[Senate Hearing 116-616]
[From the U.S. Government Publishing Office]
S. Hrg. 116-616
AVIATION SAFETY AND THE FUTURE
OF BOEING'S 737 MAX
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
OCTOBER 29, 2019
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online: http://www.govinfo.gov
______
U.S. GOVERNMENT PUBLISHING OFFICE
52-795 PDF WASHINGTON : 2023
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
ROGER WICKER, Mississippi, Chairman
JOHN THUNE, South Dakota MARIA CANTWELL, Washington,
ROY BLUNT, Missouri Ranking
TED CRUZ, Texas AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska RICHARD BLUMENTHAL, Connecticut
JERRY MORAN, Kansas BRIAN SCHATZ, Hawaii
DAN SULLIVAN, Alaska EDWARD MARKEY, Massachusetts
CORY GARDNER, Colorado TOM UDALL, New Mexico
MARSHA BLACKBURN, Tennessee GARY PETERS, Michigan
SHELLEY MOORE CAPITO, West Virginia TAMMY BALDWIN, Wisconsin
MIKE LEE, Utah TAMMY DUCKWORTH, Illinois
RON JOHNSON, Wisconsin JON TESTER, Montana
TODD YOUNG, Indiana KYRSTEN SINEMA, Arizona
RICK SCOTT, Florida JACKY ROSEN, Nevada
John Keast, Staff Director
Crystal Tully, Deputy Staff Director
Steven Wall, General Counsel
Kim Lipsky, Democratic Staff Director
Chris Day, Democratic Deputy Staff Director
Renae Black, Senior Counsel
C O N T E N T S
----------
Page
Hearing held on October 29, 2019................................. 1
Statement of Senator Wicker...................................... 1
Statement of Senator Cantwell.................................... 3
Statement of Senator Thune....................................... 13
Statement of Senator Klobuchar................................... 15
Statement of Senator Fischer..................................... 16
Statement of Senator Blumenthal.................................. 18
Poster submitted by Hon. Richard Blumenthal entitled, ``MCAS
lives in both FCCs''....................................... 20
Statement of Senator Moran....................................... 21
Statement of Senator Peters...................................... 23
Statement of Senator Capito...................................... 24
Statement of Senator Udall....................................... 26
Statement of Senator Markey...................................... 28
Statement of Senator Duckworth................................... 29
Report dated October 28, 2019 entitled, ``Flawed Assumptions
Pave a Path to Disaster'' by Peter Lemme................... 70
Statement of Senator Cruz........................................ 31
Poster submitted by Hon. Ted Cruz............................ 33
Statement of Senator Tester...................................... 33
Statement of Senator Johnson..................................... 35
Statement of Senator Rosen....................................... 37
Statement of Senator Blunt....................................... 39
Statement of Senator Blackburn................................... 40
Statement of Senator Scott....................................... 42
Statement of Senator Sullivan.................................... 43
Witnesses
Dennis Muilenburg, President And Chief Executive Officer, The
Boeing Company................................................. 5
Prepared statement........................................... 7
Hon. Robert L. Sumwalt III, Chairman, National Transportation
Safety Board................................................... 45
Prepared statement........................................... 46
Hon. Christopher A. Hart, Chairman, Joint Authorities Technical
Review (JATR).................................................. 58
Prepared statement........................................... 60
Appendix
Response to written questions submitted to Dennis Muilenburg by:
Hon. Roger Wicker............................................ 127
Hon. John Thune.............................................. 129
Hon. Jerry Moran............................................. 130
Hon. Maria Cantwell.......................................... 130
Hon. Amy Klobuchar........................................... 139
Hon. Richard Blumenthal...................................... 140
Hon. Tom Udall............................................... 143
Hon. Tammy Duckworth......................................... 144
Hon. Kyrsten Sinema.......................................... 150
Response to written questions submitted to Hon. Robert L. Sumwalt
III by:
Hon. John Thune.............................................. 153
Hon. Tom Udall............................................... 154
Hon. Tammy Duckworth......................................... 154
Response to written questions submitted to Hon. Christopher A.
Hart by:
Hon. Tom Udall............................................... 155
AVIATION SAFETY AND THE FUTURE
OF BOEING'S 737 MAX
----------
TUESDAY, OCTOBER 29, 2019
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10:06 a.m., in
room SH-216, Hart Senate Office Building, Hon. Roger Wicker,
Chairman of the Committee, presiding.
Present: Senators Wicker [presiding], Thune, Blunt, Cruz,
Fischer, Moran, Sullivan, Gardner, Blackburn, Capito, Johnson,
Young, Scott, Cantwell, Klobuchar, Blumenthal, Markey, Udall,
Peters, Baldwin, Duckworth, Tester, Sinema, and Rosen.
OPENING STATEMENT OF HON. ROGER WICKER,
U.S. SENATOR FROM MISSISSIPPI
The Chairman. This hearing will come to order. Thank you
all for being here today. One year ago, today, Lion Air Flight
610 crashed into the sea shortly after takeoff from Jakarta,
Indonesia. All 189 people onboard perished. Five months later,
Ethiopian Airlines Flight 302 departed Addis Ababa, Ethiopia.
Just like Lion Air Flight 610, Ethiopian Airlines Flight 302
experienced problems shortly after takeoff and crashed. All 157
persons onboard died. Both of these accidents were entirely
preventable.
We cannot fathom the pain experienced by the families of
those 346 human beings who were lost. Many family members are
here today, and we appreciate their attendance, and I
appreciate many of them meeting with members of the Committee
over time.
As Chairman of this Committee, I promise their loved ones
that we are working to obtain a full answer as to how to
prevent future tragedies. These families deserve answers,
accountability, and action--and the public deserves to know
this. The type of aircraft involved in both accidents is the
737 MAX 8 manufactured by Boeing. International aviation safety
regulators began grounding the MAX the day after the Ethiopian
crash.
On March 13, the Federal Aviation Administration formally
grounded the aircraft in the United States. The MAX's return to
service is contingent on Boeing's work with the FAA to test and
certify fixes to the MCAS flight-control system, which
activated during both crashes. In order for the MAX to return
to service, international regulators also need to be satisfied
that it is safe to fly. As the certification process continues,
many questions remain about Boeing's actions and the FAA's
actions during the design, development, and certification
processes, as well as the operation of the MAX.
Today's hearing is divided into two panels. Let me note for
Senators that the Committee will follow regular order of
recognition for both panels. The five-minute rule will be
observed strictly because we have so many people who wish to
participate. On the first panel, Dennis Muilenburg, President
and CEO of Boeing, will testify on behalf of the aircraft
manufacturer. He is accompanied by John Hamilton, Chief
Engineer for Boeing Commercial Airplanes, who will provide
technical expertise.
Our second panel will examine these issues from the
Government's perspective. The witnesses today include National
Transportation Safety Board Chairman Robert Sumwalt, and
Chairman of the Joint Authorities Technical Review, or JATR,
Chris Hart. Chairman Sumwalt oversees NTSB, which recently
released a report and recommendations regarding the MAX
certification. Chairman Hart led the JATR, an FAA-commissioned
body that included the FAA, NASA, and nine foreign aviation
safety authorities tasked with reviewing the MAX's flight
control systems.
The JATR has submitted a broad range of recommendations to
the FAA. Let me note that Chairman Hart has extensive past
Government service in aviation safety, but he is a private
citizen, today, who agreed to lead the JATR. We have many
concerns that Boeing should address today. We need to know if
Boeing and the FAA rushed to certify the MAX. In particular,
critics have focused on the MCAS development and testing. The
JATR criticized Boeing's communication with the FAA on MCAS's
development, particularly after the system was modified to
activate at lower airspeeds.
The JATR also criticized the FAA for relying on outdated
regulations, guidance, and certification procedures, and
failing to incorporate realistic human behavior factors into
its assumptions. The NTSB also called into question Boeing and
FAA's assumptions about pilot reaction during MCAS activation.
These questions were especially important for stressful
situations with multiple alerts going off in the cockpit.
Our witnesses should address the company and the safety
regulators' actions regarding MAX certification in general and
MCAS in particular. The process for certifying the MAX
necessitated a close partnership between Boeing and the FAA.
Under a decades-old system called Organization Designation
Authorization, or ODA, the FAA has delegated certain
certification activities to the ODA holder, in this case
Boeing. While the ODA has been used to certify many aircraft
over the years, some have criticized the system for permitting
an inappropriately close relationship between companies and
their safety regulator. Indeed, e-mail correspondence, dating
from as early as 2015, between the MAX's former Chief Technical
Pilot, Mark Forkner, and FAA personnel released on October 18
reflect a disturbing level of casualness and flippancy that
seem to corroborate these criticisms.
I was disappointed to learn of a November 2016 instant
messenger conversation between Mr. Forkner and a colleague, in
which he acknowledged misinforming the FAA. Boeing should have
notified the FAA about that conversation immediately upon its
discovery. Although the FAA is not testifying today, let me
express my frustration with the agency's lack of responsiveness
to my requests dating back to April of this year for documents
relevant to the 737 MAX as part of the investigation that I
opened, as Chairman, based on whistleblower disclosures.
The relationship between regulating agencies and
organizations they regulate is important, but so are the
internal reforms that Boeing is implementing. Witnesses should
provide their views on the ODA system and whether or not
reforms are needed. I invite Mr. Muilenburg to describe the
steps Boeing is taking to improve aviation safety and to ensure
that technical experts never experience undue pressure to put
profits and relationships ahead of safety. The Committee's
oversight is not limited to past actions. The reviews by both
JATR and NTSB note that future aircraft systems are likely to
be even more complex and interdependent than current models.
Managing interfaces between humans and machines will become
even more important as automation increases. At the same time,
commercial aviation is set to continue expanding around the
globe.
Many future pilots will fly in countries without the same
training requirements and safety standards that we have in the
United States. We welcome the witnesses' thoughts on how to
improve design, development, and certification in the future to
account for these major changes. This hearing will by no means
be the end of our inquiry. Additional oversight hearings will
be held. The Committee will carefully review the final Lion Air
report, which was released on Friday, as well as the Ethiopian
Airlines report, which is forthcoming.
The Committee also will consider the findings and
recommendations from JATR, NTSB, and all other investigations
and reviews. I now recognize the distinguished Ranking Member,
Senator Cantwell, for her opening statement.
STATEMENT OF HON. MARIA CANTWELL,
U.S. SENATOR FROM WASHINGTON
Senator Cantwell. Thank you, Mr. Chairman, and thank you
for this important hearing. I too want to take a moment and
recognize the families who have lost loved ones in both the
Ethiopian Airlines and Lion Air tragedies, some of whom are
here with us today. I cannot imagine the loss and the enduring
pain that you must feel. I thank you for your vigilance on this
issue, just as we have seen the families of the Colgan Air
flight vigilance help us improve safety for the future.
Right now, Mr. Muilenburg, these families, millions of
airline passengers, and over 150,000 aerospace workers want to
know what we're doing to fix what went wrong and what did go
wrong. To date, we have not gotten all those answers. Hopefully
today's hearing will help provide some. But one thing is
crystal clear, if you want to be the leader in aviation
manufacturing, you have to be the leader in aviation safety.
Aviation demand, especially for 737s and single-aisle planes is
exploding to 101 percent growth over the next 10 years--
something like 35,000 planes and $3 trillion. I think that is
actually 20 years. But we cannot have a race for commercial
airplanes become a race to the bottom when it comes to safety.
The company, the Board, cannot prioritize profits over safety.
Safety always has to be job one. So, it is troubling to
hear that Boeing may have skirted the FAA certification process
over a desire by airlines to have more fuel-efficient planes
but without pilot training. Now this issue of lowering
standards is permeating through all of aviation. We are dealing
with it here in the Committee. My Democratic colleagues have
led the charge to try to stop companies coming here to say they
do not want to have the same training for co-pilots on the
regional jets because they do not have enough pilots. Or the
issue my colleague has championed on rest requirements for
cargo pilots having the same requirements for rest as passenger
planes.
Thank God Captain Sullenberger, the hero of the Hudson,
made it clear, when you are in an emergency, the pilot and co-
pilot do not have time, a lot of time, to communicate. So that
is why today we need answers to how the first 737 MAX
certification process was done, and we especially need
transparency on this process of review before the 737 MAX is
put in the air again. The public needs to know and fully
understand what testing, what review, what processes were
conducted both by Boeing and the FAA before this plane is put
back in the air.
We also want to know today about Boeing's safety culture,
whether Boeing employees raised safety concerns that were not
listened to, whether there was enough testing and complex
system integration and information into a cockpit alert system
that we now all know was flawed, and whether there was even
enough data presented to the FAA. These are all questions that
are important, including outsourcing of engineering and coding.
There are many questions about software and cockpit automation
and overload.
I guarantee you the FAA codes and laws are clear when it
comes to the standards for certification. Yes, software and
automation, flight training, better rest requirements for
pilots have all led to 10 years between 2009 to 2018 as the
safest 10 years in aviation history. But, more software and
more automation without robust third-party testing and
validation will lead us to where we are today. We should note
that the last five aviation accidents have all involved this
issue of automation and pilot response to automation. Whether
it is Lion Air, Ethiopian, the Asiana, the French, or Qantas
330 accidents, they were all in response to an automation in a
command and response from the pilot.
So that is why last week I introduced legislation with my
colleagues Senator Duckworth and Senator Blumenthal to
implement the recommendations of the NTSB safety board and the
Inspector General report on better safety management systems,
better cockpit prioritization, and a new FAA Center of
Excellence on flight automation and human factors. The FAA
needs the best engineers to understand the engineering
challenges of the future and stay ahead on this human behavior
response to new automation.
We are dealing--I see people here on the transportation,
automobile side. It is the same issue in advanced vehicles,
what automation exists and how do humans respond to it? So, I
also look forward to hearing from Chairman Sumwalt and Chris
Hart about their findings on improving the safety review
process that we have included in this legislation. I will just
say again, our sorrows are nothing like the families who are
with us today, but I do want to note that 737 MAX accidents
have struck at the heart of everyone in the Northwest.
Soon after the Ethiopian crash, a Seattle firefighter
approached me and asked if I thought he could get a job at
Boeing. He said, I just want to go there and make sure we get
the safety right. Everyone feels that way. Generations of
workers in the Pacific Northwest have dedicated their lives to
aviation excellence and safety, and that spirit lives on in
Everett and Renton.
So, this is not a question about line workers, this is a
question about the corporate view from Chicago, whether there
is enough attention to manufacturing and certification. You
should take, you know, offense to the fact that people say it
is a great company not being run correctly.
So, for the 346 people who trusted Boeing without a second
thought, we need to get this right. These families are counting
on us. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Cantwell. Mr. Muilenburg,
you have submitted an extensive written statement. It will be
entered in full in the record at this point. You are now--and I
understand Mr. Hamilton will not be making a formal statement.
So, Mr. Muilenburg, you are recognized at this point to
summarize your opening statement for five minutes. Thank you
for being here.
STATEMENT OF DENNIS MUILENBURG, PRESIDENT AND
CHIEF EXECUTIVE OFFICER, THE BOEING COMPANY;
ACCOMPANIED BY JOHN HAMILTON, VICE PRESIDENT AND
CHIEF ENGINEER, BOEING COMMERCIAL AIRPLANES
Mr. Muilenburg. Chairman Wicker, Ranking Member Cantwell,
committee members, thank you for the opportunity to join you
today and that we share your commitment to aviation safety.
Before we start today, I would like to speak directly to the
families of the victims that are here with us. On behalf of
myself and the Boeing Company, we are sorry, deeply and truly
sorry.
As a husband and father, myself, I am heartbroken by your
losses. I think about you and your loved ones every day, and I
know our entire Boeing team does as well. I know that probably
does not offer much comfort and healing at this point, but I
want you to know that we carry those memories with us every
day, and every day that drives us to improve the safety of our
airplanes and our industry and that will never stop.
I am grateful and humbled to be here today and to be able
to say these words to the families directly, and I want to
convey our absolute commitment to safety, our commitment to
learning, our commitment to rebuilding the public's confidence
in what we do, and to preventing accidents like this from ever
ever happening again. We will never forget and that is our
commitment going forward.
Mr. Chairman, I know this Committee has many questions
about the MAX. We will do our best today to answer all of those
questions. While one of the accidents is still under
investigation, we know both accidents involve the repeated
activation of a flight control system called MCAS, which
responded to erroneous signals from a sensor that measures the
airplane's angle of attack. Based on that, we have enhanced
MCAS in three ways. First, it will now compare information for
both sensors instead of one before activating.
Second, MCAS will only activate a single time. And third,
MCAS will never provide more input than a pilot can counteract
using the control column alone. Pilots will also continue to
have the ability to override MCAS at any time. We brought the
best of Boeing to this effort. We spent over 100,000
engineering and test hours, we have flown more than 800 test
flights, we conducted simulator sessions with 545 participants
from 99 customers and 41 global regulators. I have flown on a
couple of flights myself.
This has taken longer than expected but we are committed to
getting it right. During this process, we worked closely with
the FAA and other regulators, we provided them documentation,
had them fly the simulators, answered their questions, and
regulators around the world should rigorously scrutinize the
MAX and only approve its return to flight when they are
completely satisfied with its safety. The public deserves
nothing less. Mr. Chairman, today and everyday over 5 million
people will board a Boeing airplane and fly safely to their
destination. Decades of cooperation and innovation by industry
and regulators and the rigorous oversight of this Committee
have reduced accidents by more than 95 percent over the last
twenty years, but no number other than zero accidents is ever
acceptable. We can and must do better.
We have been challenged and changed by these accidents. We
have made mistakes and we got some things wrong. We are
improving and we are learning, and we are continuing to learn.
We established a permanent airspace safety committee of our
Board. We stood up a new safety organization. We strengthened
our engineering organization so that all engineers now report
up through Boeing's Chief Engineer. We are also helping to
rebuild the communities and families impacted by these
accidents. We pledged $100 million to this effort and have
hired renowned experts in this area to ensure families can
access these funds as quickly as possible. No amount of money
can bring back what was lost but we can at least help the
families meet their financial needs.
Mr. Chairman, I started at Boeing more than 30 years ago as
a summer intern in Seattle. I was a junior at Iowa State
University studying engineering having grown up on a family
farm in Iowa. I was awestruck to work at the company that
brought the jet age to the world and helped land a person on
the moon. Today I am still inspired by what Boeing does and by
the remarkable men and women who are committed to its
outstanding legacy but these heartbreaking accidents and the
memories of the 346 lives lost are now part of that legacy. It
is our solemn duty to learn from them and we will.
Recently there has been much criticism of Boeing and our
culture. We understand and deserve this scrutiny, but I know
the people at Boeing. They are more than 150,000 of the most
dedicated, honest, hard-working men and women in the world, and
their commitment to safety, quality, and integrity is
unparalleled and resolute.
We will stay true to those values because we know our work
demands the utmost excellence. Mr. Chairman.
[The prepared statement of Mr. Muilenburg follows:]
Prepared Statement of Dennis Muilenburg, President and Chief Executive
Officer, The Boeing Company; Accompanied by John Hamilton, Vice
President and Chief Engineer, Boeing Commercial Airplanes
Chairman Wicker, Ranking Member Cantwell, members of the Committee:
good morning and thank you for inviting me to be here today.
I'd like to begin by expressing my deepest sympathies to the
families and loved ones of those who were lost in the Lion Air Flight
610 and Ethiopian Airlines Flight 302 accidents, including those who
are here in the room today. I wanted to let you know, on behalf of
myself and all of the men and women of Boeing, how deeply sorry I am.
As we observe today the solemn anniversary of the loss of Lion Air
Flight 610, please know that we carry the memory of these accidents,
and of your loved ones, with us every day. They will never be
forgotten, and these tragedies will continue to drive us to do
everything we can to make our airplanes and our industry safer.
Mr. Chairman, I know that you and your colleagues have many
questions about the 737 MAX. My colleague John Hamilton, Chief Engineer
for Boeing Commercial Airplanes, and I will do our best today to answer
them. While the Ethiopian Airlines accident is still under
investigation by authorities in Ethiopia, we know that both accidents
involved the repeated activation of a flight control software function
called MCAS, which responded to erroneous signals from a sensor that
measures the airplane's angle of attack.
Based on that information, we have developed robust software
improvements that will, among other things, ensure MCAS cannot be
activated based on signals from a single sensor, and cannot be
activated repeatedly. We are also making additional changes to the 737
MAX's flight control software to eliminate the possibility of even
extremely unlikely risks that are unrelated to the accidents.
We have brought the very best of Boeing to this effort. We've
dedicated all resources necessary to ensure that the improvements to
the 737 MAX are comprehensive and thoroughly tested. That includes
spending over 100,000 engineering and test hours on their development.
We've also flown more than 814 test flights with the updated software
and conducted numerous simulator sessions with 545 participants from 99
customers and 41 global regulators. This process has taken longer than
we originally expected, but we're committed to getting it right, and
return-to-service timing is completely dependent on answering each and
every question from the FAA.
I have flown on two of the demonstration flights myself and seen
first-hand the expertise and professionalism of our teams. Mr.
Chairman, I could not be more confident in our solutions--and I could
not be more grateful to the men and women who have worked so hard to
develop and test these improvements always with safety at the
forefront. When the 737 MAX returns to service, it will be one of the
safest airplanes ever to fly.
During this process we have been working closely with the FAA and
other regulators. We've provided documentation, had them fly the
simulators, and helped them understand our logic and the design for the
new software. All of their questions are being answered. Regulators
around the world should approve the return of the MAX to the skies only
after they have applied the most rigorous scrutiny, and are completely
satisfied as to the plane's safety. The flying public deserves nothing
less.
We know that it's not just regulators that need to be convinced. We
know the grounding of the MAX is hurting our airline customers, their
pilots and flight attendants, and most importantly, the people who fly
on our airplanes. Our airline customers and their pilots have told us
they don't believe we communicated enough about MCAS--and we've heard
them. So we have partnered with customers and pilots from around the
world as we've developed our solutions. We have welcomed and encouraged
their questions and given them opportunities to test those solutions
firsthand in simulators. And subject to regulatory approval, additional
and enhanced training and educational materials will be available for
pilots who fly the MAX.
We have learned and are still learning from these accidents, Mr.
Chairman. We know we made mistakes and got some things wrong. We own
that, and we are fixing them. We have developed improvements to the 737
MAX to ensure that accidents like these never happen again. We also are
learning deeper lessons that will result in improvements in the design
of future airplanes. As painful as it can be, the process of learning
from failure, and even from tragedies like these, has been essential to
the advances in airplane safety since the industry began roughly a
century ago. And it is one of the reasons that travel on a large
commercial airplane is the safest form of transportation in human
history.
Mr. Chairman, this is something we must not lose sight of. Today
and every day, over 5 million people will board a Boeing airplane and
fly safely to their destination. Whether it's their first flight or
their millionth mile, we want it to be a great experience--and most
importantly, a safe one. Decades of work and innovation throughout the
industry, as well as the oversight of the FAA, this Committee, and
regulators around the world have reduced the risks of air travel by
more than 95 percent over the last twenty years. But no number, other
than zero accidents, is ever acceptable.
For 103 years, Boeing has been dedicated to making the world a
safer and better place. Our founder, Bill Boeing, established our first
safety council in 1917, the first full year of the company's existence,
beginning a commitment to safety that we have carried forward as a core
value ever since. The engineers who design our airplanes, the
machinists who work in our factories, and the many others who
contribute to the extraordinarily complex work of building and
maintaining commercial airplanes do so with pride and honor. Ensuring
safe and reliable travel is core to who we are. Our customers and the
traveling public, including our own families, friends, and loved ones,
depend on us to keep them safe. That's our promise and our purpose.
But we also know we can and must do better. We have been challenged
and changed by these accidents, and we are improving as a company
because of them. We established a permanent aerospace safety committee
of our Board of Directors; stood up a new Product and Services Safety
organization that will review all aspects of product safety and provide
streamlined reporting and elevation of safety concerns; and
strengthened our Engineering organization by having all engineers in
the company report up through Boeing's chief engineer. We also are
investing in advanced research and development in new safety
technologies and are exploring ways to strengthen not just the safety
of our company but our industry as a whole. We have a shared bond of
safety across the entire aerospace community.
We recognize it is not just our airplanes and our company that
needs to be supported and strengthened. We also must help rebuild the
communities and families affected by these accidents. Our first step
was our pledge of $100 million to them. We hired Ken Feinberg and
Camille Biros, renowned experts in this area, to ensure families can
access this money as quickly as possible. Of course, no amount of money
can bring back what has been lost. But we can at least help families
meet their financial needs. Our people also have donated more than
$750,000 of their own money to these funds--a tremendous example of the
giving spirit our teams consistently display in the communities where
they live and work across the globe.
Mr. Chairman, I've worked at Boeing my entire career. It started
more than 30 years ago when Boeing offered me a job as a summer intern
in Seattle. I was a junior at Iowa State University studying
engineering, having grown up on our family farm in Iowa. It's beautiful
land with rolling hills where my siblings and I milked cows and baled
hay. Our parents taught us the value of hard work, integrity, and
respect for others. Back then, I drove my 1982 Monte Carlo from Iowa to
Boeing's operations in Seattle, crossing the Rocky Mountains for the
first time. I was awestruck at the opportunities I had to work on
projects that mattered at the company that brought the Jet Age to the
world and helped land a person on the moon. I was amazed by the people
of Boeing. Today, I'm still inspired every day by what Boeing does and
by the remarkable men and women who are committed to continuing its
legacy.
These heartbreaking accidents--and the memories of the 346 lives
lost--are now part of that legacy as well. It's our solemn duty to
learn from them and change our company for the better. I can assure you
that we have learned from this and will continue learning. We have
changed from this and will continue changing. The importance of our
work demands it.
In the months since the accidents, there has been much criticism of
Boeing and its culture. We understand and deserve this scrutiny. But I
also know the people of Boeing, the passion we have for our mission,
and what we stand for. There are over 150,000 dedicated men and women
working for Boeing around the world--and their commitment to our
values, including safety, quality, and integrity, is unparalleled and
resolute. No matter what, we will stay true to those values because we
know our work demands the utmost excellence.
Over the last few months, I've had the opportunity to visit many of
our Boeing teams, talk about our safety culture, and gain ideas for how
we can be better still. Last week, I saw our team in San Antonio--made
up of 40 percent veterans--beaming with pride as they support the C-17
fleet for our men and women in uniform. Earlier, I talked with our
people in Philadelphia building Chinook helicopters; in St. Louis
testing F/A-18 Super Hornets; and in Charleston, South Carolina, and El
Segundo, California, connecting the world with the 787 Dreamliner and
advanced satellites. I've also met with our people in Huntsville,
Alabama, and New Orleans, Louisiana, who are building the rocket that
will return humans to the moon and then travel on to Mars and those at
Kennedy Space Center, Florida, who are preparing to launch the CST-100
Starliner that will commercialize space travel. I've spent time also
with our teams in Everett, Washington, who are testing the new 777X
long-range jet and in Renton, Washington, where 12,000 amazing people
pour their hearts into building the 737 MAX. These are the people of
Boeing. I wish you could all meet them. They change the world. They are
Boeing.
I'm here today, honored to serve as the leader of this incredible
team--talented engineers, machinists and all those who design, build
and support our products. I want to answer all of your questions and
convey to the world that we are doing everything in our power to make
our airplanes and our industry safer and prevent an accident like this
from ever happening again.
And, Mr. Chairman, you have my personal commitment that I will do
everything I can to make sure we live up to that promise.
Thank you for listening, and I look forward to your questions.
Mr. Chairman. Thank you very much, Mr. Muilenburg. During
my opening statement, I mentioned an instant message
conversation and then a series of e-mails. This message
conversation was between the 737 MAX Chief Technical Pilot and
a colleague and it expresses concerns about the operation of
the MCAS. Boeing knew about this instant message for months but
failed to share it with the FAA until recently.
With regard to the e-mails, again, Mr. Forkner, the former
MAX Chief Technical Pilot, calls for removing any mention of
the MCAS flight control system from the flight crew operating
manual. He talks about Jedi-mind tricking of regulators with at
least one person who works for the FAA. So, with regard to the
instant message conversation, when were you made aware of the
existence of the November 2016 messages?
Mr. Muilenburg. Mr. Chairman, as I recall, I was made aware
of that message earlier this year. It was discovered as part of
a document gathering process in response to a Government
investigation.
The Chairman. So, it was after the crashes? You were made
aware of it this year?
Mr. Muilenburg. Sir, as I recall, I believe it was prior to
the second crash earlier this year.
The Chairman. Prior to the second crash. Was it your
decision to wait months before disclosing this to the FAA?
Mr. Muilenburg. Mr. Chairman, at that point it had been
identified as a document in response to an ongoing
investigation and I relied on our counsel to provide that to
the appropriate authorities.
The Chairman. OK, what did the counsel tell you? Did he
say, I am going to supply it to the Justice Department, or did
he say I am going to get it to the appropriate authorities?
Mr. Muilenburg. Mr. Chairman, I do not recall having a
specific conversation about which authorities. Just again as
part of this investigative process, our intent to cooperate
fully with your request and to provide that to the appropriate
authorities. I think over this time period, we provided, on the
order, half a million pages of documents in support of various
requests.
The Chairman. Do you agree that this should have been
provided to the FAA in retrospect?
Mr. Muilenburg. Senator, as I became familiar with the
details of the document over the last few weeks, as I expressed
our disappointment and concern with the how this came to the
FAA--I think you heard the same from Administrator Dickson--I
called him and apologized for how this had come through the
process. Again, I was not involved in the document production
process, but I counted on our team to make sure all the right
authorities were notified.
The Chairman. OK, so we should look to the team then. Can
you ensure the Committee that Boeing has now turned over all
such safety-related communications to the FAA and related to
the 737 MAX?
Mr. Muilenburg. Senator, our team continues to cooperate
with all requests for documentation. I am sure that additional
documents will be provided over time as they are discovered as
would be normal to the process, and we will cooperate fully
with the requests.
The Chairman. It seems to me that a request should not have
to have been made with regard to that conversation, sir. Let me
ask you, when did you become aware of the e-mails that I
referred to in the second part of my question about Jedi-mind
tricking regulators?
Mr. Muilenburg. Senator, again just recently I have been
informed of the details of those e-mails and instant messages--
--
The Chairman. Can you give us an idea of how recently?
Mr. Muilenburg. Over the last couple of weeks when it
became public news.
The Chairman. OK. And you did not know about it until then?
Mr. Muilenburg. Sir, I do not recall being briefed on the
details of those documents any time prior to that.
The Chairman. Can you see that this raises much concern
about the level of coziness between Boeing personnel and FAA
regulators?
Mr. Muilenburg. Mr. Chairman, I understand the concern
there, and again, we are doing our best to lean forward and
provide information as part of this process. I can tell you
that the comments, that the values, the approaches that are
described in those e-mails are counter to our values, that in
no way would meet any expectation I would have for our team or
employees, so I understand the concern, share the concern, and
am trying to convey it is not consistent with our values as a
company at all.
The Chairman. And this series of e-mails has only in the
last few weeks come to your attention, is that right, sir?
Mr. Muilenburg. Senator, as I said, I was aware of the
documents that were being produced as part of an investigation.
That is what I recall from earlier this year. I do not recall
getting briefed on the details of these documents. Those
details are things that I learned of over the last few weeks.
The Chairman. Senator Cantwell.
Senator Cantwell. Thank you, Mr. Chairman. And if you could
help, I have a lot to go through, so we are going to try to
move quickly through it. Was Boeing aware of the defects in the
MCAS system which it failed to disclose to the FAA at the time
the aircraft was in development and certification?
Mr. Muilenburg. Senator, as you know the MCAS development
occurred over a lengthy time period, about a six-year
development program of the MAX. We have learned from both
accidents and we have identified changes that need to be made
to MCAS. We did, during the development process, follow our
certification standards and long-standing industry standards
behind the MCAS design but clearly, we have learned and there
are things we need to improve on MCAS.
Senator Cantwell. So are you saying----
The Chairman. Answer the question, Mr. Muilenburg.
Mr. Muilenburg. Senator, could I ask you----
Senator Cantwell. Was Boeing aware of defect in the MCAS
system which it failed to disclose to the FAA at the time the
aircraft was in development and certification?
Mr. Muilenburg. Senator, I just have to question, I will
say, the premise of the question. So, as part of our
development process, we do identify hazards and failure modes--
--
Senator Cantwell. And they were disclosed?
Mr. Muilenburg. That was part of the failure mode analysis
that we shared as part of the certification process during that
time period.
Senator Cantwell. So, you think everything that you were
aware of was disclosed to the FAA as it relates to defects in
the MCAS system?
Mr. Muilenburg. Well Senator, as we get to defects--things
we need to fix--we have identified three areas that we talked
about that we need to address. One was the single sensor feed
that was a piece of the architecture that was shared with the
FAA. The fact that the system would operate more than once
during a flight that was also part of the design description.
And the control authority of the system at various parts of the
flight----
Senator Cantwell. Do you know what Mr. Forkner is referring
to when he says, unknowingly lied to the FAA or Jedi-mind
tricking?
Mr. Muilenburg. Senator, I am not sure what he meant by
that. We haven't been able to talk to him. He does not work for
Boeing anymore. We have been trying to contact him.
Senator Cantwell. Here is my concern, that if you do not
know what he meant, then you also do not know what wasn't
disclosed. And so, we do not know if there are things in the
MCAS system that were defects that he or someone else knew
about that were not disclosed. So, I hear what you are saying
that there is a lot to discover in the process, but I would
like to go over some of the very specifics about what was
tested and did Boeing test the consequences of the MCAS
reliance on a single AOA sensor? Did it test that?
Mr. Muilenburg. Senator, we tested a broad array of
different aspects of the MCAS system, a set of failure modes.
We did thorough flight testing. You know, John, if you want to
comment on the details there?
Mr. Hamilton. Yes. Senator, the 737 NG is one of the safest
airplane sets----
Senator Cantwell. OK, look we are trying to understand what
got tested. So did you test the reliability of the AOA sensors
in general? Did you test the reliability on a single sensor?
Did you consult with the pilots on the lack of guidance on MCAS
in the flight manuals? Did you test the AOA sensors' degree
alert to ensure reliability? Did you test the human factor
response? These are all things from the Lion Air report and my
guess is you didn't test those and that is at the heart of
this. But if you did and you have data on that and it was
provided to the FAA, that is what we want to see.
Mr. Hamilton. Senator, we did test the MCAS uncommanded
inputs to the stabilizer system due to whatever causes was
driving it, not specifically due to an AoA sensor. We assessed
that hazard level. We talked about pilots----
Senator Cantwell. Now do you think it is wrong?
Mr. Hamilton. In hindsight, Senator, yes.
Senator Cantwell. Thank you because I agree.
Mr. Muilenburg. Senator, if I can just add a point to that
because as John pointed out, we relied on these long-standing
industry standards as part of our evaluation of response time
behind MCAS, and that is one of the areas that we found
shortfall.
Senator Cantwell. Here is the thing I am very confused
about which is just this larger issue, and look we want to get
this right because we do want to go forward and we know there
is going to be automation in many aspects of our lives, but
this robust testing that must occur and third-party validation,
there were just--I just do not understand how you have sensors
on the outside of a plane and you are going to let that send a
command to the inside of the plane that basically says turn the
plane 2.5 degrees and then all of a sudden you are going to be
yelled at from the cockpit from somebody saying pull up and
then at the same time you are being forced down in your nose
and you have seconds to respond because you are in takeoff.
That does not seem like a lot of robust testing was done to
me because if it was then the Lion Air incident wouldn't have
happened. OK, so I see my time, I have a few seconds left. I
want to just bring up, look I think this whole issue of air
speed is a major issue at large for all of us to get right in
the sector. Those crashes about automation, even that Air
France crash is related to a faulty pitot tube.
I do not know how much we should be trusting things on the
outside of a plane to give commands to the inside of the plane
when they can be damaged. But I do want to know that you are
improving the safety culture, this issue of both reporting,
people not being able to talk to FAA, oversight people, and
this issue of some of the machinist Boeing quality inspectors,
their work being taken over. I want to understand that a safety
culture is going to exist.
Mr. Muilenburg. Senator, if anything I can leave with you
today, I want to reinforce the culture of safety at Boeing, and
we know we can improve, we encourage our employees to speak up
when there are issues and some of those have been public
recently.
We respect and accept those inputs. We take action
following on those. We have recently made a number of
improvements that includes restructuring our safety review
boards, elevating them to increase transparency and focus on
safety. We have moved all 50,000 Boeing engineers to now report
directly to our Chief Engineer, separating them from----
Senator Cantwell. OK, I am going to ask you to come back on
the SPIA and Boeing quality inspectors, two different issues,
with a written response. Thank you, Mr. Chairman. I know I went
over my time.
The Chairman. Thank you. Now I have the duty of telling the
distinguished Whip that he is limited to five minutes.
[Laughter.]
STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
Senator Thune. Thank you, Mr. Chairman. Mr. Muilenburg, it
is my understanding that the MCAS has been substantially
redesigned to include several redundancies that will better
prevent erroneous activation. Could you speak to why some of
the changes being made in the reconfiguration of the MCAS were
not considered in the initial development of the system?
Mr. Muilenburg. Yes, Senator. I think you raise a very
important point. And as John began to allude to earlier, the
original concept for the MCAS design was an extension of what
we call the speed trim system on the 737 NG, the previous
version of the 737, that is a single sensor system that has
been proven safe in flight--more than 200 million flight hours.
So, one of our safety principles is to minimize change from
model to model. That is a good standard safety process that was
the concept behind the original MCAS design. And what we have
learned from both accidents is that we made some mistakes.
There are some things we can improve. One of them is this idea
of going to a dual sensor feed instead of single as well as
limiting MCAS with a single action or activation during a
flight.
Those are improvements that we have identified. We take
responsibility for that. We feel responsible for our airplanes
and we know that there are some fixes that we need to make, we
own that, and we are implementing those fixes going forward.
Senator Thune. As we discuss possible improvements to the
certification of an aircraft, it would be helpful for you to
explain how safety supposed to be integrated into the
certification process from the initial conception of the
aircraft all the way to flying at 30,000 feet filled with
passengers. Since these crashes, we have heard concerns about
whether Boeing's relationship with the FAA is too cozy and we
want a certification process that is efficient and that
promotes U.S. competitiveness but one that always prioritizes
safety. So, what would you say to address the concerns that
have been raised about regulatory capture?
Mr. Muilenburg. Senator, I agree with the focus in that
area. I would say that over the last couple of decades the
improvements that have been made in aviation safety are because
of strong Government oversight, that includes the work of this
Committee, it includes the other oversight of the FAA. The
delegated authority process as it is structured, we do think
has contributed to safety of the industry. I mentioned in my
comments that it is about a 95 percent improvement in safety
over the last two decades, some of that I believe is associated
with the delegated authority, but we have to get the balance
right.
And I think it is very important that we have strong
Government oversight, strong FAA oversight, but we also tap the
technical depth that our industry teams can bring to the table.
That is the concept. But if we need to rebalance it--I fully
support evaluating that concept, looking at the details, and
making sure we have got the balance right.
Senator Thune. Could you briefly explain, very briefly if
you could, how Boeing and the FAA work together to certify
aircraft?
Mr. Muilenburg. Yes. Senator, I could but I think Mr.
Hamilton here is a deeper expert on that, if I could ask him to
take that question?
Mr. Hamilton. Certainly. Senator, the FAA is actually in
control of the certification process the whole time. Let me
just kind of walk you through the process very quickly. It
starts out by identifying the requirements to certify the
airplane. That is the sole authority of the FAA. It establishes
the certification basis of the airplane. The second step is
identifying the methods of compliance to those requirements.
So, this is how you are going to show that the airplane design
actually meets those requirements.
Again, the FAA is the sole authority on that. That is their
action. The third step is doing the testing, the analysis, and
the documentation that demonstrates the airplane meets those
requirements. And that is done by Boeing in our case or the
applicant. And then there is a review of those documents to
validate that they actually met the requirements, and that can
be done by the FAA, or the ODA who acts as a designee of the
FAA, or it can be a combination.
And finally, there is oversight. The FAA does oversight of
the actual unit members. They do oversight of the ODA and are
you following the processes. They do oversight of did you find
compliance as they expected with the methods of compliance. And
then they do systemic oversight of the entire system.
Senator Thune. And Mr. Muilenburg, how are you working to
ensure, coming back to this issue of safety, that employees who
raised concerns even if they inhibit your ability to get a
product to the market quickly are taken seriously and then
importantly those concerns are raised to the top and not
brushed aside?
Mr. Muilenburg. Senator, in my role as the CEO of this
company I take that responsibility very seriously. We have a
number of ethics hotline avenues that our employees can use.
When it comes to delegated authority, in particular we also
have additional survey tools that we deploy, and we openly
share that data with the FAA and make improvements.
That said, again, we know we can improve, and one of the
areas that I have taken recent action on is to restructure our
safety organization. So, we have now created a new safety
organization. Vice President Beth Pasztor reports to my Chief
Engineer who reports directly to me. That safety organization
has responsibility for all safety related accident
investigations, our ODA process, and also responding to any
employee concerns.
Senator Thune. Thank you, Mr. Chairman.
The Chairman. Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you, Mr. Chairman, and thank you
to Senator Cantwell. I also want to give my sincere thanks to
the people who are here who lost their loved ones in these two
crashes. I think you know you are here not only for them, and
it must be hard to hear all this technical issues when you
think of your brother or sister or father or mother or son or
daughter, but I want you to know that we want to get to the
bottom of this and we want to change this.
So, I will start where Senator Thune was going with the FAA
and Boeing, and this relationship. Our recent Inspector General
report found that only 4 percent of airline manufacturer
employees responsible for conducting the certification were
certified by the FAA that conducted oversight. The same report
found that one manufacturer approved about 95 percent of
certifications for their own aircraft. What can you tell us
about the percentage of certifications that Boeing conducts on
its own aircraft?
Mr. Muilenburg. Senator, I cannot answer that number off
the top of my head. I do not know--John if you have a----
Mr. Hamilton. No, I would have to follow up.
Senator Klobuchar. OK. How many Boeing engineers both
design systems for the company and then certify those same
systems for the FAA? I am just trying to get at a safety check
from the outside.
Mr. Hamilton. So, we have approximately 1,000 engineering
unit members that work not just in systems----
Senator Klobuchar. But what percentage of them then certify
the safety as opposed to having the FAA certify the safety?
Mr. Hamilton. Those are roughly 1,000 unit members that are
acting on behalf of the FAA to find the compliance, but that is
beyond just systems. This includes structures and propulsion,
so it is across the whole airplane.
Mr. Muilenburg. Senator just to clarify, we have about
50,000 engineers at Boeing. About 1,000 of them are what we
call, operate in this area that John's referring to, unit
members. So, these are members who have the authority and the
training.
Senator Klobuchar. OK. We will follow up. I am trying to
get at when the FAA steps in and when you certify it yourself,
and we will get that later. Two months after Mr. Forkner sent
these messages expressing safety concerns, he asked the FAA to
remove mention of the MCAS automated flight control feature
from the 737 Max pilots' flight manual and training course, a
change that the FAA approved in 2017.
Notably Indonesia's National Transportation Safety
Committee report on the Lion Air crash confirms that the
pilot's lack of knowledge of MCAS was one of the key reasons
for the plane crash. How frequently are new automated systems
left out of the manual and training that you give to pilots?
Mr. Muilenburg. Senator, first of all of one of the things
we have learned from both of these accidents is that we need to
provide additional information on MCAS to pilots. Just to give
you context, as we develop our training manuals, our idea is to
provide training to pilots so they can respond to the effects
of failures as opposed to trying to diagnose failures and that
is a very important distinction.
And so more information in the training manuals is not
necessarily safer but as we understand from both of these
accidents, we need to provide more information on MCAS to
enhance safety. But we do try to include information in the
training manuals----
Senator Klobuchar. But do you think it is acceptable that
pilots are flying planes without knowing about these key
automated flight systems?
Mr. Muilenburg. Senator, again our approach is to train
pilots on the effects of a failure mode. So, in this case, the
MCAS automation system, when it fails it fails in what we call
a runway stabilizer, uncommanded movement of the horizontal
tail. That is what is in the training manual and we try to
train pilots to respond to the effect of the failure as opposed
to diagnose it.
Senator Klobuchar. OK, let me move on to two more
questions. After these terrible crashes have claimed 346 lives,
do you think it makes sense for these aircraft to be allowed to
fly in some countries and not others because the FAA says each
country can make its own decision?
Mr. Muilenburg. Well, Senator, we respect the jurisdiction
of the regulatory authorities around the world----
Senator Klobuchar. So, you think it is acceptable? Just say
yes or no.
Mr. Muilenburg. Senator, that is up to the regulatory
authorities. That is not a decision that we can make. We
respect the authority of the regulators.
Senator Klobuchar. OK. You are saying the same thing again,
so I am going to go with a yes. While there have been several
factors that contributed to the plane crashes, one that is
particularly troubling was highlighted in a recent article in
the Washington Post, which found that the Lion Air had a faulty
angle-of-attack sensor which gave pilots and airplanes systems
unreliable information the day before it crashed. Do you think
that is a problem and what steps can be taken to change that?
Mr. Muilenburg. Senator, in the case of the angle of attack
disagree alert we got the implementation wrong. I mentioned in
my comments up front that we made some mistakes, we made a
mistake in that implementation. Once we discovered it, our
engineering teams quickly convened a safety review board.
They confirmed that it wasn't an operational safety issue
and the FAA subsequently concurred with that but nonetheless,
we got the implementation wrong and we have addressed the
faults in the process. We have fixed that. And angle of attack
disagree alert will be standard implementation on all MAXs
going forward.
The Chairman. Thank you, Senator Klobuchar. Senator
Fischer.
STATEMENT OF HON. DEB FISCHER,
U.S. SENATOR FROM NEBRASKA
Senator Fischer. Thank you, Mr. Chairman. I too would like
to recognize and offer my sympathies to the people that are
here today and the people who are at home who have lost loved
ones in these crashes. I hope that we can get answers at this
hearing and also in the future so that these issues, these
mistakes will not happen again and cause future loss of life.
Mr. Muilenburg, the Joint Authorities Technical Review
notes that Boeing made several other changes to the 737 MAX
that differ from the earlier model, such as structural changes
that would accommodate the new engines that were planned on the
plane and other advanced technologies. Senator Thune touched on
this with the delegated authority. Was Boeing delegated
authority over the certification of those changes as well?
Mr. Muilenburg. Senator, I cannot answer that question
completely because as you pointed out to there were a number of
changes. Again, those are done and evaluated jointly with the
FAA. I don't know, John, if you want to comment on any
specifics there?
Mr. Hamilton. There were approximately 92 certification
plans associated with the MAX which encompass all the different
changes to the airplane. The FAA reviewed approximately 8 of
those initially and----
Senator Fischer. Are you looking into those certification
processes as part of your review of the 737 MAX?
Mr. Muilenburg. Senator, yes, we are. I asked my Board to
set up an independent review committee headed by Admiral
Giambastiani about 5 months ago, and that committee did its
work, provided inputs that we are acting on. And with the other
authorities, we are continuing to take a hard look at that, and
we look forward to taking an action on those reports.
Senator Fischer. OK. Also, the Joint Authorities Technical
Review included a recommendation that states, ``if any flight
control service is used in a novel manner, the FAA should be
directly involved.'' This is based on the observation that the
FAA was not, ``completely unaware of MCAS,'' but, ``because
information and discussions about MCAS were so fragmented and
they were delivered to disconnected groups within the process,
it was difficult to recognize the impacts and the implications
of this system.''
Do you agree that the communication between Boeing and the
FAA is fragmented to the point that relevant information on
MCAS was not provided to the agency? Is this what you were
referring to when you talked about getting the balance right?
Mr. Muilenburg. Senator, I think you raise some very good
points there. I do think one of the areas we can improve, and
we have seen it in the JATR report and others is system-wide
integration, cross system integration amongst the different
technical expertise areas and improvements in documentation and
communication. And again, we found some areas where we could
have, should have, done better.
Senator Fischer. Do you think those steps will improve your
communication with the FAA?
Mr. Muilenburg. Senator, I do.
Senator Fischer. Do you think the FAA has a responsibility
to also change its process to improve communication?
Mr. Muilenburg. Senator, I believe the FAA does, but I
would not say that is only the FAA's responsibility. We at
Boeing need to make some improvements in communication and we
own that, and we are committed to doing that.
Senator Fischer. The Boeing 737 airplanes are based on a
type certificate that was originally provided in 1967, I
believe, and it has been amended to address the different 737
model since then. The Technical Review notes that, ``some
elements of the design and certification remain rooted in the
original 1967 certification of the Boeing 737-100.'' Does
Boeing or the FAA review the elements of the 737 that are based
in the 1967 certification for continued safety when new models
of the airplane are produced?
Mr. Muilenburg. Senator, if I could ask John to field that
question?
Mr. Hamilton. Senator, as you note there is a single type
certificate for the 737 but as the design has evolved with each
new generation of airplanes, the safety standards on which the
airplane is designed to have also evolved. Yes, there are some
amendments that the designs might reference back to an earlier
amendment level but those are likely changes that have not
changed in the family of airplanes since the original design.
An example might be some of the structural elements.
However, we have stepped up in many areas voluntarily to later
amendment levels to demonstrate that it still meets the latest
standards in compliance.
The Chairman. Thank you, Senator Fischer.
Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thank you, Mr. Chairman. Thank you to
both our witnesses for being here today and thank you most
importantly to the relatives who have lost loved ones. If you
could please stand so we could thank you all. Thank you for
being here. If you could just stand. Thank you.
The Chairman. Go ahead and hold up the photographs that you
brought.
Senator Blumenthal. I was going to ask that you hold up
those photographs because I understand that for security
purposes you cannot during the hearing but just for this short
period of time. Mr. Muilenburg----
The Chairman. So, thank you, and if the timekeeper could
start Senator Blumenthal's time over. Thank you very much to
the family members. Senator Blumenthal.
Senator Blumenthal. Thank you very much, Mr. Chairman. Mr.
Muilenburg, as I watched those loved ones stand and frankly as
I reviewed this file over the past week or so again and as I
sit here today my anger has only grown. These loved ones lost
lives because of an accident that was not only preventable as
the Chairman said at the very start but was the result of a
pattern of deliberate concealment.
Boeing came to my office shortly after these crashes and
said they were the result of pilot error. Those pilots never
had a chance. These loved ones never had a chance. They were in
flying coffins as a result of Boeing deciding that it was going
to conceal MCAS from the pilot. And the best evidence is this
message from Mark Forkner saying in effect we are going to
conceal MCAS, delete it from the manual used in training. When
did you become aware of the fact that MCAS was not going to be
included in the flying manual?
Mr. Muilenburg. Senator, first if I could express my
deepest sympathies for----
Senator Blumenthal. You have done that, and my time is
limited. I apologize for interrupting you, but I want to know
specifically when you became aware of this effort?
Mr. Muilenburg. Senator, I cannot reference that e-mail and
I am not----
Senator Blumenthal. I am not asking about the e-mail. You
have been asked about the e-mail already. I am asking you about
Boeing policy as reflected in this e-mail, its chief test pilot
deciding he was going to mislead pilots who were then going to
take passengers into the air, these loved ones, and turn those
planes into flying coffins.
Mr. Muilenburg. Senator, I am not sure what Mr. Forkner
meant by that e-mail. I can tell you that certification and
training materials are not determined by one individual.
Senator Blumenthal. In fact, let me just interrupt you
again. In the over 1,600 page original flight manual of Boeing
737 MAX, the aircraft's new MCAS computer system was mentioned
only once, once in 1,600 pages in the glossary of abbreviated
terms. So, when Boeing came to us and they said it is the
pilot, inexperienced pilots, you were lying to us as well.
Mr. Muilenburg. Senator, if I could try to respond to your
question. First of all, the premise that we would lie or
conceal is just not consistent with our values.
Senator Blumenthal. Well I know it is not consistent with
the values that you are articulating here but let me just,
since my time is limited, move on. Would you agree that this
system of certification and oversight is absolutely broken?
That is the lesson here, isn't it? That Boeing lobbied the
Congress for more delegation and now we have to reverse that
delegation of authority. Would you support those legislative
efforts?
Mr. Muilenburg. Senator, again I support taking a hard look
at the delegated----
Senator Blumenthal. I am not asking you for a hard look, I
am asking you for a commitment here because you have the
opportunity to make things right?
Mr. Muilenburg. Senator, I am not familiar with particular
legislation, but I am committed to working and supporting it.
Senator Blumenthal. Boeing asked for legislation that
exists right now. Will you commit to supporting reform efforts
such as many of us on this Committee are advocating?
Mr. Muilenburg. Senator, we will commit to participating in
those reform efforts and providing our inputs.
Senator Blumenthal. Well, I agree that your input would be
valuable. I am looking for input in support of reform that will
stop outsourcing by the FAA, and I might just add, the FAA has
been really disappointing and its disclosure to us is an
example, the kind of disclosure the FAA has given us, total
redaction. I have asked for full disclosure of documents. The
FAA has failed to provide them.
I have asked for the FAA to return my phone calls. It has
failed to do so and I think the FAA is part of this problem as
well, and it is the result at the end of the day of Boeing
rushing this process, I am using the Chairman's terms, putting
profits over safety, rushing the certification process with you
in charge of that certification and prioritizing speed and cost
over safety.
And my time has expired but the folks who really deserve
time here are the people who lost loved ones.
The Chairman. Thank you, Senator Blumenthal. Let us do
this; this poster is entitled, ``MCAS lives in both FCC.'' If
you can provide a copy of that, we will admit it into the
record at this point without objection.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairman. Thank you. And Mr. Hamilton, let me just ask
you, when it says MCAS does live in both FCCs, what does that
mean? Briefly.
Mr. Hamilton. Certainly. So, the MCAS function is
replicated in the two flight control computers that are onboard
the airplane. And so, each flight control computer previously
received its input from one AOA sensor on the left or right
side. In the software changes we are making going forward, now
both flight control computers will receive the data from both
sensors, compare it, and only if they agree they will activate.
The Chairman. OK. Thank you. Senator Moran.
STATEMENT OF HON. JERRY MORAN,
U.S. SENATOR FROM KANSAS
Senator Moran. Mr. Chairman, thank you. Mr. Muilenburg, did
you determine that the failures that resulted in the tragic
consequences, were they failures in the policies and protocols
that Boeing had in place or was it a failure to comply with
those protocols and policies that resulted in these
consequences?
Mr. Muilenburg. Senator, in some cases we relied on these
longstanding industry-standards, policies, and certified to
those, and we are now raising questions around those. That gets
back to this pilot response time discussion that we had
earlier. And in some cases, we missed on implementation as I
mentioned earlier with the angle of attack sensor but overall,
we did follow the certification process and steps. But
nonetheless, we have learned from both of these accidents. And
the fixes that we need to make are clear.
Senator Moran. So, the fixes are both in policy and then
making certain that the policies are followed once the new
policies are in place?
Mr. Muilenburg. Senator, I believe both are true, yes.
Senator Moran. Thank you. And I assume there is other
certification and just developments at Boeing that are always
ongoing. Have you changed your behavior and or policies for the
certification and development process for other pieces of
equipment, other aircraft that Boeing is now proceeding toward
certification?
Mr. Muilenburg. Senator, we have, and we are going to
continue to change. As I said we have learned, but we are still
learning. I mentioned earlier that we changed our safety review
board structure. That is a big, substantive change, the stand-
up of our new safety organization. The realignment of our
engineering team, those 50,000 engineers. We are also taking a
look at some of those long-standing assumptions behind how we
design as we look at next generation products like the 777-X as
an example. So, we are taking a comprehensive approach to those
updates.
Senator Moran. As this Committee looks certainly at
certification, as we look at the FAA, what suggestions does
Boeing have for this Committee when you look at any policies or
failures at the FAA? So, the way I would view this is we have
two major organizations involved in this process: one is the
manufacturer Boeing, the other is the Federal agency that is
there to certify. My assumption is that neither one did things
right. And what have you learned about the FAA that we should
know as we look at the FAA now and in the future?
Mr. Muilenburg. Senator, we have a great deal of respect
for the FAA. I have personally worked with the FAA for many
years, have a great deal of respect for them and their
professionals. I know the FAA is also taking a hard look at all
of the reports and inputs and investigations and is committed
to making changes. I think you heard that from Administrator
Dickson.
Senator Moran. Do you have suggestions on what changes the
FAA should make?
Mr. Muilenburg. Senator, I do not have specific
recommendations for you, but we would be glad to follow up on
that if it would be useful.
Senator Moran. Thank you. Where are we now in the 737 MAX?
It seems like every week there is a report that an airline is
going to believe they are going to have that plane flying again
or certification is nearby. What is the status?
Mr. Muilenburg. Senator, we are in the final stages of the
process, so we are currently testing the final software
updates. When ready and with the FAA's approval, we will
proceed to a certification flight in the near-term. Subsequent
to that it would be the FAA's responsibility to evaluate and
issue an airworthiness directive. That is all work that we are
proceeding on over the next few weeks and months, but I think
it is important again that the airplane will return to service
when it is safe. This is not going to be timeline driven. We
are committed to answering every question the regulators have
and the airplane will fly when everyone is convinced it is
safe. That is the most important thing here.
Senator Moran. It troubles me that to get to that point is
certainly not that it is taking so long, I want the result that
you just described but with the right circumstance before we're
flying again, but it would suggest to me that there was much
more significant problems with the MAX 737 if it was previously
certified and yet now it takes so long. It is something more
than just a glitch, it is something more than just a minor
change. That makes me concerned about the process that allowed
it to be certified in the first place. What am I missing?
Mr. Muilenburg. Senator, I think you raise a very good
point. Our initial effort early this year was focused on the
MCAS updates that we have already talked about. Around the
middle of the year, as we were evaluating all of the other
inputs and data, we identified some additional safety
enhancements that we can make. Not something that was required
for certification but something that we thought while the
airplane was grounded was the right thing to do and a safety
enhancement, and rather than waiting to do that later after
return to service, we as a company and with the FAA decided
that we would take the extra time for those additional software
updates.
And that is the work we have been doing through the summer
and into the fall. That is designed to add additional software
redundancies throughout the flight control computers and that
is the final software we are testing. What I want to convey
here is this is really the culture of Boeing. And I understand
the questions that are being raised but when our teams find
opportunity to improve safety, that goes to the top of the
list. That is the top priority.
And if it takes time, if it takes money to do that, that is
where we are focused and that is why it is taking longer than I
think some anticipate.
Senator Moran. I request your follow up on your thoughts
about the FAA. Thank you.
The Chairman. Thank you, Senator Moran. Senator Markey.
Senator Udall. Senator Peters.
STATEMENT OF HON. GARY PETERS,
U.S. SENATOR FROM MICHIGAN
Senator Peters. Thank you, Mr. Chairman. Let me begin also
by expressing my sympathies to those who lost loved ones in the
two 737 MAX crashes and I would like to thank the families that
are here today for your continued attention to safety and for
working to prevent future tragedies like we saw here.
Over the years out aviation system has become the safest in
the world, but these tragedies certainly remind us so that we
cannot rest, safety cannot be taken for granted. There is no
doubt from what we have been hearing in the testimony here
today that many mistakes were made, and the consequences were
unfortunately tragic. The reports from technical experts
underscore that technology becomes increasingly complex. The
debate about how to move forward cannot be simply about a one-
size-fits-all regulatory regime versus a let the free market
just police itself type of approach.
We have a new paradigm and they need to be developed to
address the regulatory challenges associated with very complex
technology and that is something this Committee needs to weigh
in very heavily into as we move forward. Mr. Muilenburg, as you
know, the BP oil disaster in the Gulf of Mexico killed 11
workers, lasted 87 days, and cost upwards of $65 billion.
And in the wake of that disaster, it was revealed that the
oil and gas industry have lobbied for the reduced safety
precautions that could have prevented that disaster. We often
hear in Congress about how much our regulations cost industry
however thoughtful regulation plays an incredibly important
role in protecting the public.
So, I am curious if Boeing's view on oversight has changed
in the wake of this tremendous human tragedy as well as the
cost that this company is facing right now. Has your view
changed? You have talked in response to an earlier question
about having a balance. Clearly something is wrong with that
balance. Please let me know if your thoughts have changed
recently?
Mr. Muilenburg. Senator, my thoughts have changed. We have
learned lessons from these two accidents and the families that
are here with us today, the pictures we saw, they are
heartbreaking. They remind us of the importance of the work we
do and the paramount importance on safety. That is what makes
this industry great, and strong oversight is part of the fabric
of our industry, always has been, and I think this should give
us pause to take a hard look at that.
Senator Peters. Well, the hard look. You said we need to
look at the balance. Has the balance gone too far to allowing
the industry to police itself?
Mr. Muilenburg. Senator, I do not know if I can
characterize it that way. My sense is that we all have the same
objective here. We all want the safest industry possible. That
is our objective and my sense is that we could look at the
balance. There are refinements that would be worthy. I think,
you know, technology----
Senator Peters. Do you think it is out of balance now based
on what happened here? Do you think we have not just taken a
look at it, but seriously understand that the balance may be
out of whack if we delegate too much to industry and do not
have impartial eyes and make sure the regulatory regime is
sufficient. That you truly have impartial eyes looking at these
factors. It is going to save lives and you won't put a company
through the cost that you have when you balance those
regulations. Is it out of balance right now, yes or no?
Mr. Muilenburg. Senator, again, I think it can be improved.
I completely agree with you on the importance of strong
oversight. I have worked in this industry for more than three
decades from airplanes to spacecraft. People's lives depend on
what we do and strong oversight from the Government is a key to
the safety of our industry. So, I think we have a shared
objective there and we will work with you on examining any
improvements we can make. We have a mutual interest.
Senator Peters. Mr. Muilenburg, the NTSB report indicated
that the FAA and industry have historically used highly trained
test pilots to verify the safety of new aircraft models rather
than average pilots who typically have less experience. Does
Boeing use pilots with average training and experience?
Mr. Muilenburg. Senator, our Boeing test pilots are
experienced, highly qualified pilots. We work with airlines,
the FAA, and the regulators to bring other pilots in from
around the world as part of the evaluation, but I think as you
are pointing out as we look to the future again, we want to
make sure that the testing we are doing is representative of
that future pilot population.
Senator Peters. Thank you.
The Chairman. Thank you, Senator Peters. Senator Capito.
STATEMENT OF HON. SHELLEY MOORE CAPITO,
U.S. SENATOR FROM WEST VIRGINIA
Senator Capito. Thank you, Mr. Chairman. I thank the
Ranking Member as well. I want to say first of all to the
families who are here, extending my sympathies but also my
gratitude for you coming forward through your pain to bring to
us to Congress, which is not an easy thing to do, your
frustrations and probably stronger feelings in the loss of your
loved ones. I will say that when Colgan flight 3407 went down
in Buffalo in early 2009, the families that came forward to us,
I was on Transportation committee on the House side, made such
an incredible impact and it made flying on our regional
airlines much, much safer because of that.
So hopefully that will be what the result of this is for
you today and for all of us. Mr. Muilenburg, particular
attention has been called to the fact that Boeing later in the
development process of the MAX revised the range of flight
conditions that could lead to activation of the MCAS, but that
Boeing did not notify the FAA of these changes at the time.
This is troubling if in fact this is true. Was Boeing not
obligated by the FAA to report changes like the ones I just
described?
Mr. Muilenburg. Senator, I believe you are referring to the
low-speed extension of MCAS and I have seen those same reports,
but they do not reflect the facts. The extension of MCAS low
speeds was done in a rigorous way. It was done in a very
visible way. There was testing done on that from the mid-2016
time-frame to the early 2017 time-frame including flight test
with the FAA onboard. The FAA was aware of the low-speed
extension and ultimately certified that, and I believe FAA
leadership has publicly stated----
Senator Capito. So that is a false report then?
Mr. Muilenburg. I believe it is a false report. I believe
the low-speed extension was fully certified with the FAA.
Senator Capito. OK. Another report that has been out in the
media and among is that after the second flight went down that
Boeing actually actively lobbied the FAA to keep the planes in
the air. Can you respond to that?
Mr. Muilenburg. Senator, could you just clarify your
question for me?
Senator Capito. Yes, after the second plane with Ethiopian
Air went down that there was quite--several countries had
limited the flight of that plane. We have not done that yet in
the United States. There are media reports that Boeing was
actively lobbying the FAA to keep the planes in the air at that
time in this country. Is that true?
Mr. Muilenburg. Senator, let me, let me clarify what was
happening in that timeframe.
Senator Capito. Could you make it brief, please?
Mr. Muilenburg. Yes. We immediately after that accident
reached out to the FAA and other regulatory authorities to
understand what happened in the accident. What has made
aviation safe is that we make decisions based on data. At that
point we didn't have data and so we with the FAA were looking
to understand what happened. There were early reports that the
airplane had some kind of low speed, low altitude problem that
turned out to be incorrect.
So, we, with the FAA, were pursuing data to make a good
safety based decision. That was our position with the FAA. When
data became available, satellite data that was referred to in
the media, again with the FAA we came to a conclusion that
there could be similarities between the two accidents and that
led very quickly to a decision to ground the fleet.
Senator Capito. Well, I think, you know, in retrospect I
think it was pretty obvious and I do not want to say
conclusively so but there is a problem and a consistent
problem. The other thing that has really bothered me about this
whole thing and I questioned this in the last Committee hearing
that we had. Between the Lion Air crash and the Ethiopian Air
crash, it defies logic to me that some of these folks who wrote
e-mails or sent text messages did not come to you and to the
expertise of the engineering of these engines and of these
planes and say this is what we were talking about.
Why was there any reaction at all like that within your
company after the Lion Air crash? And do not tell me because
you did not have the official report, that would have maybe
saved those people in that Ethiopian Air flight.
Mr. Muilenburg. Senator, I think about that decision over
and over every day. And if we knew everything back then that we
know now, we would have made a different----
Senator Capito. OK, the question then, did people come to
you at the highest levels, at any level, and say wait a minute,
this is sounding familiar? Yes or no?
Mr. Muilenburg. Senator, after the first accident we
convened our broad technical team across Boeing. It wasn't any
single individual or small team. It was a broad team. We
brought all those experts to bear trying to assemble data from
the accident, understanding what occurred. We quickly with the
FAA issued an operational bulletin to remind everyone of the
training and the emergency scenario that----
Senator Capito. Around that particular system?
Mr. Muilenburg. Around what we call runaway stabilizer,
which again is the effect of that system, and at the same time
we began work on an MCAS software update in that timeframe.
Senator Capito. So, the answer is yes. Thank you.
Senator Cantwell. Mr. Chairman, just one point of
clarification. Are you saying Mr. Muilenburg the FAA did know
about the 2.5 trim not 0.6 but 2.5? The FAA knew about that?
Mr. Muilenburg. Yes, Senator. You are referring to that
low-speed extension which is the 2.5 degree trim?
Senator Cantwell. Yes.
Mr. Muilenburg. That is the low-speed extension. The FAA
did know about that and participated.
Senator Cantwell. Thank you.
The Chairman. Senator Udall.
STATEMENT OF HON. TOM UDALL,
U.S. SENATOR FROM NEW MEXICO
Senator Udall. Thank you, Mr. Chairman, and thank you to
the Ranking Member for having this hearing. And Mr. Muilenburg,
you know, I first want to say to all the people that stood up,
that I am very moved by you being here and that your losses are
very, very I think heartfelt across the Committee here. And,
you know, the thing that really bothers me is knowing that it
is preventable. It makes it even more outrageous that we
haven't made the kind of dramatic changes that I want to talk
to the CEO here about. Mr. Muilenburg, you showed some emotion
when these folks stood up and everything.
What should come from that emotion is some action to do
something to really make a difference, and for this Committee
to coalesce around the solution that is really going to move us
forward would require you to step forward and specifically say
what you support. And I haven't seen you do that in all the
questioning you have been asked over and over again. What would
you support? I mean, it is absolutely clear that it is too cozy
a relationship with the FAA and your airline. And so, what is
it you are going to commit to specifically in terms of reform?
That is why you are up here.
And that is what we want to see you do is to weigh in with
us, this is what would make a difference, this is what would
make it safer, this is what would make sure that we do not lose
passengers like this in the future or the crew.
Mr. Muilenburg. Senator, while I respectfully do not agree
with the characterization of coziness with the FAA, we respect
the independent oversight of the FAA and that is very important
to us from a safety principle standpoint. We have taken a
number of internal actions that we think are meaningful as they
relate to our own internal reforms on safety.
We are engaged in the legislative process, and Senator, I
appreciate your invitation for us to be involved in that. I
know there are many stakeholders. As you heard from me earlier,
we are committed to strong oversight in the aerospace industry.
It is part of what makes this system safe. We have a shared
objective and if there are things we can do to make it better
we will. I do not know John if you have any specific----
Mr. Hamilton. Thank you. Senator, you know, I would say
that, you know, one of the big issues was we made use of an
industry standard assumption on pilots and how they would react
and that proved incorrect in these two accidents. So, in terms
of things that I think we need to change with the FAA, we need
to go revisit some of these regulatory guidances and make sure
they are up to date.
I would even tell you that there are probably some
regulations that we advocate as part of the FAA reauthorization
bill, 10 regulations, that FAA should work with industry to
update based on technology that is out there today. But in
terms of opposing this, I used to be the lead administrator for
the ODA, and I can tell you that we have a respectful
relationship with the FAA, but we do have our differences of
opinion sometimes.
But we discuss those, we work it out on how we are going to
comply, and it is not a cozy relationship. It is a professional
relationship.
Senator Udall. It is a relationship that didn't work for
the consumers and for your employees that went down in those
flights. You and others in your company blamed the deceased
pilots and the culture of the countries where the crashes
occurred for the accidents. But from what we have seen in the
last year since the first crash, it appears that Boeing's own
culture is more blameworthy for installing a faulty system that
resulted in too many deaths and could have caused more.
This culture starts at the top and that is why I have been
asking you for the specifics of what you support, and I hope
after this hearing you will come forward and when there is
legislation out there say this is going to make it better and
come up here and spend some time to build the consensus to get
this done.
Because I think the large, powerful interests that are a
part of this do not want any reform. They want you to tinker
around like you are talking about it, but they do not want to
see any reform. If Boeing could not guarantee that pilots were
prepared to fly these jets, your company should not have sold
them. Did anyone at Boeing question, hesitate, or raise any
issues prior to selling the 737 MAX 8 with this software to
Lion Air or Ethiopian Air?
Mr. Muilenburg. Senator, first we look forward to
responding to your request there and providing inputs on the
reforms. To your question, we do rely on the airlines and the
regulatory authorities around the world as part of this
integrated system to make sure we are fielding airplanes and
crews that can fly safely. I do think it is important for me to
clarify a point that you made earlier. We have not blamed the
pilots and I know that has been reported but that is not our
company position and it never will be.
We are responsible for our airplanes. We are responsible
and we own that. Regardless of cause, any accident with one of
our airplanes is unacceptable.
Senator Udall. That change is welcomed but that about the
culture went out from your company early on. Thank you, Mr.
Chairman.
The Chairman. Thank you, Senator Udall. Let's do this at
this point. Mr. Muilenburg, the JATR published 12 main
recommendations. Will both of you get back to us on the record
and tell us Boeing's position with regard to these 12
recommendations?
Mr. Muilenburg. Senator, we will.
The Chairman. Thank you. Senator Markey is next.
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Thank you, Mr. Chairman. Let me begin by
recognizing the families who lost so much on these flights.
Many of you are here today including Michael Stumo and Nadia
Milleron, the parents of Samya Stumo, a University of
Massachusetts Amherst graduate and a resident of Sheffield,
Massachusetts who was tragically killed on the Ethiopian
flight. The losses that the Stumo family and all of the
families suffered is absolutely inexcusable and we will
remember that as we are moving forward in the drafting of
legislation. We will do it in the memory of your families.
One thing is clear to make sure that safety is our top
priority is to guarantee that every aviation safety measure is
built into every plane and that it is never for sale.
Unfortunately, our current laws only prevent aircraft
manufacturers like Boeing from selling critical safety elements
for an additional price. Existing rules allow companies to
charge extra for non-critical safety enhancing features. And
Boeing actually does charge more for those technologies.
The 737 MAX aircraft involved in the Indonesian and
Ethiopian crashes lacked two, two safety enhancing features, an
angle of attack indicator and a disagree light. Both of these
technologies would have helped the pilots recognize the faulty
sensor readings were causing the plane's automated flight
control system to push the aircraft nose down toward the
ground. With that knowledge the pilots may have been able to
take more effective action to prevent these crashes. In fact,
the Indonesian crash report released last week specifically
cited the lack of a disagree light on the 737 MAX as
contributing to the Lion Air tragedy.
Shamefully, the law allows Boeing to treat these safety
technologies as a la carte add-ons that airlines can obtain
only by paying an extra fee. A la carte add-ons, safety. Not
like XM radio, all leather seats on a plane, safety is a la
carte. Safety is an added on feature. These tragic crashes have
made it all too clear that there should not be any distinction
between critical and non-critical safety enhancing features and
that is why I have introduced my Safety is not for Sale
legislation.
My bill will require aircraft manufacturers like Boeing to
offer or provide any technology that measurably enhances safety
without an additional charge to airline carriers. If you
believe that safety should never be for sale, the question is
why was it? Now you seem to now recognize that the disagree
light should be standard, but you have yet to say the same
thing about the angle of attack indicator and whether or not
that should be offered for free or whether or not each airline
should be given the option of not building it into the plane
for free.
So, I think you have to make a decision here in terms of
where you want to go because otherwise your disagree light is
still oncoming from Boeing toward the safety features. So, I
want first of all to have you answer whether or not according
to the Wall Street Journal you agree that Boeing did not
originally include the disagree light on the 737 even though
the same technology was standard on prior models of the
airplanes, is that correct?
Mr. Muilenburg. Senator, I feel I need to respond to your
earlier point about selling safety. We do not sell safety. That
is not our business model. And I do want to clarify your points
on the angle of attack indicator. That is a system that we have
offered as an option to airlines. Some airlines do not want it.
It is not necessarily a safety improvement. It actually takes
up space on the flight deck displays and more information on
the displays is not necessarily safer. So that is not a safety
feature. On the angle of attack disagree----
Senator Markey. All I am saying is you should not offer it
for a price. You should give the option to the airline without
any price attachment. Do you agree to do that?
Mr. Muilenburg. Senator, yes. And in fact, we have already
announced that the angle of attack disagree alert will be on
all MAX airplanes going forward, standard, and the angle of
attack indicator will be available as an option to all airlines
at no cost.
Senator Markey. So, given your stated support for the
principle behind my legislation, will you support my
legislation that ensures that you offer to provide any
technology that measurably enhances safety without an
additional fee to airlines? Would you agree to support that
legislation?
Mr. Muilenburg. Senator, I haven't seen the specific
legislation. I think the principle around focusing on safety is
a top priority. I agree with that and it is a worthy principle,
and I ask if we could take a look at the legislation.
Senator Markey. The key is just--the word is free to an
airline for anything that measurably impacts safety. Do you
agree?
Mr. Muilenburg. Yes, we do not sell safety and that is not
our business model.
The Chairman. Thank you. Thank you, Senator Markey.
Senator Duckworth.
STATEMENT OF HON. TAMMY DUCKWORTH,
U.S. SENATOR FROM ILLINOIS
Senator Duckworth. Thank you, Mr. Chairman. So, I am going
to try to put some of the issues here into layman's terms. I
want to first of course share my sincere condolences to the
families who are here, but also to the families in Ethiopia and
in Indonesia who are watching this hearing, who will be
watching this hearing. I do not speak Amharic, but for the
Indonesians----
[Speaking in a foreign language.]
Senator Duckworth. And what I just said was we will as
Senators get to the bottom of this tragedy and we will continue
to investigate this. We will not stop because you see Boeing
sells its aircraft to the world and we in America have well-
earned reputation as leaders in aviation in the world and I
want us to reach that shining example once again.
Pilots know that tragedies do not occur in a vacuum.
Catastrophic outcomes result in long succession of failures
that often overwhelm the pilots at the control of the aircraft.
We call it an aviation the accident chain and there are many
links in an accident chain that must happen that would
eventually overwhelm the pilots and results in the crash. Many
of these links in the accident chain happened with Boeing and
your decisions in the development of the 737 MAX. So, let me
talk about what has happened here. You put a sensor on the
outside of the aircraft, which is standard, but you allowed
that sensor to override the pilot's input in this system.
So, in every other 737 aircraft, there is the function of
the, you can pull back the pilot, the cutout, and that will
override that uncommanded nose-down altitude. That is standard.
That is the basic assumption. As you said you use an industry
standard on how a pilot would react to a malfunction like that.
Uncommanded nose down, every pilot including helicopter
pilots, you pull back. But what you did was you put an MCAS
system into an aircraft, you didn't tell the pilots that this
MCAS system was in there, and you put in a function in order
for the MCAS to work the way you wanted it to work after the
pilot does to uncommanded--reaction to the uncommanded nose
down, in every other 737, cutout, that is the end of it.
In the 737 MAX, after five seconds, the system resets and
it pushes the nose right back down. The pilots had exactly
three seconds to pull, nose down, pull up. Now we got to do a
new procedure that did not exist in previous 737 models, which
is the electronic cutout switch because you have now put in a
system that overrides the pilot in command of that aircraft.
So, you have been telling this Committee that, yes, you use
basic pilot reactions. That is true. But you have not been
telling this Committee the whole truth. Time and again, this is
my frustration, Boeing has not told the whole truth to this
Committee and to the families and to the people looking at
this. Yes, the pilots did exactly what they were supposed to do
but five seconds later, especially if that sensor is still
stuck, it overrides what the pilot does, and it pushes the nose
right back down again. Three seconds.
A pilot's best friend is time and altitude. And on takeoff
there is no altitude and he has got no time. You set those
pilots up for failure. And when I sent you a letter asking you
to answer several questions, it took Boeing over five months to
respond to my question. I only got the answers the day before
you and I met. And one of the questions I asked was, what date
did Boeing discover that a stuck angle of attack vane would
result in MCAS issuing persistent commands with unlimited
authority to trim the airplane nose down?
In layman's terms, if this vane is stuck, MCAS will
continue to provide faulty directions and will keep pushing
that nose down over and over and over again no matter how many
times an experienced 737 pilot pulls back on the yoke, five
seconds later, reset, nose back down. You knew in 2016 that
this was happening and your team at Boeing decided we didn't
need to fix that because of well-understood piloting techniques
and procedures.
But the problem is that the well-understood piloting
techniques and procedures are to pull back and that is it. But
you added something else. You put in a system you didn't tell
pilots about and then you put in an override by resetting the
system 5 seconds later.
Boeing is the company that built the Flying Fortress that
saved Europe. I remember watching B-17s fly above--it is a
storied aircraft that has rescued the free world and yet you
knew about these problems and you continued to put the system
into place. And when we asked you to answer these questions,
you have told this Committee and you have told me half-truths
over and over again, including in that meeting. This is why I
am so upset. You have not told us the whole truth and these
families are suffering because of it.
The Chairman. Thank you, Senator Duckworth. Members of the
Committee, at this point Senator Scott is deferring his time to
the Chairman of the Subcommittee, Senator Cruz. You're
recognized, sir, for five minutes.
STATEMENT OF HON. TED CRUZ,
U.S. SENATOR FROM TEXAS
Senator Cruz. Thank you, Mr. Chairman. Mr. Muilenburg, I
have to say the testimony here today has been quite dismaying.
I want to focus on the text exchange that has been referred to
and has been publicly reported on. This was a text exchange
between Mark Forkner who was then Boeing's technical pilot for
the MAX, chief technical pilot for the MAX, and Mr. Gustavsson
who in 2018 was promoted to being Boeing's 737 chief technical
pilot. Is that right?
Mr. Muilenburg. We believe that is the case, Senator.
Senator Cruz. So, this exchange is stunning. Mr. Forkner,
``oh, shocker alert. MCAS is now active down to M2. It is
running rampant in the sim on me. At least that is what Vince
thinks is happening.'' Gustavsson responds, ``oh great, that
means we have to update the speed trim description in volume
2.'' Mr. Forkner, ``so basically I lied to the regulators
unknowingly.'' Gustavsson, ``it was not a lie. No one told us
that was the case.'' Forkner, ``I am leveling off at like 4,000
feet, 230 knots, and the plane is trimming itself like crazy. I
am like what?'' Gustavsson, ``that is what I saw in sim 1 but
on approach I think that is wrong.'' Forkner, ``granted I suck
at flying but even this was egregious.''
That exchange describes what happened in Lion Air and
Ethiopian Air. The men and women who are gathered here with the
photos of your loved ones, 346 people are dead because what
these chief pilots described as egregious and crazy--that is
their language, that is Boeing's internal language in this
exchange. Now what I find truly stunning, Boeing handed this
exchange over to the Department of Justice in February.
In March, I chaired a hearing of the Aviation subcommittee
on these two crashes. Boeing did not see fit to give this
Committee that exchange, nor did Boeing give it to the FAA or
the Department of Transportation. But what I find most stunning
is your testimony here today that you said you first learned of
this exchange a couple of weeks ago.
These are senior leaders at Boeing in an exchange saying
and I will quote again, ``so I basically lied to the
regulators.'' Look, I have practiced law for a lot of years.
You had your lawyers look over this document and they read a
senior leader, after these crashes occurred, saying they lied
to the regulators. Mr. Muilenburg, how in the hell did nobody
bring this to your attention in February when you produced this
to the Department of Justice? How did you just read this a
couple of weeks ago?
Mr. Muilenburg. Senator, again to clarify my earlier
comments. I was made aware of the existence of this kind of
document, this issue, as part of that discovery process in the
investigation early in the year as you pointed out. At that
point I counted on my Counsel to handle that appropriately.
Senator Cruz. Did you read this exchange? Look, I was made
aware documents were being produced. Whether that is passive
voice and disclaiming responsibility--you are the CEO, the buck
stops with you. Did you read this document? And how did your
team not put it in front of you, run in with their hair on fire
saying we got a real problem here? How did that not happen and
what does that say about the culture at Boeing if they didn't
give it to you and you didn't read it? If you didn't say, I
want to read it and see what happened?
Your testimony here earlier today is well we are not sure
what they were talking about because he is not at Boeing
anymore. How did you not in February set out a 9 alarm fire to
say, we need to figure out exactly what happened, not after all
the hearings, not after the pressure but because 346 people
have died, and we do not want another person to die?
Mr. Muilenburg. Senator, as you mentioned, I didn't see the
details of this exchange until recently and we are not quite
sure what Mr. Forkner meant by that exchange. His lawyer has
suggested he was talking about a simulator that was in
development in that time period. That is where he was working.
That could be the case. We do not know. I fully support diving
deep into this and understanding what he said and what he meant
but I can also tell you that in that same time-frame where his
original message was made----
Senator Cruz. Mr. Gustavsson still works at Boeing?
Mr. Muilenburg. Senator, yes, he does.
Senator Cruz. Have you had that conversation with him?
Mr. Muilenburg. Senator, my team has talked with Patrick as
well.
Senator Cruz. Have you had that conversation?
Mr. Muilenburg. Senator, I have not.
Senator Cruz. My time has expired.
The Chairman. Thank you. Thank you, Senator Cruz. Senator
Tester. Let's do this. The entire poster--Senator Cruz if you
can have that reduced in size and we will enter into the record
without objection at this point. So ordered.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The Chairman. Senator Tester.
STATEMENT OF HON. JON TESTER,
U.S. SENATOR FROM MONTANA
Senator Tester. Thank you, Mr. Chairman. I want to thank
you and the Ranking Member for having this hearing and I know
for the two folks on the panel this morning it is probably a
painful morning for you. But the fact is it is infinitely more
painful for the folks that are sitting a couple rows behind
you. You have said many times, Mr. Muilenburg, that mistakes
were made and obviously they were.
Unfortunately that admission was made after 346 people
died. And there are a lot of reasons an airplane can go down
whether it is pilot error, whether there is an equipment
malfunction, or birds, but safety should not be one of them.
And in a previous question you said you guys do not sell safety
and I will be honest with you I didn't listen to the whole
thing. But you damn well better sell safety.
I fly four legs a week and there is a lot--if not for the
grace of God it could have been me on one of those airplanes
and we expect there to be safety. Obviously, something went
wrong, and it is not the first time. There is the MCAS
situation here that was pointed out as several people on this
Committee have already pointed out to you and nothing was done
or to your leadership team.
There was a South Carolina whistleblower that talked about
debris being left in the planes or those technicians were
removed. There is a KC-46 finding, wrench bolts and trash
inside the new airplanes. That was in June of this year. There
was a cargo 777. You get the deal. It goes on.
And so the question is the one that Senator Udall brought
up that you didn't answer, and I think other people on this
Committee also brought it up and that is, what do we do? What
do you do? So I will be a little more specific. I do believe
there is a cozy relationship and I do not believe that quite
frankly time and money are no object because there is also
plenty of examples.
For example in 2014, FAA made regulatory changes to safety
standards that would have required changes to the MAX to add
new crew alerts. Boeing appealed it to the FAA and sought to
seek an exemption arguing it would cost too much money, $10
billion, which is a lot of money, but the truth is that it
wouldn't happen if FAA would have been doing their job and it
also wouldn't have happened if you would have known what the
hell was going on.
So my question is, and I know there was a push a number of
decades ago about privatization of the Federal Government, and
I think that is how we got here is privatization of Government.
But why do we not just turn over the certification back to the
FAA and let them do it and then they would be the ones sitting
at this desk and not you. Why not do that?
Mr. Muilenburg. Well Senator, we share your focus on safety
and I can confidently say that is our number one priority.
Senator Tester. OK, cool, but we failed in this case and
there is a whole bunch of people back there that are going
through incredible anguish because we failed.
Mr. Muilenburg. Senator, I agree, and we feel----
Senator Tester. So let's get to the question and look there
is--I can pivot with the best of them. I know how to pivot, I
know when people are pivoting. You are pivoting. Tell me if you
would support having the FAA do the certification?
Mr. Muilenburg. Senator, we believe that delegated
authority process that we have today has contributed to improve
safety over the last two decades. As I mentioned earlier, we
are open to improving it but the idea that we can tap the deep
technical expertise for companies across the aerospace industry
is a valuable part of the certification process. But the FAA is
the certification authority and should be and should continue
to be.
Senator Tester. Well, but they really aren't. The truth is
you can say that they have the ultimate responsibility, but the
truth is if the issues aren't flagged by the ODA, by your
people doing the certification, the FAA never does it because
quite frankly it would cost them more money to have the FAA do
the certification.
And by the way, it is costing you money so we could charge
you for that certification to help pay for it so it would have
no reflection on the taxpayers. So the question becomes--I am
going to tell you what, when the FAA says you need to do this
and you come in and say no, you do not need to do this, it is
fine if nothing happens, but when 350 people die, we got a
problem.
And to bring up the point that Senator Cruz brought up that
there was plenty of information out there on this and nothing
was done. And so the whole thing about it, you know, when it
comes to safety, time and money are no object is not--the
record certainly does not show that.
Mr. Muilenburg. Senator, I understand your points and
criticism and I think it is true that we operate in a very
competitive world and we are the only large airplane,
commercial airplane maker left in the United States. We do have
competitive pressures around the world, but I can also tell you
that it never takes precedence over safety. Our business model
is safe airplanes.
Senator Tester. Think it absolutely could be argued that it
did in this case, and I heard Senator Duckworth questions. And
Boeing has had an incredibly valuable name, but I have got to
tell you and I think I told you guys this an office some time
ago, I would walk before I would get on the 737 MAX. I would
walk. There is no way and the question becomes when issues like
this happen, it costs your company huge. And so you shouldn't
be cutting corners and I see corners being cut and this
Committee is going to have to do something to stop that from
happening. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Tester. I am going to ask
that Mr. Muilenburg answer on the record his opinion of the
current ODA system, whether it should be modified. Answer
Senator Tester's question.
Senator Johnson.
STATEMENT OF HON. RON JOHNSON,
U.S. SENATOR FROM WISCONSIN
Senator Johnson. Thank you, Mr. Chairman. Let me add my
condolences to the surviving family members and friends of the
victims of these tragedies.
And Mr. Muilenburg, among many failures it strikes me there
are two primary failures. First and foremost in the original
design and certification process, and then second in the
reaction after the first crash. So let's concentrate on those
two things. Tell me if I am getting this right, the 737, a very
successful airframe. New, more fuel-efficient engines were
available and so you wanted to include that and upgrade of that
airframe, correct?
Mr. Muilenburg. New fuel-efficient engines and some other
enhancements.
Senator Johnson. And those fuel-efficient engines created
different aerodynamics for that aircraft, correct?
Mr. Muilenburg. That is correct.
Senator Johnson. Is the MCAS system, is that a standard
type of automatic pilot type of software system on planes? Is
that pretty standard to have something like that?
Mr. Muilenburg. Senator, the MCAS system that we have on
the MAX is unique to that airplane.
Senator Johnson. So it was put in there specifically
because you added a different type of engine to a known,
successful airframe which made that less stable and required
some kind of, as you called it, a runaway stabilizing system?
Mr. Muilenburg. Senator, if I can clarify that, the 737
family has a system called the speed trim system and the MCAS
is an extension of that system that is unique for the MAX.
Senator Johnson. Unique because of that added engine
design?
Mr. Muilenburg. We tailor the software of each one of our
airplanes so that they optimize the handling qualities for the
unique airplane configuration.
Senator Johnson. But again going into the introduction of
this 737 MAX, you realize that that airframe was changed
because those engines required this MCAS system for
stabilization?
Mr. Muilenburg. That was one of the additions we made to
create the handling qualities we wanted for the pilots. We also
made some changes to things like the vortex generators on the
wing. So it is an integrated solution to creating----
Senator Johnson. You are well aware that this design change
created something that required an MCAS system. So now fast
forward, you have the Lion Air tragedy. According to Senator
Cruz, the message that he set up there which I believe was
written on November 15, 2016 just a couple years before that
Lion Air crash, there are people or it sure appears some in
Boeing that knew exactly or suspected what went wrong because
the integrated design, you had an MCAS system to take care of
this eventuality in the flight characteristics, correct?
Mr. Muilenburg. Senator again, I am not exactly sure what
was meant by that traffic, that e-mail traffic, but I can tell
you in that timeframe----
Senator Johnson. It seems pretty obvious, does it not? I
mean it does not seem pretty obvious to you? I mean again you
are engineers, you understand how this was designed, you
understood you needed an MCAS system to make up for that
instability, and then something happened. I would think you
would diagnose pretty fast.
I mean again, I am reading these things. I am not a pilot.
I am not an aerospace engineer and yet I am scratching my head
going, whoa, something really wrong happened. You know a whole
lot. Why didn't you react faster?
Mr. Muilenburg. Well Senator, completely separate from that
e-mail traffic and what it might mean, our team very quickly
after the Lion Air accident assembled with the regulators. We
evaluated the data from the accident. We saw that MCAS was
involved and so we began to take quick action immediately. It
does not have to do with that e-mail. That is not relevant to
that discussion. Our team was immediately identifying----
Senator Johnson. Which is exactly my point. The fact that
it took another tragedy to actually ground the airplanes so you
could actually have a true--a fix that worked is I think really
what is on the table here. And the diagnosis is why didn't we
react? Why didn't we ground that aircraft a lot sooner so that
another tragedy wouldn't happen?
Mr. Muilenburg. And Senator, we have asked that question
over and over. And you know, if we knew everything back then
that we know now, we would have made a different decision. The
decision that was made on that at that point with the data we
had, we quickly convened a safety review board, the FAA coming
out of that confirmed the continuing airworthiness of the
airplane and issued that officially.
That was the safety case that was built. But Senator as you
pointed out we have learned from the second accident and if we
could go back, we would have made a different decision. And we
have learned. We are making those improvements to MCAS and that
is where our focus is going forward.
Senator Johnson. Boeing is an important company. It is
important for our economy. I want to see you get this right,
but you have to properly diagnose this. You have to accept
responsibility for what happened so we actually can make those
changes both within Boeing and also within the FAA. Thank you,
Mr. Chairman.
The Chairman. Thank you, Senator Johnson. Senator Rosen.
STATEMENT OF HON. JACKY ROSEN,
U.S. SENATOR FROM NEVADA
Senator Rosen. Thank you. And I want to thank all the
families that are here today who have lost their most precious
loved ones. Their death should not be in vain and we all have
to do every bit of our part together to make sure that we
prevent future tragedies from happening. And in order to honor
the memories of these 346 souls and the empty chairs that they
will leave behind this Thanksgiving and Christmas and on and on
and on.
And so you said additional information wasn't available. I
want to touch a little bit on MCAS and Brazil. According to
news reports, when the Brazilian National Civil Aviation Agency
came to the U.S. in 2017 to test out the MAX 8, they determined
the changes made to the old 737 were significant enough that
they needed much more information from Boeing and were going to
provide it for their pilots.
When they eventually published their pilot training
requirements, they were therefore able to flag the MCAS as one
of the changes the pilots needed to take into consideration
when flying the MAX 8. And yet for United States pilots, MCAS
wasn't mentioned in their manual.
So, Mr. Muilenburg, why was this information not flagged
for your other customers who had 737 MAXs in their fleet? And
to prevent your company from sharing these differences to other
regulatory bodies or operators, I have here the Brazilian
manual. They decided their pilot should learn this and why
wouldn't you provide it to the United States pilots?
Mr. Muilenburg. Senator, I cannot comment on the details of
the Brazilian document. John may be able to but let me more
broadly make the point that that is exactly how the process is
supposed to work. We provide information, we evaluate with the
regulators in the various jurisdictions what should be included
in the training. We have no desire to hide features of the
airplane that pilots need to know.
Senator Rosen. But they reported back to you and it was
significant enough for them to put this in their manual then
why wouldn't you consider that it was a significant change?
Mr. Muilenburg. Senator, I understand your point and that
was a decision that was made in Brazil. Again, I am not
familiar with the details of that one. But the discussion----
Senator Rosen. So let me just ask you this question then,
moving forward will you commit to making it a practice when
other countries are clearly paying attention enough to make
significant changes to their pilot manuals based on major
operational changes, that Boeing will send these notifications
of changes to the other users of these aircraft so at least
they have the opportunity to train their pilots? You denied
them the opportunity, sir.
Mr. Muilenburg. Senator, we are committed to sharing that
information and that is part of our international
collaboration. But I also want to note again that the
discussion around MCAS training and whether it would be
included in the training manuals that was an active, iterative
discussion with the FAA, and it was a decision made based on
safety.
Again, we try to put information in the training manuals
that focuses on the effects of failures and things that will be
valuable to the pilots and it is not always the case that more
information adds to safety. Although in this case, we
understand this, and this is one of the additions going
forward.
Senator Rosen. Brazil thought it added to their safety. But
I want to touch a little bit on Senator Fischer, the question
that she raised earlier. All these changes have taken place, of
course, over the years and this plane is still working off its
original certification from 1967. This is despite the fact that
pilots have told me that the MAX 8 is in no way functionally
similar to the original 737s that took to the skies 52 years
ago.
I said in the last hearing that we had, seems to me like
there have been so many significant modifications. It is almost
as if you took a canoe and turned it into a cruise ship. So Mr.
Hamilton, can you tell us how many derivative certificates
Boeing has received for the 737 since initially being certified
over 50 years ago?
Mr. Hamilton. Senator, I do not have the exact number in my
head, but it is approximately 14.
Senator Rosen. Fourteen or 814?
Mr. Hamilton. Fourteen derivatives. But I will--let me take
the action to follow up with you on that.
Senator Rosen. Thank you. I appreciate that. And the last
thing I am going to ask. Do you believe that the 737 MAX is
functionally the same plane that was certified in 1967?
Mr. Hamilton. Senator, as I mentioned to you earlier,
Senator, the safety standards have evolved as the airplane has
evolved, and one of the important things I think to understand
is what is really important also is for the pilots as they
transition from an earlier version of the 737 to the newer
version, that the airplane behaves and handles in the same way.
That was important from a handling characteristics standpoint--
--
Senator Rosen. And important enough for Brazil to mention
but not for us?
Mr. Hamilton. With respect to that Senator, so there is a
joint operation evaluation board that determines the training,
but other regulators can determine what training they want to
do above and beyond based on the information. I do not know the
specifics of the Brazilian document you are referencing. We can
follow up on that.
The Chairman. Thank you. Thank you, Senator Rosen. Senator
Blunt.
STATEMENT OF HON. ROY BLUNT,
U.S. SENATOR FROM MISSOURI
Senator Blunt. Thank you, Mr. Chairman. So Mr. Muilenburg,
I do not want to absolve you from both the opportunity and
responsibility to go back and look at that long question from
Senator Tester and answer it for the record. But for now one of
the sources, one of the central thoughts in that question was,
why shouldn't we change this process and go back to where it is
no longer cooperative, or the FAA takes full responsibility?
Give me the answer to that. Should this process be changed
where the Federal Government is fully responsible with
employees only hired by the Federal Government? What impact
would that have on safety?
Mr. Muilenburg. Senator, I believe the data clearly shows
that creation of the delegated authority process and its
implementation has enhanced safety over the last couple of
decades. I mentioned earlier about a 95 percent improvement in
aviation safety over the last couple of decades. I think a
portion of that at least can be attributed to the delegated
authority process.
That does not mean we should not refine it, reform it over
time, but the fundamental process of strong Government
oversight combined with deep industry technical knowledge in
the right balance is a strong safety process. And I firmly
believe that is one of the things that has contributed to
aviation safety. And that process demands oversight and we are
fully supportive of strong oversight, but we also fully support
the idea of tapping deep industry technical expertise. And that
combination is the safest combination.
Senator Blunt. And what do you think the view of the
industry technicians is of their responsibilities there? Do you
think they feel the right level of both responsibility and
liability of providing the information that they need to
provide?
Mr. Muilenburg. Senator, they do, and I can tell you that
is the culture of our company. And I respect the comments that
were made today, and the questions have been raised about our
culture. We deserve the scrutiny, but I have been at this
company for 34 years. I know the people of Boeing. You all know
the people of Boeing. These are 150,000 people that every day
come to work because they have an important mission. They are
honest, they are resolute in their efforts, they are committed
to safety. That is our culture and every employee at Boeing--
that is just how we think about the work we do.
And we are going to continue to improve as a company. I am
not saying we have done everything right. As I have noted
today, we have gotten some things wrong. But this is a great
company with a great legacy that is committed to excellence and
where we can improve, we will, where we can learn we will, but
our culture is about safety. That is at the very core of
Boeing. It has been that way for 103 years.
Senator Blunt. Alright. Mr. Hamilton, I had two or three
questions that actually Senator Rosen just asked pursuing that
further. But you have got a 1967 certification that has had 14
variants since 1967. You have a significantly different plane
that is based on the 14th variant of the original plane.
What difference do you think would have made if the
certification process would have gone back to the we are
certifying a new plane? Would that have made a difference in
the MCAS system? Or you have been doing this a long time, what
difference would it have made if we hadn't built on the
previous half-century of this plane's history and just had
started with a new plane. Would that have been better or worse?
Mr. Hamilton. You know, in part 21 of the Federal
Regulations, it spells out the change product rule which is how
you assess for a derivative type certification. And it is a
process that is in the USFAA's regulations. It is also in
European and other countries regulations. And it requires you
to look at all significant changes and step up. I think there
is an assumption here that derivative type certification is
less robust than the new type certification.
I think when you look at new types of certifications, or
you oftentimes have some exceptions or equivalent levels of
safety very similar to what you see on a derivative. So I am
not sure it would have necessarily resulted in a safer
airplane. It might have driven some different design decisions
though, but fundamentally one of the things that happened in
these two accidents was this assumption around how we expected
crews to respond under certain situations, which proved to be--
it did not happen.
And I think you know, that is a fundamental issue that we
have to address in the industry.
Senator Blunt. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Blunt.
Senator Blackburn.
STATEMENT OF HON. MARSHA BLACKBURN,
U.S. SENATOR FROM TENNESSEE
Senator Blackburn. Thank you, Mr. Chairman. Thank you for
being here today and for taking our questions. I will tell you
this is you have responded you have addressed Senator, Senator,
Senator. I think you should be addressing victims because they
are the ones who we are asking questions on behalf of and they
are the ones who have come today on behalf of their family
members.
And another thing I want to ask you, you have mentioned a
couple of times a lack of awareness of e-mails or documents or
communications and you know, Mr. Muilenburg, we have something
around here, before we vote, we say we read the bill so that we
know what is in it. And if we need to ask questions, we ask
questions, and we develop that awareness that is so necessary
to make good decisions and to have a full view of the situation
that is in front of us.
And it is disconcerting to hear someone who is to be the
leader of a company to say I wasn't aware, or I didn't know, or
I haven't read that, nobody made me aware of that, I depended
on that. You know, we call that passing the buck and it is your
responsibility if you are going to lead the company to have
that awareness.
So have you at this point read each and every page of every
document that is relative to the situation in this case?
Mr. Muilenburg. Senator, I cannot say I have read every
document, every page. I know we have provided more than half a
million pages of documents as part of the production process
over the last year. I accept your input and your criticism. I
am accountable, our company is accountable. Accountability
starts----
Senator Blackburn. I appreciate that, but I think that it
is unsettling to hear you say I haven't read that. Let me move
on. I do believe that you are in the business of safety as a
priority and even though you say you do not sell safety, let us
talk a little bit about the simulators because you had pilots
that were training in the simulators as well as training in
flight, correct?
Mr. Muilenburg. You are referring during the MAX
development?
Senator Blackburn. Yes.
Mr. Muilenburg. Yes, Senator.
Senator Blackburn. OK. So the simulators that were being
used for training, were they built by the same engineers with
the same components, the same sensors, the same systems as the
MAX system?
Mr. Muilenburg. Senator, we have a wide variety of
simulators, some of which are what we call conformed simulators
which represent the actual hardware and software of the
airplane. We have others that are engineering simulators.
Senator Blackburn. So it is conceivable that some of the
pilots were not training on this specific simulator? And then
you also--you know, Mr. Peters had started down a line of
questioning with you about the pilots and the pilots that were
trained. And you only had highly experienced pilots and
simulators before flying the new MAX system, correct?
Mr. Muilenburg. Senator, I was referring to our Boeing test
pilots. We also have pilots from a number of other
organizations, regulators, and airlines.
Senator Blackburn. Why would you not use pilots with a
variety of experience, a wide range of experience? Because
there are pilots with the wide range of experience that are
going to be in that cockpit flying that plane in real time.
Mr. Muilenburg. Senator, I agree with your view on the
necessity of having a variety of pilot experiences involved in
the testing process, but again our Boeing pilots are not the
only testers in the process.
Senator Blackburn. OK. Well, then let's take it this way.
What changes are you going to make in the simulators and in the
training that is going to bring to account for human factor?
Mr. Muilenburg. Senator, we have made several changes and
have more to come but to start the baseline training program
for the MAX is a roughly a 24 day training program which
includes heavy use of simulators, advanced simulators. We have
also modified the computer-based training for the incremental
training between the NG and the MAX. We have added visibility
to the training materials for the MCAS system that we have
talked about.
That new training is all currently being evaluated and will
be ultimately certified by the regulators to make it a baseline
in the program. We are also investing R&D significantly in
advance----
Senator Blackburn. Let me ask you this, I appreciate all of
that and I appreciate your answer. Prior to these occurrences,
did you feel that your training was not sufficient?
Mr. Muilenburg. Senator, no, we implemented the training
that was planned and certified for the airplane.
Senator Blackburn. I yield back.
The Chairman. Thank you, Senator Blackburn.
Senator Scott.
STATEMENT OF HON. RICK SCOTT,
U.S. SENATOR FROM FLORIDA
Senator Scott. Thank you, Mr. Chairman. First off, my heart
goes out to all the families. I mean, I just cannot imagine,
you know, the impact on these families after these tragic
accidents. I come from Florida, so air travel is a pretty big
deal for us. 126 million people traveled to Florida as tourists
last year and a lined share of them came by aircraft. So the
safety of everybody is really important. Mr. Muilenburg, the
President and CEO of your commercial airlines was let go after
this. So what is your process to hold people accountable to
make sure this does not happen again?
Mr. Muilenburg. Senator, first of all my company and I are
accountable. I believe that accountability starts with me. My
Board took some recent actions regarding my position, which I
fully support and will allow me to focus even more on safety.
So every action we take strives to focus on safety. I have also
taken some management actions. Again, those are focused on
operational excellence and safety going forward. As other
reviews are completed, if we see additional actions that need
to be taken, we won't hesitate.
But in some cases, accountability also includes
improvements to our processes and our organization structure,
and that gets to some of the changes we announced on our safety
review boards, our new safety organization, our new board
safety committee, and the realignment of all 50,000 of our
engineers to our chief engineer in terms of reporting
structure. All of those accountability actions are important
and all of them are focused on safety.
Senator Scott. So if anybody, if any of your--whether it is
engineers or nonengineers, if somebody has a concern in the
future about safety, what is the process you have created to
make sure that it gets to you and you can react to it because
ultimately as a CEO the buck stops with you?
Mr. Muilenburg. Senator, that has been one of the key
learnings from this whole process is we need to elevate the
visibility on safety issues that might come up the at the
ground floor level. Make sure they get the right visibility and
action. So a couple of things we have done there. One is again
restructuring our safety review boards. So I now get a weekly
update on safety review boards from across the Boeing
enterprise at a detailed level, which I found to be very
helpful.
We have also with the start of our new safety organization
under Beth Pasztor, instead of having those safety teams
underneath our businesses, they are now separated and report up
through our chief engineer. Any safety concerns that employees
have will come through that organization.
We set up a new anonymous reporting system for those
employees that want might want to make anonymous reports to
facilitate that, and we continue to have a full range of ethics
hotlines across our enterprise that encourage employees to make
their inputs. And we have a culture of asking our employees to
speak up. We want them to speak up. We want to make sure they
are heard and that we take action.
Senator Scott. Have you made any changes at the Board level
to increase the accountability for all employees?
Mr. Muilenburg. Senator, our Board has been very engaged in
this entire process. One of the things we did is a now about
six months ago I asked our Board to set up an independent
review led by Admiral Giambastiani. He has a tremendous safety
background. That Committee came forward with a number of
recommendations, some of which I mentioned in things that we
have implemented.
Our Board will continue to be engaged in that process. And
this new this new safety organization that I talked about, in
addition to reporting to the Chief Engineer and to me, it also
provides independent audit, if you will, back into our Board.
And our Board has set up a new aerospace safety committee
that is now permanent headed up by Admiral Giambastiani. You
might have seen on Friday we added another Board member,
Admiral Richardson, who also has deep experience in safety. He
will also be a member of that committee and so our safety
organization will have an independent reporting line to them as
well, which I think is a good discipline process.
Senator Scott. I had to go to preside, so I didn't get to
hear all the testimony. But have you made any recommendations
to this Committee on things that at the Federal level we ought
to be doing differently, you know, to make sure whether Boeing,
Airbus, or anybody else, this does not happen again?
Mr. Muilenburg. Senator, we have discussed a number of
options there. Again, we have learned and there are some things
that we need to fix that are related to the airplane design and
training and communications. We also think there are some
opportunities to reform our processes and how we work together
as a Government and industry. And we are very supportive of any
actions there that would enhance safety.
Senator Scott. Thank you.
The Chairman. Thank you, Senator Scott.
Senator Sullivan.
STATEMENT OF HON. DAN SULLIVAN,
U.S. SENATOR FROM ALASKA
Senator Sullivan. Thank you, Mr. Chairman. And I also want
to express my sympathies and condolences to the family members
here. We have a safe commercial aviation industry in America,
but I think we always have to look at ways to improve the
industry, the airlines, FAA, Congress. So I am sure it is
difficult for the family members to be here, but it is
important that you are here. So I want to thank you for that. I
am going to start with just a bit of a kind of a parochial
question.
Mr. Muilenburg, Mr. Hamilton, Alaska Airlines is my state's
airline, it is a very good airline, certainly critically
important to my state. I know it is to the Ranking Member's
state as well. They fly almost all 737 Boeings. We Alaskans
travel a lot. I have had many constituents in the aftermath of
these MAX crashes that have asked me, are the 737s that we are
flying on all the time in Alaska, to and from Seattle and other
places, safe? So can both of you assure my constituents that
these 737s are safe that are such an important component of the
Alaskan air travel?
Mr. Muilenburg. Yes, Senator. The 737 NG fleet that Alaska
operates is a safe fleet, it is a safe airplane and it has got
about 200 million hours of air safety track record behind it.
Senator Sullivan. Mr. Hamilton?
Mr. Hamilton. I agree with Mr. Muilenburg's comments. I
also just want to say that we have a weekly meeting that we
review all the reports that are coming in from the fleet on
whether or not there are potential safety issues or not.
Senator Sullivan. So the MAX issues that we are focused on
here with regard to 737s are not issues that exist with your
other line of 737s, 800s, and 900s?
Mr. Hamilton. No.
Mr. Muilenburg. That is correct.
Senator Sullivan. Let me ask--and I know the House side was
looking at this issue. As we focus as this Committee on the
tragic lessons learned from the MAX 737 accidents, should we
also take the time to ensure that the other 737 models that are
receiving less attention now nevertheless continue to be safe
and to take the opportunity to look at the FAA certification
process on those to make sure that that is not bedeviled with
some of the challenges that we are discussing here with regard
to the MAX? Would you agree that that is an opportunity to not
just focus on the MAX but the overall process to reboot the
focus both at your company, but also in the FAA on safety?
Mr. Muilenburg. Yes, Senator, I believe there are a number
of independent reviews underway right now looking at that
broader certification process, some of which have begun to
report out. We support that broader look.
Senator Sullivan. So models that aren't just the MAX?
Mr. Muilenburg. All models. So we are taking an end-to-end
comprehensive look at the certification process and I believe
there are a number of Government independent reviews that are
focused on that.
Senator Sullivan. Let me ask for both of you. I keep
hearing from safety experts about the importance of what they
refer to as functional safety and that is the way the different
systems work together with the operator as opposed to looking
at each system as it is added to a new model in a vacuum. And
it seems to me that this issue of functional safety is a core
issue as it relates to the MAX given what has happened.
Can you tell the Committee about what your company's
approach to this issue of functional safety is when adding new
systems to an existing aircraft like the 737? Obviously, there
was a failure here on that issue. How are you working to
improve that and does the FAA do enough to focus on this idea
of functional safety not just the individual additions to
existing and older models?
Mr. Muilenburg. I will ask John to take that question.
Mr. Hamilton. Yes. So Senator, I think it starts with our
requirements breakdown of what is our airplane level
requirements, system level requirements, component level
requirements and then validating at the component level, the
system level, and the airplane level how any change met the
requirements and interacted across at the system or airplane
level. You also talked about regulatory requirements.
Senator Sullivan. Yes. Does the FAA focus enough do you
think on functional safety?
Mr. Hamilton. So there has been some rather recent changes
in what we call development assurance that I think has
continued to mature and again this looks at the functional
safety and some of the things that you really focused at is the
breakdown of requirements and how different systems interact
with that. So, I think we as Mr. Muilenburg pointed out, some
of the recent industry committee reports have discussed this
and I think we will support those recommendations and the FAA's
actions going forward.
Senator Sullivan. Thank you. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Sullivan. And thank you to
the panel. We appreciate you being with us and I am sure we
will be questioning you further as we continue to get more
reports. Our second panel of witnesses will be escorted in now.
We thank you two gentlemen for being with us.
The second panel, as I said before, is Mr. Robert Sumwalt,
Chairman of the National Transportation Safety Board, and the
Honorable Christopher Hart. Mr. Hart is the team Chair of the
Joint Authorities Technical Review, which we use the shorthand
of JATR for, and I have referred to that a number of times
during this hearing. Mr. Hart is a former Chairman of the
National Transportation Safety Board.
They have been waiting patiently during these two and a
half hours. Gentlemen, we appreciate you being here. We ask
each of you to summarize your submitted testimony in five
minutes. And Mr. Sumwalt, we will begin with you. You are
recognized.
STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL
TRANSPORTATION SAFETY BOARD
Mr. Sumwalt. Thank you, Mr. Chairman. Good afternoon
Chairman Wicker, Ranking Member Cantwell, and members of the
Committee. Thank you for the opportunity to testify before you
today. This afternoon I will address the NTSB's recent
recommendation report regarding the 737 MAX certification
processes. This recommendation report issued last month
contained seven recommendations to the FAA.
These recommendations are the result of the NTSB's
involvement as an accredited representative to the Indonesian
government's investigation into last year's Lion Air crash and
to the Ethiopian government's investigation into this year's
crash involving the Ethiopian Airlines Boeing 737 MAX. The NTSB
participates in foreign investigations in accordance with ICAO
Annex 13, which details the standards and recommended practices
of international aviation accident investigations.
Under Annex 13, the state of occurrence leads the
investigation and the U.S. has the right to participate in the
investigation when it involves a U.S. manufacturer or U.S.
registered or designed aircraft such as the 737 MAX 8. This is
so that any design or manufacturing issues can promptly be
addressed by the FAA and the manufacturer.
As an accredited representative to these crash
investigations, the NTSB initiated an in-depth examination of
the U.S. design certification processes used to certify the
MAX. The issues we identified revolve around three basic areas
and our safety recommendations are centered on them.
First, the system safety assumptions used by Boeing for the
MCAS and ultimately accepted by the FAA did not use realistic
pilot recognition and corrective actions in response to
uncommanded flight control inputs. Quite simply, the
assumptions that Boeing used did not consider or account for
the impact that multiple flight deck alerts or indications
could have on pilots' responses to uncommanded MCAS activation.
Next, we identified the need for manufacturers to validate
their pilot response assumptions using scientific methods and
application of human factors principles to improve cockpit
design, procedures, and training. We believe that the use of
validated methods and tools to assess pilot performance in
dealing with failure conditions in emergencies would result in
more effective requirements for flight deck interface design,
pilot procedures, and training strategies.
And finally, we believe that manufacturers should develop
and incorporate in airline cockpits mechanisms that would allow
pilots to better diagnose, prioritize, and react to multiple
alerts and alarms. The pilots in the Lion Air and Ethiopian
crashes were faced with multiple oral and visual alerts.
Research demonstrates that emergency situations increase
workload and require additional effort to manage effectively
because of the stress involved and possible confusion regarding
which actions are necessary to resolve the problem. Each of our
seven recommendations are detailed in my written testimony.
In closing, it should be noted that the NTSB investigators
continue to examine the design certification process, and we
may issue additional recommendations in this area if warranted.
Thank you again for the opportunity to testify and I look
forward to your questions.
[The prepared statement of Mr. Sumwalt follows:]
Prepared Statement of Hon. Robert L. Sumwalt III, Chairman,
National Transportation Safety Board
Good afternoon, Chairman Wicker, Ranking Member Cantwell, and
Members of the Committee. Thank you for inviting the National
Transportation Safety Board (NTSB) to testify before you today.
The NTSB is an independent Federal agency charged by Congress with
investigating every civil aviation accident in the United States and
significant accidents in other modes of transportation--highway, rail,
marine, and pipeline. We determine the probable cause of the accidents
we investigate, and we issue safety recommendations aimed at preventing
future accidents. In addition, we conduct special transportation safety
studies and special investigations and coordinate the resources of the
Federal government and other organizations to assist victims and their
family members who have been impacted by major transportation
disasters. The NTSB is not a regulatory agency--we do not promulgate
operating standards, nor do we certificate organizations, individuals,
or equipment. The goal of our work is to foster safety improvements,
through safety recommendations, for the traveling public.
Today I will address NTSB's recent recommendation report,
``Assumptions Used in the Safety Assessment Process and the Effects of
Multiple Alerts and Indications on Pilot Performance,'' issued on
September 26, 2019, which contained seven recommendations to the
Federal Aviation Administration (FAA). These recommendations resulted
from our examination of relevant factors in the U.S. design
certification process following two crashes of Boeing 737 MAX 8
aircraft.
NTSB's Role in Boeing 737-MAX 8 Crashes
On October 29, 2018, a Boeing 737 MAX 8, operated by Lion Air,
crashed into the Java Sea shortly after takeoff from Soekarno-Hatta
International Airport, in Jakarta, Indonesia, killing all 189
passengers and crew on board. The Komite Nasional Keselamatan
Transportasi (KNKT) of Indonesia, investigated the accident and
released the final report on October 25, 2019.\1\ On March 10, 2019, a
Boeing 737 MAX 8, operated by Ethiopian Airlines, crashed after takeoff
from Addis Ababa Bole International Airport in Ethiopia, killing all
157 passengers and crew, including 8 American citizens. The
investigation is being led by the Ethiopia Accident Investigation
Bureau (EAIB), which released a preliminary report on April 4, 2019.\2\
---------------------------------------------------------------------------
\1\ Komite Nasional Keselamatan Transportasi, Final Report No.
KNKT.18.10.35.04.
\2\ Ethiopia Accident Investigation Bureau, Report No. AI-01/19.
---------------------------------------------------------------------------
The NTSB participated in these foreign investigations in accordance
with the Chicago Convention of the International Civil Aviation
Organization (ICAO) and the Standards and Recommended Practices
provided in Annex 13 to the Convention because these accidents involved
the Boeing 737 MAX 8, a US-designed, certified and manufactured
airplane.\3\ Because both Indonesia and Ethiopia are signatories to the
ICAO Convention, they are each responsible for the investigation in
their state and control the release of all information regarding the
investigation.
---------------------------------------------------------------------------
\3\ ICAO is a UN specialized agency that manages the administration
and governance of the Convention on International Civil Aviation
(Chicago Convention), (https://www.icao.int/about-icao/Pages/
default.aspx).
---------------------------------------------------------------------------
Following the Lion Air crash, the NTSB appointed a U.S. accredited
representative and immediately dispatched investigators to Indonesia to
participate in the KNKT investigation. NTSB investigators had access to
all investigative data and participated in all aspects of the
investigation, including: download and analysis of the flight data
recorder (FDR) and cockpit voice recorder (CVR); teardown and
examination of airplane components such as the angle of attack sensor
that was removed prior to the accident flight; airplane performance
analysis and simulation sessions; airplane system and certification
analysis; interviews of airline and maintenance personnel; and review
of the KNKT draft final report. The final report released by the KNKT
on October 25, 2019, reiterated the seven NTSB recommendations and also
included an additional 25 recommendations to seven organizations,
including Lion Air, Boeing, Indonesian Directorate General of Civil
Aviation, and the FAA.
In response to the Ethiopian Airlines crash, the NTSB also
appointed an accredited representative, who we dispatched to Ethiopia
with a team of investigators. NTSB investigators continue to take part
in this ongoing investigation and have had access to all investigative
data, including taking part in the download and analysis of the CVR and
FDR.
In accordance with ICAO Annex 13, technical advisors from the FAA,
Boeing, and General Electric have accompanied NTSB investigators to the
Lion Air and Ethiopian Airlines accident sites to provide their
specialized technical knowledge regarding the aircraft and its systems.
ICAO Annex 13 provides for other involved states to gain timely
access to investigative information for the purposes of continued
operational safety. As a result, NTSB participation in the foreign
accident investigations enabled safety deficiencies to be promptly
addressed by the FAA and the manufacturer and through NTSB safety
recommendations. Because the United States is the state of design and
manufacturer of the aircraft involved in these accidents, we examined
relevant factors in the U.S. design certification process to ensure
deficiencies were identified and addressed.
Design Certification of the 737 MAX 8 and Safety Assessment of the
Maneuvering Characteristics Augmentation System (MCAS)
The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG)
model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\4\ The
737 MAX incorporated a new engine (CFM LEAP-1B) and nacelle, which
produced an airplane-nose-up pitching moment when the airplane was
operating at high angle of attack (AOA) and mid-Mach numbers. After
studying various options for addressing this issue, Boeing implemented
aerodynamic changes as well as a stability augmentation function,
Maneuvering Characteristics Augmentation System (MCAS), as an extension
of the existing speed trim system to improve aircraft handling
characteristics and decrease pitch-up tendency at elevated AOA. As the
development of the 737 MAX progressed, the MCAS function was expanded
to low Mach numbers.
As originally delivered, the MCAS became active during manual
flight (autopilot not engaged) when the flaps were fully retracted and
the airplane's AOA value (as measured by either AOA sensor) exceeded a
threshold based on Mach number. When activated, the MCAS provided
automatic trim commands to move the stabilizer airplane nose down. Once
the AOA fell below the threshold, the MCAS would move the stabilizer to
the original position. At any time, the stabilizer inputs could be
stopped or reversed by the pilots using their stabilizer trim switches.
If the stabilizer trim switches were used by the pilots and the
elevated AOA condition persisted, the MCAS would command another
stabilizer airplane nose down trim input after 5 seconds.
In each of the accident flights, the MCAS activated in response to
erroneous AOA inputs, resulting in continuous command of airplane nose
down stabilizer trim input as well as other alerts and indications.
Multiple alerts and indications can increase pilots' workload, and the
combination of the alerts and indications did not trigger the accident
pilots to immediately perform the runaway stabilizer trim procedure
during the MCAS-activated airplane-nose-down stabilizer trim input. The
pilots' responses did not match the assumptions of the pilot responses
to unintended MCAS operation on which Boeing based its hazard
classifications within the safety assessment and that the FAA approved
and used to ensure the design safely accommodates failures. Thus, the
NTSB concluded that Boeing's functional hazard assessment of
uncommanded MCAS function for the 737 MAX did not adequately consider
and account for the impact that multiple flight deck alerts and
indications could have on pilots' responses to the hazard.
We further concluded that a standardized methodology and/or tools
for manufacturers' use in evaluating and validating assumptions about
pilot recognition and response to failure condition(s), would help
ensure that system designs adequately and consistently minimize the
potential for pilot actions that are inconsistent with manufacturer
assumptions. Lastly, because the pilots were uncertain how to
prioritize and respond to the multiple alerts and indications that they
received, we concluded that aircraft systems that can more clearly and
concisely inform pilots of the highest priority actions when multiple
flight deck alerts and indications are present would minimize confusion
and help pilots respond most effectively.
Since the Lion Air accident in October 2018, Boeing has developed a
software update to provide additional layers of protection to the MCAS
and is working on updated procedures and training. However, we are
concerned that the process used to evaluate the original design needs
improvement because that process is still in use to certify current and
future aircraft and system designs. Therefore, in accordance with our
responsibilities as the accredited representative of the state of
design and manufacture of the 737, we felt it necessary to issue safety
recommendations.
NTSB Recommendations
On September 19, 2019, the NTSB issued seven safety recommendations
to the FAA as a result of our examination of the U.S. design
certification process used to approve the original design of the MCAS
system on the Boeing 737 MAX.
The NTSB found that the accident pilots' responses to the
unintended MCAS operation were not consistent with the underlying
assumptions about pilot recognition and response that Boeing used,
based on FAA guidance, for flight control system functional hazard
assessments, including for MCAS, as part of the 737 MAX design. We
issued these recommendations to address assumptions about pilot
recognition and response to failure conditions used during the design
certification process as well as diagnostic tools to improve the
prioritization and clarity of failure indications presented to pilots.
As a result of the NTSB's in-depth examination of the U.S. design
certification process and assumptions used to approve the original
design of the MCAS system on the Boeing 737 MAX, the NTSB issued the
following seven recommendations to the FAA:
1. Require that Boeing (1) ensure that system safety assessments for
the 737 MAX in which it assumed immediate and appropriate pilot
corrective actions in response to uncommanded flight control
inputs, from systems such as the Maneuvering Characteristics
Augmentation System, consider the effect of all possible flight
deck alerts and indications on pilot recognition and response;
and (2) incorporate design enhancements (including flight deck
alerts and indications), pilot procedures, and/or training
requirements, where needed, to minimize the potential for and
safety impact of pilot actions that are inconsistent with
manufacturer assumptions. (A-19-10)
2. Require that for all other U.S. type-certificated transport-
category airplanes, manufacturers (1) ensure that system safety
assessments for which they assumed immediate and appropriate
pilot corrective actions in response to uncommanded flight
control inputs consider the effect of all possible flight deck
alerts and indications on pilot recognition and response; and
(2) incorporate design enhancements (including flight deck
alerts and indications), pilot procedures, and/or training
requirements, where needed, to minimize the potential for and
safety impact of pilot actions that are inconsistent with
manufacturer assumptions. (A-19-11)
3. Notify other international regulators that certify transport-
category airplane type designs (for example, the European Union
Aviation Safety Agency, Transport Canada, the National Civil
Aviation Agency-Brazil, the Civil Aviation Administration of
China, and the Russian Federal Air Transport Agency) of
Recommendation A-19-11 and encourage them to evaluate its
relevance to their processes and address any changes, if
applicable. (A-19-12)
4. Develop robust tools and methods, with the input of industry and
human factors experts, for use in validating assumptions about
pilot recognition and response to safety-significant failure
conditions as part of the design certification process. (A-19-
13)
5. Once the tools and methods have been developed as recommended in
Recommendation A-19-13, revise existing Federal Aviation
Administration (FAA) regulations and guidance to incorporate
their use and documentation as part of the design certification
process, including re-examining the validity of pilot
recognition and response assumptions permitted in existing FAA
guidance. (A-19-14)
6. Develop design standards, with the input of industry and human
factors experts, for aircraft system diagnostic tools that
improve the prioritization and clarity of failure indications
(direct and indirect) presented to pilots to improve the
timeliness and effectiveness of their response. (A-19-15)
7. Once the design standards have been developed as recommended in
Recommendation A-19-15, require implementation of system
diagnostic tools on transport-category aircraft to improve the
timeliness and effectiveness of pilots' response when multiple
flight deck alerts and indications are present. (A-19-16)
The complete safety recommendation report is attached to this
testimony.
Finally, it should be noted that NTSB investigators continue to
examine the design certification process and the NTSB may issue
additional recommendations in this area in the future if such
recommendations are warranted.
Conclusion
Thank you again for the opportunity to be here today to discuss the
NTSB's role in these important international aviation accident
investigations and to highlight our recent recommendations to FAA
regarding the safety assessment process. I will be happy to answer any
questions.
______
National Transportation Safety Board
Washington, DC 20594
Safety Recommendation Report
Assumptions Used in the Safety Assessment Process and the Effects of
Multiple Alerts and Indications on Pilot Performance
------------------------------------------------------------------------
------------------------------------------------------------------------
Accident Number: DCA19RA017/DCA19RA101
Operator: PT Lion Mentari Airlines/Ethiopian Airlines
Aircraft: Boeing 737 MAX 8/Boeing 737 MAX 8
Location: Java Sea, Indonesia/Ejere, Ethiopia
Date: October 29, 2018/March 10, 2019
------------------------------------------------------------------------
The National Transportation Safety Board (NTSB) is providing the
following information to urge the Federal Aviation Administration (FAA)
to take action on the safety recommendations in this report. They are
derived from our participation in the ongoing investigations of two
fatal accidents under the provisions of Annex 13 of the International
Civil Aviation Organization. As the accident investigation authority
for the state of design and manufacture of the airplane in these
accidents, the NTSB has been examining the U.S. design certification
process used to approve the original design of the Maneuvering
Characteristics Augmentation System (MCAS) on the Boeing Company
(Boeing) 737 MAX. We note that, since the PT Lion Mentari Airlines
(Lion Air) accident on October 29, 2018, Boeing has developed an MCAS
software update to provide additional layers of protection and is
working on updated procedures and training. However, we are concerned
that the process used to evaluate the original design needs improvement
because that process is still in use to certify current and future
aircraft and system designs.
Although the NTSB's work in this area is ongoing, based on
preliminary information, we are concerned that the accident pilot
responses to the unintended MCAS operation were not consistent with the
underlying assumptions about pilot recognition and response that Boeing
used, based on FAA guidance, for flight control system functional
hazard assessments, including for MCAS, as part of the 737 MAX
design.\1\ We are making these recommendations to address assumptions
about pilot recognition and response to failure conditions used during
the design certification process as well as diagnostic tools to improve
the prioritization and clarity of failure indications presented to
pilots.
---------------------------------------------------------------------------
\1\ (a) We based our preliminary findings on information from the
publicly released preliminary accident reports. (b) While Boeing uses
the term ``uncommanded MCAS function'' in its assessment documents, in
this report, we are using the term ``unintended MCAS operation'' as it
relates to our review of the accident events.
---------------------------------------------------------------------------
Factual Information
Accidents
On October 29, 2018, Lion Air flight 610, a Boeing 737 MAX 8, PK-
LQP, crashed in the Java Sea shortly after takeoff from Soekarno-Hatta
International Airport, Jakarta, Indonesia. The flight crew had
communicated with air traffic control and indicated that they were
having flight control and altitude issues before the airplane
disappeared from radar. The flight was a scheduled domestic flight from
Jakarta to Depati Amir Airport, Pangkal Pinang City, Bangka Belitung
Islands Province, Indonesia. All 189 passengers and crew on board died,
and the airplane was destroyed. The National Transportation Safety
Committee of Indonesia is leading the investigation.\2\
---------------------------------------------------------------------------
\2\ Information in this section is taken from the preliminary
report on this accident, which can be found at https://
reports.aviation-safety.net/2018/20181029-0_B38M_PK-LQP_PRELIMI
NARY.pdf.
---------------------------------------------------------------------------
The airplane's digital flight data recorder (DFDR) recorded a
difference between the left and right angle of attack (AOA) sensors
that was present during the entire accident flight; the left AOA sensor
was indicating about 20+ higher than the right AOA sensor. During
rotation, the left (captain's) stick shaker activated, and DFDR data
showed that the left airspeed and altitude values disagreed with, and
were lower than, the corresponding values from the right. The first
officer asked a controller to confirm the altitude of the airplane and
later also asked the speed as shown on the controller radar display.
After the flaps were fully retracted, a 10-second automaticaircraft
nose-down (AND) stabilizer trim input occurred. After the automatic AND
stabilizer trim input, the flight crew used the stabilizer trim
switches (located on the outboard side of each control wheel) and
applied aircraft nose-up (ANU) electric trim. According to DFDR data,
about 5 seconds after the completion of the pilot trim input, another
automatic AND stabilizer trim input occurred. The crew applied ANU
electric trim again. DFDR data then showed that the flaps were extended
for almost 2 minutes. However, the flaps were then fully retracted, and
automatic AND stabilizer trim inputs occurred more than 20 times over
the next 6 minutes; the crew countered each input during this time
using ANU electric trim. The last few automatic AND stabilizer trim
inputs were not fully countered by the crew.
During the preceding Lion Air flight on the accident airplane with
a different flight crew, the DFDR recorded the same difference between
left and right AOA of about 20+ that continued until the end of the
recording. During rotation, the left control column stick shaker
activated and continued for the entire flight, and DFDR data showed
that the left airspeed and altitude values disagreed with, and were
lower than, the corresponding values from the right. After the flaps
were fully retracted, a 10-second automatic AND stabilizer trim input
occurred, and the crew countered the input with an ANU electric trim
input. After several automatic AND stabilizer trim inputs that were
countered by pilot-commanded ANU electric trim inputs, the crew noticed
that the airplane was automatically trimming AND. The captain moved the
stabilizer trim cutout (STAB TRIM CUTOUT) switches to CUTOUT.\3\ He
then moved them back to NORMAL, and the problem almost immediately
reappeared. He moved the switches back to CUTOUT. He stated that the
crew performed three non-normal checklists: Airspeed Unreliable, ALT
DISAGREE (altitude disagree), and Runaway Stabilizer. The pilots
continued the flight using manual trim until the end of the flight.
Upon landing, the captain informed an engineer of IAS DISAGREE
(indicated airspeed disagree) and ALT DISAGREE alerts, in addition to
FEEL DIFF PRESS (feel differential pressure) light problems on the
airplane.
---------------------------------------------------------------------------
\3\ Two STAB TRIM CUTOUT switches on the control stand can be used
to stop the flight crew electric and autopilot trim inputs to the
stabilizer trim actuator. The switches can be set to NORMAL or CUTOUT.
If the switches are moved to CUTOUT, both the electric and autopilot
trim inputs are disconnected from the stabilizer trim motor. NORMAL is
the default position to enable operation of the electric and autopilot
trim.
---------------------------------------------------------------------------
On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX
8, Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly
after takeoff from Addis Ababa Bole International Airport, Ethiopia.
The flight was a scheduled international passenger flight from Addis
Ababa to Jomo Kenyatta International Airport, Nairobi, Kenya. All 157
passengers and crew on board died, and the airplane was destroyed. The
investigation is being led by the Ethiopia Accident Investigation
Bureau.\4\
---------------------------------------------------------------------------
\4\ Information in this section is taken from the preliminary
report on this accident, which can be found at http://www.ecaa.gov.et/
Home/wp-content/uploads/2019/07/Preliminary-Report-B737-800MAX-ET-
AVJ.pdf.
---------------------------------------------------------------------------
The airplane's DFDR data indicated that shortly after liftoff, the
left (captain's) AOA sensor data increased rapidly to 74.5+ and was
59.2+ higher than the right AOA sensor; the captain's stick shaker
activated. Concurrently, the airspeed and altitude values on the left
side disagreed with, and were lower than, the corresponding values on
the right side; in addition, DFDR data indicated a Master Caution
alert. Similar to the Lion Air accident flight, a 9-second automatic
AND stabilizer trim input occurred after flaps were retracted and while
in manual flight (no autopilot). About 3 seconds after the AND
stabilizer motion ended, using the stabilizer trim switches, the
captain, who was the pilot flying, partially countered the AND
stabilizer input by applying ANU electric trim. About 5 seconds after
the completion of pilot trim input, another automatic AND stabilizer
trim input occurred. The captain applied ANU electric trim and fully
countered the second automatic AND stabilizer input; however, the
airplane was not returned to a fully trimmed condition. Cockpit voice
recorder data indicated that the flight crew then discussed the STAB
TRIM CUTOUT switches, and shortly thereafter DFDR data were consistent
with the STAB TRIM CUTOUT switches being moved to CUTOUT.
However, because the airplane remained in a nose-down out-of-trim
condition, the crew was required to continue applying nose-up force to
the control column to maintain level flight. About 32 seconds before
impact, two momentary pilot-commanded electric ANU trim inputs and
corresponding stabilizer movement were recorded, consistent with the
STAB TRIM CUTOUT switches no longer being in CUTOUT. Five seconds after
these short electric trim inputs, another automatic AND stabilizer trim
input occurred, and the airplane began pitching nose down.
Design Certification of the 737 MAX 8 and Safety Assessment of the MCAS
The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG)
model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\5\ The
737 MAX incorporated the CFM LEAP-1B engine, which has a larger fan
diameter and redesigned engine nacelle compared to engines installed on
the 737 NG family. During the preliminary design stage of the 737 MAX,
Boeing testing and analysis revealed that the addition of the LEAP-1B
engine and associated nacelle changes produced an ANU pitching moment
when the airplane was operating at high AOA and mid Mach numbers. After
studying various options for addressing this issue, Boeing implemented
aerodynamic changes as well as a stability augmentation function, MCAS,
as an extension of the existing speed trim system to improve aircraft
handling characteristics and decrease pitch-up tendency at elevated
AOA. As the development of the 737 MAX progressed, the MCAS function
was expanded to low Mach numbers.
---------------------------------------------------------------------------
\5\ The 737-600, -700, and -800 airplanes are part of the 737 NG
family.
---------------------------------------------------------------------------
As originally delivered, the MCAS became active during manual
flight (autopilot not engaged) when the flaps were fully retracted and
the airplane's AOA value (as measured by either AOA sensor) exceeded a
threshold based on Mach number. When activated, the MCAS provided
automatic trim commands to move the stabilizer AND. Once the AOA fell
below the threshold, the MCAS would move the stabilizer ANU to the
original position. At any time, the stabilizer inputs could be stopped
or reversed by the pilots using their stabilizer trim switches. If the
stabilizer trim switches were used by the pilots and the elevated AOA
condition persisted, the MCAS would command another stabilizer AND trim
input after 5 seconds.
The FAA's procedures for aircraft type certification require an
aircraft manufacturer (``applicant'') to demonstrate that its design
complies with all applicable FAA regulations and requirements.\6\ For
transport-category airplanes, as part of this process, applicants must
demonstrate through analysis, test, or both that their design meets the
applicable requirements under Title 14 Code of Federal Regulations
(CFR) Part 25. Specifically, 14 CFR 25.671 and 25.672 define the
requirements for control systems in general and stability augmentation
and automatic and power-operated systems, respectively. Title 14 CFR
25.1322 addresses flight crew alerting and states, in part, that flight
crew alerts must
---------------------------------------------------------------------------
\6\ Title 14 Code of Federal Regulations Part 21 defines the
procedures for certification.
---------------------------------------------------------------------------
(1) Provide the flightcrew with the information needed to:
(i) Identify non-normal operation or airplane system conditions,
and
(ii) Determine the appropriate actions, if any.
(2) Be readily and easily detectable and intelligible by the
flightcrew under all foreseeable operating conditions,
including conditions where multiple alerts are provided.
Advisory Circular (AC) 25.1322-1, ``Flightcrew Alerting,'' provides
guidance for showing compliance with requirements for the design
approval of flight crew alerting functions and indicates that
``Appropriate flightcrew corrective actions are normally defined by
airplane procedures (for example, in checklists) and are part of a
flightcrew training curriculum or considered basic airmanship.'' Title
14 CFR 25.1309 relates to aircraft equipment, systems, and
installations, and the primary means of compliance with this section
for systems that are critical to safe flight and operations is through
safety assessments or through rational analyses; AC 25.1309-1A,
``System Design and Analysis,'' provides guidance for showing
compliance with Title 14 CFR 25.1309(b), (c), and (d).\7\ AC 25.1309-1A
explains the FAA's fail-safe design concept, which ``considers the
effects of failures and combinations of failures in defining a safe
design.'' As part of demonstrating 737 MAX 8 compliance with the
requirements in 14 CFR 25.1309, Boeing conducted a number of airplane-
and system-level safety assessments, consistent with the guidance
provided in AC 25.1309-1A.\8\
---------------------------------------------------------------------------
\7\ Safety assessments are performed by the manufacturer and its
suppliers and are reviewed and accepted by the FAA. Safety assessments
proceed in a stepwise, data-driven manner to ensure that all
significant single-failure conditions have been identified and all
combinations of failures that could lead to hazardous or catastrophic
airplane-level effects have been considered and appropriately
mitigated. When a safety assessment cannot be performed on a new or
complex system, a rational analysis may be performed to estimate
quantitative probabilities and supplement qualitative analyses and
tests. The safety assessment process outlined in AC 25.1309-1A is not
mandatory, but manufacturers that do not conduct safety assessments
must demonstrate compliance in another manner, such as ground or flight
tests.
\8\ Safety assessments can include the development of airplane-and
system-level functional hazard assessments (to identify and classify
potentially hazardous failure conditions), failure modes and effects
analyses (a structured bottom-up analysis that evaluates the effects of
each possible failure), and fault tree analyses (a structured top-down
analysis to identify the conditions, failures, and events that would
cause a failure condition).
---------------------------------------------------------------------------
The NTSB reviewed sections of Boeing's system safety analysis for
stabilizer trim control that pertained to MCAS on the 737 MAX. Boeing's
analysis included a summary of the functional hazard assessment
findings for the 737 MAX stabilizer trim control system. For the normal
flight envelope, Boeing identified and classified two hazards
associated with ``uncommanded MCAS'' activation as ``major.'' \9\ One
of these hazards, applicable to the MCAS function seen in these
accidents, included uncommanded MCAS operation to maximum
authority.\10\ Boeing indicated that, as part of the functional hazard
assessment development, pilot assessments of MCAS-related hazards were
conducted in an engineering flight simulator, including the uncommanded
MCAS operation (stabilizer runaway) to the MCAS maximum authority.
---------------------------------------------------------------------------
\9\ The ``major'' classification used by Boeing indicated a remote
probability of this hazard occurring and that it could result in
reduced control capability, reduced system redundancy, or increased
crew workload. Other classification categories included ``minor,''
``hazardous,'' and ``catastrophic.''
\10\ In March 2016, Boeing determined that MCAS should be revised
to improve flaps up, low Mach stall characteristics and identification.
The preliminary hazard assessments of MCAS were re-evaluated after this
change by pilot evaluation in the motion simulator and determined to
have not changed the hazard classification.
---------------------------------------------------------------------------
To perform these simulator tests, Boeing induced a stabilizer trim
input that would simulate the stabilizer moving at a rate and duration
consistent with the MCAS function. Using this method to induce the
hazard resulted in the following: motion of the stabilizer trim wheel,
increased column forces, and indication that the airplane was moving
nose down. Boeing indicated to the NTSB that this evaluation was
focused on the pilot response to uncommanded MCAS operation, regardless
of underlying cause. Thus, the specific failure modes that could lead
to uncommanded MCAS activation (such as an erroneous high AOA input to
the MCAS) were not simulated as part of these functional hazard
assessment validation tests. As a result, additional flight deck
effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker
activation) resulting from the same underlying failure (for example,
erroneous AOA) were not simulated and were not in the stabilizer trim
safety assessment report reviewed by the NTSB.
Boeing indicated to the NTSB that, based on FAA guidance, it used
assumptions during its safety assessment of MCAS hazards in the
engineering flight simulator. Four of these assumptions were the
following:
Uncommanded system inputs are readily recognizable and can
be counteracted by overriding the failure by movement of the
flight controls ``in the normal sense'' by the flight crew and
do not require specific procedures.\11\
---------------------------------------------------------------------------
\11\ Title 14 CFR 25.672 states the following: ``The design of the
stability augmentation system or of any other automatic or power-
operated system must permit initial counteraction of failures of the
type specified in Sec. 25.671(c) without requiring exceptional pilot
skill or strength, by either the deactivation of the esystem, or a
failed portion thereof, or by overriding the failure by movement of the
flight controls in the normal sense.''
Action to counter the failure shall not require exceptional
---------------------------------------------------------------------------
piloting skill or strength.
The pilot will take immediate action to reduce or eliminate
increased control forces by re-trimming or changing
configuration or flight conditions.
Trained flight crew memory procedures shall be followed to
address and eliminate or mitigate the failure.
Boeing advised that these assumptions are used across all Boeing models
when performing functional hazard assessments of flight control
systems. These assumptions were consistent with requirements in 14 CFR
25.671 and 25.672 and guidance in AC 25-7C, ``Flight Test Guide for
Certification of Transport Category Airplanes.'' \12\ AC 25-7C stated
that short-term forces are the initial stabilized control forces that
result from maintaining the intended flightpath after configuration
changes and normal transitions from one flight condition to another,
``or from regaining control following a failure. It is assumed that the
pilot will take immediate action to reduce or eliminate such forces by
re-trimming or changing configuration or flight conditions, and
consequently short-term forces are not considered to exist for any
significant duration [emphasis added].'' In a 2019 presentation to the
NTSB, Boeing indicated that the MCAS hazard classification of ``major''
for uncommanded MCAS function in the normal flight envelope was based
on the following conclusions:
---------------------------------------------------------------------------
\12\ On October 16, 2012, the FAA released AC 25-7C, which revised
version B to reduce the number of differences from the European
Aviation Safety Agency's Flight Test Guide; provide acceptable means of
compliance for the regulatory changes associated with amendments 107,
109, 113, 115, 119, and 123 to 14 CFR Part 25; respond to NTSB
recommendations; and provide a general update to reflect current FAA
and industry practices and policies. AC 25-7C was in effect at the time
of Boeing's safety assessments of the 737 MAX. On May 4, 2018, the FAA
released AC 25-7D to clarify several paragraphs, revise an appendix,
and improve usability with formatting changes.
Unintended stabilizer trim inputs are readily recognized by
movement of the stabilizer trim wheel, flightpath change, or
---------------------------------------------------------------------------
increased column forces.
Aircraft can be returned to steady level flight using
available column (elevator) alone or stabilizer trim.
Continuous unintended nose-down stabilizer trim inputs would
be recognized as a stabilizer trim or stabilizer runaway
failure and the procedure for stabilizer runaway would be
followed.\13\
---------------------------------------------------------------------------
\13\ The runaway stabilizer procedure includes holding the control
column firmly, disengaging the autopilot and autothrottles (if
engaged), setting the STAB TRIM CUTOUT switches to CUTOUT, and trimming
the airplane manually.
---------------------------------------------------------------------------
Analysis
Assumptions about Pilot Recognition and Response in the Safety
Assessment
Functional hazard assessments at the aircraft and systems levels
are a critical part of the design certification process because the
resulting hazard classifications (severity level) drive the safety
requirements for equipment design, flight crew procedures, and training
to ensure the hazard effects are sufficiently mitigated. On the basis
of Boeing's functional hazard assessment for the MCAS, which assumed
timely pilot response to uncommanded MCAS-generated trim input,
uncommanded MCAS activation was classified as ``major.'' Boeing was
then required to verify that each system that supported MCAS complied
with the quantitative and qualitative safety requirements for a
``major'' hazard, as provided in AC 25.1309-1A, and demonstrate this to
the FAA in its aircraft and system safety assessments.
On the Lion Air flight immediately before the accident flight and
the Lion Air and Ethiopian Airlines accident flights, the DFDR recorded
higher AOA sensor data on the left side than on the right (about 20+
higher on the previous Lion Air flight and the Lion Air accident flight
and about 59+ higher on the Ethiopian Airlines accident flight). As
previously stated, the MCAS becomes active when the airplane's AOA
exceeds a certain threshold. Thus, these erroneous AOA sensor inputs
resulted in the MCAS activating on the accident flights and providing
the automatic AND stabilizer trim inputs. The erroneous high AOA sensor
input that caused the MCAS activation also caused several other alerts
and indications for the flight crews. The stick shaker activated on
both accident flights and the previous Lion Air flight. In addition,
IAS DISAGREE and ALT DISAGREE alerts occurred on all three flights.
Also, the Ethiopian Airlines flight crew received a Master Caution
alert. Further, after the flaps were fully retracted, the unintended
AND stabilizer inputs required the pilots to apply additional force to
the columns to maintain the airplane's climb attitude.
Multiple alerts and indications can increase pilots' workload, and
the combination of the alerts and indications did not trigger the
accident pilots to immediately perform the runaway stabilizer procedure
during the initial automatic AND stabilizer trim input. In all three
flights, the pilot responses differed and did not match the assumptions
of pilot responses to unintended MCAS operation on which Boeing based
its hazard classifications within the safety assessment and that the
FAA approved and used to ensure the design safely accommodates
failures. Although a number of factors, including system design,
training, operation, and the pilots' previous experiences, can affect a
human's ability to recognize and take immediate, appropriate corrective
actions for failure conditions, industry experts generally recognize
that an aircraft system should be designed such that the consequences
of any human error are limited.\14\ Further, a report on a joint FAA-
industry study published in 2002, Commercial Airplane Certification
Process Study: An Evaluation of Selected Aircraft Certification,
Operations, and Maintenance Processes, noted that human performance was
still the dominant factor in accidents and highlighted that the
industry challenge is to develop airplanes and procedures that are less
likely to result in operator error and that are more tolerant of
operator errors when they do occur, in particular errors involving
incorrect response after a malfunction.\15\
---------------------------------------------------------------------------
\14\ (a) Yeh, Michelle, Cathy Swider, Young Jin Jo, and Colleen
Donovan. 2016. Human Factors Considerations in the Design and
Evaluation of Flight Deck Displays and Controls. Version 2.0, Final
Report--December 2016, DOT/FAA/TC-16/56. pp. 248-249. (b) The FAA's
Pilot's Handbook of Aeronautical Knowledge, FAA-H-8083-25B, Chapter 2,
page 2-12, states, ``Historically, the term `pilot error' has been used
to describe an accident in which an action or decision made by the
pilot was the cause or a contributing factor that led to the accident.
This definition also includes the pilot's failure to make a correct
decision or take proper action.''
\15\ The industry study team included representatives from
manufacturers, airlines, pilot labor organizations, and other aviation
stakeholders. See Commercial Airplane Certification Process Study: An
Evaluation of Selected Aircraft Certification, Operations, and
Maintenance Processes. March 2002. The Report of the FAA Associate
Administrator for Regulation and Certification's Study on the
Commercial Airplane Certification Process.
---------------------------------------------------------------------------
Consistent with this philosophy, the NTSB notes that FAA
certification guidance in AC 25.1309-1A that allows manufacturers to
assume pilots will respond to failure conditions appropriately is
based, in part, upon the applicant showing that the systems, controls,
and associated monitoring and warnings are designed to minimize crew
errors, which could create additional hazards.\16\ While Boeing
considered the possibility of uncommanded MCAS operation as part of its
functional hazard assessment, it did not evaluate all the potential
alerts and indications that could accompany a failure that also
resulted in uncommanded MCAS operation. Therefore, neither Boeing's
system safety assessment nor its simulator tests evaluated how the
combined effect of alerts and indications might impact pilots'
recognition of which procedure(s) to prioritize in responding to an
unintended MCAS operation caused by an erroneous AOA input.\17\ The
NTSB is concerned that, if manufacturers assume correct pilot response
without comprehensively examining all possible flight deck alerts and
indications that may occur for system and component failures that
contribute to a given hazard, the hazard classification and resulting
system design (including alerts and indications), procedural, and/or
training mitigations may not adequately consider and account for the
potential for pilots to take actions that are inconsistent with
manufacturer assumptions.
---------------------------------------------------------------------------
\16\ Title 14 CFR 25.1309(c) states, ``Warning information must be
provided to alert the crew to unsafe system operating conditions, and
to enable them to take appropriate corrective action. Systems,
controls, and associated monitoring and warning means must be designed
to minimize crew errors which could create additional hazards.''
\17\ Per Title 14 CFR 25.1309(d)(4), compliance demonstration as
part of aircraft certification must include analysis that considers the
crew warning cues, corrective action required, and the capability of
detecting faults.
---------------------------------------------------------------------------
Thus, the NTSB concludes that the assumptions that Boeing used in
its functional hazard assessment of uncommanded MCAS function for the
737 MAX did not adequately consider and account for the impact that
multiple flight deck alerts and indications could have on pilots'
responses to the hazard. Therefore, the NTSB recommends that the FAA
require that Boeing (1) ensure that system safety assessments for the
737 MAX in which it assumed immediate and appropriate pilot corrective
actions in response to uncommanded flight control inputs, from systems
such as MCAS, consider the effect of all possible flight deck alerts
and indications on pilot recognition and response; and (2) incorporate
design enhancements (including flight deck alerts and indications),
pilot procedures, and/or training requirements, where needed, to
minimize the potential for and safety impact of pilot actions that are
inconsistent with manufacturer assumptions.
Further, because FAA guidance allows such assumptions to be made in
transport-category airplane certification analyses without providing
applicants with clear direction concerning the consideration of
multiple flight deck alerts and indications in evaluating pilot
recognition and response, the NTSB is concerned that similar
assumptions and procedures for their validation may have also been used
in the development of flight control system safety assessments for
other airplanes. Therefore, the NTSB recommends that the FAA require
that for all other U.S. type-certificated transport-category airplanes,
manufacturers (1) ensure that system safety assessments for which they
assumed immediate and appropriate pilot corrective actions in response
to uncommanded flight control inputs consider the effect of all
possible flight deck alerts and indications on pilot recognition and
response; and (2) incorporate design enhancements (including flight
deck alerts and indications), pilot procedures, and/or training
requirements, where needed, to minimize the potential for and safety
impact of pilot actions that are inconsistent with manufacturer
assumptions.
Because the FAA routinely harmonizes related standards and guidance
with other international regulators who type certificate transport-
category airplanes, the NTSB notes that those airplanes may have been
designed using similar standards and therefore may also be impacted by
this vulnerability. Therefore, the NTSB also recommends that the FAA
notify other international regulators that certify transport-category
airplane type designs (for example, the European Union Aviation Safety
Agency [EASA], Transport Canada, the National Civil Aviation Agency-
Brazil, the Civil Aviation Administration of China, and the Russian
Federal Air Transport Agency) of Recommendation A-19-11 and encourage
them to evaluate its relevance to their processes and address any
changes, if applicable.
As early as 2002, the joint FAA-industry study recognized that,
while excellent guidance existed for manufacturers on various topics
salient to the development of system safety assessments, there were no
methods available to evaluate the probability of human error in the
operation of a particular system design and that existing qualitative
methods for assessing human error were not ``very satisfactory.'' The
2002 study went on to state that the processes used to determine and
validate human responses to failure and methods to include human
responses in safety assessments needed to be improved.\18\ The NTSB
notes that a number of human performance research studies have been
conducted in the years since the certification guidance contained in AC
25.1309-1A was put in place (in 1988) and this study was conducted and
it is likely that more rigorous, validated methodologies exist today to
assess error tolerance with regard to pilot recognition and response to
failure conditions. The NTSB also believes that the use of validated
methods and tools to assess pilot performance in dealing with failure
conditions and emergencies would result in more effective requirements
for flight deck interface design, pilot procedures, and training
strategies. However, we are concerned that such tools and methods are
still not commonplace or required as part of the design certification
process for functions such as MCAS on newly certified type designs.
---------------------------------------------------------------------------
\18\ Commercial Airplane Certification Process Study: An Evaluation
of Selected Aircraft Certification, Operations, and Maintenance
Processes. March 2002. The Report of the FAAAssociate Administrator for
Regulation and Certification's Study on the Commercial Airplane
Certification Process.
---------------------------------------------------------------------------
Thus, the NTSB concludes that a standardized methodology and/or
tools for manufacturers' use in evaluating and validating assumptions
about pilot recognition and response to failure condition(s),
particularly those conditions that result in multiple flight deck
alerts and indications, would help ensure that system designs
adequately and consistently minimize the potential for pilot actions
that are inconsistent with manufacturer assumptions. Therefore, the
NTSB recommends that the FAA develop robust tools and methods, with the
input of industry and human factors experts, for use in validating
assumptions about pilot recognition and response to safety-significant
failure conditions as part of the design certification process.
Further, the NTSB recommends that once the tools and methods have been
developed as recommended in Recommendation A-19-13, the FAA revise
existing FAA regulations and guidance to incorporate their use and
documentation as part of the design certification process, including
re-examining the validity of pilot recognition and response assumptions
permitted in existing FAA guidance.
System Diagnostic Tools
As previously discussed, Title 14 CFR 25.1322 addresses flight crew
alerting and states, in part, that flight crew alerts must
(1) Provide the flightcrew with the information needed to:
(i) Identify non-normal operation or airplane system conditions,
and
(ii) Determine the appropriate actions, if any.
(2) Be readily and easily detectable and intelligible by the
flightcrew under all foreseeable operating conditions,
including conditions where multiple alerts are provided.
Multiple alerts and indications in the cockpit can increase pilots'
workload and can also make it more difficult to identify which
procedure the pilots should conduct. The NTSB notes that the Lion Air
and Ethiopian Airlines accident pilots' responses to multiple alerts
and indications are similar to the circumstances of a 2009 accident
involving Air France flight 447, an Airbus A330, which was traveling
from Rio de Janeiro to Paris when it crashed in the Atlantic Ocean.\19\
In its accident report, the Bureau d'Enquetes et d'Analyses Pour la
Securite de L'aviation Civile (BEA) concluded that failure messages
successively displayed on the electronic centralized aircraft
monitoring system did not allow the crew to rapidly and effectively
diagnose the issue (the blockage of the pitot probes) or make the
connection between the messages that appeared and the procedure to use.
Accordingly, the BEA recommended that EASA ``study the relevance of
having a dedicated warning provided to the crew when specific
monitoring is triggered, in order to facilitate comprehension of the
situation.'' \20\
---------------------------------------------------------------------------
\19\ Bureau d'Enquetes et d'Analyses Pour la Securite de L'aviation
Civile. 2012. Final Report, On the accident on 1st June 2009 to the
Airbus A330-203, registered F-GZCP, operated by Air France, flight AF
447, Rio de Janeiro--Paris.
\20\ The response to this recommendation, FRAN-2012-049, was
classified as ``partially adequate,'' and the recommendation was closed
as of February 2, 2019.
---------------------------------------------------------------------------
Human factors research has identified that, for non-normal
conditions, such as those involving a system failure with multiple
alerts, where there may be multiple flight crew actions required,
providing pilots with understanding as to which actions must take
priority is a critical need.\21\ This is particularly true in the case
of functions implemented across multiple airplane systems because a
failure in one system within highly integrated system architectures can
present multiple alerts and indications to the flight crew as each
interfacing system registers the failure. For example, the erroneous
AOA output experienced during the two accident flights resulted in
multiple alerts and indications to the flight crews, yet the crews
lacked tools to identify the most effective response.\22\ Thus, it is
important that system interactions and the flight deck interface be
designed to help direct pilots to the highest priority action(s).
---------------------------------------------------------------------------
\21\ See (a) Mumaw, Randall J. 2017. ``Analysis of Alerting System
Failures in Commercial Aviation Accidents.'' Proceedings of the Human
Factors and Ergonomics Society 2017 Annual Meeting; and (b) Burian,
Barbara K., Immanuel Barshi, and Key Dismukes. 2005. The Challenge of
Aviation Emergency and Abnormal Situations NASA/TM--2005-213462. NASA
Scientific and Technical Information Program Office. Washington, DC.
\22\ After the Lion Air accident, on November 7, 2018, the FAA
issued emergency Airworthiness Directive 2018-23-51, revising the
Boeing 737 MAX Airplane Flight Manual (AFM) to expand the existing
runaway stabilizer procedure when erroneous AOA input is detected. This
revision provided new details about the effects and indications a pilot
might experience due to an erroneous AOA input, such as increasing
nose-down control forces resulting from repeated AND stabilizer trim
inputs. It also instructed pilots to perform the existing AFM runaway
stabilizer procedure, emphasizing that the pilot set the STAB TRIM
CUTOUT switches to CUTOUT and that the switches stay in the CUTOUT
position for the remainder of the flight.
---------------------------------------------------------------------------
Research demonstrates that emergency situations increase workload
and require additional effort to manage effectively because of the
stress involved and the lack of opportunity for pilots to practice
these skills compared to those used in normal operations.\23\ In
addition, research into pilot responses to multiple/simultaneous
anomalous situations, along with data from accidents, indicates that
multiple competing alerts may exceed available mental resources and
narrow attentional focus leading to delayed or inadequately prioritized
responses.\24\ According to FAA research, ``in some airplanes, the
complexity and variety of ancillary warnings and alerts associated with
major system failures can make it difficult for the flightcrew to
discern the primary failure.'' \25\ The researchers noted that better
system failure diagnostic tools are needed to resolve this issue.
---------------------------------------------------------------------------
\23\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005.
The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
2005-213462. NASA Scientific and Technical Information Program Office.
Washington, DC.
\24\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005.
The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
2005-213462. NASA Scientific and Technical Information Program Office.
Washington, DC.
\25\ Federal Aviation Administration. 1996. Federal Aviation
Administration Human Factors Team Report on: The Interfaces Between
Flightcrews and Modern Flight Deck Systems, June 18, 1996.
---------------------------------------------------------------------------
Thus, the NTSB concludes that aircraft systems that can more
clearly and concisely inform pilots of the highest priority actions
when multiple flight deck alerts and indications are present would
minimize confusion and help pilots respond most effectively. Therefore,
the NTSB recommends that the FAA develop design standards, with the
input of industry and human factors experts, for aircraft system
diagnostic tools that improve the prioritization and clarity of failure
indications (direct and indirect) presented to pilots to improve the
timeliness and effectiveness of their response. The NTSB further
recommends that once the design standards have been developed as
recommended in Recommendation A-19-15, the FAA require implementation
of system diagnostic tools on transport-category aircraft to improve
the timeliness and effectiveness of pilots' response when multiple
flight deck alerts and indications are present.
______
Recommendations
To the Federal Aviation Administration
Require that Boeing (1) ensure that system safety assessments
for the 737 MAX in which it assumed immediate and appropriate
pilot corrective actions in response to uncommanded flight
control inputs, from systems such as the Maneuvering
Characteristics Augmentation System, consider the effect of all
possible flight deck alerts and indications on pilot
recognition and response; and (2) incorporate design
enhancements (including flight deck alerts and indications),
pilot procedures, and/or training requirements, where needed,
to minimize the potential for and safety impact of pilot
actions that are inconsistent with manufacturer assumptions.
(A-19-10)
Require that for all other U.S. type-certificated transport-
category airplanes, manufacturers (1) ensure that system safety
assessments for which they assumed immediate and appropriate
pilot corrective actions in response to uncommanded flight
control inputs consider the effect of all possible flight deck
alerts and indications on pilot recognition and response; and
(2) incorporate design enhancements (including flight deck
alerts and indications), pilot procedures, and/or training
requirements, where needed, to minimize the potential for and
safety impact of pilot actions that are inconsistent with
manufacturer assumptions. (A-19-11)
Notify other international regulators that certify transport-
category airplane type designs (for example, the European Union
Aviation Safety Agency, Transport Canada, the National Civil
Aviation Agency-Brazil, the Civil Aviation Administration of
China, and the Russian Federal Air Transport Agency) of
Recommendation A-19-11 and encourage them to evaluate its
relevance to their processes and address any changes, if
applicable. (A-19-12)
Develop robust tools and methods, with the input of industry
and human factors experts, for use in validating assumptions
about pilot recognition and response to safety-significant
failure conditions as part of the design certification process.
(A-19-13)
Once the tools and methods have been developed as recommended
in Recommendation A-19-13, revise existing Federal Aviation
Administration (FAA) regulations and guidance to incorporate
their use and documentation as part of the design certification
process, including re-examining the validity of pilot
recognition and response assumptions permitted in existing FAA
guidance. (A-19-14)
Develop design standards, with the input of industry and human
factors experts, for aircraft system diagnostic tools that
improve the prioritization and clarity of failure indications
(direct and indirect) presented to pilots to improve the
timeliness and effectiveness of their response. (A-19-15)
Once the design standards have been developed as recommended in
Recommendation A-19-15, require implementation of system
diagnostic tools on transport-category aircraft to improve the
timeliness and effectiveness of pilots' response when multiple
flight deck alerts and indications are present. (A-19-16)
BY THE NATIONAL TRANSPORTATION SAFETY BOARD
ROBERT L. SUMWALT, III JENNIFER HOMENDY
Chairman Member
BRUCE LANDSBERG
Vice Chairman
Report Date: September 19, 2019
The Chairman. Thank you, Mr. Sumwalt. Mr. Hart, you are
recognized.
STATEMENT OF HON. CHRISTOPHER A. HART, CHAIRMAN,
JOINT AUTHORITIES TECHNICAL REVIEW (JATR)
Mr. Hart. Thank you, Chairman Wicker, Ranking Member
Cantwell, and members of the Committee. Thank you for inviting
me to this hearing today. First, I would like to extend my
condolences, joining others who have already done so, to the
families and friends of the passengers and crew on Lion Air
flight 610 and Ethiopian Airlines flight 302.
The FAA created the Joint Authorities Technical Review
because these crashes revealed a need to review the robustness
of the aircraft certification process. The JATR, which included
representatives from the FAA, NASA, and nine other civil
aviation authorities was created to review the MAX
certification process to determine whether the appropriate
regulations were applied, to assess whether compliance with
those regulations was shown, and to recommend improvements in
the process.
I commend the FAA for seeking this certification process
peer review and for making it public. The MAX grounding was
unprecedented. Two previous groundings were the McDonnell
Douglas DC-10 in 1979 when an engine separated from the wing,
and the Boeing 787 in 2013 due to battery fires. In those two
groundings, the airplanes were rendered unairworthy. Because
the airplanes were unairworthy, pilot competence was not an
issue. Because those groundings resulted solely from airplane
problems, the country where the airplanes were manufactured
made the grounding and ungrounding decisions.
The grounding of the MAX, on the other hand, involves
automation that usually worked but sometimes failed, and when
it failed, some pilots knew how to respond but some, including
those who crashed, did not. Because the scenario was not just
an airplane problem, but a problem of airplane system/pilot
interaction, every country that licenses pilots must also be
involved in the grounding and ungrounded decisions.
As automation complexity increases, I anticipate that
future problems are more likely to be of the airplane/pilot
type rather than airplane only. After three JATR meetings in
Seattle in which Boeing and the FAA were very open and helpful,
and extensive work between the meetings, the JATR gave the FAA
on October 11 a compilation of team members' recommendations in
12 areas. Some of the recommendations derived from the need for
the certification process to address how a single system
failure may create issues in other systems.
Other recommendations raised the issue of whether a process
that has been based largely upon compliance should also address
safety. As systems become more complex, the likelihood
increases that compliance with applicable regulations will not
necessarily ensure safety. Moreover, as systems become more
complex, the certification process should ensure that fail-safe
design principles prioritize the mitigation of hazards through
design, minimizing reliance on pilot action as primary means of
risk mitigation. Delegation will probably become more prevalent
as regulators encounter increasing difficulty hiring and
retaining technology leaders.
Thus, although the recommendations do not address the
desirability of delegation. They do recommend examining how to
make the ODA process less cumbersome to avoid stifling
communications. Query, for example, whether inadequate
communications resulted in the failure to address the effects
of evolving the Maneuvering Characteristics Augmentation
System, MCAS, from a benign system to a more aggressive system.
And query whether inadequate communications resulted in the
failure to address the effects of modifying MCAS from one
scenario to another scenario.
Other recommendations relate to the FAA standards regarding
the time for pilots to identify and respond to problems. JATR
members recommend reviewing whether existing standards are
appropriate for today's complex systems. For example, when a
system failure results in cascading failures and multiple
alarms, query how adequately the certification process
considers the impact of multiple alarms, along with possible
startle effect, on the ability of pilots to respond
appropriately. These two crashes are the latest of several
recent crashes in which pilots encountered scenarios that they
had never seen before, even in training, and responded
inappropriately. Increasing complexity and reliability
exacerbate the challenge of training pilots to respond to
problems that they have never seen before.
Increasing complexity exacerbates the challenge because it
reduces the likelihood that pilots understand the system.
Increasing reliability exacerbates the challenge because it
increases the difficulty of determining what types of problems
might occur and then including those types of problems in
training. In conclusion, the JATR members hope that their
recommendations will continue improving aviation safety by
helping to improve the certification process.
Thank you again for inviting me and I look forward to your
questions.
[The prepared statement of Mr. Hart follows:]
Prepared Statement of Hon. Christopher A. Hart, Chairman,
Joint Authorities Technical Review (JATR)
Introduction. Chairman Wicker, Ranking Member Cantwell, and Members
of the Committee, thank you for the opportunity to be here today in my
capacity as Chairman of the Joint Authorities Technical Review (JATR)
to discuss the JATR's efforts to improve aviation safety.
Before I begin, I would like to extend my sincerest condolences to
the families and friends of the passengers and crew on Lion Air Flight
JT610 that crashed a year ago today, on October 29, 2019, and on
Ethiopian Airlines Flight ET302 that crashed less than five months
later, on March 10, 2019.
The following describes the JATR and why it was created, discusses
some of the recommendations that it submitted to the Federal Aviation
Administration (FAA), and then briefly describes a training challenge
that has come to light as a result of the JATR's efforts.
The JATR. The Boeing 737 MAX (MAX) Flight Control System Joint
Authorities Technical Review, created by the FAA, had its kickoff
meeting in late April/early May 2019, and its charter was signed and
became official on June 1, 2019. It consisted of technical
representatives from the FAA, the National Aeronautics and Space
Administration (NASA), and civil aviation authorities from Australia,
Brazil, Canada, China, Europe, Indonesia, Japan, Singapore, and the
United Arab Emirates. The FAA intentionally did not include on the JATR
team any of its staff who were involved in the MAX certification
process.
I was asked to lead the JATR, in part because of my experience in
aviation safety and accident investigation. I was at the National
Transportation Safety Board for a total of 12 years, including as
Chairman. I also have a regulatory perspective from 14 years at the
FAA. To ensure a fully objective review, I was not compensated by the
FAA for this role. I would also note that I am not a certification
process expert, so I don't have the perspective of ``this is how we
have always done certification and we should keep it that way.'' I was
honored to be asked to lead this important international aviation
safety improvement effort.
Why the JATR. The FAA's aircraft certification process has played a
major role in producing airliners with an exemplary safety record.
Nonetheless, as with any system that is designed and operated by
humans, the certification process can never be perfect, and the two
tragic MAX crashes noted above revealed a critical need to review the
process to determine whether improvement and modernization are
warranted. The JATR was created to conduct that review and make
improvement recommendations as warranted. The JATR completed its review
on October 11, 2019, when it gave its compilation of team members'
recommendations (not necessarily with consensus, as noted below) to the
FAA.
The JATR was not chartered to become involved in returning the MAX
to service, nor was it chartered to become involved in the two accident
investigations. Moreover, the JATR was not created to determine fault
or blame in the certification process, but to consider whether the
appropriate regulations and policy were applied to the MAX; to assess
whether compliance was shown with the applicable requirements related
to the flight control system; and to recommend improvements to the
certification process.
The JATR was unprecedented in that it was the first time an
aviation safety regulator has voluntarily called for what is
essentially an international peer review of its certification process,
and then made that peer review public. The FAA's willingness to use
such a process to improve safety, and doing so with such transparency,
are indicative of the safety culture that permeates the commercial
aviation industry that has produced such an exemplary airline safety
record.
Unprecedented Groundings. The grounding of the MAX was also
unprecedented and placed the worldwide aviation industry in uncharted
territory. The other two airliner groundings by the FAA in in the last
40 years were the McDonnell Douglas DC-10 in 1979, after an engine
separated from the wing shortly after takeoff; and the Boeing 787 in
2013, due to lithium-ion battery thermal runaways and fires. In those
two groundings, the airplanes were rendered unairworthy by mechanical
malfunctions.
Because the airplanes were unairworthy, the problem was solely an
airplane problem and pilot competence was not an issue. Because those
groundings resulted entirely from airplane problems, the primary
country that decided when to ground the airplanes and when to return
them to service was the country where the airplanes were manufactured--
in those two instances, the U.S.
The MAX grounding, on the other hand, involved automation that
usually worked but sometimes failed; and when it failed, some pilots
knew how to handle the failure (including the pilots on the Lion Air
MAX the day before it crashed) but some did not, even after the
additional attention to the issue that resulted from the Lion Air
crash; and among those who did not know how to handle the failure were
those who crashed. Hence, the scenario was not just an airplane
problem, but a problem of the interaction between the airplane systems
and its pilots. Thus, not only the country where the airplane is
manufactured, but also every country that licenses and trains pilots
must be involved in the decisions to ground and to return to service.
My expectation is that the international aviation community will be
challenged to figure out how to handle this new scenario because future
airliner problems are more likely to be of the airplane-pilot
interaction type and less likely to be of the airplane-only type. The
JATR was a first step in figuring out how the certification process can
best address what may be a new normal.
Hence, I commend the FAA's inclusion in the JATR of representatives
from nine other civil aviation authorities because this is not just an
FAA certification process issue but a worldwide certification process
issue. Because most of the aviation authorities in the JATR also
certify aviation products, this was an opportunity for the certifying
countries to begin working together to determine how best to navigate
this uncharted territory. Moreover, all of the aviation authorities in
the JATR are involved in the licensing and training of pilots.
The JATR process. The JATR met three times in Seattle, starting
with the kickoff meeting in the Spring in Seattle (noted above) for
initial briefings from Boeing and the FAA. At that first meeting the
JATR was divided into seven subgroups, with the following focus areas:
A: Applied Regulations and Policy
B: Compliance with applicable portions of 14 CFR part 25,
subparts B (Flight) and G (Operating Limitations and
Information)
C: Compliance with applicable portions of 14 CFR part 25,
subparts D (Design and Construction) and F (Equipment)
D: Boeing Systems Engineering Practices
E: Organization Designation Authorization (ODA)
F: Operational Suitability, Maintenance, and Training
G: Preliminary Accident Information
In mid-Summer the JATR had an intensive follow-up meeting in
Seattle with Boeing and FAA personnel, including an extensive review of
various certification documents.
Writing the observations, findings, and recommendations commenced
after the second meeting, and later in the summer the JATR met again in
Seattle to consider the document as a whole as it was shaping up.
Boeing and the FAA were very open and helpful to the JATR team in these
meetings and in general throughout our review. We also received notable
support from a number of FAA aircraft certification, evaluation, and
oversight personnel throughout the process. As the document was being
finalized, the JATR gave Boeing and the FAA an opportunity to review
objective information assembled by the team for the purpose of ensuring
the factual accuracy of the information on which the JATR team members
based their observations, findings, and recommendations. After several
iterations, the JATR submitted its final observations, findings, and
compilation of team members' recommendations to the FAA on October 11,
2019.
The Recommendations. The JATR submitted recommendations in eleven
areas involving the certification process, and one post-certification
area. In order to encourage diversity of views from the team, the
JATR's charter encouraged its members to provide recommendations
irrespective of whether they reflected consensus. Consequently, the
JATR did not check or measure consensus.
The initial scope of the JATR process was limited to the
certification process itself, but the charter enabled the co-chairs, in
their discretion, to expand the scope if warranted. Hence, one
recommendation area pertains to post-certification activities because
of its potential to help improve the safety of future certification
processes.
In no particular order of priority, the eleven recommendation areas
regarding the certification process are:
1. Changed Product Rule
2. Development and use of up-to-date requirements and practices
3. Consistent interpretation and application of requirements
4. Changes during the certification process
5. Delegation of certification authority
6. Holistic, integrated aircraft-level approach
7. Human factors
8. Development assurance
9. Impact of product design changes on certification
10. Impact of product design changes on flightcrew training
11. Impact of product design changes on maintenance training
The post-certification recommendation area is:
12. Post-certification corrective actions and data sharing
Some of the recommendations are very broad in their application and
others are more specific.
Broad Recommendations. Some of the broader recommendations derive
from the increasing complexity of aircraft systems, particularly
automated systems and the interaction and interrelationship between
systems. As aircraft systems become more complex, ensuring that the
certification process adequately addresses potential operational and
safety ramifications for the entire aircraft that may be caused by the
failure or inappropriate operation of any system on the aircraft
becomes not only more important, but also more difficult.
Other broader recommendations raise the foundational issue of
whether a process that has historically served the industry well for
decades based largely upon compliance needs to be revisited to address
not only compliance but also safety. As systems become more complex and
may interact in unforeseeable ways, the likelihood increases that
regulations and standards will not address every conceivable scenario.
To the extent they do not address every scenario, compliance with every
applicable regulation and standard does not necessarily ensure safety.
Moreover, as systems become more complex, the certification process
should ensure that aircraft incorporate fail-safe design principles
that prioritize the elimination or mitigation of hazards through
design, minimizing reliance on pilot action as primary means of risk
mitigation.
Specific Recommendations. Some form of delegation will probably
become increasingly necessary as the FAA and aviation regulators
worldwide encounter increasing difficulty hiring and retaining leading
technologists in rapidly advancing technologies. Thus, although the
recommendations do not address the desirability of delegation in
general or of the ODA concept in particular, they do recommend
examining how to make the ODA process less cumbersome and bureaucratic
to avoid stifling adequate communications in future certification
processes about important characteristics of what is being
certificated.
Query, for example, whether inadequate communications were partly
responsible for the failure to address potential unintended
consequences from the evolution of the Maneuvering Characteristics
Augmentation System (MCAS) from a relatively benign system to a much
more aggressive system; and query whether inadequate communications
played a role in the failure to address potential unintended
consequences that can result from designing software for one scenario--
in this case, high-speed windup turns--and then modifying the software
for a different scenario--in this case reducing the pitch-up tendency
at higher angles of attack at low speeds.
Other specific recommendations relate to revisiting the FAA's
standards regarding the time needed by pilots to identify and respond
to problems. Although existing standards have served the industry well
for decades, the JATR members recommended an examination of whether
those standards remain appropriate for the complex integrated systems
in today's airplanes. For example, when the failure or inappropriate
operation of a system results in cascading failures and multiple
alarms, query how adequately the certification process considers the
impact of multiple alarms, along with possible startle effect, on the
ability of pilots to respond appropriately. Inherent in this issue is
the adequacy of training to help pilots be able to respond effectively
to failures that they may never have encountered before, not even in
training.
The Future Training Challenge. The closer automation comes to
completely removing the human, the more daunting are the challenges of
becoming more automated. One of those challenges was highlighted by
these two MAX crashes. These crashes were the latest of several crashes
in the previous decade in which pilots encountered scenarios that they
had never seen before, even in training, and responded inappropriately.
The increasing complexity and reliability of automation will
exacerbate the international aviation community's challenge of training
pilots to respond to problems that they have never seen before.
Increasing complexity will exacerbate the training challenge because it
will reduce the likelihood that pilots will fully understand the
system's capabilities and what it does and does not do. Increasing
reliability is obviously good, but an unintended consequence is that it
will exacerbate the training challenge because it increases the
difficulty of forecasting what types of failures might occur, which in
turn decreases the likelihood of including the most important potential
failure modes in training.
This issue is not within the scope of the JATR's charter because it
is not a certification issue, but it has been brought to light by the
JATR's activities. Hopefully the international aviation community will
follow the collaboration example reflected by the JATR and work
together to address this training challenge.
Conclusion. The JATR members hope that their recommendations will
continue improving aviation safety by helping to improve the
certification process.
The Chairman. Thank you, gentlemen. Is the work complete
regarding the MAX for either of your organizations? Mr.
Sumwalt?
Mr. Sumwalt. Mr. Chairman, thank you for that question. We
are continuing to go through scores and scores of design
certification documents. If we need to make additional
recommendations, we certainly will. So, to answer your
question, our work is not completed.
The Chairman. And Mr. Hart?
Mr. Hart. Our work is completed because we were chartered
to review the situation and give recommendations to the FAA. We
did that on October 11. That completed our work and thank you
for asking.
The Chairman. So this particular JATR, Joint Authorities
Technical Review, is over and disbanded?
Mr. Hart. That is correct.
The Chairman. Alright. Let's talk about the time between
the first crash and the second crash. It was evident after the
Lion crash, that the MCAS system was not working correctly. Is
that true, Mr. Sumwalt?
Mr. Sumwalt. Yes, sir. That is correct.
The Chairman. And Mr. Hart, there were many factors
involved, but the dysfunction of the MCAS was central?
Mr. Hart. That is correct.
The Chairman. OK. And at that point, what notice was sent
out to other airlines and to the pilots to make it clear that
the MCAS was the main problem?
Mr. Sumwalt. Mr. Chairman, as you are aware today is the 1-
year anniversary of Lion Air. So, on October 29 was the crash.
I believe it was October, or correction November the 7th when
the FAA put out an airworthiness directive to require certain
procedural modifications.
The Chairman. Was that a typical airworthiness directive or
was it highlighted as an emergency airworthiness directive?
Mr. Sumwalt. I am not sure. Chris, do you know?
Mr. Hart. Airworthiness directives pretty much by
definition are considered an emergency. So I think this one was
definitely one that is supposed to command the attention of the
entire industry.
The Chairman. OK, Mr. Sumwalt is consulting with staff and
it is fine if he supplements his answer, but this was a red
flag sent out about the MAX and the MCAS part of it. Is that
correct? Would either of you gentlemen quarrel that this was a
red flag warning?
Mr. Hart. It was an industry-wide warning that everybody
who flies this airplane needs to know about, and so to that
extent, yes.
The Chairman. OK. Well, is there a way that we could have
made it more explicit? Was there something about this advisory
that didn't get the job done, Mr. Hart?
Mr. Hart. I am sorry, but I cannot speak for the FAA and
their decision process on how to handle this. The decision
process to have the airworthiness directives within days of the
second crash was intentional to get the word out as quickly as
possible. But I was not privy to the decisionmaking process.
The Chairman. No, but I am referring to the way it would
typically have been received internationally and in the
aviation industry. This would have been taken seriously and
been given a heightened bit of attention, is that correct?
Mr. Hart. That certainly is the purpose of an airworthiness
directive, yes. How people responded to it, I do not have a
good answer to that.
The Chairman. OK. Now did I hear you say, Mr. Hart, that
some pilots reacted in one way which was sufficient, and some
pilots did not for whatever reasons? If you could elaborate on
what you were telling the Committee.
Mr. Hart. Yes, thank you for that question. I was referring
specifically to the fact that before the Lion Air crash, the
day before that crash, that same problem was encountered, and
the pilots responded to it appropriately.
The Chairman. Well, do you think that there was a failure
at Lion Air to notify the other crews that a problem had
occurred, it was resolved in this fashion, and we need to be
mindful of that? Do you know if that was communicated between
the flight that did land safely and the one the next day?
Mr. Hart. Thank you for the question. Unfortunately, I do
not know the details of who told what to whom, whether it was
the mechanics, or the other pilots. I do not know the details
of how that information about what happened the day before was
transmitted to the to the subsequent pilots and subsequent
mechanics.
The Chairman. Mr. Sumwalt, do you want to clarify anything
that you have said based on some advice that you have been
getting?
Mr. Sumwalt. Well, in fact, it was an emergency
airworthiness directive that was issued by the FAA as Mr. Hart
has indicated.
The Chairman. That is a term of art, an ``emergency
airworthiness directive?''
Mr. Sumwalt. That is correct. And that means that it does
not allow for public comment. Oftentimes for normal
airworthiness directive the FAA has to put it out for public
comment unless it is an emergency airworthiness directive.
The Chairman. Is it fair for me to characterize that as a
red flag?
Mr. Sumwalt. Well as Chris Hart indicated, it does indicate
that there was something that needed immediate awareness within
the aviation community.
The Chairman. Senator Cantwell.
Senator Cantwell. Thank you, Mr. Chairman, and I thank the
second panel for being here. Wish there was many people
listening to this panel as the first because this is the hard
work that we have to do in getting this right and moving
forward. And I so much appreciate, Mr. Sumwalt, NTSB's
recommendations and Mr. Hart, your committee's recommendations.
My colleagues and I, Senator Duckworth, Senator Blumenthal
have already introduced legislation on the NTSB and other
recommendations last week, and hopefully we will be able to
move forward on those. You heard the discussion. I believe we
are here for this issue about what happened in the cockpit and
the level of distraction, which I think is the point, Mr.
Sumwalt. At least two of the recommendations that we put in our
legislation, that is your recommendation, that the FAA direct
Boeing to have clearer corrective actions from uncommanded
systems and that there be some sort of resolution that they
have had in other planes to the cockpit situation so that we
are not bombarding pilots. Also that they develop the same kind
of assessment.
Now when I read the circulars, and I have read many, it is
pretty clear to me that, you know, this already should have
been done. I mean, it is pretty clear that you have talked
about the effectiveness--when you submit a plan for a plane you
have to submit this alert plan. So we will see, we will find
out at some point what alert plan was submitted and what was
reviewed.
But it is very clear that you have to have, you know, this
effectiveness intended for human and machine integration, you
know, people understanding the alerts, compatibility with other
displays and warnings, ensuring that the system is telling the
pilots what to do. So listen, I appreciate your recommendations
and we are going to get them into law, trust me. The question
becomes, what are we doing on top of something that isn't
already clear here.
What is it that actually we are doing and helping people
understand. What is it we are doing here to make this system
safer? And the reason I ask this is because as I said in my
opening statement, I actually believe this is the issue de
jure. I think it is for automobile safety moving forward on
more AVs and on airplanes. There is going to be more
integration into the cockpit. So anytime you are taking over
command of that plane with a response, we need to know, and we
need to understand that functionality.
So what are these alert system requirements that were
asking the FAA to do both for the MAX and for all planes? What
is that really giving us that we do not currently have now in
the statute?
Mr. Sumwalt. Thank you for the question, Senator Cantwell,
and thank you for your leadership and your advocacy on this
area. We issued these seven recommendations a month ago because
we did identify holes in the design certification process. I
would be glad to get into some of those holes in what those
recommendations are, but I do not want to dominate your time. I
defer to you.
Senator Cantwell. Well, my question was, why do you think
this is important because you actually do not think that the
details are there?
Mr. Sumwalt. That is correct--the long and the short of it,
woven throughout each of the seven recommendations is that we
found that when pilots are faced with multiple alerts, they are
not performing or reacting in the way that Boeing thought that
they would react when they developed their design assumptions.
Senator Cantwell. And what about safety management systems
for aerospace manufacturers? What about that recommendation?
Mr. Sumwalt. The NTSB has found the benefits of safety
management systems in many modes of transportation including
aviation. We do not have specifically a recommendation for an
SMS for the manufacturers. However, we do believe that when you
are properly analyzing and assessing your risk, that is
improving safety. So, personally, I think that would be a good
idea for manufacturers to have a safety management system in
place.
Senator Cantwell. And what does that mean to most people
who are trying to listen to this conversation post the one we
just had? What does that actually mean that happens?
Mr. Sumwalt. You know, I have always looked at safety
management systems and I like the term safety management
instead of safety management systems because it is an active
thing. We want to manage safety the way that we would manage
other vital business functions. So, there are generally thought
to be four tenets of SMS, one of which is safety risk
assessment where you are actively assessing your risk and
managing those risk to an acceptable level. And so that is a
key component of a safety management system.
Senator Cantwell. Well this issue of risk management is
critical and that is what I believe is that you have to say,
what are the highest risks so you can focus on it. It is clear
no one thought this change of a new system that took outside
information, controlled the plane, gave it different commands
with different alerts, that do different things, it wasn't
tested.
So we have to implement this. The FAA was given this, I do
not know if it was a directive or nudge before, but then they
pulled back on a rulemaking in 2014 on this system management.
But you believe ICAO, others are recommending this is what we
should go forward with because it creates this robust
discussion constantly. Is that the right way to describe it?
Mr. Sumwalt. As a safety practitioner, I agree with that
and I do want to say again, the NTSB has not gone on the record
to have a recommendation for that, but from a safety
practitioners perspective, again when you are managing your
risk, you are managing safety.
Senator Cantwell. Thank you. Thank you. My time has passed.
Senator Blumenthal.
Senator Blumenthal. Thank you. Thank you, Senator Cantwell,
and I want to express my appreciation to Senator Cantwell and
Senator Duckworth for the legislation that we are working on
together and additional legislation that we hope will be based
on your reports and others. You know, I had a lot of questions
for our previous witness, which unfortunately I didn't have
time to ask.
One of them would have been, why did he call the President
of the United States, in effect circumventing the FAA if they
were really going to respect safety? Are either of you aware of
the call or calls that were made by Mr. Muilenburg to the
President of the United States seeking to prevent grounding of
these airplanes in the immediate aftermath of the second crash?
Mr. Sumwalt. Senator Blumenthal, I am not aware of that. I
sat in this hearing room in March when you asked Mr. Elwell the
same questions. I am not aware of that. We were not involved in
the decision to ground the aircraft in any form or fashion.
Senator Blumenthal. Mr. Hart?
Mr. Hart. It was not within the purview of the JATR either.
We were looking into the certification process to decide how to
make it better.
Senator Blumenthal. The fact of the matter is that the
United States of America was among the last nations to ground
those airplanes, correct?
Mr. Sumwalt. That is certainly my understanding. Us and
Canada.
Senator Blumenthal. And normally the United States of
America would be at the forefront of safety, correct? Mr. Hart?
Mr. Hart. Good question, Senator. Just for your awareness,
I am on record through an op-ed in USA Today to congratulate
the FAA for waiting until they had enough data to see was this
a one-off event because if it was a one-off event, they would
be grounding airplanes after every crash or was it more than a
one-off in other words----
Senator Blumenthal. In retrospect was it a good decision to
ground that airplane?
Mr. Hart.--after they had enough data to see the similarity
of the two, yes.
Senator Blumenthal. But the United States was the last to
have enough data for whatever the reason?
Mr. Hart. Yes.
Senator Blumenthal. Just saying, right?
Mr. Hart. Well, everybody had the same data about the same
time. I just think the U.S., the FAA has a reputation for
waiting until it has the data to react.
Senator Blumenthal. Let me ask you, your report found that,
``key aspects of the MCAS function such as intended function
description, its interfaces, and architecture were not directly
visible to the FAA in a straightforward manner through the
certification deliverable documents.'' I am trying to put that
in simple English that you would use in the USA Today article.
They didn't do full disclosure to the FAA, correct?
Mr. Hart. In simple language, the process certainly--the
process was complicated enough and challenging enough and
bureaucratic enough that the communication was stifled. And so
the communication didn't get where it needed to be when it
needed to be there.
Senator Blumenthal. OK. I think that answers my question.
And that was something we should correct, correct?
Mr. Hart. That is something that the JATR has recommended
correcting, and yes, it does need correcting.
Senator Blumenthal. The Wall Street Journal recently
reported that internal Boeing surveys revealed that about 30
percent of its employees felt potential undue pressure from
managers regarding safety related approval. In fact, one of the
Boeing engineers, Curtis Ewbank filed a complaint that
asserted, ``Boeing management was more concerned with cost and
schedule than safety or quality.'' Did your investigative work
indicate that kind of undue pressure from Boeing on its
employees to move the safety process at the expense of--I am
sorry move the certification process at the expense of safety?
Mr. Hart. Thank you for your question. Our investigation,
our review found enough concern about undue influence that we
recommended that it be reviewed carefully for the next time,
the next certification process.
Senator Blumenthal. You indicate, I think, in your
testimony that you thought delegation would continue, which
seems contrary to what we have found here so far that a lot of
the thrust of the questioning has been to reverse delegation.
So, I hope that maybe we can have your further thoughts on that
issue. Let me just ask one more question.
Mr. Sumwalt, on Sunday, just this past Sunday, the New York
Times reported on Boeing's efforts to undercut regulatory
oversight early and often. The story of Boeing sabotaging
rigorous safety scrutiny is chilling to all of us and more
reason to keep the 737 MAX grounded until certification is
really and truly independent and the system is reformed.
What are your views on the amount of delegation authority
from the FAA to Boeing? Shouldn't we reverse the delegation
that exist right now?
Mr. Sumwalt. Senator Blumenthal, thank you for that
question. The NTSB's role in all of this is to serve as an
accredited representative to each of the respective accident
investigations. As such, we looked at the design certification
processes of the 737 MAX and we issued the seven
recommendations. We have not looked at the ODA process. That is
not something that we have done.
Senator Blumenthal. Why?
Mr. Sumwalt. Well because there are approximately 79
organizations that have ODA approval. We have got about two
people that have the expertise to dwell into the design
certification issues. We have devoted those energies to come up
with these seven recommendations that we issued 1 month ago.
That is an enormous task. I am under the impression that the
U.S. DOT IG is doing a study of this issue.
The Chairman. As are numerous other entities. Thank you.
Senator Duckworth.
Senator Duckworth. Thank you, Mr. Chairman. Chairman
Sumwalt, welcome. At the March 2019 hearing held by this
committee's Aviation subcommittee, Chairman Wicker asked you a
simple question concerning Lion Air flight 610, and I
quote``what should the pilots have done,'' and you responded as
follows, and I quote ``well, I flew the 737 for 10 years and I
do believe that there is a procedure at least for the
Flintstone version of the 737. I flew a very old 737, but I do
believe that the very first thing you would do is oppose that
motion by pulling the yoke back and that would engage the stab
break or the stabilizer cutout function.'' And to me this
answer makes sense. The most reliable initial human response to
an uncommanded nose down dive is to pull back on the yoke.
Would you concur with this view?
Mr. Sumwalt. Yes, I do. I have actually looked at the
procedure and it says to grasp and to hold it firmly but as you
know as an experienced pilot, your natural reaction would in
fact if it is going in a direction you do not intend it to, you
would tend to oppose it, which you should. In the older models
of the Boeing aircraft that I flew, the 727 and 737, that would
engage the stabilizer brake and stop the stab from running. But
as you pointed out in the earlier round, it will not do that
when MCAS is active on the 737 MAX.
Senator Duckworth. Right. So that is what I would like to
add to your response is the critical importance of the column
cutout function, whether aft or forward, is that it is not just
limited to the very old 737, but, in fact, according to a
former Boeing engineer who was responsible for the control law
development, in the 757, 767, and the 747-400. In every Boeing
airplane until the 737 MAX, uncommanded stabilizer runaway is
stopped by column motion only. You don't have to do another
step. Once you pull back and you have overridden it, that's it.
There is nothing that resets and then pushes the nose back
down 5 seconds later. There is nothing else you have to do.
That is it in every other model of Boeing aircraft of 737s. But
for the MAX with the MCAS malfunction, the pilot has to also
apply the manual electric trim within the same 3 second window,
otherwise the MCAS, which the pilots did not know was installed
in the aircraft, could reset and put the nose back down. So now
you are telling pilots, OK, natural reaction, you have pulled
back, you have overridden it, you think that is it.
But now you have to troubleshoot for a system that you do
not know exist that is now overriding your pilot's command
input and pulling back the yoke. Mr. Sumwalt, are you aware of
Boeing notifying commercial 737 pilots before the Lion Air
crash that when MCAS activates during manual flight it disables
the aft column cutout safety function? That is, it overrides
that safety function?
Mr. Sumwalt. Senator Duckworth, I am under the impression
that just as you said that prior to these two tragic crashes
that information was not widely known within the piloting
community.
Senator Duckworth. Thank you. Mr. Sumwalt, the MCAS
malfunction should have been elevated to a hazardous rating, in
my opinion, because the aft column cutout was removed and
worsened by tripling the stab trim rate, which made severe
mistrim likely, especially with a persistent malfunction. Had
Boeing done this, instead of rating it as a ``Major'' hazard,
we would not be where we are today. Would you agree with that?
It changes how they report to the FAA. Am I correct?
Mr. Sumwalt. Yes, and that hazard category of major, as I
understand it, only required there to be one angle of attack
sensor. If it was at a higher hazard category, it would have
required the input from two.
Senator Duckworth. Thank you. Mr. Chairman, I would like to
enter Peter Lemme's ``Flawed Assumptions Pave a Path to
Disaster'' into the hearing record.
The Chairman. Without objection.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Senator Duckworth. Thank you. Mr. Sumwalt, can you talk
about the accident chain, the concept of these decisions that
pile up and leads up to those Lion Air pilots, for example,
fighting to save that aircraft and how these decisions add up?
Mr. Sumwalt. Yes. As you know Senator Duckworth, the NTSB
was an accredited representative to the Lion Air investigation
as well as the Ethiopian accident investigation. We
participated closely with both of them. But since the Lion Air
is wrapped up, we have worked closely with the Indonesian
authorities. We commented on their report. We feel that their
report, the Indonesian report, the KNKT report is comprehensive
and we are satisfied with that report. So, I think that report
outlines the chain of events was not just one factor, there
were several issues that led to that crash.
Senator Duckworth. Thank you. I yield back.
The Chairman. Thank you, Senator, Duckworth.
Senator Cruz.
Senator Cruz. Thank you, Mr. Chairman. Chairman Sumwalt,
the NTSB report that you mentioned in your testimony stated
that the NTSB is, ``concerned that the accident pilot responses
to the unintended MCAS operation were not consistent with the
underlying assumptions about pilot recognition and response
that Boeing used based on FAA guidance for flight control
system functional hazard assessments, including for MCAS as
part of the 737 MAX design.'' Why do you think it was that
Boeing made the wrong assumptions?
Mr. Sumwalt. Senator Cruz, thank you for that question. And
what we do know is that to simulate the MCAS or to assess the
level of hazard, the less level of risk associated with that,
they put Boeing pilots, test pilots, in the engineering
simulator. And while they were flying, all of a sudden, the
trim started moving. They wanted to see how a pilot would have
reacted.
And if they reacted the way that Boeing expected them to
do, then they said OK, well the pilot will immediately
recognize this problem. They will notice because the nose is
starting to pitch down, they will notice because it has
increased pressure on the control wheel, and one other thing--
and the stab trim wheel was moving. That is all correct. But
what Boeing failed to account for in their assumptions was to
consider that the MCAS could have failed because of another
reason.
The MCAS could have activated because of a failure of the
angle of attack which would have led to numerous other alerts
and warnings in the cockpit. So, with a failed angle of attack
sensor, they would have had a low air speed indication on their
primary flight display. They would have gotten a stick shaker
or stall warning which is rattling the stick and making a lot
of noise. They would have gotten an oral warning that says
``air speed low, air speed low.'' They would have had various
lights in the cockpit.
So, the long and the short of it is that Boeing only
evaluated pilots performance with the stab trim itself moving.
They did not simulate or replicate how multiple failures could
affect a pilot's performance.
Senator Cruz. And why did the FAA processes not catch these
failed assumptions?
Mr. Sumwalt. Well, that is a great question, Senator. And I
am not sure that I know the answer to that. But that is why we
have issued these seven recommendations, is so that these
design assumptions can be more realistic. We found in three
incidences in the two accident flights plus the Lion Air flight
prior to the accident flight, we have seen three cases where
the pilots did not perform in accordance with the assumptions
that Boeing used.
Senator Cruz. And is a bird strike a scenario that
engineers designing a plane should anticipate and the
regulators focusing on a plane should anticipate?
Mr. Sumwalt. I believe so and I believe they do in certain
areas. I am not sure how it might apply to this. As you know,
there is conjecture that perhaps a bird might have taken out
the AOA sensor on the Ethiopian aircraft. I do not know if that
is a part of the total risk assessment for the 737 MAX as it
relates to MCAS.
Senator Cruz. Is there any indication either Boeing or the
FAA considered the possibility that a bird strike would share
off the angle of attack sensor?
Mr. Sumwalt. I do not know but I can certainly look into
that and get back with you if you like.
Senator Cruz. I would appreciate that very much. Mr. Hart,
one of the key findings of the Joint Technical Review Committee
report is that the FAA's visibility into important system
safety information was, ``incomplete and fragmented.'' JATR
then went on to say, if the FAA had been more involved in the
certification of the MCAS, this, ``would likely have resulted
in design changes that would have improved safety.'' Based on
the JATR's findings, why would the FAA accept incomplete and
fragmented safety information from Boeing and what can be done
to fix that?
Mr. Hart. Thank you for the question. That is the purpose
of the recommendation that the communication process that the
ODA be less bureaucratic and less complicated, so the
communication process isn't undermined by the complexity of
that situation. So the FAA was not adequately aware of the
evolution of the MCAS from a relatively weak system to a much
more robust system.
The FAA wasn't aware of the details of how adequately the
transformation of the MCAS from a high-speed wind up turn
correction to a low speed angle of attack correction and were
the assumptions properly considered in that process. The
communications to the FAA were not adequate for it to be fully
aware of the impact of those issues.
Senator Cruz. Thank you.
The Chairman. Thank you, Senator Cruz.
Senator Blumenthal.
Senator Blumenthal. I have just one question and you may
consider it outside of your expertise, but the CEO of Boeing
told us today that they made mistakes and regretted them and
wanted to take action in response to do the right thing for the
families who were affected, the loved ones of the victims.
Boeing has said that it will take responsibility
specifically for the Lion Air crash resulting in the deaths of
189 people in Indonesia last year and the Ethiopian Airlines
crash that killed 157 people. But it has filed court documents
for the Lion's aircraft indicating that it will move to change
the venue of the case to Indonesia where the plane was
maintained if settlement talks fail. The case was filed in the
Northern district of Illinois where Boeing is headquartered, as
you know.
Resolving these claims in Indonesia seems a lot less likely
to provide justice to those families. There is no Seventh
Amendment right to a jury trial there. There is no requirement
of discovery. There is no rule allowing for depositions. Would
you agree with me that equity, fairness, justice would argue in
favor of keeping these cases in the United States?
Mr. Sumwalt. My friend, Chris Hart, is a Harvard-educated
lawyer.
Senator Blumenthal. He is a Harvard Law School graduate and
practicing lawyer in addition to being a pilot so if you want
to defer to him, that is fine.
Mr. Sumwalt. Absolutely.
Mr. Hart. Thank you for the question. I am a Harvard-
trained attorney but I do not know anything about the
litigation strategy to be able to comment on what they want to
do regarding litigation. That is way outside of my lane. JATR
did not consider it and I am not really--I do not consider
myself competent enough to speak to that issue.
Senator Blumenthal. Well in general, wouldn't you consider
this court to the United States to be a better place to do
justice for American families than the courts of Indonesia?
Mr. Hart. I thank you for the question, but I am not enough
of a litigator to be able to give you a competent answer.
Senator Blumenthal. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Blumenthal. We are going
to close this hearing now.
Senator Cantwell. Can I just ask one more thing?
The Chairman. Sure. Senator Cantwell.
Senator Cantwell. Thank you, Mr. Chairman for a second
round. I just wanted to clarify, Mr. Hart, I think I heard
earlier from the testimony from the company that they actually
do think that the FAA knew about the level of trim. I think
this is going to be a big issue. I think we are going to hear a
lot more about this, but you would hope that a plan at the very
beginning of certification would include that data then they
would make the decisions, but I am concerned that the level of
automation and technology and human response.
I want to see the best engineers. I think when the
automobile industry and Toyota went through this and we didn't
know what happened, we basically called NASA and said would you
look at this code and figure out what happened? OK. I do not
want to call NASA to look at software code. I want the FAA to
be the best technology engineers in understanding problems with
software, problems with automation, and challenges with human
response. That is why part of our legislation is that center of
excellence for the FAA.
Just by the way, I have done two other center of
excellences, one on composite manufacturing because the FAA
didn't know enough about composite to know how to certify the
plane, and one on biofuels for jets because they also do not
know how to certify fuel sources for planes if they do not
understand jet fuel themselves. So I am a believer that we give
the FAA the extra resources and tools so they can stay ahead or
at least, you know, know the right parameters of debate.
But isn't the right parameter of debate have to focus on
this human technology interface today? Isn't that where we are?
Because we saw those 10 years of making us safer, and yet this
level of integration has also told us that 5 of the last
accidents were all around this. And I think, you know, for me
and many Americans are waking up wondering what is a pitot tube
and, you know, an AOA sensor on the outside of the plane giving
commands and responses to inside the cockpit without the pilots
understanding.
So I just feel that the FAA, and we have had this
discussion with Captain Sullenberger, needs to understand human
response to these automation systems. What do you say about
that recommendation of a center of excellence, Mr. Hart or Mr.
Sumwalt?
Mr. Hart. Thank you for the question. It also gives you an
opportunity to respond to Senator Blumenthal raising the same
issue. And that is, I think that as first of all the type of
problem we are going to see with airplane safety in the future
in my view is not going to be things falling off the airplane
like the DC-10 engines. It is going to be the pilot/airplane
interaction issue.
So the human factors piece is crucial and that is why I am
totally on board with the human factors recommendations that
the NTSB made. There are two problems. One is the reference to
multiple things going wrong at the same time. I would add to
that, it is not just multiple things going wrong, it is also
never having seen it before even in training. That is really
the challenge. It is when they are seeing this for the first
time in real time, as in a series of accidents where this has
happened, and it has been unsuccessful.
The one exception to that was Sully when he had a kind of
situation that he had never seen before, even in training, and
he handled it masterfully.
Senator Cantwell. And that--listen I think I have consulted
him a lot about this but that is why he came to us after the
Colgan Air and said do not change the regulations on the
copilot for regional aircraft because you do not have enough
time. You do not have enough time to talk. So I think if you
are going to develop a system for certification and give it to
the FAA, I think the FAA has to know the parameters of human
response and what pilots are capable of, we just need a lot
more data.
If this is the route we are going to keep going on
innovation, then we just need to know a lot more about what is
that factor. I think even, I do not want to speak for him, but
I think his perception is that that is where you have to start
because you do not have any way to judge a system if you do not
really understand what the human limitation is.
Mr. Hart. And that goes to my point that the leading
technologists in these rapidly advancing and innovative
technologies, the leading technologists are not going to be
with the regulator. That is why this is not an FAA problem,
this is an international certification problem, because the
regulators are not able to hire and retain the leading
technologists in these rapidly advancing technologies. They are
going to be with the companies.
Senator Cantwell. But I want the FAA to have enough data,
information, and understanding to ask the right questions.
Because if they are not asking the right questions because they
do not understand the technological impact, we are going to
have a problem. OK, so we have to make sure they understand the
R&D and at least the parameters, whether that is composites,
biofuels, or cockpit automation.
Mr. Hart. That is precisely why adequate information is so
crucial. Straight to your point.
Senator Cantwell. Yes.
Mr. Hart. Thank you for making that point.
Senator Cantwell. Thank you, Mr. Chairman.
The Chairman. Senator Blumenthal.
Senator Blumenthal. Just one quick question. If the FAA
were able to pay enough to offer career opportunities would
that affect your judgment that they cannot hire the leading
technologist as you put it?
Mr. Hart. I cannot speak to the totality of the
circumstances why the regulators do not have those people but
that is probably part of it, yes.
Senator Blumenthal. Well, I am just really discouraged and
frankly somewhat skeptical about your view that the FAA should
be sort of doomed to failure and has to outsource safety.
Mr. Hart. I do not mean to suggest they are doomed to
failure. I am suggesting that is why I think the collaborative
process of the delegation will continue because there is no way
that in my view, in the way that things are currently situated,
the FAA is going to have the expertise within house to do it
without the collaboration.
Senator Blumenthal. Well, putting aside the word
collaboration, I hope we can prove you wrong by in fact
incentivizing both financially and otherwise people with those
skills to go to work for the FAA because that is where the
disinterested and independent safety function belongs. If you
outsource safety, that is doomed to failure.
Mr. Hart. I certainly agree with you. That would be ideal.
Yes, Senator Blumenthal.
Senator Blumenthal. Thank you.
The Chairman. Well, thank you very much. And thanks to the
members of the Committee who have participated throughout. I
have to say, this has been one of the most difficult hearings I
have ever participated in, and I know it has been difficult for
the family members who are still with us in the room. Some of
them had to leave. Let me reiterate what I said at the outset,
that this Committee, under my leadership and Senator Cantwell's
leadership, is working to obtain as full of an answer as
possible. We owe it to the public and we owe it to the families
and to the victims. You have my assurance that we are not
finished with the work.
That said, the hearing record will remain open for two
weeks. During this time, Senators are asked to submit any
questions for the record. Upon receipt, all witnesses are
requested to submit their written answers to the Committee as
soon as possible. I thank the witnesses for appearing today,
and the hearing is now adjourned.
[Whereupon, at 1:16 p.m., the hearing was adjourned.]
A P P E N D I X
Response to Written Questions Submitted by Hon. Roger Wicker to
Dennis Muilenburg
Question 1. Mr. Muilenburg, the Maneuvering Characteristics
Augmentation System (MCAS) has been described as an anti-stall system
that Boeing installed on the Boeing 737 MAX to address pitch stability
concerns caused by the use of larger engines on the aircraft than
earlier versions of the 737. However, it has also been said that MCAS
was added to the 737 MAX so that it handled similarly to the 737 NG
from a pilot's perspective.
What was the original purpose of MCAS? What would have been the
risks associated with the 737 MAX had MCAS not been added as a flight
control law?
Answer. In 2009, Boeing began to explore a possible re-engining of
the 737 NG series airplane to improve noise pollution and fuel
efficiency. In approximately 2010, early in the development process,
testing and analysis showed that the contemplated design changes
affected the airplane's handling characteristics in certain high-speed,
high angle of attack conditions involving a rarely encountered maneuver
known as a wind-up turn. Although most commercial pilots go their
entire career without making such a turn in commercial flight,
certification requirements exist for handling characteristics in these
scenarios.
If MCAS had not been added as a flight control law to the 737 MAX,
a different solution would have been necessary to achieve the required
handling characteristics. Boeing personnel, including engineers and
pilots from multiple disciplines, considered a number of alternatives
for improving the airplane's handling qualities in these unusual
scenarios, including physical changes to the airplane. Ultimately,
Boeing determined that the addition of MCAS, coupled with the
implementation of a modified outboard wing vortex generator pattern,
represented an appropriate solution for addressing the handling
qualities issue. This approach in designing MCAS allowed for a
straightforward expansion of the pre-existing Speed Trim function, as
an integrated part of an existing flight control system. The
incorporation of MCAS allowed Boeing to safely satisfy certification
requirements for handling characteristics while staying within the
framework of the existing airplane architecture, consistent with a
fundamental airplane design principle of minimizing unnecessary
complexity. Boeing implemented the initial MCAS requirements in early
2012, although evaluation of the function continued afterwards, and the
technical team recognized that further refinement of the design would
likely be necessary going forward. The incorporation of MCAS was
validated through rigorous testing and analysis, including piloted
simulator sessions, wind tunnel tests, and a variety of engineering
analytical techniques.
Question 2. During the hearing you were asked about two sets of
documents involving former Boeing employee Mark Forkner: (1) a November
16, 2016 instant message between Mr. Forkner and a Boeing colleague,
and (2) e-mails between Mr. Forkner and someone at the FAA in which Mr.
Forkner used the phrase ``jedi mind tricking.'' Please clarify when Mr.
Muilenburg learned of each.
Answer. As to the instant message exchange involving former Boeing
employee Mark Forkner: while Mr. Muilenburg does not recall seeing the
document itself until it became public a few weeks before the hearing,
he was made aware of the document in a briefing earlier this year,
including the fact that the message contained a reference by Mr.
Forkner to having unknowingly lied to regulators. Since the document
became public, Mr. Muilenburg has had the opportunity to review the
entire exchange and become familiar with all of its details. With
respect to the other e-mails from Mr. Forkner that were referenced by
Chairman Wicker in his question, Mr. Muilenburg was not aware of those
e-mails until he read about them in the media in the weeks prior to the
hearing.
Question 3. Please describe the steps Boeing took after it learned
that the AOA DISAGREE alert on the MAX was not operable on all
airplanes.
Answer. In August 2017, several months after the software delivery
and the commencement of MAX deliveries, Boeing engineers identified
that the display system software delivered to Boeing by a supplier
incorrectly linked the AOA DISAGREE alert to an optional AOA indicator,
after internal testing revealed that the alert was not working as
expected.
Immediately upon identifying the discrepancy between the
requirements and the software, Boeing initiated its standard process
for determining the appropriate resolution of such discrepancies.
Boeing quickly initiated a ``problem report''--the name for the
standard process--and assigned it to the supplier to verify Boeing's
assessment. The supplier conducted testing and confirmed the issue
Boeing had identified.
Under Boeing's procedures, any inconsistency between the airplane
requirements and the product delivered by a supplier must be
immediately resolved if it renders the airplane unsafe. Deferring the
solution to a later date is appropriate only if Boeing's experts can
determine that the airplane remains safe, it remains certifiable, and
there is no adverse operational impact. Here, to decide the appropriate
disposition of the AOA DISAGREE alert issue, Boeing conducted a
rigorous review that involved multiple company subject matter experts,
including systems engineers, pilots, and crew operations specialists.
This review determined that the absence of the AOA DISAGREE alert did
not adversely impact airplane safety, certification, or operations, and
therefore correction of the issue appropriately could be deferred until
the next routine software update. The responsible authorized
representative, who exercises authority delegated by the FAA, concurred
with this recommendation for deferral.
Boeing's review identified three main factors supporting the
conclusion that deferral was permissible. First, no airplane or system
safety assessment takes credit for the activation of the AOA DISAGREE
alert as part of the analysis-accordingly, the absence of the alert did
not alter the analysis in these assessments demonstrating that the
airplane is safe. Second, based on consultations with pilots, the team
determined that the same conditions that would activate the AOA
DISAGREE alert would also likely cause unreliable airspeed information,
and thereby trigger the indicated airspeed (IAS) DISAGREE alert. Thus,
even without the AOA DISAGREE alert, the IAS DISAGREE alert would
remain available to prompt pilot action in response to the expected
effects of erroneous AOA data. Third, the team noted that other
maintenance indicators on the airplane would detect a damaged AOA vane
that remains faulty for two consecutive flights. Thus, a damaged vane
would likely persist for only a limited amount of time before prompting
maintenance action, even in the absence of the AOA DISAGREE alert.
Based on these considerations, the review concluded that the
existing functionality was acceptable until the next planned display
system software update, when the alert and the indicator could be
delinked, and the AOA DISAGREE alert made standard per the
requirements. That update was scheduled for 2020, when the Dash-10
variant of the MAX was expected to enter into service. Boeing recorded
this disposition in its certification summary documentation for the MAX
dated September 2017.
Boeing personnel discussed notifying 737 MAX operators about the
deferral decision. Boeing pilots and other technical experts considered
issuing an Operations Manual Bulletin (``OMB'') on the issue. After
internal discussion, it was determined that an OMB was not the
appropriate vehicle for notification because the linkage of the AOA
DISAGREE alert to the AOA indicator did not present a safety of flight
issue, and because there was no specific crew guidance to be provided
for dealing with the absence of the alert. Boeing personnel prepared a
Fleet Team Digest on the issue, but ultimately it was not issued.
When the MAX returns to service, all MAX airplanes will have an
activated and operable AOA DISAGREE alert as a stand-alone, standard
feature.
Question 4. How many certification plans for the MAX did the FAA
delegate to Boeing and how many did the FAA retain?
Answer. The FAA initially accepted the Master Certification Plan
for the 737-8 in November 2013, and it accepted the Detailed
Certification Plans in August 2015. When the Master Certification Plan
was initially accepted by the FAA, approximately 28 percent of the
detailed Certification Plans were delegated. As the FAA reviewed the
certification deliverables, those deliverables evolved. The number of
delegated tasks increased as a result. However, even for certifications
that are delegated, all testing and reviews that Boeing conducts to
demonstrate compliance with applicable standards and requirements are
subject to FAA oversight.
Question 5. Please describe the changes Boeing has made since the
Lion Air accident to the MAX Flight Control Computer software beyond
updates to MCAS, and the considerations that led to those changes?
Answer. In late March, as part of a comprehensive supplemental
review of the updated MCAS software, Boeing discovered that a monitor
to address erroneous processor commands was not as robust as originally
assumed. Although this fault had never occurred in 125 million flight
hours, Boeing decided to implement an improved monitor to avoid even
the theoretical risk of a stabilizer runaway near the ground, where the
flight crew would have less time to respond than at a higher altitude.
During a simulator certification demonstration on June 26, an FAA
pilot raised an additional concern regarding the possibility that this
failure condition could occur at cruising altitude. The pilot
determined that, while the flight crew could reverse the stabilizer
runaway effect through use of the electric trim switches, this response
might--if the crew delayed in recognizing the condition--require a
level of piloting skills that could not be assumed. Based on this
finding, the FAA asked Boeing to develop additional redundancies in the
flight control computer software to prevent this type of failure.
Boeing has since been working on new software functionality to address
the possibility of such uncommanded stabilizer motion in all phases of
flight
______
Response to Written Questions Submitted by Hon. John Thune to
Dennis Muilenburg
Question 1. Both the National Transportation Safety Board (NTSB)
and Joint Authorities Technical Review Board (JATR) reports mentioned a
need for greater consideration of crew workload when designing flight
control systems.
For example, the JATR report cited a lack of communication between
divisions within Boeing as one reason a more holistic evaluation of
crew workload may not have been considered in the development of the
Maneuvering Characteristics Augmentation System (MCAS).
Could you speak to how some of the organizational changes at Boeing
you mentioned in your testimony will help address issues with
communication?
Answer. The review undertaken by a committee of the Boeing Board of
Directors following the ET302 accident made a series of
recommendations, all accepted by the Board, that will enhance safety
throughout the design and manufacturing process.
First, all engineering employees now report to the Company's chief
engineer. By keeping engineering functions within the engineering
department, rather than having engineers report up to program leaders,
our engineers will have the enhanced ability to holistically assess key
factors as we develop and design flight control and other systems on
future airplanes. This organization change will also help ensure that
lessons learned in one program will be shared with, and considered with
respect to, other programs.
Second, Boeing created a Product and Services Safety organization.
Building off of Boeing's already robust avenues for reporting
engineering and safety concerns, this organization will further
encourage reporting and investigation of any potential safety issues,
by anyone within the company.
Third, Boeing created a Design Requirements Program. This program
will strengthen information sharing and education among our engineering
corps regarding design issues, and also further enhance Boeing's
ability to incorporate lessons learned and detailed after action
reports. This will help strengthen our existing process to ensure that
issues identified and resolved in one program become training tools
that improve safety across all Boeing's programs.
These changes will enhance and reinforce Boeing's safety culture,
and help to ensure that all safety matters, including lessons learned
from these accidents, are appropriately addressed.
Question 2. The NTSB report mentioned that while a safety
assessment was performed on MCAS, it may not have considered an MCAS
activation in concert with other potential alerts and indications.
Do you believe that the establishment of the Product and Services
Safety organization within Boeing will provide more comprehensive
safety assessments that adequately assess crew workload?
Answer. While Boeing already employs a rigorous process to perform
the safety assessments required to demonstrate compliance to the
Federal Aviation Regulations, we expect that the Product and Services
Safety organization will heighten Boeing's focus on all safety matters,
including the safety assessment process. The other changes outlined in
response to the previous question will also further enhance Boeing's
safety processes.
______
Response to Written Question Submitted by Hon. Jerry Moran to
Dennis Muilenburg
Question. Mr. Muilenburg, regarding the Federal Aviation
Administration's (FAA) role in the certification process, what specific
recommendations of change at the FAA would you suggest?
Answer. Boeing strongly supports robust FAA oversight of the
certification process. As the last major commercial airplane
manufacturer in the United States, Boeing believes the certification
process, and the FAA's role in that process, are vital to the safety of
the traveling public, and have been an important factor driving
substantial improvements in aviation safety in recent decades. Boeing
supports increasing the FAA's global engagement and leadership in order
to strengthen safety standards, safety culture, and safety-related best
practices throughout the world.
The certification process requires significant technical expertise
and considerable resources. Boeing believes that any changes made
should continue to ensure the FAA's resources are focused on areas such
as new technologies, systems integration, and development. Moreover,
the FAA must be able to attract and retain strong technical capability,
commensurate with industry. To achieve those goals, Boeing supports the
following changes:
Increasing integration across organizations within FAA
Aviation Safety, especially between Aircraft Certification and
Flight Standards. This would facilitate earlier engagement by
the operational evaluation teams in the airplane design and
certification process, and strengthen the understanding of how
certification and operational decisions impact each other.
The FAA's System Oversight capability could be strengthened
by setting clear expectations for applicants' processes and
procedures to ensure compliance for lower risk areas, as
identified by the FAA. This would allow FAA to dedicate the
majority of its resources on areas the FAA has determined to be
the highest safety risk.
The rulemaking process should be strengthened so that the
FAA has the capability to incorporate new rules and update
existing rules to more quickly accommodate new technology and
lessons learned from the existing fleet. For example, FAA
should quickly incorporate International Civil Aviation
Organization Safety Management System standards for
manufacturers into domestic FAA regulations.
______
Response to Written Questions Submitted by Hon. Maria Cantwell to
Dennis Muilenburg
Boeing is developing a software fix to correct the deadly flaws in
the Maneuvering Characteristics Augmentation System (``MCAS''). The
Federal Aviation Administration (``FAA'') and international regulators
are reviewing Boeing's work.
I believe thorough transparency about the specific testing and
evaluation is essential to ensure public confidence in the safety of
the 737 MAX aircraft.
Question 1. Will you commit to full public transparency about the
technical details and the specific tests and evaluations conducted in
order to correct MCAS and return the 737 MAX to service?
Answer. Boeing is committed to keeping the public informed about
the status of the enhancements being made to the MCAS system. Boeing
has created a public website with information regarding the MAX to
facilitate dissemination of information regarding the MAX. That website
is located at http://www.boeing.com/737-max-updates/. Boeing will
continue to provide information regarding the MAX as we work to rebuild
the public's confidence in what we do, as well as work with our
regulators to ensure that the public, our customers, and other
stakeholders can understand the rigor and scope of the return to
service process.
Boeing has already disclosed the changes it is making to the MCAS
system. When the MAX returns to service, MCAS will compare inputs from
both Angle-of-Attack sensors on the MAX, it will only activate one time
per high angle-of-attack event, and MCAS will never command more
stabilizer input than can be counteracted by the flight crew pulling
back on the control column.
Boeing extensively tested these updates. As of November 26, Boeing
has dedicated over 190,000 engineering and test hours relating to
updates to the MAX, flown more than 1100 test and production flights,
and conducted simulator sessions with 41 international regulators as
well as 99 of our airline customers. Testing has included evaluation of
the system in normal operation, operation when subject to failures (in
both the normal and operational flight envelopes), and the potential
effect of pilot crew error and workload. When the MAX returns to
service, we are confident it will be one of the safest aircraft ever to
fly.
Moreover, the FAA established a Technical Advisory Board (TAB) to
review Boeing's updates to MCAS. As Matthew Kiefer, a member of the
TAB, testified before the Committee on Transportation and
Infrastructure of the House of Representatives, this panel consists of
independent experts, with no past involvement in the development or
certification of the 737 MAX. In his written testimony, Mr. Kiefer
stated that, pending final testing and the results of their review, the
TAB ``feels the changes made to the flight control software in the B737
MAX should vastly improve the safety of the aircraft, in keeping with
the highly successful safety record of the previous models of the
Boeing 737.''
Question 2. Will you publicly release the specific results of the
testing and evaluation of the MCAS ``fix?''
Answer. Please see the response to Question 1.
Question 3. The current Organization Designation Authorization
(``ODA'') process hinders the ability of designated Boeing
certification engineers, or ``unit members,'' from communicating
directly with their FAA counterparts. Instead, issues are resolved
internally within Boeing, which can lead the certification process to
potentially be influenced by cost and delivery schedule pressures. Some
Boeing engineers are concerned that important dialogue with FAA about
problems is being hindered or does not happen as a result of this
process.
Further, Boeing recently developed a new program called
``Verification Optimization.'' Under that program, up to 1,000 quality
inspector positions will be cut over the next two years. Boeing quality
inspectors have ensured mechanic work was performed per engineering
requirements. Now, in many critical areas, mechanics will be the only
set of eyes to verify they performed their work to Boeing
specifications and procedures.
Are you aware Boeing employees have raised concerns about being
required to complete an internal review process before being allowed to
speak with their FAA counterparts about potential problems?
Answer. The procedures for communications between the ODA unit and
the FAA, and the process for coordinating such communications, are
defined in Boeing's ODA procedures manual, which is approved by the
FAA. The procedures manual governs the conduct of Boeing's ODA unit
members. Boeing's ODA procedures manual, as well as Boeing policy,
contains procedures to comply with regulatory requirements by ensuring
certain communications between Boeing and ODA unit members are
coordinated, documented, and retained.
Neither these regulatory requirements nor Boeing's ODA procedures
manual prevent members of Boeing's ODA from communicating with their
FAA counterparts. Boeing employees have multiple avenues they can use
to raise concerns or potential problems, including within the ODA,
within the company, and directly to the FAA.
As discussed in more detail in response to Question 4, Boeing's
``Verification Optimization'' program is unrelated to the ODA unit.
Question 4. Does Boeing still plan to move forward with its plan to
cut visual inspections by Boeing quality inspectors?
Answer. Boeing's ``Verification Optimization'' program is part of
Boeing's effort to ensure first-time quality and increase the overall
quality of its products. Under this program, in coordination with the
FAA, Boeing has introduced a robust verification plan that allows
quality inspectors to focus on certain areas: (1) critical items or
areas of that pose higher risks; (2) new or unique build processes; and
(3) areas where inspection data demonstrates existing processes result
in a high rate of defects. For areas outside these categories, quality
is still verified by experts in the work being performed. This program
includes continuously evaluating regulatory and design requirements for
specific inspections, ensuring those inspections are conducted, as well
as monitoring results to re-evaluate where additional inspections could
be needed. Through this program, Boeing is able to effectively use its
quality inspector workforce to focus on the areas of production most in
need of additional inspection. Moreover, as part of this program,
Boeing has introduced a reporting process and review panel in its
factories to identify and report any issues or concerns.
Question 5. Does removal of quality inspectors increase the
likelihood of human factor errors?
Answer. The verification optimization program does not eliminate
checking our work. Instead, it focuses resources on more critical,
difficult, or high risk areas where the likelihood or consequence of a
human error is higher.
Question 6. Reports indicate that Boeing's original design of MCAS
called for the system to move the horizontal stabilizer only 0.6
degrees. However, the final design authorized MCAS to move the
horizontal stabilizer more than four times as far, by 2.5 degrees for
each activation.
Was FAA made aware of the change of design providing for MCAS
movements of 2.5 degrees for each activation? If so, when and under
what circumstances? Please specify who at FAA was made aware of the
change of design.
Answer. The FAA was made aware of the change in the design. Boeing
was transparent with the FAA about MCAS's design, including changes in
that design over time. The development and certification process for
the MAX took over five years. During that time, Boeing worked with
numerous FAA employees across multiple departments regarding all
aspects of MAX certification, including MCAS. This includes FAA
employees at the Boeing Aviation Safety Oversight Office (BASOO) within
the FAA's Aircraft Certification Service, as well as FAA test pilots
and other FAA personnel who participated in flight tests and evaluated
the activation of and data related to MCAS.
On numerous occasions, Boeing shared with the FAA and international
regulators that MCAS's final design had changed from its earlier
parameters, and that its operating range had expanded to include low-
speed conditions. The meetings and information exchanges regarding
these topics began in mid-2016 and continued over subsequent months.
The information provided to the FAA in these interactions included
MCAS's maximum stabilizer authority of 2.5 degrees, as well as other
aspects of the function's performance.
In addition to these briefings, FAA personnel also observed the
operation of expanded MCAS during certification flight testing. The
conditions tested included MCAS's performance during low speed stall,
and during these tests MCAS was activated nearly to the limit of its
maximum stabilizer authority of 2.5 degrees. FAA personnel--including
engineers, pilots, and at times both--were on board many of these
flight tests to observe the performance of the flight conditions,
including those involving MCAS. In some cases, FAA test pilots were at
the controls and flew the relevant conditions. Boeing also provided the
FAA with data related to MCAS activation in low speed conditions.
Dan Elwell, then-Acting Administrator of the FAA, has testified
before Congress that the certification process ``included 297 test
flights, some of which encompassed tests of MCAS functions. FAA
engineers and flight test pilots were involved in the MCAS operational
evaluation flight test.''
Question 7. If FAA was not made aware of the change of design,
explain why Boeing failed to bring the change to FAA's attention.
Answer. As noted in the response to Question 6, the FAA was made
aware of the change of design.
Question 8. Was MCAS installed on the 737 MAX for the purpose of
ensuring the stability of the aircraft? Or was the system installed for
the purpose of more closely approximating the handling characteristics
of previous models of the 737 aircraft?
Answer. MCAS was initially implemented to improve aircraft handling
characteristics in certain rarely encountered high-speed, high-angle-
of-attack flight conditions. As development of the 737 MAX continued,
flight testing showed that other changes to the airplane's design
affected the 737 MAX 8's handling characteristics in certain low speed
scenarios involving high angles of attack. Boeing analyzed both control
law and physical changes as possibilities to address this issue and
ultimately determined that a combination of the two approaches,
including an expansion of MCAS's operating range to lower speeds, was
the most promising solution for achieving appropriate and certifiable
handling characteristics.
Question 9. Can the 737 MAX aircraft be operated safely without
MCAS within the normal flight envelope? Can it be operated safely
without MCAS within the operational flight envelope?
Answer. As described more fully in the answer to the previous
questions, MCAS was initially implemented to improve handling
characteristics in certain rarely encountered high angle of attack
situations, and was expanded to achieve appropriate and certifiable
handling characteristics in certain low-speed situations. As part of
the safety process described more fully in the answer to Question 10,
Boeing evaluated the loss of the MCAS function within both the normal
and operational envelope. Loss of the MCAS function was rated minor
within the normal flight envelope, and major within the operational
flight envelope.
Question 10. The Lion Air report finds that MCAS was designed to
rely on a single Angle of Attack (``AoA'') sensor, making it vulnerable
to erroneous input from that sensor. Did Boeing test the consequences
of relying on only one sensor? Explain why or why not.
Answer. The 737 MAX was a derivative of the 737 NG, an airplane
with one of the best safety records of all large commercial aircraft.
MCAS was an extension of the 737 NG Speed Trim System, which is also
based on a single sensor. Boeing uses an established safety analysis
process to implement and validate changes to an airplane design. This
process entails a comprehensive and iterative assessment of the new
design, and identification and resolution of any potential safety
issues.
Central to the safety analysis process is evaluating how a design
performs in the presence of a series of hypothetical failure scenarios.
In identifying and evaluating potential failure conditions, Boeing
follows the industry standard approach of preparing functional hazard
assessments. Boeing experts identify potential failure conditions using
a variety of techniques, including pilot feedback and evaluation, in-
service experience, lessons from prior accidents and incidents, and
engineering performance analysis. They then assess the level of hazard
that these failure conditions present at an airplane level. The design
is then validated through a combination of lab, simulator, and flight
testing, to ensure that the probability of each identified failure
condition is appropriate for the level of hazard assessed. The results
of this testing are in turn evaluated by cross-functional teams of
subject matter experts across the enterprise, and changes are made to
the design as appropriate. The testing is then repeated after the
incorporation of any changes. Multiple levels of review, conducted both
at the working level and by program and functional management, occur
throughout the process, as does regular information sharing and
interaction with the FAA. These reviews and regulator interactions
frequently result in direction to the team to further refine the
design, and to conduct additional testing and analysis, in order to
ensure that the design is safe and meets all certification and
performance requirements and expectations.
Boeing's evaluation of MCAS was consistent with this process.
Boeing experts performed a thorough safety assessment for the initial
MCAS design, with Boeing test pilots and engineers conducting a number
of piloted simulator sessions in 2012 and 2013 to evaluate possible
hazards. In March 2016, concurrently with developing the requirements
for the expanded MCAS design, Boeing subject matter experts--including
both engineers and experienced pilots--conducted an additional targeted
assessment of the potential hazards posed by MCAS's greater stabilizer
authority at low speeds. Among other conditions tested during the MAX
development process, Boeing considered uncommanded MCAS operation
resulting in unintended nose down trim to the maximum stabilizer
authority for both the earlier and expanded MCAS designs.
Question 11. The Lion Air report finds that the absence of guidance
on MCAS or more detailed use of trim in the flight manuals and in pilot
training made it more difficult for flight crews to properly respond to
uncommanded MCAS activations.
Did Boeing consult with pilots employed by domestic or foreign air
carriers about the removal of information about MCAS in flight manuals
and in flight crew training? Explain why or why not.
Answer. In accordance with FAA regulatory guidance, flight training
for all Boeing airplanes, including the 737 MAX, is designed to give
pilots the knowledge, skills, and abilities necessary to safely operate
each model on which they are licensed (or ``type-rated''). Boeing and
the FAA coordinated closely over the course of several years in
developing the necessary training requirements and flight manual
content for the MAX. Many items were considered for inclusion,
including MCAS, and the content of the manuals and training evolved
over time, as is common. Ultimately, relying on the professional
judgment of those involved in this process, Boeing proposed, and the
FAA agreed, not to include a description of MCAS in the final version
of the Flight Crew Operations Manual for the MAX. When the MAX returns
to service, Boeing has recommend that pilots receive simulator training
on the MAX and the flight manuals will have specific references to the
MCAS system.
Question 12. Have any Boeing personnel been terminated, reassigned,
or suffered any internal disciplinary action as a result of actions or
omissions regarding any activities concerning the certification or
approval of the Boeing 737 MAX or any systems therein? If so, please
provide details on the actions taken, including the dates.
Answer. Boeing has recently made several high-level leadership
changes to ensure that it has the right leadership going forward.
Boeing has also made several structural changes to enhance the
company's culture of safety and accountability. These include the
creation of a permanent Aerospace Safety Committee within our Board of
Directors to ensure greater Board oversight and visibility, creation of
a Product and Services Safety organization that will, among other
things, centralize investigations of safety concerns, and realignment
of the engineering function within the company, to ensure technical
accountability to the Chief Engineer. In addition, several external
reviews are ongoing. As those conclude, we will evaluate the results of
those reviews and will not hesitate to hold individuals accountable,
where appropriate.
Question 13. Is Boeing committed to returning the 737 MAX to
service only as part of a unified review process with other
international regulators (such as the European Aviation Safety Agency)?
Answer. Boeing's regulators will determine the process for the
MAX's return to service, and Boeing will support whatever process the
FAA and other international regulators determine is appropriate. Boeing
is working with both the FAA and other global regulators, including
through multi-regulator assessments such as the Joint Operations
Evaluation Board, to safely return the MAX to service worldwide. Boeing
is committed to providing any information needed by those regulatory
authorities to support their reviews.
Question 14. The Lion Air report finds that the AoA DISAGREE alert
was not correctly enabled during 737 MAX development. Did Boeing test
the AoA sensor DISAGREE alert to ensure reliability prior to receiving
type certification? Explain why or why not.
Answer. Boeing tests all software it receives prior to type
certification. Boeing's testing did not immediately detect this
software issue. In August 2017, several months after the software
delivery and the commencement of MAX deliveries, Boeing engineers
identified the issue after internal testing revealed that the alert was
not working as expected.
Question 15. The Lion Air report finds that the crew was unable to
effectively manage the multiple alerts, repetitive MCAS activations,
and distractions related to numerous air traffic control
communications. Did Boeing test the human factors impact of multiple
alerts, repetitive MCAS activations, and other distractions that would
make it difficult for a flight crew to manage a catastrophic failure?
Explain why or why not.
Answer. As described in the answer to Question 10, Boeing uses an
established safety-analysis process, and that process was used for the
737 MAX and MCAS specifically. Boeing experts performed a thorough
safety assessment for the initial MCAS design, with Boeing test pilots
and engineers conducting a number of piloted simulator sessions in 2012
and 2013 to evaluate possible hazards. In March 2016, concurrently with
developing the requirements for the expanded MCAS design, Boeing
subject matter experts--including both engineers and experienced
pilots--conducted an additional targeted assessment of the potential
hazards posed by MCAS's greater stabilizer authority at low speeds. In
performing this assessment, Boeing's experts applied their engineering
judgment and piloting experience to the existing safety analysis and
data for the earlier MCAS design, and also considered new performance
data generated through piloted simulator testing and computer analysis
of MCAS's operation at low speeds.
In the initial analysis, Boeing's subject matter experts had
concluded that MCAS's earlier design met all applicable functional
hazard assessment thresholds. Based on their updated hazard analysis,
Boeing's subject matter experts concluded at the end of March 2016 that
the expanded version of MCAS also met all applicable requirements, and
did not create any heightened risks beyond the earlier design.
Since the accidents, a number of reports have recommended revisions
to the safety-analysis process. Boeing is evaluating those
recommendations, as well as the lessons learned during the process of
returning the MAX to service, to make improvements to its safety
analysis processes. Boeing also supports updating the industry-wide
assumptions reflected in existing regulatory guidance.
Question 16. To replace or to supplement flight data generated by
external sensors, Boeing has developed such virtual technologies as
``synthetic airspeed'' and ``synthetic AoA.'' Currently, these state-
of-the-art technologies are present only on the 787 aircraft, although
they will reportedly be installed on the new 777X aircraft, as well.
Exclusive reliance on external sensors such as AoA sensors raises
concerns because of their exposure to inadvertent or intentional
damage.
Why weren't these state-of-the-art technologies incorporated into
the design of the 737 MAX? Why isn't Boeing setting the standard by
deploying the best available technologies in new aircraft?
Answer. Boeing routinely introduces best-available and industry-
leading technologies on its airplanes. However, not every new
technology is appropriate for every aircraft. Synthetic airspeed is a
technology that allows for the indirect calculation of a plane's
airspeed from various inputs, including external sensor data. Boeing
carefully considered the possible inclusion of synthetic airspeed
during the development of the 737 MAX, and determined not to implement
synthetic airspeed on the 737-8. Boeing subject matter experts
evaluated the potential advantages and disadvantages of implementing
synthetic airspeed. This evaluation process included the relevant
technical experts and decision-makers, and different views were
appropriately considered. Boeing continues to assess the potential
application of synthetic airspeed to its airplanes.
Question 17. Why was MCAS designed with authority to ``issue''
uncommanded flight control inputs while relying on only one AoA
sensor--a single point of failure with no redundancy? Did any Boeing
employees raise concerns about the reliance on one AoA sensor during
MCAS' development?
Answer. Please see the answers to questions 8 and 10 regarding
MCAS's original design. As discussed therein, the MCAS flight control
law was designed as an extension of the 737 NG's Speed Trim System.
That system is a single sensor design that has hundreds of millions of
hours of safe flight.
Regarding potential employee concerns, as is normal during the
airplane development process, Boeing technical personnel raised and
discussed many technical issues related to the design and development
of the MAX, including MCAS. Boeing maintains an Employee Issue Tracking
System, a single, common system for entering and tracking employee
issues and complaints. Boeing has searched EITS and located no records
indicating an employee raised concerns with the design of MCAS prior to
the Lion Air accident in October 2018.
Question 18. Are there other systems installed on Boeing aircraft
which are given such authority based on data from only one sensor?
Answer. Whether an airplane system is allowed to rely on a single
input is determined by FAA regulation. For an aircraft to be certified,
it must meet all regulatory requirements.
Note: The following questions refer to the Aircraft Certification
``Transformation'' Pre-Decisional Involvement Report, Union
Recommendations and Dissenting Opinion that was published on February
6, 2017. The report is attached for your reference.
Question 19. Will Boeing upgrade the single string rudder control
before the MAX is returned to service? Why or why not? (See Dissenting
Opinion, 2017 sec. 12.2.3)
Answer. Boeing's rudder control design has been certified by the
FAA multiple times, most recently on the 737 MAX. As part of the MAX
certification process, Boeing discussed its rudder cable design with
the FAA in multiple meetings over several years. These meetings focused
on how the planned changes from the certified NG design to the MAX
could affect hazards related to engine failure as well as design
precautions taken by Boeing to minimize such hazards in accordance with
FAA regulations. Boeing also shared with the FAA several potential
additional design changes. Because changes to an existing, proven
design can increase risks in other areas, design changes were evaluated
based on their potential utility to mitigate the overall level of risk.
As Administrator Dickson testified before the Transportation and
Infrastructure Committee of the House of Representatives on December
11, 2013, adding complexity to existing systems often introduces new
risks.
Boeing's analysis of these potential design changes indicated that
they would increase the overall level of risk to the airplane, by
introducing significant new risks. In addition, the risk of this type
of hazard for the MAX was determined to be similar to the 737 NG, an
airplane with an excellent safety record. As a result of these
discussions, Boeing made additional changes to the MAX floor beam
structure to further reduce the likelihood for damage to control
surface cables in the event of an uncontained engine rotor failure.
Boeing and the FAA also agreed on the methods and analysis that Boeing
would use to demonstrate regulatory compliance. Boeing worked with the
FAA and responded to all of its concerns to ensure that the 737 MAX
complied with applicable requirements.
Question 20. Will Boeing upgrade the single float switch that is
vulnerable to single failures and that can cause fuel spillage onto the
ramp area and the potential for uncontrolled fire? Why or why not? (See
Dissenting Opinion, 2017 sec. 12.2.3)
Answer. The single float switch design is based on the 737 NG,
which has hundreds of millions of hours of safe flight. During the
certification process, Boeing discussed the design and the means of
compliance with the FAA. As a result of those discussion, Boeing
provided data and analysis that demonstrated Boeing's design provided
an equivalent level of safety to existing regulatory requirements, and
the FAA certified the design.
Question 21. Will Boeing upgrade the engine mount on the auxiliary
power unit, which is aluminum and not fireproof, as required by current
regulations? (See Dissenting Opinion, 2017 sec. 12.2.3)
Answer. The initial design of the auxiliary power unit structural
mount on the 737 MAX is unchanged from the 737 NG, which has hundreds
of millions of hours of safe flight. During the certification process,
Boeing improved the design to further reduce the risk of certain
failure scenarios beyond regulatory requirements. Boeing documented
these changes and provided data and analysis to the FAA identifying how
Boeing's design provided an equivalent level of safety to existing
regulatory requirements. The FAA certified Boeing's design.
Note: The following questions refer to the Joint Authorities
Technical Review (``JATR'') Boeing 737 MAX Flight Control System
Observations, Findings, and Recommendations report that was published
on October 11, 2019. The report is attached for your reference.
Question 22. Please describe--and provide the documents showing--
the changes Boeing has made and the testing the company has done
regarding human factors and human system integration with relation to
the MCAS fix, as suggested by Recommendation R7 of the JATR report.
Answer. Boeing has engaged in extensive testing of its MCAS
updates. As of November 26, Boeing has dedicated over 190,000
engineering and test hours relating to the MAX updates, flown nearly
1100 test and production flights, and conducted simulator sessions with
41 international regulators as well as 99 of our airline customers.
This testing included simulator sessions, with regulators, to evaluate
workload and human factors aspects of the updated procedures, training,
and design.
In the process of developing the MCAS update, Boeing incorporated
human factors considerations into the design development, analysis, and
testing process. Boeing has ensured that human-factors-focused
specialists participate in the design reviews of the update, review its
relevant safety analyses, and participate in simulator sessions where
human-factors issues were evaluated. Boeing is also ensuring that
relevant human-factors analyses are documented in its certification
compliance submissions. Before engaging in human factors testing,
Boeing shared its proposed approach with regulators, and Boeing
incorporated the feedback it received into the tests.
Question 23. Has Boeing created an independent system safety
function to challenge the assumptions and work of Boeing's design and
manufacturing personnel? (JATR report pgs. 30, 32). If so, has this
independent system safety function been applied to the MCAS fix? What
authority did that function have in relation to the design and other
personnel? Please describe.
Answer. Pursuant to a recommendation by a special Board committee,
Boeing has created an independent Product and Services Safety
organization that, among other responsibilities, will provide an
independent review of safety assessments completed by design personnel.
Although this specific organization was created after design of the
upgrades to the MCAS flight control law were begun, those updates were
scrutinized through a similar process.
Question 24. The JATR report (pg. VIII) found that MCAS was not
evaluated as a complete and integrated function and that the design was
based upon data, architecture, and assumptions that were reused from
the past. What has Boeing done to update these evaluations?
Answer. As part of the 737 MAX's return to service, revised
individual system safety assessments were consolidated into one
Integrated System Safety Assessment (ISSA) for the entire Speed Trim
System. The ISSA combines the analysis and results of several different
systems and components of the airplane into a single compliance
document, providing an integrated perspective into the flight control
system's overall level of safety. As Boeing continues to work to return
the MAX to service, we will use knowledge we have gained from that
process to improve our safety processes for future airplanes. Moreover,
as discussed in the response to Question 26, Boeing also supports
updating the industry-wide assumptions reflected in existing regulatory
guidance.
Question 25. Who made the ultimate decision to remove information
relating to MCAS functionality from the Flight Crew Operating Manual?
Answer. Consistent with the established regulatory process, the
development of the training requirements and manuals for the MAX was a
complex, multi-year effort that involved close coordination between
Boeing and the FAA. Ultimately, relying on the professional judgment of
those involved in this process, Boeing proposed, and the FAA agreed,
not to include MCAS in required pilot training for the MAX. Likewise,
the FAA reviewed Boeing's flight manuals, which did not reference the
MCAS function by name. Boeing has learned from these accidents,
however, and the responses we have received from regulators, our
customers, and other stakeholders, and Boeing is also in the process of
updating flight crew training and manuals to reflect the updates to
MCAS, as appropriate.
Question 26. What assumptions has Boeing changed regarding pilot
response time in the flight control functional hazard assessment? What
data and testing did Boeing engage in, and what studies, if any, did
the company rely upon when changing these pilot response time
assumptions? (JTAR report pg. XII)
Answer. Boeing's design, analysis and evaluation approach is based
on FAA guidance and published industry standards, including FAA
Advisory Circular 25-7C \1\ (``Flight Test Guide for Certification of
Transport Category Airplanes''). This was the approach used when
designing and certifying the 737 MAX. Boeing supports an industry-wide
effort to update those standards.
---------------------------------------------------------------------------
\1\ FAA Advisory Circular 25-7C was canceled in May 2018 and
replaced by FAA Advisory Circular 25-7D, which contains the same
guidance on these points. This is true for all references to Advisory
Circular 25-7C in this document.
---------------------------------------------------------------------------
In updating MCAS, Boeing has implemented a number of changes to the
MCAS system that will minimize the risk that pilots encounter
erroneous, repeated or non-command limited MCAS activation. Those
changes include:
The flight control system will compare inputs from both
angle of attack sensors, and MCAS will not activate if the
sensors disagree by 5.5 degrees or more.
MCAS will no longer activate repeatedly. It will provide one
input for each elevated angle of attack event.
Finally, MCAS will never be able to command more stabilizer
input than can be counteracted by the flight crew pulling back
on the control column.
This design does not require the flight crew to promptly use
sustained electric trim to mitigate potential stabilizer failures
caused by MCAS. Moreover, this design meets all certification
requirements whether or not flight crews follow all of the steps in the
Runaway Stabilizer Non-Normal Checklist. As discussed in response to
the previous question, Boeing is also in the process of updating flight
crew training and manuals to reflect the updates to MCAS, as
appropriate.
Question 27. FAA Advisory Circular (``AC'') 25.1302-1 requires a
showing that MCAS, individually and in combination with other systems
and equipment, is designed so that qualified flight crew members
trained in their use can safely perform all the tasks associated with
the systems and equipment. The JATR report (pg. 12) found that Boeing
wrongly failed to identify MCAS as requiring compliance with 25.1302-1.
Has Boeing now complied with sec 25.1302-1 with regard to MCAS? If so,
how?
Answer. As part of the MAX's return to service, Boeing will
demonstrate compliance with 14 C.F.R. Sec. 25.1302. The specific means
of compliance are determined by the FAA. Boeing will provide all
necessary information to the FAA as part of the return-to-service
process.
Question 28. The JATR report (pg. 18) found that a review of the
natural (bare airframe) stalling characteristics of the 737 MAX should
be performed to determine if unsafe characteristics exist. Has this
been conducted? If so, please provide the data and testing
documentation underling that review and conclusions.
Answer. As part of the MAX's return to service and in response to a
request from a regulator, Boeing conducted both simulator sessions and
flight testing designed to verify that the MAX's characteristics and
systems were compliant with relevant regulatory requirements regarding
stall identification and subsequent airplane behavior. This testing
included tests with the Speed Trim System (including MCAS) turned off.
The testing verified the original finding of compliance.
Question 29. Has Boeing performed stall demonstration compliance as
required by 14 CFR 25.201 before or after the 737 MAX was grounded?
(JATR report pg. 18) If so, when was this done? Please describe the
testing, analysis and results.
Answer. As part of the initial certification process, the 737 MAX
demonstrated compliance with 14 C.F.R. Sec. 25.201. As part of the
MAX's return to service, Boeing is working with the FAA to demonstrate
compliance with this section, and will provide any necessary data and
analysis required by the FAA.
Question 30. Prior to the crashes, 737 MAX simulators did not
exhibit the problems that occurred and caused the crashes. What has
Boeing done to verify that simulators accurately simulate all aspects
and potential problems of flying the 737 MAX? How many such simulators
exist?
Answer. Pursuant to Federal regulation, the FAA certifies flight
simulators for use as aviation training devices. Boeing does not
manufacture aircraft simulators, though Boeing does provide software to
the manufacturers of these products. Though it is impossible to
simulate every possible aircraft malfunction or combination of
malfunctions, the 737 MAX training simulation software contains
hundreds of malfunction scenarios. Those scenarios were identified
based on industry standards and an assessment of training value. The
available malfunction scenarios are continuously reviewed based on
changing training techniques, operator feedback, and operational data.
For instance, in March 2019 Boeing added a malfunction scenario that
simulates the effects of erroneously high Angle of Attack data.
Boeing owns one MAX engineering simulator in Seattle, as well as 8
MAX training simulators at locations around the globe. As of December
2019, Boeing is aware of approximately 26 others worldwide.
Question 31. Has Boeing changed its prior practice (JATR report pg.
29) of failing to identify personnel recommending approval with
airworthiness standards via FAA Form 8100-9 Statement of Compliance
with Airworthiness Standards? Does this change apply to submissions
relating to the MCAS fix? If not, please describe how Boeing identifies
employees who make airworthiness recommendation decisions and hold them
accountable.
Answer. Boeing's existing Organization Designation Authority (ODA)
procedures require the submission of signed FAA Form 8100-9 for all
compliance data submittals except in limited circumstances, such as
flight test reports where the FAA retained the compliance deliverable
and conducted the test. In all cases where Boeing submits a Form 8100-
9, the individual signing the form is identified.
Boeing's Organization Designation Authority procedures are outlined
in its ODA procedures manual, which is the product of an agreement with
the FAA. As such, Boeing cannot unilaterally change its ODA procedures.
However, Boeing is evaluating changes to these procedures and will make
any necessary changes in coordination with the FAA.
Question 32. The JATR report recommended that all ``major hazards''
determined under AC 25.1309.1A, which include flight crew action in
mitigation, should be examined to determine if they are potentially
catastrophic. (JTAR report pg. 30) Has Boeing conducted a review of
other systems in the 737 MAX since the accidents? Please describe what
systems were examined, what testing and analysis was done, and what
were the results of the examinations?
Answer. As part of the process to return the MAX to service, Boeing
has re-evaluated its analysis of any system that could have a failure
effect on the flight control computer (FCC), as well as any system
potentially affected by a failure of the FCC. Boeing used a
comprehensive failure analysis process, focusing on cascading system
effects as well as the flight crew's ability to cope with the failure
during different phases of flight. The testing and analysis included
identifying the effects of a particular failure, conducting a thorough
review of each failure case, and, where necessary, conducting simulator
testing to finalize the appropriate hazard classification.
After reviewing the individual system effects for the failure
(first, second, third order effects), Boeing prepared an airplane level
analysis of the system effects and expected flight crew response. The
results of the testing and analysis were provided to the FAA for use
during the return-to-service process. As described previously, Boeing
will use the knowledge we have gained during the process of returning
the MAX to service to make improvements to its processes going forward.
Question 33. The JATR report determined that the single and
multiple failure analysis of MCAS was never performed (JTAR report pg.
34). Please describe all possible failures of MCAS and related systems
that were examined in the process of returning the MAX to service, and
how Boeing intends to mitigate those potential failures.
Answer. The JATR report indicates that an aircraft-level single-and
multiple-failure analysis, although not a certification deliverable,
was developed and used by Boeing in evaluating the MAX. JATR Report at
33.
In the process of returning the MAX to service, Boeing has
conducted extensive testing of the updates to the MCAS flight control
law, and has documented that testing in submissions to the FAA. This
testing has included failure modes such as unexpected loss of MCAS
operation and three different types of erroneous MCAS operation: (1)
MCAS operating when unnecessary; (2) MCAS operation based on incorrect
data input; and (3) MCAS stopping in the middle of expected operation.
As described in the answer to the previous question, Boeing has also
re-evaluated other potential flight-control-computer failures.
In updating MCAS, Boeing has implemented a number of changes to the
MCAS system that will minimize the risk that pilots encounter
erroneous, repeated, or non-command-limited MCAS activation. Those
changes include:
The flight control system will compare inputs from both
angle of attack sensors, and MCAS will not activate if the
sensors disagree by 5.5 degrees or more.
MCAS will no longer activate repeatedly. It will provide one
input for each elevated angle of attack event.
Finally, MCAS will never be able to command more stabilizer
input than can be counteracted by the flight crew pulling back
on the control column.
This design does not require the flight crew to promptly use
sustained electric trim to mitigate potential stabilizer failures
caused by MCAS. Moreover, this design meets all certification
requirements whether or not flight crews follow all of the steps in the
Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process
of updating flight crew training and manuals to reflect the updates to
MCAS, as appropriate.
Question 34. The JATR report found that Boeing did not meet the
objectives of Society of Automotive Engineers Aerospace Recommended
Practice 4754A (``ARP4754A'') for an integrated approach to design when
integrating complex systems like MCAS into the legacy 737. (JTAR report
pg. 38) Please describe what Boeing has done to meet the objectives of
ARP4754A in this regard, as it attempts to return the MAX to service.
Answer. During the certification of 737 MAX systems, Boeing worked
with the FAA to develop specific methods of compliance with FAA
regulations. These methods are consistent with the intent of ARP4754A.
As described in the answer to Question 24, for the updates to the MCAS
flight control law, Boeing has consolidated individual system hazard
assessments into an Integrated System Safety Assessment for the Speed
Trim System. The ISSA combines the analysis and results of several
different systems and components of the airplane into a single
compliance document, providing an integrated perspective into the
flight control system's overall level of safety.
______
Response to Written Questions Submitted by Hon. Amy Klobuchar to
Dennis Muilenburg
At Tuesday's hearing, you indicated that you would follow up with
information in response to my questions on how often Boeing engineers--
rather than Federal Aviation Administration (FAA) employees--conduct
safety certifications for Boeing aircraft.
Question 1. What percentage of FAA certifications do Boeing
employees--rather than FAA employees--approve for Boeing aircraft?
Answer. The FAA initially accepted the Master Certification Plan
for the 737-8 in November 2013, and it accepted the Detailed
Certification Plans in August 2015. When the Master Certification Plan
was initially accepted by the FAA, approximately 28 percent of the
detailed Certification Plans were delegated. As the FAA reviewed the
certification deliverables, those deliverables evolved. The number of
delegated tasks increased as a result. For example, the FAA often will
review a Boeing proposal for compliance, provide comments and require
changes to that proposal and then delegate the final implementation
work to Boeing's ODA. However, even for certifications that are
delegated, all testing and reviews that Boeing conducts to demonstrate
compliance with applicable standards and requirements are subject to
FAA oversight.
Question 2. How many Boeing engineers both work on automated
systems for the company and then certify those systems for the FAA?
Answer. Boeing employs approximately 16,000 engineers that work on
designing commercial airplanes. Of those, approximately 3700 work
specifically on airplane systems, and approximately 350 work on flight
control systems. Approximately ten flight control engineers have
credentials as Engineering Unit Members in the Boeing Organization
Delegation Authority (ODA), which would allow them to make a compliance
finding on behalf of the FAA regarding flight controls, if the FAA
delegates such findings to Boeing's ODA.
In response to my question regarding whether certain aircraft
should be allowed to carry passengers in some countries and not others,
you declined to respond and stated that you ``respect the jurisdiction
of the regulatory authorities around the world.''
Question 3. How would you explain that to a passenger who is
rightly concerned about their safety?
Answer. Boeing respects the authority of all individual civil
aviation authorities to make decisions regarding the airspace they
control and the pilots, maintenance personnel, and airlines they
oversee. Individual civil aviation authorities around the world,
working in collaboration with other regulators and the broader aviation
community, are best positioned to determine how to achieve safety goals
in the context of their individual regions and operations. Boeing is
committed to ensuring the MAX returns to service worldwide, and to
providing any information and support needed by those civil aviation
authorities, and our customers, to achieve their goals and ensure the
MAX safely returns to service worldwide.
______
Response to Written Questions Submitted by Hon. Richard Blumenthal to
Dennis Muilenburg
Boeing's attempt to move all the Lion Air cases overseas to
Indonesia. Boeing says that it will take responsibility for the Lion
Air crash resulting in the deaths of 189 people in Indonesia last year
and the Ethiopian Airlines crashed that killed a 157 people from a pair
of defectively designed 737 MAX aircraft. However, your company is
threatening not to. Boeing has filed court documents for the Lion Air
crash indicating that it will move to change the venue of the case to
Indonesia, where the plane was maintained, if settlement talks fail.
The case was filed in the Northern District of Illinois, where Boeing
is headquartered. Resolving these claims in Indonesia is a travesty of
justice because:
There is no Seventh Amendment Constitutional right to a jury
trial;
There is no requirement of discovery, so there is limited or
no ability for the plaintiffs to uncover the documents showing
what Boeing knew, when it knew it, what information was
withheld from the FAA, and other critical information;
There is no rule allowing for depositions to be taken of key
Boeing decision-makers; and
There is no right to cross-examine witnesses to see what
they know.
Question 1. Is the threat to move the case to Indonesia a
litigation tactic or is this attempt to evade responsibility for
corporate misconduct?
Answer. In response to both MAX accidents, Boeing has offered to
engage in mediations in the United States to resolve the families'
claims without the need for any litigation. To facilitate this, Boeing
arranged for a prominent Chicago mediator, a former Chief Judge of the
Circuit Court of Cook County, to assist, and is paying the full costs
of all mediations. Since the middle of July, Boeing has been working
with the mediator and the families who lost loved ones in the Lion Air
accident to settle these cases. We have resolved approximately one half
of the Lion Air claims filed in the United States on terms that
compensate the victims' families. We remain committed to this mediation
process. If, at some point and despite Boeing's best efforts, an
impasse is reached in the mediation process, the litigation may resume.
And at that point, well-settled U.S. law will give Boeing the option of
requesting that the court determine whether, consistent with well-
settled legal principles adopted by the United States Supreme Court,
another jurisdiction is the appropriate venue for such cases.
Question 2. It seems that you want the advantages of being treated
like an American company except that you don't want to utilize U.S.
courts, which recognize the rights of both parties in a dispute. Why
are you threatening to move the claims filed against you to Indonesia?
Answer. Please see the response to the previous question.
Question 3. Traditionally, companies complain that they don't want
to be sued in the plaintiff's backyard, yet, you are being sued in your
home state. Why are you threatening to leave courts conveniently
located in your backyard?
Answer. Please see the response to your first question.
Clarification on Boeing's support for changes to the certification
process. On October 27, 2019, the New York Times reported on Boeing
efforts to undercut regulatory oversight--early and often. The story of
Boeing sabotaging rigorous safety scrutiny is chilling--and more reason
to keep 737 MAX aircraft grounded until certification is truly
independent and the system reformed.
Your company has lost the trust of the public, and I am evaluating
changes to the Organizational Designation Authorization (ODA) program.
At the hearing, you were unclear about Boeing's position on changes to
the current certification process.
Question 4. Do you support reducing the amount of delegation
authority from the FAA to Boeing to restore public trust?
Answer. Boeing strongly supports robust FAA oversight of the
certification process. As the last major commercial airplane
manufacturer in the United States, Boeing believes the certification
process, and the FAA's role in that process, are vital to the safety of
the traveling public, and have been an important factor driving
substantial improvements in aviation safety in recent decades.
Delegation has strongly correlated with safety. Delegation is
decades old; and as delegation has increased, safety has as well. The
data does not support the idea that reducing the amount of delegation
will result in an increase in safety. Boeing believes that any changes
made should continue to ensure the FAA's resources are focused on areas
such as new technologies, systems integration, and development, and
providing the FAA with the resources needed to effectively administer
that process as well as ensure FAA has the required technical
expertise.
Question 5. What is the current timeline for returning the 737 MAX
to service and how can the public be assured of its safety?
Answer. The relevant civil aviation authorities will determine when
the MAX returns to service. When the MAX returns to service, it will be
one of the most scrutinized aircraft in history, and Boeing is
committed to ensuring that it will also be one of safest aircraft ever
to fly.
Boeing's decision to label MCAS failure as ``major'' rather than
``catastrophic''. As you are aware, Boeing decided to classify failure
of the MCAS system during flight as merely ``major''--lowering the
classification of risk and exempting Boeing from having to fully test
and analyze the effects of system failure.
Question 6. How can you explain the failure to label the MCAS as
``catastrophic?''
Answer, Boeing engaged in a multi-step process for evaluating the
potential safety considerations involved in the implementation of MCAS.
At each stage of the design, development, and testing of MCAS, Boeing
subject matter experts reviewed and evaluated the design and the
potential safety implications of design changes.
As authorized by applicable FAA guidance, including FAA Advisory
Circular 25-7C (``Flight Test Guide for Certification of Transport
Category Airplanes''), in conducting their hazard assessments, Boeing's
subject matter experts made a series of assumptions about how a flight
crew would react if MCAS failed or did not function as intended.
Consistent with established FAA guidance, this included the assumption
that the crew would recognize and address uncommanded MCAS activation
through normal use of the control column and the electric trim
switches, and that the crew would also be able to use the stabilizer
cutout switches and rely on manual trimming (as outlined in the Runaway
Stabilizer Non-Normal Procedure) to stop any unintended stabilizer
motion. Test pilots participated in the simulator testing of MCAS and
had vital input into the hazard analysis.
Question 7. Why did you make this decision?
Answer. Please see the response to question 6.
Question 8. Could the decision to label the system as
``catastrophic'' have prevented the MCAS failure from contributing the
Lion Air and Ethiopian Air crashes?
Answer. Whether hypothetical changes to the MCAS hazard rating
could have prevented a failure of MCAS from contributing to the Lion
Air and Ethiopian Air crashes is impossible to determine. As Boeing
testified at the hearing, if, using hindsight, Boeing could go back and
make changes to the MAX that would prevent the accidents, it would do
so.
Undue pressure put on Boeing employees to certify 737 MAX aircraft.
The Wall Street Journal recently reported that internal Boeing surveys
revealed that about 30 percent of its employees felt potential undue
pressure from managers regarding safety related approvals.
Boeing engineer Curtis Ewbank filed a complaint that asserted,
``Boeing management was more concerned with cost and schedule than
safety or quality.'' He further asserted that you, Mr. Muilenburg,
publicly misrepresented the safety of 737 MAX aircraft.
The October 11, 2019 Joint Authorities Technical Review report also
found several instances of Boeing management exerting undue pressure on
its own engineers performing certification activities, which, as a
result, ``erodes the level of assurance in this system of delegation.''
Question 9. Did you at any point misrepresent the safety of 737 MAX
aircraft? Please explain.
Answer. No. With that said, Boeing has learned from these
accidents, and has made several changes to the MAX to ensure that
accidents like these never happen again. Boeing has dedicated over
190,000 engineering and test hours relating to the MAX updates, flown
more than 1100 test and production flights, and conducted simulator
sessions with 41 international regulators as well as 99 of our airline
customers. When the MAX returns to service, we are confident it will be
one of the most scrutinized and safest aircraft ever to fly.
Question 10. Did personnel within the company--involved in
performing certification activities--have compensation tied to meeting
timeline and cost goals? Please explain.
Answer. For members of Boeing's Organization Delegation Authority
(ODA), Boeing's ODA manual does not permit the use of timeline and cost
goals as part of performance evaluations.
Question 11. Did you ever personally exert production pressures on
any of the employees that served under you as Boeing's CEO? If not,
have you identified who, or what, in your organization caused that
undue pressure?
Answer. Mr. Muilenburg was not the subject of any undue pressure
complaint. Boeing provides a number of avenues for employees to report
instances of potential or actual undue pressure. In accordance with
Boeing's ODA procedures manual, which is reviewed and approved by the
FAA, allegations of potential undue pressure must be investigated and
rectified, where needed, in a timely manner. Boeing investigates all
undue pressure reports and those investigations are reviewed with the
FAA. Boeing also conducts regular self-audits and surveys of the
workforce to identify and address potential avenues of undue pressure
that are not specifically reported by the workforce. In addition,
Boeing requires any manager associated with the certification process
to take training on undue pressure every two years, to ensure that they
can identify and address potential undue pressure issues.
Question 12. What steps have been taken to hold individuals
accountable and reform Boeing's safety protocols related to undue
pressure being put on employees?
Answer. Boeing takes all allegations of undue pressure seriously.
The Boeing Organization Designation Authority manual requires that any
allegation of undue pressure be promptly rectified. When appropriate,
employee corrective action is taken. More broadly, Boeing has created a
Product and Services Safety Organization. This organization will ensure
that any safety issue, including issues of undue pressure, will be
investigated and evaluated by an independent organization within the
company.
The need for Boeing to move away from a system of assumptions. The
Joint Authorities Technical Review report stated that Boeing made
critical and several unsupported assumptions underlying the
certification of 737 MAX aircraft, including a three-second pilot
response assumption in the event of a problem.
These assumptions directly contributed to two horrific and
preventable crashes.
Question 13. As you have resubmitted a package to return the
aircraft to service, what changes in assumptions of pilot response or
the other assumptions outlined in that report have you made?
Answer. Boeing's design, analysis and evaluation approach is based
on FAA guidance and published industry standards, including FAA
Advisory Circular 25-7C \2\ (``Flight Test Guide for Certification of
Transport Category Airplanes''). This was the approach used when
designing and certifying the 737 MAX. Boeing supports an industry-wide
effort to update those standards.
---------------------------------------------------------------------------
\2\ FAA Advisory Circular 25-7C was canceled in May 2018 and
replaced by FAA Advisory Circular 25-7D, which contains the same
guidance on these points. This is true for all references to Advisory
Circular 25-7C in this document.
---------------------------------------------------------------------------
In updating MCAS, Boeing has implemented a number of changes to the
MCAS system that will minimize the risk that pilots encounter
erroneous, repeated and non-command limited MCAS activation, those
include:
The flight control system will compare inputs from both
angle of attack sensors, and MCAS will not activate if the
sensors disagree by 5.5 degrees or more.
MCAS will no longer activate repeatedly. It will provide one
input for each elevated angle of attack event.
Finally, MCAS will never be able to command more stabilizer
input than can be counteracted by the flight crew pulling back
on the control column.
This design does not require the flight crew to promptly use
sustained electric trim to mitigate potential stabilizer failures
caused by MCAS. Moreover, this design meets all certification
requirements whether or not flight crews follow all of the steps in the
Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process
of updating flight crew training and manuals to reflect the updates to
MCAS, as appropriate.
Question 14. What research have you or the FAA done to justify any
of those changes?
Answer. Boeing has engaged in extensive testing of these MCAS
updates. As of November 26, Boeing has dedicated over 190,000
engineering and test hours relating to the MAX updates, flown nearly
1100 test and production flights, and conducted simulator sessions with
41 international regulators as well as 99 of our airline customers.
Testing has included evaluation of the system in normal operation,
operation when subject to failures (in both the normal and operational
flight envelopes), and the potential effect of pilot crew error and
workload. When the MAX returns to service, we are confident it will be
one of the safest aircraft ever to fly.
The lack of documents provided to the Senate Commerce Committee.
The House Transportation and Infrastructure Committee had received over
500,000 pages of documents related to the certification of the 737 MAX.
Boeing has failed to provide the same documents to the Senate Commerce
Committee--inhibiting our ability to carry out our oversight authority.
Question 15. Will you commit to providing these documents to the
Senate Commerce Committee as well? Please explain.
Answer. Boeing respects the role of both Committees in the
oversight of the aviation industry and is committed to continuing to
cooperate with both Committees. To date, Boeing has responded to all
requests received from the Chairmen of both Committees, and we intend
to continue to cooperate with such requests.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Dennis Muilenburg
Question 1. As a follow up to my questioning during the hearing,
have you and your team engaged on what are ways to improve the ODA
process?
Answer. Boeing strongly supports robust FAA oversight of the
certification process. As the last major commercial airplane
manufacturer in the United States, Boeing believes the certification
process, and the FAA's role in that process, are vital to the safety of
the traveling public, and have been important factors driving
substantial improvements in aviation safety in recent decades.
The Organization Delegation Authority process has helped facilitate
these safety improvements. However, there are ways to improve that
process. For example, the FAA's System Oversight capability could be
strengthened by setting clear expectations for applicants' processes
and procedures to ensure compliance for lower risk areas, as identified
by the FAA. This would allow FAA to dedicate the majority of its
resources on areas the FAA has determined to be the highest safety
risk. Boeing will work with all interested stakeholders to learn from
these accidents and further increase aviation safety.
Question 2. Accountability is critical. How will you personally or
Boeing collectively be held accountable for decisions you made or
pressure you exerted on your team that led to minimizing pilot training
and failing to disclose critical information in the rush to get these
planes in the air?
Answer. Boeing has recently made several high-level leadership
changes to ensure that it has the right leadership going forward. As
described in more detail in response to Question 4, Boeing has also
made several structural changes to enhance the company's culture of
safety and accountability. Several external reviews are ongoing. As
those conclude, we will evaluate the results of those reviews and will
not hesitate to hold individuals accountable, where appropriate.
Question 3. In 2018, you received a $13 million dollar bonus, based
in part on Boeing surpassing a three-year economic profit goal. Was any
part of this goal and bonus based on the sales of the 737 MAX 8--which
seems to have been rushed to the market? Have you given any of this
bonus back?
Answer. Mr. Muilenburg's 2018 compensation is publicly available in
Boeing's annual proxy statement, which can be found at www.boeing.com.
Question 4. Please detail the changes recommended by the FAA and
other reviewing entities that will be incorporated into Boeing's other
product lines and planes like the Boeing 737 MAX 10?
Answer. Boeing is taking into consideration the recent
recommendations of a number of reviews, and making improvements to
Boeing internal processes as they relate to how we evaluate new
airplane system design. Boeing continues to review additional reports
and reviews as they are completed, and will continue to incorporate
lessons from those reviews.
Based on the recommendation of a special board committee, Boeing is
also making several changes to our organization and processes designed
to enhance safety culture of the company. These changes include:
(1) Creating a permanent Aerospace Safety Committee within our Board
of Directors to oversee and ensure safe design, development,
manufacture, maintenance, and delivery of our products and
services;
(2) Creating a Product and Services Safety organization to review
all aspects of product safety;
(3) Realigning the Engineering function within the company, so that
engineers across Boeing will report directly to the Chief
Engineer;
(4) Establishing a design requirements program to further facilitate
the incorporation of historical design materials, data and
information, best practices, lessons learned, and detailed
after action reports to reinforce Boeing's commitment to
continuous improvement;
(5) Enhancing our Continued Operational Safety Program to aid
transparency and visibility of safety related issues; the
Continued Operational Safety Program now will require the Chief
Engineer's review of all safety and potential safety reports;
(6) To anticipate the needs of future pilot populations, re-
examining assumptions about flight deck design and operation in
partnership with our airline customers and industry members;
(7) Expanding our Safety Promotion Center for employees to learn and
reflect on our safety culture and renew personal commitments to
safety;
(8) Expanding our anonymous safety reporting system to strengthen
safety management systems within Boeing and our supply chain;
(9) Investing in new capabilities, including enhanced flight
simulation and computing, and advanced R&D for future flight
decks, as well as pilot and maintenance technician training and
STEM education.
______
Response to Written Questions Submitted by Hon. Tammy Duckworth to
Dennis Muilenburg
During the October 29th hearing, I asked the Chairman of the
National Transportation Safety Board (NTSB) whether he concurred with
my view that, ``The most reliable initial human response to an
uncommanded nose down dive is to pull back on the yoke.''
Chairman Sumwalt provided the following response:
``Yes, I do. I have actually looked at the procedure and it
says to grasp and to hold it firmly but as you know as an
experienced pilot, your natural reaction would in fact if it is
going in a direction you do not intend it to, you would tend to
oppose it, which you should. In the older models of the Boeing
aircraft that I flew, the 727 and 737, that would engage the
stabilizer brake and stop the stab from running. But as you
pointed out in the earlier round, it will not do that when MCAS
is active on the 737 MAX.''
I submitted the following written question to The Boeing Company on
May 17, 2019:
``What does Boeing believe is the natural human reaction to
stop a nose down trim command runaway?''
Boeing's written response failed to address what Boeing believes
the ``natural human reaction is to stop a nose down trim command
runaway'' and cited the steps of the Runaway Stabilizer Non-normal
checklist.
Question 1. Yes or no, does Boeing concur with the view that human
factors have proven that the most reliable initial human response to a
runaway horizontal stabilizer movement trimming airplane nose-down is
to oppose the motion by pulling back on the yolk? Please explain your
answer.
Answer. Boeing is not aware of specific research that addresses the
issue as presented by the question. Flight crews may use the control
column, the pitch trim switches, or a combination of both to control
the flight path of the airplane in the presence of an uncommanded nose-
down stabilizer movement.
Pursuant to FAA guidance, Boeing's design assumes that pilots will
take immediate action to reduce or eliminate short-term forces that
cause an aircraft to deviate from its intended flight path. Based on
that assumption and Boeing's expertise, the reaction to nose-down
stabilizer movement is to control the flight path of the airplane using
the methods available, including use of the control column and electric
trim switches.
Question 2. If the answer to Question 1 is ``No,'' please confirm
whether Boeing concurs with the view that human factors have proven
that the most reliable initial human response to a runaway horizontal
stabilizer movement trimming airplane nose-down is to use both aft
column motion and the column trim switch to quickly stop the runaway
stabilizer and restore trim? Please explain your answer.
Answer. Based on Boeing's expertise, the reaction to nose-down
stabilizer movement is to control the flight path of the airplane. In
the 737 MAX, the use of aft column motion, or the column trim switches,
or both, could typically be used by a pilot to control the flight path
of the airplane.
Question 3. Yes or no, does Boeing concur that for the 707, 727,
737 (except for the MAX), 747, 757 and 767 aircraft, many safe flight
hours demonstrate that in non-normal conditions where a uncommanded
stabilizer trim movement is causing a nose-down dive, pilots will
reliably respond with aft column travel to both trigger the aft column
cutout switch to quickly stop the runaway stabilizer movement and
prevent significant mistrim, and command sufficient airplane nose-up
elevator to exactly offset the stabilizer mistrim? Please explain your
answer.
Answer. The established procedure for responding to uncommanded
stabilizer trim movement causing nose down mistrim is contained in the
Runaway Stabilizer Non-Normal Checklist. This procedure does not direct
pilots to use ``aft column travel'' to address the mistrim condition;
rather, it directs pilots to hold the control column firmly, disengage
the autopilot and autothrottle, and then control the pitch attitude of
the aircraft manually using the control column or main electric trim,
as needed. If the runaway continues, it directs pilots to disable
electric trim by use of the aisle stand cutout switch. These steps are
designed to assist the flight crew in controlling the flight path of
the airplane.
Question 4. Yes or no, does Boeing concur with the view that for
approximately 60 years of service, across the 707, 727, 737 (except for
the MAX), 747, 757 and 767 aircraft, column cutout switches have
enabled pilots to quickly stop the runaway stabilizer movement using
column motion only? Please explain your answer.
Answer. For many Boeing models, the column cutout switch is one
method that may address a runaway stabilizer movement. However, the
memory item procedures contained in the Runaway Stabilizer Non-Normal
Checklist, which flight crews are required to learn and memorize, do
not include engaging the aft column cutout switch for either the 737 NG
or the 737 MAX.
Question 5. Yes or no, does Boeing concur with this statement:
``For every Boeing airplane until the 737 MAX, uncommanded
stabilizer runaway is stopped by column motion only. But for
the MAX, with MCAS malfunction, the pilot has to also apply
manual electric trim within the same three second window?''
Please explain your answer.
Answer. No. On all Boeing airplanes there are possible stabilizer
failures where column motion alone may not arrest the failure. The
procedure in the Flight Crew Operations Manual for arresting an
uncommanded stabilizer runaway on the Boeing 737 NG, as well as the
MAX, is the Runaway Stabilizer Non-Normal Checklist. That checklist
directs pilots that steps beyond column motion alone may be required to
arrest a runaway stabilizer.
In addition, Boeing assumes the ``three second window'' described
in the statement refers to FAA regulations, including FAA Circular 25-
7C (now Circular 25-7D), that allows manufacturers to assume, in
certain types of testing, that flight crews will not react to a
potential hazard for up to three seconds. That guidance relates to the
time a manufacturer should assume will pass before the flight crew
begins reacting to a hazard, not the time required to complete
corrective action.
Question 6. Yes or no, prior to the 737 MAX series aircraft, did
the Speed Trim System bypass the aft column cutout switch on the 737 NG
or any earlier versions of the 737 that included the Speed Trim System?
Answer. The speed trim systems on the 737 NG and earlier versions
of the 737 do not have the aft column cutout bypass feature. That
feature was introduced with the MCAS function, and the speed trim
systems on the 737 NG and earlier versions of the 737 airplane do not
include the MCAS function.
Question 7. On almost any other Boeing aircraft, it would be
reasonable to expect a pilot to react instantly to uncommanded
stabilizer trim motion in manual flight. However, as installed on the
737 aircraft, the Speed Trim System has desensitized pilots to
stabilizer trim motion in manual flight. In speaking with 737 pilots, a
few confirmed that the feel and sound of the Speed Trim System moving
the stabilizer is normal and something a 737 pilot would be accustomed
to in manual flight.
Given that the 737 aircraft appears to be the only Boeing aircraft
where an augmentation system exists that results in stabilizer trim
motion in manual flight, what analysis or evidence did Boeing rely on
to justify its assumption that a 737 MAX pilot would instantly react to
stabilizer trim motion in manual flight caused by MCAS activation?
Answer. Automated flight controls that move flight surfaces during
manual flight are not unique to the 737. For the 737, during manual
flight, the assumption of pilot recognition is predicated on an
increase in column forces or deviation from the intended flight path.
FAA regulatory guidance, including Advisory Circular 75-7C, allows
manufacturers to assume that a flight crew will seek to offload
unexpected column forces.
Question 8. On October 30, 2019, you publicly stated, ``The
original concept from a safety standpoint was to build the MCAS, extend
the current Speed Trim System of the previous generation of the 737,
that's a system that had about 200 million safe flight hours on it.''
For those 200 million safe flight hours on the Speed Trim System
that you referenced, did the aft column cutout switch enable pilots to
use column motion only to quickly stop the runaway stabilizer, prevent
significant mistrim, and preserve sufficient elevator authority to
restore the trim efficiently?
Answer. As explained in response to question 5, on all Boeing
airplanes there are possible stabilizer failures where column motion
alone may not arrest the failure. Boeing's procedures for responding to
a runaway stabilizer do not include engaging the aft column cutout
switch.
Question 9. One of Boeing's safety principles is to take safe
systems, such as the Speed Trim System, and then incrementally extend
them. Presumably, this was the concept behind Boeing's decision to add
the MCAS flight control law to the existing Speed Trim System. However,
it appears that MCAS did not represent an extension of the Speed Trim
System, but rather, MCAS activation must, and does, disable a long-
standing safety function: the aft column cutout switch.
Please explain whether the decision to add a new flight control law
(MCAS) to the Speed Trim System that bypasses the aft column cutout
switch is consistent with Boeing's concept of incrementally extending
an existing safety system.
Answer. In designing MCAS for the 737 MAX, the decision to bypass
the aft column cutout switch was consistent with safe and sound design
principles, and relied on well-established, industry-wide assumptions
and long-standing FAA guidance. In addition, as previously explained,
engaging the aft column cutout switch was not a part of the memory
procedure for addressing a runaway stabilizer.
Question 10. Yes or no, does Boeing concur that MCAS bypassing the
aft column cutout switch undermined Boeing's assumptions that limited
mistrim to 0.6 units and assumed sufficient elevator authority would
always be preserved? Please explain your answer.
Answer. No. MCAS's design has always included bypassing the aft
column cutout switch. When MCAS's design was changed to include
operation at lower speeds, Boeing subject matter experts--including
both engineers and experienced pilots--conducted a targeted assessment
of the potential hazards posed by MCAS's greater stabilizer authority
at low speeds. In performing this assessment, Boeing's experts applied
their engineering judgment and piloting experience to the existing
safety analysis and data for the earlier MCAS design, and also
considered new performance data generated through piloted simulator
testing and computer analysis of MCAS's operation at low speeds.
Boeing's subject matter experts concluded that the updated version of
MCAS, which still included the aft column cutout switch bypass, met all
applicable requirements.
Question 11. Please identify the specific compensating safety
features Boeing installed in response to MCAS activation bypassing the
aft column cutout switch or confirm that Boeing did not develop a
specific compensating safety feature to bypassing aft column cutout.
Answer. On the 737 MAX, pilots had the ability to counteract the
effects of MCAS through use of the control column and the electric trim
switches, or to disable MCAS through use of the aisle stand cutout
switches. As previously stated, the memory procedure appropriate for
responding to a runaway stabilizer did not include engaging the aft
column cutout switch.
Question 12. Please explain how Boeing demonstrated that when the
737 MAX MCAS flight control law is activated during manual flight, the
MAX series aircraft complies with Section 25.255 of Title 14, Chapter
I, Subchapter C, Part 25, Subpart B, of the Code of Federal Regulations
(14 CFR Sec. 25.255: Out-of-trim characteristics), despite MCAS
activation bypassing the aft column cutout switch and tripling the stab
trim rate.
Answer. MCAS moves the stabilizer at a rate based on the speed of
the airplane. Its maximum stabilizer authority is 0.27 degrees/second.
This rate is 35 percent greater than the rate at which the pilot can
move the stabilizer using manual electric trim when flaps are up, and
less than the rate that the pilot can move the stabilizer using manual
electric trim when flaps are down.
Title 14, Code of Federal Regulations, Section 25.255 defines
acceptable maneuvering stability and dive recovery requirements for
out-of-trim conditions. The magnitude of the out-of-trim condition is
defined by a three second movement of the stabilizer at its normal no-
load rate. The 737 MAX meets the required characteristics with the
mistrim that results from a three second movement of the stabilizer at
the flaps up trim rate. Boeing also tested a magnitude of mistrim that
was greater than would occur from a three second movement of the
stabilizer at the flaps up trim rate and found that MCAS met all
applicable regulatory requirements.
Question 13. Please confirm that between October 29, 2018 and March
10, 2019, Boeing conducted tests in a 737 MAX simulator to observe how
a pilot--without knowledge of MCAS--responds when he or she realizes
that Step One of the Runaway Stabilizer procedure (hold the control
column firmly to counter the nose-down trim command of the horizontal
stabilizer) does NOT automatically stop MCAS from repeated activations.
If Boeing did not conduct such a test, please provide Boeing's
justification for this course of action.
Answer. In the relevant time frame, Boeing did conduct extensive
testing of pilot response to repeated MCAS activation. If a pilot only
maintains control of the flight path of the airplane through use of the
control column to counter MCAS's nose-down trim, MCAS, as designed and
installed on the MAX, will not activate multiple times. MCAS will only
reactivate if the flight crew uses electric trim. Thus, the described
condition was not tested because it was not a possible failure mode of
the MCAS design.
Question 14. Yes or no, does Boeing concur that because of the aft
column cutout switch, a Boeing 737 NG pilot, following the Runaway
Stabilizer Non-Normal procedure, would be accustomed to, and expect,
column motion (and only column motion) to quickly stop an uncommanded
runaway stabilizer trimming in opposition to the column motion and
ensure the elevator remains effective? Please explain your answer.
Answer. No. The Runaway Stabilizer Non-Normal Checklist for the 737
NG directs pilots to hold the column steady, disengage the autopilot,
and to control the airplane pitch attitude manually or, as needed, with
the use of the trim switches on the control column; it does not direct
flight crews to apply column force until the aft column cutout switch
engages.
Question 15. Several of Boeing's critical assumptions appear to be
grounded in the expectation that because the Runaway Stabilizer Non-
Normal procedure is identical for both the 737 NG and 737 MAX, pilots
flying the 737 MAX should have been prepared to respond to a flight
condition caused by repeated MCAS activations resulting from a single
erroneous AOA sensor input exactly as they would respond to a runaway
stabilizer on the 737 NG. Yet, Boeing was clearly aware that on the 737
MAX, MCAS activation bypasses the aft column cutout switch and triples
the stab trim rate.
Prior to JT610 and ET302, did Boeing inform 737 MAX pilots that the
aft column cutout switch is bypassed in the 737 MAX and thus column
alone will not always stop the uncommanded stabilizer trim movement?
Answer. As noted in the response to Question 14, the aft column
cutout switch is not identified in the memory procedure for uncommanded
stabilizer motion. Consistent with the established regulatory process,
the development of the training requirements and manuals for the MAX
was a complex, multi-year effort that involved close coordination
between Boeing and the FAA. Many items were considered for inclusion,
including MCAS, and the content of the manuals and training evolved
over time, as is common. Ultimately, relying on the professional
judgment of those involved in this process, Boeing proposed, and the
FAA agreed, not to include a description of MCAS in the final version
of the Flight Crew Operations Manual for the MAX.
Question 16. The Federal Aviation Administration's Emergency
Airworthiness Directive (AD) 2018-23-51 issued on November 7, 2018, was
intended to prevent a catastrophic crash resulting from repeated MCAS
nose-down trim commands of the horizontal stabilizer caused by an
erroneously high single angle of attack sensor input. However,
publishing AD 2018-23-51 failed to prevent ET302.
Following its publication, did any Boeing employee, or employee of
a Boeing contractor, express concerns related to AD 2018-23-51?
Answer. Boeing maintain an Employee Issue Tracking System, a
single, common system for entering and tracking employee issues and
complaints. Boeing has searched EITS and located no records indicating
an employee or contractor raised concerns with AD 2018-23-51 to Boeing
after it was issued.
Question 17. How many occurrences of AoA malfunction (erroneous
high angle reading) have occurred across Boeing aircraft models without
significant incident prior to the JT610?
Answer. Boeing's records indicate there have been 35 total events
of erroneous Angle of Attack data and stick shaker across the Boeing
fleet since 1998. Of those events, 26 occurred on 737 NGs. All 35
flights resulted in continued safe flight and landing. There have been
more than 220 million departures in that timeframe.
Question 18. On ET302, MCAS was activated at a high airspeed that
appears to be far above any airspeed that MCAS should trigger. Why did
Boeing decide not to constrain MCAS authority to prevent it from
triggering at high airspeeds significantly above any level where MCAS
may be safely activated?
Answer. MCAS was initially designed to give the 737 MAX specific
handling qualities during certain high speed maneuvers, and thus was
intended to be active at high airspeeds. Boeing does not intentionally
engineer a system to change the handling characteristics of the
airplane in unexpected or uncommon situations, as such a design would
introduce significant safety risks.
Question 19. Please describe in detail the flight condition where
75 degrees is a valid angle of attack value.
Answer. Boeing is unaware of any normal flight condition where a
plane would have a 75 degree angle of attack. However, as Boeing
detailed in our response to your May 17, 2019 letter, Boeing's air data
inertial reference unit does not artificially limit the data from its
sensors.
Question 20. Please explain why Boeing failed to note that MCAS
activation in manual, flaps up flight, bypasses the aft column cutout
switch in the Boeing Multi-Operator Message (MOM-MOM-18-0664-01B) sent
in November 2018.
Answer. Boeing's Multi-Operator Message is consistent with the
procedures described in the Runaway Stabilizer Non-Normal Checklist.
These Checklist procedures are also discussed at length in Boeing's
Operations Manual Bulletin and the FAA's Airworthiness Directive issued
after the Lion Air accident. These are the appropriate procedures to
respond to erroneous uncommanded stabilizer trim movement (including
erroneous MCAS activation), and they do not include engaging the aft
column cutout switch.
Question 21. Please explain why Boeing failed to note that the
flight crew must use column trim switch or stabilizer aisle stand
cutout switches to override MCAS input, and instead used the following
more passive terminology: ``The system is designed to allow [emphasis
added] the flight crew to use column trim switch or stabilizer aisle
stand cutout switches to override MCAS input?''
Answer. As noted in response to the previous question, Boeing's
Multi-Operator Message was consistent with the procedures in the
Runaway Stabilizer Non-Normal Checklist. In addition, it would have
been incorrect to state that use of the column trim switch or aisle
stand cutout switch is required to override MCAS input. Because MCAS
input can be overridden solely by use of the control column in some
circumstances, use of the electric trim or aisle stand cutout switches
may not be necessary to override MCAS in those circumstances.
Question 22. Please share with the Committee any Boeing
communications sent after JT610 emphasizing the critical importance of
using manual electric trim to oppose MCAS because aft column cutout
switch is bypassed.
Answer. Please see the response to question 20.
Question 23. Following JT610 and prior to ET302, why did Boeing
fail to immediately disable MCAS?
Answer. The MCAS software is an integrated part of the flight
control system for the MAX as certified by the FAA and cannot be
``disabled'' per se. Following JT610, Boeing worked with the FAA to
establish a plan to revise the MCAS software to eliminate the risk of
erroneous AOA data leading to repeated MCAS activation.
On November 6, 2018, a Boeing Safety Review Board (``SRB'')--
Boeing's established process for evaluating in-service safety issues--
determined that the crew workload effects of erroneous AOA input
leading to activation of the MCAS function presented a safety issue,
and also determined that appropriate pilot action could counteract the
condition. That same day, Boeing issued an Operations Manual Bulletin
(``OMB'') to the fleet calling attention to the airplane effects and
flight deck indications of the condition, and directing flight crews to
existing procedures to address it. Boeing also moved forward
expeditiously to develop an update to the MAX's flight control computer
software to eliminate the risk of erroneous AOA data leading to
repeated MCAS activation.
On November 7, 2018, a day after Boeing issued its OMB, the FAA
issued an Emergency Airworthiness Directive (``AD'') requiring airlines
to amend their Airplane Flight Manuals to include the OMB guidance. The
FAA also convened multiple Corrective Action Review Board (``CARB'')
meetings--the FAA's analog to Boeing's SRB process--starting in late
November to evaluate issues relating to the airplane effects of
erroneous AOA data and MCAS activation. Relying on the FAA's
independent risk analysis, the CARB process largely concurred with
Boeing's analysis of the safety issue and proposed risk mitigation
approach. Referencing the FAA's independent risk analysis, an FAA CARB
concluded in December 2018 that, as development of the software update
proceeded, the MAX fleet could continue operating until the new
software was implemented on the FAA-approved schedule.
Question 24. Following JT610 and prior ET302, why did Boeing fail
to immediately seek to fix MCAS based on a HAZARDOUS malfunction?
Answer. As described above in response to Question 23, following
the crash of JT610, Boeing immediately followed its safety process to
determine the appropriate response. As a result of that process, Boeing
took steps in conjunction with the FAA to develop and implement a
software update to the flight control computer in order to eliminate
the risk of erroneous AOA data leading to repeated MCAS activation. The
FAA determined that Boeing should implement the software update more
quickly than Boeing originally proposed, and Boeing accepted the FAA's
schedule.
Question 25. Given the centrality of the Speed Trim System to these
matters, please address the following questions:
Yes or no, is the implementation of the Speed Trim System on
the Boeing 757 fail-safe, dual-input and dual-processor design
with aft column cutout switch active?
Yes or no, is the implementation of the Speed Trim System on
the Boeing 747-400 fail-safe, dual-input and dual-processor
design with aft column cutout switch active?
Yes or no, is the implementation of the Speed Trim System on
the Boeing 737-700 fail-safe, dual-input and dual processor
design with aft column cutout switch active?
If the answer to any of the above three questions is ``no,''
please provide a detailed explanation.
Answer. The Speed Trim System as currently implemented on all the
listed models meets all regulatory requirements, and ensures any single
failure of the system does not affect the ability of the aircraft to
maintain safe flight and landing. The design for each model is dual-
processor, but it is not dual-input. The aft column cutout switch is
active in each design, though the amount of movement required to
activate it varies between models.
Question 26. Yes or no, even though the 737 Speed Trim System is a
single threaded design augmentation system that has full control of the
stabilizer, does the 737 Speed Trim System survive without greater
hazard classification because active aft and forward column cutout
switches constrain malfunction?
Answer. Hazard classifications are applied to particular failure
modes of a system, not the system itself. There are failure modes of
the Speed Trim System (STS), such as a stabilizer runaway driven by the
flight control computer, which can be mitigated by the column cutout
switches. However, other failure modes of the STS do not rely on those
switches for mitigation. The classification of each hazard depends on
the specific circumstances of that failure. None of the hazard
assessments for MCAS relied on engaging the aft column cutout switch.
Question 27. One of your primary competitors appears to require
testing the angle of attack sensor reading at 80 to 100 knots in the
takeoff roll when the relative wind reliably aligns the vane to the
expected angle of incidence. Will Boeing upgrade Flight Crew Operating
Manuals to require such a test during the takeoff roll?
Answer. No. Boeing airplanes already electronically conduct similar
checks. The results of those checks are captured and documented to
ensure they are addressed by maintenance personnel. With the upgrades
to MCAS that will be implemented as part of return to service, if the
two AOA vanes on the 737 MAX disagree by more than 5.5 degrees, MCAS
will be disabled for the remainder of the flight and pilots will be
alerted that speed trim is inoperative. Boeing is continually working
to develop ways to increase safety during all phases of flight,
including takeoff.
Question 28. On May 17, 2019, I submitted the follow oversight
question to the Boeing Company:
``On what date did Boeing first provide the Flight
Standardization Board (FSB) with information on the addition of
the Maneuvering Characteristics Augmentation System (MCAS)
flight control law to the 737 MAX series aircraft to comply
with Federal Regulation 25.203--Stall characteristics,
paragraph (a)?''
Boeing provided the following response:
``Boeing briefed FAA personnel involved in the FSB process for
the 737 MAX about MCAS at least as early as 2012. In the spring
of 2014, Boeing and the FAA began more formal discussions about
how the FSB process for the 737 MAX would proceed. During this
time, Boeing provided the FAA technical briefings on MCAS among
other aspects of the evolving airplane design. Following the
process set forth in FAA guidance, in February 2015 Boeing
submitted a preliminary draft of the Master Differences
Requirements and Design Operator Differences Requirements (ODR)
tables to the FAA for evaluation. Boeing included MCAS as one
of dozens of airplane features in the draft ODR table.''
I also posed this question to Boeing:
``Please confirm whether Boeing ever recommended that the FSB
evaluate the differences between the Speed Trim System (STS) in
the 737 NG series and the STS in 737 MAX series that also has
MCAS installed, and if so, the earliest date upon which Boeing
advised the FSB to evaluate MCAS when conducting the
differences assessment.''
Boeing provided the following response:
``As explained in the response to Question #1, Boeing briefed
FAA personnel involved in the FSB process about MCAS at least
as early as 2012. MCAS is an extension of the pre-existing
Speed Trim function, which helps stabilize airplane speed by
commanding stabilizer in the direction to oppose a speed
change, and which has been used safely on 737 series airplanes
for decades. Following a series of technical briefings on MCAS
and other airplane features in 2014, in February 2015 Boeing
submitted a preliminary draft of the Master Differences
Requirements and Design Operator Differences Requirements (ODR)
tables to the FAA for evaluation. Boeing included MCAS as one
of dozens of airplane features in the draft ODR table.
Ultimately, the versions of the FSB report that the FAA posted
for public comment and finalized in 2017 did not include MCAS
in the ODR table.''
Please explain why Boeing chose not to use either response as an
opportunity to share with my office the fact that Boeing proposed
removing MCAS from the ODR table.
Answer. As we stated in response to Question No. 1 on May 17, 2019,
MCAS was included in the preliminary procedures and ODR tables that
were sent to the FAA in February 2015. Boeing recommended removal of
MCAS from the ODR Table in March 2016 and FAA agreed with Boeing's
recommendation. Boeing exchanged multiple drafts of the ODR Table with
the FAA throughout 2016 and 2017 and the versions of the FSB report
that the FAA posted for public comment and finalized in 2017 did not
include MCAS in the ODR Table.
Question 29. Beyond MCAS, what other issues related to aircraft
systems worry you and require improvement? For example, is Boeing
planning to make the Speed Trim System fail-safe on the 737 NG?
Answer. Boeing is continually evaluating the performance of its
aircraft. As part of that process, Boeing identifies appropriate
enhancements to those aircraft, and will continue to do so. The Speed
Trim System as currently implemented meets all regulatory requirements,
and any single failure of the system does not affect the ability of the
aircraft to maintain safe flight and landing.
______
Response to Written Questions Submitted by Hon. Kyrsten Sinema to
Dennis Muilenburg
The Boeing 737 Max 8 received a derivative type certificate from
the FAA, which was based on the original type certificate the Boeing
737-100 from 1967.
The original 737-100 was a very different aircraft. It was 94 feet
long, carried 115 passengers, required three pilots, and had a maximum
takeoff weight of 42,000 kilograms. The current versions of the 737 MAX
can be up to 50 percent longer, carry twice as many passengers, and
have double the maximum takeoff weight.
The FAA states that getting an amended type certificate can take up
to 5 years, but a new type certificate, which is a more detailed
analysis, can take up to 9 years.
Question 1. Based on the significant changes in the aircraft since
1967, do you believe that an amended type certificate was appropriate
for the Boeing 737 Max 8? And going forward, do you believe FAA should
limit the number of times an aircraft design can be amended before a
new type certificate is required?
Answer. An amended type certificate was appropriate for the Boeing
737 MAX 8. Building upon existing, safe designs with a proven track
record has continuously improved the safety record of the aviation
industry for decades. As with all airplane development decisions, we
make such decisions deliberately and methodically, after studying the
current state of technology and opportunities for improving the
existing airplane architecture, among many other factors.
The FAA has robust regulations and processes for evaluating when an
airplane should be a new or amended type certificate and what
regulations to follow for each process. The MAX certification project
followed these regulations. Setting an arbitrary limit on the number or
timing of changes to an airplane does not advance the interest of
safety.
The United States has the best airline pilots in the world, and I
believe the quality of our pilots is the reason that U.S. commercial
aviation is the safest in the world.
But all pilots, regardless of experience or nationality, need all
the information about the aircraft to be able to make the right
decisions.
Boeing pilot manuals did not reference MCAS or describe an
autonomous system to repeatedly lower the nose by 2.5 degrees. But
Boeing's safety analysis expected pilots to be the primary backup for
the system, if it failed. The pilots cannot be the backup for a system,
if they aren't informed that the system exists, and it operates in the
background without their knowledge.
Question 2. Please explain Boeing's decision not to include MCAS in
the pilot manual or pilot training, and discuss Boeing's future plans
to fully inform pilots about background systems.
Answer. In accordance with FAA regulatory guidance, flight training
for all Boeing airplanes, including the 737 MAX, is designed to give
pilots the knowledge, skills, and abilities necessary to safely operate
each model on which they are licensed (or ``type-rated''). Rather than
diagnose particular failures, flight training and manuals are designed
to give pilots the knowledge, skills, and abilities necessary to safety
respond to those failures.
Boeing and the FAA coordinated closely over the course of several
years in developing the necessary training requirements and flight
manual content for the MAX. Since the accidents, the FAA and Boeing
have worked together to develop additional MAX flight crew training, as
well as flight manual content, that addresses the updates Boeing has
made to MCAS. The inclusion of specific training and flight manual
content on MCAS is consistent with the feedback Boeing has received
from pilots and its customers, and reflects the additional knowledge
and understanding that Boeing has gained as a result of these
accidents.
In designing aircraft, redundancy is key. The FAA requires aircraft
systems that can cause hazardous or catastrophic failure to incorporate
multiple levels of redundancy. This way, if FAA requirements are met,
no single malfunction can lead to tragedy.
However, the MCAS system on the Boeing 737 Max 8 had zero
redundancy. A single faulty or damaged angle-of-attack sensor could
cause the MCAS system to engage repeatedly, as was the case for the
tragedies in Indonesia and Ethiopia.
These disclosures are leading many to consider revisions to the
FAA's Organization Designation Authorization (ODA) program. As you
know, the FAA uses the ODA program to authorize organizations or
companies to approve certain aspects of FAA aircraft certification.
The DOT Special Committee is making recommendations on FAA
certification, but I expect that Boeing has undertaken its own internal
review of ODA and the necessary changes.
Question 3. Based on the Boeing 737 Max 8 tragedies, what concrete
revisions to the ODA program are required to ensure that only safe
aircraft are certified to fly?
Answer. Boeing strongly supports robust FAA oversight of the
certification process. As the last major commercial airplane
manufacturer in the United States, Boeing believes the certification
process, and the FAA's role in that process, are vital to the safety of
the traveling public, and have been an important factor driving
substantial improvements in aviation safety in recent decades.
The Organization Delegation Authority process has helped improve
that safety record. However, there are ways to improve that process.
For example, the FAA's System Oversight capability could be
strengthened by setting clear expectations for applicants' processes
and procedures to ensure compliance for lower risk areas, as identified
by the FAA. This would allow FAA to dedicate the majority of its
resources on areas the FAA has determined to be the highest safety
risk. Boeing will work with all interested stakeholders to learn from
these accidents and further increase aviation safety.
During flight testing, Boeing increased the MCAS system from
providing a 0.6 degree nose-down correction to a 2.5 degree nose-down
correction--without FAA oversight.
And according to reports, once MCAS was adjusted to provide a more
powerful input, Boeing never flight-tested a scenario in which a broken
angle-of-attack sensor triggered MCAS on its own, instead relying on
simulator analysis.
Former Boeing test pilots described a culture of pressure inside
the company to limit flight testing, due to project delays. And in the
text messages Boeing released last week, an employee stated: ``they're
all so damn busy, and getting pressure from the program.''
Question 4. Was there adequate flight testing of the revised MCAS
system, and what will Boeing do to address schedule pressure to get
aircraft certificated?
The first tragic crash, involving Lion Air Flight 610, occurred on
October 29, 2018. The second crash, involving Ethiopian Airlines Flight
302, occurred five months later.
Answer. The final MCAS design, including MCAS's operation at low
speeds, was tested in flight tests, where multiple conditions involving
the design were tested.
Boeing has taken a number of steps to reinforce our safety culture.
These include creating a permanent Aerospace Safety Committee within
our Board of Directors, creating a Product and Services Safety
organization to review all aspects of product safety, and realigning
our Engineering function so that all engineers will report directly to
the Chief Engineer. Moreover, pursuant to our Organization Delegation
Authority, Boeing maintains robust procedures for ODA unit members to
report incidents of undue pressure, and Boeing provides all employees
multiple avenues to raise safety issues related to our products.
Question 5. Why was the Boeing Max 8 not grounded after the Lion
Air crash and prior to the second crash in Ethiopia? What information
regarding the MCAS system did Boeing have prior to or immediately after
the first crash that lead to concerns related to the Angle of Attack
and MCAS system?
Answer. Boeing does not have the authority to ground airplanes.
Boeing does, however, provide civil aviation authorities and our
airline customers with any relevant information we may receive or
develop, so that they can make informed decisions on how to regulate
aircraft operations.
After the Lion Air crash, on Sunday, November 4, Indonesian
authorities provided Boeing with data downloaded from the airplane's
flight data recorder. That same day, Boeing convened an ``out-of-
sequence'' Safety Review Board (``SRB'') to consider and analyze the
available data. The SRB included subject matter experts from various
backgrounds, including senior Boeing engineers, test pilots, and
executives responsible for safety and regulatory matters. FAA
representatives were also in attendance. After considering the limited
information available, the SRB decided to defer a decision on the
potential safety issue for two days to allow time for Boeing engineers
and pilots to conduct further testing and analysis.
The SRB, with most of the same members present, reconvened on
November 6, 2018. The FAA was again in attendance. With the fuller
information then available, including additional analysis by Boeing's
technical experts and test pilot input, the SRB identified as a safety
issue the increased crew workload that might result if erroneous AOA
input led to repeated MCAS activation. Although a full quantitative
analysis of the issue had not yet been completed, the SRB made this
determination based on a preliminary risk assessment and in recognition
of the importance of immediately addressing the concerns identified.
The SRB further noted the importance of appropriate action by the
flight crew to prevent and counteract repeated MCAS activation in this
erroneous AOA scenario.
That same day, Boeing issued an Operations Manual Bulletin
(``OMB'') to the fleet calling attention to the airplane effects and
flight deck indications of the condition, and directing flight crews to
existing procedures to address it. Boeing also moved forward
expeditiously to develop an update to the MAX's flight control computer
software to eliminate the risk of erroneous AOA data leading to
repeated MCAS activation.
On November 7, 2018, a day after Boeing issued its OMB, the FAA
issued an Emergency Airworthiness Directive (``AD'') requiring airlines
to amend their Airplane Flight Manuals to include the OMB guidance. The
FAA also convened multiple Corrective Action Review Board (``CARB'')
meetings--the FAA's analog to Boeing's SRB process--starting in late
November to evaluate issues relating to the airplane effects of
erroneous AOA data and MCAS activation. Relying on the FAA's
independent risk analysis, the CARB process largely concurred with
Boeing's analysis of the safety issue and proposed risk mitigation
approach--although the FAA did determine that that Boeing should
implement the flight control computer software update more quickly than
Boeing had originally proposed, an accelerated schedule the Company
accepted. Re Referencing the FAA's independent risk analysis, an FAA
CARB concluded in December 2018 that, as development of the software
update proceeded, the MAX fleet could continue operating until the new
software was implemented on the FAA-approved schedule.
Question 6. And why did Boeing publish a supplementary service
bulletin regarding the Angle of Attack sensors and MCAS, but did not
take the aircraft out of service?
Answer. Please see the response to the previous question. Boeing
does not have the authority to ground airplanes. After the Lion Air
accident and continuing to today, Boeing provides civil aviation
authorities and our airline customers any relevant information we may
receive or develop, so that they can make informed decisions on how to
regulate aircraft operations.
Question 7. Do you disagree with any of the findings in the
National Transportation Safety Board in Aviation Safety Recommendation
Report ASR-19-01 issued on September 19, 2019 titled ``Assumptions Used
in the Safety Assessment Process and the Effects of Multiple Alerts and
Indications on Pilot Performance'' or audit report AV-2016-013 the
Inspector General of the Department of Transportation issued on January
7, 2016 titled ``Enhanced FAA Oversight Could Reduce Hazards Associated
With Increased Use of Flight Deck Automation?''
Answer. Boeing is deeply committed to the safety of its products
and the safety of the aviation system and values the role of the
National Transportation Safety Board (NTSB), as well as the reviews of
the Office of the Inspector General (OIG), in promoting aviation
safety.
Boeing has already undertaken steps that align with at least one of
the NTSB's recommendations. The NTSB recommended that FAA require
manufacturers to consider the way cockpit design can impact pilot
reaction to alerts and alarms that may sound in non-normal situations.
As a result of a recommendation from a special committee of Boeing's
Board of Directors, the company is already planning to work with our
airline customers to re-examine the way we design our cockpits, with
the goal of helping pilots to prioritize their attention and their
actions when faced with multiple alerts and alarms. Boeing is taking
this step with the recognition that pilot training and experience can
vary significantly in different regions of the world. Boeing will
continue to work with the NTSB, as well as the FAA, to understand the
scope of the NTSB's recommendations and the appropriate way to
implement them.
Boeing will also support the FAA as it implements the
recommendations from the OIG audit report from January 7, 2016. This
report recommends that the FAA develop new guidance for training and
standards to determine whether pilots receive sufficient training
opportunities to develop, maintain, and demonstrate manual flying
skills. Boeing continues to support the FAA's Air Carrier Training
Aviation Rulemaking Committee to discuss, prioritize, and provide
recommendations to the FAA concerning these types of operations and
training considerations.
______
Response to Written Questions Submitted by Hon. John Thune to
Hon. Robert L. Sumwalt III
Question 1. Your testimony mentioned the inadequacy of the MCAS
safety assessment in estimating the crew workload, since it is likely
other alerts and indications would be activated simultaneously in the
event of an MCAS failure.
The National Transportation Safety Board (NTSB) recommended that
the Federal Aviation Administration (FAA) instruct Boeing to better
consider crew workload in the event of a system failure, including
through the development of tools to improve the timeliness and
effectiveness of crew responses.
Do you believe that any of the recent organizational changes made
by Boeing will help address this recommendation?
Answer. The NTSB has not evaluated the recent organizational
changes made by Boeing.
Question 2. As you know, the aviation system is safer--and
catastrophic incidents rarer--than ever before, but the complexity of
aircraft flight control systems means that when failures do occur, it
can be difficult for crew members to prioritize the appropriate and
timely actions in response to that failure.
How could system failure diagnostic tools be better designed to
improve the threat and error management used by crew members in
responding to system failures?
Answer. The NTSB believes that aircraft systems designed to clearly
and concisely inform pilots of the highest priority actions when
multiple flight deck alerts and indications are present would minimize
confusion and help pilots respond most effectively to emergency and
abnormal operational events. By developing design standards for such
system diagnostic tools, with the input of industry and human factors
experts, we believe the timeliness and effectiveness of pilot response
would be improved.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Hon. Robert L. Sumwalt III
Question 1. The NTSB recommended that manufacturers use ``less
experienced'' pilots to test advanced equipment. Are you aware of any
resistance to this recommendation?
The NTSB concluded that a standardized methodology and/or tools for
manufacturers' use in evaluating and validating assumptions about pilot
recognition and response to failure condition(s), particularly those
conditions that result in multiple flight deck alerts and indications
is needed. Based on this, the NTSB recommended that the FAA develop
robust tools and methods, with the input of industry and human factors
experts, for use in validating assumptions about pilot recognition and
response to safety-significant failure conditions as part of the design
certification process. We are not aware of any resistance to
implementation of this recommendation.
Question 2. The Boeing 737 made its first flight in 1967 and has
applied for 14 model changes since that time. There have been calls for
a complete recertification of the entire 737. Do you agree that the
entire plane should be recertified?
The NTSB does not have a position on this.
______
Response to Written Question Submitted by Hon. Tammy Duckworth to
Hon. Robert l. Sumwalt III
As you are aware, problems originating with a damaged or
malfunctioning angle of attack (AOA) sensor are not limited to any
single model of aircraft or manufacturer. Enhancing AOA sensors must be
a priority for the entire aviation industry and regulatory system.
Increasing awareness and improving knowledge represent critical tools
in improving aviation safety.
That is why I wrote to then-Acting Administrator Elwell on May 21,
2019 to request that FAA publish a comprehensive advisory circular that
standardizes guidance on best practices for manufacturing, operating,
testing and maintaining AOA sensors, particularly the AOA wind vane
component, to ensure effective compliance with all applicable
regulatory requirements.
Following the FAA's order revoking a repair station certificate
from a firm that repaired and supplied the malfunctioning AOA sensor
that contributed to the fatal crash of Lion Air Flight 610, I once
again wrote to FAA Administrator Dickson to request that FAA publish a
comprehensive advisory circular that standardizes guidance on best
practices for manufacturing, operating, testing and maintaining AOA
sensors, particularly the AOA wind vane component, to ensure effective
compliance with all applicable regulatory requirements.
Awareness and knowledge are critical tools in strengthening
aviation safety.
Question. Please address how the potential publication of the type
of comprehensive advisory circular that I have requested would improve
aviation safety.
The NTSB has not issued any recommendations regarding design,
manufacturing, operating, testing or maintaining of AOA sensors
and therefore does not have a position on this matter.
However, the Komite Nasional Keselamatan Transportasi (KNKT) of
Indonesia has issued one related recommendation based on its
investigation of the Lion Air 610 crash.\1\
---------------------------------------------------------------------------
\1\ Komite Nasional Keselamatan Transportasi (KNKT), Final Report
No. KNKT.18.10.35.04.
04.R-2018-35.22
The absence of equivalency assessment required by Xtra
Aerospace procedure and unavailability of procedure was
not detected by the FAA. This indicated inadequacy of
the FAA oversight.
Therefore, KNKT recommends that the FAA improves the
oversight to Approved Maintenance Organization (AMO) to
ensure the processes within the AMO are conducted in
accordance with the requirements.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Hon. Christopher A. Hart
Question 1. Chairman Hart, in the JATR report, there was discussion
of the undue pressure placed on employees at Boeing to pressure to
employees get the plane certified without any new pilot training or
delay. Boeing has said it is restructuring its units, and safety
engineers will no longer be required to report directly to a business
unit manager. Do you believe this change will relieve some pressure on
employees?
Answer. Because of concerns about potential undue influence, the
JATR recommended that the FAA review its certification process, as well
as Boeing's Organization Designation Authorization (ODA) procedures and
work environment, to ensure that there is no undue pressure (e.g.,
Recommendation 5). Whether a specific substantive change will be
helpful is beyond the purview of the JATR because it completed its
review when it submitted its recommendations to the FAA, and it was
chartered to review the certification process rather than specific
substantive changes. I am not in a position to opine about the
effectiveness of specific proposed substantive changes.
Question 2. Are there other changes that Boeing should make?
Answer. The JATR's recommendations were addressed to the FAA, not
to Boeing, and were about how the FAA could improve its certification
process. Although the JATR's improvement recommendations included
recommendations to the FAA to review Boeing's processes and procedures,
the JATR was chartered to review the certification process rather than
specific substantive changes. Examples of Boeing's processes and
procedures that the JATR recommended the FAA should review include Rec
5 (ODA work environment and procedures manual), Rec 8.1 (development
assurance process), Rec 8.2 (safety analysis process), Rec 8.4 (process
for managing assumptions), and Rec 8.6 (process for managing
requirements).
Question 3. How can we ensure that pilots are fully prepared for
the high-levels of automation in today's cockpits?
Answer. The JATR's recommendations address two aspects of helping
to optimize airplane/pilot interactions. First, the recommendations
address ways that the certification process can help ensure that
aircraft systems are designed to be adequately pilot-friendly, e.g.,
Rec 2.2, Rec 2.4, Rec 2.7, Rec 2.8, Rec 2.9, Rec 3.8, Rec 3.16, Rec
3.17, Rec 6.1, Rec 6.2, Rec 6.3, Rec 6.4, Rec 6.6, Rec 6.8, Rec 6.9,
Rec 6.10, Rec 7.1, Rec 7.2, Rec 8.8, Rec 9.6, and Rec 9.7. Second, the
recommendations address ways that the certification process can help
ensure that, upon completion of the design, pilots are aware of, and
adequately trained regarding, the aircraft automation and other
systems, e.g., Rec 3.9, Rec 3.11, Rec 3.14, Rec 9.1, Rec 9.2, Rec 9.3,
Rec 9.4, Rec 10.2, Rec 10.3, Rec 10.4, Rec 10.5, and Rec 12.2.
[all]