the opportunity to visit many of
    our Boeing teams, talk about our safety culture, and gain ideas for how
    we can be better still. Last week, I saw our team in San Antonio--made
    up of 40 percent veterans--beaming with pride as they support the C-17
    fleet for our men and women in uniform. Earlier, I talked with our
    people in Philadelphia building Chinook helicopters; in St. Louis
    testing F/A-18 Super Hornets; and in Charleston, South Carolina, and El
    Segundo, California, connecting the world with the 787 Dreamliner and
    advanced satellites. I've also met with our people in Huntsville,
    Alabama, and New Orleans, Louisiana, who are building the rocket that
    will return humans to the moon and then travel on to Mars and those at
    Kennedy Space Center, Florida, who are preparing to launch the CST-100
    Starliner that will commercialize space travel. I've spent time also
    with our teams in Everett, Washington, who are testing the new 777X
    long-range jet and in Renton, Washington, where 12,000 amazing people
    pour their hearts into building the 737 MAX. These are the people of
    Boeing. I wish you could all meet them. They change the world. They are
    Boeing.
        I'm here today, honored to serve as the leader of this incredible
    team--talented engineers, machinists and all those who design, build
    and support our products. I want to answer all of your questions and
    convey to the world that we are doing everything in our power to make
    our airplanes and our industry safer and prevent an accident like this
    from ever happening again.
        And, Mr. Chairman, you have my personal commitment that I will do
    everything I can to make sure we live up to that promise.
        Thank you for listening, and I look forward to your questions.

        Mr. Chairman. Thank you very much, Mr. Muilenburg. During
    my opening statement, I mentioned an instant message
    conversation and then a series of e-mails. This message
    conversation was between the 737 MAX Chief Technical Pilot and
    a colleague and it expresses concerns about the operation of
    the MCAS. Boeing knew about this instant message for months but
    failed to share it with the FAA until recently.
        With regard to the e-mails, again, Mr. Forkner, the former
    MAX Chief Technical Pilot, calls for removing any mention of
    the MCAS flight control system from the flight crew operating
    manual. He talks about Jedi-mind tricking of regulators with at
    least one person who works for the FAA. So, with regard to the
    instant message conversation, when were you made aware of the
    existence of the November 2016 messages?
        Mr. Muilenburg. Mr. Chairman, as I recall, I was made aware
    of that message earlier this year. It was discovered as part of
    a document gathering process in response to a Government
    investigation.
        The Chairman. So, it was after the crashes? You were made
    aware of it this year?
        Mr. Muilenburg. Sir, as I recall, I believe it was prior to
    the second crash earlier this year.
        The Chairman. Prior to the second crash. Was it your
    decision to wait months before disclosing this to the FAA?
        Mr. Muilenburg. Mr. Chairman, at that point it had been
    identified as a document in response to an ongoing
    investigation and I relied on our counsel to provide that to
    the appropriate authorities.
        The Chairman. OK, what did the counsel tell you? Did he
    say, I am going to supply it to the Justice Department, or did
    he say I am going to get it to the appropriate authorities?
        Mr. Muilenburg. Mr. Chairman, I do not recall having a
    specific conversation about which authorities. Just again as
    part of this investigative process, our intent to cooperate
    fully with your request and to provide that to the appropriate
    authorities. I think over this time period, we provided, on the
    order, half a million pages of documents in support of various
    requests.
        The Chairman. Do you agree that this should have been
    provided to the FAA in retrospect?
        Mr. Muilenburg. Senator, as I became familiar with the
    details of the document over the last few weeks, as I expressed
    our disappointment and concern with the how this came to the
    FAA--I think you heard the same from Administrator Dickson--I
    called him and apologized for how this had come through the
    process. Again, I was not involved in the document production
    process, but I counted on our team to make sure all the right
    authorities were notified.
        The Chairman. OK, so we should look to the team then. Can
    you ensure the Committee that Boeing has now turned over all
    such safety-related communications to the FAA and related to
    the 737 MAX?
        Mr. Muilenburg. Senator, our team continues to cooperate
    with all requests for documentation. I am sure that additional
    documents will be provided over time as they are discovered as
    would be normal to the process, and we will cooperate fully
    with the requests.
        The Chairman. It seems to me that a request should not have
    to have been made with regard to that conversation, sir. Let me
    ask you, when did you become aware of the e-mails that I
    referred to in the second part of my question about Jedi-mind
    tricking regulators?
        Mr. Muilenburg. Senator, again just recently I have been
    informed of the details of those e-mails and instant messages--
    --
        The Chairman. Can you give us an idea of how recently?
        Mr. Muilenburg. Over the last couple of weeks when it
    became public news.
        The Chairman. OK. And you did not know about it until then?
        Mr. Muilenburg. Sir, I do not recall being briefed on the
    details of those documents any time prior to that.
        The Chairman. Can you see that this raises much concern
    about the level of coziness between Boeing personnel and FAA
    regulators?
        Mr. Muilenburg. Mr. Chairman, I understand the concern
    there, and again, we are doing our best to lean forward and
    provide information as part of this process. I can tell you
    that the comments, that the values, the approaches that are
    described in those e-mails are counter to our values, that in
    no way would meet any expectation I would have for our team or
    employees, so I understand the concern, share the concern, and
    am trying to convey it is not consistent with our values as a
    company at all.
        The Chairman. And this series of e-mails has only in the
    last few weeks come to your attention, is that right, sir?
        Mr. Muilenburg. Senator, as I said, I was aware of the
    documents that were being produced as part of an investigation.
    That is what I recall from earlier this year. I do not recall
    getting briefed on the details of these documents. Those
    details are things that I learned of over the last few weeks.
        The Chairman. Senator Cantwell.
        Senator Cantwell. Thank you, Mr. Chairman. And if you could
    help, I have a lot to go through, so we are going to try to
    move quickly through it. Was Boeing aware of the defects in the
    MCAS system which it failed to disclose to the FAA at the time
    the aircraft was in development and certification?
        Mr. Muilenburg. Senator, as you know the MCAS development
    occurred over a lengthy time period, about a six-year
    development program of the MAX. We have learned from both
    accidents and we have identified changes that need to be made
    to MCAS. We did, during the development process, follow our
    certification standards and long-standing industry standards
    behind the MCAS design but clearly, we have learned and there
    are things we need to improve on MCAS.
        Senator Cantwell. So are you saying----
        The Chairman. Answer the question, Mr. Muilenburg.
        Mr. Muilenburg. Senator, could I ask you----
        Senator Cantwell. Was Boeing aware of defect in the MCAS
    system which it failed to disclose to the FAA at the time the
    aircraft was in development and certification?
        Mr. Muilenburg. Senator, I just have to question, I will
    say, the premise of the question. So, as part of our
    development process, we do identify hazards and failure modes--
    --
        Senator Cantwell. And they were disclosed?
        Mr. Muilenburg. That was part of the failure mode analysis
    that we shared as part of the certification process during that
    time period.
        Senator Cantwell. So, you think everything that you were
    aware of was disclosed to the FAA as it relates to defects in
    the MCAS system?
        Mr. Muilenburg. Well Senator, as we get to defects--things
    we need to fix--we have identified three areas that we talked
    about that we need to address. One was the single sensor feed
    that was a piece of the architecture that was shared with the
    FAA. The fact that the system would operate more than once
    during a flight that was also part of the design description.
    And the control authority of the system at various parts of the
    flight----
        Senator Cantwell. Do you know what Mr. Forkner is referring
    to when he says, unknowingly lied to the FAA or Jedi-mind
    tricking?
        Mr. Muilenburg. Senator, I am not sure what he meant by
    that. We haven't been able to talk to him. He does not work for
    Boeing anymore. We have been trying to contact him.
        Senator Cantwell. Here is my concern, that if you do not
    know what he meant, then you also do not know what wasn't
    disclosed. And so, we do not know if there are things in the
    MCAS system that were defects that he or someone else knew
    about that were not disclosed. So, I hear what you are saying
    that there is a lot to discover in the process, but I would
    like to go over some of the very specifics about what was
    tested and did Boeing test the consequences of the MCAS
    reliance on a single AOA sensor? Did it test that?
        Mr. Muilenburg. Senator, we tested a broad array of
    different aspects of the MCAS system, a set of failure modes.
    We did thorough flight testing. You know, John, if you want to
    comment on the details there?
        Mr. Hamilton. Yes. Senator, the 737 NG is one of the safest
    airplane sets----
        Senator Cantwell. OK, look we are trying to understand what
    got tested. So did you test the reliability of the AOA sensors
    in general? Did you test the reliability on a single sensor?
    Did you consult with the pilots on the lack of guidance on MCAS
    in the flight manuals? Did you test the AOA sensors' degree
    alert to ensure reliability? Did you test the human factor
    response? These are all things from the Lion Air report and my
    guess is you didn't test those and that is at the heart of
    this. But if you did and you have data on that and it was
    provided to the FAA, that is what we want to see.
        Mr. Hamilton. Senator, we did test the MCAS uncommanded
    inputs to the stabilizer system due to whatever causes was
    driving it, not specifically due to an AoA sensor. We assessed
    that hazard level. We talked about pilots----
        Senator Cantwell. Now do you think it is wrong?
        Mr. Hamilton. In hindsight, Senator, yes.
        Senator Cantwell. Thank you because I agree.
        Mr. Muilenburg. Senator, if I can just add a point to that
    because as John pointed out, we relied on these long-standing
    industry standards as part of our evaluation of response time
    behind MCAS, and that is one of the areas that we found
    shortfall.
        Senator Cantwell. Here is the thing I am very confused
    about which is just this larger issue, and look we want to get
    this right because we do want to go forward and we know there
    is going to be automation in many aspects of our lives, but
    this robust testing that must occur and third-party validation,
    there were just--I just do not understand how you have sensors
    on the outside of a plane and you are going to let that send a
    command to the inside of the plane that basically says turn the
    plane 2.5 degrees and then all of a sudden you are going to be
    yelled at from the cockpit from somebody saying pull up and
    then at the same time you are being forced down in your nose
    and you have seconds to respond because you are in takeoff.
        That does not seem like a lot of robust testing was done to
    me because if it was then the Lion Air incident wouldn't have
    happened. OK, so I see my time, I have a few seconds left. I
    want to just bring up, look I think this whole issue of air
    speed is a major issue at large for all of us to get right in
    the sector. Those crashes about automation, even that Air
    France crash is related to a faulty pitot tube.
        I do not know how much we should be trusting things on the
    outside of a plane to give commands to the inside of the plane
    when they can be damaged. But I do want to know that you are
    improving the safety culture, this issue of both reporting,
    people not being able to talk to FAA, oversight people, and
    this issue of some of the machinist Boeing quality inspectors,
    their work being taken over. I want to understand that a safety
    culture is going to exist.
        Mr. Muilenburg. Senator, if anything I can leave with you
    today, I want to reinforce the culture of safety at Boeing, and
    we know we can improve, we encourage our employees to speak up
    when there are issues and some of those have been public
    recently.
        We respect and accept those inputs. We take action
    following on those. We have recently made a number of
    improvements that includes restructuring our safety review
    boards, elevating them to increase transparency and focus on
    safety. We have moved all 50,000 Boeing engineers to now report
    directly to our Chief Engineer, separating them from----
        Senator Cantwell. OK, I am going to ask you to come back on
    the SPIA and Boeing quality inspectors, two different issues,
    with a written response. Thank you, Mr. Chairman. I know I went
    over my time.
        The Chairman. Thank you. Now I have the duty of telling the
    distinguished Whip that he is limited to five minutes.
        [Laughter.]

                     STATEMENT OF HON. JOHN THUNE,
                     U.S. SENATOR FROM SOUTH DAKOTA

        Senator Thune. Thank you, Mr. Chairman. Mr. Muilenburg, it
    is my understanding that the MCAS has been substantially
    redesigned to include several redundancies that will better
    prevent erroneous activation. Could you speak to why some of
    the changes being made in the reconfiguration of the MCAS were
    not considered in the initial development of the system?
        Mr. Muilenburg. Yes, Senator. I think you raise a very
    important point. And as John began to allude to earlier, the
    original concept for the MCAS design was an extension of what
    we call the speed trim system on the 737 NG, the previous
    version of the 737, that is a single sensor system that has
    been proven safe in flight--more than 200 million flight hours.
        So, one of our safety principles is to minimize change from
    model to model. That is a good standard safety process that was
    the concept behind the original MCAS design. And what we have
    learned from both accidents is that we made some mistakes.
    There are some things we can improve. One of them is this idea
    of going to a dual sensor feed instead of single as well as
    limiting MCAS with a single action or activation during a
    flight.
        Those are improvements that we have identified. We take
    responsibility for that. We feel responsible for our airplanes
    and we know that there are some fixes that we need to make, we
    own that, and we are implementing those fixes going forward.
        Senator Thune. As we discuss possible improvements to the
    certification of an aircraft, it would be helpful for you to
    explain how safety supposed to be integrated into the
    certification process from the initial conception of the
    aircraft all the way to flying at 30,000 feet filled with
    passengers. Since these crashes, we have heard concerns about
    whether Boeing's relationship with the FAA is too cozy and we
    want a certification process that is efficient and that
    promotes U.S. competitiveness but one that always prioritizes
    safety. So, what would you say to address the concerns that
    have been raised about regulatory capture?
        Mr. Muilenburg. Senator, I agree with the focus in that
    area. I would say that over the last couple of decades the
    improvements that have been made in aviation safety are because
    of strong Government oversight, that includes the work of this
    Committee, it includes the other oversight of the FAA. The
    delegated authority process as it is structured, we do think
    has contributed to safety of the industry. I mentioned in my
    comments that it is about a 95 percent improvement in safety
    over the last two decades, some of that I believe is associated
    with the delegated authority, but we have to get the balance
    right.
        And I think it is very important that we have strong
    Government oversight, strong FAA oversight, but we also tap the
    technical depth that our industry teams can bring to the table.
    That is the concept. But if we need to rebalance it--I fully
    support evaluating that concept, looking at the details, and
    making sure we have got the balance right.
        Senator Thune. Could you briefly explain, very briefly if
    you could, how Boeing and the FAA work together to certify
    aircraft?
        Mr. Muilenburg. Yes. Senator, I could but I think Mr.
    Hamilton here is a deeper expert on that, if I could ask him to
    take that question?
        Mr. Hamilton. Certainly. Senator, the FAA is actually in
    control of the certification process the whole time. Let me
    just kind of walk you through the process very quickly. It
    starts out by identifying the requirements to certify the
    airplane. That is the sole authority of the FAA. It establishes
    the certification basis of the airplane. The second step is
    identifying the methods of compliance to those requirements.
    So, this is how you are going to show that the airplane design
    actually meets those requirements.
        Again, the FAA is the sole authority on that. That is their
    action. The third step is doing the testing, the analysis, and
    the documentation that demonstrates the airplane meets those
    requirements. And that is done by Boeing in our case or the
    applicant. And then there is a review of those documents to
    validate that they actually met the requirements, and that can
    be done by the FAA, or the ODA who acts as a designee of the
    FAA, or it can be a combination.
        And finally, there is oversight. The FAA does oversight of
    the actual unit members. They do oversight of the ODA and are
    you following the processes. They do oversight of did you find
    compliance as they expected with the methods of compliance. And
    then they do systemic oversight of the entire system.
        Senator Thune. And Mr. Muilenburg, how are you working to
    ensure, coming back to this issue of safety, that employees who
    raised concerns even if they inhibit your ability to get a
    product to the market quickly are taken seriously and then
    importantly those concerns are raised to the top and not
    brushed aside?
        Mr. Muilenburg. Senator, in my role as the CEO of this
    company I take that responsibility very seriously. We have a
    number of ethics hotline avenues that our employees can use.
    When it comes to delegated authority, in particular we also
    have additional survey tools that we deploy, and we openly
    share that data with the FAA and make improvements.
        That said, again, we know we can improve, and one of the
    areas that I have taken recent action on is to restructure our
    safety organization. So, we have now created a new safety
    organization. Vice President Beth Pasztor reports to my Chief
    Engineer who reports directly to me. That safety organization
    has responsibility for all safety related accident
    investigations, our ODA process, and also responding to any
    employee concerns.
        Senator Thune. Thank you, Mr. Chairman.
        The Chairman. Senator Klobuchar.

                   STATEMENT OF HON. AMY KLOBUCHAR,
                      U.S. SENATOR FROM MINNESOTA

        Senator Klobuchar. Thank you, Mr. Chairman, and thank you
    to Senator Cantwell. I also want to give my sincere thanks to
    the people who are here who lost their loved ones in these two
    crashes. I think you know you are here not only for them, and
    it must be hard to hear all this technical issues when you
    think of your brother or sister or father or mother or son or
    daughter, but I want you to know that we want to get to the
    bottom of this and we want to change this.
        So, I will start where Senator Thune was going with the FAA
    and Boeing, and this relationship. Our recent Inspector General
    report found that only 4 percent of airline manufacturer
    employees responsible for conducting the certification were
    certified by the FAA that conducted oversight. The same report
    found that one manufacturer approved about 95 percent of
    certifications for their own aircraft. What can you tell us
    about the percentage of certifications that Boeing conducts on
    its own aircraft?
        Mr. Muilenburg. Senator, I cannot answer that number off
    the top of my head. I do not know--John if you have a----
        Mr. Hamilton. No, I would have to follow up.
        Senator Klobuchar. OK. How many Boeing engineers both
    design systems for the company and then certify those same
    systems for the FAA? I am just trying to get at a safety check
    from the outside.
        Mr. Hamilton. So, we have approximately 1,000 engineering
    unit members that work not just in systems----
        Senator Klobuchar. But what percentage of them then certify
    the safety as opposed to having the FAA certify the safety?
        Mr. Hamilton. Those are roughly 1,000 unit members that are
    acting on behalf of the FAA to find the compliance, but that is
    beyond just systems. This includes structures and propulsion,
    so it is across the whole airplane.
        Mr. Muilenburg. Senator just to clarify, we have about
    50,000 engineers at Boeing. About 1,000 of them are what we
    call, operate in this area that John's referring to, unit
    members. So, these are members who have the authority and the
    training.
        Senator Klobuchar. OK. We will follow up. I am trying to
    get at when the FAA steps in and when you certify it yourself,
    and we will get that later. Two months after Mr. Forkner sent
    these messages expressing safety concerns, he asked the FAA to
    remove mention of the MCAS automated flight control feature
    from the 737 Max pilots' flight manual and training course, a
    change that the FAA approved in 2017.
        Notably Indonesia's National Transportation Safety
    Committee report on the Lion Air crash confirms that the
    pilot's lack of knowledge of MCAS was one of the key reasons
    for the plane crash. How frequently are new automated systems
    left out of the manual and training that you give to pilots?
        Mr. Muilenburg. Senator, first of all of one of the things
    we have learned from both of these accidents is that we need to
    provide additional information on MCAS to pilots. Just to give
    you context, as we develop our training manuals, our idea is to
    provide training to pilots so they can respond to the effects
    of failures as opposed to trying to diagnose failures and that
    is a very important distinction.
        And so more information in the training manuals is not
    necessarily safer but as we understand from both of these
    accidents, we need to provide more information on MCAS to
    enhance safety. But we do try to include information in the
    training manuals----
        Senator Klobuchar. But do you think it is acceptable that
    pilots are flying planes without knowing about these key
    automated flight systems?
        Mr. Muilenburg. Senator, again our approach is to train
    pilots on the effects of a failure mode. So, in this case, the
    MCAS automation system, when it fails it fails in what we call
    a runway stabilizer, uncommanded movement of the horizontal
    tail. That is what is in the training manual and we try to
    train pilots to respond to the effect of the failure as opposed
    to diagnose it.
        Senator Klobuchar. OK, let me move on to two more
    questions. After these terrible crashes have claimed 346 lives,
    do you think it makes sense for these aircraft to be allowed to
    fly in some countries and not others because the FAA says each
    country can make its own decision?
        Mr. Muilenburg. Well, Senator, we respect the jurisdiction
    of the regulatory authorities around the world----
        Senator Klobuchar. So, you think it is acceptable? Just say
    yes or no.
        Mr. Muilenburg. Senator, that is up to the regulatory
    authorities. That is not a decision that we can make. We
    respect the authority of the regulators.
        Senator Klobuchar. OK. You are saying the same thing again,
    so I am going to go with a yes. While there have been several
    factors that contributed to the plane crashes, one that is
    particularly troubling was highlighted in a recent article in
    the Washington Post, which found that the Lion Air had a faulty
    angle-of-attack sensor which gave pilots and airplanes systems
    unreliable information the day before it crashed. Do you think
    that is a problem and what steps can be taken to change that?
        Mr. Muilenburg. Senator, in the case of the angle of attack
    disagree alert we got the implementation wrong. I mentioned in
    my comments up front that we made some mistakes, we made a
    mistake in that implementation. Once we discovered it, our
    engineering teams quickly convened a safety review board.
        They confirmed that it wasn't an operational safety issue
    and the FAA subsequently concurred with that but nonetheless,
    we got the implementation wrong and we have addressed the
    faults in the process. We have fixed that. And angle of attack
    disagree alert will be standard implementation on all MAXs
    going forward.
        The Chairman. Thank you, Senator Klobuchar. Senator
    Fischer.

                    STATEMENT OF HON. DEB FISCHER,
                       U.S. SENATOR FROM NEBRASKA

        Senator Fischer. Thank you, Mr. Chairman. I too would like
    to recognize and offer my sympathies to the people that are
    here today and the people who are at home who have lost loved
    ones in these crashes. I hope that we can get answers at this
    hearing and also in the future so that these issues, these
    mistakes will not happen again and cause future loss of life.
        Mr. Muilenburg, the Joint Authorities Technical Review
    notes that Boeing made several other changes to the 737 MAX
    that differ from the earlier model, such as structural changes
    that would accommodate the new engines that were planned on the
    plane and other advanced technologies. Senator Thune touched on
    this with the delegated authority. Was Boeing delegated
    authority over the certification of those changes as well?
        Mr. Muilenburg. Senator, I cannot answer that question
    completely because as you pointed out to there were a number of
    changes. Again, those are done and evaluated jointly with the
    FAA. I don't know, John, if you want to comment on any
    specifics there?
        Mr. Hamilton. There were approximately 92 certification
    plans associated with the MAX which encompass all the different
    changes to the airplane. The FAA reviewed approximately 8 of
    those initially and----
        Senator Fischer. Are you looking into those certification
    processes as part of your review of the 737 MAX?
        Mr. Muilenburg. Senator, yes, we are. I asked my Board to
    set up an independent review committee headed by Admiral
    Giambastiani about 5 months ago, and that committee did its
    work, provided inputs that we are acting on. And with the other
    authorities, we are continuing to take a hard look at that, and
    we look forward to taking an action on those reports.
        Senator Fischer. OK. Also, the Joint Authorities Technical
    Review included a recommendation that states, ``if any flight
    control service is used in a novel manner, the FAA should be
    directly involved.'' This is based on the observation that the
    FAA was not, ``completely unaware of MCAS,'' but, ``because
    information and discussions about MCAS were so fragmented and
    they were delivered to disconnected groups within the process,
    it was difficult to recognize the impacts and the implications
    of this system.''
        Do you agree that the communication between Boeing and the
    FAA is fragmented to the point that relevant information on
    MCAS was not provided to the agency? Is this what you were
    referring to when you talked about getting the balance right?
        Mr. Muilenburg. Senator, I think you raise some very good
    points there. I do think one of the areas we can improve, and
    we have seen it in the JATR report and others is system-wide
    integration, cross system integration amongst the different
    technical expertise areas and improvements in documentation and
    communication. And again, we found some areas where we could
    have, should have, done better.
        Senator Fischer. Do you think those steps will improve your
    communication with the FAA?
        Mr. Muilenburg. Senator, I do.
        Senator Fischer. Do you think the FAA has a responsibility
    to also change its process to improve communication?
        Mr. Muilenburg. Senator, I believe the FAA does, but I
    would not say that is only the FAA's responsibility. We at
    Boeing need to make some improvements in communication and we
    own that, and we are committed to doing that.
        Senator Fischer. The Boeing 737 airplanes are based on a
    type certificate that was originally provided in 1967, I
    believe, and it has been amended to address the different 737
    model since then. The Technical Review notes that, ``some
    elements of the design and certification remain rooted in the
    original 1967 certification of the Boeing 737-100.'' Does
    Boeing or the FAA review the elements of the 737 that are based
    in the 1967 certification for continued safety when new models
    of the airplane are produced?
        Mr. Muilenburg. Senator, if I could ask John to field that
    question?
        Mr. Hamilton. Senator, as you note there is a single type
    certificate for the 737 but as the design has evolved with each
    new generation of airplanes, the safety standards on which the
    airplane is designed to have also evolved. Yes, there are some
    amendments that the designs might reference back to an earlier
    amendment level but those are likely changes that have not
    changed in the family of airplanes since the original design.
        An example might be some of the structural elements.
    However, we have stepped up in many areas voluntarily to later
    amendment levels to demonstrate that it still meets the latest
    standards in compliance.
        The Chairman. Thank you, Senator Fischer.
        Senator Blumenthal.

                 STATEMENT OF HON. RICHARD BLUMENTHAL,
                     U.S. SENATOR FROM CONNECTICUT

        Senator Blumenthal. Thank you, Mr. Chairman. Thank you to
    both our witnesses for being here today and thank you most
    importantly to the relatives who have lost loved ones. If you
    could please stand so we could thank you all. Thank you for
    being here. If you could just stand. Thank you.
        The Chairman. Go ahead and hold up the photographs that you
    brought.
        Senator Blumenthal. I was going to ask that you hold up
    those photographs because I understand that for security
    purposes you cannot during the hearing but just for this short
    period of time. Mr. Muilenburg----
        The Chairman. So, thank you, and if the timekeeper could
    start Senator Blumenthal's time over. Thank you very much to
    the family members. Senator Blumenthal.
        Senator Blumenthal. Thank you very much, Mr. Chairman. Mr.
    Muilenburg, as I watched those loved ones stand and frankly as
    I reviewed this file over the past week or so again and as I
    sit here today my anger has only grown. These loved ones lost
    lives because of an accident that was not only preventable as
    the Chairman said at the very start but was the result of a
    pattern of deliberate concealment.
        Boeing came to my office shortly after these crashes and
    said they were the result of pilot error. Those pilots never
    had a chance. These loved ones never had a chance. They were in
    flying coffins as a result of Boeing deciding that it was going
    to conceal MCAS from the pilot. And the best evidence is this
    message from Mark Forkner saying in effect we are going to
    conceal MCAS, delete it from the manual used in training. When
    did you become aware of the fact that MCAS was not going to be
    included in the flying manual?
        Mr. Muilenburg. Senator, first if I could express my
    deepest sympathies for----
        Senator Blumenthal. You have done that, and my time is
    limited. I apologize for interrupting you, but I want to know
    specifically when you became aware of this effort?
        Mr. Muilenburg. Senator, I cannot reference that e-mail and
    I am not----
        Senator Blumenthal. I am not asking about the e-mail. You
    have been asked about the e-mail already. I am asking you about
    Boeing policy as reflected in this e-mail, its chief test pilot
    deciding he was going to mislead pilots who were then going to
    take passengers into the air, these loved ones, and turn those
    planes into flying coffins.
        Mr. Muilenburg. Senator, I am not sure what Mr. Forkner
    meant by that e-mail. I can tell you that certification and
    training materials are not determined by one individual.
        Senator Blumenthal. In fact, let me just interrupt you
    again. In the over 1,600 page original flight manual of Boeing
    737 MAX, the aircraft's new MCAS computer system was mentioned
    only once, once in 1,600 pages in the glossary of abbreviated
    terms. So, when Boeing came to us and they said it is the
    pilot, inexperienced pilots, you were lying to us as well.
        Mr. Muilenburg. Senator, if I could try to respond to your
    question. First of all, the premise that we would lie or
    conceal is just not consistent with our values.
        Senator Blumenthal. Well I know it is not consistent with
    the values that you are articulating here but let me just,
    since my time is limited, move on. Would you agree that this
    system of certification and oversight is absolutely broken?
    That is the lesson here, isn't it? That Boeing lobbied the
    Congress for more delegation and now we have to reverse that
    delegation of authority. Would you support those legislative
    efforts?
        Mr. Muilenburg. Senator, again I support taking a hard look
    at the delegated----
        Senator Blumenthal. I am not asking you for a hard look, I
    am asking you for a commitment here because you have the
    opportunity to make things right?
        Mr. Muilenburg. Senator, I am not familiar with particular
    legislation, but I am committed to working and supporting it.
        Senator Blumenthal. Boeing asked for legislation that
    exists right now. Will you commit to supporting reform efforts
    such as many of us on this Committee are advocating?
        Mr. Muilenburg. Senator, we will commit to participating in
    those reform efforts and providing our inputs.
        Senator Blumenthal. Well, I agree that your input would be
    valuable. I am looking for input in support of reform that will
    stop outsourcing by the FAA, and I might just add, the FAA has
    been really disappointing and its disclosure to us is an
    example, the kind of disclosure the FAA has given us, total
    redaction. I have asked for full disclosure of documents. The
    FAA has failed to provide them.
        I have asked for the FAA to return my phone calls. It has
    failed to do so and I think the FAA is part of this problem as
    well, and it is the result at the end of the day of Boeing
    rushing this process, I am using the Chairman's terms, putting
    profits over safety, rushing the certification process with you
    in charge of that certification and prioritizing speed and cost
    over safety.
        And my time has expired but the folks who really deserve
    time here are the people who lost loved ones.
        The Chairman. Thank you, Senator Blumenthal. Let us do
    this; this poster is entitled, ``MCAS lives in both FCC.'' If
    you can provide a copy of that, we will admit it into the
    record at this point without objection.
        [The information referred to follows:]

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you. And Mr. Hamilton, let me just ask
    you, when it says MCAS does live in both FCCs, what does that
    mean? Briefly.
        Mr. Hamilton. Certainly. So, the MCAS function is
    replicated in the two flight control computers that are onboard
    the airplane. And so, each flight control computer previously
    received its input from one AOA sensor on the left or right
    side. In the software changes we are making going forward, now
    both flight control computers will receive the data from both
    sensors, compare it, and only if they agree they will activate.
        The Chairman. OK. Thank you. Senator Moran.

                    STATEMENT OF HON. JERRY MORAN,
                        U.S. SENATOR FROM KANSAS

        Senator Moran. Mr. Chairman, thank you. Mr. Muilenburg, did
    you determine that the failures that resulted in the tragic
    consequences, were they failures in the policies and protocols
    that Boeing had in place or was it a failure to comply with
    those protocols and policies that resulted in these
    consequences?
        Mr. Muilenburg. Senator, in some cases we relied on these
    longstanding industry-standards, policies, and certified to
    those, and we are now raising questions around those. That gets
    back to this pilot response time discussion that we had
    earlier. And in some cases, we missed on implementation as I
    mentioned earlier with the angle of attack sensor but overall,
    we did follow the certification process and steps. But
    nonetheless, we have learned from both of these accidents. And
    the fixes that we need to make are clear.
        Senator Moran. So, the fixes are both in policy and then
    making certain that the policies are followed once the new
    policies are in place?
        Mr. Muilenburg. Senator, I believe both are true, yes.
        Senator Moran. Thank you. And I assume there is other
    certification and just developments at Boeing that are always
    ongoing. Have you changed your behavior and or policies for the
    certification and development process for other pieces of
    equipment, other aircraft that Boeing is now proceeding toward
    certification?
        Mr. Muilenburg. Senator, we have, and we are going to
    continue to change. As I said we have learned, but we are still
    learning. I mentioned earlier that we changed our safety review
    board structure. That is a big, substantive change, the stand-
    up of our new safety organization. The realignment of our
    engineering team, those 50,000 engineers. We are also taking a
    look at some of those long-standing assumptions behind how we
    design as we look at next generation products like the 777-X as
    an example. So, we are taking a comprehensive approach to those
    updates.
        Senator Moran. As this Committee looks certainly at
    certification, as we look at the FAA, what suggestions does
    Boeing have for this Committee when you look at any policies or
    failures at the FAA? So, the way I would view this is we have
    two major organizations involved in this process: one is the
    manufacturer Boeing, the other is the Federal agency that is
    there to certify. My assumption is that neither one did things
    right. And what have you learned about the FAA that we should
    know as we look at the FAA now and in the future?
        Mr. Muilenburg. Senator, we have a great deal of respect
    for the FAA. I have personally worked with the FAA for many
    years, have a great deal of respect for them and their
    professionals. I know the FAA is also taking a hard look at all
    of the reports and inputs and investigations and is committed
    to making changes. I think you heard that from Administrator
    Dickson.
        Senator Moran. Do you have suggestions on what changes the
    FAA should make?
        Mr. Muilenburg. Senator, I do not have specific
    recommendations for you, but we would be glad to follow up on
    that if it would be useful.
        Senator Moran. Thank you. Where are we now in the 737 MAX?
    It seems like every week there is a report that an airline is
    going to believe they are going to have that plane flying again
    or certification is nearby. What is the status?
        Mr. Muilenburg. Senator, we are in the final stages of the
    process, so we are currently testing the final software
    updates. When ready and with the FAA's approval, we will
    proceed to a certification flight in the near-term. Subsequent
    to that it would be the FAA's responsibility to evaluate and
    issue an airworthiness directive. That is all work that we are
    proceeding on over the next few weeks and months, but I think
    it is important again that the airplane will return to service
    when it is safe. This is not going to be timeline driven. We
    are committed to answering every question the regulators have
    and the airplane will fly when everyone is convinced it is
    safe. That is the most important thing here.
        Senator Moran. It troubles me that to get to that point is
    certainly not that it is taking so long, I want the result that
    you just described but with the right circumstance before we're
    flying again, but it would suggest to me that there was much
    more significant problems with the MAX 737 if it was previously
    certified and yet now it takes so long. It is something more
    than just a glitch, it is something more than just a minor
    change. That makes me concerned about the process that allowed
    it to be certified in the first place. What am I missing?
        Mr. Muilenburg. Senator, I think you raise a very good
    point. Our initial effort early this year was focused on the
    MCAS updates that we have already talked about. Around the
    middle of the year, as we were evaluating all of the other
    inputs and data, we identified some additional safety
    enhancements that we can make. Not something that was required
    for certification but something that we thought while the
    airplane was grounded was the right thing to do and a safety
    enhancement, and rather than waiting to do that later after
    return to service, we as a company and with the FAA decided
    that we would take the extra time for those additional software
    updates.
        And that is the work we have been doing through the summer
    and into the fall. That is designed to add additional software
    redundancies throughout the flight control computers and that
    is the final software we are testing. What I want to convey
    here is this is really the culture of Boeing. And I understand
    the questions that are being raised but when our teams find
    opportunity to improve safety, that goes to the top of the
    list. That is the top priority.
        And if it takes time, if it takes money to do that, that is
    where we are focused and that is why it is taking longer than I
    think some anticipate.
        Senator Moran. I request your follow up on your thoughts
    about the FAA. Thank you.
        The Chairman. Thank you, Senator Moran. Senator Markey.
    Senator Udall. Senator Peters.

                    STATEMENT OF HON. GARY PETERS,
                       U.S. SENATOR FROM MICHIGAN

        Senator Peters. Thank you, Mr. Chairman. Let me begin also
    by expressing my sympathies to those who lost loved ones in the
    two 737 MAX crashes and I would like to thank the families that
    are here today for your continued attention to safety and for
    working to prevent future tragedies like we saw here.
        Over the years out aviation system has become the safest in
    the world, but these tragedies certainly remind us so that we
    cannot rest, safety cannot be taken for granted. There is no
    doubt from what we have been hearing in the testimony here
    today that many mistakes were made, and the consequences were
    unfortunately tragic. The reports from technical experts
    underscore that technology becomes increasingly complex. The
    debate about how to move forward cannot be simply about a one-
    size-fits-all regulatory regime versus a let the free market
    just police itself type of approach.
        We have a new paradigm and they need to be developed to
    address the regulatory challenges associated with very complex
    technology and that is something this Committee needs to weigh
    in very heavily into as we move forward. Mr. Muilenburg, as you
    know, the BP oil disaster in the Gulf of Mexico killed 11
    workers, lasted 87 days, and cost upwards of $65 billion.
        And in the wake of that disaster, it was revealed that the
    oil and gas industry have lobbied for the reduced safety
    precautions that could have prevented that disaster. We often
    hear in Congress about how much our regulations cost industry
    however thoughtful regulation plays an incredibly important
    role in protecting the public.
        So, I am curious if Boeing's view on oversight has changed
    in the wake of this tremendous human tragedy as well as the
    cost that this company is facing right now. Has your view
    changed? You have talked in response to an earlier question
    about having a balance. Clearly something is wrong with that
    balance. Please let me know if your thoughts have changed
    recently?
        Mr. Muilenburg. Senator, my thoughts have changed. We have
    learned lessons from these two accidents and the families that
    are here with us today, the pictures we saw, they are
    heartbreaking. They remind us of the importance of the work we
    do and the paramount importance on safety. That is what makes
    this industry great, and strong oversight is part of the fabric
    of our industry, always has been, and I think this should give
    us pause to take a hard look at that.
        Senator Peters. Well, the hard look. You said we need to
    look at the balance. Has the balance gone too far to allowing
    the industry to police itself?
        Mr. Muilenburg. Senator, I do not know if I can
    characterize it that way. My sense is that we all have the same
    objective here. We all want the safest industry possible. That
    is our objective and my sense is that we could look at the
    balance. There are refinements that would be worthy. I think,
    you know, technology----
        Senator Peters. Do you think it is out of balance now based
    on what happened here? Do you think we have not just taken a
    look at it, but seriously understand that the balance may be
    out of whack if we delegate too much to industry and do not
    have impartial eyes and make sure the regulatory regime is
    sufficient. That you truly have impartial eyes looking at these
    factors. It is going to save lives and you won't put a company
    through the cost that you have when you balance those
    regulations. Is it out of balance right now, yes or no?
        Mr. Muilenburg. Senator, again, I think it can be improved.
    I completely agree with you on the importance of strong
    oversight. I have worked in this industry for more than three
    decades from airplanes to spacecraft. People's lives depend on
    what we do and strong oversight from the Government is a key to
    the safety of our industry. So, I think we have a shared
    objective there and we will work with you on examining any
    improvements we can make. We have a mutual interest.
        Senator Peters. Mr. Muilenburg, the NTSB report indicated
    that the FAA and industry have historically used highly trained
    test pilots to verify the safety of new aircraft models rather
    than average pilots who typically have less experience. Does
    Boeing use pilots with average training and experience?
        Mr. Muilenburg. Senator, our Boeing test pilots are
    experienced, highly qualified pilots. We work with airlines,
    the FAA, and the regulators to bring other pilots in from
    around the world as part of the evaluation, but I think as you
    are pointing out as we look to the future again, we want to
    make sure that the testing we are doing is representative of
    that future pilot population.
        Senator Peters. Thank you.
        The Chairman. Thank you, Senator Peters. Senator Capito.

                STATEMENT OF HON. SHELLEY MOORE CAPITO,
                    U.S. SENATOR FROM WEST VIRGINIA

        Senator Capito. Thank you, Mr. Chairman. I thank the
    Ranking Member as well. I want to say first of all to the
    families who are here, extending my sympathies but also my
    gratitude for you coming forward through your pain to bring to
    us to Congress, which is not an easy thing to do, your
    frustrations and probably stronger feelings in the loss of your
    loved ones. I will say that when Colgan flight 3407 went down
    in Buffalo in early 2009, the families that came forward to us,
    I was on Transportation committee on the House side, made such
    an incredible impact and it made flying on our regional
    airlines much, much safer because of that.
        So hopefully that will be what the result of this is for
    you today and for all of us. Mr. Muilenburg, particular
    attention has been called to the fact that Boeing later in the
    development process of the MAX revised the range of flight
    conditions that could lead to activation of the MCAS, but that
    Boeing did not notify the FAA of these changes at the time.
    This is troubling if in fact this is true. Was Boeing not
    obligated by the FAA to report changes like the ones I just
    described?
        Mr. Muilenburg. Senator, I believe you are referring to the
    low-speed extension of MCAS and I have seen those same reports,
    but they do not reflect the facts. The extension of MCAS low
    speeds was done in a rigorous way. It was done in a very
    visible way. There was testing done on that from the mid-2016
    time-frame to the early 2017 time-frame including flight test
    with the FAA onboard. The FAA was aware of the low-speed
    extension and ultimately certified that, and I believe FAA
    leadership has publicly stated----
        Senator Capito. So that is a false report then?
        Mr. Muilenburg. I believe it is a false report. I believe
    the low-speed extension was fully certified with the FAA.
        Senator Capito. OK. Another report that has been out in the
    media and among is that after the second flight went down that
    Boeing actually actively lobbied the FAA to keep the planes in
    the air. Can you respond to that?
        Mr. Muilenburg. Senator, could you just clarify your
    question for me?
        Senator Capito. Yes, after the second plane with Ethiopian
    Air went down that there was quite--several countries had
    limited the flight of that plane. We have not done that yet in
    the United States. There are media reports that Boeing was
    actively lobbying the FAA to keep the planes in the air at that
    time in this country. Is that true?
        Mr. Muilenburg. Senator, let me, let me clarify what was
    happening in that timeframe.
        Senator Capito. Could you make it brief, please?
        Mr. Muilenburg. Yes. We immediately after that accident
    reached out to the FAA and other regulatory authorities to
    understand what happened in the accident. What has made
    aviation safe is that we make decisions based on data. At that
    point we didn't have data and so we with the FAA were looking
    to understand what happened. There were early reports that the
    airplane had some kind of low speed, low altitude problem that
    turned out to be incorrect.
        So, we, with the FAA, were pursuing data to make a good
    safety based decision. That was our position with the FAA. When
    data became available, satellite data that was referred to in
    the media, again with the FAA we came to a conclusion that
    there could be similarities between the two accidents and that
    led very quickly to a decision to ground the fleet.
        Senator Capito. Well, I think, you know, in retrospect I
    think it was pretty obvious and I do not want to say
    conclusively so but there is a problem and a consistent
    problem. The other thing that has really bothered me about this
    whole thing and I questioned this in the last Committee hearing
    that we had. Between the Lion Air crash and the Ethiopian Air
    crash, it defies logic to me that some of these folks who wrote
    e-mails or sent text messages did not come to you and to the
    expertise of the engineering of these engines and of these
    planes and say this is what we were talking about.
        Why was there any reaction at all like that within your
    company after the Lion Air crash? And do not tell me because
    you did not have the official report, that would have maybe
    saved those people in that Ethiopian Air flight.
        Mr. Muilenburg. Senator, I think about that decision over
    and over every day. And if we knew everything back then that we
    know now, we would have made a different----
        Senator Capito. OK, the question then, did people come to
    you at the highest levels, at any level, and say wait a minute,
    this is sounding familiar? Yes or no?
        Mr. Muilenburg. Senator, after the first accident we
    convened our broad technical team across Boeing. It wasn't any
    single individual or small team. It was a broad team. We
    brought all those experts to bear trying to assemble data from
    the accident, understanding what occurred. We quickly with the
    FAA issued an operational bulletin to remind everyone of the
    training and the emergency scenario that----
        Senator Capito. Around that particular system?
        Mr. Muilenburg. Around what we call runaway stabilizer,
    which again is the effect of that system, and at the same time
    we began work on an MCAS software update in that timeframe.
        Senator Capito. So, the answer is yes. Thank you.
        Senator Cantwell. Mr. Chairman, just one point of
    clarification. Are you saying Mr. Muilenburg the FAA did know
    about the 2.5 trim not 0.6 but 2.5? The FAA knew about that?
        Mr. Muilenburg. Yes, Senator. You are referring to that
    low-speed extension which is the 2.5 degree trim?
        Senator Cantwell. Yes.
        Mr. Muilenburg. That is the low-speed extension. The FAA
    did know about that and participated.
        Senator Cantwell. Thank you.
        The Chairman. Senator Udall.

                     STATEMENT OF HON. TOM UDALL,
                      U.S. SENATOR FROM NEW MEXICO

        Senator Udall. Thank you, Mr. Chairman, and thank you to
    the Ranking Member for having this hearing. And Mr. Muilenburg,
    you know, I first want to say to all the people that stood up,
    that I am very moved by you being here and that your losses are
    very, very I think heartfelt across the Committee here. And,
    you know, the thing that really bothers me is knowing that it
    is preventable. It makes it even more outrageous that we
    haven't made the kind of dramatic changes that I want to talk
    to the CEO here about. Mr. Muilenburg, you showed some emotion
    when these folks stood up and everything.
        What should come from that emotion is some action to do
    something to really make a difference, and for this Committee
    to coalesce around the solution that is really going to move us
    forward would require you to step forward and specifically say
    what you support. And I haven't seen you do that in all the
    questioning you have been asked over and over again. What would
    you support? I mean, it is absolutely clear that it is too cozy
    a relationship with the FAA and your airline. And so, what is
    it you are going to commit to specifically in terms of reform?
    That is why you are up here.
        And that is what we want to see you do is to weigh in with
    us, this is what would make a difference, this is what would
    make it safer, this is what would make sure that we do not lose
    passengers like this in the future or the crew.
        Mr. Muilenburg. Senator, while I respectfully do not agree
    with the characterization of coziness with the FAA, we respect
    the independent oversight of the FAA and that is very important
    to us from a safety principle standpoint. We have taken a
    number of internal actions that we think are meaningful as they
    relate to our own internal reforms on safety.
        We are engaged in the legislative process, and Senator, I
    appreciate your invitation for us to be involved in that. I
    know there are many stakeholders. As you heard from me earlier,
    we are committed to strong oversight in the aerospace industry.
    It is part of what makes this system safe. We have a shared
    objective and if there are things we can do to make it better
    we will. I do not know John if you have any specific----
        Mr. Hamilton. Thank you. Senator, you know, I would say
    that, you know, one of the big issues was we made use of an
    industry standard assumption on pilots and how they would react
    and that proved incorrect in these two accidents. So, in terms
    of things that I think we need to change with the FAA, we need
    to go revisit some of these regulatory guidances and make sure
    they are up to date.
        I would even tell you that there are probably some
    regulations that we advocate as part of the FAA reauthorization
    bill, 10 regulations, that FAA should work with industry to
    update based on technology that is out there today. But in
    terms of opposing this, I used to be the lead administrator for
    the ODA, and I can tell you that we have a respectful
    relationship with the FAA, but we do have our differences of
    opinion sometimes.
        But we discuss those, we work it out on how we are going to
    comply, and it is not a cozy relationship. It is a professional
    relationship.
        Senator Udall. It is a relationship that didn't work for
    the consumers and for your employees that went down in those
    flights. You and others in your company blamed the deceased
    pilots and the culture of the countries where the crashes
    occurred for the accidents. But from what we have seen in the
    last year since the first crash, it appears that Boeing's own
    culture is more blameworthy for installing a faulty system that
    resulted in too many deaths and could have caused more.
        This culture starts at the top and that is why I have been
    asking you for the specifics of what you support, and I hope
    after this hearing you will come forward and when there is
    legislation out there say this is going to make it better and
    come up here and spend some time to build the consensus to get
    this done.
        Because I think the large, powerful interests that are a
    part of this do not want any reform. They want you to tinker
    around like you are talking about it, but they do not want to
    see any reform. If Boeing could not guarantee that pilots were
    prepared to fly these jets, your company should not have sold
    them. Did anyone at Boeing question, hesitate, or raise any
    issues prior to selling the 737 MAX 8 with this software to
    Lion Air or Ethiopian Air?
        Mr. Muilenburg. Senator, first we look forward to
    responding to your request there and providing inputs on the
    reforms. To your question, we do rely on the airlines and the
    regulatory authorities around the world as part of this
    integrated system to make sure we are fielding airplanes and
    crews that can fly safely. I do think it is important for me to
    clarify a point that you made earlier. We have not blamed the
    pilots and I know that has been reported but that is not our
    company position and it never will be.
        We are responsible for our airplanes. We are responsible
    and we own that. Regardless of cause, any accident with one of
    our airplanes is unacceptable.
        Senator Udall. That change is welcomed but that about the
    culture went out from your company early on. Thank you, Mr.
    Chairman.
        The Chairman. Thank you, Senator Udall. Let's do this at
    this point. Mr. Muilenburg, the JATR published 12 main
    recommendations. Will both of you get back to us on the record
    and tell us Boeing's position with regard to these 12
    recommendations?
        Mr. Muilenburg. Senator, we will.
        The Chairman. Thank you. Senator Markey is next.

                   STATEMENT OF HON. EDWARD MARKEY,
                    U.S. SENATOR FROM MASSACHUSETTS

        Senator Markey. Thank you, Mr. Chairman. Let me begin by
    recognizing the families who lost so much on these flights.
    Many of you are here today including Michael Stumo and Nadia
    Milleron, the parents of Samya Stumo, a University of
    Massachusetts Amherst graduate and a resident of Sheffield,
    Massachusetts who was tragically killed on the Ethiopian
    flight. The losses that the Stumo family and all of the
    families suffered is absolutely inexcusable and we will
    remember that as we are moving forward in the drafting of
    legislation. We will do it in the memory of your families.
        One thing is clear to make sure that safety is our top
    priority is to guarantee that every aviation safety measure is
    built into every plane and that it is never for sale.
    Unfortunately, our current laws only prevent aircraft
    manufacturers like Boeing from selling critical safety elements
    for an additional price. Existing rules allow companies to
    charge extra for non-critical safety enhancing features. And
    Boeing actually does charge more for those technologies.
        The 737 MAX aircraft involved in the Indonesian and
    Ethiopian crashes lacked two, two safety enhancing features, an
    angle of attack indicator and a disagree light. Both of these
    technologies would have helped the pilots recognize the faulty
    sensor readings were causing the plane's automated flight
    control system to push the aircraft nose down toward the
    ground. With that knowledge the pilots may have been able to
    take more effective action to prevent these crashes. In fact,
    the Indonesian crash report released last week specifically
    cited the lack of a disagree light on the 737 MAX as
    contributing to the Lion Air tragedy.
        Shamefully, the law allows Boeing to treat these safety
    technologies as a la carte add-ons that airlines can obtain
    only by paying an extra fee. A la carte add-ons, safety. Not
    like XM radio, all leather seats on a plane, safety is a la
    carte. Safety is an added on feature. These tragic crashes have
    made it all too clear that there should not be any distinction
    between critical and non-critical safety enhancing features and
    that is why I have introduced my Safety is not for Sale
    legislation.
        My bill will require aircraft manufacturers like Boeing to
    offer or provide any technology that measurably enhances safety
    without an additional charge to airline carriers. If you
    believe that safety should never be for sale, the question is
    why was it? Now you seem to now recognize that the disagree
    light should be standard, but you have yet to say the same
    thing about the angle of attack indicator and whether or not
    that should be offered for free or whether or not each airline
    should be given the option of not building it into the plane
    for free.
        So, I think you have to make a decision here in terms of
    where you want to go because otherwise your disagree light is
    still oncoming from Boeing toward the safety features. So, I
    want first of all to have you answer whether or not according
    to the Wall Street Journal you agree that Boeing did not
    originally include the disagree light on the 737 even though
    the same technology was standard on prior models of the
    airplanes, is that correct?
        Mr. Muilenburg. Senator, I feel I need to respond to your
    earlier point about selling safety. We do not sell safety. That
    is not our business model. And I do want to clarify your points
    on the angle of attack indicator. That is a system that we have
    offered as an option to airlines. Some airlines do not want it.
    It is not necessarily a safety improvement. It actually takes
    up space on the flight deck displays and more information on
    the displays is not necessarily safer. So that is not a safety
    feature. On the angle of attack disagree----
        Senator Markey. All I am saying is you should not offer it
    for a price. You should give the option to the airline without
    any price attachment. Do you agree to do that?
        Mr. Muilenburg. Senator, yes. And in fact, we have already
    announced that the angle of attack disagree alert will be on
    all MAX airplanes going forward, standard, and the angle of
    attack indicator will be available as an option to all airlines
    at no cost.
        Senator Markey. So, given your stated support for the
    principle behind my legislation, will you support my
    legislation that ensures that you offer to provide any
    technology that measurably enhances safety without an
    additional fee to airlines? Would you agree to support that
    legislation?
        Mr. Muilenburg. Senator, I haven't seen the specific
    legislation. I think the principle around focusing on safety is
    a top priority. I agree with that and it is a worthy principle,
    and I ask if we could take a look at the legislation.
        Senator Markey. The key is just--the word is free to an
    airline for anything that measurably impacts safety. Do you
    agree?
        Mr. Muilenburg. Yes, we do not sell safety and that is not
    our business model.
        The Chairman. Thank you. Thank you, Senator Markey.
        Senator Duckworth.

                  STATEMENT OF HON. TAMMY DUCKWORTH,
                       U.S. SENATOR FROM ILLINOIS

        Senator Duckworth. Thank you, Mr. Chairman. So, I am going
    to try to put some of the issues here into layman's terms. I
    want to first of course share my sincere condolences to the
    families who are here, but also to the families in Ethiopia and
    in Indonesia who are watching this hearing, who will be
    watching this hearing. I do not speak Amharic, but for the
    Indonesians----
        [Speaking in a foreign language.]
        Senator Duckworth. And what I just said was we will as
    Senators get to the bottom of this tragedy and we will continue
    to investigate this. We will not stop because you see Boeing
    sells its aircraft to the world and we in America have well-
    earned reputation as leaders in aviation in the world and I
    want us to reach that shining example once again.
        Pilots know that tragedies do not occur in a vacuum.
    Catastrophic outcomes result in long succession of failures
    that often overwhelm the pilots at the control of the aircraft.
    We call it an aviation the accident chain and there are many
    links in an accident chain that must happen that would
    eventually overwhelm the pilots and results in the crash. Many
    of these links in the accident chain happened with Boeing and
    your decisions in the development of the 737 MAX. So, let me
    talk about what has happened here. You put a sensor on the
    outside of the aircraft, which is standard, but you allowed
    that sensor to override the pilot's input in this system.
        So, in every other 737 aircraft, there is the function of
    the, you can pull back the pilot, the cutout, and that will
    override that uncommanded nose-down altitude. That is standard.
    That is the basic assumption. As you said you use an industry
    standard on how a pilot would react to a malfunction like that.
        Uncommanded nose down, every pilot including helicopter
    pilots, you pull back. But what you did was you put an MCAS
    system into an aircraft, you didn't tell the pilots that this
    MCAS system was in there, and you put in a function in order
    for the MCAS to work the way you wanted it to work after the
    pilot does to uncommanded--reaction to the uncommanded nose
    down, in every other 737, cutout, that is the end of it.
        In the 737 MAX, after five seconds, the system resets and
    it pushes the nose right back down. The pilots had exactly
    three seconds to pull, nose down, pull up. Now we got to do a
    new procedure that did not exist in previous 737 models, which
    is the electronic cutout switch because you have now put in a
    system that overrides the pilot in command of that aircraft.
        So, you have been telling this Committee that, yes, you use
    basic pilot reactions. That is true. But you have not been
    telling this Committee the whole truth. Time and again, this is
    my frustration, Boeing has not told the whole truth to this
    Committee and to the families and to the people looking at
    this. Yes, the pilots did exactly what they were supposed to do
    but five seconds later, especially if that sensor is still
    stuck, it overrides what the pilot does, and it pushes the nose
    right back down again. Three seconds.
        A pilot's best friend is time and altitude. And on takeoff
    there is no altitude and he has got no time. You set those
    pilots up for failure. And when I sent you a letter asking you
    to answer several questions, it took Boeing over five months to
    respond to my question. I only got the answers the day before
    you and I met. And one of the questions I asked was, what date
    did Boeing discover that a stuck angle of attack vane would
    result in MCAS issuing persistent commands with unlimited
    authority to trim the airplane nose down?
        In layman's terms, if this vane is stuck, MCAS will
    continue to provide faulty directions and will keep pushing
    that nose down over and over and over again no matter how many
    times an experienced 737 pilot pulls back on the yoke, five
    seconds later, reset, nose back down. You knew in 2016 that
    this was happening and your team at Boeing decided we didn't
    need to fix that because of well-understood piloting techniques
    and procedures.
        But the problem is that the well-understood piloting
    techniques and procedures are to pull back and that is it. But
    you added something else. You put in a system you didn't tell
    pilots about and then you put in an override by resetting the
    system 5 seconds later.
        Boeing is the company that built the Flying Fortress that
    saved Europe. I remember watching B-17s fly above--it is a
    storied aircraft that has rescued the free world and yet you
    knew about these problems and you continued to put the system
    into place. And when we asked you to answer these questions,
    you have told this Committee and you have told me half-truths
    over and over again, including in that meeting. This is why I
    am so upset. You have not told us the whole truth and these
    families are suffering because of it.
        The Chairman. Thank you, Senator Duckworth. Members of the
    Committee, at this point Senator Scott is deferring his time to
    the Chairman of the Subcommittee, Senator Cruz. You're
    recognized, sir, for five minutes.

                      STATEMENT OF HON. TED CRUZ,
                        U.S. SENATOR FROM TEXAS

        Senator Cruz. Thank you, Mr. Chairman. Mr. Muilenburg, I
    have to say the testimony here today has been quite dismaying.
    I want to focus on the text exchange that has been referred to
    and has been publicly reported on. This was a text exchange
    between Mark Forkner who was then Boeing's technical pilot for
    the MAX, chief technical pilot for the MAX, and Mr. Gustavsson
    who in 2018 was promoted to being Boeing's 737 chief technical
    pilot. Is that right?
        Mr. Muilenburg. We believe that is the case, Senator.
        Senator Cruz. So, this exchange is stunning. Mr. Forkner,
    ``oh, shocker alert. MCAS is now active down to M2. It is
    running rampant in the sim on me. At least that is what Vince
    thinks is happening.'' Gustavsson responds, ``oh great, that
    means we have to update the speed trim description in volume
    2.'' Mr. Forkner, ``so basically I lied to the regulators
    unknowingly.'' Gustavsson, ``it was not a lie. No one told us
    that was the case.'' Forkner, ``I am leveling off at like 4,000
    feet, 230 knots, and the plane is trimming itself like crazy. I
    am like what?'' Gustavsson, ``that is what I saw in sim 1 but
    on approach I think that is wrong.'' Forkner, ``granted I suck
    at flying but even this was egregious.''
        That exchange describes what happened in Lion Air and
    Ethiopian Air. The men and women who are gathered here with the
    photos of your loved ones, 346 people are dead because what
    these chief pilots described as egregious and crazy--that is
    their language, that is Boeing's internal language in this
    exchange. Now what I find truly stunning, Boeing handed this
    exchange over to the Department of Justice in February.
        In March, I chaired a hearing of the Aviation subcommittee
    on these two crashes. Boeing did not see fit to give this
    Committee that exchange, nor did Boeing give it to the FAA or
    the Department of Transportation. But what I find most stunning
    is your testimony here today that you said you first learned of
    this exchange a couple of weeks ago.
        These are senior leaders at Boeing in an exchange saying
    and I will quote again, ``so I basically lied to the
    regulators.'' Look, I have practiced law for a lot of years.
    You had your lawyers look over this document and they read a
    senior leader, after these crashes occurred, saying they lied
    to the regulators. Mr. Muilenburg, how in the hell did nobody
    bring this to your attention in February when you produced this
    to the Department of Justice? How did you just read this a
    couple of weeks ago?
        Mr. Muilenburg. Senator, again to clarify my earlier
    comments. I was made aware of the existence of this kind of
    document, this issue, as part of that discovery process in the
    investigation early in the year as you pointed out. At that
    point I counted on my Counsel to handle that appropriately.
        Senator Cruz. Did you read this exchange? Look, I was made
    aware documents were being produced. Whether that is passive
    voice and disclaiming responsibility--you are the CEO, the buck
    stops with you. Did you read this document? And how did your
    team not put it in front of you, run in with their hair on fire
    saying we got a real problem here? How did that not happen and
    what does that say about the culture at Boeing if they didn't
    give it to you and you didn't read it? If you didn't say, I
    want to read it and see what happened?
        Your testimony here earlier today is well we are not sure
    what they were talking about because he is not at Boeing
    anymore. How did you not in February set out a 9 alarm fire to
    say, we need to figure out exactly what happened, not after all
    the hearings, not after the pressure but because 346 people
    have died, and we do not want another person to die?
        Mr. Muilenburg. Senator, as you mentioned, I didn't see the
    details of this exchange until recently and we are not quite
    sure what Mr. Forkner meant by that exchange. His lawyer has
    suggested he was talking about a simulator that was in
    development in that time period. That is where he was working.
    That could be the case. We do not know. I fully support diving
    deep into this and understanding what he said and what he meant
    but I can also tell you that in that same time-frame where his
    original message was made----
        Senator Cruz. Mr. Gustavsson still works at Boeing?
        Mr. Muilenburg. Senator, yes, he does.
        Senator Cruz. Have you had that conversation with him?
        Mr. Muilenburg. Senator, my team has talked with Patrick as
    well.
        Senator Cruz. Have you had that conversation?
        Mr. Muilenburg. Senator, I have not.
        Senator Cruz. My time has expired.
        The Chairman. Thank you. Thank you, Senator Cruz. Senator
    Tester. Let's do this. The entire poster--Senator Cruz if you
    can have that reduced in size and we will enter into the record
    without objection at this point. So ordered.
        [The information referred to follows:]

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Senator Tester.

                     STATEMENT OF HON. JON TESTER,
                       U.S. SENATOR FROM MONTANA

        Senator Tester. Thank you, Mr. Chairman. I want to thank
    you and the Ranking Member for having this hearing and I know
    for the two folks on the panel this morning it is probably a
    painful morning for you. But the fact is it is infinitely more
    painful for the folks that are sitting a couple rows behind
    you. You have said many times, Mr. Muilenburg, that mistakes
    were made and obviously they were.
        Unfortunately that admission was made after 346 people
    died. And there are a lot of reasons an airplane can go down
    whether it is pilot error, whether there is an equipment
    malfunction, or birds, but safety should not be one of them.
    And in a previous question you said you guys do not sell safety
    and I will be honest with you I didn't listen to the whole
    thing. But you damn well better sell safety.
        I fly four legs a week and there is a lot--if not for the
    grace of God it could have been me on one of those airplanes
    and we expect there to be safety. Obviously, something went
    wrong, and it is not the first time. There is the MCAS
    situation here that was pointed out as several people on this
    Committee have already pointed out to you and nothing was done
    or to your leadership team.
        There was a South Carolina whistleblower that talked about
    debris being left in the planes or those technicians were
    removed. There is a KC-46 finding, wrench bolts and trash
    inside the new airplanes. That was in June of this year. There
    was a cargo 777. You get the deal. It goes on.
        And so the question is the one that Senator Udall brought
    up that you didn't answer, and I think other people on this
    Committee also brought it up and that is, what do we do? What
    do you do? So I will be a little more specific. I do believe
    there is a cozy relationship and I do not believe that quite
    frankly time and money are no object because there is also
    plenty of examples.
        For example in 2014, FAA made regulatory changes to safety
    standards that would have required changes to the MAX to add
    new crew alerts. Boeing appealed it to the FAA and sought to
    seek an exemption arguing it would cost too much money, $10
    billion, which is a lot of money, but the truth is that it
    wouldn't happen if FAA would have been doing their job and it
    also wouldn't have happened if you would have known what the
    hell was going on.
        So my question is, and I know there was a push a number of
    decades ago about privatization of the Federal Government, and
    I think that is how we got here is privatization of Government.
    But why do we not just turn over the certification back to the
    FAA and let them do it and then they would be the ones sitting
    at this desk and not you. Why not do that?
        Mr. Muilenburg. Well Senator, we share your focus on safety
    and I can confidently say that is our number one priority.
        Senator Tester. OK, cool, but we failed in this case and
    there is a whole bunch of people back there that are going
    through incredible anguish because we failed.
        Mr. Muilenburg. Senator, I agree, and we feel----
        Senator Tester. So let's get to the question and look there
    is--I can pivot with the best of them. I know how to pivot, I
    know when people are pivoting. You are pivoting. Tell me if you
    would support having the FAA do the certification?
        Mr. Muilenburg. Senator, we believe that delegated
    authority process that we have today has contributed to improve
    safety over the last two decades. As I mentioned earlier, we
    are open to improving it but the idea that we can tap the deep
    technical expertise for companies across the aerospace industry
    is a valuable part of the certification process. But the FAA is
    the certification authority and should be and should continue
    to be.
        Senator Tester. Well, but they really aren't. The truth is
    you can say that they have the ultimate responsibility, but the
    truth is if the issues aren't flagged by the ODA, by your
    people doing the certification, the FAA never does it because
    quite frankly it would cost them more money to have the FAA do
    the certification.
        And by the way, it is costing you money so we could charge
    you for that certification to help pay for it so it would have
    no reflection on the taxpayers. So the question becomes--I am
    going to tell you what, when the FAA says you need to do this
    and you come in and say no, you do not need to do this, it is
    fine if nothing happens, but when 350 people die, we got a
    problem.
        And to bring up the point that Senator Cruz brought up that
    there was plenty of information out there on this and nothing
    was done. And so the whole thing about it, you know, when it
    comes to safety, time and money are no object is not--the
    record certainly does not show that.
        Mr. Muilenburg. Senator, I understand your points and
    criticism and I think it is true that we operate in a very
    competitive world and we are the only large airplane,
    commercial airplane maker left in the United States. We do have
    competitive pressures around the world, but I can also tell you
    that it never takes precedence over safety. Our business model
    is safe airplanes.
        Senator Tester. Think it absolutely could be argued that it
    did in this case, and I heard Senator Duckworth questions. And
    Boeing has had an incredibly valuable name, but I have got to
    tell you and I think I told you guys this an office some time
    ago, I would walk before I would get on the 737 MAX. I would
    walk. There is no way and the question becomes when issues like
    this happen, it costs your company huge. And so you shouldn't
    be cutting corners and I see corners being cut and this
    Committee is going to have to do something to stop that from
    happening. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Tester. I am going to ask
    that Mr. Muilenburg answer on the record his opinion of the
    current ODA system, whether it should be modified. Answer
    Senator Tester's question.
        Senator Johnson.

                    STATEMENT OF HON. RON JOHNSON,
                      U.S. SENATOR FROM WISCONSIN

        Senator Johnson. Thank you, Mr. Chairman. Let me add my
    condolences to the surviving family members and friends of the
    victims of these tragedies.
        And Mr. Muilenburg, among many failures it strikes me there
    are two primary failures. First and foremost in the original
    design and certification process, and then second in the
    reaction after the first crash. So let's concentrate on those
    two things. Tell me if I am getting this right, the 737, a very
    successful airframe. New, more fuel-efficient engines were
    available and so you wanted to include that and upgrade of that
    airframe, correct?
        Mr. Muilenburg. New fuel-efficient engines and some other
    enhancements.
        Senator Johnson. And those fuel-efficient engines created
    different aerodynamics for that aircraft, correct?
        Mr. Muilenburg. That is correct.
        Senator Johnson. Is the MCAS system, is that a standard
    type of automatic pilot type of software system on planes? Is
    that pretty standard to have something like that?
        Mr. Muilenburg. Senator, the MCAS system that we have on
    the MAX is unique to that airplane.
        Senator Johnson. So it was put in there specifically
    because you added a different type of engine to a known,
    successful airframe which made that less stable and required
    some kind of, as you called it, a runaway stabilizing system?
        Mr. Muilenburg. Senator, if I can clarify that, the 737
    family has a system called the speed trim system and the MCAS
    is an extension of that system that is unique for the MAX.
        Senator Johnson. Unique because of that added engine
    design?
        Mr. Muilenburg. We tailor the software of each one of our
    airplanes so that they optimize the handling qualities for the
    unique airplane configuration.
        Senator Johnson. But again going into the introduction of
    this 737 MAX, you realize that that airframe was changed
    because those engines required this MCAS system for
    stabilization?
        Mr. Muilenburg. That was one of the additions we made to
    create the handling qualities we wanted for the pilots. We also
    made some changes to things like the vortex generators on the
    wing. So it is an integrated solution to creating----
        Senator Johnson. You are well aware that this design change
    created something that required an MCAS system. So now fast
    forward, you have the Lion Air tragedy. According to Senator
    Cruz, the message that he set up there which I believe was
    written on November 15, 2016 just a couple years before that
    Lion Air crash, there are people or it sure appears some in
    Boeing that knew exactly or suspected what went wrong because
    the integrated design, you had an MCAS system to take care of
    this eventuality in the flight characteristics, correct?
        Mr. Muilenburg. Senator again, I am not exactly sure what
    was meant by that traffic, that e-mail traffic, but I can tell
    you in that timeframe----
        Senator Johnson. It seems pretty obvious, does it not? I
    mean it does not seem pretty obvious to you? I mean again you
    are engineers, you understand how this was designed, you
    understood you needed an MCAS system to make up for that
    instability, and then something happened. I would think you
    would diagnose pretty fast.
        I mean again, I am reading these things. I am not a pilot.
    I am not an aerospace engineer and yet I am scratching my head
    going, whoa, something really wrong happened. You know a whole
    lot. Why didn't you react faster?
        Mr. Muilenburg. Well Senator, completely separate from that
    e-mail traffic and what it might mean, our team very quickly
    after the Lion Air accident assembled with the regulators. We
    evaluated the data from the accident. We saw that MCAS was
    involved and so we began to take quick action immediately. It
    does not have to do with that e-mail. That is not relevant to
    that discussion. Our team was immediately identifying----
        Senator Johnson. Which is exactly my point. The fact that
    it took another tragedy to actually ground the airplanes so you
    could actually have a true--a fix that worked is I think really
    what is on the table here. And the diagnosis is why didn't we
    react? Why didn't we ground that aircraft a lot sooner so that
    another tragedy wouldn't happen?
        Mr. Muilenburg. And Senator, we have asked that question
    over and over. And you know, if we knew everything back then
    that we know now, we would have made a different decision. The
    decision that was made on that at that point with the data we
    had, we quickly convened a safety review board, the FAA coming
    out of that confirmed the continuing airworthiness of the
    airplane and issued that officially.
        That was the safety case that was built. But Senator as you
    pointed out we have learned from the second accident and if we
    could go back, we would have made a different decision. And we
    have learned. We are making those improvements to MCAS and that
    is where our focus is going forward.
        Senator Johnson. Boeing is an important company. It is
    important for our economy. I want to see you get this right,
    but you have to properly diagnose this. You have to accept
    responsibility for what happened so we actually can make those
    changes both within Boeing and also within the FAA. Thank you,
    Mr. Chairman.
        The Chairman. Thank you, Senator Johnson. Senator Rosen.

                    STATEMENT OF HON. JACKY ROSEN,
                        U.S. SENATOR FROM NEVADA

        Senator Rosen. Thank you. And I want to thank all the
    families that are here today who have lost their most precious
    loved ones. Their death should not be in vain and we all have
    to do every bit of our part together to make sure that we
    prevent future tragedies from happening. And in order to honor
    the memories of these 346 souls and the empty chairs that they
    will leave behind this Thanksgiving and Christmas and on and on
    and on.
        And so you said additional information wasn't available. I
    want to touch a little bit on MCAS and Brazil. According to
    news reports, when the Brazilian National Civil Aviation Agency
    came to the U.S. in 2017 to test out the MAX 8, they determined
    the changes made to the old 737 were significant enough that
    they needed much more information from Boeing and were going to
    provide it for their pilots.
        When they eventually published their pilot training
    requirements, they were therefore able to flag the MCAS as one
    of the changes the pilots needed to take into consideration
    when flying the MAX 8. And yet for United States pilots, MCAS
    wasn't mentioned in their manual.
        So, Mr. Muilenburg, why was this information not flagged
    for your other customers who had 737 MAXs in their fleet? And
    to prevent your company from sharing these differences to other
    regulatory bodies or operators, I have here the Brazilian
    manual. They decided their pilot should learn this and why
    wouldn't you provide it to the United States pilots?
        Mr. Muilenburg. Senator, I cannot comment on the details of
    the Brazilian document. John may be able to but let me more
    broadly make the point that that is exactly how the process is
    supposed to work. We provide information, we evaluate with the
    regulators in the various jurisdictions what should be included
    in the training. We have no desire to hide features of the
    airplane that pilots need to know.
        Senator Rosen. But they reported back to you and it was
    significant enough for them to put this in their manual then
    why wouldn't you consider that it was a significant change?
        Mr. Muilenburg. Senator, I understand your point and that
    was a decision that was made in Brazil. Again, I am not
    familiar with the details of that one. But the discussion----
        Senator Rosen. So let me just ask you this question then,
    moving forward will you commit to making it a practice when
    other countries are clearly paying attention enough to make
    significant changes to their pilot manuals based on major
    operational changes, that Boeing will send these notifications
    of changes to the other users of these aircraft so at least
    they have the opportunity to train their pilots? You denied
    them the opportunity, sir.
        Mr. Muilenburg. Senator, we are committed to sharing that
    information and that is part of our international
    collaboration. But I also want to note again that the
    discussion around MCAS training and whether it would be
    included in the training manuals that was an active, iterative
    discussion with the FAA, and it was a decision made based on
    safety.
        Again, we try to put information in the training manuals
    that focuses on the effects of failures and things that will be
    valuable to the pilots and it is not always the case that more
    information adds to safety. Although in this case, we
    understand this, and this is one of the additions going
    forward.
        Senator Rosen. Brazil thought it added to their safety. But
    I want to touch a little bit on Senator Fischer, the question
    that she raised earlier. All these changes have taken place, of
    course, over the years and this plane is still working off its
    original certification from 1967. This is despite the fact that
    pilots have told me that the MAX 8 is in no way functionally
    similar to the original 737s that took to the skies 52 years
    ago.
        I said in the last hearing that we had, seems to me like
    there have been so many significant modifications. It is almost
    as if you took a canoe and turned it into a cruise ship. So Mr.
    Hamilton, can you tell us how many derivative certificates
    Boeing has received for the 737 since initially being certified
    over 50 years ago?
        Mr. Hamilton. Senator, I do not have the exact number in my
    head, but it is approximately 14.
        Senator Rosen. Fourteen or 814?
        Mr. Hamilton. Fourteen derivatives. But I will--let me take
    the action to follow up with you on that.
        Senator Rosen. Thank you. I appreciate that. And the last
    thing I am going to ask. Do you believe that the 737 MAX is
    functionally the same plane that was certified in 1967?
        Mr. Hamilton. Senator, as I mentioned to you earlier,
    Senator, the safety standards have evolved as the airplane has
    evolved, and one of the important things I think to understand
    is what is really important also is for the pilots as they
    transition from an earlier version of the 737 to the newer
    version, that the airplane behaves and handles in the same way.
    That was important from a handling characteristics standpoint--
    --
        Senator Rosen. And important enough for Brazil to mention
    but not for us?
        Mr. Hamilton. With respect to that Senator, so there is a
    joint operation evaluation board that determines the training,
    but other regulators can determine what training they want to
    do above and beyond based on the information. I do not know the
    specifics of the Brazilian document you are referencing. We can
    follow up on that.
        The Chairman. Thank you. Thank you, Senator Rosen. Senator
    Blunt.

                     STATEMENT OF HON. ROY BLUNT,
                       U.S. SENATOR FROM MISSOURI

        Senator Blunt. Thank you, Mr. Chairman. So Mr. Muilenburg,
    I do not want to absolve you from both the opportunity and
    responsibility to go back and look at that long question from
    Senator Tester and answer it for the record. But for now one of
    the sources, one of the central thoughts in that question was,
    why shouldn't we change this process and go back to where it is
    no longer cooperative, or the FAA takes full responsibility?
        Give me the answer to that. Should this process be changed
    where the Federal Government is fully responsible with
    employees only hired by the Federal Government? What impact
    would that have on safety?
        Mr. Muilenburg. Senator, I believe the data clearly shows
    that creation of the delegated authority process and its
    implementation has enhanced safety over the last couple of
    decades. I mentioned earlier about a 95 percent improvement in
    aviation safety over the last couple of decades. I think a
    portion of that at least can be attributed to the delegated
    authority process.
        That does not mean we should not refine it, reform it over
    time, but the fundamental process of strong Government
    oversight combined with deep industry technical knowledge in
    the right balance is a strong safety process. And I firmly
    believe that is one of the things that has contributed to
    aviation safety. And that process demands oversight and we are
    fully supportive of strong oversight, but we also fully support
    the idea of tapping deep industry technical expertise. And that
    combination is the safest combination.
        Senator Blunt. And what do you think the view of the
    industry technicians is of their responsibilities there? Do you
    think they feel the right level of both responsibility and
    liability of providing the information that they need to
    provide?
        Mr. Muilenburg. Senator, they do, and I can tell you that
    is the culture of our company. And I respect the comments that
    were made today, and the questions have been raised about our
    culture. We deserve the scrutiny, but I have been at this
    company for 34 years. I know the people of Boeing. You all know
    the people of Boeing. These are 150,000 people that every day
    come to work because they have an important mission. They are
    honest, they are resolute in their efforts, they are committed
    to safety. That is our culture and every employee at Boeing--
    that is just how we think about the work we do.
        And we are going to continue to improve as a company. I am
    not saying we have done everything right. As I have noted
    today, we have gotten some things wrong. But this is a great
    company with a great legacy that is committed to excellence and
    where we can improve, we will, where we can learn we will, but
    our culture is about safety. That is at the very core of
    Boeing. It has been that way for 103 years.
        Senator Blunt. Alright. Mr. Hamilton, I had two or three
    questions that actually Senator Rosen just asked pursuing that
    further. But you have got a 1967 certification that has had 14
    variants since 1967. You have a significantly different plane
    that is based on the 14th variant of the original plane.
        What difference do you think would have made if the
    certification process would have gone back to the we are
    certifying a new plane? Would that have made a difference in
    the MCAS system? Or you have been doing this a long time, what
    difference would it have made if we hadn't built on the
    previous half-century of this plane's history and just had
    started with a new plane. Would that have been better or worse?
        Mr. Hamilton. You know, in part 21 of the Federal
    Regulations, it spells out the change product rule which is how
    you assess for a derivative type certification. And it is a
    process that is in the USFAA's regulations. It is also in
    European and other countries regulations. And it requires you
    to look at all significant changes and step up. I think there
    is an assumption here that derivative type certification is
    less robust than the new type certification.
        I think when you look at new types of certifications, or
    you oftentimes have some exceptions or equivalent levels of
    safety very similar to what you see on a derivative. So I am
    not sure it would have necessarily resulted in a safer
    airplane. It might have driven some different design decisions
    though, but fundamentally one of the things that happened in
    these two accidents was this assumption around how we expected
    crews to respond under certain situations, which proved to be--
    it did not happen.
        And I think you know, that is a fundamental issue that we
    have to address in the industry.
        Senator Blunt. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Blunt.
        Senator Blackburn.

                  STATEMENT OF HON. MARSHA BLACKBURN,
                      U.S. SENATOR FROM TENNESSEE

        Senator Blackburn. Thank you, Mr. Chairman. Thank you for
    being here today and for taking our questions. I will tell you
    this is you have responded you have addressed Senator, Senator,
    Senator. I think you should be addressing victims because they
    are the ones who we are asking questions on behalf of and they
    are the ones who have come today on behalf of their family
    members.
        And another thing I want to ask you, you have mentioned a
    couple of times a lack of awareness of e-mails or documents or
    communications and you know, Mr. Muilenburg, we have something
    around here, before we vote, we say we read the bill so that we
    know what is in it. And if we need to ask questions, we ask
    questions, and we develop that awareness that is so necessary
    to make good decisions and to have a full view of the situation
    that is in front of us.
        And it is disconcerting to hear someone who is to be the
    leader of a company to say I wasn't aware, or I didn't know, or
    I haven't read that, nobody made me aware of that, I depended
    on that. You know, we call that passing the buck and it is your
    responsibility if you are going to lead the company to have
    that awareness.
        So have you at this point read each and every page of every
    document that is relative to the situation in this case?
        Mr. Muilenburg. Senator, I cannot say I have read every
    document, every page. I know we have provided more than half a
    million pages of documents as part of the production process
    over the last year. I accept your input and your criticism. I
    am accountable, our company is accountable. Accountability
    starts----
        Senator Blackburn. I appreciate that, but I think that it
    is unsettling to hear you say I haven't read that. Let me move
    on. I do believe that you are in the business of safety as a
    priority and even though you say you do not sell safety, let us
    talk a little bit about the simulators because you had pilots
    that were training in the simulators as well as training in
    flight, correct?
        Mr. Muilenburg. You are referring during the MAX
    development?
        Senator Blackburn. Yes.
        Mr. Muilenburg. Yes, Senator.
        Senator Blackburn. OK. So the simulators that were being
    used for training, were they built by the same engineers with
    the same components, the same sensors, the same systems as the
    MAX system?
        Mr. Muilenburg. Senator, we have a wide variety of
    simulators, some of which are what we call conformed simulators
    which represent the actual hardware and software of the
    airplane. We have others that are engineering simulators.
        Senator Blackburn. So it is conceivable that some of the
    pilots were not training on this specific simulator? And then
    you also--you know, Mr. Peters had started down a line of
    questioning with you about the pilots and the pilots that were
    trained. And you only had highly experienced pilots and
    simulators before flying the new MAX system, correct?
        Mr. Muilenburg. Senator, I was referring to our Boeing test
    pilots. We also have pilots from a number of other
    organizations, regulators, and airlines.
        Senator Blackburn. Why would you not use pilots with a
    variety of experience, a wide range of experience? Because
    there are pilots with the wide range of experience that are
    going to be in that cockpit flying that plane in real time.
        Mr. Muilenburg. Senator, I agree with your view on the
    necessity of having a variety of pilot experiences involved in
    the testing process, but again our Boeing pilots are not the
    only testers in the process.
        Senator Blackburn. OK. Well, then let's take it this way.
    What changes are you going to make in the simulators and in the
    training that is going to bring to account for human factor?
        Mr. Muilenburg. Senator, we have made several changes and
    have more to come but to start the baseline training program
    for the MAX is a roughly a 24 day training program which
    includes heavy use of simulators, advanced simulators. We have
    also modified the computer-based training for the incremental
    training between the NG and the MAX. We have added visibility
    to the training materials for the MCAS system that we have
    talked about.
        That new training is all currently being evaluated and will
    be ultimately certified by the regulators to make it a baseline
    in the program. We are also investing R&D significantly in
    advance----
        Senator Blackburn. Let me ask you this, I appreciate all of
    that and I appreciate your answer. Prior to these occurrences,
    did you feel that your training was not sufficient?
        Mr. Muilenburg. Senator, no, we implemented the training
    that was planned and certified for the airplane.
        Senator Blackburn. I yield back.
        The Chairman. Thank you, Senator Blackburn.
        Senator Scott.

                     STATEMENT OF HON. RICK SCOTT,
                       U.S. SENATOR FROM FLORIDA

        Senator Scott. Thank you, Mr. Chairman. First off, my heart
    goes out to all the families. I mean, I just cannot imagine,
    you know, the impact on these families after these tragic
    accidents. I come from Florida, so air travel is a pretty big
    deal for us. 126 million people traveled to Florida as tourists
    last year and a lined share of them came by aircraft. So the
    safety of everybody is really important. Mr. Muilenburg, the
    President and CEO of your commercial airlines was let go after
    this. So what is your process to hold people accountable to
    make sure this does not happen again?
        Mr. Muilenburg. Senator, first of all my company and I are
    accountable. I believe that accountability starts with me. My
    Board took some recent actions regarding my position, which I
    fully support and will allow me to focus even more on safety.
    So every action we take strives to focus on safety. I have also
    taken some management actions. Again, those are focused on
    operational excellence and safety going forward. As other
    reviews are completed, if we see additional actions that need
    to be taken, we won't hesitate.
        But in some cases, accountability also includes
    improvements to our processes and our organization structure,
    and that gets to some of the changes we announced on our safety
    review boards, our new safety organization, our new board
    safety committee, and the realignment of all 50,000 of our
    engineers to our chief engineer in terms of reporting
    structure. All of those accountability actions are important
    and all of them are focused on safety.
        Senator Scott. So if anybody, if any of your--whether it is
    engineers or nonengineers, if somebody has a concern in the
    future about safety, what is the process you have created to
    make sure that it gets to you and you can react to it because
    ultimately as a CEO the buck stops with you?
        Mr. Muilenburg. Senator, that has been one of the key
    learnings from this whole process is we need to elevate the
    visibility on safety issues that might come up the at the
    ground floor level. Make sure they get the right visibility and
    action. So a couple of things we have done there. One is again
    restructuring our safety review boards. So I now get a weekly
    update on safety review boards from across the Boeing
    enterprise at a detailed level, which I found to be very
    helpful.
        We have also with the start of our new safety organization
    under Beth Pasztor, instead of having those safety teams
    underneath our businesses, they are now separated and report up
    through our chief engineer. Any safety concerns that employees
    have will come through that organization.
        We set up a new anonymous reporting system for those
    employees that want might want to make anonymous reports to
    facilitate that, and we continue to have a full range of ethics
    hotlines across our enterprise that encourage employees to make
    their inputs. And we have a culture of asking our employees to
    speak up. We want them to speak up. We want to make sure they
    are heard and that we take action.
        Senator Scott. Have you made any changes at the Board level
    to increase the accountability for all employees?
        Mr. Muilenburg. Senator, our Board has been very engaged in
    this entire process. One of the things we did is a now about
    six months ago I asked our Board to set up an independent
    review led by Admiral Giambastiani. He has a tremendous safety
    background. That Committee came forward with a number of
    recommendations, some of which I mentioned in things that we
    have implemented.
        Our Board will continue to be engaged in that process. And
    this new this new safety organization that I talked about, in
    addition to reporting to the Chief Engineer and to me, it also
    provides independent audit, if you will, back into our Board.
        And our Board has set up a new aerospace safety committee
    that is now permanent headed up by Admiral Giambastiani. You
    might have seen on Friday we added another Board member,
    Admiral Richardson, who also has deep experience in safety. He
    will also be a member of that committee and so our safety
    organization will have an independent reporting line to them as
    well, which I think is a good discipline process.
        Senator Scott. I had to go to preside, so I didn't get to
    hear all the testimony. But have you made any recommendations
    to this Committee on things that at the Federal level we ought
    to be doing differently, you know, to make sure whether Boeing,
    Airbus, or anybody else, this does not happen again?
        Mr. Muilenburg. Senator, we have discussed a number of
    options there. Again, we have learned and there are some things
    that we need to fix that are related to the airplane design and
    training and communications. We also think there are some
    opportunities to reform our processes and how we work together
    as a Government and industry. And we are very supportive of any
    actions there that would enhance safety.
        Senator Scott. Thank you.
        The Chairman. Thank you, Senator Scott.
        Senator Sullivan.

                    STATEMENT OF HON. DAN SULLIVAN,
                        U.S. SENATOR FROM ALASKA

        Senator Sullivan. Thank you, Mr. Chairman. And I also want
    to express my sympathies and condolences to the family members
    here. We have a safe commercial aviation industry in America,
    but I think we always have to look at ways to improve the
    industry, the airlines, FAA, Congress. So I am sure it is
    difficult for the family members to be here, but it is
    important that you are here. So I want to thank you for that. I
    am going to start with just a bit of a kind of a parochial
    question.
        Mr. Muilenburg, Mr. Hamilton, Alaska Airlines is my state's
    airline, it is a very good airline, certainly critically
    important to my state. I know it is to the Ranking Member's
    state as well. They fly almost all 737 Boeings. We Alaskans
    travel a lot. I have had many constituents in the aftermath of
    these MAX crashes that have asked me, are the 737s that we are
    flying on all the time in Alaska, to and from Seattle and other
    places, safe? So can both of you assure my constituents that
    these 737s are safe that are such an important component of the
    Alaskan air travel?
        Mr. Muilenburg. Yes, Senator. The 737 NG fleet that Alaska
    operates is a safe fleet, it is a safe airplane and it has got
    about 200 million hours of air safety track record behind it.
        Senator Sullivan. Mr. Hamilton?
        Mr. Hamilton. I agree with Mr. Muilenburg's comments. I
    also just want to say that we have a weekly meeting that we
    review all the reports that are coming in from the fleet on
    whether or not there are potential safety issues or not.
        Senator Sullivan. So the MAX issues that we are focused on
    here with regard to 737s are not issues that exist with your
    other line of 737s, 800s, and 900s?
        Mr. Hamilton. No.
        Mr. Muilenburg. That is correct.
        Senator Sullivan. Let me ask--and I know the House side was
    looking at this issue. As we focus as this Committee on the
    tragic lessons learned from the MAX 737 accidents, should we
    also take the time to ensure that the other 737 models that are
    receiving less attention now nevertheless continue to be safe
    and to take the opportunity to look at the FAA certification
    process on those to make sure that that is not bedeviled with
    some of the challenges that we are discussing here with regard
    to the MAX? Would you agree that that is an opportunity to not
    just focus on the MAX but the overall process to reboot the
    focus both at your company, but also in the FAA on safety?
        Mr. Muilenburg. Yes, Senator, I believe there are a number
    of independent reviews underway right now looking at that
    broader certification process, some of which have begun to
    report out. We support that broader look.
        Senator Sullivan. So models that aren't just the MAX?
        Mr. Muilenburg. All models. So we are taking an end-to-end
    comprehensive look at the certification process and I believe
    there are a number of Government independent reviews that are
    focused on that.
        Senator Sullivan. Let me ask for both of you. I keep
    hearing from safety experts about the importance of what they
    refer to as functional safety and that is the way the different
    systems work together with the operator as opposed to looking
    at each system as it is added to a new model in a vacuum. And
    it seems to me that this issue of functional safety is a core
    issue as it relates to the MAX given what has happened.
        Can you tell the Committee about what your company's
    approach to this issue of functional safety is when adding new
    systems to an existing aircraft like the 737? Obviously, there
    was a failure here on that issue. How are you working to
    improve that and does the FAA do enough to focus on this idea
    of functional safety not just the individual additions to
    existing and older models?
        Mr. Muilenburg. I will ask John to take that question.
        Mr. Hamilton. Yes. So Senator, I think it starts with our
    requirements breakdown of what is our airplane level
    requirements, system level requirements, component level
    requirements and then validating at the component level, the
    system level, and the airplane level how any change met the
    requirements and interacted across at the system or airplane
    level. You also talked about regulatory requirements.
        Senator Sullivan. Yes. Does the FAA focus enough do you
    think on functional safety?
        Mr. Hamilton. So there has been some rather recent changes
    in what we call development assurance that I think has
    continued to mature and again this looks at the functional
    safety and some of the things that you really focused at is the
    breakdown of requirements and how different systems interact
    with that. So, I think we as Mr. Muilenburg pointed out, some
    of the recent industry committee reports have discussed this
    and I think we will support those recommendations and the FAA's
    actions going forward.
        Senator Sullivan. Thank you. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Sullivan. And thank you to
    the panel. We appreciate you being with us and I am sure we
    will be questioning you further as we continue to get more
    reports. Our second panel of witnesses will be escorted in now.
    We thank you two gentlemen for being with us.
        The second panel, as I said before, is Mr. Robert Sumwalt,
    Chairman of the National Transportation Safety Board, and the
    Honorable Christopher Hart. Mr. Hart is the team Chair of the
    Joint Authorities Technical Review, which we use the shorthand
    of JATR for, and I have referred to that a number of times
    during this hearing. Mr. Hart is a former Chairman of the
    National Transportation Safety Board.
        They have been waiting patiently during these two and a
    half hours. Gentlemen, we appreciate you being here. We ask
    each of you to summarize your submitted testimony in five
    minutes. And Mr. Sumwalt, we will begin with you. You are
    recognized.

      STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL
                      TRANSPORTATION SAFETY BOARD

        Mr. Sumwalt. Thank you, Mr. Chairman. Good afternoon
    Chairman Wicker, Ranking Member Cantwell, and members of the
    Committee. Thank you for the opportunity to testify before you
    today. This afternoon I will address the NTSB's recent
    recommendation report regarding the 737 MAX certification
    processes. This recommendation report issued last month
    contained seven recommendations to the FAA.
        These recommendations are the result of the NTSB's
    involvement as an accredited representative to the Indonesian
    government's investigation into last year's Lion Air crash and
    to the Ethiopian government's investigation into this year's
    crash involving the Ethiopian Airlines Boeing 737 MAX. The NTSB
    participates in foreign investigations in accordance with ICAO
    Annex 13, which details the standards and recommended practices
    of international aviation accident investigations.
        Under Annex 13, the state of occurrence leads the
    investigation and the U.S. has the right to participate in the
    investigation when it involves a U.S. manufacturer or U.S.
    registered or designed aircraft such as the 737 MAX 8. This is
    so that any design or manufacturing issues can promptly be
    addressed by the FAA and the manufacturer.
        As an accredited representative to these crash
    investigations, the NTSB initiated an in-depth examination of
    the U.S. design certification processes used to certify the
    MAX. The issues we identified revolve around three basic areas
    and our safety recommendations are centered on them.
        First, the system safety assumptions used by Boeing for the
    MCAS and ultimately accepted by the FAA did not use realistic
    pilot recognition and corrective actions in response to
    uncommanded flight control inputs. Quite simply, the
    assumptions that Boeing used did not consider or account for
    the impact that multiple flight deck alerts or indications
    could have on pilots' responses to uncommanded MCAS activation.
        Next, we identified the need for manufacturers to validate
    their pilot response assumptions using scientific methods and
    application of human factors principles to improve cockpit
    design, procedures, and training. We believe that the use of
    validated methods and tools to assess pilot performance in
    dealing with failure conditions in emergencies would result in
    more effective requirements for flight deck interface design,
    pilot procedures, and training strategies.
        And finally, we believe that manufacturers should develop
    and incorporate in airline cockpits mechanisms that would allow
    pilots to better diagnose, prioritize, and react to multiple
    alerts and alarms. The pilots in the Lion Air and Ethiopian
    crashes were faced with multiple oral and visual alerts.
        Research demonstrates that emergency situations increase
    workload and require additional effort to manage effectively
    because of the stress involved and possible confusion regarding
    which actions are necessary to resolve the problem. Each of our
    seven recommendations are detailed in my written testimony.
        In closing, it should be noted that the NTSB investigators
    continue to examine the design certification process, and we
    may issue additional recommendations in this area if warranted.
    Thank you again for the opportunity to testify and I look
    forward to your questions.
        [The prepared statement of Mr. Sumwalt follows:]

          Prepared Statement of Hon. Robert L. Sumwalt III, Chairman,
                      National Transportation Safety Board
        Good afternoon, Chairman Wicker, Ranking Member Cantwell, and
    Members of the Committee. Thank you for inviting the National
    Transportation Safety Board (NTSB) to testify before you today.
        The NTSB is an independent Federal agency charged by Congress with
    investigating every civil aviation accident in the United States and
    significant accidents in other modes of transportation--highway, rail,
    marine, and pipeline. We determine the probable cause of the accidents
    we investigate, and we issue safety recommendations aimed at preventing
    future accidents. In addition, we conduct special transportation safety
    studies and special investigations and coordinate the resources of the
    Federal government and other organizations to assist victims and their
    family members who have been impacted by major transportation
    disasters. The NTSB is not a regulatory agency--we do not promulgate
    operating standards, nor do we certificate organizations, individuals,
    or equipment. The goal of our work is to foster safety improvements,
    through safety recommendations, for the traveling public.
        Today I will address NTSB's recent recommendation report,
    ``Assumptions Used in the Safety Assessment Process and the Effects of
    Multiple Alerts and Indications on Pilot Performance,'' issued on
    September 26, 2019, which contained seven recommendations to the
    Federal Aviation Administration (FAA). These recommendations resulted
    from our examination of relevant factors in the U.S. design
    certification process following two crashes of Boeing 737 MAX 8
    aircraft.
    NTSB's Role in Boeing 737-MAX 8 Crashes
        On October 29, 2018, a Boeing 737 MAX 8, operated by Lion Air,
    crashed into the Java Sea shortly after takeoff from Soekarno-Hatta
    International Airport, in Jakarta, Indonesia, killing all 189
    passengers and crew on board. The Komite Nasional Keselamatan
    Transportasi (KNKT) of Indonesia, investigated the accident and
    released the final report on October 25, 2019.\1\ On March 10, 2019, a
    Boeing 737 MAX 8, operated by Ethiopian Airlines, crashed after takeoff
    from Addis Ababa Bole International Airport in Ethiopia, killing all
    157 passengers and crew, including 8 American citizens. The
    investigation is being led by the Ethiopia Accident Investigation
    Bureau (EAIB), which released a preliminary report on April 4, 2019.\2\
    ---------------------------------------------------------------------------
        \1\ Komite Nasional Keselamatan Transportasi, Final Report No.
    KNKT.18.10.35.04.
        \2\ Ethiopia Accident Investigation Bureau, Report No. AI-01/19.
    ---------------------------------------------------------------------------
        The NTSB participated in these foreign investigations in accordance
    with the Chicago Convention of the International Civil Aviation
    Organization (ICAO) and the Standards and Recommended Practices
    provided in Annex 13 to the Convention because these accidents involved
    the Boeing 737 MAX 8, a US-designed, certified and manufactured
    airplane.\3\ Because both Indonesia and Ethiopia are signatories to the
    ICAO Convention, they are each responsible for the investigation in
    their state and control the release of all information regarding the
    investigation.
    ---------------------------------------------------------------------------
        \3\ ICAO is a UN specialized agency that manages the administration
    and governance of the Convention on International Civil Aviation
    (Chicago Convention), (https://www.icao.int/about-icao/Pages/
    default.aspx).
    ---------------------------------------------------------------------------
        Following the Lion Air crash, the NTSB appointed a U.S. accredited
    representative and immediately dispatched investigators to Indonesia to
    participate in the KNKT investigation. NTSB investigators had access to
    all investigative data and participated in all aspects of the
    investigation, including: download and analysis of the flight data
    recorder (FDR) and cockpit voice recorder (CVR); teardown and
    examination of airplane components such as the angle of attack sensor
    that was removed prior to the accident flight; airplane performance
    analysis and simulation sessions; airplane system and certification
    analysis; interviews of airline and maintenance personnel; and review
    of the KNKT draft final report. The final report released by the KNKT
    on October 25, 2019, reiterated the seven NTSB recommendations and also
    included an additional 25 recommendations to seven organizations,
    including Lion Air, Boeing, Indonesian Directorate General of Civil
    Aviation, and the FAA.
        In response to the Ethiopian Airlines crash, the NTSB also
    appointed an accredited representative, who we dispatched to Ethiopia
    with a team of investigators. NTSB investigators continue to take part
    in this ongoing investigation and have had access to all investigative
    data, including taking part in the download and analysis of the CVR and
    FDR.
        In accordance with ICAO Annex 13, technical advisors from the FAA,
    Boeing, and General Electric have accompanied NTSB investigators to the
    Lion Air and Ethiopian Airlines accident sites to provide their
    specialized technical knowledge regarding the aircraft and its systems.
        ICAO Annex 13 provides for other involved states to gain timely
    access to investigative information for the purposes of continued
    operational safety. As a result, NTSB participation in the foreign
    accident investigations enabled safety deficiencies to be promptly
    addressed by the FAA and the manufacturer and through NTSB safety
    recommendations. Because the United States is the state of design and
    manufacturer of the aircraft involved in these accidents, we examined
    relevant factors in the U.S. design certification process to ensure
    deficiencies were identified and addressed.
    Design Certification of the 737 MAX 8 and Safety Assessment of the
            Maneuvering Characteristics Augmentation System (MCAS)
        The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG)
    model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\4\ The
    737 MAX incorporated a new engine (CFM LEAP-1B) and nacelle, which
    produced an airplane-nose-up pitching moment when the airplane was
    operating at high angle of attack (AOA) and mid-Mach numbers. After
    studying various options for addressing this issue, Boeing implemented
    aerodynamic changes as well as a stability augmentation function,
    Maneuvering Characteristics Augmentation System (MCAS), as an extension
    of the existing speed trim system to improve aircraft handling
    characteristics and decrease pitch-up tendency at elevated AOA. As the
    development of the 737 MAX progressed, the MCAS function was expanded
    to low Mach numbers.
        As originally delivered, the MCAS became active during manual
    flight (autopilot not engaged) when the flaps were fully retracted and
    the airplane's AOA value (as measured by either AOA sensor) exceeded a
    threshold based on Mach number. When activated, the MCAS provided
    automatic trim commands to move the stabilizer airplane nose down. Once
    the AOA fell below the threshold, the MCAS would move the stabilizer to
    the original position. At any time, the stabilizer inputs could be
    stopped or reversed by the pilots using their stabilizer trim switches.
    If the stabilizer trim switches were used by the pilots and the
    elevated AOA condition persisted, the MCAS would command another
    stabilizer airplane nose down trim input after 5 seconds.
        In each of the accident flights, the MCAS activated in response to
    erroneous AOA inputs, resulting in continuous command of airplane nose
    down stabilizer trim input as well as other alerts and indications.
    Multiple alerts and indications can increase pilots' workload, and the
    combination of the alerts and indications did not trigger the accident
    pilots to immediately perform the runaway stabilizer trim procedure
    during the MCAS-activated airplane-nose-down stabilizer trim input. The
    pilots' responses did not match the assumptions of the pilot responses
    to unintended MCAS operation on which Boeing based its hazard
    classifications within the safety assessment and that the FAA approved
    and used to ensure the design safely accommodates failures. Thus, the
    NTSB concluded that Boeing's functional hazard assessment of
    uncommanded MCAS function for the 737 MAX did not adequately consider
    and account for the impact that multiple flight deck alerts and
    indications could have on pilots' responses to the hazard.
        We further concluded that a standardized methodology and/or tools
    for manufacturers' use in evaluating and validating assumptions about
    pilot recognition and response to failure condition(s), would help
    ensure that system designs adequately and consistently minimize the
    potential for pilot actions that are inconsistent with manufacturer
    assumptions. Lastly, because the pilots were uncertain how to
    prioritize and respond to the multiple alerts and indications that they
    received, we concluded that aircraft systems that can more clearly and
    concisely inform pilots of the highest priority actions when multiple
    flight deck alerts and indications are present would minimize confusion
    and help pilots respond most effectively.
        Since the Lion Air accident in October 2018, Boeing has developed a
    software update to provide additional layers of protection to the MCAS
    and is working on updated procedures and training. However, we are
    concerned that the process used to evaluate the original design needs
    improvement because that process is still in use to certify current and
    future aircraft and system designs. Therefore, in accordance with our
    responsibilities as the accredited representative of the state of
    design and manufacture of the 737, we felt it necessary to issue safety
    recommendations.
    NTSB Recommendations
        On September 19, 2019, the NTSB issued seven safety recommendations
    to the FAA as a result of our examination of the U.S. design
    certification process used to approve the original design of the MCAS
    system on the Boeing 737 MAX.
        The NTSB found that the accident pilots' responses to the
    unintended MCAS operation were not consistent with the underlying
    assumptions about pilot recognition and response that Boeing used,
    based on FAA guidance, for flight control system functional hazard
    assessments, including for MCAS, as part of the 737 MAX design. We
    issued these recommendations to address assumptions about pilot
    recognition and response to failure conditions used during the design
    certification process as well as diagnostic tools to improve the
    prioritization and clarity of failure indications presented to pilots.
        As a result of the NTSB's in-depth examination of the U.S. design
    certification process and assumptions used to approve the original
    design of the MCAS system on the Boeing 737 MAX, the NTSB issued the
    following seven recommendations to the FAA:

      1.  Require that Boeing (1) ensure that system safety assessments for
            the 737 MAX in which it assumed immediate and appropriate pilot
            corrective actions in response to uncommanded flight control
            inputs, from systems such as the Maneuvering Characteristics
            Augmentation System, consider the effect of all possible flight
            deck alerts and indications on pilot recognition and response;
            and (2) incorporate design enhancements (including flight deck
            alerts and indications), pilot procedures, and/or training
            requirements, where needed, to minimize the potential for and
            safety impact of pilot actions that are inconsistent with
            manufacturer assumptions. (A-19-10)

      2.  Require that for all other U.S. type-certificated transport-
            category airplanes, manufacturers (1) ensure that system safety
            assessments for which they assumed immediate and appropriate
            pilot corrective actions in response to uncommanded flight
            control inputs consider the effect of all possible flight deck
            alerts and indications on pilot recognition and response; and
            (2) incorporate design enhancements (including flight deck
            alerts and indications), pilot procedures, and/or training
            requirements, where needed, to minimize the potential for and
            safety impact of pilot actions that are inconsistent with
            manufacturer assumptions. (A-19-11)

      3.  Notify other international regulators that certify transport-
            category airplane type designs (for example, the European Union
            Aviation Safety Agency, Transport Canada, the National Civil
            Aviation Agency-Brazil, the Civil Aviation Administration of
            China, and the Russian Federal Air Transport Agency) of
            Recommendation A-19-11 and encourage them to evaluate its
            relevance to their processes and address any changes, if
            applicable. (A-19-12)

      4.  Develop robust tools and methods, with the input of industry and
            human factors experts, for use in validating assumptions about
            pilot recognition and response to safety-significant failure
            conditions as part of the design certification process. (A-19-
            13)

      5.  Once the tools and methods have been developed as recommended in
            Recommendation A-19-13, revise existing Federal Aviation
            Administration (FAA) regulations and guidance to incorporate
            their use and documentation as part of the design certification
            process, including re-examining the validity of pilot
            recognition and response assumptions permitted in existing FAA
            guidance. (A-19-14)

      6.  Develop design standards, with the input of industry and human
            factors experts, for aircraft system diagnostic tools that
            improve the prioritization and clarity of failure indications
            (direct and indirect) presented to pilots to improve the
            timeliness and effectiveness of their response. (A-19-15)

      7.  Once the design standards have been developed as recommended in
            Recommendation A-19-15, require implementation of system
            diagnostic tools on transport-category aircraft to improve the
            timeliness and effectiveness of pilots' response when multiple
            flight deck alerts and indications are present. (A-19-16)

        The complete safety recommendation report is attached to this
    testimony.
        Finally, it should be noted that NTSB investigators continue to
    examine the design certification process and the NTSB may issue
    additional recommendations in this area in the future if such
    recommendations are warranted.
    Conclusion
        Thank you again for the opportunity to be here today to discuss the
    NTSB's role in these important international aviation accident
    investigations and to highlight our recent recommendations to FAA
    regarding the safety assessment process. I will be happy to answer any
    questions.
                                     ______

                      National Transportation Safety Board
                              Washington, DC 20594
                          Safety Recommendation Report
    Assumptions Used in the Safety Assessment Process and the Effects of
            Multiple Alerts and Indications on Pilot Performance

    ------------------------------------------------------------------------

    ------------------------------------------------------------------------
    Accident Number:          DCA19RA017/DCA19RA101

    Operator:                 PT Lion Mentari Airlines/Ethiopian Airlines

    Aircraft:                 Boeing 737 MAX 8/Boeing 737 MAX 8

    Location:                 Java Sea, Indonesia/Ejere, Ethiopia

    Date:                     October 29, 2018/March 10, 2019
    ------------------------------------------------------------------------

        The National Transportation Safety Board (NTSB) is providing the
    following information to urge the Federal Aviation Administration (FAA)
    to take action on the safety recommendations in this report. They are
    derived from our participation in the ongoing investigations of two
    fatal accidents under the provisions of Annex 13 of the International
    Civil Aviation Organization. As the accident investigation authority
    for the state of design and manufacture of the airplane in these
    accidents, the NTSB has been examining the U.S. design certification
    process used to approve the original design of the Maneuvering
    Characteristics Augmentation System (MCAS) on the Boeing Company
    (Boeing) 737 MAX. We note that, since the PT Lion Mentari Airlines
    (Lion Air) accident on October 29, 2018, Boeing has developed an MCAS
    software update to provide additional layers of protection and is
    working on updated procedures and training. However, we are concerned
    that the process used to evaluate the original design needs improvement
    because that process is still in use to certify current and future
    aircraft and system designs.
        Although the NTSB's work in this area is ongoing, based on
    preliminary information, we are concerned that the accident pilot
    responses to the unintended MCAS operation were not consistent with the
    underlying assumptions about pilot recognition and response that Boeing
    used, based on FAA guidance, for flight control system functional
    hazard assessments, including for MCAS, as part of the 737 MAX
    design.\1\ We are making these recommendations to address assumptions
    about pilot recognition and response to failure conditions used during
    the design certification process as well as diagnostic tools to improve
    the prioritization and clarity of failure indications presented to
    pilots.
    ---------------------------------------------------------------------------
        \1\ (a) We based our preliminary findings on information from the
    publicly released preliminary accident reports. (b) While Boeing uses
    the term ``uncommanded MCAS function'' in its assessment documents, in
    this report, we are using the term ``unintended MCAS operation'' as it
    relates to our review of the accident events.
    ---------------------------------------------------------------------------
                              Factual Information
    Accidents
        On October 29, 2018, Lion Air flight 610, a Boeing 737 MAX 8, PK-
    LQP, crashed in the Java Sea shortly after takeoff from Soekarno-Hatta
    International Airport, Jakarta, Indonesia. The flight crew had
    communicated with air traffic control and indicated that they were
    having flight control and altitude issues before the airplane
    disappeared from radar. The flight was a scheduled domestic flight from
    Jakarta to Depati Amir Airport, Pangkal Pinang City, Bangka Belitung
    Islands Province, Indonesia. All 189 passengers and crew on board died,
    and the airplane was destroyed. The National Transportation Safety
    Committee of Indonesia is leading the investigation.\2\
    ---------------------------------------------------------------------------
        \2\ Information in this section is taken from the preliminary
    report on this accident, which can be found at https://
    reports.aviation-safety.net/2018/20181029-0_B38M_PK-LQP_PRELIMI
    NARY.pdf.
    ---------------------------------------------------------------------------
        The airplane's digital flight data recorder (DFDR) recorded a
    difference between the left and right angle of attack (AOA) sensors
    that was present during the entire accident flight; the left AOA sensor
    was indicating about 20+ higher than the right AOA sensor. During
    rotation, the left (captain's) stick shaker activated, and DFDR data
    showed that the left airspeed and altitude values disagreed with, and
    were lower than, the corresponding values from the right. The first
    officer asked a controller to confirm the altitude of the airplane and
    later also asked the speed as shown on the controller radar display.
    After the flaps were fully retracted, a 10-second automaticaircraft
    nose-down (AND) stabilizer trim input occurred. After the automatic AND
    stabilizer trim input, the flight crew used the stabilizer trim
    switches (located on the outboard side of each control wheel) and
    applied aircraft nose-up (ANU) electric trim. According to DFDR data,
    about 5 seconds after the completion of the pilot trim input, another
    automatic AND stabilizer trim input occurred. The crew applied ANU
    electric trim again. DFDR data then showed that the flaps were extended
    for almost 2 minutes. However, the flaps were then fully retracted, and
    automatic AND stabilizer trim inputs occurred more than 20 times over
    the next 6 minutes; the crew countered each input during this time
    using ANU electric trim. The last few automatic AND stabilizer trim
    inputs were not fully countered by the crew.
        During the preceding Lion Air flight on the accident airplane with
    a different flight crew, the DFDR recorded the same difference between
    left and right AOA of about 20+ that continued until the end of the
    recording. During rotation, the left control column stick shaker
    activated and continued for the entire flight, and DFDR data showed
    that the left airspeed and altitude values disagreed with, and were
    lower than, the corresponding values from the right. After the flaps
    were fully retracted, a 10-second automatic AND stabilizer trim input
    occurred, and the crew countered the input with an ANU electric trim
    input. After several automatic AND stabilizer trim inputs that were
    countered by pilot-commanded ANU electric trim inputs, the crew noticed
    that the airplane was automatically trimming AND. The captain moved the
    stabilizer trim cutout (STAB TRIM CUTOUT) switches to CUTOUT.\3\ He
    then moved them back to NORMAL, and the problem almost immediately
    reappeared. He moved the switches back to CUTOUT. He stated that the
    crew performed three non-normal checklists: Airspeed Unreliable, ALT
    DISAGREE (altitude disagree), and Runaway Stabilizer. The pilots
    continued the flight using manual trim until the end of the flight.
    Upon landing, the captain informed an engineer of IAS DISAGREE
    (indicated airspeed disagree) and ALT DISAGREE alerts, in addition to
    FEEL DIFF PRESS (feel differential pressure) light problems on the
    airplane.
    ---------------------------------------------------------------------------
        \3\ Two STAB TRIM CUTOUT switches on the control stand can be used
    to stop the flight crew electric and autopilot trim inputs to the
    stabilizer trim actuator. The switches can be set to NORMAL or CUTOUT.
    If the switches are moved to CUTOUT, both the electric and autopilot
    trim inputs are disconnected from the stabilizer trim motor. NORMAL is
    the default position to enable operation of the electric and autopilot
    trim.
    ---------------------------------------------------------------------------
        On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX
    8, Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly
    after takeoff from Addis Ababa Bole International Airport, Ethiopia.
    The flight was a scheduled international passenger flight from Addis
    Ababa to Jomo Kenyatta International Airport, Nairobi, Kenya. All 157
    passengers and crew on board died, and the airplane was destroyed. The
    investigation is being led by the Ethiopia Accident Investigation
    Bureau.\4\
    ---------------------------------------------------------------------------
        \4\ Information in this section is taken from the preliminary
    report on this accident, which can be found at http://www.ecaa.gov.et/
    Home/wp-content/uploads/2019/07/Preliminary-Report-B737-800MAX-ET-
    AVJ.pdf.
    ---------------------------------------------------------------------------
        The airplane's DFDR data indicated that shortly after liftoff, the
    left (captain's) AOA sensor data increased rapidly to 74.5+ and was
    59.2+ higher than the right AOA sensor; the captain's stick shaker
    activated. Concurrently, the airspeed and altitude values on the left
    side disagreed with, and were lower than, the corresponding values on
    the right side; in addition, DFDR data indicated a Master Caution
    alert. Similar to the Lion Air accident flight, a 9-second automatic
    AND stabilizer trim input occurred after flaps were retracted and while
    in manual flight (no autopilot). About 3 seconds after the AND
    stabilizer motion ended, using the stabilizer trim switches, the
    captain, who was the pilot flying, partially countered the AND
    stabilizer input by applying ANU electric trim. About 5 seconds after
    the completion of pilot trim input, another automatic AND stabilizer
    trim input occurred. The captain applied ANU electric trim and fully
    countered the second automatic AND stabilizer input; however, the
    airplane was not returned to a fully trimmed condition. Cockpit voice
    recorder data indicated that the flight crew then discussed the STAB
    TRIM CUTOUT switches, and shortly thereafter DFDR data were consistent
    with the STAB TRIM CUTOUT switches being moved to CUTOUT.
        However, because the airplane remained in a nose-down out-of-trim
    condition, the crew was required to continue applying nose-up force to
    the control column to maintain level flight. About 32 seconds before
    impact, two momentary pilot-commanded electric ANU trim inputs and
    corresponding stabilizer movement were recorded, consistent with the
    STAB TRIM CUTOUT switches no longer being in CUTOUT. Five seconds after
    these short electric trim inputs, another automatic AND stabilizer trim
    input occurred, and the airplane began pitching nose down.
    Design Certification of the 737 MAX 8 and Safety Assessment of the MCAS
        The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG)
    model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\5\ The
    737 MAX incorporated the CFM LEAP-1B engine, which has a larger fan
    diameter and redesigned engine nacelle compared to engines installed on
    the 737 NG family. During the preliminary design stage of the 737 MAX,
    Boeing testing and analysis revealed that the addition of the LEAP-1B
    engine and associated nacelle changes produced an ANU pitching moment
    when the airplane was operating at high AOA and mid Mach numbers. After
    studying various options for addressing this issue, Boeing implemented
    aerodynamic changes as well as a stability augmentation function, MCAS,
    as an extension of the existing speed trim system to improve aircraft
    handling characteristics and decrease pitch-up tendency at elevated
    AOA. As the development of the 737 MAX progressed, the MCAS function
    was expanded to low Mach numbers.
    ---------------------------------------------------------------------------
        \5\ The 737-600, -700, and -800 airplanes are part of the 737 NG
    family.
    ---------------------------------------------------------------------------
        As originally delivered, the MCAS became active during manual
    flight (autopilot not engaged) when the flaps were fully retracted and
    the airplane's AOA value (as measured by either AOA sensor) exceeded a
    threshold based on Mach number. When activated, the MCAS provided
    automatic trim commands to move the stabilizer AND. Once the AOA fell
    below the threshold, the MCAS would move the stabilizer ANU to the
    original position. At any time, the stabilizer inputs could be stopped
    or reversed by the pilots using their stabilizer trim switches. If the
    stabilizer trim switches were used by the pilots and the elevated AOA
    condition persisted, the MCAS would command another stabilizer AND trim
    input after 5 seconds.
        The FAA's procedures for aircraft type certification require an
    aircraft manufacturer (``applicant'') to demonstrate that its design
    complies with all applicable FAA regulations and requirements.\6\ For
    transport-category airplanes, as part of this process, applicants must
    demonstrate through analysis, test, or both that their design meets the
    applicable requirements under Title 14 Code of Federal Regulations
    (CFR) Part 25. Specifically, 14 CFR 25.671 and 25.672 define the
    requirements for control systems in general and stability augmentation
    and automatic and power-operated systems, respectively. Title 14 CFR
    25.1322 addresses flight crew alerting and states, in part, that flight
    crew alerts must
    ---------------------------------------------------------------------------
        \6\ Title 14 Code of Federal Regulations Part 21 defines the
    procedures for certification.

    ---------------------------------------------------------------------------
      (1)  Provide the flightcrew with the information needed to:

          (i)  Identify non-normal operation or airplane system conditions,
                and

          (ii)  Determine the appropriate actions, if any.

      (2)  Be readily and easily detectable and intelligible by the
            flightcrew under all foreseeable operating conditions,
            including conditions where multiple alerts are provided.

    Advisory Circular (AC) 25.1322-1, ``Flightcrew Alerting,'' provides
    guidance for showing compliance with requirements for the design
    approval of flight crew alerting functions and indicates that
    ``Appropriate flightcrew corrective actions are normally defined by
    airplane procedures (for example, in checklists) and are part of a
    flightcrew training curriculum or considered basic airmanship.'' Title
    14 CFR 25.1309 relates to aircraft equipment, systems, and
    installations, and the primary means of compliance with this section
    for systems that are critical to safe flight and operations is through
    safety assessments or through rational analyses; AC 25.1309-1A,
    ``System Design and Analysis,'' provides guidance for showing
    compliance with Title 14 CFR 25.1309(b), (c), and (d).\7\ AC 25.1309-1A
    explains the FAA's fail-safe design concept, which ``considers the
    effects of failures and combinations of failures in defining a safe
    design.'' As part of demonstrating 737 MAX 8 compliance with the
    requirements in 14 CFR 25.1309, Boeing conducted a number of airplane-
    and system-level safety assessments, consistent with the guidance
    provided in AC 25.1309-1A.\8\
    ---------------------------------------------------------------------------
        \7\ Safety assessments are performed by the manufacturer and its
    suppliers and are reviewed and accepted by the FAA. Safety assessments
    proceed in a stepwise, data-driven manner to ensure that all
    significant single-failure conditions have been identified and all
    combinations of failures that could lead to hazardous or catastrophic
    airplane-level effects have been considered and appropriately
    mitigated. When a safety assessment cannot be performed on a new or
    complex system, a rational analysis may be performed to estimate
    quantitative probabilities and supplement qualitative analyses and
    tests. The safety assessment process outlined in AC 25.1309-1A is not
    mandatory, but manufacturers that do not conduct safety assessments
    must demonstrate compliance in another manner, such as ground or flight
    tests.
        \8\ Safety assessments can include the development of airplane-and
    system-level functional hazard assessments (to identify and classify
    potentially hazardous failure conditions), failure modes and effects
    analyses (a structured bottom-up analysis that evaluates the effects of
    each possible failure), and fault tree analyses (a structured top-down
    analysis to identify the conditions, failures, and events that would
    cause a failure condition).
    ---------------------------------------------------------------------------
        The NTSB reviewed sections of Boeing's system safety analysis for
    stabilizer trim control that pertained to MCAS on the 737 MAX. Boeing's
    analysis included a summary of the functional hazard assessment
    findings for the 737 MAX stabilizer trim control system. For the normal
    flight envelope, Boeing identified and classified two hazards
    associated with ``uncommanded MCAS'' activation as ``major.'' \9\ One
    of these hazards, applicable to the MCAS function seen in these
    accidents, included uncommanded MCAS operation to maximum
    authority.\10\ Boeing indicated that, as part of the functional hazard
    assessment development, pilot assessments of MCAS-related hazards were
    conducted in an engineering flight simulator, including the uncommanded
    MCAS operation (stabilizer runaway) to the MCAS maximum authority.
    ---------------------------------------------------------------------------
        \9\ The ``major'' classification used by Boeing indicated a remote
    probability of this hazard occurring and that it could result in
    reduced control capability, reduced system redundancy, or increased
    crew workload. Other classification categories included ``minor,''
    ``hazardous,'' and ``catastrophic.''
        \10\ In March 2016, Boeing determined that MCAS should be revised
    to improve flaps up, low Mach stall characteristics and identification.
    The preliminary hazard assessments of MCAS were re-evaluated after this
    change by pilot evaluation in the motion simulator and determined to
    have not changed the hazard classification.
    ---------------------------------------------------------------------------
        To perform these simulator tests, Boeing induced a stabilizer trim
    input that would simulate the stabilizer moving at a rate and duration
    consistent with the MCAS function. Using this method to induce the
    hazard resulted in the following: motion of the stabilizer trim wheel,
    increased column forces, and indication that the airplane was moving
    nose down. Boeing indicated to the NTSB that this evaluation was
    focused on the pilot response to uncommanded MCAS operation, regardless
    of underlying cause. Thus, the specific failure modes that could lead
    to uncommanded MCAS activation (such as an erroneous high AOA input to
    the MCAS) were not simulated as part of these functional hazard
    assessment validation tests. As a result, additional flight deck
    effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker
    activation) resulting from the same underlying failure (for example,
    erroneous AOA) were not simulated and were not in the stabilizer trim
    safety assessment report reviewed by the NTSB.
        Boeing indicated to the NTSB that, based on FAA guidance, it used
    assumptions during its safety assessment of MCAS hazards in the
    engineering flight simulator. Four of these assumptions were the
    following:

       Uncommanded system inputs are readily recognizable and can
            be counteracted by overriding the failure by movement of the
            flight controls ``in the normal sense'' by the flight crew and
            do not require specific procedures.\11\
    ---------------------------------------------------------------------------
        \11\ Title 14 CFR 25.672 states the following: ``The design of the
    stability augmentation system or of any other automatic or power-
    operated system must permit initial counteraction of failures of the
    type specified in Sec. 25.671(c) without requiring exceptional pilot
    skill or strength, by either the deactivation of the esystem, or a
    failed portion thereof, or by overriding the failure by movement of the
    flight controls in the normal sense.''

       Action to counter the failure shall not require exceptional
    ---------------------------------------------------------------------------
            piloting skill or strength.

       The pilot will take immediate action to reduce or eliminate
            increased control forces by re-trimming or changing
            configuration or flight conditions.

       Trained flight crew memory procedures shall be followed to
            address and eliminate or mitigate the failure.

    Boeing advised that these assumptions are used across all Boeing models
    when performing functional hazard assessments of flight control
    systems. These assumptions were consistent with requirements in 14 CFR
    25.671 and 25.672 and guidance in AC 25-7C, ``Flight Test Guide for
    Certification of Transport Category Airplanes.'' \12\ AC 25-7C stated
    that short-term forces are the initial stabilized control forces that
    result from maintaining the intended flightpath after configuration
    changes and normal transitions from one flight condition to another,
    ``or from regaining control following a failure. It is assumed that the
    pilot will take immediate action to reduce or eliminate such forces by
    re-trimming or changing configuration or flight conditions, and
    consequently short-term forces are not considered to exist for any
    significant duration [emphasis added].'' In a 2019 presentation to the
    NTSB, Boeing indicated that the MCAS hazard classification of ``major''
    for uncommanded MCAS function in the normal flight envelope was based
    on the following conclusions:
    ---------------------------------------------------------------------------
        \12\ On October 16, 2012, the FAA released AC 25-7C, which revised
    version B to reduce the number of differences from the European
    Aviation Safety Agency's Flight Test Guide; provide acceptable means of
    compliance for the regulatory changes associated with amendments 107,
    109, 113, 115, 119, and 123 to 14 CFR Part 25; respond to NTSB
    recommendations; and provide a general update to reflect current FAA
    and industry practices and policies. AC 25-7C was in effect at the time
    of Boeing's safety assessments of the 737 MAX. On May 4, 2018, the FAA
    released AC 25-7D to clarify several paragraphs, revise an appendix,
    and improve usability with formatting changes.

       Unintended stabilizer trim inputs are readily recognized by
            movement of the stabilizer trim wheel, flightpath change, or
    ---------------------------------------------------------------------------
            increased column forces.

       Aircraft can be returned to steady level flight using
            available column (elevator) alone or stabilizer trim.

       Continuous unintended nose-down stabilizer trim inputs would
            be recognized as a stabilizer trim or stabilizer runaway
            failure and the procedure for stabilizer runaway would be
            followed.\13\
    ---------------------------------------------------------------------------
        \13\ The runaway stabilizer procedure includes holding the control
    column firmly, disengaging the autopilot and autothrottles (if
    engaged), setting the STAB TRIM CUTOUT switches to CUTOUT, and trimming
    the airplane manually.
    ---------------------------------------------------------------------------
                                    Analysis
    Assumptions about Pilot Recognition and Response in the Safety
            Assessment
        Functional hazard assessments at the aircraft and systems levels
    are a critical part of the design certification process because the
    resulting hazard classifications (severity level) drive the safety
    requirements for equipment design, flight crew procedures, and training
    to ensure the hazard effects are sufficiently mitigated. On the basis
    of Boeing's functional hazard assessment for the MCAS, which assumed
    timely pilot response to uncommanded MCAS-generated trim input,
    uncommanded MCAS activation was classified as ``major.'' Boeing was
    then required to verify that each system that supported MCAS complied
    with the quantitative and qualitative safety requirements for a
    ``major'' hazard, as provided in AC 25.1309-1A, and demonstrate this to
    the FAA in its aircraft and system safety assessments.
        On the Lion Air flight immediately before the accident flight and
    the Lion Air and Ethiopian Airlines accident flights, the DFDR recorded
    higher AOA sensor data on the left side than on the right (about 20+
    higher on the previous Lion Air flight and the Lion Air accident flight
    and about 59+ higher on the Ethiopian Airlines accident flight). As
    previously stated, the MCAS becomes active when the airplane's AOA
    exceeds a certain threshold. Thus, these erroneous AOA sensor inputs
    resulted in the MCAS activating on the accident flights and providing
    the automatic AND stabilizer trim inputs. The erroneous high AOA sensor
    input that caused the MCAS activation also caused several other alerts
    and indications for the flight crews. The stick shaker activated on
    both accident flights and the previous Lion Air flight. In addition,
    IAS DISAGREE and ALT DISAGREE alerts occurred on all three flights.
    Also, the Ethiopian Airlines flight crew received a Master Caution
    alert. Further, after the flaps were fully retracted, the unintended
    AND stabilizer inputs required the pilots to apply additional force to
    the columns to maintain the airplane's climb attitude.
        Multiple alerts and indications can increase pilots' workload, and
    the combination of the alerts and indications did not trigger the
    accident pilots to immediately perform the runaway stabilizer procedure
    during the initial automatic AND stabilizer trim input. In all three
    flights, the pilot responses differed and did not match the assumptions
    of pilot responses to unintended MCAS operation on which Boeing based
    its hazard classifications within the safety assessment and that the
    FAA approved and used to ensure the design safely accommodates
    failures. Although a number of factors, including system design,
    training, operation, and the pilots' previous experiences, can affect a
    human's ability to recognize and take immediate, appropriate corrective
    actions for failure conditions, industry experts generally recognize
    that an aircraft system should be designed such that the consequences
    of any human error are limited.\14\ Further, a report on a joint FAA-
    industry study published in 2002, Commercial Airplane Certification
    Process Study: An Evaluation of Selected Aircraft Certification,
    Operations, and Maintenance Processes, noted that human performance was
    still the dominant factor in accidents and highlighted that the
    industry challenge is to develop airplanes and procedures that are less
    likely to result in operator error and that are more tolerant of
    operator errors when they do occur, in particular errors involving
    incorrect response after a malfunction.\15\
    ---------------------------------------------------------------------------
        \14\ (a) Yeh, Michelle, Cathy Swider, Young Jin Jo, and Colleen
    Donovan. 2016. Human Factors Considerations in the Design and
    Evaluation of Flight Deck Displays and Controls. Version 2.0, Final
    Report--December 2016, DOT/FAA/TC-16/56. pp. 248-249. (b) The FAA's
    Pilot's Handbook of Aeronautical Knowledge, FAA-H-8083-25B, Chapter 2,
    page 2-12, states, ``Historically, the term `pilot error' has been used
    to describe an accident in which an action or decision made by the
    pilot was the cause or a contributing factor that led to the accident.
    This definition also includes the pilot's failure to make a correct
    decision or take proper action.''
        \15\ The industry study team included representatives from
    manufacturers, airlines, pilot labor organizations, and other aviation
    stakeholders. See Commercial Airplane Certification Process Study: An
    Evaluation of Selected Aircraft Certification, Operations, and
    Maintenance Processes. March 2002. The Report of the FAA Associate
    Administrator for Regulation and Certification's Study on the
    Commercial Airplane Certification Process.
    ---------------------------------------------------------------------------
        Consistent with this philosophy, the NTSB notes that FAA
    certification guidance in AC 25.1309-1A that allows manufacturers to
    assume pilots will respond to failure conditions appropriately is
    based, in part, upon the applicant showing that the systems, controls,
    and associated monitoring and warnings are designed to minimize crew
    errors, which could create additional hazards.\16\ While Boeing
    considered the possibility of uncommanded MCAS operation as part of its
    functional hazard assessment, it did not evaluate all the potential
    alerts and indications that could accompany a failure that also
    resulted in uncommanded MCAS operation. Therefore, neither Boeing's
    system safety assessment nor its simulator tests evaluated how the
    combined effect of alerts and indications might impact pilots'
    recognition of which procedure(s) to prioritize in responding to an
    unintended MCAS operation caused by an erroneous AOA input.\17\ The
    NTSB is concerned that, if manufacturers assume correct pilot response
    without comprehensively examining all possible flight deck alerts and
    indications that may occur for system and component failures that
    contribute to a given hazard, the hazard classification and resulting
    system design (including alerts and indications), procedural, and/or
    training mitigations may not adequately consider and account for the
    potential for pilots to take actions that are inconsistent with
    manufacturer assumptions.
    ---------------------------------------------------------------------------
        \16\ Title 14 CFR 25.1309(c) states, ``Warning information must be
    provided to alert the crew to unsafe system operating conditions, and
    to enable them to take appropriate corrective action. Systems,
    controls, and associated monitoring and warning means must be designed
    to minimize crew errors which could create additional hazards.''
        \17\ Per Title 14 CFR 25.1309(d)(4), compliance demonstration as
    part of aircraft certification must include analysis that considers the
    crew warning cues, corrective action required, and the capability of
    detecting faults.
    ---------------------------------------------------------------------------
        Thus, the NTSB concludes that the assumptions that Boeing used in
    its functional hazard assessment of uncommanded MCAS function for the
    737 MAX did not adequately consider and account for the impact that
    multiple flight deck alerts and indications could have on pilots'
    responses to the hazard. Therefore, the NTSB recommends that the FAA
    require that Boeing (1) ensure that system safety assessments for the
    737 MAX in which it assumed immediate and appropriate pilot corrective
    actions in response to uncommanded flight control inputs, from systems
    such as MCAS, consider the effect of all possible flight deck alerts
    and indications on pilot recognition and response; and (2) incorporate
    design enhancements (including flight deck alerts and indications),
    pilot procedures, and/or training requirements, where needed, to
    minimize the potential for and safety impact of pilot actions that are
    inconsistent with manufacturer assumptions.
        Further, because FAA guidance allows such assumptions to be made in
    transport-category airplane certification analyses without providing
    applicants with clear direction concerning the consideration of
    multiple flight deck alerts and indications in evaluating pilot
    recognition and response, the NTSB is concerned that similar
    assumptions and procedures for their validation may have also been used
    in the development of flight control system safety assessments for
    other airplanes. Therefore, the NTSB recommends that the FAA require
    that for all other U.S. type-certificated transport-category airplanes,
    manufacturers (1) ensure that system safety assessments for which they
    assumed immediate and appropriate pilot corrective actions in response
    to uncommanded flight control inputs consider the effect of all
    possible flight deck alerts and indications on pilot recognition and
    response; and (2) incorporate design enhancements (including flight
    deck alerts and indications), pilot procedures, and/or training
    requirements, where needed, to minimize the potential for and safety
    impact of pilot actions that are inconsistent with manufacturer
    assumptions.
        Because the FAA routinely harmonizes related standards and guidance
    with other international regulators who type certificate transport-
    category airplanes, the NTSB notes that those airplanes may have been
    designed using similar standards and therefore may also be impacted by
    this vulnerability. Therefore, the NTSB also recommends that the FAA
    notify other international regulators that certify transport-category
    airplane type designs (for example, the European Union Aviation Safety
    Agency [EASA], Transport Canada, the National Civil Aviation Agency-
    Brazil, the Civil Aviation Administration of China, and the Russian
    Federal Air Transport Agency) of Recommendation A-19-11 and encourage
    them to evaluate its relevance to their processes and address any
    changes, if applicable.
        As early as 2002, the joint FAA-industry study recognized that,
    while excellent guidance existed for manufacturers on various topics
    salient to the development of system safety assessments, there were no
    methods available to evaluate the probability of human error in the
    operation of a particular system design and that existing qualitative
    methods for assessing human error were not ``very satisfactory.'' The
    2002 study went on to state that the processes used to determine and
    validate human responses to failure and methods to include human
    responses in safety assessments needed to be improved.\18\ The NTSB
    notes that a number of human performance research studies have been
    conducted in the years since the certification guidance contained in AC
    25.1309-1A was put in place (in 1988) and this study was conducted and
    it is likely that more rigorous, validated methodologies exist today to
    assess error tolerance with regard to pilot recognition and response to
    failure conditions. The NTSB also believes that the use of validated
    methods and tools to assess pilot performance in dealing with failure
    conditions and emergencies would result in more effective requirements
    for flight deck interface design, pilot procedures, and training
    strategies. However, we are concerned that such tools and methods are
    still not commonplace or required as part of the design certification
    process for functions such as MCAS on newly certified type designs.
    ---------------------------------------------------------------------------
        \18\ Commercial Airplane Certification Process Study: An Evaluation
    of Selected Aircraft Certification, Operations, and Maintenance
    Processes. March 2002. The Report of the FAAAssociate Administrator for
    Regulation and Certification's Study on the Commercial Airplane
    Certification Process.
    ---------------------------------------------------------------------------
        Thus, the NTSB concludes that a standardized methodology and/or
    tools for manufacturers' use in evaluating and validating assumptions
    about pilot recognition and response to failure condition(s),
    particularly those conditions that result in multiple flight deck
    alerts and indications, would help ensure that system designs
    adequately and consistently minimize the potential for pilot actions
    that are inconsistent with manufacturer assumptions. Therefore, the
    NTSB recommends that the FAA develop robust tools and methods, with the
    input of industry and human factors experts, for use in validating
    assumptions about pilot recognition and response to safety-significant
    failure conditions as part of the design certification process.
    Further, the NTSB recommends that once the tools and methods have been
    developed as recommended in Recommendation A-19-13, the FAA revise
    existing FAA regulations and guidance to incorporate their use and
    documentation as part of the design certification process, including
    re-examining the validity of pilot recognition and response assumptions
    permitted in existing FAA guidance.
    System Diagnostic Tools
        As previously discussed, Title 14 CFR 25.1322 addresses flight crew
    alerting and states, in part, that flight crew alerts must

      (1)  Provide the flightcrew with the information needed to:

          (i)  Identify non-normal operation or airplane system conditions,
                and

          (ii)  Determine the appropriate actions, if any.

      (2)  Be readily and easily detectable and intelligible by the
            flightcrew under all foreseeable operating conditions,
            including conditions where multiple alerts are provided.

    Multiple alerts and indications in the cockpit can increase pilots'
    workload and can also make it more difficult to identify which
    procedure the pilots should conduct. The NTSB notes that the Lion Air
    and Ethiopian Airlines accident pilots' responses to multiple alerts
    and indications are similar to the circumstances of a 2009 accident
    involving Air France flight 447, an Airbus A330, which was traveling
    from Rio de Janeiro to Paris when it crashed in the Atlantic Ocean.\19\
    In its accident report, the Bureau d'Enquetes et d'Analyses Pour la
    Securite de L'aviation Civile (BEA) concluded that failure messages
    successively displayed on the electronic centralized aircraft
    monitoring system did not allow the crew to rapidly and effectively
    diagnose the issue (the blockage of the pitot probes) or make the
    connection between the messages that appeared and the procedure to use.
    Accordingly, the BEA recommended that EASA ``study the relevance of
    having a dedicated warning provided to the crew when specific
    monitoring is triggered, in order to facilitate comprehension of the
    situation.'' \20\
    ---------------------------------------------------------------------------
        \19\ Bureau d'Enquetes et d'Analyses Pour la Securite de L'aviation
    Civile. 2012. Final Report, On the accident on 1st June 2009 to the
    Airbus A330-203, registered F-GZCP, operated by Air France, flight AF
    447, Rio de Janeiro--Paris.
        \20\ The response to this recommendation, FRAN-2012-049, was
    classified as ``partially adequate,'' and the recommendation was closed
    as of February 2, 2019.
    ---------------------------------------------------------------------------
        Human factors research has identified that, for non-normal
    conditions, such as those involving a system failure with multiple
    alerts, where there may be multiple flight crew actions required,
    providing pilots with understanding as to which actions must take
    priority is a critical need.\21\ This is particularly true in the case
    of functions implemented across multiple airplane systems because a
    failure in one system within highly integrated system architectures can
    present multiple alerts and indications to the flight crew as each
    interfacing system registers the failure. For example, the erroneous
    AOA output experienced during the two accident flights resulted in
    multiple alerts and indications to the flight crews, yet the crews
    lacked tools to identify the most effective response.\22\ Thus, it is
    important that system interactions and the flight deck interface be
    designed to help direct pilots to the highest priority action(s).
    ---------------------------------------------------------------------------
        \21\ See (a) Mumaw, Randall J. 2017. ``Analysis of Alerting System
    Failures in Commercial Aviation Accidents.'' Proceedings of the Human
    Factors and Ergonomics Society 2017 Annual Meeting; and (b) Burian,
    Barbara K., Immanuel Barshi, and Key Dismukes. 2005. The Challenge of
    Aviation Emergency and Abnormal Situations NASA/TM--2005-213462. NASA
    Scientific and Technical Information Program Office. Washington, DC.
        \22\ After the Lion Air accident, on November 7, 2018, the FAA
    issued emergency Airworthiness Directive 2018-23-51, revising the
    Boeing 737 MAX Airplane Flight Manual (AFM) to expand the existing
    runaway stabilizer procedure when erroneous AOA input is detected. This
    revision provided new details about the effects and indications a pilot
    might experience due to an erroneous AOA input, such as increasing
    nose-down control forces resulting from repeated AND stabilizer trim
    inputs. It also instructed pilots to perform the existing AFM runaway
    stabilizer procedure, emphasizing that the pilot set the STAB TRIM
    CUTOUT switches to CUTOUT and that the switches stay in the CUTOUT
    position for the remainder of the flight.
    ---------------------------------------------------------------------------
        Research demonstrates that emergency situations increase workload
    and require additional effort to manage effectively because of the
    stress involved and the lack of opportunity for pilots to practice
    these skills compared to those used in normal operations.\23\ In
    addition, research into pilot responses to multiple/simultaneous
    anomalous situations, along with data from accidents, indicates that
    multiple competing alerts may exceed available mental resources and
    narrow attentional focus leading to delayed or inadequately prioritized
    responses.\24\ According to FAA research, ``in some airplanes, the
    complexity and variety of ancillary warnings and alerts associated with
    major system failures can make it difficult for the flightcrew to
    discern the primary failure.'' \25\ The researchers noted that better
    system failure diagnostic tools are needed to resolve this issue.
    ---------------------------------------------------------------------------
        \23\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005.
    The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
    2005-213462. NASA Scientific and Technical Information Program Office.
    Washington, DC.
        \24\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005.
    The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
    2005-213462. NASA Scientific and Technical Information Program Office.
    Washington, DC.
        \25\ Federal Aviation Administration. 1996. Federal Aviation
    Administration Human Factors Team Report on: The Interfaces Between
    Flightcrews and Modern Flight Deck Systems, June 18, 1996.
    ---------------------------------------------------------------------------
        Thus, the NTSB concludes that aircraft systems that can more
    clearly and concisely inform pilots of the highest priority actions
    when multiple flight deck alerts and indications are present would
    minimize confusion and help pilots respond most effectively. Therefore,
    the NTSB recommends that the FAA develop design standards, with the
    input of industry and human factors experts, for aircraft system
    diagnostic tools that improve the prioritization and clarity of failure
    indications (direct and indirect) presented to pilots to improve the
    timeliness and effectiveness of their response. The NTSB further
    recommends that once the design standards have been developed as
    recommended in Recommendation A-19-15, the FAA require implementation
    of system diagnostic tools on transport-category aircraft to improve
    the timeliness and effectiveness of pilots' response when multiple
    flight deck alerts and indications are present.
                                     ______

                                Recommendations
    To the Federal Aviation Administration
            Require that Boeing (1) ensure that system safety assessments
            for the 737 MAX in which it assumed immediate and appropriate
            pilot corrective actions in response to uncommanded flight
            control inputs, from systems such as the Maneuvering
            Characteristics Augmentation System, consider the effect of all
            possible flight deck alerts and indications on pilot
            recognition and response; and (2) incorporate design
            enhancements (including flight deck alerts and indications),
            pilot procedures, and/or training requirements, where needed,
            to minimize the potential for and safety impact of pilot
            actions that are inconsistent with manufacturer assumptions.
            (A-19-10)

            Require that for all other U.S. type-certificated transport-
            category airplanes, manufacturers (1) ensure that system safety
            assessments for which they assumed immediate and appropriate
            pilot corrective actions in response to uncommanded flight
            control inputs consider the effect of all possible flight deck
            alerts and indications on pilot recognition and response; and
            (2) incorporate design enhancements (including flight deck
            alerts and indications), pilot procedures, and/or training
            requirements, where needed, to minimize the potential for and
            safety impact of pilot actions that are inconsistent with
            manufacturer assumptions. (A-19-11)

            Notify other international regulators that certify transport-
            category airplane type designs (for example, the European Union
            Aviation Safety Agency, Transport Canada, the National Civil
            Aviation Agency-Brazil, the Civil Aviation Administration of
            China, and the Russian Federal Air Transport Agency) of
            Recommendation A-19-11 and encourage them to evaluate its
            relevance to their processes and address any changes, if
            applicable. (A-19-12)

            Develop robust tools and methods, with the input of industry
            and human factors experts, for use in validating assumptions
            about pilot recognition and response to safety-significant
            failure conditions as part of the design certification process.
            (A-19-13)

            Once the tools and methods have been developed as recommended
            in Recommendation A-19-13, revise existing Federal Aviation
            Administration (FAA) regulations and guidance to incorporate
            their use and documentation as part of the design certification
            process, including re-examining the validity of pilot
            recognition and response assumptions permitted in existing FAA
            guidance. (A-19-14)

            Develop design standards, with the input of industry and human
            factors experts, for aircraft system diagnostic tools that
            improve the prioritization and clarity of failure indications
            (direct and indirect) presented to pilots to improve the
            timeliness and effectiveness of their response. (A-19-15)

            Once the design standards have been developed as recommended in
            Recommendation A-19-15, require implementation of system
            diagnostic tools on transport-category aircraft to improve the
            timeliness and effectiveness of pilots' response when multiple
            flight deck alerts and indications are present. (A-19-16)

    BY THE NATIONAL TRANSPORTATION SAFETY BOARD

    ROBERT L. SUMWALT, III               JENNIFER HOMENDY
    Chairman                             Member

    BRUCE LANDSBERG
    Vice Chairman

    Report Date: September 19, 2019

        The Chairman. Thank you, Mr. Sumwalt. Mr. Hart, you are
    recognized.

           STATEMENT OF HON. CHRISTOPHER A. HART, CHAIRMAN,
               JOINT AUTHORITIES TECHNICAL REVIEW (JATR)

        Mr. Hart. Thank you, Chairman Wicker, Ranking Member
    Cantwell, and members of the Committee. Thank you for inviting
    me to this hearing today. First, I would like to extend my
    condolences, joining others who have already done so, to the
    families and friends of the passengers and crew on Lion Air
    flight 610 and Ethiopian Airlines flight 302.
        The FAA created the Joint Authorities Technical Review
    because these crashes revealed a need to review the robustness
    of the aircraft certification process. The JATR, which included
    representatives from the FAA, NASA, and nine other civil
    aviation authorities was created to review the MAX
    certification process to determine whether the appropriate
    regulations were applied, to assess whether compliance with
    those regulations was shown, and to recommend improvements in
    the process.
        I commend the FAA for seeking this certification process
    peer review and for making it public. The MAX grounding was
    unprecedented. Two previous groundings were the McDonnell
    Douglas DC-10 in 1979 when an engine separated from the wing,
    and the Boeing 787 in 2013 due to battery fires. In those two
    groundings, the airplanes were rendered unairworthy. Because
    the airplanes were unairworthy, pilot competence was not an
    issue. Because those groundings resulted solely from airplane
    problems, the country where the airplanes were manufactured
    made the grounding and ungrounding decisions.
        The grounding of the MAX, on the other hand, involves
    automation that usually worked but sometimes failed, and when
    it failed, some pilots knew how to respond but some, including
    those who crashed, did not. Because the scenario was not just
    an airplane problem, but a problem of airplane system/pilot
    interaction, every country that licenses pilots must also be
    involved in the grounding and ungrounded decisions.
        As automation complexity increases, I anticipate that
    future problems are more likely to be of the airplane/pilot
    type rather than airplane only. After three JATR meetings in
    Seattle in which Boeing and the FAA were very open and helpful,
    and extensive work between the meetings, the JATR gave the FAA
    on October 11 a compilation of team members' recommendations in
    12 areas. Some of the recommendations derived from the need for
    the certification process to address how a single system
    failure may create issues in other systems.
        Other recommendations raised the issue of whether a process
    that has been based largely upon compliance should also address
    safety. As systems become more complex, the likelihood
    increases that compliance with applicable regulations will not
    necessarily ensure safety. Moreover, as systems become more
    complex, the certification process should ensure that fail-safe
    design principles prioritize the mitigation of hazards through
    design, minimizing reliance on pilot action as primary means of
    risk mitigation. Delegation will probably become more prevalent
    as regulators encounter increasing difficulty hiring and
    retaining technology leaders.
        Thus, although the recommendations do not address the
    desirability of delegation. They do recommend examining how to
    make the ODA process less cumbersome to avoid stifling
    communications. Query, for example, whether inadequate
    communications resulted in the failure to address the effects
    of evolving the Maneuvering Characteristics Augmentation
    System, MCAS, from a benign system to a more aggressive system.
    And query whether inadequate communications resulted in the
    failure to address the effects of modifying MCAS from one
    scenario to another scenario.
        Other recommendations relate to the FAA standards regarding
    the time for pilots to identify and respond to problems. JATR
    members recommend reviewing whether existing standards are
    appropriate for today's complex systems. For example, when a
    system failure results in cascading failures and multiple
    alarms, query how adequately the certification process
    considers the impact of multiple alarms, along with possible
    startle effect, on the ability of pilots to respond
    appropriately. These two crashes are the latest of several
    recent crashes in which pilots encountered scenarios that they
    had never seen before, even in training, and responded
    inappropriately. Increasing complexity and reliability
    exacerbate the challenge of training pilots to respond to
    problems that they have never seen before.
        Increasing complexity exacerbates the challenge because it
    reduces the likelihood that pilots understand the system.
    Increasing reliability exacerbates the challenge because it
    increases the difficulty of determining what types of problems
    might occur and then including those types of problems in
    training. In conclusion, the JATR members hope that their
    recommendations will continue improving aviation safety by
    helping to improve the certification process.
        Thank you again for inviting me and I look forward to your
    questions.
        [The prepared statement of Mr. Hart follows:]

           Prepared Statement of Hon. Christopher A. Hart, Chairman,
                   Joint Authorities Technical Review (JATR)
        Introduction. Chairman Wicker, Ranking Member Cantwell, and Members
    of the Committee, thank you for the opportunity to be here today in my
    capacity as Chairman of the Joint Authorities Technical Review (JATR)
    to discuss the JATR's efforts to improve aviation safety.
        Before I begin, I would like to extend my sincerest condolences to
    the families and friends of the passengers and crew on Lion Air Flight
    JT610 that crashed a year ago today, on October 29, 2019, and on
    Ethiopian Airlines Flight ET302 that crashed less than five months
    later, on March 10, 2019.
        The following describes the JATR and why it was created, discusses
    some of the recommendations that it submitted to the Federal Aviation
    Administration (FAA), and then briefly describes a training challenge
    that has come to light as a result of the JATR's efforts.
        The JATR. The Boeing 737 MAX (MAX) Flight Control System Joint
    Authorities Technical Review, created by the FAA, had its kickoff
    meeting in late April/early May 2019, and its charter was signed and
    became official on June 1, 2019. It consisted of technical
    representatives from the FAA, the National Aeronautics and Space
    Administration (NASA), and civil aviation authorities from Australia,
    Brazil, Canada, China, Europe, Indonesia, Japan, Singapore, and the
    United Arab Emirates. The FAA intentionally did not include on the JATR
    team any of its staff who were involved in the MAX certification
    process.
        I was asked to lead the JATR, in part because of my experience in
    aviation safety and accident investigation. I was at the National
    Transportation Safety Board for a total of 12 years, including as
    Chairman. I also have a regulatory perspective from 14 years at the
    FAA. To ensure a fully objective review, I was not compensated by the
    FAA for this role. I would also note that I am not a certification
    process expert, so I don't have the perspective of ``this is how we
    have always done certification and we should keep it that way.'' I was
    honored to be asked to lead this important international aviation
    safety improvement effort.
        Why the JATR. The FAA's aircraft certification process has played a
    major role in producing airliners with an exemplary safety record.
    Nonetheless, as with any system that is designed and operated by
    humans, the certification process can never be perfect, and the two
    tragic MAX crashes noted above revealed a critical need to review the
    process to determine whether improvement and modernization are
    warranted. The JATR was created to conduct that review and make
    improvement recommendations as warranted. The JATR completed its review
    on October 11, 2019, when it gave its compilation of team members'
    recommendations (not necessarily with consensus, as noted below) to the
    FAA.
        The JATR was not chartered to become involved in returning the MAX
    to service, nor was it chartered to become involved in the two accident
    investigations. Moreover, the JATR was not created to determine fault
    or blame in the certification process, but to consider whether the
    appropriate regulations and policy were applied to the MAX; to assess
    whether compliance was shown with the applicable requirements related
    to the flight control system; and to recommend improvements to the
    certification process.
        The JATR was unprecedented in that it was the first time an
    aviation safety regulator has voluntarily called for what is
    essentially an international peer review of its certification process,
    and then made that peer review public. The FAA's willingness to use
    such a process to improve safety, and doing so with such transparency,
    are indicative of the safety culture that permeates the commercial
    aviation industry that has produced such an exemplary airline safety
    record.
        Unprecedented Groundings. The grounding of the MAX was also
    unprecedented and placed the worldwide aviation industry in uncharted
    territory. The other two airliner groundings by the FAA in in the last
    40 years were the McDonnell Douglas DC-10 in 1979, after an engine
    separated from the wing shortly after takeoff; and the Boeing 787 in
    2013, due to lithium-ion battery thermal runaways and fires. In those
    two groundings, the airplanes were rendered unairworthy by mechanical
    malfunctions.
        Because the airplanes were unairworthy, the problem was solely an
    airplane problem and pilot competence was not an issue. Because those
    groundings resulted entirely from airplane problems, the primary
    country that decided when to ground the airplanes and when to return
    them to service was the country where the airplanes were manufactured--
    in those two instances, the U.S.
        The MAX grounding, on the other hand, involved automation that
    usually worked but sometimes failed; and when it failed, some pilots
    knew how to handle the failure (including the pilots on the Lion Air
    MAX the day before it crashed) but some did not, even after the
    additional attention to the issue that resulted from the Lion Air
    crash; and among those who did not know how to handle the failure were
    those who crashed. Hence, the scenario was not just an airplane
    problem, but a problem of the interaction between the airplane systems
    and its pilots. Thus, not only the country where the airplane is
    manufactured, but also every country that licenses and trains pilots
    must be involved in the decisions to ground and to return to service.
        My expectation is that the international aviation community will be
    challenged to figure out how to handle this new scenario because future
    airliner problems are more likely to be of the airplane-pilot
    interaction type and less likely to be of the airplane-only type. The
    JATR was a first step in figuring out how the certification process can
    best address what may be a new normal.
        Hence, I commend the FAA's inclusion in the JATR of representatives
    from nine other civil aviation authorities because this is not just an
    FAA certification process issue but a worldwide certification process
    issue. Because most of the aviation authorities in the JATR also
    certify aviation products, this was an opportunity for the certifying
    countries to begin working together to determine how best to navigate
    this uncharted territory. Moreover, all of the aviation authorities in
    the JATR are involved in the licensing and training of pilots.
        The JATR process. The JATR met three times in Seattle, starting
    with the kickoff meeting in the Spring in Seattle (noted above) for
    initial briefings from Boeing and the FAA. At that first meeting the
    JATR was divided into seven subgroups, with the following focus areas:

            A: Applied Regulations and Policy

            B: Compliance with applicable portions of 14 CFR part 25,
            subparts B (Flight) and G (Operating Limitations and
            Information)

            C: Compliance with applicable portions of 14 CFR part 25,
            subparts D (Design and Construction) and F (Equipment)

            D: Boeing Systems Engineering Practices

            E: Organization Designation Authorization (ODA)

            F: Operational Suitability, Maintenance, and Training

            G: Preliminary Accident Information

        In mid-Summer the JATR had an intensive follow-up meeting in
    Seattle with Boeing and FAA personnel, including an extensive review of
    various certification documents.
        Writing the observations, findings, and recommendations commenced
    after the second meeting, and later in the summer the JATR met again in
    Seattle to consider the document as a whole as it was shaping up.
    Boeing and the FAA were very open and helpful to the JATR team in these
    meetings and in general throughout our review. We also received notable
    support from a number of FAA aircraft certification, evaluation, and
    oversight personnel throughout the process. As the document was being
    finalized, the JATR gave Boeing and the FAA an opportunity to review
    objective information assembled by the team for the purpose of ensuring
    the factual accuracy of the information on which the JATR team members
    based their observations, findings, and recommendations. After several
    iterations, the JATR submitted its final observations, findings, and
    compilation of team members' recommendations to the FAA on October 11,
    2019.
        The Recommendations. The JATR submitted recommendations in eleven
    areas involving the certification process, and one post-certification
    area. In order to encourage diversity of views from the team, the
    JATR's charter encouraged its members to provide recommendations
    irrespective of whether they reflected consensus. Consequently, the
    JATR did not check or measure consensus.
        The initial scope of the JATR process was limited to the
    certification process itself, but the charter enabled the co-chairs, in
    their discretion, to expand the scope if warranted. Hence, one
    recommendation area pertains to post-certification activities because
    of its potential to help improve the safety of future certification
    processes.
        In no particular order of priority, the eleven recommendation areas
    regarding the certification process are:

       1.  Changed Product Rule

       2.  Development and use of up-to-date requirements and practices

       3.  Consistent interpretation and application of requirements

       4.  Changes during the certification process

       5.  Delegation of certification authority

       6.  Holistic, integrated aircraft-level approach

       7.  Human factors

       8.  Development assurance

       9.  Impact of product design changes on certification

      10.  Impact of product design changes on flightcrew training

      11.  Impact of product design changes on maintenance training

        The post-certification recommendation area is:

      12.  Post-certification corrective actions and data sharing

        Some of the recommendations are very broad in their application and
    others are more specific.
        Broad Recommendations. Some of the broader recommendations derive
    from the increasing complexity of aircraft systems, particularly
    automated systems and the interaction and interrelationship between
    systems. As aircraft systems become more complex, ensuring that the
    certification process adequately addresses potential operational and
    safety ramifications for the entire aircraft that may be caused by the
    failure or inappropriate operation of any system on the aircraft
    becomes not only more important, but also more difficult.
        Other broader recommendations raise the foundational issue of
    whether a process that has historically served the industry well for
    decades based largely upon compliance needs to be revisited to address
    not only compliance but also safety. As systems become more complex and
    may interact in unforeseeable ways, the likelihood increases that
    regulations and standards will not address every conceivable scenario.
    To the extent they do not address every scenario, compliance with every
    applicable regulation and standard does not necessarily ensure safety.
        Moreover, as systems become more complex, the certification process
    should ensure that aircraft incorporate fail-safe design principles
    that prioritize the elimination or mitigation of hazards through
    design, minimizing reliance on pilot action as primary means of risk
    mitigation.
        Specific Recommendations. Some form of delegation will probably
    become increasingly necessary as the FAA and aviation regulators
    worldwide encounter increasing difficulty hiring and retaining leading
    technologists in rapidly advancing technologies. Thus, although the
    recommendations do not address the desirability of delegation in
    general or of the ODA concept in particular, they do recommend
    examining how to make the ODA process less cumbersome and bureaucratic
    to avoid stifling adequate communications in future certification
    processes about important characteristics of what is being
    certificated.
        Query, for example, whether inadequate communications were partly
    responsible for the failure to address potential unintended
    consequences from the evolution of the Maneuvering Characteristics
    Augmentation System (MCAS) from a relatively benign system to a much
    more aggressive system; and query whether inadequate communications
    played a role in the failure to address potential unintended
    consequences that can result from designing software for one scenario--
    in this case, high-speed windup turns--and then modifying the software
    for a different scenario--in this case reducing the pitch-up tendency
    at higher angles of attack at low speeds.
        Other specific recommendations relate to revisiting the FAA's
    standards regarding the time needed by pilots to identify and respond
    to problems. Although existing standards have served the industry well
    for decades, the JATR members recommended an examination of whether
    those standards remain appropriate for the complex integrated systems
    in today's airplanes. For example, when the failure or inappropriate
    operation of a system results in cascading failures and multiple
    alarms, query how adequately the certification process considers the
    impact of multiple alarms, along with possible startle effect, on the
    ability of pilots to respond appropriately. Inherent in this issue is
    the adequacy of training to help pilots be able to respond effectively
    to failures that they may never have encountered before, not even in
    training.
        The Future Training Challenge. The closer automation comes to
    completely removing the human, the more daunting are the challenges of
    becoming more automated. One of those challenges was highlighted by
    these two MAX crashes. These crashes were the latest of several crashes
    in the previous decade in which pilots encountered scenarios that they
    had never seen before, even in training, and responded inappropriately.
        The increasing complexity and reliability of automation will
    exacerbate the international aviation community's challenge of training
    pilots to respond to problems that they have never seen before.
    Increasing complexity will exacerbate the training challenge because it
    will reduce the likelihood that pilots will fully understand the
    system's capabilities and what it does and does not do. Increasing
    reliability is obviously good, but an unintended consequence is that it
    will exacerbate the training challenge because it increases the
    difficulty of forecasting what types of failures might occur, which in
    turn decreases the likelihood of including the most important potential
    failure modes in training.
        This issue is not within the scope of the JATR's charter because it
    is not a certification issue, but it has been brought to light by the
    JATR's activities. Hopefully the international aviation community will
    follow the collaboration example reflected by the JATR and work
    together to address this training challenge.
        Conclusion. The JATR members hope that their recommendations will
    continue improving aviation safety by helping to improve the
    certification process.

        The Chairman. Thank you, gentlemen. Is the work complete
    regarding the MAX for either of your organizations? Mr.
    Sumwalt?
        Mr. Sumwalt. Mr. Chairman, thank you for that question. We
    are continuing to go through scores and scores of design
    certification documents. If we need to make additional
    recommendations, we certainly will. So, to answer your
    question, our work is not completed.
        The Chairman. And Mr. Hart?
        Mr. Hart. Our work is completed because we were chartered
    to review the situation and give recommendations to the FAA. We
    did that on October 11. That completed our work and thank you
    for asking.
        The Chairman. So this particular JATR, Joint Authorities
    Technical Review, is over and disbanded?
        Mr. Hart. That is correct.
        The Chairman. Alright. Let's talk about the time between
    the first crash and the second crash. It was evident after the
    Lion crash, that the MCAS system was not working correctly. Is
    that true, Mr. Sumwalt?
        Mr. Sumwalt. Yes, sir. That is correct.
        The Chairman. And Mr. Hart, there were many factors
    involved, but the dysfunction of the MCAS was central?
        Mr. Hart. That is correct.
        The Chairman. OK. And at that point, what notice was sent
    out to other airlines and to the pilots to make it clear that
    the MCAS was the main problem?
        Mr. Sumwalt. Mr. Chairman, as you are aware today is the 1-
    year anniversary of Lion Air. So, on October 29 was the crash.
    I believe it was October, or correction November the 7th when
    the FAA put out an airworthiness directive to require certain
    procedural modifications.
        The Chairman. Was that a typical airworthiness directive or
    was it highlighted as an emergency airworthiness directive?
        Mr. Sumwalt. I am not sure. Chris, do you know?
        Mr. Hart. Airworthiness directives pretty much by
    definition are considered an emergency. So I think this one was
    definitely one that is supposed to command the attention of the
    entire industry.
        The Chairman. OK, Mr. Sumwalt is consulting with staff and
    it is fine if he supplements his answer, but this was a red
    flag sent out about the MAX and the MCAS part of it. Is that
    correct? Would either of you gentlemen quarrel that this was a
    red flag warning?
        Mr. Hart. It was an industry-wide warning that everybody
    who flies this airplane needs to know about, and so to that
    extent, yes.
        The Chairman. OK. Well, is there a way that we could have
    made it more explicit? Was there something about this advisory
    that didn't get the job done, Mr. Hart?
        Mr. Hart. I am sorry, but I cannot speak for the FAA and
    their decision process on how to handle this. The decision
    process to have the airworthiness directives within days of the
    second crash was intentional to get the word out as quickly as
    possible. But I was not privy to the decisionmaking process.
        The Chairman. No, but I am referring to the way it would
    typically have been received internationally and in the
    aviation industry. This would have been taken seriously and
    been given a heightened bit of attention, is that correct?
        Mr. Hart. That certainly is the purpose of an airworthiness
    directive, yes. How people responded to it, I do not have a
    good answer to that.
        The Chairman. OK. Now did I hear you say, Mr. Hart, that
    some pilots reacted in one way which was sufficient, and some
    pilots did not for whatever reasons? If you could elaborate on
    what you were telling the Committee.
        Mr. Hart. Yes, thank you for that question. I was referring
    specifically to the fact that before the Lion Air crash, the
    day before that crash, that same problem was encountered, and
    the pilots responded to it appropriately.
        The Chairman. Well, do you think that there was a failure
    at Lion Air to notify the other crews that a problem had
    occurred, it was resolved in this fashion, and we need to be
    mindful of that? Do you know if that was communicated between
    the flight that did land safely and the one the next day?
        Mr. Hart. Thank you for the question. Unfortunately, I do
    not know the details of who told what to whom, whether it was
    the mechanics, or the other pilots. I do not know the details
    of how that information about what happened the day before was
    transmitted to the to the subsequent pilots and subsequent
    mechanics.
        The Chairman. Mr. Sumwalt, do you want to clarify anything
    that you have said based on some advice that you have been
    getting?
        Mr. Sumwalt. Well, in fact, it was an emergency
    airworthiness directive that was issued by the FAA as Mr. Hart
    has indicated.
        The Chairman. That is a term of art, an ``emergency
    airworthiness directive?''
        Mr. Sumwalt. That is correct. And that means that it does
    not allow for public comment. Oftentimes for normal
    airworthiness directive the FAA has to put it out for public
    comment unless it is an emergency airworthiness directive.
        The Chairman. Is it fair for me to characterize that as a
    red flag?
        Mr. Sumwalt. Well as Chris Hart indicated, it does indicate
    that there was something that needed immediate awareness within
    the aviation community.
        The Chairman. Senator Cantwell.
        Senator Cantwell. Thank you, Mr. Chairman, and I thank the
    second panel for being here. Wish there was many people
    listening to this panel as the first because this is the hard
    work that we have to do in getting this right and moving
    forward. And I so much appreciate, Mr. Sumwalt, NTSB's
    recommendations and Mr. Hart, your committee's recommendations.
        My colleagues and I, Senator Duckworth, Senator Blumenthal
    have already introduced legislation on the NTSB and other
    recommendations last week, and hopefully we will be able to
    move forward on those. You heard the discussion. I believe we
    are here for this issue about what happened in the cockpit and
    the level of distraction, which I think is the point, Mr.
    Sumwalt. At least two of the recommendations that we put in our
    legislation, that is your recommendation, that the FAA direct
    Boeing to have clearer corrective actions from uncommanded
    systems and that there be some sort of resolution that they
    have had in other planes to the cockpit situation so that we
    are not bombarding pilots. Also that they develop the same kind
    of assessment.
        Now when I read the circulars, and I have read many, it is
    pretty clear to me that, you know, this already should have
    been done. I mean, it is pretty clear that you have talked
    about the effectiveness--when you submit a plan for a plane you
    have to submit this alert plan. So we will see, we will find
    out at some point what alert plan was submitted and what was
    reviewed.
        But it is very clear that you have to have, you know, this
    effectiveness intended for human and machine integration, you
    know, people understanding the alerts, compatibility with other
    displays and warnings, ensuring that the system is telling the
    pilots what to do. So listen, I appreciate your recommendations
    and we are going to get them into law, trust me. The question
    becomes, what are we doing on top of something that isn't
    already clear here.
        What is it that actually we are doing and helping people
    understand. What is it we are doing here to make this system
    safer? And the reason I ask this is because as I said in my
    opening statement, I actually believe this is the issue de
    jure. I think it is for automobile safety moving forward on
    more AVs and on airplanes. There is going to be more
    integration into the cockpit. So anytime you are taking over
    command of that plane with a response, we need to know, and we
    need to understand that functionality.
        So what are these alert system requirements that were
    asking the FAA to do both for the MAX and for all planes? What
    is that really giving us that we do not currently have now in
    the statute?
        Mr. Sumwalt. Thank you for the question, Senator Cantwell,
    and thank you for your leadership and your advocacy on this
    area. We issued these seven recommendations a month ago because
    we did identify holes in the design certification process. I
    would be glad to get into some of those holes in what those
    recommendations are, but I do not want to dominate your time. I
    defer to you.
        Senator Cantwell. Well, my question was, why do you think
    this is important because you actually do not think that the
    details are there?
        Mr. Sumwalt. That is correct--the long and the short of it,
    woven throughout each of the seven recommendations is that we
    found that when pilots are faced with multiple alerts, they are
    not performing or reacting in the way that Boeing thought that
    they would react when they developed their design assumptions.
        Senator Cantwell. And what about safety management systems
    for aerospace manufacturers? What about that recommendation?
        Mr. Sumwalt. The NTSB has found the benefits of safety
    management systems in many modes of transportation including
    aviation. We do not have specifically a recommendation for an
    SMS for the manufacturers. However, we do believe that when you
    are properly analyzing and assessing your risk, that is
    improving safety. So, personally, I think that would be a good
    idea for manufacturers to have a safety management system in
    place.
        Senator Cantwell. And what does that mean to most people
    who are trying to listen to this conversation post the one we
    just had? What does that actually mean that happens?
        Mr. Sumwalt. You know, I have always looked at safety
    management systems and I like the term safety management
    instead of safety management systems because it is an active
    thing. We want to manage safety the way that we would manage
    other vital business functions. So, there are generally thought
    to be four tenets of SMS, one of which is safety risk
    assessment where you are actively assessing your risk and
    managing those risk to an acceptable level. And so that is a
    key component of a safety management system.
        Senator Cantwell. Well this issue of risk management is
    critical and that is what I believe is that you have to say,
    what are the highest risks so you can focus on it. It is clear
    no one thought this change of a new system that took outside
    information, controlled the plane, gave it different commands
    with different alerts, that do different things, it wasn't
    tested.
        So we have to implement this. The FAA was given this, I do
    not know if it was a directive or nudge before, but then they
    pulled back on a rulemaking in 2014 on this system management.
    But you believe ICAO, others are recommending this is what we
    should go forward with because it creates this robust
    discussion constantly. Is that the right way to describe it?
        Mr. Sumwalt. As a safety practitioner, I agree with that
    and I do want to say again, the NTSB has not gone on the record
    to have a recommendation for that, but from a safety
    practitioners perspective, again when you are managing your
    risk, you are managing safety.
        Senator Cantwell. Thank you. Thank you. My time has passed.
        Senator Blumenthal.
        Senator Blumenthal. Thank you. Thank you, Senator Cantwell,
    and I want to express my appreciation to Senator Cantwell and
    Senator Duckworth for the legislation that we are working on
    together and additional legislation that we hope will be based
    on your reports and others. You know, I had a lot of questions
    for our previous witness, which unfortunately I didn't have
    time to ask.
        One of them would have been, why did he call the President
    of the United States, in effect circumventing the FAA if they
    were really going to respect safety? Are either of you aware of
    the call or calls that were made by Mr. Muilenburg to the
    President of the United States seeking to prevent grounding of
    these airplanes in the immediate aftermath of the second crash?
        Mr. Sumwalt. Senator Blumenthal, I am not aware of that. I
    sat in this hearing room in March when you asked Mr. Elwell the
    same questions. I am not aware of that. We were not involved in
    the decision to ground the aircraft in any form or fashion.
        Senator Blumenthal. Mr. Hart?
        Mr. Hart. It was not within the purview of the JATR either.
    We were looking into the certification process to decide how to
    make it better.
        Senator Blumenthal. The fact of the matter is that the
    United States of America was among the last nations to ground
    those airplanes, correct?
        Mr. Sumwalt. That is certainly my understanding. Us and
    Canada.
        Senator Blumenthal. And normally the United States of
    America would be at the forefront of safety, correct? Mr. Hart?
        Mr. Hart. Good question, Senator. Just for your awareness,
    I am on record through an op-ed in USA Today to congratulate
    the FAA for waiting until they had enough data to see was this
    a one-off event because if it was a one-off event, they would
    be grounding airplanes after every crash or was it more than a
    one-off in other words----
        Senator Blumenthal. In retrospect was it a good decision to
    ground that airplane?
        Mr. Hart.--after they had enough data to see the similarity
    of the two, yes.
        Senator Blumenthal. But the United States was the last to
    have enough data for whatever the reason?
        Mr. Hart. Yes.
        Senator Blumenthal. Just saying, right?
        Mr. Hart. Well, everybody had the same data about the same
    time. I just think the U.S., the FAA has a reputation for
    waiting until it has the data to react.
        Senator Blumenthal. Let me ask you, your report found that,
    ``key aspects of the MCAS function such as intended function
    description, its interfaces, and architecture were not directly
    visible to the FAA in a straightforward manner through the
    certification deliverable documents.'' I am trying to put that
    in simple English that you would use in the USA Today article.
    They didn't do full disclosure to the FAA, correct?
        Mr. Hart. In simple language, the process certainly--the
    process was complicated enough and challenging enough and
    bureaucratic enough that the communication was stifled. And so
    the communication didn't get where it needed to be when it
    needed to be there.
        Senator Blumenthal. OK. I think that answers my question.
    And that was something we should correct, correct?
        Mr. Hart. That is something that the JATR has recommended
    correcting, and yes, it does need correcting.
        Senator Blumenthal. The Wall Street Journal recently
    reported that internal Boeing surveys revealed that about 30
    percent of its employees felt potential undue pressure from
    managers regarding safety related approval. In fact, one of the
    Boeing engineers, Curtis Ewbank filed a complaint that
    asserted, ``Boeing management was more concerned with cost and
    schedule than safety or quality.'' Did your investigative work
    indicate that kind of undue pressure from Boeing on its
    employees to move the safety process at the expense of--I am
    sorry move the certification process at the expense of safety?
        Mr. Hart. Thank you for your question. Our investigation,
    our review found enough concern about undue influence that we
    recommended that it be reviewed carefully for the next time,
    the next certification process.
        Senator Blumenthal. You indicate, I think, in your
    testimony that you thought delegation would continue, which
    seems contrary to what we have found here so far that a lot of
    the thrust of the questioning has been to reverse delegation.
    So, I hope that maybe we can have your further thoughts on that
    issue. Let me just ask one more question.
        Mr. Sumwalt, on Sunday, just this past Sunday, the New York
    Times reported on Boeing's efforts to undercut regulatory
    oversight early and often. The story of Boeing sabotaging
    rigorous safety scrutiny is chilling to all of us and more
    reason to keep the 737 MAX grounded until certification is
    really and truly independent and the system is reformed.
        What are your views on the amount of delegation authority
    from the FAA to Boeing? Shouldn't we reverse the delegation
    that exist right now?
        Mr. Sumwalt. Senator Blumenthal, thank you for that
    question. The NTSB's role in all of this is to serve as an
    accredited representative to each of the respective accident
    investigations. As such, we looked at the design certification
    processes of the 737 MAX and we issued the seven
    recommendations. We have not looked at the ODA process. That is
    not something that we have done.
        Senator Blumenthal. Why?
        Mr. Sumwalt. Well because there are approximately 79
    organizations that have ODA approval. We have got about two
    people that have the expertise to dwell into the design
    certification issues. We have devoted those energies to come up
    with these seven recommendations that we issued 1 month ago.
    That is an enormous task. I am under the impression that the
    U.S. DOT IG is doing a study of this issue.
        The Chairman. As are numerous other entities. Thank you.
        Senator Duckworth.
        Senator Duckworth. Thank you, Mr. Chairman. Chairman
    Sumwalt, welcome. At the March 2019 hearing held by this
    committee's Aviation subcommittee, Chairman Wicker asked you a
    simple question concerning Lion Air flight 610, and I
    quote``what should the pilots have done,'' and you responded as
    follows, and I quote ``well, I flew the 737 for 10 years and I
    do believe that there is a procedure at least for the
    Flintstone version of the 737. I flew a very old 737, but I do
    believe that the very first thing you would do is oppose that
    motion by pulling the yoke back and that would engage the stab
    break or the stabilizer cutout function.'' And to me this
    answer makes sense. The most reliable initial human response to
    an uncommanded nose down dive is to pull back on the yoke.
    Would you concur with this view?
        Mr. Sumwalt. Yes, I do. I have actually looked at the
    procedure and it says to grasp and to hold it firmly but as you
    know as an experienced pilot, your natural reaction would in
    fact if it is going in a direction you do not intend it to, you
    would tend to oppose it, which you should. In the older models
    of the Boeing aircraft that I flew, the 727 and 737, that would
    engage the stabilizer brake and stop the stab from running. But
    as you pointed out in the earlier round, it will not do that
    when MCAS is active on the 737 MAX.
        Senator Duckworth. Right. So that is what I would like to
    add to your response is the critical importance of the column
    cutout function, whether aft or forward, is that it is not just
    limited to the very old 737, but, in fact, according to a
    former Boeing engineer who was responsible for the control law
    development, in the 757, 767, and the 747-400. In every Boeing
    airplane until the 737 MAX, uncommanded stabilizer runaway is
    stopped by column motion only. You don't have to do another
    step. Once you pull back and you have overridden it, that's it.
        There is nothing that resets and then pushes the nose back
    down 5 seconds later. There is nothing else you have to do.
    That is it in every other model of Boeing aircraft of 737s. But
    for the MAX with the MCAS malfunction, the pilot has to also
    apply the manual electric trim within the same 3 second window,
    otherwise the MCAS, which the pilots did not know was installed
    in the aircraft, could reset and put the nose back down. So now
    you are telling pilots, OK, natural reaction, you have pulled
    back, you have overridden it, you think that is it.
        But now you have to troubleshoot for a system that you do
    not know exist that is now overriding your pilot's command
    input and pulling back the yoke. Mr. Sumwalt, are you aware of
    Boeing notifying commercial 737 pilots before the Lion Air
    crash that when MCAS activates during manual flight it disables
    the aft column cutout safety function? That is, it overrides
    that safety function?
        Mr. Sumwalt. Senator Duckworth, I am under the impression
    that just as you said that prior to these two tragic crashes
    that information was not widely known within the piloting
    community.
        Senator Duckworth. Thank you. Mr. Sumwalt, the MCAS
    malfunction should have been elevated to a hazardous rating, in
    my opinion, because the aft column cutout was removed and
    worsened by tripling the stab trim rate, which made severe
    mistrim likely, especially with a persistent malfunction. Had
    Boeing done this, instead of rating it as a ``Major'' hazard,
    we would not be where we are today. Would you agree with that?
    It changes how they report to the FAA. Am I correct?
        Mr. Sumwalt. Yes, and that hazard category of major, as I
    understand it, only required there to be one angle of attack
    sensor. If it was at a higher hazard category, it would have
    required the input from two.
        Senator Duckworth. Thank you. Mr. Chairman, I would like to
    enter Peter Lemme's ``Flawed Assumptions Pave a Path to
    Disaster'' into the hearing record.
        The Chairman. Without objection.
        [The information referred to follows:]

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Senator Duckworth. Thank you. Mr. Sumwalt, can you talk
    about the accident chain, the concept of these decisions that
    pile up and leads up to those Lion Air pilots, for example,
    fighting to save that aircraft and how these decisions add up?
        Mr. Sumwalt. Yes. As you know Senator Duckworth, the NTSB
    was an accredited representative to the Lion Air investigation
    as well as the Ethiopian accident investigation. We
    participated closely with both of them. But since the Lion Air
    is wrapped up, we have worked closely with the Indonesian
    authorities. We commented on their report. We feel that their
    report, the Indonesian report, the KNKT report is comprehensive
    and we are satisfied with that report. So, I think that report
    outlines the chain of events was not just one factor, there
    were several issues that led to that crash.
        Senator Duckworth. Thank you. I yield back.
        The Chairman. Thank you, Senator, Duckworth.
        Senator Cruz.
        Senator Cruz. Thank you, Mr. Chairman. Chairman Sumwalt,
    the NTSB report that you mentioned in your testimony stated
    that the NTSB is, ``concerned that the accident pilot responses
    to the unintended MCAS operation were not consistent with the
    underlying assumptions about pilot recognition and response
    that Boeing used based on FAA guidance for flight control
    system functional hazard assessments, including for MCAS as
    part of the 737 MAX design.'' Why do you think it was that
    Boeing made the wrong assumptions?
        Mr. Sumwalt. Senator Cruz, thank you for that question. And
    what we do know is that to simulate the MCAS or to assess the
    level of hazard, the less level of risk associated with that,
    they put Boeing pilots, test pilots, in the engineering
    simulator. And while they were flying, all of a sudden, the
    trim started moving. They wanted to see how a pilot would have
    reacted.
        And if they reacted the way that Boeing expected them to
    do, then they said OK, well the pilot will immediately
    recognize this problem. They will notice because the nose is
    starting to pitch down, they will notice because it has
    increased pressure on the control wheel, and one other thing--
    and the stab trim wheel was moving. That is all correct. But
    what Boeing failed to account for in their assumptions was to
    consider that the MCAS could have failed because of another
    reason.
        The MCAS could have activated because of a failure of the
    angle of attack which would have led to numerous other alerts
    and warnings in the cockpit. So, with a failed angle of attack
    sensor, they would have had a low air speed indication on their
    primary flight display. They would have gotten a stick shaker
    or stall warning which is rattling the stick and making a lot
    of noise. They would have gotten an oral warning that says
    ``air speed low, air speed low.'' They would have had various
    lights in the cockpit.
        So, the long and the short of it is that Boeing only
    evaluated pilots performance with the stab trim itself moving.
    They did not simulate or replicate how multiple failures could
    affect a pilot's performance.
        Senator Cruz. And why did the FAA processes not catch these
    failed assumptions?
        Mr. Sumwalt. Well, that is a great question, Senator. And I
    am not sure that I know the answer to that. But that is why we
    have issued these seven recommendations, is so that these
    design assumptions can be more realistic. We found in three
    incidences in the two accident flights plus the Lion Air flight
    prior to the accident flight, we have seen three cases where
    the pilots did not perform in accordance with the assumptions
    that Boeing used.
        Senator Cruz. And is a bird strike a scenario that
    engineers designing a plane should anticipate and the
    regulators focusing on a plane should anticipate?
        Mr. Sumwalt. I believe so and I believe they do in certain
    areas. I am not sure how it might apply to this. As you know,
    there is conjecture that perhaps a bird might have taken out
    the AOA sensor on the Ethiopian aircraft. I do not know if that
    is a part of the total risk assessment for the 737 MAX as it
    relates to MCAS.
        Senator Cruz. Is there any indication either Boeing or the
    FAA considered the possibility that a bird strike would share
    off the angle of attack sensor?
        Mr. Sumwalt. I do not know but I can certainly look into
    that and get back with you if you like.
        Senator Cruz. I would appreciate that very much. Mr. Hart,
    one of the key findings of the Joint Technical Review Committee
    report is that the FAA's visibility into important system
    safety information was, ``incomplete and fragmented.'' JATR
    then went on to say, if the FAA had been more involved in the
    certification of the MCAS, this, ``would likely have resulted
    in design changes that would have improved safety.'' Based on
    the JATR's findings, why would the FAA accept incomplete and
    fragmented safety information from Boeing and what can be done
    to fix that?
        Mr. Hart. Thank you for the question. That is the purpose
    of the recommendation that the communication process that the
    ODA be less bureaucratic and less complicated, so the
    communication process isn't undermined by the complexity of
    that situation. So the FAA was not adequately aware of the
    evolution of the MCAS from a relatively weak system to a much
    more robust system.
        The FAA wasn't aware of the details of how adequately the
    transformation of the MCAS from a high-speed wind up turn
    correction to a low speed angle of attack correction and were
    the assumptions properly considered in that process. The
    communications to the FAA were not adequate for it to be fully
    aware of the impact of those issues.
        Senator Cruz. Thank you.
        The Chairman. Thank you, Senator Cruz.
        Senator Blumenthal.
        Senator Blumenthal. I have just one question and you may
    consider it outside of your expertise, but the CEO of Boeing
    told us today that they made mistakes and regretted them and
    wanted to take action in response to do the right thing for the
    families who were affected, the loved ones of the victims.
        Boeing has said that it will take responsibility
    specifically for the Lion Air crash resulting in the deaths of
    189 people in Indonesia last year and the Ethiopian Airlines
    crash that killed 157 people. But it has filed court documents
    for the Lion's aircraft indicating that it will move to change
    the venue of the case to Indonesia where the plane was
    maintained if settlement talks fail. The case was filed in the
    Northern district of Illinois where Boeing is headquartered, as
    you know.
        Resolving these claims in Indonesia seems a lot less likely
    to provide justice to those families. There is no Seventh
    Amendment right to a jury trial there. There is no requirement
    of discovery. There is no rule allowing for depositions. Would
    you agree with me that equity, fairness, justice would argue in
    favor of keeping these cases in the United States?
        Mr. Sumwalt. My friend, Chris Hart, is a Harvard-educated
    lawyer.
        Senator Blumenthal. He is a Harvard Law School graduate and
    practicing lawyer in addition to being a pilot so if you want
    to defer to him, that is fine.
        Mr. Sumwalt. Absolutely.
        Mr. Hart. Thank you for the question. I am a Harvard-
    trained attorney but I do not know anything about the
    litigation strategy to be able to comment on what they want to
    do regarding litigation. That is way outside of my lane. JATR
    did not consider it and I am not really--I do not consider
    myself competent enough to speak to that issue.
        Senator Blumenthal. Well in general, wouldn't you consider
    this court to the United States to be a better place to do
    justice for American families than the courts of Indonesia?
        Mr. Hart. I thank you for the question, but I am not enough
    of a litigator to be able to give you a competent answer.
        Senator Blumenthal. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Blumenthal. We are going
    to close this hearing now.
        Senator Cantwell. Can I just ask one more thing?
        The Chairman. Sure. Senator Cantwell.
        Senator Cantwell. Thank you, Mr. Chairman for a second
    round. I just wanted to clarify, Mr. Hart, I think I heard
    earlier from the testimony from the company that they actually
    do think that the FAA knew about the level of trim. I think
    this is going to be a big issue. I think we are going to hear a
    lot more about this, but you would hope that a plan at the very
    beginning of certification would include that data then they
    would make the decisions, but I am concerned that the level of
    automation and technology and human response.
        I want to see the best engineers. I think when the
    automobile industry and Toyota went through this and we didn't
    know what happened, we basically called NASA and said would you
    look at this code and figure out what happened? OK. I do not
    want to call NASA to look at software code. I want the FAA to
    be the best technology engineers in understanding problems with
    software, problems with automation, and challenges with human
    response. That is why part of our legislation is that center of
    excellence for the FAA.
        Just by the way, I have done two other center of
    excellences, one on composite manufacturing because the FAA
    didn't know enough about composite to know how to certify the
    plane, and one on biofuels for jets because they also do not
    know how to certify fuel sources for planes if they do not
    understand jet fuel themselves. So I am a believer that we give
    the FAA the extra resources and tools so they can stay ahead or
    at least, you know, know the right parameters of debate.
        But isn't the right parameter of debate have to focus on
    this human technology interface today? Isn't that where we are?
    Because we saw those 10 years of making us safer, and yet this
    level of integration has also told us that 5 of the last
    accidents were all around this. And I think, you know, for me
    and many Americans are waking up wondering what is a pitot tube
    and, you know, an AOA sensor on the outside of the plane giving
    commands and responses to inside the cockpit without the pilots
    understanding.
        So I just feel that the FAA, and we have had this
    discussion with Captain Sullenberger, needs to understand human
    response to these automation systems. What do you say about
    that recommendation of a center of excellence, Mr. Hart or Mr.
    Sumwalt?
        Mr. Hart. Thank you for the question. It also gives you an
    opportunity to respond to Senator Blumenthal raising the same
    issue. And that is, I think that as first of all the type of
    problem we are going to see with airplane safety in the future
    in my view is not going to be things falling off the airplane
    like the DC-10 engines. It is going to be the pilot/airplane
    interaction issue.
        So the human factors piece is crucial and that is why I am
    totally on board with the human factors recommendations that
    the NTSB made. There are two problems. One is the reference to
    multiple things going wrong at the same time. I would add to
    that, it is not just multiple things going wrong, it is also
    never having seen it before even in training. That is really
    the challenge. It is when they are seeing this for the first
    time in real time, as in a series of accidents where this has
    happened, and it has been unsuccessful.
        The one exception to that was Sully when he had a kind of
    situation that he had never seen before, even in training, and
    he handled it masterfully.
        Senator Cantwell. And that--listen I think I have consulted
    him a lot about this but that is why he came to us after the
    Colgan Air and said do not change the regulations on the
    copilot for regional aircraft because you do not have enough
    time. You do not have enough time to talk. So I think if you
    are going to develop a system for certification and give it to
    the FAA, I think the FAA has to know the parameters of human
    response and what pilots are capable of, we just need a lot
    more data.
        If this is the route we are going to keep going on
    innovation, then we just need to know a lot more about what is
    that factor. I think even, I do not want to speak for him, but
    I think his perception is that that is where you have to start
    because you do not have any way to judge a system if you do not
    really understand what the human limitation is.
        Mr. Hart. And that goes to my point that the leading
    technologists in these rapidly advancing and innovative
    technologies, the leading technologists are not going to be
    with the regulator. That is why this is not an FAA problem,
    this is an international certification problem, because the
    regulators are not able to hire and retain the leading
    technologists in these rapidly advancing technologies. They are
    going to be with the companies.
        Senator Cantwell. But I want the FAA to have enough data,
    information, and understanding to ask the right questions.
    Because if they are not asking the right questions because they
    do not understand the technological impact, we are going to
    have a problem. OK, so we have to make sure they understand the
    R&D and at least the parameters, whether that is composites,
    biofuels, or cockpit automation.
        Mr. Hart. That is precisely why adequate information is so
    crucial. Straight to your point.
        Senator Cantwell. Yes.
        Mr. Hart. Thank you for making that point.
        Senator Cantwell. Thank you, Mr. Chairman.
        The Chairman. Senator Blumenthal.
        Senator Blumenthal. Just one quick question. If the FAA
    were able to pay enough to offer career opportunities would
    that affect your judgment that they cannot hire the leading
    technologist as you put it?
        Mr. Hart. I cannot speak to the totality of the
    circumstances why the regulators do not have those people but
    that is probably part of it, yes.
        Senator Blumenthal. Well, I am just really discouraged and
    frankly somewhat skeptical about your view that the FAA should
    be sort of doomed to failure and has to outsource safety.
        Mr. Hart. I do not mean to suggest they are doomed to
    failure. I am suggesting that is why I think the collaborative
    process of the delegation will continue because there is no way
    that in my view, in the way that things are currently situated,
    the FAA is going to have the expertise within house to do it
    without the collaboration.
        Senator Blumenthal. Well, putting aside the word
    collaboration, I hope we can prove you wrong by in fact
    incentivizing both financially and otherwise people with those
    skills to go to work for the FAA because that is where the
    disinterested and independent safety function belongs. If you
    outsource safety, that is doomed to failure.
        Mr. Hart. I certainly agree with you. That would be ideal.
    Yes, Senator Blumenthal.
        Senator Blumenthal. Thank you.
        The Chairman. Well, thank you very much. And thanks to the
    members of the Committee who have participated throughout. I
    have to say, this has been one of the most difficult hearings I
    have ever participated in, and I know it has been difficult for
    the family members who are still with us in the room. Some of
    them had to leave. Let me reiterate what I said at the outset,
    that this Committee, under my leadership and Senator Cantwell's
    leadership, is working to obtain as full of an answer as
    possible. We owe it to the public and we owe it to the families
    and to the victims. You have my assurance that we are not
    finished with the work.
        That said, the hearing record will remain open for two
    weeks. During this time, Senators are asked to submit any
    questions for the record. Upon receipt, all witnesses are
    requested to submit their written answers to the Committee as
    soon as possible. I thank the witnesses for appearing today,
    and the hearing is now adjourned.
        [Whereupon, at 1:16 p.m., the hearing was adjourned.]

                                A P P E N D I X

        Response to Written Questions Submitted by Hon. Roger Wicker to
                               Dennis Muilenburg
        Question 1. Mr. Muilenburg, the Maneuvering Characteristics
    Augmentation System (MCAS) has been described as an anti-stall system
    that Boeing installed on the Boeing 737 MAX to address pitch stability
    concerns caused by the use of larger engines on the aircraft than
    earlier versions of the 737. However, it has also been said that MCAS
    was added to the 737 MAX so that it handled similarly to the 737 NG
    from a pilot's perspective.
        What was the original purpose of MCAS? What would have been the
    risks associated with the 737 MAX had MCAS not been added as a flight
    control law?
        Answer. In 2009, Boeing began to explore a possible re-engining of
    the 737 NG series airplane to improve noise pollution and fuel
    efficiency. In approximately 2010, early in the development process,
    testing and analysis showed that the contemplated design changes
    affected the airplane's handling characteristics in certain high-speed,
    high angle of attack conditions involving a rarely encountered maneuver
    known as a wind-up turn. Although most commercial pilots go their
    entire career without making such a turn in commercial flight,
    certification requirements exist for handling characteristics in these
    scenarios.
        If MCAS had not been added as a flight control law to the 737 MAX,
    a different solution would have been necessary to achieve the required
    handling characteristics. Boeing personnel, including engineers and
    pilots from multiple disciplines, considered a number of alternatives
    for improving the airplane's handling qualities in these unusual
    scenarios, including physical changes to the airplane. Ultimately,
    Boeing determined that the addition of MCAS, coupled with the
    implementation of a modified outboard wing vortex generator pattern,
    represented an appropriate solution for addressing the handling
    qualities issue. This approach in designing MCAS allowed for a
    straightforward expansion of the pre-existing Speed Trim function, as
    an integrated part of an existing flight control system. The
    incorporation of MCAS allowed Boeing to safely satisfy certification
    requirements for handling characteristics while staying within the
    framework of the existing airplane architecture, consistent with a
    fundamental airplane design principle of minimizing unnecessary
    complexity. Boeing implemented the initial MCAS requirements in early
    2012, although evaluation of the function continued afterwards, and the
    technical team recognized that further refinement of the design would
    likely be necessary going forward. The incorporation of MCAS was
    validated through rigorous testing and analysis, including piloted
    simulator sessions, wind tunnel tests, and a variety of engineering
    analytical techniques.

        Question 2. During the hearing you were asked about two sets of
    documents involving former Boeing employee Mark Forkner: (1) a November
    16, 2016 instant message between Mr. Forkner and a Boeing colleague,
    and (2) e-mails between Mr. Forkner and someone at the FAA in which Mr.
    Forkner used the phrase ``jedi mind tricking.'' Please clarify when Mr.
    Muilenburg learned of each.
        Answer. As to the instant message exchange involving former Boeing
    employee Mark Forkner: while Mr. Muilenburg does not recall seeing the
    document itself until it became public a few weeks before the hearing,
    he was made aware of the document in a briefing earlier this year,
    including the fact that the message contained a reference by Mr.
    Forkner to having unknowingly lied to regulators. Since the document
    became public, Mr. Muilenburg has had the opportunity to review the
    entire exchange and become familiar with all of its details. With
    respect to the other e-mails from Mr. Forkner that were referenced by
    Chairman Wicker in his question, Mr. Muilenburg was not aware of those
    e-mails until he read about them in the media in the weeks prior to the
    hearing.

        Question 3. Please describe the steps Boeing took after it learned
    that the AOA DISAGREE alert on the MAX was not operable on all
    airplanes.
        Answer. In August 2017, several months after the software delivery
    and the commencement of MAX deliveries, Boeing engineers identified
    that the display system software delivered to Boeing by a supplier
    incorrectly linked the AOA DISAGREE alert to an optional AOA indicator,
    after internal testing revealed that the alert was not working as
    expected.
        Immediately upon identifying the discrepancy between the
    requirements and the software, Boeing initiated its standard process
    for determining the appropriate resolution of such discrepancies.
    Boeing quickly initiated a ``problem report''--the name for the
    standard process--and assigned it to the supplier to verify Boeing's
    assessment. The supplier conducted testing and confirmed the issue
    Boeing had identified.
        Under Boeing's procedures, any inconsistency between the airplane
    requirements and the product delivered by a supplier must be
    immediately resolved if it renders the airplane unsafe. Deferring the
    solution to a later date is appropriate only if Boeing's experts can
    determine that the airplane remains safe, it remains certifiable, and
    there is no adverse operational impact. Here, to decide the appropriate
    disposition of the AOA DISAGREE alert issue, Boeing conducted a
    rigorous review that involved multiple company subject matter experts,
    including systems engineers, pilots, and crew operations specialists.
    This review determined that the absence of the AOA DISAGREE alert did
    not adversely impact airplane safety, certification, or operations, and
    therefore correction of the issue appropriately could be deferred until
    the next routine software update. The responsible authorized
    representative, who exercises authority delegated by the FAA, concurred
    with this recommendation for deferral.
        Boeing's review identified three main factors supporting the
    conclusion that deferral was permissible. First, no airplane or system
    safety assessment takes credit for the activation of the AOA DISAGREE
    alert as part of the analysis-accordingly, the absence of the alert did
    not alter the analysis in these assessments demonstrating that the
    airplane is safe. Second, based on consultations with pilots, the team
    determined that the same conditions that would activate the AOA
    DISAGREE alert would also likely cause unreliable airspeed information,
    and thereby trigger the indicated airspeed (IAS) DISAGREE alert. Thus,
    even without the AOA DISAGREE alert, the IAS DISAGREE alert would
    remain available to prompt pilot action in response to the expected
    effects of erroneous AOA data. Third, the team noted that other
    maintenance indicators on the airplane would detect a damaged AOA vane
    that remains faulty for two consecutive flights. Thus, a damaged vane
    would likely persist for only a limited amount of time before prompting
    maintenance action, even in the absence of the AOA DISAGREE alert.
        Based on these considerations, the review concluded that the
    existing functionality was acceptable until the next planned display
    system software update, when the alert and the indicator could be
    delinked, and the AOA DISAGREE alert made standard per the
    requirements. That update was scheduled for 2020, when the Dash-10
    variant of the MAX was expected to enter into service. Boeing recorded
    this disposition in its certification summary documentation for the MAX
    dated September 2017.
        Boeing personnel discussed notifying 737 MAX operators about the
    deferral decision. Boeing pilots and other technical experts considered
    issuing an Operations Manual Bulletin (``OMB'') on the issue. After
    internal discussion, it was determined that an OMB was not the
    appropriate vehicle for notification because the linkage of the AOA
    DISAGREE alert to the AOA indicator did not present a safety of flight
    issue, and because there was no specific crew guidance to be provided
    for dealing with the absence of the alert. Boeing personnel prepared a
    Fleet Team Digest on the issue, but ultimately it was not issued.
        When the MAX returns to service, all MAX airplanes will have an
    activated and operable AOA DISAGREE alert as a stand-alone, standard
    feature.

        Question 4. How many certification plans for the MAX did the FAA
    delegate to Boeing and how many did the FAA retain?
        Answer. The FAA initially accepted the Master Certification Plan
    for the 737-8 in November 2013, and it accepted the Detailed
    Certification Plans in August 2015. When the Master Certification Plan
    was initially accepted by the FAA, approximately 28 percent of the
    detailed Certification Plans were delegated. As the FAA reviewed the
    certification deliverables, those deliverables evolved. The number of
    delegated tasks increased as a result. However, even for certifications
    that are delegated, all testing and reviews that Boeing conducts to
    demonstrate compliance with applicable standards and requirements are
    subject to FAA oversight.

        Question 5. Please describe the changes Boeing has made since the
    Lion Air accident to the MAX Flight Control Computer software beyond
    updates to MCAS, and the considerations that led to those changes?
        Answer. In late March, as part of a comprehensive supplemental
    review of the updated MCAS software, Boeing discovered that a monitor
    to address erroneous processor commands was not as robust as originally
    assumed. Although this fault had never occurred in 125 million flight
    hours, Boeing decided to implement an improved monitor to avoid even
    the theoretical risk of a stabilizer runaway near the ground, where the
    flight crew would have less time to respond than at a higher altitude.
        During a simulator certification demonstration on June 26, an FAA
    pilot raised an additional concern regarding the possibility that this
    failure condition could occur at cruising altitude. The pilot
    determined that, while the flight crew could reverse the stabilizer
    runaway effect through use of the electric trim switches, this response
    might--if the crew delayed in recognizing the condition--require a
    level of piloting skills that could not be assumed. Based on this
    finding, the FAA asked Boeing to develop additional redundancies in the
    flight control computer software to prevent this type of failure.
    Boeing has since been working on new software functionality to address
    the possibility of such uncommanded stabilizer motion in all phases of
    flight
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                               Dennis Muilenburg
        Question 1. Both the National Transportation Safety Board (NTSB)
    and Joint Authorities Technical Review Board (JATR) reports mentioned a
    need for greater consideration of crew workload when designing flight
    control systems.
        For example, the JATR report cited a lack of communication between
    divisions within Boeing as one reason a more holistic evaluation of
    crew workload may not have been considered in the development of the
    Maneuvering Characteristics Augmentation System (MCAS).
        Could you speak to how some of the organizational changes at Boeing
    you mentioned in your testimony will help address issues with
    communication?
        Answer. The review undertaken by a committee of the Boeing Board of
    Directors following the ET302 accident made a series of
    recommendations, all accepted by the Board, that will enhance safety
    throughout the design and manufacturing process.
        First, all engineering employees now report to the Company's chief
    engineer. By keeping engineering functions within the engineering
    department, rather than having engineers report up to program leaders,
    our engineers will have the enhanced ability to holistically assess key
    factors as we develop and design flight control and other systems on
    future airplanes. This organization change will also help ensure that
    lessons learned in one program will be shared with, and considered with
    respect to, other programs.
        Second, Boeing created a Product and Services Safety organization.
    Building off of Boeing's already robust avenues for reporting
    engineering and safety concerns, this organization will further
    encourage reporting and investigation of any potential safety issues,
    by anyone within the company.
        Third, Boeing created a Design Requirements Program. This program
    will strengthen information sharing and education among our engineering
    corps regarding design issues, and also further enhance Boeing's
    ability to incorporate lessons learned and detailed after action
    reports. This will help strengthen our existing process to ensure that
    issues identified and resolved in one program become training tools
    that improve safety across all Boeing's programs.
        These changes will enhance and reinforce Boeing's safety culture,
    and help to ensure that all safety matters, including lessons learned
    from these accidents, are appropriately addressed.

        Question 2. The NTSB report mentioned that while a safety
    assessment was performed on MCAS, it may not have considered an MCAS
    activation in concert with other potential alerts and indications.
        Do you believe that the establishment of the Product and Services
    Safety organization within Boeing will provide more comprehensive
    safety assessments that adequately assess crew workload?
        Answer. While Boeing already employs a rigorous process to perform
    the safety assessments required to demonstrate compliance to the
    Federal Aviation Regulations, we expect that the Product and Services
    Safety organization will heighten Boeing's focus on all safety matters,
    including the safety assessment process. The other changes outlined in
    response to the previous question will also further enhance Boeing's
    safety processes.
                                     ______

         Response to Written Question Submitted by Hon. Jerry Moran to
                               Dennis Muilenburg
        Question. Mr. Muilenburg, regarding the Federal Aviation
    Administration's (FAA) role in the certification process, what specific
    recommendations of change at the FAA would you suggest?
        Answer. Boeing strongly supports robust FAA oversight of the
    certification process. As the last major commercial airplane
    manufacturer in the United States, Boeing believes the certification
    process, and the FAA's role in that process, are vital to the safety of
    the traveling public, and have been an important factor driving
    substantial improvements in aviation safety in recent decades. Boeing
    supports increasing the FAA's global engagement and leadership in order
    to strengthen safety standards, safety culture, and safety-related best
    practices throughout the world.
        The certification process requires significant technical expertise
    and considerable resources. Boeing believes that any changes made
    should continue to ensure the FAA's resources are focused on areas such
    as new technologies, systems integration, and development. Moreover,
    the FAA must be able to attract and retain strong technical capability,
    commensurate with industry. To achieve those goals, Boeing supports the
    following changes:

       Increasing integration across organizations within FAA
            Aviation Safety, especially between Aircraft Certification and
            Flight Standards. This would facilitate earlier engagement by
            the operational evaluation teams in the airplane design and
            certification process, and strengthen the understanding of how
            certification and operational decisions impact each other.

       The FAA's System Oversight capability could be strengthened
            by setting clear expectations for applicants' processes and
            procedures to ensure compliance for lower risk areas, as
            identified by the FAA. This would allow FAA to dedicate the
            majority of its resources on areas the FAA has determined to be
            the highest safety risk.

       The rulemaking process should be strengthened so that the
            FAA has the capability to incorporate new rules and update
            existing rules to more quickly accommodate new technology and
            lessons learned from the existing fleet. For example, FAA
            should quickly incorporate International Civil Aviation
            Organization Safety Management System standards for
            manufacturers into domestic FAA regulations.
                                     ______

       Response to Written Questions Submitted by Hon. Maria Cantwell to
                               Dennis Muilenburg
        Boeing is developing a software fix to correct the deadly flaws in
    the Maneuvering Characteristics Augmentation System (``MCAS''). The
    Federal Aviation Administration (``FAA'') and international regulators
    are reviewing Boeing's work.
        I believe thorough transparency about the specific testing and
    evaluation is essential to ensure public confidence in the safety of
    the 737 MAX aircraft.
        Question 1. Will you commit to full public transparency about the
    technical details and the specific tests and evaluations conducted in
    order to correct MCAS and return the 737 MAX to service?
        Answer. Boeing is committed to keeping the public informed about
    the status of the enhancements being made to the MCAS system. Boeing
    has created a public website with information regarding the MAX to
    facilitate dissemination of information regarding the MAX. That website
    is located at http://www.boeing.com/737-max-updates/. Boeing will
    continue to provide information regarding the MAX as we work to rebuild
    the public's confidence in what we do, as well as work with our
    regulators to ensure that the public, our customers, and other
    stakeholders can understand the rigor and scope of the return to
    service process.
        Boeing has already disclosed the changes it is making to the MCAS
    system. When the MAX returns to service, MCAS will compare inputs from
    both Angle-of-Attack sensors on the MAX, it will only activate one time
    per high angle-of-attack event, and MCAS will never command more
    stabilizer input than can be counteracted by the flight crew pulling
    back on the control column.
        Boeing extensively tested these updates. As of November 26, Boeing
    has dedicated over 190,000 engineering and test hours relating to
    updates to the MAX, flown more than 1100 test and production flights,
    and conducted simulator sessions with 41 international regulators as
    well as 99 of our airline customers. Testing has included evaluation of
    the system in normal operation, operation when subject to failures (in
    both the normal and operational flight envelopes), and the potential
    effect of pilot crew error and workload. When the MAX returns to
    service, we are confident it will be one of the safest aircraft ever to
    fly.
        Moreover, the FAA established a Technical Advisory Board (TAB) to
    review Boeing's updates to MCAS. As Matthew Kiefer, a member of the
    TAB, testified before the Committee on Transportation and
    Infrastructure of the House of Representatives, this panel consists of
    independent experts, with no past involvement in the development or
    certification of the 737 MAX. In his written testimony, Mr. Kiefer
    stated that, pending final testing and the results of their review, the
    TAB ``feels the changes made to the flight control software in the B737
    MAX should vastly improve the safety of the aircraft, in keeping with
    the highly successful safety record of the previous models of the
    Boeing 737.''

        Question 2. Will you publicly release the specific results of the
    testing and evaluation of the MCAS ``fix?''
        Answer. Please see the response to Question 1.

        Question 3. The current Organization Designation Authorization
    (``ODA'') process hinders the ability of designated Boeing
    certification engineers, or ``unit members,'' from communicating
    directly with their FAA counterparts. Instead, issues are resolved
    internally within Boeing, which can lead the certification process to
    potentially be influenced by cost and delivery schedule pressures. Some
    Boeing engineers are concerned that important dialogue with FAA about
    problems is being hindered or does not happen as a result of this
    process.
        Further, Boeing recently developed a new program called
    ``Verification Optimization.'' Under that program, up to 1,000 quality
    inspector positions will be cut over the next two years. Boeing quality
    inspectors have ensured mechanic work was performed per engineering
    requirements. Now, in many critical areas, mechanics will be the only
    set of eyes to verify they performed their work to Boeing
    specifications and procedures.
        Are you aware Boeing employees have raised concerns about being
    required to complete an internal review process before being allowed to
    speak with their FAA counterparts about potential problems?
        Answer. The procedures for communications between the ODA unit and
    the FAA, and the process for coordinating such communications, are
    defined in Boeing's ODA procedures manual, which is approved by the
    FAA. The procedures manual governs the conduct of Boeing's ODA unit
    members. Boeing's ODA procedures manual, as well as Boeing policy,
    contains procedures to comply with regulatory requirements by ensuring
    certain communications between Boeing and ODA unit members are
    coordinated, documented, and retained.
        Neither these regulatory requirements nor Boeing's ODA procedures
    manual prevent members of Boeing's ODA from communicating with their
    FAA counterparts. Boeing employees have multiple avenues they can use
    to raise concerns or potential problems, including within the ODA,
    within the company, and directly to the FAA.
        As discussed in more detail in response to Question 4, Boeing's
    ``Verification Optimization'' program is unrelated to the ODA unit.

        Question 4. Does Boeing still plan to move forward with its plan to
    cut visual inspections by Boeing quality inspectors?
        Answer. Boeing's ``Verification Optimization'' program is part of
    Boeing's effort to ensure first-time quality and increase the overall
    quality of its products. Under this program, in coordination with the
    FAA, Boeing has introduced a robust verification plan that allows
    quality inspectors to focus on certain areas: (1) critical items or
    areas of that pose higher risks; (2) new or unique build processes; and
    (3) areas where inspection data demonstrates existing processes result
    in a high rate of defects. For areas outside these categories, quality
    is still verified by experts in the work being performed. This program
    includes continuously evaluating regulatory and design requirements for
    specific inspections, ensuring those inspections are conducted, as well
    as monitoring results to re-evaluate where additional inspections could
    be needed. Through this program, Boeing is able to effectively use its
    quality inspector workforce to focus on the areas of production most in
    need of additional inspection. Moreover, as part of this program,
    Boeing has introduced a reporting process and review panel in its
    factories to identify and report any issues or concerns.

        Question 5. Does removal of quality inspectors increase the
    likelihood of human factor errors?
        Answer. The verification optimization program does not eliminate
    checking our work. Instead, it focuses resources on more critical,
    difficult, or high risk areas where the likelihood or consequence of a
    human error is higher.

        Question 6. Reports indicate that Boeing's original design of MCAS
    called for the system to move the horizontal stabilizer only 0.6
    degrees. However, the final design authorized MCAS to move the
    horizontal stabilizer more than four times as far, by 2.5 degrees for
    each activation.
        Was FAA made aware of the change of design providing for MCAS
    movements of 2.5 degrees for each activation? If so, when and under
    what circumstances? Please specify who at FAA was made aware of the
    change of design.
        Answer. The FAA was made aware of the change in the design. Boeing
    was transparent with the FAA about MCAS's design, including changes in
    that design over time. The development and certification process for
    the MAX took over five years. During that time, Boeing worked with
    numerous FAA employees across multiple departments regarding all
    aspects of MAX certification, including MCAS. This includes FAA
    employees at the Boeing Aviation Safety Oversight Office (BASOO) within
    the FAA's Aircraft Certification Service, as well as FAA test pilots
    and other FAA personnel who participated in flight tests and evaluated
    the activation of and data related to MCAS.
        On numerous occasions, Boeing shared with the FAA and international
    regulators that MCAS's final design had changed from its earlier
    parameters, and that its operating range had expanded to include low-
    speed conditions. The meetings and information exchanges regarding
    these topics began in mid-2016 and continued over subsequent months.
    The information provided to the FAA in these interactions included
    MCAS's maximum stabilizer authority of 2.5 degrees, as well as other
    aspects of the function's performance.
        In addition to these briefings, FAA personnel also observed the
    operation of expanded MCAS during certification flight testing. The
    conditions tested included MCAS's performance during low speed stall,
    and during these tests MCAS was activated nearly to the limit of its
    maximum stabilizer authority of 2.5 degrees. FAA personnel--including
    engineers, pilots, and at times both--were on board many of these
    flight tests to observe the performance of the flight conditions,
    including those involving MCAS. In some cases, FAA test pilots were at
    the controls and flew the relevant conditions. Boeing also provided the
    FAA with data related to MCAS activation in low speed conditions.
        Dan Elwell, then-Acting Administrator of the FAA, has testified
    before Congress that the certification process ``included 297 test
    flights, some of which encompassed tests of MCAS functions. FAA
    engineers and flight test pilots were involved in the MCAS operational
    evaluation flight test.''

        Question 7. If FAA was not made aware of the change of design,
    explain why Boeing failed to bring the change to FAA's attention.
        Answer. As noted in the response to Question 6, the FAA was made
    aware of the change of design.

        Question 8. Was MCAS installed on the 737 MAX for the purpose of
    ensuring the stability of the aircraft? Or was the system installed for
    the purpose of more closely approximating the handling characteristics
    of previous models of the 737 aircraft?
        Answer. MCAS was initially implemented to improve aircraft handling
    characteristics in certain rarely encountered high-speed, high-angle-
    of-attack flight conditions. As development of the 737 MAX continued,
    flight testing showed that other changes to the airplane's design
    affected the 737 MAX 8's handling characteristics in certain low speed
    scenarios involving high angles of attack. Boeing analyzed both control
    law and physical changes as possibilities to address this issue and
    ultimately determined that a combination of the two approaches,
    including an expansion of MCAS's operating range to lower speeds, was
    the most promising solution for achieving appropriate and certifiable
    handling characteristics.

        Question 9. Can the 737 MAX aircraft be operated safely without
    MCAS within the normal flight envelope? Can it be operated safely
    without MCAS within the operational flight envelope?
        Answer. As described more fully in the answer to the previous
    questions, MCAS was initially implemented to improve handling
    characteristics in certain rarely encountered high angle of attack
    situations, and was expanded to achieve appropriate and certifiable
    handling characteristics in certain low-speed situations. As part of
    the safety process described more fully in the answer to Question 10,
    Boeing evaluated the loss of the MCAS function within both the normal
    and operational envelope. Loss of the MCAS function was rated minor
    within the normal flight envelope, and major within the operational
    flight envelope.

        Question 10. The Lion Air report finds that MCAS was designed to
    rely on a single Angle of Attack (``AoA'') sensor, making it vulnerable
    to erroneous input from that sensor. Did Boeing test the consequences
    of relying on only one sensor? Explain why or why not.
        Answer. The 737 MAX was a derivative of the 737 NG, an airplane
    with one of the best safety records of all large commercial aircraft.
    MCAS was an extension of the 737 NG Speed Trim System, which is also
    based on a single sensor. Boeing uses an established safety analysis
    process to implement and validate changes to an airplane design. This
    process entails a comprehensive and iterative assessment of the new
    design, and identification and resolution of any potential safety
    issues.
        Central to the safety analysis process is evaluating how a design
    performs in the presence of a series of hypothetical failure scenarios.
    In identifying and evaluating potential failure conditions, Boeing
    follows the industry standard approach of preparing functional hazard
    assessments. Boeing experts identify potential failure conditions using
    a variety of techniques, including pilot feedback and evaluation, in-
    service experience, lessons from prior accidents and incidents, and
    engineering performance analysis. They then assess the level of hazard
    that these failure conditions present at an airplane level. The design
    is then validated through a combination of lab, simulator, and flight
    testing, to ensure that the probability of each identified failure
    condition is appropriate for the level of hazard assessed. The results
    of this testing are in turn evaluated by cross-functional teams of
    subject matter experts across the enterprise, and changes are made to
    the design as appropriate. The testing is then repeated after the
    incorporation of any changes. Multiple levels of review, conducted both
    at the working level and by program and functional management, occur
    throughout the process, as does regular information sharing and
    interaction with the FAA. These reviews and regulator interactions
    frequently result in direction to the team to further refine the
    design, and to conduct additional testing and analysis, in order to
    ensure that the design is safe and meets all certification and
    performance requirements and expectations.
        Boeing's evaluation of MCAS was consistent with this process.
    Boeing experts performed a thorough safety assessment for the initial
    MCAS design, with Boeing test pilots and engineers conducting a number
    of piloted simulator sessions in 2012 and 2013 to evaluate possible
    hazards. In March 2016, concurrently with developing the requirements
    for the expanded MCAS design, Boeing subject matter experts--including
    both engineers and experienced pilots--conducted an additional targeted
    assessment of the potential hazards posed by MCAS's greater stabilizer
    authority at low speeds. Among other conditions tested during the MAX
    development process, Boeing considered uncommanded MCAS operation
    resulting in unintended nose down trim to the maximum stabilizer
    authority for both the earlier and expanded MCAS designs.

        Question 11. The Lion Air report finds that the absence of guidance
    on MCAS or more detailed use of trim in the flight manuals and in pilot
    training made it more difficult for flight crews to properly respond to
    uncommanded MCAS activations.
        Did Boeing consult with pilots employed by domestic or foreign air
    carriers about the removal of information about MCAS in flight manuals
    and in flight crew training? Explain why or why not.
        Answer. In accordance with FAA regulatory guidance, flight training
    for all Boeing airplanes, including the 737 MAX, is designed to give
    pilots the knowledge, skills, and abilities necessary to safely operate
    each model on which they are licensed (or ``type-rated''). Boeing and
    the FAA coordinated closely over the course of several years in
    developing the necessary training requirements and flight manual
    content for the MAX. Many items were considered for inclusion,
    including MCAS, and the content of the manuals and training evolved
    over time, as is common. Ultimately, relying on the professional
    judgment of those involved in this process, Boeing proposed, and the
    FAA agreed, not to include a description of MCAS in the final version
    of the Flight Crew Operations Manual for the MAX. When the MAX returns
    to service, Boeing has recommend that pilots receive simulator training
    on the MAX and the flight manuals will have specific references to the
    MCAS system.

        Question 12. Have any Boeing personnel been terminated, reassigned,
    or suffered any internal disciplinary action as a result of actions or
    omissions regarding any activities concerning the certification or
    approval of the Boeing 737 MAX or any systems therein? If so, please
    provide details on the actions taken, including the dates.
        Answer. Boeing has recently made several high-level leadership
    changes to ensure that it has the right leadership going forward.
    Boeing has also made several structural changes to enhance the
    company's culture of safety and accountability. These include the
    creation of a permanent Aerospace Safety Committee within our Board of
    Directors to ensure greater Board oversight and visibility, creation of
    a Product and Services Safety organization that will, among other
    things, centralize investigations of safety concerns, and realignment
    of the engineering function within the company, to ensure technical
    accountability to the Chief Engineer. In addition, several external
    reviews are ongoing. As those conclude, we will evaluate the results of
    those reviews and will not hesitate to hold individuals accountable,
    where appropriate.

        Question 13. Is Boeing committed to returning the 737 MAX to
    service only as part of a unified review process with other
    international regulators (such as the European Aviation Safety Agency)?
        Answer. Boeing's regulators will determine the process for the
    MAX's return to service, and Boeing will support whatever process the
    FAA and other international regulators determine is appropriate. Boeing
    is working with both the FAA and other global regulators, including
    through multi-regulator assessments such as the Joint Operations
    Evaluation Board, to safely return the MAX to service worldwide. Boeing
    is committed to providing any information needed by those regulatory
    authorities to support their reviews.

        Question 14. The Lion Air report finds that the AoA DISAGREE alert
    was not correctly enabled during 737 MAX development. Did Boeing test
    the AoA sensor DISAGREE alert to ensure reliability prior to receiving
    type certification? Explain why or why not.
        Answer. Boeing tests all software it receives prior to type
    certification. Boeing's testing did not immediately detect this
    software issue. In August 2017, several months after the software
    delivery and the commencement of MAX deliveries, Boeing engineers
    identified the issue after internal testing revealed that the alert was
    not working as expected.

        Question 15. The Lion Air report finds that the crew was unable to
    effectively manage the multiple alerts, repetitive MCAS activations,
    and distractions related to numerous air traffic control
    communications. Did Boeing test the human factors impact of multiple
    alerts, repetitive MCAS activations, and other distractions that would
    make it difficult for a flight crew to manage a catastrophic failure?
    Explain why or why not.
        Answer. As described in the answer to Question 10, Boeing uses an
    established safety-analysis process, and that process was used for the
    737 MAX and MCAS specifically. Boeing experts performed a thorough
    safety assessment for the initial MCAS design, with Boeing test pilots
    and engineers conducting a number of piloted simulator sessions in 2012
    and 2013 to evaluate possible hazards. In March 2016, concurrently with
    developing the requirements for the expanded MCAS design, Boeing
    subject matter experts--including both engineers and experienced
    pilots--conducted an additional targeted assessment of the potential
    hazards posed by MCAS's greater stabilizer authority at low speeds. In
    performing this assessment, Boeing's experts applied their engineering
    judgment and piloting experience to the existing safety analysis and
    data for the earlier MCAS design, and also considered new performance
    data generated through piloted simulator testing and computer analysis
    of MCAS's operation at low speeds.
        In the initial analysis, Boeing's subject matter experts had
    concluded that MCAS's earlier design met all applicable functional
    hazard assessment thresholds. Based on their updated hazard analysis,
    Boeing's subject matter experts concluded at the end of March 2016 that
    the expanded version of MCAS also met all applicable requirements, and
    did not create any heightened risks beyond the earlier design.
        Since the accidents, a number of reports have recommended revisions
    to the safety-analysis process. Boeing is evaluating those
    recommendations, as well as the lessons learned during the process of
    returning the MAX to service, to make improvements to its safety
    analysis processes. Boeing also supports updating the industry-wide
    assumptions reflected in existing regulatory guidance.

        Question 16. To replace or to supplement flight data generated by
    external sensors, Boeing has developed such virtual technologies as
    ``synthetic airspeed'' and ``synthetic AoA.'' Currently, these state-
    of-the-art technologies are present only on the 787 aircraft, although
    they will reportedly be installed on the new 777X aircraft, as well.
    Exclusive reliance on external sensors such as AoA sensors raises
    concerns because of their exposure to inadvertent or intentional
    damage.
        Why weren't these state-of-the-art technologies incorporated into
    the design of the 737 MAX? Why isn't Boeing setting the standard by
    deploying the best available technologies in new aircraft?
        Answer. Boeing routinely introduces best-available and industry-
    leading technologies on its airplanes. However, not every new
    technology is appropriate for every aircraft. Synthetic airspeed is a
    technology that allows for the indirect calculation of a plane's
    airspeed from various inputs, including external sensor data. Boeing
    carefully considered the possible inclusion of synthetic airspeed
    during the development of the 737 MAX, and determined not to implement
    synthetic airspeed on the 737-8. Boeing subject matter experts
    evaluated the potential advantages and disadvantages of implementing
    synthetic airspeed. This evaluation process included the relevant
    technical experts and decision-makers, and different views were
    appropriately considered. Boeing continues to assess the potential
    application of synthetic airspeed to its airplanes.

        Question 17. Why was MCAS designed with authority to ``issue''
    uncommanded flight control inputs while relying on only one AoA
    sensor--a single point of failure with no redundancy? Did any Boeing
    employees raise concerns about the reliance on one AoA sensor during
    MCAS' development?
        Answer. Please see the answers to questions 8 and 10 regarding
    MCAS's original design. As discussed therein, the MCAS flight control
    law was designed as an extension of the 737 NG's Speed Trim System.
    That system is a single sensor design that has hundreds of millions of
    hours of safe flight.
        Regarding potential employee concerns, as is normal during the
    airplane development process, Boeing technical personnel raised and
    discussed many technical issues related to the design and development
    of the MAX, including MCAS. Boeing maintains an Employee Issue Tracking
    System, a single, common system for entering and tracking employee
    issues and complaints. Boeing has searched EITS and located no records
    indicating an employee raised concerns with the design of MCAS prior to
    the Lion Air accident in October 2018.

        Question 18. Are there other systems installed on Boeing aircraft
    which are given such authority based on data from only one sensor?
        Answer. Whether an airplane system is allowed to rely on a single
    input is determined by FAA regulation. For an aircraft to be certified,
    it must meet all regulatory requirements.
        Note: The following questions refer to the Aircraft Certification
    ``Transformation'' Pre-Decisional Involvement Report, Union
    Recommendations and Dissenting Opinion that was published on February
    6, 2017. The report is attached for your reference.

        Question 19. Will Boeing upgrade the single string rudder control
    before the MAX is returned to service? Why or why not? (See Dissenting
    Opinion, 2017 sec. 12.2.3)
        Answer. Boeing's rudder control design has been certified by the
    FAA multiple times, most recently on the 737 MAX. As part of the MAX
    certification process, Boeing discussed its rudder cable design with
    the FAA in multiple meetings over several years. These meetings focused
    on how the planned changes from the certified NG design to the MAX
    could affect hazards related to engine failure as well as design
    precautions taken by Boeing to minimize such hazards in accordance with
    FAA regulations. Boeing also shared with the FAA several potential
    additional design changes. Because changes to an existing, proven
    design can increase risks in other areas, design changes were evaluated
    based on their potential utility to mitigate the overall level of risk.
    As Administrator Dickson testified before the Transportation and
    Infrastructure Committee of the House of Representatives on December
    11, 2013, adding complexity to existing systems often introduces new
    risks.
        Boeing's analysis of these potential design changes indicated that
    they would increase the overall level of risk to the airplane, by
    introducing significant new risks. In addition, the risk of this type
    of hazard for the MAX was determined to be similar to the 737 NG, an
    airplane with an excellent safety record. As a result of these
    discussions, Boeing made additional changes to the MAX floor beam
    structure to further reduce the likelihood for damage to control
    surface cables in the event of an uncontained engine rotor failure.
    Boeing and the FAA also agreed on the methods and analysis that Boeing
    would use to demonstrate regulatory compliance. Boeing worked with the
    FAA and responded to all of its concerns to ensure that the 737 MAX
    complied with applicable requirements.

        Question 20. Will Boeing upgrade the single float switch that is
    vulnerable to single failures and that can cause fuel spillage onto the
    ramp area and the potential for uncontrolled fire? Why or why not? (See
    Dissenting Opinion, 2017 sec. 12.2.3)
        Answer. The single float switch design is based on the 737 NG,
    which has hundreds of millions of hours of safe flight. During the
    certification process, Boeing discussed the design and the means of
    compliance with the FAA. As a result of those discussion, Boeing
    provided data and analysis that demonstrated Boeing's design provided
    an equivalent level of safety to existing regulatory requirements, and
    the FAA certified the design.

        Question 21. Will Boeing upgrade the engine mount on the auxiliary
    power unit, which is aluminum and not fireproof, as required by current
    regulations? (See Dissenting Opinion, 2017 sec. 12.2.3)
        Answer. The initial design of the auxiliary power unit structural
    mount on the 737 MAX is unchanged from the 737 NG, which has hundreds
    of millions of hours of safe flight. During the certification process,
    Boeing improved the design to further reduce the risk of certain
    failure scenarios beyond regulatory requirements. Boeing documented
    these changes and provided data and analysis to the FAA identifying how
    Boeing's design provided an equivalent level of safety to existing
    regulatory requirements. The FAA certified Boeing's design.
        Note: The following questions refer to the Joint Authorities
    Technical Review (``JATR'') Boeing 737 MAX Flight Control System
    Observations, Findings, and Recommendations report that was published
    on October 11, 2019. The report is attached for your reference.

        Question 22. Please describe--and provide the documents showing--
    the changes Boeing has made and the testing the company has done
    regarding human factors and human system integration with relation to
    the MCAS fix, as suggested by Recommendation R7 of the JATR report.
        Answer. Boeing has engaged in extensive testing of its MCAS
    updates. As of November 26, Boeing has dedicated over 190,000
    engineering and test hours relating to the MAX updates, flown nearly
    1100 test and production flights, and conducted simulator sessions with
    41 international regulators as well as 99 of our airline customers.
    This testing included simulator sessions, with regulators, to evaluate
    workload and human factors aspects of the updated procedures, training,
    and design.
        In the process of developing the MCAS update, Boeing incorporated
    human factors considerations into the design development, analysis, and
    testing process. Boeing has ensured that human-factors-focused
    specialists participate in the design reviews of the update, review its
    relevant safety analyses, and participate in simulator sessions where
    human-factors issues were evaluated. Boeing is also ensuring that
    relevant human-factors analyses are documented in its certification
    compliance submissions. Before engaging in human factors testing,
    Boeing shared its proposed approach with regulators, and Boeing
    incorporated the feedback it received into the tests.

        Question 23. Has Boeing created an independent system safety
    function to challenge the assumptions and work of Boeing's design and
    manufacturing personnel? (JATR report pgs. 30, 32). If so, has this
    independent system safety function been applied to the MCAS fix? What
    authority did that function have in relation to the design and other
    personnel? Please describe.
        Answer. Pursuant to a recommendation by a special Board committee,
    Boeing has created an independent Product and Services Safety
    organization that, among other responsibilities, will provide an
    independent review of safety assessments completed by design personnel.
    Although this specific organization was created after design of the
    upgrades to the MCAS flight control law were begun, those updates were
    scrutinized through a similar process.

        Question 24. The JATR report (pg. VIII) found that MCAS was not
    evaluated as a complete and integrated function and that the design was
    based upon data, architecture, and assumptions that were reused from
    the past. What has Boeing done to update these evaluations?
        Answer. As part of the 737 MAX's return to service, revised
    individual system safety assessments were consolidated into one
    Integrated System Safety Assessment (ISSA) for the entire Speed Trim
    System. The ISSA combines the analysis and results of several different
    systems and components of the airplane into a single compliance
    document, providing an integrated perspective into the flight control
    system's overall level of safety. As Boeing continues to work to return
    the MAX to service, we will use knowledge we have gained from that
    process to improve our safety processes for future airplanes. Moreover,
    as discussed in the response to Question 26, Boeing also supports
    updating the industry-wide assumptions reflected in existing regulatory
    guidance.

        Question 25. Who made the ultimate decision to remove information
    relating to MCAS functionality from the Flight Crew Operating Manual?
        Answer. Consistent with the established regulatory process, the
    development of the training requirements and manuals for the MAX was a
    complex, multi-year effort that involved close coordination between
    Boeing and the FAA. Ultimately, relying on the professional judgment of
    those involved in this process, Boeing proposed, and the FAA agreed,
    not to include MCAS in required pilot training for the MAX. Likewise,
    the FAA reviewed Boeing's flight manuals, which did not reference the
    MCAS function by name. Boeing has learned from these accidents,
    however, and the responses we have received from regulators, our
    customers, and other stakeholders, and Boeing is also in the process of
    updating flight crew training and manuals to reflect the updates to
    MCAS, as appropriate.

        Question 26. What assumptions has Boeing changed regarding pilot
    response time in the flight control functional hazard assessment? What
    data and testing did Boeing engage in, and what studies, if any, did
    the company rely upon when changing these pilot response time
    assumptions? (JTAR report pg. XII)
        Answer. Boeing's design, analysis and evaluation approach is based
    on FAA guidance and published industry standards, including FAA
    Advisory Circular 25-7C \1\ (``Flight Test Guide for Certification of
    Transport Category Airplanes''). This was the approach used when
    designing and certifying the 737 MAX. Boeing supports an industry-wide
    effort to update those standards.
    ---------------------------------------------------------------------------
        \1\ FAA Advisory Circular 25-7C was canceled in May 2018 and
    replaced by FAA Advisory Circular 25-7D, which contains the same
    guidance on these points. This is true for all references to Advisory
    Circular 25-7C in this document.
    ---------------------------------------------------------------------------
        In updating MCAS, Boeing has implemented a number of changes to the
    MCAS system that will minimize the risk that pilots encounter
    erroneous, repeated or non-command limited MCAS activation. Those
    changes include:

       The flight control system will compare inputs from both
            angle of attack sensors, and MCAS will not activate if the
            sensors disagree by 5.5 degrees or more.

       MCAS will no longer activate repeatedly. It will provide one
            input for each elevated angle of attack event.

       Finally, MCAS will never be able to command more stabilizer
            input than can be counteracted by the flight crew pulling back
            on the control column.

        This design does not require the flight crew to promptly use
    sustained electric trim to mitigate potential stabilizer failures
    caused by MCAS. Moreover, this design meets all certification
    requirements whether or not flight crews follow all of the steps in the
    Runaway Stabilizer Non-Normal Checklist. As discussed in response to
    the previous question, Boeing is also in the process of updating flight
    crew training and manuals to reflect the updates to MCAS, as
    appropriate.

        Question 27. FAA Advisory Circular (``AC'') 25.1302-1 requires a
    showing that MCAS, individually and in combination with other systems
    and equipment, is designed so that qualified flight crew members
    trained in their use can safely perform all the tasks associated with
    the systems and equipment. The JATR report (pg. 12) found that Boeing
    wrongly failed to identify MCAS as requiring compliance with 25.1302-1.
    Has Boeing now complied with sec 25.1302-1 with regard to MCAS? If so,
    how?
        Answer. As part of the MAX's return to service, Boeing will
    demonstrate compliance with 14 C.F.R. Sec. 25.1302. The specific means
    of compliance are determined by the FAA. Boeing will provide all
    necessary information to the FAA as part of the return-to-service
    process.

        Question 28. The JATR report (pg. 18) found that a review of the
    natural (bare airframe) stalling characteristics of the 737 MAX should
    be performed to determine if unsafe characteristics exist. Has this
    been conducted? If so, please provide the data and testing
    documentation underling that review and conclusions.
        Answer. As part of the MAX's return to service and in response to a
    request from a regulator, Boeing conducted both simulator sessions and
    flight testing designed to verify that the MAX's characteristics and
    systems were compliant with relevant regulatory requirements regarding
    stall identification and subsequent airplane behavior. This testing
    included tests with the Speed Trim System (including MCAS) turned off.
    The testing verified the original finding of compliance.

        Question 29. Has Boeing performed stall demonstration compliance as
    required by 14 CFR 25.201 before or after the 737 MAX was grounded?
    (JATR report pg. 18) If so, when was this done? Please describe the
    testing, analysis and results.
        Answer. As part of the initial certification process, the 737 MAX
    demonstrated compliance with 14 C.F.R. Sec. 25.201. As part of the
    MAX's return to service, Boeing is working with the FAA to demonstrate
    compliance with this section, and will provide any necessary data and
    analysis required by the FAA.

        Question 30. Prior to the crashes, 737 MAX simulators did not
    exhibit the problems that occurred and caused the crashes. What has
    Boeing done to verify that simulators accurately simulate all aspects
    and potential problems of flying the 737 MAX? How many such simulators
    exist?
        Answer. Pursuant to Federal regulation, the FAA certifies flight
    simulators for use as aviation training devices. Boeing does not
    manufacture aircraft simulators, though Boeing does provide software to
    the manufacturers of these products. Though it is impossible to
    simulate every possible aircraft malfunction or combination of
    malfunctions, the 737 MAX training simulation software contains
    hundreds of malfunction scenarios. Those scenarios were identified
    based on industry standards and an assessment of training value. The
    available malfunction scenarios are continuously reviewed based on
    changing training techniques, operator feedback, and operational data.
    For instance, in March 2019 Boeing added a malfunction scenario that
    simulates the effects of erroneously high Angle of Attack data.
        Boeing owns one MAX engineering simulator in Seattle, as well as 8
    MAX training simulators at locations around the globe. As of December
    2019, Boeing is aware of approximately 26 others worldwide.

        Question 31. Has Boeing changed its prior practice (JATR report pg.
    29) of failing to identify personnel recommending approval with
    airworthiness standards via FAA Form 8100-9 Statement of Compliance
    with Airworthiness Standards? Does this change apply to submissions
    relating to the MCAS fix? If not, please describe how Boeing identifies
    employees who make airworthiness recommendation decisions and hold them
    accountable.
        Answer. Boeing's existing Organization Designation Authority (ODA)
    procedures require the submission of signed FAA Form 8100-9 for all
    compliance data submittals except in limited circumstances, such as
    flight test reports where the FAA retained the compliance deliverable
    and conducted the test. In all cases where Boeing submits a Form 8100-
    9, the individual signing the form is identified.
        Boeing's Organization Designation Authority procedures are outlined
    in its ODA procedures manual, which is the product of an agreement with
    the FAA. As such, Boeing cannot unilaterally change its ODA procedures.
    However, Boeing is evaluating changes to these procedures and will make
    any necessary changes in coordination with the FAA.

        Question 32. The JATR report recommended that all ``major hazards''
    determined under AC 25.1309.1A, which include flight crew action in
    mitigation, should be examined to determine if they are potentially
    catastrophic. (JTAR report pg. 30) Has Boeing conducted a review of
    other systems in the 737 MAX since the accidents? Please describe what
    systems were examined, what testing and analysis was done, and what
    were the results of the examinations?
        Answer. As part of the process to return the MAX to service, Boeing
    has re-evaluated its analysis of any system that could have a failure
    effect on the flight control computer (FCC), as well as any system
    potentially affected by a failure of the FCC. Boeing used a
    comprehensive failure analysis process, focusing on cascading system
    effects as well as the flight crew's ability to cope with the failure
    during different phases of flight. The testing and analysis included
    identifying the effects of a particular failure, conducting a thorough
    review of each failure case, and, where necessary, conducting simulator
    testing to finalize the appropriate hazard classification.
        After reviewing the individual system effects for the failure
    (first, second, third order effects), Boeing prepared an airplane level
    analysis of the system effects and expected flight crew response. The
    results of the testing and analysis were provided to the FAA for use
    during the return-to-service process. As described previously, Boeing
    will use the knowledge we have gained during the process of returning
    the MAX to service to make improvements to its processes going forward.

        Question 33. The JATR report determined that the single and
    multiple failure analysis of MCAS was never performed (JTAR report pg.
    34). Please describe all possible failures of MCAS and related systems
    that were examined in the process of returning the MAX to service, and
    how Boeing intends to mitigate those potential failures.
        Answer. The JATR report indicates that an aircraft-level single-and
    multiple-failure analysis, although not a certification deliverable,
    was developed and used by Boeing in evaluating the MAX. JATR Report at
    33.
        In the process of returning the MAX to service, Boeing has
    conducted extensive testing of the updates to the MCAS flight control
    law, and has documented that testing in submissions to the FAA. This
    testing has included failure modes such as unexpected loss of MCAS
    operation and three different types of erroneous MCAS operation: (1)
    MCAS operating when unnecessary; (2) MCAS operation based on incorrect
    data input; and (3) MCAS stopping in the middle of expected operation.
    As described in the answer to the previous question, Boeing has also
    re-evaluated other potential flight-control-computer failures.
        In updating MCAS, Boeing has implemented a number of changes to the
    MCAS system that will minimize the risk that pilots encounter
    erroneous, repeated, or non-command-limited MCAS activation. Those
    changes include:

       The flight control system will compare inputs from both
            angle of attack sensors, and MCAS will not activate if the
            sensors disagree by 5.5 degrees or more.

       MCAS will no longer activate repeatedly. It will provide one
            input for each elevated angle of attack event.

       Finally, MCAS will never be able to command more stabilizer
            input than can be counteracted by the flight crew pulling back
            on the control column.

        This design does not require the flight crew to promptly use
    sustained electric trim to mitigate potential stabilizer failures
    caused by MCAS. Moreover, this design meets all certification
    requirements whether or not flight crews follow all of the steps in the
    Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process
    of updating flight crew training and manuals to reflect the updates to
    MCAS, as appropriate.

        Question 34. The JATR report found that Boeing did not meet the
    objectives of Society of Automotive Engineers Aerospace Recommended
    Practice 4754A (``ARP4754A'') for an integrated approach to design when
    integrating complex systems like MCAS into the legacy 737. (JTAR report
    pg. 38) Please describe what Boeing has done to meet the objectives of
    ARP4754A in this regard, as it attempts to return the MAX to service.
        Answer. During the certification of 737 MAX systems, Boeing worked
    with the FAA to develop specific methods of compliance with FAA
    regulations. These methods are consistent with the intent of ARP4754A.
    As described in the answer to Question 24, for the updates to the MCAS
    flight control law, Boeing has consolidated individual system hazard
    assessments into an Integrated System Safety Assessment for the Speed
    Trim System. The ISSA combines the analysis and results of several
    different systems and components of the airplane into a single
    compliance document, providing an integrated perspective into the
    flight control system's overall level of safety.
                                     ______

       Response to Written Questions Submitted by Hon. Amy Klobuchar to
                               Dennis Muilenburg
        At Tuesday's hearing, you indicated that you would follow up with
    information in response to my questions on how often Boeing engineers--
    rather than Federal Aviation Administration (FAA) employees--conduct
    safety certifications for Boeing aircraft.
        Question 1. What percentage of FAA certifications do Boeing
    employees--rather than FAA employees--approve for Boeing aircraft?
        Answer. The FAA initially accepted the Master Certification Plan
    for the 737-8 in November 2013, and it accepted the Detailed
    Certification Plans in August 2015. When the Master Certification Plan
    was initially accepted by the FAA, approximately 28 percent of the
    detailed Certification Plans were delegated. As the FAA reviewed the
    certification deliverables, those deliverables evolved. The number of
    delegated tasks increased as a result. For example, the FAA often will
    review a Boeing proposal for compliance, provide comments and require
    changes to that proposal and then delegate the final implementation
    work to Boeing's ODA. However, even for certifications that are
    delegated, all testing and reviews that Boeing conducts to demonstrate
    compliance with applicable standards and requirements are subject to
    FAA oversight.

        Question 2. How many Boeing engineers both work on automated
    systems for the company and then certify those systems for the FAA?
        Answer. Boeing employs approximately 16,000 engineers that work on
    designing commercial airplanes. Of those, approximately 3700 work
    specifically on airplane systems, and approximately 350 work on flight
    control systems. Approximately ten flight control engineers have
    credentials as Engineering Unit Members in the Boeing Organization
    Delegation Authority (ODA), which would allow them to make a compliance
    finding on behalf of the FAA regarding flight controls, if the FAA
    delegates such findings to Boeing's ODA.
        In response to my question regarding whether certain aircraft
    should be allowed to carry passengers in some countries and not others,
    you declined to respond and stated that you ``respect the jurisdiction
    of the regulatory authorities around the world.''

        Question 3. How would you explain that to a passenger who is
    rightly concerned about their safety?
        Answer. Boeing respects the authority of all individual civil
    aviation authorities to make decisions regarding the airspace they
    control and the pilots, maintenance personnel, and airlines they
    oversee. Individual civil aviation authorities around the world,
    working in collaboration with other regulators and the broader aviation
    community, are best positioned to determine how to achieve safety goals
    in the context of their individual regions and operations. Boeing is
    committed to ensuring the MAX returns to service worldwide, and to
    providing any information and support needed by those civil aviation
    authorities, and our customers, to achieve their goals and ensure the
    MAX safely returns to service worldwide.
                                     ______

     Response to Written Questions Submitted by Hon. Richard Blumenthal to
                               Dennis Muilenburg
        Boeing's attempt to move all the Lion Air cases overseas to
    Indonesia. Boeing says that it will take responsibility for the Lion
    Air crash resulting in the deaths of 189 people in Indonesia last year
    and the Ethiopian Airlines crashed that killed a 157 people from a pair
    of defectively designed 737 MAX aircraft. However, your company is
    threatening not to. Boeing has filed court documents for the Lion Air
    crash indicating that it will move to change the venue of the case to
    Indonesia, where the plane was maintained, if settlement talks fail.
    The case was filed in the Northern District of Illinois, where Boeing
    is headquartered. Resolving these claims in Indonesia is a travesty of
    justice because:

       There is no Seventh Amendment Constitutional right to a jury
            trial;

       There is no requirement of discovery, so there is limited or
            no ability for the plaintiffs to uncover the documents showing
            what Boeing knew, when it knew it, what information was
            withheld from the FAA, and other critical information;

       There is no rule allowing for depositions to be taken of key
            Boeing decision-makers; and

       There is no right to cross-examine witnesses to see what
            they know.

        Question 1. Is the threat to move the case to Indonesia a
    litigation tactic or is this attempt to evade responsibility for
    corporate misconduct?
        Answer. In response to both MAX accidents, Boeing has offered to
    engage in mediations in the United States to resolve the families'
    claims without the need for any litigation. To facilitate this, Boeing
    arranged for a prominent Chicago mediator, a former Chief Judge of the
    Circuit Court of Cook County, to assist, and is paying the full costs
    of all mediations. Since the middle of July, Boeing has been working
    with the mediator and the families who lost loved ones in the Lion Air
    accident to settle these cases. We have resolved approximately one half
    of the Lion Air claims filed in the United States on terms that
    compensate the victims' families. We remain committed to this mediation
    process. If, at some point and despite Boeing's best efforts, an
    impasse is reached in the mediation process, the litigation may resume.
    And at that point, well-settled U.S. law will give Boeing the option of
    requesting that the court determine whether, consistent with well-
    settled legal principles adopted by the United States Supreme Court,
    another jurisdiction is the appropriate venue for such cases.

        Question 2. It seems that you want the advantages of being treated
    like an American company except that you don't want to utilize U.S.
    courts, which recognize the rights of both parties in a dispute. Why
    are you threatening to move the claims filed against you to Indonesia?
        Answer. Please see the response to the previous question.

        Question 3. Traditionally, companies complain that they don't want
    to be sued in the plaintiff's backyard, yet, you are being sued in your
    home state. Why are you threatening to leave courts conveniently
    located in your backyard?
        Answer. Please see the response to your first question.
        Clarification on Boeing's support for changes to the certification
    process. On October 27, 2019, the New York Times reported on Boeing
    efforts to undercut regulatory oversight--early and often. The story of
    Boeing sabotaging rigorous safety scrutiny is chilling--and more reason
    to keep 737 MAX aircraft grounded until certification is truly
    independent and the system reformed.
        Your company has lost the trust of the public, and I am evaluating
    changes to the Organizational Designation Authorization (ODA) program.
    At the hearing, you were unclear about Boeing's position on changes to
    the current certification process.

        Question 4. Do you support reducing the amount of delegation
    authority from the FAA to Boeing to restore public trust?
        Answer. Boeing strongly supports robust FAA oversight of the
    certification process. As the last major commercial airplane
    manufacturer in the United States, Boeing believes the certification
    process, and the FAA's role in that process, are vital to the safety of
    the traveling public, and have been an important factor driving
    substantial improvements in aviation safety in recent decades.
        Delegation has strongly correlated with safety. Delegation is
    decades old; and as delegation has increased, safety has as well. The
    data does not support the idea that reducing the amount of delegation
    will result in an increase in safety. Boeing believes that any changes
    made should continue to ensure the FAA's resources are focused on areas
    such as new technologies, systems integration, and development, and
    providing the FAA with the resources needed to effectively administer
    that process as well as ensure FAA has the required technical
    expertise.

        Question 5. What is the current timeline for returning the 737 MAX
    to service and how can the public be assured of its safety?
        Answer. The relevant civil aviation authorities will determine when
    the MAX returns to service. When the MAX returns to service, it will be
    one of the most scrutinized aircraft in history, and Boeing is
    committed to ensuring that it will also be one of safest aircraft ever
    to fly.
        Boeing's decision to label MCAS failure as ``major'' rather than
    ``catastrophic''. As you are aware, Boeing decided to classify failure
    of the MCAS system during flight as merely ``major''--lowering the
    classification of risk and exempting Boeing from having to fully test
    and analyze the effects of system failure.

        Question 6. How can you explain the failure to label the MCAS as
    ``catastrophic?''
        Answer, Boeing engaged in a multi-step process for evaluating the
    potential safety considerations involved in the implementation of MCAS.
    At each stage of the design, development, and testing of MCAS, Boeing
    subject matter experts reviewed and evaluated the design and the
    potential safety implications of design changes.
        As authorized by applicable FAA guidance, including FAA Advisory
    Circular 25-7C (``Flight Test Guide for Certification of Transport
    Category Airplanes''), in conducting their hazard assessments, Boeing's
    subject matter experts made a series of assumptions about how a flight
    crew would react if MCAS failed or did not function as intended.
    Consistent with established FAA guidance, this included the assumption
    that the crew would recognize and address uncommanded MCAS activation
    through normal use of the control column and the electric trim
    switches, and that the crew would also be able to use the stabilizer
    cutout switches and rely on manual trimming (as outlined in the Runaway
    Stabilizer Non-Normal Procedure) to stop any unintended stabilizer
    motion. Test pilots participated in the simulator testing of MCAS and
    had vital input into the hazard analysis.

        Question 7. Why did you make this decision?
        Answer. Please see the response to question 6.

        Question 8. Could the decision to label the system as
    ``catastrophic'' have prevented the MCAS failure from contributing the
    Lion Air and Ethiopian Air crashes?
        Answer. Whether hypothetical changes to the MCAS hazard rating
    could have prevented a failure of MCAS from contributing to the Lion
    Air and Ethiopian Air crashes is impossible to determine. As Boeing
    testified at the hearing, if, using hindsight, Boeing could go back and
    make changes to the MAX that would prevent the accidents, it would do
    so.
        Undue pressure put on Boeing employees to certify 737 MAX aircraft.
    The Wall Street Journal recently reported that internal Boeing surveys
    revealed that about 30 percent of its employees felt potential undue
    pressure from managers regarding safety related approvals.
        Boeing engineer Curtis Ewbank filed a complaint that asserted,
    ``Boeing management was more concerned with cost and schedule than
    safety or quality.'' He further asserted that you, Mr. Muilenburg,
    publicly misrepresented the safety of 737 MAX aircraft.
        The October 11, 2019 Joint Authorities Technical Review report also
    found several instances of Boeing management exerting undue pressure on
    its own engineers performing certification activities, which, as a
    result, ``erodes the level of assurance in this system of delegation.''

        Question 9. Did you at any point misrepresent the safety of 737 MAX
    aircraft? Please explain.
        Answer. No. With that said, Boeing has learned from these
    accidents, and has made several changes to the MAX to ensure that
    accidents like these never happen again. Boeing has dedicated over
    190,000 engineering and test hours relating to the MAX updates, flown
    more than 1100 test and production flights, and conducted simulator
    sessions with 41 international regulators as well as 99 of our airline
    customers. When the MAX returns to service, we are confident it will be
    one of the most scrutinized and safest aircraft ever to fly.

        Question 10. Did personnel within the company--involved in
    performing certification activities--have compensation tied to meeting
    timeline and cost goals? Please explain.
        Answer. For members of Boeing's Organization Delegation Authority
    (ODA), Boeing's ODA manual does not permit the use of timeline and cost
    goals as part of performance evaluations.

        Question 11. Did you ever personally exert production pressures on
    any of the employees that served under you as Boeing's CEO? If not,
    have you identified who, or what, in your organization caused that
    undue pressure?
        Answer. Mr. Muilenburg was not the subject of any undue pressure
    complaint. Boeing provides a number of avenues for employees to report
    instances of potential or actual undue pressure. In accordance with
    Boeing's ODA procedures manual, which is reviewed and approved by the
    FAA, allegations of potential undue pressure must be investigated and
    rectified, where needed, in a timely manner. Boeing investigates all
    undue pressure reports and those investigations are reviewed with the
    FAA. Boeing also conducts regular self-audits and surveys of the
    workforce to identify and address potential avenues of undue pressure
    that are not specifically reported by the workforce. In addition,
    Boeing requires any manager associated with the certification process
    to take training on undue pressure every two years, to ensure that they
    can identify and address potential undue pressure issues.

        Question 12. What steps have been taken to hold individuals
    accountable and reform Boeing's safety protocols related to undue
    pressure being put on employees?
        Answer. Boeing takes all allegations of undue pressure seriously.
    The Boeing Organization Designation Authority manual requires that any
    allegation of undue pressure be promptly rectified. When appropriate,
    employee corrective action is taken. More broadly, Boeing has created a
    Product and Services Safety Organization. This organization will ensure
    that any safety issue, including issues of undue pressure, will be
    investigated and evaluated by an independent organization within the
    company.
        The need for Boeing to move away from a system of assumptions. The
    Joint Authorities Technical Review report stated that Boeing made
    critical and several unsupported assumptions underlying the
    certification of 737 MAX aircraft, including a three-second pilot
    response assumption in the event of a problem.
        These assumptions directly contributed to two horrific and
    preventable crashes.

        Question 13. As you have resubmitted a package to return the
    aircraft to service, what changes in assumptions of pilot response or
    the other assumptions outlined in that report have you made?
        Answer. Boeing's design, analysis and evaluation approach is based
    on FAA guidance and published industry standards, including FAA
    Advisory Circular 25-7C \2\ (``Flight Test Guide for Certification of
    Transport Category Airplanes''). This was the approach used when
    designing and certifying the 737 MAX. Boeing supports an industry-wide
    effort to update those standards.
    ---------------------------------------------------------------------------
        \2\ FAA Advisory Circular 25-7C was canceled in May 2018 and
    replaced by FAA Advisory Circular 25-7D, which contains the same
    guidance on these points. This is true for all references to Advisory
    Circular 25-7C in this document.
    ---------------------------------------------------------------------------
        In updating MCAS, Boeing has implemented a number of changes to the
    MCAS system that will minimize the risk that pilots encounter
    erroneous, repeated and non-command limited MCAS activation, those
    include:

       The flight control system will compare inputs from both
            angle of attack sensors, and MCAS will not activate if the
            sensors disagree by 5.5 degrees or more.

       MCAS will no longer activate repeatedly. It will provide one
            input for each elevated angle of attack event.

       Finally, MCAS will never be able to command more stabilizer
            input than can be counteracted by the flight crew pulling back
            on the control column.

        This design does not require the flight crew to promptly use
    sustained electric trim to mitigate potential stabilizer failures
    caused by MCAS. Moreover, this design meets all certification
    requirements whether or not flight crews follow all of the steps in the
    Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process
    of updating flight crew training and manuals to reflect the updates to
    MCAS, as appropriate.

        Question 14. What research have you or the FAA done to justify any
    of those changes?
        Answer. Boeing has engaged in extensive testing of these MCAS
    updates. As of November 26, Boeing has dedicated over 190,000
    engineering and test hours relating to the MAX updates, flown nearly
    1100 test and production flights, and conducted simulator sessions with
    41 international regulators as well as 99 of our airline customers.
    Testing has included evaluation of the system in normal operation,
    operation when subject to failures (in both the normal and operational
    flight envelopes), and the potential effect of pilot crew error and
    workload. When the MAX returns to service, we are confident it will be
    one of the safest aircraft ever to fly.
        The lack of documents provided to the Senate Commerce Committee.
    The House Transportation and Infrastructure Committee had received over
    500,000 pages of documents related to the certification of the 737 MAX.
    Boeing has failed to provide the same documents to the Senate Commerce
    Committee--inhibiting our ability to carry out our oversight authority.

        Question 15. Will you commit to providing these documents to the
    Senate Commerce Committee as well? Please explain.
        Answer. Boeing respects the role of both Committees in the
    oversight of the aviation industry and is committed to continuing to
    cooperate with both Committees. To date, Boeing has responded to all
    requests received from the Chairmen of both Committees, and we intend
    to continue to cooperate with such requests.
                                     ______

         Response to Written Questions Submitted by Hon. Tom Udall to
                               Dennis Muilenburg
        Question 1. As a follow up to my questioning during the hearing,
    have you and your team engaged on what are ways to improve the ODA
    process?
        Answer. Boeing strongly supports robust FAA oversight of the
    certification process. As the last major commercial airplane
    manufacturer in the United States, Boeing believes the certification
    process, and the FAA's role in that process, are vital to the safety of
    the traveling public, and have been important factors driving
    substantial improvements in aviation safety in recent decades.
        The Organization Delegation Authority process has helped facilitate
    these safety improvements. However, there are ways to improve that
    process. For example, the FAA's System Oversight capability could be
    strengthened by setting clear expectations for applicants' processes
    and procedures to ensure compliance for lower risk areas, as identified
    by the FAA. This would allow FAA to dedicate the majority of its
    resources on areas the FAA has determined to be the highest safety
    risk. Boeing will work with all interested stakeholders to learn from
    these accidents and further increase aviation safety.

        Question 2. Accountability is critical. How will you personally or
    Boeing collectively be held accountable for decisions you made or
    pressure you exerted on your team that led to minimizing pilot training
    and failing to disclose critical information in the rush to get these
    planes in the air?
        Answer. Boeing has recently made several high-level leadership
    changes to ensure that it has the right leadership going forward. As
    described in more detail in response to Question 4, Boeing has also
    made several structural changes to enhance the company's culture of
    safety and accountability. Several external reviews are ongoing. As
    those conclude, we will evaluate the results of those reviews and will
    not hesitate to hold individuals accountable, where appropriate.

        Question 3. In 2018, you received a $13 million dollar bonus, based
    in part on Boeing surpassing a three-year economic profit goal. Was any
    part of this goal and bonus based on the sales of the 737 MAX 8--which
    seems to have been rushed to the market? Have you given any of this
    bonus back?
        Answer. Mr. Muilenburg's 2018 compensation is publicly available in
    Boeing's annual proxy statement, which can be found at www.boeing.com.

        Question 4. Please detail the changes recommended by the FAA and
    other reviewing entities that will be incorporated into Boeing's other
    product lines and planes like the Boeing 737 MAX 10?
        Answer. Boeing is taking into consideration the recent
    recommendations of a number of reviews, and making improvements to
    Boeing internal processes as they relate to how we evaluate new
    airplane system design. Boeing continues to review additional reports
    and reviews as they are completed, and will continue to incorporate
    lessons from those reviews.
        Based on the recommendation of a special board committee, Boeing is
    also making several changes to our organization and processes designed
    to enhance safety culture of the company. These changes include:

      (1)  Creating a permanent Aerospace Safety Committee within our Board
            of Directors to oversee and ensure safe design, development,
            manufacture, maintenance, and delivery of our products and
            services;

      (2)  Creating a Product and Services Safety organization to review
            all aspects of product safety;

      (3)  Realigning the Engineering function within the company, so that
            engineers across Boeing will report directly to the Chief
            Engineer;

      (4)  Establishing a design requirements program to further facilitate
            the incorporation of historical design materials, data and
            information, best practices, lessons learned, and detailed
            after action reports to reinforce Boeing's commitment to
            continuous improvement;

      (5)  Enhancing our Continued Operational Safety Program to aid
            transparency and visibility of safety related issues; the
            Continued Operational Safety Program now will require the Chief
            Engineer's review of all safety and potential safety reports;

      (6)  To anticipate the needs of future pilot populations, re-
            examining assumptions about flight deck design and operation in
            partnership with our airline customers and industry members;

      (7)  Expanding our Safety Promotion Center for employees to learn and
            reflect on our safety culture and renew personal commitments to
            safety;

      (8)  Expanding our anonymous safety reporting system to strengthen
            safety management systems within Boeing and our supply chain;

      (9)  Investing in new capabilities, including enhanced flight
            simulation and computing, and advanced R&D for future flight
            decks, as well as pilot and maintenance technician training and
            STEM education.
                                     ______

      Response to Written Questions Submitted by Hon. Tammy Duckworth to
                               Dennis Muilenburg
        During the October 29th hearing, I asked the Chairman of the
    National Transportation Safety Board (NTSB) whether he concurred with
    my view that, ``The most reliable initial human response to an
    uncommanded nose down dive is to pull back on the yoke.''
        Chairman Sumwalt provided the following response:

            ``Yes, I do. I have actually looked at the procedure and it
            says to grasp and to hold it firmly but as you know as an
            experienced pilot, your natural reaction would in fact if it is
            going in a direction you do not intend it to, you would tend to
            oppose it, which you should. In the older models of the Boeing
            aircraft that I flew, the 727 and 737, that would engage the
            stabilizer brake and stop the stab from running. But as you
            pointed out in the earlier round, it will not do that when MCAS
            is active on the 737 MAX.''

        I submitted the following written question to The Boeing Company on
    May 17, 2019:

            ``What does Boeing believe is the natural human reaction to
            stop a nose down trim command runaway?''

        Boeing's written response failed to address what Boeing believes
    the ``natural human reaction is to stop a nose down trim command
    runaway'' and cited the steps of the Runaway Stabilizer Non-normal
    checklist.

        Question 1. Yes or no, does Boeing concur with the view that human
    factors have proven that the most reliable initial human response to a
    runaway horizontal stabilizer movement trimming airplane nose-down is
    to oppose the motion by pulling back on the yolk? Please explain your
    answer.
        Answer. Boeing is not aware of specific research that addresses the
    issue as presented by the question. Flight crews may use the control
    column, the pitch trim switches, or a combination of both to control
    the flight path of the airplane in the presence of an uncommanded nose-
    down stabilizer movement.
        Pursuant to FAA guidance, Boeing's design assumes that pilots will
    take immediate action to reduce or eliminate short-term forces that
    cause an aircraft to deviate from its intended flight path. Based on
    that assumption and Boeing's expertise, the reaction to nose-down
    stabilizer movement is to control the flight path of the airplane using
    the methods available, including use of the control column and electric
    trim switches.

        Question 2. If the answer to Question 1 is ``No,'' please confirm
    whether Boeing concurs with the view that human factors have proven
    that the most reliable initial human response to a runaway horizontal
    stabilizer movement trimming airplane nose-down is to use both aft
    column motion and the column trim switch to quickly stop the runaway
    stabilizer and restore trim? Please explain your answer.
        Answer. Based on Boeing's expertise, the reaction to nose-down
    stabilizer movement is to control the flight path of the airplane. In
    the 737 MAX, the use of aft column motion, or the column trim switches,
    or both, could typically be used by a pilot to control the flight path
    of the airplane.

        Question 3. Yes or no, does Boeing concur that for the 707, 727,
    737 (except for the MAX), 747, 757 and 767 aircraft, many safe flight
    hours demonstrate that in non-normal conditions where a uncommanded
    stabilizer trim movement is causing a nose-down dive, pilots will
    reliably respond with aft column travel to both trigger the aft column
    cutout switch to quickly stop the runaway stabilizer movement and
    prevent significant mistrim, and command sufficient airplane nose-up
    elevator to exactly offset the stabilizer mistrim? Please explain your
    answer.
        Answer. The established procedure for responding to uncommanded
    stabilizer trim movement causing nose down mistrim is contained in the
    Runaway Stabilizer Non-Normal Checklist. This procedure does not direct
    pilots to use ``aft column travel'' to address the mistrim condition;
    rather, it directs pilots to hold the control column firmly, disengage
    the autopilot and autothrottle, and then control the pitch attitude of
    the aircraft manually using the control column or main electric trim,
    as needed. If the runaway continues, it directs pilots to disable
    electric trim by use of the aisle stand cutout switch. These steps are
    designed to assist the flight crew in controlling the flight path of
    the airplane.

        Question 4. Yes or no, does Boeing concur with the view that for
    approximately 60 years of service, across the 707, 727, 737 (except for
    the MAX), 747, 757 and 767 aircraft, column cutout switches have
    enabled pilots to quickly stop the runaway stabilizer movement using
    column motion only? Please explain your answer.
        Answer. For many Boeing models, the column cutout switch is one
    method that may address a runaway stabilizer movement. However, the
    memory item procedures contained in the Runaway Stabilizer Non-Normal
    Checklist, which flight crews are required to learn and memorize, do
    not include engaging the aft column cutout switch for either the 737 NG
    or the 737 MAX.

        Question 5. Yes or no, does Boeing concur with this statement:

            ``For every Boeing airplane until the 737 MAX, uncommanded
            stabilizer runaway is stopped by column motion only. But for
            the MAX, with MCAS malfunction, the pilot has to also apply
            manual electric trim within the same three second window?''

        Please explain your answer.
        Answer. No. On all Boeing airplanes there are possible stabilizer
    failures where column motion alone may not arrest the failure. The
    procedure in the Flight Crew Operations Manual for arresting an
    uncommanded stabilizer runaway on the Boeing 737 NG, as well as the
    MAX, is the Runaway Stabilizer Non-Normal Checklist. That checklist
    directs pilots that steps beyond column motion alone may be required to
    arrest a runaway stabilizer.
        In addition, Boeing assumes the ``three second window'' described
    in the statement refers to FAA regulations, including FAA Circular 25-
    7C (now Circular 25-7D), that allows manufacturers to assume, in
    certain types of testing, that flight crews will not react to a
    potential hazard for up to three seconds. That guidance relates to the
    time a manufacturer should assume will pass before the flight crew
    begins reacting to a hazard, not the time required to complete
    corrective action.

        Question 6. Yes or no, prior to the 737 MAX series aircraft, did
    the Speed Trim System bypass the aft column cutout switch on the 737 NG
    or any earlier versions of the 737 that included the Speed Trim System?
        Answer. The speed trim systems on the 737 NG and earlier versions
    of the 737 do not have the aft column cutout bypass feature. That
    feature was introduced with the MCAS function, and the speed trim
    systems on the 737 NG and earlier versions of the 737 airplane do not
    include the MCAS function.

        Question 7. On almost any other Boeing aircraft, it would be
    reasonable to expect a pilot to react instantly to uncommanded
    stabilizer trim motion in manual flight. However, as installed on the
    737 aircraft, the Speed Trim System has desensitized pilots to
    stabilizer trim motion in manual flight. In speaking with 737 pilots, a
    few confirmed that the feel and sound of the Speed Trim System moving
    the stabilizer is normal and something a 737 pilot would be accustomed
    to in manual flight.
        Given that the 737 aircraft appears to be the only Boeing aircraft
    where an augmentation system exists that results in stabilizer trim
    motion in manual flight, what analysis or evidence did Boeing rely on
    to justify its assumption that a 737 MAX pilot would instantly react to
    stabilizer trim motion in manual flight caused by MCAS activation?
        Answer. Automated flight controls that move flight surfaces during
    manual flight are not unique to the 737. For the 737, during manual
    flight, the assumption of pilot recognition is predicated on an
    increase in column forces or deviation from the intended flight path.
    FAA regulatory guidance, including Advisory Circular 75-7C, allows
    manufacturers to assume that a flight crew will seek to offload
    unexpected column forces.

        Question 8. On October 30, 2019, you publicly stated, ``The
    original concept from a safety standpoint was to build the MCAS, extend
    the current Speed Trim System of the previous generation of the 737,
    that's a system that had about 200 million safe flight hours on it.''
        For those 200 million safe flight hours on the Speed Trim System
    that you referenced, did the aft column cutout switch enable pilots to
    use column motion only to quickly stop the runaway stabilizer, prevent
    significant mistrim, and preserve sufficient elevator authority to
    restore the trim efficiently?
        Answer. As explained in response to question 5, on all Boeing
    airplanes there are possible stabilizer failures where column motion
    alone may not arrest the failure. Boeing's procedures for responding to
    a runaway stabilizer do not include engaging the aft column cutout
    switch.

        Question 9. One of Boeing's safety principles is to take safe
    systems, such as the Speed Trim System, and then incrementally extend
    them. Presumably, this was the concept behind Boeing's decision to add
    the MCAS flight control law to the existing Speed Trim System. However,
    it appears that MCAS did not represent an extension of the Speed Trim
    System, but rather, MCAS activation must, and does, disable a long-
    standing safety function: the aft column cutout switch.
        Please explain whether the decision to add a new flight control law
    (MCAS) to the Speed Trim System that bypasses the aft column cutout
    switch is consistent with Boeing's concept of incrementally extending
    an existing safety system.
        Answer. In designing MCAS for the 737 MAX, the decision to bypass
    the aft column cutout switch was consistent with safe and sound design
    principles, and relied on well-established, industry-wide assumptions
    and long-standing FAA guidance. In addition, as previously explained,
    engaging the aft column cutout switch was not a part of the memory
    procedure for addressing a runaway stabilizer.

        Question 10. Yes or no, does Boeing concur that MCAS bypassing the
    aft column cutout switch undermined Boeing's assumptions that limited
    mistrim to 0.6 units and assumed sufficient elevator authority would
    always be preserved? Please explain your answer.
        Answer. No. MCAS's design has always included bypassing the aft
    column cutout switch. When MCAS's design was changed to include
    operation at lower speeds, Boeing subject matter experts--including
    both engineers and experienced pilots--conducted a targeted assessment
    of the potential hazards posed by MCAS's greater stabilizer authority
    at low speeds. In performing this assessment, Boeing's experts applied
    their engineering judgment and piloting experience to the existing
    safety analysis and data for the earlier MCAS design, and also
    considered new performance data generated through piloted simulator
    testing and computer analysis of MCAS's operation at low speeds.
    Boeing's subject matter experts concluded that the updated version of
    MCAS, which still included the aft column cutout switch bypass, met all
    applicable requirements.

        Question 11. Please identify the specific compensating safety
    features Boeing installed in response to MCAS activation bypassing the
    aft column cutout switch or confirm that Boeing did not develop a
    specific compensating safety feature to bypassing aft column cutout.
        Answer. On the 737 MAX, pilots had the ability to counteract the
    effects of MCAS through use of the control column and the electric trim
    switches, or to disable MCAS through use of the aisle stand cutout
    switches. As previously stated, the memory procedure appropriate for
    responding to a runaway stabilizer did not include engaging the aft
    column cutout switch.

        Question 12. Please explain how Boeing demonstrated that when the
    737 MAX MCAS flight control law is activated during manual flight, the
    MAX series aircraft complies with Section 25.255 of Title 14, Chapter
    I, Subchapter C, Part 25, Subpart B, of the Code of Federal Regulations
    (14 CFR Sec. 25.255: Out-of-trim characteristics), despite MCAS
    activation bypassing the aft column cutout switch and tripling the stab
    trim rate.
        Answer. MCAS moves the stabilizer at a rate based on the speed of
    the airplane. Its maximum stabilizer authority is 0.27 degrees/second.
    This rate is 35 percent greater than the rate at which the pilot can
    move the stabilizer using manual electric trim when flaps are up, and
    less than the rate that the pilot can move the stabilizer using manual
    electric trim when flaps are down.
        Title 14, Code of Federal Regulations, Section 25.255 defines
    acceptable maneuvering stability and dive recovery requirements for
    out-of-trim conditions. The magnitude of the out-of-trim condition is
    defined by a three second movement of the stabilizer at its normal no-
    load rate. The 737 MAX meets the required characteristics with the
    mistrim that results from a three second movement of the stabilizer at
    the flaps up trim rate. Boeing also tested a magnitude of mistrim that
    was greater than would occur from a three second movement of the
    stabilizer at the flaps up trim rate and found that MCAS met all
    applicable regulatory requirements.

        Question 13. Please confirm that between October 29, 2018 and March
    10, 2019, Boeing conducted tests in a 737 MAX simulator to observe how
    a pilot--without knowledge of MCAS--responds when he or she realizes
    that Step One of the Runaway Stabilizer procedure (hold the control
    column firmly to counter the nose-down trim command of the horizontal
    stabilizer) does NOT automatically stop MCAS from repeated activations.
    If Boeing did not conduct such a test, please provide Boeing's
    justification for this course of action.
        Answer. In the relevant time frame, Boeing did conduct extensive
    testing of pilot response to repeated MCAS activation. If a pilot only
    maintains control of the flight path of the airplane through use of the
    control column to counter MCAS's nose-down trim, MCAS, as designed and
    installed on the MAX, will not activate multiple times. MCAS will only
    reactivate if the flight crew uses electric trim. Thus, the described
    condition was not tested because it was not a possible failure mode of
    the MCAS design.

        Question 14. Yes or no, does Boeing concur that because of the aft
    column cutout switch, a Boeing 737 NG pilot, following the Runaway
    Stabilizer Non-Normal procedure, would be accustomed to, and expect,
    column motion (and only column motion) to quickly stop an uncommanded
    runaway stabilizer trimming in opposition to the column motion and
    ensure the elevator remains effective? Please explain your answer.
        Answer. No. The Runaway Stabilizer Non-Normal Checklist for the 737
    NG directs pilots to hold the column steady, disengage the autopilot,
    and to control the airplane pitch attitude manually or, as needed, with
    the use of the trim switches on the control column; it does not direct
    flight crews to apply column force until the aft column cutout switch
    engages.

        Question 15. Several of Boeing's critical assumptions appear to be
    grounded in the expectation that because the Runaway Stabilizer Non-
    Normal procedure is identical for both the 737 NG and 737 MAX, pilots
    flying the 737 MAX should have been prepared to respond to a flight
    condition caused by repeated MCAS activations resulting from a single
    erroneous AOA sensor input exactly as they would respond to a runaway
    stabilizer on the 737 NG. Yet, Boeing was clearly aware that on the 737
    MAX, MCAS activation bypasses the aft column cutout switch and triples
    the stab trim rate.
        Prior to JT610 and ET302, did Boeing inform 737 MAX pilots that the
    aft column cutout switch is bypassed in the 737 MAX and thus column
    alone will not always stop the uncommanded stabilizer trim movement?
        Answer. As noted in the response to Question 14, the aft column
    cutout switch is not identified in the memory procedure for uncommanded
    stabilizer motion. Consistent with the established regulatory process,
    the development of the training requirements and manuals for the MAX
    was a complex, multi-year effort that involved close coordination
    between Boeing and the FAA. Many items were considered for inclusion,
    including MCAS, and the content of the manuals and training evolved
    over time, as is common. Ultimately, relying on the professional
    judgment of those involved in this process, Boeing proposed, and the
    FAA agreed, not to include a description of MCAS in the final version
    of the Flight Crew Operations Manual for the MAX.

        Question 16. The Federal Aviation Administration's Emergency
    Airworthiness Directive (AD) 2018-23-51 issued on November 7, 2018, was
    intended to prevent a catastrophic crash resulting from repeated MCAS
    nose-down trim commands of the horizontal stabilizer caused by an
    erroneously high single angle of attack sensor input. However,
    publishing AD 2018-23-51 failed to prevent ET302.
        Following its publication, did any Boeing employee, or employee of
    a Boeing contractor, express concerns related to AD 2018-23-51?
        Answer. Boeing maintain an Employee Issue Tracking System, a
    single, common system for entering and tracking employee issues and
    complaints. Boeing has searched EITS and located no records indicating
    an employee or contractor raised concerns with AD 2018-23-51 to Boeing
    after it was issued.

        Question 17. How many occurrences of AoA malfunction (erroneous
    high angle reading) have occurred across Boeing aircraft models without
    significant incident prior to the JT610?
        Answer. Boeing's records indicate there have been 35 total events
    of erroneous Angle of Attack data and stick shaker across the Boeing
    fleet since 1998. Of those events, 26 occurred on 737 NGs. All 35
    flights resulted in continued safe flight and landing. There have been
    more than 220 million departures in that timeframe.

        Question 18. On ET302, MCAS was activated at a high airspeed that
    appears to be far above any airspeed that MCAS should trigger. Why did
    Boeing decide not to constrain MCAS authority to prevent it from
    triggering at high airspeeds significantly above any level where MCAS
    may be safely activated?
        Answer. MCAS was initially designed to give the 737 MAX specific
    handling qualities during certain high speed maneuvers, and thus was
    intended to be active at high airspeeds. Boeing does not intentionally
    engineer a system to change the handling characteristics of the
    airplane in unexpected or uncommon situations, as such a design would
    introduce significant safety risks.

        Question 19. Please describe in detail the flight condition where
    75 degrees is a valid angle of attack value.
        Answer. Boeing is unaware of any normal flight condition where a
    plane would have a 75 degree angle of attack. However, as Boeing
    detailed in our response to your May 17, 2019 letter, Boeing's air data
    inertial reference unit does not artificially limit the data from its
    sensors.

        Question 20. Please explain why Boeing failed to note that MCAS
    activation in manual, flaps up flight, bypasses the aft column cutout
    switch in the Boeing Multi-Operator Message (MOM-MOM-18-0664-01B) sent
    in November 2018.
        Answer. Boeing's Multi-Operator Message is consistent with the
    procedures described in the Runaway Stabilizer Non-Normal Checklist.
    These Checklist procedures are also discussed at length in Boeing's
    Operations Manual Bulletin and the FAA's Airworthiness Directive issued
    after the Lion Air accident. These are the appropriate procedures to
    respond to erroneous uncommanded stabilizer trim movement (including
    erroneous MCAS activation), and they do not include engaging the aft
    column cutout switch.

        Question 21. Please explain why Boeing failed to note that the
    flight crew must use column trim switch or stabilizer aisle stand
    cutout switches to override MCAS input, and instead used the following
    more passive terminology: ``The system is designed to allow [emphasis
    added] the flight crew to use column trim switch or stabilizer aisle
    stand cutout switches to override MCAS input?''
        Answer. As noted in response to the previous question, Boeing's
    Multi-Operator Message was consistent with the procedures in the
    Runaway Stabilizer Non-Normal Checklist. In addition, it would have
    been incorrect to state that use of the column trim switch or aisle
    stand cutout switch is required to override MCAS input. Because MCAS
    input can be overridden solely by use of the control column in some
    circumstances, use of the electric trim or aisle stand cutout switches
    may not be necessary to override MCAS in those circumstances.

        Question 22. Please share with the Committee any Boeing
    communications sent after JT610 emphasizing the critical importance of
    using manual electric trim to oppose MCAS because aft column cutout
    switch is bypassed.
        Answer. Please see the response to question 20.

        Question 23. Following JT610 and prior to ET302, why did Boeing
    fail to immediately disable MCAS?
        Answer. The MCAS software is an integrated part of the flight
    control system for the MAX as certified by the FAA and cannot be
    ``disabled'' per se. Following JT610, Boeing worked with the FAA to
    establish a plan to revise the MCAS software to eliminate the risk of
    erroneous AOA data leading to repeated MCAS activation.
        On November 6, 2018, a Boeing Safety Review Board (``SRB'')--
    Boeing's established process for evaluating in-service safety issues--
    determined that the crew workload effects of erroneous AOA input
    leading to activation of the MCAS function presented a safety issue,
    and also determined that appropriate pilot action could counteract the
    condition. That same day, Boeing issued an Operations Manual Bulletin
    (``OMB'') to the fleet calling attention to the airplane effects and
    flight deck indications of the condition, and directing flight crews to
    existing procedures to address it. Boeing also moved forward
    expeditiously to develop an update to the MAX's flight control computer
    software to eliminate the risk of erroneous AOA data leading to
    repeated MCAS activation.
        On November 7, 2018, a day after Boeing issued its OMB, the FAA
    issued an Emergency Airworthiness Directive (``AD'') requiring airlines
    to amend their Airplane Flight Manuals to include the OMB guidance. The
    FAA also convened multiple Corrective Action Review Board (``CARB'')
    meetings--the FAA's analog to Boeing's SRB process--starting in late
    November to evaluate issues relating to the airplane effects of
    erroneous AOA data and MCAS activation. Relying on the FAA's
    independent risk analysis, the CARB process largely concurred with
    Boeing's analysis of the safety issue and proposed risk mitigation
    approach. Referencing the FAA's independent risk analysis, an FAA CARB
    concluded in December 2018 that, as development of the software update
    proceeded, the MAX fleet could continue operating until the new
    software was implemented on the FAA-approved schedule.

        Question 24. Following JT610 and prior ET302, why did Boeing fail
    to immediately seek to fix MCAS based on a HAZARDOUS malfunction?
        Answer. As described above in response to Question 23, following
    the crash of JT610, Boeing immediately followed its safety process to
    determine the appropriate response. As a result of that process, Boeing
    took steps in conjunction with the FAA to develop and implement a
    software update to the flight control computer in order to eliminate
    the risk of erroneous AOA data leading to repeated MCAS activation. The
    FAA determined that Boeing should implement the software update more
    quickly than Boeing originally proposed, and Boeing accepted the FAA's
    schedule.

        Question 25. Given the centrality of the Speed Trim System to these
    matters, please address the following questions:

       Yes or no, is the implementation of the Speed Trim System on
            the Boeing 757 fail-safe, dual-input and dual-processor design
            with aft column cutout switch active?

       Yes or no, is the implementation of the Speed Trim System on
            the Boeing 747-400 fail-safe, dual-input and dual-processor
            design with aft column cutout switch active?

       Yes or no, is the implementation of the Speed Trim System on
            the Boeing 737-700 fail-safe, dual-input and dual processor
            design with aft column cutout switch active?

       If the answer to any of the above three questions is ``no,''
            please provide a detailed explanation.

        Answer. The Speed Trim System as currently implemented on all the
    listed models meets all regulatory requirements, and ensures any single
    failure of the system does not affect the ability of the aircraft to
    maintain safe flight and landing. The design for each model is dual-
    processor, but it is not dual-input. The aft column cutout switch is
    active in each design, though the amount of movement required to
    activate it varies between models.

        Question 26. Yes or no, even though the 737 Speed Trim System is a
    single threaded design augmentation system that has full control of the
    stabilizer, does the 737 Speed Trim System survive without greater
    hazard classification because active aft and forward column cutout
    switches constrain malfunction?
        Answer. Hazard classifications are applied to particular failure
    modes of a system, not the system itself. There are failure modes of
    the Speed Trim System (STS), such as a stabilizer runaway driven by the
    flight control computer, which can be mitigated by the column cutout
    switches. However, other failure modes of the STS do not rely on those
    switches for mitigation. The classification of each hazard depends on
    the specific circumstances of that failure. None of the hazard
    assessments for MCAS relied on engaging the aft column cutout switch.

        Question 27. One of your primary competitors appears to require
    testing the angle of attack sensor reading at 80 to 100 knots in the
    takeoff roll when the relative wind reliably aligns the vane to the
    expected angle of incidence. Will Boeing upgrade Flight Crew Operating
    Manuals to require such a test during the takeoff roll?
        Answer. No. Boeing airplanes already electronically conduct similar
    checks. The results of those checks are captured and documented to
    ensure they are addressed by maintenance personnel. With the upgrades
    to MCAS that will be implemented as part of return to service, if the
    two AOA vanes on the 737 MAX disagree by more than 5.5 degrees, MCAS
    will be disabled for the remainder of the flight and pilots will be
    alerted that speed trim is inoperative. Boeing is continually working
    to develop ways to increase safety during all phases of flight,
    including takeoff.

        Question 28. On May 17, 2019, I submitted the follow oversight
    question to the Boeing Company:

            ``On what date did Boeing first provide the Flight
            Standardization Board (FSB) with information on the addition of
            the Maneuvering Characteristics Augmentation System (MCAS)
            flight control law to the 737 MAX series aircraft to comply
            with Federal Regulation 25.203--Stall characteristics,
            paragraph (a)?''

        Boeing provided the following response:

            ``Boeing briefed FAA personnel involved in the FSB process for
            the 737 MAX about MCAS at least as early as 2012. In the spring
            of 2014, Boeing and the FAA began more formal discussions about
            how the FSB process for the 737 MAX would proceed. During this
            time, Boeing provided the FAA technical briefings on MCAS among
            other aspects of the evolving airplane design. Following the
            process set forth in FAA guidance, in February 2015 Boeing
            submitted a preliminary draft of the Master Differences
            Requirements and Design Operator Differences Requirements (ODR)
            tables to the FAA for evaluation. Boeing included MCAS as one
            of dozens of airplane features in the draft ODR table.''

        I also posed this question to Boeing:

            ``Please confirm whether Boeing ever recommended that the FSB
            evaluate the differences between the Speed Trim System (STS) in
            the 737 NG series and the STS in 737 MAX series that also has
            MCAS installed, and if so, the earliest date upon which Boeing
            advised the FSB to evaluate MCAS when conducting the
            differences assessment.''

        Boeing provided the following response:

            ``As explained in the response to Question #1, Boeing briefed
            FAA personnel involved in the FSB process about MCAS at least
            as early as 2012. MCAS is an extension of the pre-existing
            Speed Trim function, which helps stabilize airplane speed by
            commanding stabilizer in the direction to oppose a speed
            change, and which has been used safely on 737 series airplanes
            for decades. Following a series of technical briefings on MCAS
            and other airplane features in 2014, in February 2015 Boeing
            submitted a preliminary draft of the Master Differences
            Requirements and Design Operator Differences Requirements (ODR)
            tables to the FAA for evaluation. Boeing included MCAS as one
            of dozens of airplane features in the draft ODR table.
            Ultimately, the versions of the FSB report that the FAA posted
            for public comment and finalized in 2017 did not include MCAS
            in the ODR table.''

        Please explain why Boeing chose not to use either response as an
    opportunity to share with my office the fact that Boeing proposed
    removing MCAS from the ODR table.
        Answer. As we stated in response to Question No. 1 on May 17, 2019,
    MCAS was included in the preliminary procedures and ODR tables that
    were sent to the FAA in February 2015. Boeing recommended removal of
    MCAS from the ODR Table in March 2016 and FAA agreed with Boeing's
    recommendation. Boeing exchanged multiple drafts of the ODR Table with
    the FAA throughout 2016 and 2017 and the versions of the FSB report
    that the FAA posted for public comment and finalized in 2017 did not
    include MCAS in the ODR Table.

        Question 29. Beyond MCAS, what other issues related to aircraft
    systems worry you and require improvement? For example, is Boeing
    planning to make the Speed Trim System fail-safe on the 737 NG?
        Answer. Boeing is continually evaluating the performance of its
    aircraft. As part of that process, Boeing identifies appropriate
    enhancements to those aircraft, and will continue to do so. The Speed
    Trim System as currently implemented meets all regulatory requirements,
    and any single failure of the system does not affect the ability of the
    aircraft to maintain safe flight and landing.
                                     ______

       Response to Written Questions Submitted by Hon. Kyrsten Sinema to
                               Dennis Muilenburg
        The Boeing 737 Max 8 received a derivative type certificate from
    the FAA, which was based on the original type certificate the Boeing
    737-100 from 1967.
        The original 737-100 was a very different aircraft. It was 94 feet
    long, carried 115 passengers, required three pilots, and had a maximum
    takeoff weight of 42,000 kilograms. The current versions of the 737 MAX
    can be up to 50 percent longer, carry twice as many passengers, and
    have double the maximum takeoff weight.
        The FAA states that getting an amended type certificate can take up
    to 5 years, but a new type certificate, which is a more detailed
    analysis, can take up to 9 years.

        Question 1. Based on the significant changes in the aircraft since
    1967, do you believe that an amended type certificate was appropriate
    for the Boeing 737 Max 8? And going forward, do you believe FAA should
    limit the number of times an aircraft design can be amended before a
    new type certificate is required?
        Answer. An amended type certificate was appropriate for the Boeing
    737 MAX 8. Building upon existing, safe designs with a proven track
    record has continuously improved the safety record of the aviation
    industry for decades. As with all airplane development decisions, we
    make such decisions deliberately and methodically, after studying the
    current state of technology and opportunities for improving the
    existing airplane architecture, among many other factors.
        The FAA has robust regulations and processes for evaluating when an
    airplane should be a new or amended type certificate and what
    regulations to follow for each process. The MAX certification project
    followed these regulations. Setting an arbitrary limit on the number or
    timing of changes to an airplane does not advance the interest of
    safety.
        The United States has the best airline pilots in the world, and I
    believe the quality of our pilots is the reason that U.S. commercial
    aviation is the safest in the world.
        But all pilots, regardless of experience or nationality, need all
    the information about the aircraft to be able to make the right
    decisions.
        Boeing pilot manuals did not reference MCAS or describe an
    autonomous system to repeatedly lower the nose by 2.5 degrees. But
    Boeing's safety analysis expected pilots to be the primary backup for
    the system, if it failed. The pilots cannot be the backup for a system,
    if they aren't informed that the system exists, and it operates in the
    background without their knowledge.

        Question 2. Please explain Boeing's decision not to include MCAS in
    the pilot manual or pilot training, and discuss Boeing's future plans
    to fully inform pilots about background systems.
        Answer. In accordance with FAA regulatory guidance, flight training
    for all Boeing airplanes, including the 737 MAX, is designed to give
    pilots the knowledge, skills, and abilities necessary to safely operate
    each model on which they are licensed (or ``type-rated''). Rather than
    diagnose particular failures, flight training and manuals are designed
    to give pilots the knowledge, skills, and abilities necessary to safety
    respond to those failures.
        Boeing and the FAA coordinated closely over the course of several
    years in developing the necessary training requirements and flight
    manual content for the MAX. Since the accidents, the FAA and Boeing
    have worked together to develop additional MAX flight crew training, as
    well as flight manual content, that addresses the updates Boeing has
    made to MCAS. The inclusion of specific training and flight manual
    content on MCAS is consistent with the feedback Boeing has received
    from pilots and its customers, and reflects the additional knowledge
    and understanding that Boeing has gained as a result of these
    accidents.
        In designing aircraft, redundancy is key. The FAA requires aircraft
    systems that can cause hazardous or catastrophic failure to incorporate
    multiple levels of redundancy. This way, if FAA requirements are met,
    no single malfunction can lead to tragedy.
        However, the MCAS system on the Boeing 737 Max 8 had zero
    redundancy. A single faulty or damaged angle-of-attack sensor could
    cause the MCAS system to engage repeatedly, as was the case for the
    tragedies in Indonesia and Ethiopia.
        These disclosures are leading many to consider revisions to the
    FAA's Organization Designation Authorization (ODA) program. As you
    know, the FAA uses the ODA program to authorize organizations or
    companies to approve certain aspects of FAA aircraft certification.
        The DOT Special Committee is making recommendations on FAA
    certification, but I expect that Boeing has undertaken its own internal
    review of ODA and the necessary changes.

        Question 3. Based on the Boeing 737 Max 8 tragedies, what concrete
    revisions to the ODA program are required to ensure that only safe
    aircraft are certified to fly?
        Answer. Boeing strongly supports robust FAA oversight of the
    certification process. As the last major commercial airplane
    manufacturer in the United States, Boeing believes the certification
    process, and the FAA's role in that process, are vital to the safety of
    the traveling public, and have been an important factor driving
    substantial improvements in aviation safety in recent decades.
        The Organization Delegation Authority process has helped improve
    that safety record. However, there are ways to improve that process.
    For example, the FAA's System Oversight capability could be
    strengthened by setting clear expectations for applicants' processes
    and procedures to ensure compliance for lower risk areas, as identified
    by the FAA. This would allow FAA to dedicate the majority of its
    resources on areas the FAA has determined to be the highest safety
    risk. Boeing will work with all interested stakeholders to learn from
    these accidents and further increase aviation safety.
        During flight testing, Boeing increased the MCAS system from
    providing a 0.6 degree nose-down correction to a 2.5 degree nose-down
    correction--without FAA oversight.
        And according to reports, once MCAS was adjusted to provide a more
    powerful input, Boeing never flight-tested a scenario in which a broken
    angle-of-attack sensor triggered MCAS on its own, instead relying on
    simulator analysis.
        Former Boeing test pilots described a culture of pressure inside
    the company to limit flight testing, due to project delays. And in the
    text messages Boeing released last week, an employee stated: ``they're
    all so damn busy, and getting pressure from the program.''

        Question 4. Was there adequate flight testing of the revised MCAS
    system, and what will Boeing do to address schedule pressure to get
    aircraft certificated?
        The first tragic crash, involving Lion Air Flight 610, occurred on
    October 29, 2018. The second crash, involving Ethiopian Airlines Flight
    302, occurred five months later.
        Answer. The final MCAS design, including MCAS's operation at low
    speeds, was tested in flight tests, where multiple conditions involving
    the design were tested.
        Boeing has taken a number of steps to reinforce our safety culture.
    These include creating a permanent Aerospace Safety Committee within
    our Board of Directors, creating a Product and Services Safety
    organization to review all aspects of product safety, and realigning
    our Engineering function so that all engineers will report directly to
    the Chief Engineer. Moreover, pursuant to our Organization Delegation
    Authority, Boeing maintains robust procedures for ODA unit members to
    report incidents of undue pressure, and Boeing provides all employees
    multiple avenues to raise safety issues related to our products.

        Question 5. Why was the Boeing Max 8 not grounded after the Lion
    Air crash and prior to the second crash in Ethiopia? What information
    regarding the MCAS system did Boeing have prior to or immediately after
    the first crash that lead to concerns related to the Angle of Attack
    and MCAS system?
        Answer. Boeing does not have the authority to ground airplanes.
    Boeing does, however, provide civil aviation authorities and our
    airline customers with any relevant information we may receive or
    develop, so that they can make informed decisions on how to regulate
    aircraft operations.
        After the Lion Air crash, on Sunday, November 4, Indonesian
    authorities provided Boeing with data downloaded from the airplane's
    flight data recorder. That same day, Boeing convened an ``out-of-
    sequence'' Safety Review Board (``SRB'') to consider and analyze the
    available data. The SRB included subject matter experts from various
    backgrounds, including senior Boeing engineers, test pilots, and
    executives responsible for safety and regulatory matters. FAA
    representatives were also in attendance. After considering the limited
    information available, the SRB decided to defer a decision on the
    potential safety issue for two days to allow time for Boeing engineers
    and pilots to conduct further testing and analysis.
        The SRB, with most of the same members present, reconvened on
    November 6, 2018. The FAA was again in attendance. With the fuller
    information then available, including additional analysis by Boeing's
    technical experts and test pilot input, the SRB identified as a safety
    issue the increased crew workload that might result if erroneous AOA
    input led to repeated MCAS activation. Although a full quantitative
    analysis of the issue had not yet been completed, the SRB made this
    determination based on a preliminary risk assessment and in recognition
    of the importance of immediately addressing the concerns identified.
    The SRB further noted the importance of appropriate action by the
    flight crew to prevent and counteract repeated MCAS activation in this
    erroneous AOA scenario.
        That same day, Boeing issued an Operations Manual Bulletin
    (``OMB'') to the fleet calling attention to the airplane effects and
    flight deck indications of the condition, and directing flight crews to
    existing procedures to address it. Boeing also moved forward
    expeditiously to develop an update to the MAX's flight control computer
    software to eliminate the risk of erroneous AOA data leading to
    repeated MCAS activation.
        On November 7, 2018, a day after Boeing issued its OMB, the FAA
    issued an Emergency Airworthiness Directive (``AD'') requiring airlines
    to amend their Airplane Flight Manuals to include the OMB guidance. The
    FAA also convened multiple Corrective Action Review Board (``CARB'')
    meetings--the FAA's analog to Boeing's SRB process--starting in late
    November to evaluate issues relating to the airplane effects of
    erroneous AOA data and MCAS activation. Relying on the FAA's
    independent risk analysis, the CARB process largely concurred with
    Boeing's analysis of the safety issue and proposed risk mitigation
    approach--although the FAA did determine that that Boeing should
    implement the flight control computer software update more quickly than
    Boeing had originally proposed, an accelerated schedule the Company
    accepted. Re Referencing the FAA's independent risk analysis, an FAA
    CARB concluded in December 2018 that, as development of the software
    update proceeded, the MAX fleet could continue operating until the new
    software was implemented on the FAA-approved schedule.

        Question 6. And why did Boeing publish a supplementary service
    bulletin regarding the Angle of Attack sensors and MCAS, but did not
    take the aircraft out of service?
        Answer. Please see the response to the previous question. Boeing
    does not have the authority to ground airplanes. After the Lion Air
    accident and continuing to today, Boeing provides civil aviation
    authorities and our airline customers any relevant information we may
    receive or develop, so that they can make informed decisions on how to
    regulate aircraft operations.

        Question 7. Do you disagree with any of the findings in the
    National Transportation Safety Board in Aviation Safety Recommendation
    Report ASR-19-01 issued on September 19, 2019 titled ``Assumptions Used
    in the Safety Assessment Process and the Effects of Multiple Alerts and
    Indications on Pilot Performance'' or audit report AV-2016-013 the
    Inspector General of the Department of Transportation issued on January
    7, 2016 titled ``Enhanced FAA Oversight Could Reduce Hazards Associated
    With Increased Use of Flight Deck Automation?''
        Answer. Boeing is deeply committed to the safety of its products
    and the safety of the aviation system and values the role of the
    National Transportation Safety Board (NTSB), as well as the reviews of
    the Office of the Inspector General (OIG), in promoting aviation
    safety.
        Boeing has already undertaken steps that align with at least one of
    the NTSB's recommendations. The NTSB recommended that FAA require
    manufacturers to consider the way cockpit design can impact pilot
    reaction to alerts and alarms that may sound in non-normal situations.
    As a result of a recommendation from a special committee of Boeing's
    Board of Directors, the company is already planning to work with our
    airline customers to re-examine the way we design our cockpits, with
    the goal of helping pilots to prioritize their attention and their
    actions when faced with multiple alerts and alarms. Boeing is taking
    this step with the recognition that pilot training and experience can
    vary significantly in different regions of the world. Boeing will
    continue to work with the NTSB, as well as the FAA, to understand the
    scope of the NTSB's recommendations and the appropriate way to
    implement them.
        Boeing will also support the FAA as it implements the
    recommendations from the OIG audit report from January 7, 2016. This
    report recommends that the FAA develop new guidance for training and
    standards to determine whether pilots receive sufficient training
    opportunities to develop, maintain, and demonstrate manual flying
    skills. Boeing continues to support the FAA's Air Carrier Training
    Aviation Rulemaking Committee to discuss, prioritize, and provide
    recommendations to the FAA concerning these types of operations and
    training considerations.
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                           Hon. Robert L. Sumwalt III
        Question 1. Your testimony mentioned the inadequacy of the MCAS
    safety assessment in estimating the crew workload, since it is likely
    other alerts and indications would be activated simultaneously in the
    event of an MCAS failure.
        The National Transportation Safety Board (NTSB) recommended that
    the Federal Aviation Administration (FAA) instruct Boeing to better
    consider crew workload in the event of a system failure, including
    through the development of tools to improve the timeliness and
    effectiveness of crew responses.
        Do you believe that any of the recent organizational changes made
    by Boeing will help address this recommendation?
        Answer. The NTSB has not evaluated the recent organizational
    changes made by Boeing.

        Question 2. As you know, the aviation system is safer--and
    catastrophic incidents rarer--than ever before, but the complexity of
    aircraft flight control systems means that when failures do occur, it
    can be difficult for crew members to prioritize the appropriate and
    timely actions in response to that failure.
        How could system failure diagnostic tools be better designed to
    improve the threat and error management used by crew members in
    responding to system failures?
        Answer. The NTSB believes that aircraft systems designed to clearly
    and concisely inform pilots of the highest priority actions when
    multiple flight deck alerts and indications are present would minimize
    confusion and help pilots respond most effectively to emergency and
    abnormal operational events. By developing design standards for such
    system diagnostic tools, with the input of industry and human factors
    experts, we believe the timeliness and effectiveness of pilot response
    would be improved.
                                     ______

         Response to Written Questions Submitted by Hon. Tom Udall to
                           Hon. Robert L. Sumwalt III
        Question 1. The NTSB recommended that manufacturers use ``less
    experienced'' pilots to test advanced equipment. Are you aware of any
    resistance to this recommendation?
        The NTSB concluded that a standardized methodology and/or tools for
    manufacturers' use in evaluating and validating assumptions about pilot
    recognition and response to failure condition(s), particularly those
    conditions that result in multiple flight deck alerts and indications
    is needed. Based on this, the NTSB recommended that the FAA develop
    robust tools and methods, with the input of industry and human factors
    experts, for use in validating assumptions about pilot recognition and
    response to safety-significant failure conditions as part of the design
    certification process. We are not aware of any resistance to
    implementation of this recommendation.

        Question 2. The Boeing 737 made its first flight in 1967 and has
    applied for 14 model changes since that time. There have been calls for
    a complete recertification of the entire 737. Do you agree that the
    entire plane should be recertified?
        The NTSB does not have a position on this.
                                     ______

       Response to Written Question Submitted by Hon. Tammy Duckworth to
                           Hon. Robert l. Sumwalt III
        As you are aware, problems originating with a damaged or
    malfunctioning angle of attack (AOA) sensor are not limited to any
    single model of aircraft or manufacturer. Enhancing AOA sensors must be
    a priority for the entire aviation industry and regulatory system.
    Increasing awareness and improving knowledge represent critical tools
    in improving aviation safety.
        That is why I wrote to then-Acting Administrator Elwell on May 21,
    2019 to request that FAA publish a comprehensive advisory circular that
    standardizes guidance on best practices for manufacturing, operating,
    testing and maintaining AOA sensors, particularly the AOA wind vane
    component, to ensure effective compliance with all applicable
    regulatory requirements.
        Following the FAA's order revoking a repair station certificate
    from a firm that repaired and supplied the malfunctioning AOA sensor
    that contributed to the fatal crash of Lion Air Flight 610, I once
    again wrote to FAA Administrator Dickson to request that FAA publish a
    comprehensive advisory circular that standardizes guidance on best
    practices for manufacturing, operating, testing and maintaining AOA
    sensors, particularly the AOA wind vane component, to ensure effective
    compliance with all applicable regulatory requirements.
        Awareness and knowledge are critical tools in strengthening
    aviation safety.
        Question. Please address how the potential publication of the type
    of comprehensive advisory circular that I have requested would improve
    aviation safety.

            The NTSB has not issued any recommendations regarding design,
            manufacturing, operating, testing or maintaining of AOA sensors
            and therefore does not have a position on this matter.

            However, the Komite Nasional Keselamatan Transportasi (KNKT) of
            Indonesia has issued one related recommendation based on its
            investigation of the Lion Air 610 crash.\1\
    ---------------------------------------------------------------------------
        \1\ Komite Nasional Keselamatan Transportasi (KNKT), Final Report
    No. KNKT.18.10.35.04.

                    04.R-2018-35.22
                    The absence of equivalency assessment required by Xtra
                    Aerospace procedure and unavailability of procedure was
                    not detected by the FAA. This indicated inadequacy of
                    the FAA oversight.

                    Therefore, KNKT recommends that the FAA improves the
                    oversight to Approved Maintenance Organization (AMO) to
                    ensure the processes within the AMO are conducted in
                    accordance with the requirements.
                                     ______

         Response to Written Questions Submitted by Hon. Tom Udall to
                            Hon. Christopher A. Hart
        Question 1. Chairman Hart, in the JATR report, there was discussion
    of the undue pressure placed on employees at Boeing to pressure to
    employees get the plane certified without any new pilot training or
    delay. Boeing has said it is restructuring its units, and safety
    engineers will no longer be required to report directly to a business
    unit manager. Do you believe this change will relieve some pressure on
    employees?
        Answer. Because of concerns about potential undue influence, the
    JATR recommended that the FAA review its certification process, as well
    as Boeing's Organization Designation Authorization (ODA) procedures and
    work environment, to ensure that there is no undue pressure (e.g.,
    Recommendation 5). Whether a specific substantive change will be
    helpful is beyond the purview of the JATR because it completed its
    review when it submitted its recommendations to the FAA, and it was
    chartered to review the certification process rather than specific
    substantive changes. I am not in a position to opine about the
    effectiveness of specific proposed substantive changes.

        Question 2. Are there other changes that Boeing should make?
        Answer. The JATR's recommendations were addressed to the FAA, not
    to Boeing, and were about how the FAA could improve its certification
    process. Although the JATR's improvement recommendations included
    recommendations to the FAA to review Boeing's processes and procedures,
    the JATR was chartered to review the certification process rather than
    specific substantive changes. Examples of Boeing's processes and
    procedures that the JATR recommended the FAA should review include Rec
    5 (ODA work environment and procedures manual), Rec 8.1 (development
    assurance process), Rec 8.2 (safety analysis process), Rec 8.4 (process
    for managing assumptions), and Rec 8.6 (process for managing
    requirements).

        Question 3. How can we ensure that pilots are fully prepared for
    the high-levels of automation in today's cockpits?
        Answer. The JATR's recommendations address two aspects of helping
    to optimize airplane/pilot interactions. First, the recommendations
    address ways that the certification process can help ensure that
    aircraft systems are designed to be adequately pilot-friendly, e.g.,
    Rec 2.2, Rec 2.4, Rec 2.7, Rec 2.8, Rec 2.9, Rec 3.8, Rec 3.16, Rec
    3.17, Rec 6.1, Rec 6.2, Rec 6.3, Rec 6.4, Rec 6.6, Rec 6.8, Rec 6.9,
    Rec 6.10, Rec 7.1, Rec 7.2, Rec 8.8, Rec 9.6, and Rec 9.7. Second, the
    recommendations address ways that the certification process can help
    ensure that, upon completion of the design, pilots are aware of, and
    adequately trained regarding, the aircraft automation and other
    systems, e.g., Rec 3.9, Rec 3.11, Rec 3.14, Rec 9.1, Rec 9.2, Rec 9.3,
    Rec 9.4, Rec 10.2, Rec 10.3, Rec 10.4, Rec 10.5, and Rec 12.2.

                                  [all]