[Senate Hearing 116-616]
[From the U.S. Government Publishing Office]



                                                        S. Hrg. 116-616

                    AVIATION SAFETY AND THE FUTURE 
                          OF BOEING'S 737 MAX

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                               __________

                            OCTOBER 29, 2019

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation





                  [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]







                Available online: http://www.govinfo.gov


                              ______
                                 

                 U.S. GOVERNMENT PUBLISHING OFFICE

52-795 PDF                WASHINGTON : 2023












       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                  ROGER WICKER, Mississippi, Chairman

JOHN THUNE, South Dakota             MARIA CANTWELL, Washington, 
ROY BLUNT, Missouri                      Ranking
TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska                RICHARD BLUMENTHAL, Connecticut
JERRY MORAN, Kansas                  BRIAN SCHATZ, Hawaii
DAN SULLIVAN, Alaska                 EDWARD MARKEY, Massachusetts
CORY GARDNER, Colorado               TOM UDALL, New Mexico
MARSHA BLACKBURN, Tennessee          GARY PETERS, Michigan
SHELLEY MOORE CAPITO, West Virginia  TAMMY BALDWIN, Wisconsin
MIKE LEE, Utah                       TAMMY DUCKWORTH, Illinois
RON JOHNSON, Wisconsin               JON TESTER, Montana
TODD YOUNG, Indiana                  KYRSTEN SINEMA, Arizona
RICK SCOTT, Florida                  JACKY ROSEN, Nevada

                       John Keast, Staff Director
                  Crystal Tully, Deputy Staff Director
                      Steven Wall, General Counsel
                 Kim Lipsky, Democratic Staff Director
              Chris Day, Democratic Deputy Staff Director
                      Renae Black, Senior Counsel











                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on October 29, 2019.................................     1
Statement of Senator Wicker......................................     1
Statement of Senator Cantwell....................................     3
Statement of Senator Thune.......................................    13
Statement of Senator Klobuchar...................................    15
Statement of Senator Fischer.....................................    16
Statement of Senator Blumenthal..................................    18
    Poster submitted by Hon. Richard Blumenthal entitled, ``MCAS 
      lives in both FCCs''.......................................    20
Statement of Senator Moran.......................................    21
Statement of Senator Peters......................................    23
Statement of Senator Capito......................................    24
Statement of Senator Udall.......................................    26
Statement of Senator Markey......................................    28
Statement of Senator Duckworth...................................    29
    Report dated October 28, 2019 entitled, ``Flawed Assumptions 
      Pave a Path to Disaster'' by Peter Lemme...................    70
Statement of Senator Cruz........................................    31
    Poster submitted by Hon. Ted Cruz............................    33
Statement of Senator Tester......................................    33
Statement of Senator Johnson.....................................    35
Statement of Senator Rosen.......................................    37
Statement of Senator Blunt.......................................    39
Statement of Senator Blackburn...................................    40
Statement of Senator Scott.......................................    42
Statement of Senator Sullivan....................................    43

                               Witnesses

Dennis Muilenburg, President And Chief Executive Officer, The 
  Boeing Company.................................................     5
    Prepared statement...........................................     7
Hon. Robert L. Sumwalt III, Chairman, National Transportation 
  Safety Board...................................................    45
    Prepared statement...........................................    46
Hon. Christopher A. Hart, Chairman, Joint Authorities Technical 
  Review (JATR)..................................................    58
    Prepared statement...........................................    60

                                Appendix

Response to written questions submitted to Dennis Muilenburg by:
    Hon. Roger Wicker............................................   127
    Hon. John Thune..............................................   129
    Hon. Jerry Moran.............................................   130
    Hon. Maria Cantwell..........................................   130
    Hon. Amy Klobuchar...........................................   139
    Hon. Richard Blumenthal......................................   140
    Hon. Tom Udall...............................................   143
    Hon. Tammy Duckworth.........................................   144
    Hon. Kyrsten Sinema..........................................   150
Response to written questions submitted to Hon. Robert L. Sumwalt 
  III by:
    Hon. John Thune..............................................   153
    Hon. Tom Udall...............................................   154
    Hon. Tammy Duckworth.........................................   154
Response to written questions submitted to Hon. Christopher A. 
  Hart by:
    Hon. Tom Udall...............................................   155










 
                    AVIATION SAFETY AND THE FUTURE 
                          OF BOEING'S 737 MAX

                              ----------                              


                       TUESDAY, OCTOBER 29, 2019

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 10:06 a.m., in 
room SH-216, Hart Senate Office Building, Hon. Roger Wicker, 
Chairman of the Committee, presiding.
    Present: Senators Wicker [presiding], Thune, Blunt, Cruz, 
Fischer, Moran, Sullivan, Gardner, Blackburn, Capito, Johnson, 
Young, Scott, Cantwell, Klobuchar, Blumenthal, Markey, Udall, 
Peters, Baldwin, Duckworth, Tester, Sinema, and Rosen.

            OPENING STATEMENT OF HON. ROGER WICKER, 
                 U.S. SENATOR FROM MISSISSIPPI

    The Chairman. This hearing will come to order. Thank you 
all for being here today. One year ago, today, Lion Air Flight 
610 crashed into the sea shortly after takeoff from Jakarta, 
Indonesia. All 189 people onboard perished. Five months later, 
Ethiopian Airlines Flight 302 departed Addis Ababa, Ethiopia. 
Just like Lion Air Flight 610, Ethiopian Airlines Flight 302 
experienced problems shortly after takeoff and crashed. All 157 
persons onboard died. Both of these accidents were entirely 
preventable.
    We cannot fathom the pain experienced by the families of 
those 346 human beings who were lost. Many family members are 
here today, and we appreciate their attendance, and I 
appreciate many of them meeting with members of the Committee 
over time.
    As Chairman of this Committee, I promise their loved ones 
that we are working to obtain a full answer as to how to 
prevent future tragedies. These families deserve answers, 
accountability, and action--and the public deserves to know 
this. The type of aircraft involved in both accidents is the 
737 MAX 8 manufactured by Boeing. International aviation safety 
regulators began grounding the MAX the day after the Ethiopian 
crash.
    On March 13, the Federal Aviation Administration formally 
grounded the aircraft in the United States. The MAX's return to 
service is contingent on Boeing's work with the FAA to test and 
certify fixes to the MCAS flight-control system, which 
activated during both crashes. In order for the MAX to return 
to service, international regulators also need to be satisfied 
that it is safe to fly. As the certification process continues, 
many questions remain about Boeing's actions and the FAA's 
actions during the design, development, and certification 
processes, as well as the operation of the MAX.
    Today's hearing is divided into two panels. Let me note for 
Senators that the Committee will follow regular order of 
recognition for both panels. The five-minute rule will be 
observed strictly because we have so many people who wish to 
participate. On the first panel, Dennis Muilenburg, President 
and CEO of Boeing, will testify on behalf of the aircraft 
manufacturer. He is accompanied by John Hamilton, Chief 
Engineer for Boeing Commercial Airplanes, who will provide 
technical expertise.
    Our second panel will examine these issues from the 
Government's perspective. The witnesses today include National 
Transportation Safety Board Chairman Robert Sumwalt, and 
Chairman of the Joint Authorities Technical Review, or JATR, 
Chris Hart. Chairman Sumwalt oversees NTSB, which recently 
released a report and recommendations regarding the MAX 
certification. Chairman Hart led the JATR, an FAA-commissioned 
body that included the FAA, NASA, and nine foreign aviation 
safety authorities tasked with reviewing the MAX's flight 
control systems.
    The JATR has submitted a broad range of recommendations to 
the FAA. Let me note that Chairman Hart has extensive past 
Government service in aviation safety, but he is a private 
citizen, today, who agreed to lead the JATR. We have many 
concerns that Boeing should address today. We need to know if 
Boeing and the FAA rushed to certify the MAX. In particular, 
critics have focused on the MCAS development and testing. The 
JATR criticized Boeing's communication with the FAA on MCAS's 
development, particularly after the system was modified to 
activate at lower airspeeds.
    The JATR also criticized the FAA for relying on outdated 
regulations, guidance, and certification procedures, and 
failing to incorporate realistic human behavior factors into 
its assumptions. The NTSB also called into question Boeing and 
FAA's assumptions about pilot reaction during MCAS activation. 
These questions were especially important for stressful 
situations with multiple alerts going off in the cockpit.
    Our witnesses should address the company and the safety 
regulators' actions regarding MAX certification in general and 
MCAS in particular. The process for certifying the MAX 
necessitated a close partnership between Boeing and the FAA. 
Under a decades-old system called Organization Designation 
Authorization, or ODA, the FAA has delegated certain 
certification activities to the ODA holder, in this case 
Boeing. While the ODA has been used to certify many aircraft 
over the years, some have criticized the system for permitting 
an inappropriately close relationship between companies and 
their safety regulator. Indeed, e-mail correspondence, dating 
from as early as 2015, between the MAX's former Chief Technical 
Pilot, Mark Forkner, and FAA personnel released on October 18 
reflect a disturbing level of casualness and flippancy that 
seem to corroborate these criticisms.
    I was disappointed to learn of a November 2016 instant 
messenger conversation between Mr. Forkner and a colleague, in 
which he acknowledged misinforming the FAA. Boeing should have 
notified the FAA about that conversation immediately upon its 
discovery. Although the FAA is not testifying today, let me 
express my frustration with the agency's lack of responsiveness 
to my requests dating back to April of this year for documents 
relevant to the 737 MAX as part of the investigation that I 
opened, as Chairman, based on whistleblower disclosures.
    The relationship between regulating agencies and 
organizations they regulate is important, but so are the 
internal reforms that Boeing is implementing. Witnesses should 
provide their views on the ODA system and whether or not 
reforms are needed. I invite Mr. Muilenburg to describe the 
steps Boeing is taking to improve aviation safety and to ensure 
that technical experts never experience undue pressure to put 
profits and relationships ahead of safety. The Committee's 
oversight is not limited to past actions. The reviews by both 
JATR and NTSB note that future aircraft systems are likely to 
be even more complex and interdependent than current models. 
Managing interfaces between humans and machines will become 
even more important as automation increases. At the same time, 
commercial aviation is set to continue expanding around the 
globe.
    Many future pilots will fly in countries without the same 
training requirements and safety standards that we have in the 
United States. We welcome the witnesses' thoughts on how to 
improve design, development, and certification in the future to 
account for these major changes. This hearing will by no means 
be the end of our inquiry. Additional oversight hearings will 
be held. The Committee will carefully review the final Lion Air 
report, which was released on Friday, as well as the Ethiopian 
Airlines report, which is forthcoming.
    The Committee also will consider the findings and 
recommendations from JATR, NTSB, and all other investigations 
and reviews. I now recognize the distinguished Ranking Member, 
Senator Cantwell, for her opening statement.

               STATEMENT OF HON. MARIA CANTWELL, 
                  U.S. SENATOR FROM WASHINGTON

    Senator Cantwell. Thank you, Mr. Chairman, and thank you 
for this important hearing. I too want to take a moment and 
recognize the families who have lost loved ones in both the 
Ethiopian Airlines and Lion Air tragedies, some of whom are 
here with us today. I cannot imagine the loss and the enduring 
pain that you must feel. I thank you for your vigilance on this 
issue, just as we have seen the families of the Colgan Air 
flight vigilance help us improve safety for the future.
    Right now, Mr. Muilenburg, these families, millions of 
airline passengers, and over 150,000 aerospace workers want to 
know what we're doing to fix what went wrong and what did go 
wrong. To date, we have not gotten all those answers. Hopefully 
today's hearing will help provide some. But one thing is 
crystal clear, if you want to be the leader in aviation 
manufacturing, you have to be the leader in aviation safety. 
Aviation demand, especially for 737s and single-aisle planes is 
exploding to 101 percent growth over the next 10 years--
something like 35,000 planes and $3 trillion. I think that is 
actually 20 years. But we cannot have a race for commercial 
airplanes become a race to the bottom when it comes to safety. 
The company, the Board, cannot prioritize profits over safety.
    Safety always has to be job one. So, it is troubling to 
hear that Boeing may have skirted the FAA certification process 
over a desire by airlines to have more fuel-efficient planes 
but without pilot training. Now this issue of lowering 
standards is permeating through all of aviation. We are dealing 
with it here in the Committee. My Democratic colleagues have 
led the charge to try to stop companies coming here to say they 
do not want to have the same training for co-pilots on the 
regional jets because they do not have enough pilots. Or the 
issue my colleague has championed on rest requirements for 
cargo pilots having the same requirements for rest as passenger 
planes.
    Thank God Captain Sullenberger, the hero of the Hudson, 
made it clear, when you are in an emergency, the pilot and co-
pilot do not have time, a lot of time, to communicate. So that 
is why today we need answers to how the first 737 MAX 
certification process was done, and we especially need 
transparency on this process of review before the 737 MAX is 
put in the air again. The public needs to know and fully 
understand what testing, what review, what processes were 
conducted both by Boeing and the FAA before this plane is put 
back in the air.
    We also want to know today about Boeing's safety culture, 
whether Boeing employees raised safety concerns that were not 
listened to, whether there was enough testing and complex 
system integration and information into a cockpit alert system 
that we now all know was flawed, and whether there was even 
enough data presented to the FAA. These are all questions that 
are important, including outsourcing of engineering and coding. 
There are many questions about software and cockpit automation 
and overload.
    I guarantee you the FAA codes and laws are clear when it 
comes to the standards for certification. Yes, software and 
automation, flight training, better rest requirements for 
pilots have all led to 10 years between 2009 to 2018 as the 
safest 10 years in aviation history. But, more software and 
more automation without robust third-party testing and 
validation will lead us to where we are today. We should note 
that the last five aviation accidents have all involved this 
issue of automation and pilot response to automation. Whether 
it is Lion Air, Ethiopian, the Asiana, the French, or Qantas 
330 accidents, they were all in response to an automation in a 
command and response from the pilot.
    So that is why last week I introduced legislation with my 
colleagues Senator Duckworth and Senator Blumenthal to 
implement the recommendations of the NTSB safety board and the 
Inspector General report on better safety management systems, 
better cockpit prioritization, and a new FAA Center of 
Excellence on flight automation and human factors. The FAA 
needs the best engineers to understand the engineering 
challenges of the future and stay ahead on this human behavior 
response to new automation.
    We are dealing--I see people here on the transportation, 
automobile side. It is the same issue in advanced vehicles, 
what automation exists and how do humans respond to it? So, I 
also look forward to hearing from Chairman Sumwalt and Chris 
Hart about their findings on improving the safety review 
process that we have included in this legislation. I will just 
say again, our sorrows are nothing like the families who are 
with us today, but I do want to note that 737 MAX accidents 
have struck at the heart of everyone in the Northwest.
    Soon after the Ethiopian crash, a Seattle firefighter 
approached me and asked if I thought he could get a job at 
Boeing. He said, I just want to go there and make sure we get 
the safety right. Everyone feels that way. Generations of 
workers in the Pacific Northwest have dedicated their lives to 
aviation excellence and safety, and that spirit lives on in 
Everett and Renton.
    So, this is not a question about line workers, this is a 
question about the corporate view from Chicago, whether there 
is enough attention to manufacturing and certification. You 
should take, you know, offense to the fact that people say it 
is a great company not being run correctly.
    So, for the 346 people who trusted Boeing without a second 
thought, we need to get this right. These families are counting 
on us. Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator Cantwell. Mr. Muilenburg, 
you have submitted an extensive written statement. It will be 
entered in full in the record at this point. You are now--and I 
understand Mr. Hamilton will not be making a formal statement. 
So, Mr. Muilenburg, you are recognized at this point to 
summarize your opening statement for five minutes. Thank you 
for being here.

         STATEMENT OF DENNIS MUILENBURG, PRESIDENT AND

          CHIEF EXECUTIVE OFFICER, THE BOEING COMPANY;

        ACCOMPANIED BY JOHN HAMILTON, VICE PRESIDENT AND

          CHIEF ENGINEER, BOEING COMMERCIAL AIRPLANES

    Mr. Muilenburg. Chairman Wicker, Ranking Member Cantwell, 
committee members, thank you for the opportunity to join you 
today and that we share your commitment to aviation safety. 
Before we start today, I would like to speak directly to the 
families of the victims that are here with us. On behalf of 
myself and the Boeing Company, we are sorry, deeply and truly 
sorry.
    As a husband and father, myself, I am heartbroken by your 
losses. I think about you and your loved ones every day, and I 
know our entire Boeing team does as well. I know that probably 
does not offer much comfort and healing at this point, but I 
want you to know that we carry those memories with us every 
day, and every day that drives us to improve the safety of our 
airplanes and our industry and that will never stop.
    I am grateful and humbled to be here today and to be able 
to say these words to the families directly, and I want to 
convey our absolute commitment to safety, our commitment to 
learning, our commitment to rebuilding the public's confidence 
in what we do, and to preventing accidents like this from ever 
ever happening again. We will never forget and that is our 
commitment going forward.
    Mr. Chairman, I know this Committee has many questions 
about the MAX. We will do our best today to answer all of those 
questions. While one of the accidents is still under 
investigation, we know both accidents involve the repeated 
activation of a flight control system called MCAS, which 
responded to erroneous signals from a sensor that measures the 
airplane's angle of attack. Based on that, we have enhanced 
MCAS in three ways. First, it will now compare information for 
both sensors instead of one before activating.
    Second, MCAS will only activate a single time. And third, 
MCAS will never provide more input than a pilot can counteract 
using the control column alone. Pilots will also continue to 
have the ability to override MCAS at any time. We brought the 
best of Boeing to this effort. We spent over 100,000 
engineering and test hours, we have flown more than 800 test 
flights, we conducted simulator sessions with 545 participants 
from 99 customers and 41 global regulators. I have flown on a 
couple of flights myself.
    This has taken longer than expected but we are committed to 
getting it right. During this process, we worked closely with 
the FAA and other regulators, we provided them documentation, 
had them fly the simulators, answered their questions, and 
regulators around the world should rigorously scrutinize the 
MAX and only approve its return to flight when they are 
completely satisfied with its safety. The public deserves 
nothing less. Mr. Chairman, today and everyday over 5 million 
people will board a Boeing airplane and fly safely to their 
destination. Decades of cooperation and innovation by industry 
and regulators and the rigorous oversight of this Committee 
have reduced accidents by more than 95 percent over the last 
twenty years, but no number other than zero accidents is ever 
acceptable. We can and must do better.
    We have been challenged and changed by these accidents. We 
have made mistakes and we got some things wrong. We are 
improving and we are learning, and we are continuing to learn. 
We established a permanent airspace safety committee of our 
Board. We stood up a new safety organization. We strengthened 
our engineering organization so that all engineers now report 
up through Boeing's Chief Engineer. We are also helping to 
rebuild the communities and families impacted by these 
accidents. We pledged $100 million to this effort and have 
hired renowned experts in this area to ensure families can 
access these funds as quickly as possible. No amount of money 
can bring back what was lost but we can at least help the 
families meet their financial needs.
    Mr. Chairman, I started at Boeing more than 30 years ago as 
a summer intern in Seattle. I was a junior at Iowa State 
University studying engineering having grown up on a family 
farm in Iowa. I was awestruck to work at the company that 
brought the jet age to the world and helped land a person on 
the moon. Today I am still inspired by what Boeing does and by 
the remarkable men and women who are committed to its 
outstanding legacy but these heartbreaking accidents and the 
memories of the 346 lives lost are now part of that legacy. It 
is our solemn duty to learn from them and we will.
    Recently there has been much criticism of Boeing and our 
culture. We understand and deserve this scrutiny, but I know 
the people at Boeing. They are more than 150,000 of the most 
dedicated, honest, hard-working men and women in the world, and 
their commitment to safety, quality, and integrity is 
unparalleled and resolute.
    We will stay true to those values because we know our work 
demands the utmost excellence. Mr. Chairman.
    [The prepared statement of Mr. Muilenburg follows:]

Prepared Statement of Dennis Muilenburg, President and Chief Executive 
    Officer, The Boeing Company; Accompanied by John Hamilton, Vice 
       President and Chief Engineer, Boeing Commercial Airplanes
    Chairman Wicker, Ranking Member Cantwell, members of the Committee: 
good morning and thank you for inviting me to be here today.
    I'd like to begin by expressing my deepest sympathies to the 
families and loved ones of those who were lost in the Lion Air Flight 
610 and Ethiopian Airlines Flight 302 accidents, including those who 
are here in the room today. I wanted to let you know, on behalf of 
myself and all of the men and women of Boeing, how deeply sorry I am. 
As we observe today the solemn anniversary of the loss of Lion Air 
Flight 610, please know that we carry the memory of these accidents, 
and of your loved ones, with us every day. They will never be 
forgotten, and these tragedies will continue to drive us to do 
everything we can to make our airplanes and our industry safer.
    Mr. Chairman, I know that you and your colleagues have many 
questions about the 737 MAX. My colleague John Hamilton, Chief Engineer 
for Boeing Commercial Airplanes, and I will do our best today to answer 
them. While the Ethiopian Airlines accident is still under 
investigation by authorities in Ethiopia, we know that both accidents 
involved the repeated activation of a flight control software function 
called MCAS, which responded to erroneous signals from a sensor that 
measures the airplane's angle of attack.
    Based on that information, we have developed robust software 
improvements that will, among other things, ensure MCAS cannot be 
activated based on signals from a single sensor, and cannot be 
activated repeatedly. We are also making additional changes to the 737 
MAX's flight control software to eliminate the possibility of even 
extremely unlikely risks that are unrelated to the accidents.
    We have brought the very best of Boeing to this effort. We've 
dedicated all resources necessary to ensure that the improvements to 
the 737 MAX are comprehensive and thoroughly tested. That includes 
spending over 100,000 engineering and test hours on their development. 
We've also flown more than 814 test flights with the updated software 
and conducted numerous simulator sessions with 545 participants from 99 
customers and 41 global regulators. This process has taken longer than 
we originally expected, but we're committed to getting it right, and 
return-to-service timing is completely dependent on answering each and 
every question from the FAA.
    I have flown on two of the demonstration flights myself and seen 
first-hand the expertise and professionalism of our teams. Mr. 
Chairman, I could not be more confident in our solutions--and I could 
not be more grateful to the men and women who have worked so hard to 
develop and test these improvements always with safety at the 
forefront. When the 737 MAX returns to service, it will be one of the 
safest airplanes ever to fly.
    During this process we have been working closely with the FAA and 
other regulators. We've provided documentation, had them fly the 
simulators, and helped them understand our logic and the design for the 
new software. All of their questions are being answered. Regulators 
around the world should approve the return of the MAX to the skies only 
after they have applied the most rigorous scrutiny, and are completely 
satisfied as to the plane's safety. The flying public deserves nothing 
less.
    We know that it's not just regulators that need to be convinced. We 
know the grounding of the MAX is hurting our airline customers, their 
pilots and flight attendants, and most importantly, the people who fly 
on our airplanes. Our airline customers and their pilots have told us 
they don't believe we communicated enough about MCAS--and we've heard 
them. So we have partnered with customers and pilots from around the 
world as we've developed our solutions. We have welcomed and encouraged 
their questions and given them opportunities to test those solutions 
firsthand in simulators. And subject to regulatory approval, additional 
and enhanced training and educational materials will be available for 
pilots who fly the MAX.
    We have learned and are still learning from these accidents, Mr. 
Chairman. We know we made mistakes and got some things wrong. We own 
that, and we are fixing them. We have developed improvements to the 737 
MAX to ensure that accidents like these never happen again. We also are 
learning deeper lessons that will result in improvements in the design 
of future airplanes. As painful as it can be, the process of learning 
from failure, and even from tragedies like these, has been essential to 
the advances in airplane safety since the industry began roughly a 
century ago. And it is one of the reasons that travel on a large 
commercial airplane is the safest form of transportation in human 
history.
    Mr. Chairman, this is something we must not lose sight of. Today 
and every day, over 5 million people will board a Boeing airplane and 
fly safely to their destination. Whether it's their first flight or 
their millionth mile, we want it to be a great experience--and most 
importantly, a safe one. Decades of work and innovation throughout the 
industry, as well as the oversight of the FAA, this Committee, and 
regulators around the world have reduced the risks of air travel by 
more than 95 percent over the last twenty years. But no number, other 
than zero accidents, is ever acceptable.
    For 103 years, Boeing has been dedicated to making the world a 
safer and better place. Our founder, Bill Boeing, established our first 
safety council in 1917, the first full year of the company's existence, 
beginning a commitment to safety that we have carried forward as a core 
value ever since. The engineers who design our airplanes, the 
machinists who work in our factories, and the many others who 
contribute to the extraordinarily complex work of building and 
maintaining commercial airplanes do so with pride and honor. Ensuring 
safe and reliable travel is core to who we are. Our customers and the 
traveling public, including our own families, friends, and loved ones, 
depend on us to keep them safe. That's our promise and our purpose.
    But we also know we can and must do better. We have been challenged 
and changed by these accidents, and we are improving as a company 
because of them. We established a permanent aerospace safety committee 
of our Board of Directors; stood up a new Product and Services Safety 
organization that will review all aspects of product safety and provide 
streamlined reporting and elevation of safety concerns; and 
strengthened our Engineering organization by having all engineers in 
the company report up through Boeing's chief engineer. We also are 
investing in advanced research and development in new safety 
technologies and are exploring ways to strengthen not just the safety 
of our company but our industry as a whole. We have a shared bond of 
safety across the entire aerospace community.
    We recognize it is not just our airplanes and our company that 
needs to be supported and strengthened. We also must help rebuild the 
communities and families affected by these accidents. Our first step 
was our pledge of $100 million to them. We hired Ken Feinberg and 
Camille Biros, renowned experts in this area, to ensure families can 
access this money as quickly as possible. Of course, no amount of money 
can bring back what has been lost. But we can at least help families 
meet their financial needs. Our people also have donated more than 
$750,000 of their own money to these funds--a tremendous example of the 
giving spirit our teams consistently display in the communities where 
they live and work across the globe.
    Mr. Chairman, I've worked at Boeing my entire career. It started 
more than 30 years ago when Boeing offered me a job as a summer intern 
in Seattle. I was a junior at Iowa State University studying 
engineering, having grown up on our family farm in Iowa. It's beautiful 
land with rolling hills where my siblings and I milked cows and baled 
hay. Our parents taught us the value of hard work, integrity, and 
respect for others. Back then, I drove my 1982 Monte Carlo from Iowa to 
Boeing's operations in Seattle, crossing the Rocky Mountains for the 
first time. I was awestruck at the opportunities I had to work on 
projects that mattered at the company that brought the Jet Age to the 
world and helped land a person on the moon. I was amazed by the people 
of Boeing. Today, I'm still inspired every day by what Boeing does and 
by the remarkable men and women who are committed to continuing its 
legacy.
    These heartbreaking accidents--and the memories of the 346 lives 
lost--are now part of that legacy as well. It's our solemn duty to 
learn from them and change our company for the better. I can assure you 
that we have learned from this and will continue learning. We have 
changed from this and will continue changing. The importance of our 
work demands it.
    In the months since the accidents, there has been much criticism of 
Boeing and its culture. We understand and deserve this scrutiny. But I 
also know the people of Boeing, the passion we have for our mission, 
and what we stand for. There are over 150,000 dedicated men and women 
working for Boeing around the world--and their commitment to our 
values, including safety, quality, and integrity, is unparalleled and 
resolute. No matter what, we will stay true to those values because we 
know our work demands the utmost excellence.
    Over the last few months, I've had the opportunity to visit many of 
our Boeing teams, talk about our safety culture, and gain ideas for how 
we can be better still. Last week, I saw our team in San Antonio--made 
up of 40 percent veterans--beaming with pride as they support the C-17 
fleet for our men and women in uniform. Earlier, I talked with our 
people in Philadelphia building Chinook helicopters; in St. Louis 
testing F/A-18 Super Hornets; and in Charleston, South Carolina, and El 
Segundo, California, connecting the world with the 787 Dreamliner and 
advanced satellites. I've also met with our people in Huntsville, 
Alabama, and New Orleans, Louisiana, who are building the rocket that 
will return humans to the moon and then travel on to Mars and those at 
Kennedy Space Center, Florida, who are preparing to launch the CST-100 
Starliner that will commercialize space travel. I've spent time also 
with our teams in Everett, Washington, who are testing the new 777X 
long-range jet and in Renton, Washington, where 12,000 amazing people 
pour their hearts into building the 737 MAX. These are the people of 
Boeing. I wish you could all meet them. They change the world. They are 
Boeing.
    I'm here today, honored to serve as the leader of this incredible 
team--talented engineers, machinists and all those who design, build 
and support our products. I want to answer all of your questions and 
convey to the world that we are doing everything in our power to make 
our airplanes and our industry safer and prevent an accident like this 
from ever happening again.
    And, Mr. Chairman, you have my personal commitment that I will do 
everything I can to make sure we live up to that promise.
    Thank you for listening, and I look forward to your questions.

    Mr. Chairman. Thank you very much, Mr. Muilenburg. During 
my opening statement, I mentioned an instant message 
conversation and then a series of e-mails. This message 
conversation was between the 737 MAX Chief Technical Pilot and 
a colleague and it expresses concerns about the operation of 
the MCAS. Boeing knew about this instant message for months but 
failed to share it with the FAA until recently.
    With regard to the e-mails, again, Mr. Forkner, the former 
MAX Chief Technical Pilot, calls for removing any mention of 
the MCAS flight control system from the flight crew operating 
manual. He talks about Jedi-mind tricking of regulators with at 
least one person who works for the FAA. So, with regard to the 
instant message conversation, when were you made aware of the 
existence of the November 2016 messages?
    Mr. Muilenburg. Mr. Chairman, as I recall, I was made aware 
of that message earlier this year. It was discovered as part of 
a document gathering process in response to a Government 
investigation.
    The Chairman. So, it was after the crashes? You were made 
aware of it this year?
    Mr. Muilenburg. Sir, as I recall, I believe it was prior to 
the second crash earlier this year.
    The Chairman. Prior to the second crash. Was it your 
decision to wait months before disclosing this to the FAA?
    Mr. Muilenburg. Mr. Chairman, at that point it had been 
identified as a document in response to an ongoing 
investigation and I relied on our counsel to provide that to 
the appropriate authorities.
    The Chairman. OK, what did the counsel tell you? Did he 
say, I am going to supply it to the Justice Department, or did 
he say I am going to get it to the appropriate authorities?
    Mr. Muilenburg. Mr. Chairman, I do not recall having a 
specific conversation about which authorities. Just again as 
part of this investigative process, our intent to cooperate 
fully with your request and to provide that to the appropriate 
authorities. I think over this time period, we provided, on the 
order, half a million pages of documents in support of various 
requests.
    The Chairman. Do you agree that this should have been 
provided to the FAA in retrospect?
    Mr. Muilenburg. Senator, as I became familiar with the 
details of the document over the last few weeks, as I expressed 
our disappointment and concern with the how this came to the 
FAA--I think you heard the same from Administrator Dickson--I 
called him and apologized for how this had come through the 
process. Again, I was not involved in the document production 
process, but I counted on our team to make sure all the right 
authorities were notified.
    The Chairman. OK, so we should look to the team then. Can 
you ensure the Committee that Boeing has now turned over all 
such safety-related communications to the FAA and related to 
the 737 MAX?
    Mr. Muilenburg. Senator, our team continues to cooperate 
with all requests for documentation. I am sure that additional 
documents will be provided over time as they are discovered as 
would be normal to the process, and we will cooperate fully 
with the requests.
    The Chairman. It seems to me that a request should not have 
to have been made with regard to that conversation, sir. Let me 
ask you, when did you become aware of the e-mails that I 
referred to in the second part of my question about Jedi-mind 
tricking regulators?
    Mr. Muilenburg. Senator, again just recently I have been 
informed of the details of those e-mails and instant messages--
--
    The Chairman. Can you give us an idea of how recently?
    Mr. Muilenburg. Over the last couple of weeks when it 
became public news.
    The Chairman. OK. And you did not know about it until then?
    Mr. Muilenburg. Sir, I do not recall being briefed on the 
details of those documents any time prior to that.
    The Chairman. Can you see that this raises much concern 
about the level of coziness between Boeing personnel and FAA 
regulators?
    Mr. Muilenburg. Mr. Chairman, I understand the concern 
there, and again, we are doing our best to lean forward and 
provide information as part of this process. I can tell you 
that the comments, that the values, the approaches that are 
described in those e-mails are counter to our values, that in 
no way would meet any expectation I would have for our team or 
employees, so I understand the concern, share the concern, and 
am trying to convey it is not consistent with our values as a 
company at all.
    The Chairman. And this series of e-mails has only in the 
last few weeks come to your attention, is that right, sir?
    Mr. Muilenburg. Senator, as I said, I was aware of the 
documents that were being produced as part of an investigation. 
That is what I recall from earlier this year. I do not recall 
getting briefed on the details of these documents. Those 
details are things that I learned of over the last few weeks.
    The Chairman. Senator Cantwell.
    Senator Cantwell. Thank you, Mr. Chairman. And if you could 
help, I have a lot to go through, so we are going to try to 
move quickly through it. Was Boeing aware of the defects in the 
MCAS system which it failed to disclose to the FAA at the time 
the aircraft was in development and certification?
    Mr. Muilenburg. Senator, as you know the MCAS development 
occurred over a lengthy time period, about a six-year 
development program of the MAX. We have learned from both 
accidents and we have identified changes that need to be made 
to MCAS. We did, during the development process, follow our 
certification standards and long-standing industry standards 
behind the MCAS design but clearly, we have learned and there 
are things we need to improve on MCAS.
    Senator Cantwell. So are you saying----
    The Chairman. Answer the question, Mr. Muilenburg.
    Mr. Muilenburg. Senator, could I ask you----
    Senator Cantwell. Was Boeing aware of defect in the MCAS 
system which it failed to disclose to the FAA at the time the 
aircraft was in development and certification?
    Mr. Muilenburg. Senator, I just have to question, I will 
say, the premise of the question. So, as part of our 
development process, we do identify hazards and failure modes--
--
    Senator Cantwell. And they were disclosed?
    Mr. Muilenburg. That was part of the failure mode analysis 
that we shared as part of the certification process during that 
time period.
    Senator Cantwell. So, you think everything that you were 
aware of was disclosed to the FAA as it relates to defects in 
the MCAS system?
    Mr. Muilenburg. Well Senator, as we get to defects--things 
we need to fix--we have identified three areas that we talked 
about that we need to address. One was the single sensor feed 
that was a piece of the architecture that was shared with the 
FAA. The fact that the system would operate more than once 
during a flight that was also part of the design description. 
And the control authority of the system at various parts of the 
flight----
    Senator Cantwell. Do you know what Mr. Forkner is referring 
to when he says, unknowingly lied to the FAA or Jedi-mind 
tricking?
    Mr. Muilenburg. Senator, I am not sure what he meant by 
that. We haven't been able to talk to him. He does not work for 
Boeing anymore. We have been trying to contact him.
    Senator Cantwell. Here is my concern, that if you do not 
know what he meant, then you also do not know what wasn't 
disclosed. And so, we do not know if there are things in the 
MCAS system that were defects that he or someone else knew 
about that were not disclosed. So, I hear what you are saying 
that there is a lot to discover in the process, but I would 
like to go over some of the very specifics about what was 
tested and did Boeing test the consequences of the MCAS 
reliance on a single AOA sensor? Did it test that?
    Mr. Muilenburg. Senator, we tested a broad array of 
different aspects of the MCAS system, a set of failure modes. 
We did thorough flight testing. You know, John, if you want to 
comment on the details there?
    Mr. Hamilton. Yes. Senator, the 737 NG is one of the safest 
airplane sets----
    Senator Cantwell. OK, look we are trying to understand what 
got tested. So did you test the reliability of the AOA sensors 
in general? Did you test the reliability on a single sensor? 
Did you consult with the pilots on the lack of guidance on MCAS 
in the flight manuals? Did you test the AOA sensors' degree 
alert to ensure reliability? Did you test the human factor 
response? These are all things from the Lion Air report and my 
guess is you didn't test those and that is at the heart of 
this. But if you did and you have data on that and it was 
provided to the FAA, that is what we want to see.
    Mr. Hamilton. Senator, we did test the MCAS uncommanded 
inputs to the stabilizer system due to whatever causes was 
driving it, not specifically due to an AoA sensor. We assessed 
that hazard level. We talked about pilots----
    Senator Cantwell. Now do you think it is wrong?
    Mr. Hamilton. In hindsight, Senator, yes.
    Senator Cantwell. Thank you because I agree.
    Mr. Muilenburg. Senator, if I can just add a point to that 
because as John pointed out, we relied on these long-standing 
industry standards as part of our evaluation of response time 
behind MCAS, and that is one of the areas that we found 
shortfall.
    Senator Cantwell. Here is the thing I am very confused 
about which is just this larger issue, and look we want to get 
this right because we do want to go forward and we know there 
is going to be automation in many aspects of our lives, but 
this robust testing that must occur and third-party validation, 
there were just--I just do not understand how you have sensors 
on the outside of a plane and you are going to let that send a 
command to the inside of the plane that basically says turn the 
plane 2.5 degrees and then all of a sudden you are going to be 
yelled at from the cockpit from somebody saying pull up and 
then at the same time you are being forced down in your nose 
and you have seconds to respond because you are in takeoff.
    That does not seem like a lot of robust testing was done to 
me because if it was then the Lion Air incident wouldn't have 
happened. OK, so I see my time, I have a few seconds left. I 
want to just bring up, look I think this whole issue of air 
speed is a major issue at large for all of us to get right in 
the sector. Those crashes about automation, even that Air 
France crash is related to a faulty pitot tube.
    I do not know how much we should be trusting things on the 
outside of a plane to give commands to the inside of the plane 
when they can be damaged. But I do want to know that you are 
improving the safety culture, this issue of both reporting, 
people not being able to talk to FAA, oversight people, and 
this issue of some of the machinist Boeing quality inspectors, 
their work being taken over. I want to understand that a safety 
culture is going to exist.
    Mr. Muilenburg. Senator, if anything I can leave with you 
today, I want to reinforce the culture of safety at Boeing, and 
we know we can improve, we encourage our employees to speak up 
when there are issues and some of those have been public 
recently.
    We respect and accept those inputs. We take action 
following on those. We have recently made a number of 
improvements that includes restructuring our safety review 
boards, elevating them to increase transparency and focus on 
safety. We have moved all 50,000 Boeing engineers to now report 
directly to our Chief Engineer, separating them from----
    Senator Cantwell. OK, I am going to ask you to come back on 
the SPIA and Boeing quality inspectors, two different issues, 
with a written response. Thank you, Mr. Chairman. I know I went 
over my time.
    The Chairman. Thank you. Now I have the duty of telling the 
distinguished Whip that he is limited to five minutes.
    [Laughter.]

                 STATEMENT OF HON. JOHN THUNE, 
                 U.S. SENATOR FROM SOUTH DAKOTA

    Senator Thune. Thank you, Mr. Chairman. Mr. Muilenburg, it 
is my understanding that the MCAS has been substantially 
redesigned to include several redundancies that will better 
prevent erroneous activation. Could you speak to why some of 
the changes being made in the reconfiguration of the MCAS were 
not considered in the initial development of the system?
    Mr. Muilenburg. Yes, Senator. I think you raise a very 
important point. And as John began to allude to earlier, the 
original concept for the MCAS design was an extension of what 
we call the speed trim system on the 737 NG, the previous 
version of the 737, that is a single sensor system that has 
been proven safe in flight--more than 200 million flight hours.
    So, one of our safety principles is to minimize change from 
model to model. That is a good standard safety process that was 
the concept behind the original MCAS design. And what we have 
learned from both accidents is that we made some mistakes. 
There are some things we can improve. One of them is this idea 
of going to a dual sensor feed instead of single as well as 
limiting MCAS with a single action or activation during a 
flight.
    Those are improvements that we have identified. We take 
responsibility for that. We feel responsible for our airplanes 
and we know that there are some fixes that we need to make, we 
own that, and we are implementing those fixes going forward.
    Senator Thune. As we discuss possible improvements to the 
certification of an aircraft, it would be helpful for you to 
explain how safety supposed to be integrated into the 
certification process from the initial conception of the 
aircraft all the way to flying at 30,000 feet filled with 
passengers. Since these crashes, we have heard concerns about 
whether Boeing's relationship with the FAA is too cozy and we 
want a certification process that is efficient and that 
promotes U.S. competitiveness but one that always prioritizes 
safety. So, what would you say to address the concerns that 
have been raised about regulatory capture?
    Mr. Muilenburg. Senator, I agree with the focus in that 
area. I would say that over the last couple of decades the 
improvements that have been made in aviation safety are because 
of strong Government oversight, that includes the work of this 
Committee, it includes the other oversight of the FAA. The 
delegated authority process as it is structured, we do think 
has contributed to safety of the industry. I mentioned in my 
comments that it is about a 95 percent improvement in safety 
over the last two decades, some of that I believe is associated 
with the delegated authority, but we have to get the balance 
right.
    And I think it is very important that we have strong 
Government oversight, strong FAA oversight, but we also tap the 
technical depth that our industry teams can bring to the table. 
That is the concept. But if we need to rebalance it--I fully 
support evaluating that concept, looking at the details, and 
making sure we have got the balance right.
    Senator Thune. Could you briefly explain, very briefly if 
you could, how Boeing and the FAA work together to certify 
aircraft?
    Mr. Muilenburg. Yes. Senator, I could but I think Mr. 
Hamilton here is a deeper expert on that, if I could ask him to 
take that question?
    Mr. Hamilton. Certainly. Senator, the FAA is actually in 
control of the certification process the whole time. Let me 
just kind of walk you through the process very quickly. It 
starts out by identifying the requirements to certify the 
airplane. That is the sole authority of the FAA. It establishes 
the certification basis of the airplane. The second step is 
identifying the methods of compliance to those requirements. 
So, this is how you are going to show that the airplane design 
actually meets those requirements.
    Again, the FAA is the sole authority on that. That is their 
action. The third step is doing the testing, the analysis, and 
the documentation that demonstrates the airplane meets those 
requirements. And that is done by Boeing in our case or the 
applicant. And then there is a review of those documents to 
validate that they actually met the requirements, and that can 
be done by the FAA, or the ODA who acts as a designee of the 
FAA, or it can be a combination.
    And finally, there is oversight. The FAA does oversight of 
the actual unit members. They do oversight of the ODA and are 
you following the processes. They do oversight of did you find 
compliance as they expected with the methods of compliance. And 
then they do systemic oversight of the entire system.
    Senator Thune. And Mr. Muilenburg, how are you working to 
ensure, coming back to this issue of safety, that employees who 
raised concerns even if they inhibit your ability to get a 
product to the market quickly are taken seriously and then 
importantly those concerns are raised to the top and not 
brushed aside?
    Mr. Muilenburg. Senator, in my role as the CEO of this 
company I take that responsibility very seriously. We have a 
number of ethics hotline avenues that our employees can use. 
When it comes to delegated authority, in particular we also 
have additional survey tools that we deploy, and we openly 
share that data with the FAA and make improvements.
    That said, again, we know we can improve, and one of the 
areas that I have taken recent action on is to restructure our 
safety organization. So, we have now created a new safety 
organization. Vice President Beth Pasztor reports to my Chief 
Engineer who reports directly to me. That safety organization 
has responsibility for all safety related accident 
investigations, our ODA process, and also responding to any 
employee concerns.
    Senator Thune. Thank you, Mr. Chairman.
    The Chairman. Senator Klobuchar.

               STATEMENT OF HON. AMY KLOBUCHAR, 
                  U.S. SENATOR FROM MINNESOTA

    Senator Klobuchar. Thank you, Mr. Chairman, and thank you 
to Senator Cantwell. I also want to give my sincere thanks to 
the people who are here who lost their loved ones in these two 
crashes. I think you know you are here not only for them, and 
it must be hard to hear all this technical issues when you 
think of your brother or sister or father or mother or son or 
daughter, but I want you to know that we want to get to the 
bottom of this and we want to change this.
    So, I will start where Senator Thune was going with the FAA 
and Boeing, and this relationship. Our recent Inspector General 
report found that only 4 percent of airline manufacturer 
employees responsible for conducting the certification were 
certified by the FAA that conducted oversight. The same report 
found that one manufacturer approved about 95 percent of 
certifications for their own aircraft. What can you tell us 
about the percentage of certifications that Boeing conducts on 
its own aircraft?
    Mr. Muilenburg. Senator, I cannot answer that number off 
the top of my head. I do not know--John if you have a----
    Mr. Hamilton. No, I would have to follow up.
    Senator Klobuchar. OK. How many Boeing engineers both 
design systems for the company and then certify those same 
systems for the FAA? I am just trying to get at a safety check 
from the outside.
    Mr. Hamilton. So, we have approximately 1,000 engineering 
unit members that work not just in systems----
    Senator Klobuchar. But what percentage of them then certify 
the safety as opposed to having the FAA certify the safety?
    Mr. Hamilton. Those are roughly 1,000 unit members that are 
acting on behalf of the FAA to find the compliance, but that is 
beyond just systems. This includes structures and propulsion, 
so it is across the whole airplane.
    Mr. Muilenburg. Senator just to clarify, we have about 
50,000 engineers at Boeing. About 1,000 of them are what we 
call, operate in this area that John's referring to, unit 
members. So, these are members who have the authority and the 
training.
    Senator Klobuchar. OK. We will follow up. I am trying to 
get at when the FAA steps in and when you certify it yourself, 
and we will get that later. Two months after Mr. Forkner sent 
these messages expressing safety concerns, he asked the FAA to 
remove mention of the MCAS automated flight control feature 
from the 737 Max pilots' flight manual and training course, a 
change that the FAA approved in 2017.
    Notably Indonesia's National Transportation Safety 
Committee report on the Lion Air crash confirms that the 
pilot's lack of knowledge of MCAS was one of the key reasons 
for the plane crash. How frequently are new automated systems 
left out of the manual and training that you give to pilots?
    Mr. Muilenburg. Senator, first of all of one of the things 
we have learned from both of these accidents is that we need to 
provide additional information on MCAS to pilots. Just to give 
you context, as we develop our training manuals, our idea is to 
provide training to pilots so they can respond to the effects 
of failures as opposed to trying to diagnose failures and that 
is a very important distinction.
    And so more information in the training manuals is not 
necessarily safer but as we understand from both of these 
accidents, we need to provide more information on MCAS to 
enhance safety. But we do try to include information in the 
training manuals----
    Senator Klobuchar. But do you think it is acceptable that 
pilots are flying planes without knowing about these key 
automated flight systems?
    Mr. Muilenburg. Senator, again our approach is to train 
pilots on the effects of a failure mode. So, in this case, the 
MCAS automation system, when it fails it fails in what we call 
a runway stabilizer, uncommanded movement of the horizontal 
tail. That is what is in the training manual and we try to 
train pilots to respond to the effect of the failure as opposed 
to diagnose it.
    Senator Klobuchar. OK, let me move on to two more 
questions. After these terrible crashes have claimed 346 lives, 
do you think it makes sense for these aircraft to be allowed to 
fly in some countries and not others because the FAA says each 
country can make its own decision?
    Mr. Muilenburg. Well, Senator, we respect the jurisdiction 
of the regulatory authorities around the world----
    Senator Klobuchar. So, you think it is acceptable? Just say 
yes or no.
    Mr. Muilenburg. Senator, that is up to the regulatory 
authorities. That is not a decision that we can make. We 
respect the authority of the regulators.
    Senator Klobuchar. OK. You are saying the same thing again, 
so I am going to go with a yes. While there have been several 
factors that contributed to the plane crashes, one that is 
particularly troubling was highlighted in a recent article in 
the Washington Post, which found that the Lion Air had a faulty 
angle-of-attack sensor which gave pilots and airplanes systems 
unreliable information the day before it crashed. Do you think 
that is a problem and what steps can be taken to change that?
    Mr. Muilenburg. Senator, in the case of the angle of attack 
disagree alert we got the implementation wrong. I mentioned in 
my comments up front that we made some mistakes, we made a 
mistake in that implementation. Once we discovered it, our 
engineering teams quickly convened a safety review board.
    They confirmed that it wasn't an operational safety issue 
and the FAA subsequently concurred with that but nonetheless, 
we got the implementation wrong and we have addressed the 
faults in the process. We have fixed that. And angle of attack 
disagree alert will be standard implementation on all MAXs 
going forward.
    The Chairman. Thank you, Senator Klobuchar. Senator 
Fischer.

                STATEMENT OF HON. DEB FISCHER, 
                   U.S. SENATOR FROM NEBRASKA

    Senator Fischer. Thank you, Mr. Chairman. I too would like 
to recognize and offer my sympathies to the people that are 
here today and the people who are at home who have lost loved 
ones in these crashes. I hope that we can get answers at this 
hearing and also in the future so that these issues, these 
mistakes will not happen again and cause future loss of life.
    Mr. Muilenburg, the Joint Authorities Technical Review 
notes that Boeing made several other changes to the 737 MAX 
that differ from the earlier model, such as structural changes 
that would accommodate the new engines that were planned on the 
plane and other advanced technologies. Senator Thune touched on 
this with the delegated authority. Was Boeing delegated 
authority over the certification of those changes as well?
    Mr. Muilenburg. Senator, I cannot answer that question 
completely because as you pointed out to there were a number of 
changes. Again, those are done and evaluated jointly with the 
FAA. I don't know, John, if you want to comment on any 
specifics there?
    Mr. Hamilton. There were approximately 92 certification 
plans associated with the MAX which encompass all the different 
changes to the airplane. The FAA reviewed approximately 8 of 
those initially and----
    Senator Fischer. Are you looking into those certification 
processes as part of your review of the 737 MAX?
    Mr. Muilenburg. Senator, yes, we are. I asked my Board to 
set up an independent review committee headed by Admiral 
Giambastiani about 5 months ago, and that committee did its 
work, provided inputs that we are acting on. And with the other 
authorities, we are continuing to take a hard look at that, and 
we look forward to taking an action on those reports.
    Senator Fischer. OK. Also, the Joint Authorities Technical 
Review included a recommendation that states, ``if any flight 
control service is used in a novel manner, the FAA should be 
directly involved.'' This is based on the observation that the 
FAA was not, ``completely unaware of MCAS,'' but, ``because 
information and discussions about MCAS were so fragmented and 
they were delivered to disconnected groups within the process, 
it was difficult to recognize the impacts and the implications 
of this system.''
    Do you agree that the communication between Boeing and the 
FAA is fragmented to the point that relevant information on 
MCAS was not provided to the agency? Is this what you were 
referring to when you talked about getting the balance right?
    Mr. Muilenburg. Senator, I think you raise some very good 
points there. I do think one of the areas we can improve, and 
we have seen it in the JATR report and others is system-wide 
integration, cross system integration amongst the different 
technical expertise areas and improvements in documentation and 
communication. And again, we found some areas where we could 
have, should have, done better.
    Senator Fischer. Do you think those steps will improve your 
communication with the FAA?
    Mr. Muilenburg. Senator, I do.
    Senator Fischer. Do you think the FAA has a responsibility 
to also change its process to improve communication?
    Mr. Muilenburg. Senator, I believe the FAA does, but I 
would not say that is only the FAA's responsibility. We at 
Boeing need to make some improvements in communication and we 
own that, and we are committed to doing that.
    Senator Fischer. The Boeing 737 airplanes are based on a 
type certificate that was originally provided in 1967, I 
believe, and it has been amended to address the different 737 
model since then. The Technical Review notes that, ``some 
elements of the design and certification remain rooted in the 
original 1967 certification of the Boeing 737-100.'' Does 
Boeing or the FAA review the elements of the 737 that are based 
in the 1967 certification for continued safety when new models 
of the airplane are produced?
    Mr. Muilenburg. Senator, if I could ask John to field that 
question?
    Mr. Hamilton. Senator, as you note there is a single type 
certificate for the 737 but as the design has evolved with each 
new generation of airplanes, the safety standards on which the 
airplane is designed to have also evolved. Yes, there are some 
amendments that the designs might reference back to an earlier 
amendment level but those are likely changes that have not 
changed in the family of airplanes since the original design.
    An example might be some of the structural elements. 
However, we have stepped up in many areas voluntarily to later 
amendment levels to demonstrate that it still meets the latest 
standards in compliance.
    The Chairman. Thank you, Senator Fischer.
    Senator Blumenthal.

             STATEMENT OF HON. RICHARD BLUMENTHAL, 
                 U.S. SENATOR FROM CONNECTICUT

    Senator Blumenthal. Thank you, Mr. Chairman. Thank you to 
both our witnesses for being here today and thank you most 
importantly to the relatives who have lost loved ones. If you 
could please stand so we could thank you all. Thank you for 
being here. If you could just stand. Thank you.
    The Chairman. Go ahead and hold up the photographs that you 
brought.
    Senator Blumenthal. I was going to ask that you hold up 
those photographs because I understand that for security 
purposes you cannot during the hearing but just for this short 
period of time. Mr. Muilenburg----
    The Chairman. So, thank you, and if the timekeeper could 
start Senator Blumenthal's time over. Thank you very much to 
the family members. Senator Blumenthal.
    Senator Blumenthal. Thank you very much, Mr. Chairman. Mr. 
Muilenburg, as I watched those loved ones stand and frankly as 
I reviewed this file over the past week or so again and as I 
sit here today my anger has only grown. These loved ones lost 
lives because of an accident that was not only preventable as 
the Chairman said at the very start but was the result of a 
pattern of deliberate concealment.
    Boeing came to my office shortly after these crashes and 
said they were the result of pilot error. Those pilots never 
had a chance. These loved ones never had a chance. They were in 
flying coffins as a result of Boeing deciding that it was going 
to conceal MCAS from the pilot. And the best evidence is this 
message from Mark Forkner saying in effect we are going to 
conceal MCAS, delete it from the manual used in training. When 
did you become aware of the fact that MCAS was not going to be 
included in the flying manual?
    Mr. Muilenburg. Senator, first if I could express my 
deepest sympathies for----
    Senator Blumenthal. You have done that, and my time is 
limited. I apologize for interrupting you, but I want to know 
specifically when you became aware of this effort?
    Mr. Muilenburg. Senator, I cannot reference that e-mail and 
I am not----
    Senator Blumenthal. I am not asking about the e-mail. You 
have been asked about the e-mail already. I am asking you about 
Boeing policy as reflected in this e-mail, its chief test pilot 
deciding he was going to mislead pilots who were then going to 
take passengers into the air, these loved ones, and turn those 
planes into flying coffins.
    Mr. Muilenburg. Senator, I am not sure what Mr. Forkner 
meant by that e-mail. I can tell you that certification and 
training materials are not determined by one individual.
    Senator Blumenthal. In fact, let me just interrupt you 
again. In the over 1,600 page original flight manual of Boeing 
737 MAX, the aircraft's new MCAS computer system was mentioned 
only once, once in 1,600 pages in the glossary of abbreviated 
terms. So, when Boeing came to us and they said it is the 
pilot, inexperienced pilots, you were lying to us as well.
    Mr. Muilenburg. Senator, if I could try to respond to your 
question. First of all, the premise that we would lie or 
conceal is just not consistent with our values.
    Senator Blumenthal. Well I know it is not consistent with 
the values that you are articulating here but let me just, 
since my time is limited, move on. Would you agree that this 
system of certification and oversight is absolutely broken? 
That is the lesson here, isn't it? That Boeing lobbied the 
Congress for more delegation and now we have to reverse that 
delegation of authority. Would you support those legislative 
efforts?
    Mr. Muilenburg. Senator, again I support taking a hard look 
at the delegated----
    Senator Blumenthal. I am not asking you for a hard look, I 
am asking you for a commitment here because you have the 
opportunity to make things right?
    Mr. Muilenburg. Senator, I am not familiar with particular 
legislation, but I am committed to working and supporting it.
    Senator Blumenthal. Boeing asked for legislation that 
exists right now. Will you commit to supporting reform efforts 
such as many of us on this Committee are advocating?
    Mr. Muilenburg. Senator, we will commit to participating in 
those reform efforts and providing our inputs.
    Senator Blumenthal. Well, I agree that your input would be 
valuable. I am looking for input in support of reform that will 
stop outsourcing by the FAA, and I might just add, the FAA has 
been really disappointing and its disclosure to us is an 
example, the kind of disclosure the FAA has given us, total 
redaction. I have asked for full disclosure of documents. The 
FAA has failed to provide them.
    I have asked for the FAA to return my phone calls. It has 
failed to do so and I think the FAA is part of this problem as 
well, and it is the result at the end of the day of Boeing 
rushing this process, I am using the Chairman's terms, putting 
profits over safety, rushing the certification process with you 
in charge of that certification and prioritizing speed and cost 
over safety.
    And my time has expired but the folks who really deserve 
time here are the people who lost loved ones.
    The Chairman. Thank you, Senator Blumenthal. Let us do 
this; this poster is entitled, ``MCAS lives in both FCC.'' If 
you can provide a copy of that, we will admit it into the 
record at this point without objection.
    [The information referred to follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    The Chairman. Thank you. And Mr. Hamilton, let me just ask 
you, when it says MCAS does live in both FCCs, what does that 
mean? Briefly.
    Mr. Hamilton. Certainly. So, the MCAS function is 
replicated in the two flight control computers that are onboard 
the airplane. And so, each flight control computer previously 
received its input from one AOA sensor on the left or right 
side. In the software changes we are making going forward, now 
both flight control computers will receive the data from both 
sensors, compare it, and only if they agree they will activate.
    The Chairman. OK. Thank you. Senator Moran.

                STATEMENT OF HON. JERRY MORAN, 
                    U.S. SENATOR FROM KANSAS

    Senator Moran. Mr. Chairman, thank you. Mr. Muilenburg, did 
you determine that the failures that resulted in the tragic 
consequences, were they failures in the policies and protocols 
that Boeing had in place or was it a failure to comply with 
those protocols and policies that resulted in these 
consequences?
    Mr. Muilenburg. Senator, in some cases we relied on these 
longstanding industry-standards, policies, and certified to 
those, and we are now raising questions around those. That gets 
back to this pilot response time discussion that we had 
earlier. And in some cases, we missed on implementation as I 
mentioned earlier with the angle of attack sensor but overall, 
we did follow the certification process and steps. But 
nonetheless, we have learned from both of these accidents. And 
the fixes that we need to make are clear.
    Senator Moran. So, the fixes are both in policy and then 
making certain that the policies are followed once the new 
policies are in place?
    Mr. Muilenburg. Senator, I believe both are true, yes.
    Senator Moran. Thank you. And I assume there is other 
certification and just developments at Boeing that are always 
ongoing. Have you changed your behavior and or policies for the 
certification and development process for other pieces of 
equipment, other aircraft that Boeing is now proceeding toward 
certification?
    Mr. Muilenburg. Senator, we have, and we are going to 
continue to change. As I said we have learned, but we are still 
learning. I mentioned earlier that we changed our safety review 
board structure. That is a big, substantive change, the stand-
up of our new safety organization. The realignment of our 
engineering team, those 50,000 engineers. We are also taking a 
look at some of those long-standing assumptions behind how we 
design as we look at next generation products like the 777-X as 
an example. So, we are taking a comprehensive approach to those 
updates.
    Senator Moran. As this Committee looks certainly at 
certification, as we look at the FAA, what suggestions does 
Boeing have for this Committee when you look at any policies or 
failures at the FAA? So, the way I would view this is we have 
two major organizations involved in this process: one is the 
manufacturer Boeing, the other is the Federal agency that is 
there to certify. My assumption is that neither one did things 
right. And what have you learned about the FAA that we should 
know as we look at the FAA now and in the future?
    Mr. Muilenburg. Senator, we have a great deal of respect 
for the FAA. I have personally worked with the FAA for many 
years, have a great deal of respect for them and their 
professionals. I know the FAA is also taking a hard look at all 
of the reports and inputs and investigations and is committed 
to making changes. I think you heard that from Administrator 
Dickson.
    Senator Moran. Do you have suggestions on what changes the 
FAA should make?
    Mr. Muilenburg. Senator, I do not have specific 
recommendations for you, but we would be glad to follow up on 
that if it would be useful.
    Senator Moran. Thank you. Where are we now in the 737 MAX? 
It seems like every week there is a report that an airline is 
going to believe they are going to have that plane flying again 
or certification is nearby. What is the status?
    Mr. Muilenburg. Senator, we are in the final stages of the 
process, so we are currently testing the final software 
updates. When ready and with the FAA's approval, we will 
proceed to a certification flight in the near-term. Subsequent 
to that it would be the FAA's responsibility to evaluate and 
issue an airworthiness directive. That is all work that we are 
proceeding on over the next few weeks and months, but I think 
it is important again that the airplane will return to service 
when it is safe. This is not going to be timeline driven. We 
are committed to answering every question the regulators have 
and the airplane will fly when everyone is convinced it is 
safe. That is the most important thing here.
    Senator Moran. It troubles me that to get to that point is 
certainly not that it is taking so long, I want the result that 
you just described but with the right circumstance before we're 
flying again, but it would suggest to me that there was much 
more significant problems with the MAX 737 if it was previously 
certified and yet now it takes so long. It is something more 
than just a glitch, it is something more than just a minor 
change. That makes me concerned about the process that allowed 
it to be certified in the first place. What am I missing?
    Mr. Muilenburg. Senator, I think you raise a very good 
point. Our initial effort early this year was focused on the 
MCAS updates that we have already talked about. Around the 
middle of the year, as we were evaluating all of the other 
inputs and data, we identified some additional safety 
enhancements that we can make. Not something that was required 
for certification but something that we thought while the 
airplane was grounded was the right thing to do and a safety 
enhancement, and rather than waiting to do that later after 
return to service, we as a company and with the FAA decided 
that we would take the extra time for those additional software 
updates.
    And that is the work we have been doing through the summer 
and into the fall. That is designed to add additional software 
redundancies throughout the flight control computers and that 
is the final software we are testing. What I want to convey 
here is this is really the culture of Boeing. And I understand 
the questions that are being raised but when our teams find 
opportunity to improve safety, that goes to the top of the 
list. That is the top priority.
    And if it takes time, if it takes money to do that, that is 
where we are focused and that is why it is taking longer than I 
think some anticipate.
    Senator Moran. I request your follow up on your thoughts 
about the FAA. Thank you.
    The Chairman. Thank you, Senator Moran. Senator Markey. 
Senator Udall. Senator Peters.

                STATEMENT OF HON. GARY PETERS, 
                   U.S. SENATOR FROM MICHIGAN

    Senator Peters. Thank you, Mr. Chairman. Let me begin also 
by expressing my sympathies to those who lost loved ones in the 
two 737 MAX crashes and I would like to thank the families that 
are here today for your continued attention to safety and for 
working to prevent future tragedies like we saw here.
    Over the years out aviation system has become the safest in 
the world, but these tragedies certainly remind us so that we 
cannot rest, safety cannot be taken for granted. There is no 
doubt from what we have been hearing in the testimony here 
today that many mistakes were made, and the consequences were 
unfortunately tragic. The reports from technical experts 
underscore that technology becomes increasingly complex. The 
debate about how to move forward cannot be simply about a one-
size-fits-all regulatory regime versus a let the free market 
just police itself type of approach.
    We have a new paradigm and they need to be developed to 
address the regulatory challenges associated with very complex 
technology and that is something this Committee needs to weigh 
in very heavily into as we move forward. Mr. Muilenburg, as you 
know, the BP oil disaster in the Gulf of Mexico killed 11 
workers, lasted 87 days, and cost upwards of $65 billion.
    And in the wake of that disaster, it was revealed that the 
oil and gas industry have lobbied for the reduced safety 
precautions that could have prevented that disaster. We often 
hear in Congress about how much our regulations cost industry 
however thoughtful regulation plays an incredibly important 
role in protecting the public.
    So, I am curious if Boeing's view on oversight has changed 
in the wake of this tremendous human tragedy as well as the 
cost that this company is facing right now. Has your view 
changed? You have talked in response to an earlier question 
about having a balance. Clearly something is wrong with that 
balance. Please let me know if your thoughts have changed 
recently?
    Mr. Muilenburg. Senator, my thoughts have changed. We have 
learned lessons from these two accidents and the families that 
are here with us today, the pictures we saw, they are 
heartbreaking. They remind us of the importance of the work we 
do and the paramount importance on safety. That is what makes 
this industry great, and strong oversight is part of the fabric 
of our industry, always has been, and I think this should give 
us pause to take a hard look at that.
    Senator Peters. Well, the hard look. You said we need to 
look at the balance. Has the balance gone too far to allowing 
the industry to police itself?
    Mr. Muilenburg. Senator, I do not know if I can 
characterize it that way. My sense is that we all have the same 
objective here. We all want the safest industry possible. That 
is our objective and my sense is that we could look at the 
balance. There are refinements that would be worthy. I think, 
you know, technology----
    Senator Peters. Do you think it is out of balance now based 
on what happened here? Do you think we have not just taken a 
look at it, but seriously understand that the balance may be 
out of whack if we delegate too much to industry and do not 
have impartial eyes and make sure the regulatory regime is 
sufficient. That you truly have impartial eyes looking at these 
factors. It is going to save lives and you won't put a company 
through the cost that you have when you balance those 
regulations. Is it out of balance right now, yes or no?
    Mr. Muilenburg. Senator, again, I think it can be improved. 
I completely agree with you on the importance of strong 
oversight. I have worked in this industry for more than three 
decades from airplanes to spacecraft. People's lives depend on 
what we do and strong oversight from the Government is a key to 
the safety of our industry. So, I think we have a shared 
objective there and we will work with you on examining any 
improvements we can make. We have a mutual interest.
    Senator Peters. Mr. Muilenburg, the NTSB report indicated 
that the FAA and industry have historically used highly trained 
test pilots to verify the safety of new aircraft models rather 
than average pilots who typically have less experience. Does 
Boeing use pilots with average training and experience?
    Mr. Muilenburg. Senator, our Boeing test pilots are 
experienced, highly qualified pilots. We work with airlines, 
the FAA, and the regulators to bring other pilots in from 
around the world as part of the evaluation, but I think as you 
are pointing out as we look to the future again, we want to 
make sure that the testing we are doing is representative of 
that future pilot population.
    Senator Peters. Thank you.
    The Chairman. Thank you, Senator Peters. Senator Capito.

            STATEMENT OF HON. SHELLEY MOORE CAPITO, 
                U.S. SENATOR FROM WEST VIRGINIA

    Senator Capito. Thank you, Mr. Chairman. I thank the 
Ranking Member as well. I want to say first of all to the 
families who are here, extending my sympathies but also my 
gratitude for you coming forward through your pain to bring to 
us to Congress, which is not an easy thing to do, your 
frustrations and probably stronger feelings in the loss of your 
loved ones. I will say that when Colgan flight 3407 went down 
in Buffalo in early 2009, the families that came forward to us, 
I was on Transportation committee on the House side, made such 
an incredible impact and it made flying on our regional 
airlines much, much safer because of that.
    So hopefully that will be what the result of this is for 
you today and for all of us. Mr. Muilenburg, particular 
attention has been called to the fact that Boeing later in the 
development process of the MAX revised the range of flight 
conditions that could lead to activation of the MCAS, but that 
Boeing did not notify the FAA of these changes at the time. 
This is troubling if in fact this is true. Was Boeing not 
obligated by the FAA to report changes like the ones I just 
described?
    Mr. Muilenburg. Senator, I believe you are referring to the 
low-speed extension of MCAS and I have seen those same reports, 
but they do not reflect the facts. The extension of MCAS low 
speeds was done in a rigorous way. It was done in a very 
visible way. There was testing done on that from the mid-2016 
time-frame to the early 2017 time-frame including flight test 
with the FAA onboard. The FAA was aware of the low-speed 
extension and ultimately certified that, and I believe FAA 
leadership has publicly stated----
    Senator Capito. So that is a false report then?
    Mr. Muilenburg. I believe it is a false report. I believe 
the low-speed extension was fully certified with the FAA.
    Senator Capito. OK. Another report that has been out in the 
media and among is that after the second flight went down that 
Boeing actually actively lobbied the FAA to keep the planes in 
the air. Can you respond to that?
    Mr. Muilenburg. Senator, could you just clarify your 
question for me?
    Senator Capito. Yes, after the second plane with Ethiopian 
Air went down that there was quite--several countries had 
limited the flight of that plane. We have not done that yet in 
the United States. There are media reports that Boeing was 
actively lobbying the FAA to keep the planes in the air at that 
time in this country. Is that true?
    Mr. Muilenburg. Senator, let me, let me clarify what was 
happening in that timeframe.
    Senator Capito. Could you make it brief, please?
    Mr. Muilenburg. Yes. We immediately after that accident 
reached out to the FAA and other regulatory authorities to 
understand what happened in the accident. What has made 
aviation safe is that we make decisions based on data. At that 
point we didn't have data and so we with the FAA were looking 
to understand what happened. There were early reports that the 
airplane had some kind of low speed, low altitude problem that 
turned out to be incorrect.
    So, we, with the FAA, were pursuing data to make a good 
safety based decision. That was our position with the FAA. When 
data became available, satellite data that was referred to in 
the media, again with the FAA we came to a conclusion that 
there could be similarities between the two accidents and that 
led very quickly to a decision to ground the fleet.
    Senator Capito. Well, I think, you know, in retrospect I 
think it was pretty obvious and I do not want to say 
conclusively so but there is a problem and a consistent 
problem. The other thing that has really bothered me about this 
whole thing and I questioned this in the last Committee hearing 
that we had. Between the Lion Air crash and the Ethiopian Air 
crash, it defies logic to me that some of these folks who wrote 
e-mails or sent text messages did not come to you and to the 
expertise of the engineering of these engines and of these 
planes and say this is what we were talking about.
    Why was there any reaction at all like that within your 
company after the Lion Air crash? And do not tell me because 
you did not have the official report, that would have maybe 
saved those people in that Ethiopian Air flight.
    Mr. Muilenburg. Senator, I think about that decision over 
and over every day. And if we knew everything back then that we 
know now, we would have made a different----
    Senator Capito. OK, the question then, did people come to 
you at the highest levels, at any level, and say wait a minute, 
this is sounding familiar? Yes or no?
    Mr. Muilenburg. Senator, after the first accident we 
convened our broad technical team across Boeing. It wasn't any 
single individual or small team. It was a broad team. We 
brought all those experts to bear trying to assemble data from 
the accident, understanding what occurred. We quickly with the 
FAA issued an operational bulletin to remind everyone of the 
training and the emergency scenario that----
    Senator Capito. Around that particular system?
    Mr. Muilenburg. Around what we call runaway stabilizer, 
which again is the effect of that system, and at the same time 
we began work on an MCAS software update in that timeframe.
    Senator Capito. So, the answer is yes. Thank you.
    Senator Cantwell. Mr. Chairman, just one point of 
clarification. Are you saying Mr. Muilenburg the FAA did know 
about the 2.5 trim not 0.6 but 2.5? The FAA knew about that?
    Mr. Muilenburg. Yes, Senator. You are referring to that 
low-speed extension which is the 2.5 degree trim?
    Senator Cantwell. Yes.
    Mr. Muilenburg. That is the low-speed extension. The FAA 
did know about that and participated.
    Senator Cantwell. Thank you.
    The Chairman. Senator Udall.

                 STATEMENT OF HON. TOM UDALL, 
                  U.S. SENATOR FROM NEW MEXICO

    Senator Udall. Thank you, Mr. Chairman, and thank you to 
the Ranking Member for having this hearing. And Mr. Muilenburg, 
you know, I first want to say to all the people that stood up, 
that I am very moved by you being here and that your losses are 
very, very I think heartfelt across the Committee here. And, 
you know, the thing that really bothers me is knowing that it 
is preventable. It makes it even more outrageous that we 
haven't made the kind of dramatic changes that I want to talk 
to the CEO here about. Mr. Muilenburg, you showed some emotion 
when these folks stood up and everything.
    What should come from that emotion is some action to do 
something to really make a difference, and for this Committee 
to coalesce around the solution that is really going to move us 
forward would require you to step forward and specifically say 
what you support. And I haven't seen you do that in all the 
questioning you have been asked over and over again. What would 
you support? I mean, it is absolutely clear that it is too cozy 
a relationship with the FAA and your airline. And so, what is 
it you are going to commit to specifically in terms of reform? 
That is why you are up here.
    And that is what we want to see you do is to weigh in with 
us, this is what would make a difference, this is what would 
make it safer, this is what would make sure that we do not lose 
passengers like this in the future or the crew.
    Mr. Muilenburg. Senator, while I respectfully do not agree 
with the characterization of coziness with the FAA, we respect 
the independent oversight of the FAA and that is very important 
to us from a safety principle standpoint. We have taken a 
number of internal actions that we think are meaningful as they 
relate to our own internal reforms on safety.
    We are engaged in the legislative process, and Senator, I 
appreciate your invitation for us to be involved in that. I 
know there are many stakeholders. As you heard from me earlier, 
we are committed to strong oversight in the aerospace industry. 
It is part of what makes this system safe. We have a shared 
objective and if there are things we can do to make it better 
we will. I do not know John if you have any specific----
    Mr. Hamilton. Thank you. Senator, you know, I would say 
that, you know, one of the big issues was we made use of an 
industry standard assumption on pilots and how they would react 
and that proved incorrect in these two accidents. So, in terms 
of things that I think we need to change with the FAA, we need 
to go revisit some of these regulatory guidances and make sure 
they are up to date.
    I would even tell you that there are probably some 
regulations that we advocate as part of the FAA reauthorization 
bill, 10 regulations, that FAA should work with industry to 
update based on technology that is out there today. But in 
terms of opposing this, I used to be the lead administrator for 
the ODA, and I can tell you that we have a respectful 
relationship with the FAA, but we do have our differences of 
opinion sometimes.
    But we discuss those, we work it out on how we are going to 
comply, and it is not a cozy relationship. It is a professional 
relationship.
    Senator Udall. It is a relationship that didn't work for 
the consumers and for your employees that went down in those 
flights. You and others in your company blamed the deceased 
pilots and the culture of the countries where the crashes 
occurred for the accidents. But from what we have seen in the 
last year since the first crash, it appears that Boeing's own 
culture is more blameworthy for installing a faulty system that 
resulted in too many deaths and could have caused more.
    This culture starts at the top and that is why I have been 
asking you for the specifics of what you support, and I hope 
after this hearing you will come forward and when there is 
legislation out there say this is going to make it better and 
come up here and spend some time to build the consensus to get 
this done.
    Because I think the large, powerful interests that are a 
part of this do not want any reform. They want you to tinker 
around like you are talking about it, but they do not want to 
see any reform. If Boeing could not guarantee that pilots were 
prepared to fly these jets, your company should not have sold 
them. Did anyone at Boeing question, hesitate, or raise any 
issues prior to selling the 737 MAX 8 with this software to 
Lion Air or Ethiopian Air?
    Mr. Muilenburg. Senator, first we look forward to 
responding to your request there and providing inputs on the 
reforms. To your question, we do rely on the airlines and the 
regulatory authorities around the world as part of this 
integrated system to make sure we are fielding airplanes and 
crews that can fly safely. I do think it is important for me to 
clarify a point that you made earlier. We have not blamed the 
pilots and I know that has been reported but that is not our 
company position and it never will be.
    We are responsible for our airplanes. We are responsible 
and we own that. Regardless of cause, any accident with one of 
our airplanes is unacceptable.
    Senator Udall. That change is welcomed but that about the 
culture went out from your company early on. Thank you, Mr. 
Chairman.
    The Chairman. Thank you, Senator Udall. Let's do this at 
this point. Mr. Muilenburg, the JATR published 12 main 
recommendations. Will both of you get back to us on the record 
and tell us Boeing's position with regard to these 12 
recommendations?
    Mr. Muilenburg. Senator, we will.
    The Chairman. Thank you. Senator Markey is next.

               STATEMENT OF HON. EDWARD MARKEY, 
                U.S. SENATOR FROM MASSACHUSETTS

    Senator Markey. Thank you, Mr. Chairman. Let me begin by 
recognizing the families who lost so much on these flights. 
Many of you are here today including Michael Stumo and Nadia 
Milleron, the parents of Samya Stumo, a University of 
Massachusetts Amherst graduate and a resident of Sheffield, 
Massachusetts who was tragically killed on the Ethiopian 
flight. The losses that the Stumo family and all of the 
families suffered is absolutely inexcusable and we will 
remember that as we are moving forward in the drafting of 
legislation. We will do it in the memory of your families.
    One thing is clear to make sure that safety is our top 
priority is to guarantee that every aviation safety measure is 
built into every plane and that it is never for sale. 
Unfortunately, our current laws only prevent aircraft 
manufacturers like Boeing from selling critical safety elements 
for an additional price. Existing rules allow companies to 
charge extra for non-critical safety enhancing features. And 
Boeing actually does charge more for those technologies.
    The 737 MAX aircraft involved in the Indonesian and 
Ethiopian crashes lacked two, two safety enhancing features, an 
angle of attack indicator and a disagree light. Both of these 
technologies would have helped the pilots recognize the faulty 
sensor readings were causing the plane's automated flight 
control system to push the aircraft nose down toward the 
ground. With that knowledge the pilots may have been able to 
take more effective action to prevent these crashes. In fact, 
the Indonesian crash report released last week specifically 
cited the lack of a disagree light on the 737 MAX as 
contributing to the Lion Air tragedy.
    Shamefully, the law allows Boeing to treat these safety 
technologies as a la carte add-ons that airlines can obtain 
only by paying an extra fee. A la carte add-ons, safety. Not 
like XM radio, all leather seats on a plane, safety is a la 
carte. Safety is an added on feature. These tragic crashes have 
made it all too clear that there should not be any distinction 
between critical and non-critical safety enhancing features and 
that is why I have introduced my Safety is not for Sale 
legislation.
    My bill will require aircraft manufacturers like Boeing to 
offer or provide any technology that measurably enhances safety 
without an additional charge to airline carriers. If you 
believe that safety should never be for sale, the question is 
why was it? Now you seem to now recognize that the disagree 
light should be standard, but you have yet to say the same 
thing about the angle of attack indicator and whether or not 
that should be offered for free or whether or not each airline 
should be given the option of not building it into the plane 
for free.
    So, I think you have to make a decision here in terms of 
where you want to go because otherwise your disagree light is 
still oncoming from Boeing toward the safety features. So, I 
want first of all to have you answer whether or not according 
to the Wall Street Journal you agree that Boeing did not 
originally include the disagree light on the 737 even though 
the same technology was standard on prior models of the 
airplanes, is that correct?
    Mr. Muilenburg. Senator, I feel I need to respond to your 
earlier point about selling safety. We do not sell safety. That 
is not our business model. And I do want to clarify your points 
on the angle of attack indicator. That is a system that we have 
offered as an option to airlines. Some airlines do not want it. 
It is not necessarily a safety improvement. It actually takes 
up space on the flight deck displays and more information on 
the displays is not necessarily safer. So that is not a safety 
feature. On the angle of attack disagree----
    Senator Markey. All I am saying is you should not offer it 
for a price. You should give the option to the airline without 
any price attachment. Do you agree to do that?
    Mr. Muilenburg. Senator, yes. And in fact, we have already 
announced that the angle of attack disagree alert will be on 
all MAX airplanes going forward, standard, and the angle of 
attack indicator will be available as an option to all airlines 
at no cost.
    Senator Markey. So, given your stated support for the 
principle behind my legislation, will you support my 
legislation that ensures that you offer to provide any 
technology that measurably enhances safety without an 
additional fee to airlines? Would you agree to support that 
legislation?
    Mr. Muilenburg. Senator, I haven't seen the specific 
legislation. I think the principle around focusing on safety is 
a top priority. I agree with that and it is a worthy principle, 
and I ask if we could take a look at the legislation.
    Senator Markey. The key is just--the word is free to an 
airline for anything that measurably impacts safety. Do you 
agree?
    Mr. Muilenburg. Yes, we do not sell safety and that is not 
our business model.
    The Chairman. Thank you. Thank you, Senator Markey.
    Senator Duckworth.

              STATEMENT OF HON. TAMMY DUCKWORTH, 
                   U.S. SENATOR FROM ILLINOIS

    Senator Duckworth. Thank you, Mr. Chairman. So, I am going 
to try to put some of the issues here into layman's terms. I 
want to first of course share my sincere condolences to the 
families who are here, but also to the families in Ethiopia and 
in Indonesia who are watching this hearing, who will be 
watching this hearing. I do not speak Amharic, but for the 
Indonesians----
    [Speaking in a foreign language.]
    Senator Duckworth. And what I just said was we will as 
Senators get to the bottom of this tragedy and we will continue 
to investigate this. We will not stop because you see Boeing 
sells its aircraft to the world and we in America have well-
earned reputation as leaders in aviation in the world and I 
want us to reach that shining example once again.
    Pilots know that tragedies do not occur in a vacuum. 
Catastrophic outcomes result in long succession of failures 
that often overwhelm the pilots at the control of the aircraft. 
We call it an aviation the accident chain and there are many 
links in an accident chain that must happen that would 
eventually overwhelm the pilots and results in the crash. Many 
of these links in the accident chain happened with Boeing and 
your decisions in the development of the 737 MAX. So, let me 
talk about what has happened here. You put a sensor on the 
outside of the aircraft, which is standard, but you allowed 
that sensor to override the pilot's input in this system.
    So, in every other 737 aircraft, there is the function of 
the, you can pull back the pilot, the cutout, and that will 
override that uncommanded nose-down altitude. That is standard. 
That is the basic assumption. As you said you use an industry 
standard on how a pilot would react to a malfunction like that.
    Uncommanded nose down, every pilot including helicopter 
pilots, you pull back. But what you did was you put an MCAS 
system into an aircraft, you didn't tell the pilots that this 
MCAS system was in there, and you put in a function in order 
for the MCAS to work the way you wanted it to work after the 
pilot does to uncommanded--reaction to the uncommanded nose 
down, in every other 737, cutout, that is the end of it.
    In the 737 MAX, after five seconds, the system resets and 
it pushes the nose right back down. The pilots had exactly 
three seconds to pull, nose down, pull up. Now we got to do a 
new procedure that did not exist in previous 737 models, which 
is the electronic cutout switch because you have now put in a 
system that overrides the pilot in command of that aircraft.
    So, you have been telling this Committee that, yes, you use 
basic pilot reactions. That is true. But you have not been 
telling this Committee the whole truth. Time and again, this is 
my frustration, Boeing has not told the whole truth to this 
Committee and to the families and to the people looking at 
this. Yes, the pilots did exactly what they were supposed to do 
but five seconds later, especially if that sensor is still 
stuck, it overrides what the pilot does, and it pushes the nose 
right back down again. Three seconds.
    A pilot's best friend is time and altitude. And on takeoff 
there is no altitude and he has got no time. You set those 
pilots up for failure. And when I sent you a letter asking you 
to answer several questions, it took Boeing over five months to 
respond to my question. I only got the answers the day before 
you and I met. And one of the questions I asked was, what date 
did Boeing discover that a stuck angle of attack vane would 
result in MCAS issuing persistent commands with unlimited 
authority to trim the airplane nose down?
    In layman's terms, if this vane is stuck, MCAS will 
continue to provide faulty directions and will keep pushing 
that nose down over and over and over again no matter how many 
times an experienced 737 pilot pulls back on the yoke, five 
seconds later, reset, nose back down. You knew in 2016 that 
this was happening and your team at Boeing decided we didn't 
need to fix that because of well-understood piloting techniques 
and procedures.
    But the problem is that the well-understood piloting 
techniques and procedures are to pull back and that is it. But 
you added something else. You put in a system you didn't tell 
pilots about and then you put in an override by resetting the 
system 5 seconds later.
    Boeing is the company that built the Flying Fortress that 
saved Europe. I remember watching B-17s fly above--it is a 
storied aircraft that has rescued the free world and yet you 
knew about these problems and you continued to put the system 
into place. And when we asked you to answer these questions, 
you have told this Committee and you have told me half-truths 
over and over again, including in that meeting. This is why I 
am so upset. You have not told us the whole truth and these 
families are suffering because of it.
    The Chairman. Thank you, Senator Duckworth. Members of the 
Committee, at this point Senator Scott is deferring his time to 
the Chairman of the Subcommittee, Senator Cruz. You're 
recognized, sir, for five minutes.

                  STATEMENT OF HON. TED CRUZ, 
                    U.S. SENATOR FROM TEXAS

    Senator Cruz. Thank you, Mr. Chairman. Mr. Muilenburg, I 
have to say the testimony here today has been quite dismaying. 
I want to focus on the text exchange that has been referred to 
and has been publicly reported on. This was a text exchange 
between Mark Forkner who was then Boeing's technical pilot for 
the MAX, chief technical pilot for the MAX, and Mr. Gustavsson 
who in 2018 was promoted to being Boeing's 737 chief technical 
pilot. Is that right?
    Mr. Muilenburg. We believe that is the case, Senator.
    Senator Cruz. So, this exchange is stunning. Mr. Forkner, 
``oh, shocker alert. MCAS is now active down to M2. It is 
running rampant in the sim on me. At least that is what Vince 
thinks is happening.'' Gustavsson responds, ``oh great, that 
means we have to update the speed trim description in volume 
2.'' Mr. Forkner, ``so basically I lied to the regulators 
unknowingly.'' Gustavsson, ``it was not a lie. No one told us 
that was the case.'' Forkner, ``I am leveling off at like 4,000 
feet, 230 knots, and the plane is trimming itself like crazy. I 
am like what?'' Gustavsson, ``that is what I saw in sim 1 but 
on approach I think that is wrong.'' Forkner, ``granted I suck 
at flying but even this was egregious.''
    That exchange describes what happened in Lion Air and 
Ethiopian Air. The men and women who are gathered here with the 
photos of your loved ones, 346 people are dead because what 
these chief pilots described as egregious and crazy--that is 
their language, that is Boeing's internal language in this 
exchange. Now what I find truly stunning, Boeing handed this 
exchange over to the Department of Justice in February.
    In March, I chaired a hearing of the Aviation subcommittee 
on these two crashes. Boeing did not see fit to give this 
Committee that exchange, nor did Boeing give it to the FAA or 
the Department of Transportation. But what I find most stunning 
is your testimony here today that you said you first learned of 
this exchange a couple of weeks ago.
    These are senior leaders at Boeing in an exchange saying 
and I will quote again, ``so I basically lied to the 
regulators.'' Look, I have practiced law for a lot of years. 
You had your lawyers look over this document and they read a 
senior leader, after these crashes occurred, saying they lied 
to the regulators. Mr. Muilenburg, how in the hell did nobody 
bring this to your attention in February when you produced this 
to the Department of Justice? How did you just read this a 
couple of weeks ago?
    Mr. Muilenburg. Senator, again to clarify my earlier 
comments. I was made aware of the existence of this kind of 
document, this issue, as part of that discovery process in the 
investigation early in the year as you pointed out. At that 
point I counted on my Counsel to handle that appropriately.
    Senator Cruz. Did you read this exchange? Look, I was made 
aware documents were being produced. Whether that is passive 
voice and disclaiming responsibility--you are the CEO, the buck 
stops with you. Did you read this document? And how did your 
team not put it in front of you, run in with their hair on fire 
saying we got a real problem here? How did that not happen and 
what does that say about the culture at Boeing if they didn't 
give it to you and you didn't read it? If you didn't say, I 
want to read it and see what happened?
    Your testimony here earlier today is well we are not sure 
what they were talking about because he is not at Boeing 
anymore. How did you not in February set out a 9 alarm fire to 
say, we need to figure out exactly what happened, not after all 
the hearings, not after the pressure but because 346 people 
have died, and we do not want another person to die?
    Mr. Muilenburg. Senator, as you mentioned, I didn't see the 
details of this exchange until recently and we are not quite 
sure what Mr. Forkner meant by that exchange. His lawyer has 
suggested he was talking about a simulator that was in 
development in that time period. That is where he was working. 
That could be the case. We do not know. I fully support diving 
deep into this and understanding what he said and what he meant 
but I can also tell you that in that same time-frame where his 
original message was made----
    Senator Cruz. Mr. Gustavsson still works at Boeing?
    Mr. Muilenburg. Senator, yes, he does.
    Senator Cruz. Have you had that conversation with him?
    Mr. Muilenburg. Senator, my team has talked with Patrick as 
well.
    Senator Cruz. Have you had that conversation?
    Mr. Muilenburg. Senator, I have not.
    Senator Cruz. My time has expired.
    The Chairman. Thank you. Thank you, Senator Cruz. Senator 
Tester. Let's do this. The entire poster--Senator Cruz if you 
can have that reduced in size and we will enter into the record 
without objection at this point. So ordered.
    [The information referred to follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    The Chairman. Senator Tester.

                 STATEMENT OF HON. JON TESTER, 
                   U.S. SENATOR FROM MONTANA

    Senator Tester. Thank you, Mr. Chairman. I want to thank 
you and the Ranking Member for having this hearing and I know 
for the two folks on the panel this morning it is probably a 
painful morning for you. But the fact is it is infinitely more 
painful for the folks that are sitting a couple rows behind 
you. You have said many times, Mr. Muilenburg, that mistakes 
were made and obviously they were.
    Unfortunately that admission was made after 346 people 
died. And there are a lot of reasons an airplane can go down 
whether it is pilot error, whether there is an equipment 
malfunction, or birds, but safety should not be one of them. 
And in a previous question you said you guys do not sell safety 
and I will be honest with you I didn't listen to the whole 
thing. But you damn well better sell safety.
    I fly four legs a week and there is a lot--if not for the 
grace of God it could have been me on one of those airplanes 
and we expect there to be safety. Obviously, something went 
wrong, and it is not the first time. There is the MCAS 
situation here that was pointed out as several people on this 
Committee have already pointed out to you and nothing was done 
or to your leadership team.
    There was a South Carolina whistleblower that talked about 
debris being left in the planes or those technicians were 
removed. There is a KC-46 finding, wrench bolts and trash 
inside the new airplanes. That was in June of this year. There 
was a cargo 777. You get the deal. It goes on.
    And so the question is the one that Senator Udall brought 
up that you didn't answer, and I think other people on this 
Committee also brought it up and that is, what do we do? What 
do you do? So I will be a little more specific. I do believe 
there is a cozy relationship and I do not believe that quite 
frankly time and money are no object because there is also 
plenty of examples.
    For example in 2014, FAA made regulatory changes to safety 
standards that would have required changes to the MAX to add 
new crew alerts. Boeing appealed it to the FAA and sought to 
seek an exemption arguing it would cost too much money, $10 
billion, which is a lot of money, but the truth is that it 
wouldn't happen if FAA would have been doing their job and it 
also wouldn't have happened if you would have known what the 
hell was going on.
    So my question is, and I know there was a push a number of 
decades ago about privatization of the Federal Government, and 
I think that is how we got here is privatization of Government. 
But why do we not just turn over the certification back to the 
FAA and let them do it and then they would be the ones sitting 
at this desk and not you. Why not do that?
    Mr. Muilenburg. Well Senator, we share your focus on safety 
and I can confidently say that is our number one priority.
    Senator Tester. OK, cool, but we failed in this case and 
there is a whole bunch of people back there that are going 
through incredible anguish because we failed.
    Mr. Muilenburg. Senator, I agree, and we feel----
    Senator Tester. So let's get to the question and look there 
is--I can pivot with the best of them. I know how to pivot, I 
know when people are pivoting. You are pivoting. Tell me if you 
would support having the FAA do the certification?
    Mr. Muilenburg. Senator, we believe that delegated 
authority process that we have today has contributed to improve 
safety over the last two decades. As I mentioned earlier, we 
are open to improving it but the idea that we can tap the deep 
technical expertise for companies across the aerospace industry 
is a valuable part of the certification process. But the FAA is 
the certification authority and should be and should continue 
to be.
    Senator Tester. Well, but they really aren't. The truth is 
you can say that they have the ultimate responsibility, but the 
truth is if the issues aren't flagged by the ODA, by your 
people doing the certification, the FAA never does it because 
quite frankly it would cost them more money to have the FAA do 
the certification.
    And by the way, it is costing you money so we could charge 
you for that certification to help pay for it so it would have 
no reflection on the taxpayers. So the question becomes--I am 
going to tell you what, when the FAA says you need to do this 
and you come in and say no, you do not need to do this, it is 
fine if nothing happens, but when 350 people die, we got a 
problem.
    And to bring up the point that Senator Cruz brought up that 
there was plenty of information out there on this and nothing 
was done. And so the whole thing about it, you know, when it 
comes to safety, time and money are no object is not--the 
record certainly does not show that.
    Mr. Muilenburg. Senator, I understand your points and 
criticism and I think it is true that we operate in a very 
competitive world and we are the only large airplane, 
commercial airplane maker left in the United States. We do have 
competitive pressures around the world, but I can also tell you 
that it never takes precedence over safety. Our business model 
is safe airplanes.
    Senator Tester. Think it absolutely could be argued that it 
did in this case, and I heard Senator Duckworth questions. And 
Boeing has had an incredibly valuable name, but I have got to 
tell you and I think I told you guys this an office some time 
ago, I would walk before I would get on the 737 MAX. I would 
walk. There is no way and the question becomes when issues like 
this happen, it costs your company huge. And so you shouldn't 
be cutting corners and I see corners being cut and this 
Committee is going to have to do something to stop that from 
happening. Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator Tester. I am going to ask 
that Mr. Muilenburg answer on the record his opinion of the 
current ODA system, whether it should be modified. Answer 
Senator Tester's question.
    Senator Johnson.

                STATEMENT OF HON. RON JOHNSON, 
                  U.S. SENATOR FROM WISCONSIN

    Senator Johnson. Thank you, Mr. Chairman. Let me add my 
condolences to the surviving family members and friends of the 
victims of these tragedies.
    And Mr. Muilenburg, among many failures it strikes me there 
are two primary failures. First and foremost in the original 
design and certification process, and then second in the 
reaction after the first crash. So let's concentrate on those 
two things. Tell me if I am getting this right, the 737, a very 
successful airframe. New, more fuel-efficient engines were 
available and so you wanted to include that and upgrade of that 
airframe, correct?
    Mr. Muilenburg. New fuel-efficient engines and some other 
enhancements.
    Senator Johnson. And those fuel-efficient engines created 
different aerodynamics for that aircraft, correct?
    Mr. Muilenburg. That is correct.
    Senator Johnson. Is the MCAS system, is that a standard 
type of automatic pilot type of software system on planes? Is 
that pretty standard to have something like that?
    Mr. Muilenburg. Senator, the MCAS system that we have on 
the MAX is unique to that airplane.
    Senator Johnson. So it was put in there specifically 
because you added a different type of engine to a known, 
successful airframe which made that less stable and required 
some kind of, as you called it, a runaway stabilizing system?
    Mr. Muilenburg. Senator, if I can clarify that, the 737 
family has a system called the speed trim system and the MCAS 
is an extension of that system that is unique for the MAX.
    Senator Johnson. Unique because of that added engine 
design?
    Mr. Muilenburg. We tailor the software of each one of our 
airplanes so that they optimize the handling qualities for the 
unique airplane configuration.
    Senator Johnson. But again going into the introduction of 
this 737 MAX, you realize that that airframe was changed 
because those engines required this MCAS system for 
stabilization?
    Mr. Muilenburg. That was one of the additions we made to 
create the handling qualities we wanted for the pilots. We also 
made some changes to things like the vortex generators on the 
wing. So it is an integrated solution to creating----
    Senator Johnson. You are well aware that this design change 
created something that required an MCAS system. So now fast 
forward, you have the Lion Air tragedy. According to Senator 
Cruz, the message that he set up there which I believe was 
written on November 15, 2016 just a couple years before that 
Lion Air crash, there are people or it sure appears some in 
Boeing that knew exactly or suspected what went wrong because 
the integrated design, you had an MCAS system to take care of 
this eventuality in the flight characteristics, correct?
    Mr. Muilenburg. Senator again, I am not exactly sure what 
was meant by that traffic, that e-mail traffic, but I can tell 
you in that timeframe----
    Senator Johnson. It seems pretty obvious, does it not? I 
mean it does not seem pretty obvious to you? I mean again you 
are engineers, you understand how this was designed, you 
understood you needed an MCAS system to make up for that 
instability, and then something happened. I would think you 
would diagnose pretty fast.
    I mean again, I am reading these things. I am not a pilot. 
I am not an aerospace engineer and yet I am scratching my head 
going, whoa, something really wrong happened. You know a whole 
lot. Why didn't you react faster?
    Mr. Muilenburg. Well Senator, completely separate from that 
e-mail traffic and what it might mean, our team very quickly 
after the Lion Air accident assembled with the regulators. We 
evaluated the data from the accident. We saw that MCAS was 
involved and so we began to take quick action immediately. It 
does not have to do with that e-mail. That is not relevant to 
that discussion. Our team was immediately identifying----
    Senator Johnson. Which is exactly my point. The fact that 
it took another tragedy to actually ground the airplanes so you 
could actually have a true--a fix that worked is I think really 
what is on the table here. And the diagnosis is why didn't we 
react? Why didn't we ground that aircraft a lot sooner so that 
another tragedy wouldn't happen?
    Mr. Muilenburg. And Senator, we have asked that question 
over and over. And you know, if we knew everything back then 
that we know now, we would have made a different decision. The 
decision that was made on that at that point with the data we 
had, we quickly convened a safety review board, the FAA coming 
out of that confirmed the continuing airworthiness of the 
airplane and issued that officially.
    That was the safety case that was built. But Senator as you 
pointed out we have learned from the second accident and if we 
could go back, we would have made a different decision. And we 
have learned. We are making those improvements to MCAS and that 
is where our focus is going forward.
    Senator Johnson. Boeing is an important company. It is 
important for our economy. I want to see you get this right, 
but you have to properly diagnose this. You have to accept 
responsibility for what happened so we actually can make those 
changes both within Boeing and also within the FAA. Thank you, 
Mr. Chairman.
    The Chairman. Thank you, Senator Johnson. Senator Rosen.

                STATEMENT OF HON. JACKY ROSEN, 
                    U.S. SENATOR FROM NEVADA

    Senator Rosen. Thank you. And I want to thank all the 
families that are here today who have lost their most precious 
loved ones. Their death should not be in vain and we all have 
to do every bit of our part together to make sure that we 
prevent future tragedies from happening. And in order to honor 
the memories of these 346 souls and the empty chairs that they 
will leave behind this Thanksgiving and Christmas and on and on 
and on.
    And so you said additional information wasn't available. I 
want to touch a little bit on MCAS and Brazil. According to 
news reports, when the Brazilian National Civil Aviation Agency 
came to the U.S. in 2017 to test out the MAX 8, they determined 
the changes made to the old 737 were significant enough that 
they needed much more information from Boeing and were going to 
provide it for their pilots.
    When they eventually published their pilot training 
requirements, they were therefore able to flag the MCAS as one 
of the changes the pilots needed to take into consideration 
when flying the MAX 8. And yet for United States pilots, MCAS 
wasn't mentioned in their manual.
    So, Mr. Muilenburg, why was this information not flagged 
for your other customers who had 737 MAXs in their fleet? And 
to prevent your company from sharing these differences to other 
regulatory bodies or operators, I have here the Brazilian 
manual. They decided their pilot should learn this and why 
wouldn't you provide it to the United States pilots?
    Mr. Muilenburg. Senator, I cannot comment on the details of 
the Brazilian document. John may be able to but let me more 
broadly make the point that that is exactly how the process is 
supposed to work. We provide information, we evaluate with the 
regulators in the various jurisdictions what should be included 
in the training. We have no desire to hide features of the 
airplane that pilots need to know.
    Senator Rosen. But they reported back to you and it was 
significant enough for them to put this in their manual then 
why wouldn't you consider that it was a significant change?
    Mr. Muilenburg. Senator, I understand your point and that 
was a decision that was made in Brazil. Again, I am not 
familiar with the details of that one. But the discussion----
    Senator Rosen. So let me just ask you this question then, 
moving forward will you commit to making it a practice when 
other countries are clearly paying attention enough to make 
significant changes to their pilot manuals based on major 
operational changes, that Boeing will send these notifications 
of changes to the other users of these aircraft so at least 
they have the opportunity to train their pilots? You denied 
them the opportunity, sir.
    Mr. Muilenburg. Senator, we are committed to sharing that 
information and that is part of our international 
collaboration. But I also want to note again that the 
discussion around MCAS training and whether it would be 
included in the training manuals that was an active, iterative 
discussion with the FAA, and it was a decision made based on 
safety.
    Again, we try to put information in the training manuals 
that focuses on the effects of failures and things that will be 
valuable to the pilots and it is not always the case that more 
information adds to safety. Although in this case, we 
understand this, and this is one of the additions going 
forward.
    Senator Rosen. Brazil thought it added to their safety. But 
I want to touch a little bit on Senator Fischer, the question 
that she raised earlier. All these changes have taken place, of 
course, over the years and this plane is still working off its 
original certification from 1967. This is despite the fact that 
pilots have told me that the MAX 8 is in no way functionally 
similar to the original 737s that took to the skies 52 years 
ago.
    I said in the last hearing that we had, seems to me like 
there have been so many significant modifications. It is almost 
as if you took a canoe and turned it into a cruise ship. So Mr. 
Hamilton, can you tell us how many derivative certificates 
Boeing has received for the 737 since initially being certified 
over 50 years ago?
    Mr. Hamilton. Senator, I do not have the exact number in my 
head, but it is approximately 14.
    Senator Rosen. Fourteen or 814?
    Mr. Hamilton. Fourteen derivatives. But I will--let me take 
the action to follow up with you on that.
    Senator Rosen. Thank you. I appreciate that. And the last 
thing I am going to ask. Do you believe that the 737 MAX is 
functionally the same plane that was certified in 1967?
    Mr. Hamilton. Senator, as I mentioned to you earlier, 
Senator, the safety standards have evolved as the airplane has 
evolved, and one of the important things I think to understand 
is what is really important also is for the pilots as they 
transition from an earlier version of the 737 to the newer 
version, that the airplane behaves and handles in the same way. 
That was important from a handling characteristics standpoint--
--
    Senator Rosen. And important enough for Brazil to mention 
but not for us?
    Mr. Hamilton. With respect to that Senator, so there is a 
joint operation evaluation board that determines the training, 
but other regulators can determine what training they want to 
do above and beyond based on the information. I do not know the 
specifics of the Brazilian document you are referencing. We can 
follow up on that.
    The Chairman. Thank you. Thank you, Senator Rosen. Senator 
Blunt.

                 STATEMENT OF HON. ROY BLUNT, 
                   U.S. SENATOR FROM MISSOURI

    Senator Blunt. Thank you, Mr. Chairman. So Mr. Muilenburg, 
I do not want to absolve you from both the opportunity and 
responsibility to go back and look at that long question from 
Senator Tester and answer it for the record. But for now one of 
the sources, one of the central thoughts in that question was, 
why shouldn't we change this process and go back to where it is 
no longer cooperative, or the FAA takes full responsibility?
    Give me the answer to that. Should this process be changed 
where the Federal Government is fully responsible with 
employees only hired by the Federal Government? What impact 
would that have on safety?
    Mr. Muilenburg. Senator, I believe the data clearly shows 
that creation of the delegated authority process and its 
implementation has enhanced safety over the last couple of 
decades. I mentioned earlier about a 95 percent improvement in 
aviation safety over the last couple of decades. I think a 
portion of that at least can be attributed to the delegated 
authority process.
    That does not mean we should not refine it, reform it over 
time, but the fundamental process of strong Government 
oversight combined with deep industry technical knowledge in 
the right balance is a strong safety process. And I firmly 
believe that is one of the things that has contributed to 
aviation safety. And that process demands oversight and we are 
fully supportive of strong oversight, but we also fully support 
the idea of tapping deep industry technical expertise. And that 
combination is the safest combination.
    Senator Blunt. And what do you think the view of the 
industry technicians is of their responsibilities there? Do you 
think they feel the right level of both responsibility and 
liability of providing the information that they need to 
provide?
    Mr. Muilenburg. Senator, they do, and I can tell you that 
is the culture of our company. And I respect the comments that 
were made today, and the questions have been raised about our 
culture. We deserve the scrutiny, but I have been at this 
company for 34 years. I know the people of Boeing. You all know 
the people of Boeing. These are 150,000 people that every day 
come to work because they have an important mission. They are 
honest, they are resolute in their efforts, they are committed 
to safety. That is our culture and every employee at Boeing--
that is just how we think about the work we do.
    And we are going to continue to improve as a company. I am 
not saying we have done everything right. As I have noted 
today, we have gotten some things wrong. But this is a great 
company with a great legacy that is committed to excellence and 
where we can improve, we will, where we can learn we will, but 
our culture is about safety. That is at the very core of 
Boeing. It has been that way for 103 years.
    Senator Blunt. Alright. Mr. Hamilton, I had two or three 
questions that actually Senator Rosen just asked pursuing that 
further. But you have got a 1967 certification that has had 14 
variants since 1967. You have a significantly different plane 
that is based on the 14th variant of the original plane.
    What difference do you think would have made if the 
certification process would have gone back to the we are 
certifying a new plane? Would that have made a difference in 
the MCAS system? Or you have been doing this a long time, what 
difference would it have made if we hadn't built on the 
previous half-century of this plane's history and just had 
started with a new plane. Would that have been better or worse?
    Mr. Hamilton. You know, in part 21 of the Federal 
Regulations, it spells out the change product rule which is how 
you assess for a derivative type certification. And it is a 
process that is in the USFAA's regulations. It is also in 
European and other countries regulations. And it requires you 
to look at all significant changes and step up. I think there 
is an assumption here that derivative type certification is 
less robust than the new type certification.
    I think when you look at new types of certifications, or 
you oftentimes have some exceptions or equivalent levels of 
safety very similar to what you see on a derivative. So I am 
not sure it would have necessarily resulted in a safer 
airplane. It might have driven some different design decisions 
though, but fundamentally one of the things that happened in 
these two accidents was this assumption around how we expected 
crews to respond under certain situations, which proved to be--
it did not happen.
    And I think you know, that is a fundamental issue that we 
have to address in the industry.
    Senator Blunt. Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator Blunt.
    Senator Blackburn.

              STATEMENT OF HON. MARSHA BLACKBURN, 
                  U.S. SENATOR FROM TENNESSEE

    Senator Blackburn. Thank you, Mr. Chairman. Thank you for 
being here today and for taking our questions. I will tell you 
this is you have responded you have addressed Senator, Senator, 
Senator. I think you should be addressing victims because they 
are the ones who we are asking questions on behalf of and they 
are the ones who have come today on behalf of their family 
members.
    And another thing I want to ask you, you have mentioned a 
couple of times a lack of awareness of e-mails or documents or 
communications and you know, Mr. Muilenburg, we have something 
around here, before we vote, we say we read the bill so that we 
know what is in it. And if we need to ask questions, we ask 
questions, and we develop that awareness that is so necessary 
to make good decisions and to have a full view of the situation 
that is in front of us.
    And it is disconcerting to hear someone who is to be the 
leader of a company to say I wasn't aware, or I didn't know, or 
I haven't read that, nobody made me aware of that, I depended 
on that. You know, we call that passing the buck and it is your 
responsibility if you are going to lead the company to have 
that awareness.
    So have you at this point read each and every page of every 
document that is relative to the situation in this case?
    Mr. Muilenburg. Senator, I cannot say I have read every 
document, every page. I know we have provided more than half a 
million pages of documents as part of the production process 
over the last year. I accept your input and your criticism. I 
am accountable, our company is accountable. Accountability 
starts----
    Senator Blackburn. I appreciate that, but I think that it 
is unsettling to hear you say I haven't read that. Let me move 
on. I do believe that you are in the business of safety as a 
priority and even though you say you do not sell safety, let us 
talk a little bit about the simulators because you had pilots 
that were training in the simulators as well as training in 
flight, correct?
    Mr. Muilenburg. You are referring during the MAX 
development?
    Senator Blackburn. Yes.
    Mr. Muilenburg. Yes, Senator.
    Senator Blackburn. OK. So the simulators that were being 
used for training, were they built by the same engineers with 
the same components, the same sensors, the same systems as the 
MAX system?
    Mr. Muilenburg. Senator, we have a wide variety of 
simulators, some of which are what we call conformed simulators 
which represent the actual hardware and software of the 
airplane. We have others that are engineering simulators.
    Senator Blackburn. So it is conceivable that some of the 
pilots were not training on this specific simulator? And then 
you also--you know, Mr. Peters had started down a line of 
questioning with you about the pilots and the pilots that were 
trained. And you only had highly experienced pilots and 
simulators before flying the new MAX system, correct?
    Mr. Muilenburg. Senator, I was referring to our Boeing test 
pilots. We also have pilots from a number of other 
organizations, regulators, and airlines.
    Senator Blackburn. Why would you not use pilots with a 
variety of experience, a wide range of experience? Because 
there are pilots with the wide range of experience that are 
going to be in that cockpit flying that plane in real time.
    Mr. Muilenburg. Senator, I agree with your view on the 
necessity of having a variety of pilot experiences involved in 
the testing process, but again our Boeing pilots are not the 
only testers in the process.
    Senator Blackburn. OK. Well, then let's take it this way. 
What changes are you going to make in the simulators and in the 
training that is going to bring to account for human factor?
    Mr. Muilenburg. Senator, we have made several changes and 
have more to come but to start the baseline training program 
for the MAX is a roughly a 24 day training program which 
includes heavy use of simulators, advanced simulators. We have 
also modified the computer-based training for the incremental 
training between the NG and the MAX. We have added visibility 
to the training materials for the MCAS system that we have 
talked about.
    That new training is all currently being evaluated and will 
be ultimately certified by the regulators to make it a baseline 
in the program. We are also investing R&D significantly in 
advance----
    Senator Blackburn. Let me ask you this, I appreciate all of 
that and I appreciate your answer. Prior to these occurrences, 
did you feel that your training was not sufficient?
    Mr. Muilenburg. Senator, no, we implemented the training 
that was planned and certified for the airplane.
    Senator Blackburn. I yield back.
    The Chairman. Thank you, Senator Blackburn.
    Senator Scott.

                 STATEMENT OF HON. RICK SCOTT, 
                   U.S. SENATOR FROM FLORIDA

    Senator Scott. Thank you, Mr. Chairman. First off, my heart 
goes out to all the families. I mean, I just cannot imagine, 
you know, the impact on these families after these tragic 
accidents. I come from Florida, so air travel is a pretty big 
deal for us. 126 million people traveled to Florida as tourists 
last year and a lined share of them came by aircraft. So the 
safety of everybody is really important. Mr. Muilenburg, the 
President and CEO of your commercial airlines was let go after 
this. So what is your process to hold people accountable to 
make sure this does not happen again?
    Mr. Muilenburg. Senator, first of all my company and I are 
accountable. I believe that accountability starts with me. My 
Board took some recent actions regarding my position, which I 
fully support and will allow me to focus even more on safety. 
So every action we take strives to focus on safety. I have also 
taken some management actions. Again, those are focused on 
operational excellence and safety going forward. As other 
reviews are completed, if we see additional actions that need 
to be taken, we won't hesitate.
    But in some cases, accountability also includes 
improvements to our processes and our organization structure, 
and that gets to some of the changes we announced on our safety 
review boards, our new safety organization, our new board 
safety committee, and the realignment of all 50,000 of our 
engineers to our chief engineer in terms of reporting 
structure. All of those accountability actions are important 
and all of them are focused on safety.
    Senator Scott. So if anybody, if any of your--whether it is 
engineers or nonengineers, if somebody has a concern in the 
future about safety, what is the process you have created to 
make sure that it gets to you and you can react to it because 
ultimately as a CEO the buck stops with you?
    Mr. Muilenburg. Senator, that has been one of the key 
learnings from this whole process is we need to elevate the 
visibility on safety issues that might come up the at the 
ground floor level. Make sure they get the right visibility and 
action. So a couple of things we have done there. One is again 
restructuring our safety review boards. So I now get a weekly 
update on safety review boards from across the Boeing 
enterprise at a detailed level, which I found to be very 
helpful.
    We have also with the start of our new safety organization 
under Beth Pasztor, instead of having those safety teams 
underneath our businesses, they are now separated and report up 
through our chief engineer. Any safety concerns that employees 
have will come through that organization.
    We set up a new anonymous reporting system for those 
employees that want might want to make anonymous reports to 
facilitate that, and we continue to have a full range of ethics 
hotlines across our enterprise that encourage employees to make 
their inputs. And we have a culture of asking our employees to 
speak up. We want them to speak up. We want to make sure they 
are heard and that we take action.
    Senator Scott. Have you made any changes at the Board level 
to increase the accountability for all employees?
    Mr. Muilenburg. Senator, our Board has been very engaged in 
this entire process. One of the things we did is a now about 
six months ago I asked our Board to set up an independent 
review led by Admiral Giambastiani. He has a tremendous safety 
background. That Committee came forward with a number of 
recommendations, some of which I mentioned in things that we 
have implemented.
    Our Board will continue to be engaged in that process. And 
this new this new safety organization that I talked about, in 
addition to reporting to the Chief Engineer and to me, it also 
provides independent audit, if you will, back into our Board.
    And our Board has set up a new aerospace safety committee 
that is now permanent headed up by Admiral Giambastiani. You 
might have seen on Friday we added another Board member, 
Admiral Richardson, who also has deep experience in safety. He 
will also be a member of that committee and so our safety 
organization will have an independent reporting line to them as 
well, which I think is a good discipline process.
    Senator Scott. I had to go to preside, so I didn't get to 
hear all the testimony. But have you made any recommendations 
to this Committee on things that at the Federal level we ought 
to be doing differently, you know, to make sure whether Boeing, 
Airbus, or anybody else, this does not happen again?
    Mr. Muilenburg. Senator, we have discussed a number of 
options there. Again, we have learned and there are some things 
that we need to fix that are related to the airplane design and 
training and communications. We also think there are some 
opportunities to reform our processes and how we work together 
as a Government and industry. And we are very supportive of any 
actions there that would enhance safety.
    Senator Scott. Thank you.
    The Chairman. Thank you, Senator Scott.
    Senator Sullivan.

                STATEMENT OF HON. DAN SULLIVAN, 
                    U.S. SENATOR FROM ALASKA

    Senator Sullivan. Thank you, Mr. Chairman. And I also want 
to express my sympathies and condolences to the family members 
here. We have a safe commercial aviation industry in America, 
but I think we always have to look at ways to improve the 
industry, the airlines, FAA, Congress. So I am sure it is 
difficult for the family members to be here, but it is 
important that you are here. So I want to thank you for that. I 
am going to start with just a bit of a kind of a parochial 
question.
    Mr. Muilenburg, Mr. Hamilton, Alaska Airlines is my state's 
airline, it is a very good airline, certainly critically 
important to my state. I know it is to the Ranking Member's 
state as well. They fly almost all 737 Boeings. We Alaskans 
travel a lot. I have had many constituents in the aftermath of 
these MAX crashes that have asked me, are the 737s that we are 
flying on all the time in Alaska, to and from Seattle and other 
places, safe? So can both of you assure my constituents that 
these 737s are safe that are such an important component of the 
Alaskan air travel?
    Mr. Muilenburg. Yes, Senator. The 737 NG fleet that Alaska 
operates is a safe fleet, it is a safe airplane and it has got 
about 200 million hours of air safety track record behind it.
    Senator Sullivan. Mr. Hamilton?
    Mr. Hamilton. I agree with Mr. Muilenburg's comments. I 
also just want to say that we have a weekly meeting that we 
review all the reports that are coming in from the fleet on 
whether or not there are potential safety issues or not.
    Senator Sullivan. So the MAX issues that we are focused on 
here with regard to 737s are not issues that exist with your 
other line of 737s, 800s, and 900s?
    Mr. Hamilton. No.
    Mr. Muilenburg. That is correct.
    Senator Sullivan. Let me ask--and I know the House side was 
looking at this issue. As we focus as this Committee on the 
tragic lessons learned from the MAX 737 accidents, should we 
also take the time to ensure that the other 737 models that are 
receiving less attention now nevertheless continue to be safe 
and to take the opportunity to look at the FAA certification 
process on those to make sure that that is not bedeviled with 
some of the challenges that we are discussing here with regard 
to the MAX? Would you agree that that is an opportunity to not 
just focus on the MAX but the overall process to reboot the 
focus both at your company, but also in the FAA on safety?
    Mr. Muilenburg. Yes, Senator, I believe there are a number 
of independent reviews underway right now looking at that 
broader certification process, some of which have begun to 
report out. We support that broader look.
    Senator Sullivan. So models that aren't just the MAX?
    Mr. Muilenburg. All models. So we are taking an end-to-end 
comprehensive look at the certification process and I believe 
there are a number of Government independent reviews that are 
focused on that.
    Senator Sullivan. Let me ask for both of you. I keep 
hearing from safety experts about the importance of what they 
refer to as functional safety and that is the way the different 
systems work together with the operator as opposed to looking 
at each system as it is added to a new model in a vacuum. And 
it seems to me that this issue of functional safety is a core 
issue as it relates to the MAX given what has happened.
    Can you tell the Committee about what your company's 
approach to this issue of functional safety is when adding new 
systems to an existing aircraft like the 737? Obviously, there 
was a failure here on that issue. How are you working to 
improve that and does the FAA do enough to focus on this idea 
of functional safety not just the individual additions to 
existing and older models?
    Mr. Muilenburg. I will ask John to take that question.
    Mr. Hamilton. Yes. So Senator, I think it starts with our 
requirements breakdown of what is our airplane level 
requirements, system level requirements, component level 
requirements and then validating at the component level, the 
system level, and the airplane level how any change met the 
requirements and interacted across at the system or airplane 
level. You also talked about regulatory requirements.
    Senator Sullivan. Yes. Does the FAA focus enough do you 
think on functional safety?
    Mr. Hamilton. So there has been some rather recent changes 
in what we call development assurance that I think has 
continued to mature and again this looks at the functional 
safety and some of the things that you really focused at is the 
breakdown of requirements and how different systems interact 
with that. So, I think we as Mr. Muilenburg pointed out, some 
of the recent industry committee reports have discussed this 
and I think we will support those recommendations and the FAA's 
actions going forward.
    Senator Sullivan. Thank you. Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator Sullivan. And thank you to 
the panel. We appreciate you being with us and I am sure we 
will be questioning you further as we continue to get more 
reports. Our second panel of witnesses will be escorted in now. 
We thank you two gentlemen for being with us.
    The second panel, as I said before, is Mr. Robert Sumwalt, 
Chairman of the National Transportation Safety Board, and the 
Honorable Christopher Hart. Mr. Hart is the team Chair of the 
Joint Authorities Technical Review, which we use the shorthand 
of JATR for, and I have referred to that a number of times 
during this hearing. Mr. Hart is a former Chairman of the 
National Transportation Safety Board.
    They have been waiting patiently during these two and a 
half hours. Gentlemen, we appreciate you being here. We ask 
each of you to summarize your submitted testimony in five 
minutes. And Mr. Sumwalt, we will begin with you. You are 
recognized.

  STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL 
                  TRANSPORTATION SAFETY BOARD

    Mr. Sumwalt. Thank you, Mr. Chairman. Good afternoon 
Chairman Wicker, Ranking Member Cantwell, and members of the 
Committee. Thank you for the opportunity to testify before you 
today. This afternoon I will address the NTSB's recent 
recommendation report regarding the 737 MAX certification 
processes. This recommendation report issued last month 
contained seven recommendations to the FAA.
    These recommendations are the result of the NTSB's 
involvement as an accredited representative to the Indonesian 
government's investigation into last year's Lion Air crash and 
to the Ethiopian government's investigation into this year's 
crash involving the Ethiopian Airlines Boeing 737 MAX. The NTSB 
participates in foreign investigations in accordance with ICAO 
Annex 13, which details the standards and recommended practices 
of international aviation accident investigations.
    Under Annex 13, the state of occurrence leads the 
investigation and the U.S. has the right to participate in the 
investigation when it involves a U.S. manufacturer or U.S. 
registered or designed aircraft such as the 737 MAX 8. This is 
so that any design or manufacturing issues can promptly be 
addressed by the FAA and the manufacturer.
    As an accredited representative to these crash 
investigations, the NTSB initiated an in-depth examination of 
the U.S. design certification processes used to certify the 
MAX. The issues we identified revolve around three basic areas 
and our safety recommendations are centered on them.
    First, the system safety assumptions used by Boeing for the 
MCAS and ultimately accepted by the FAA did not use realistic 
pilot recognition and corrective actions in response to 
uncommanded flight control inputs. Quite simply, the 
assumptions that Boeing used did not consider or account for 
the impact that multiple flight deck alerts or indications 
could have on pilots' responses to uncommanded MCAS activation.
    Next, we identified the need for manufacturers to validate 
their pilot response assumptions using scientific methods and 
application of human factors principles to improve cockpit 
design, procedures, and training. We believe that the use of 
validated methods and tools to assess pilot performance in 
dealing with failure conditions in emergencies would result in 
more effective requirements for flight deck interface design, 
pilot procedures, and training strategies.
    And finally, we believe that manufacturers should develop 
and incorporate in airline cockpits mechanisms that would allow 
pilots to better diagnose, prioritize, and react to multiple 
alerts and alarms. The pilots in the Lion Air and Ethiopian 
crashes were faced with multiple oral and visual alerts.
    Research demonstrates that emergency situations increase 
workload and require additional effort to manage effectively 
because of the stress involved and possible confusion regarding 
which actions are necessary to resolve the problem. Each of our 
seven recommendations are detailed in my written testimony.
    In closing, it should be noted that the NTSB investigators 
continue to examine the design certification process, and we 
may issue additional recommendations in this area if warranted. 
Thank you again for the opportunity to testify and I look 
forward to your questions.
    [The prepared statement of Mr. Sumwalt follows:]

      Prepared Statement of Hon. Robert L. Sumwalt III, Chairman, 
                  National Transportation Safety Board
    Good afternoon, Chairman Wicker, Ranking Member Cantwell, and 
Members of the Committee. Thank you for inviting the National 
Transportation Safety Board (NTSB) to testify before you today.
    The NTSB is an independent Federal agency charged by Congress with 
investigating every civil aviation accident in the United States and 
significant accidents in other modes of transportation--highway, rail, 
marine, and pipeline. We determine the probable cause of the accidents 
we investigate, and we issue safety recommendations aimed at preventing 
future accidents. In addition, we conduct special transportation safety 
studies and special investigations and coordinate the resources of the 
Federal government and other organizations to assist victims and their 
family members who have been impacted by major transportation 
disasters. The NTSB is not a regulatory agency--we do not promulgate 
operating standards, nor do we certificate organizations, individuals, 
or equipment. The goal of our work is to foster safety improvements, 
through safety recommendations, for the traveling public.
    Today I will address NTSB's recent recommendation report, 
``Assumptions Used in the Safety Assessment Process and the Effects of 
Multiple Alerts and Indications on Pilot Performance,'' issued on 
September 26, 2019, which contained seven recommendations to the 
Federal Aviation Administration (FAA). These recommendations resulted 
from our examination of relevant factors in the U.S. design 
certification process following two crashes of Boeing 737 MAX 8 
aircraft.
NTSB's Role in Boeing 737-MAX 8 Crashes
    On October 29, 2018, a Boeing 737 MAX 8, operated by Lion Air, 
crashed into the Java Sea shortly after takeoff from Soekarno-Hatta 
International Airport, in Jakarta, Indonesia, killing all 189 
passengers and crew on board. The Komite Nasional Keselamatan 
Transportasi (KNKT) of Indonesia, investigated the accident and 
released the final report on October 25, 2019.\1\ On March 10, 2019, a 
Boeing 737 MAX 8, operated by Ethiopian Airlines, crashed after takeoff 
from Addis Ababa Bole International Airport in Ethiopia, killing all 
157 passengers and crew, including 8 American citizens. The 
investigation is being led by the Ethiopia Accident Investigation 
Bureau (EAIB), which released a preliminary report on April 4, 2019.\2\
---------------------------------------------------------------------------
    \1\ Komite Nasional Keselamatan Transportasi, Final Report No. 
KNKT.18.10.35.04.
    \2\ Ethiopia Accident Investigation Bureau, Report No. AI-01/19.
---------------------------------------------------------------------------
    The NTSB participated in these foreign investigations in accordance 
with the Chicago Convention of the International Civil Aviation 
Organization (ICAO) and the Standards and Recommended Practices 
provided in Annex 13 to the Convention because these accidents involved 
the Boeing 737 MAX 8, a US-designed, certified and manufactured 
airplane.\3\ Because both Indonesia and Ethiopia are signatories to the 
ICAO Convention, they are each responsible for the investigation in 
their state and control the release of all information regarding the 
investigation.
---------------------------------------------------------------------------
    \3\ ICAO is a UN specialized agency that manages the administration 
and governance of the Convention on International Civil Aviation 
(Chicago Convention), (https://www.icao.int/about-icao/Pages/
default.aspx).
---------------------------------------------------------------------------
    Following the Lion Air crash, the NTSB appointed a U.S. accredited 
representative and immediately dispatched investigators to Indonesia to 
participate in the KNKT investigation. NTSB investigators had access to 
all investigative data and participated in all aspects of the 
investigation, including: download and analysis of the flight data 
recorder (FDR) and cockpit voice recorder (CVR); teardown and 
examination of airplane components such as the angle of attack sensor 
that was removed prior to the accident flight; airplane performance 
analysis and simulation sessions; airplane system and certification 
analysis; interviews of airline and maintenance personnel; and review 
of the KNKT draft final report. The final report released by the KNKT 
on October 25, 2019, reiterated the seven NTSB recommendations and also 
included an additional 25 recommendations to seven organizations, 
including Lion Air, Boeing, Indonesian Directorate General of Civil 
Aviation, and the FAA.
    In response to the Ethiopian Airlines crash, the NTSB also 
appointed an accredited representative, who we dispatched to Ethiopia 
with a team of investigators. NTSB investigators continue to take part 
in this ongoing investigation and have had access to all investigative 
data, including taking part in the download and analysis of the CVR and 
FDR.
    In accordance with ICAO Annex 13, technical advisors from the FAA, 
Boeing, and General Electric have accompanied NTSB investigators to the 
Lion Air and Ethiopian Airlines accident sites to provide their 
specialized technical knowledge regarding the aircraft and its systems.
    ICAO Annex 13 provides for other involved states to gain timely 
access to investigative information for the purposes of continued 
operational safety. As a result, NTSB participation in the foreign 
accident investigations enabled safety deficiencies to be promptly 
addressed by the FAA and the manufacturer and through NTSB safety 
recommendations. Because the United States is the state of design and 
manufacturer of the aircraft involved in these accidents, we examined 
relevant factors in the U.S. design certification process to ensure 
deficiencies were identified and addressed.
Design Certification of the 737 MAX 8 and Safety Assessment of the 
        Maneuvering Characteristics Augmentation System (MCAS)
    The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG) 
model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\4\ The 
737 MAX incorporated a new engine (CFM LEAP-1B) and nacelle, which 
produced an airplane-nose-up pitching moment when the airplane was 
operating at high angle of attack (AOA) and mid-Mach numbers. After 
studying various options for addressing this issue, Boeing implemented 
aerodynamic changes as well as a stability augmentation function, 
Maneuvering Characteristics Augmentation System (MCAS), as an extension 
of the existing speed trim system to improve aircraft handling 
characteristics and decrease pitch-up tendency at elevated AOA. As the 
development of the 737 MAX progressed, the MCAS function was expanded 
to low Mach numbers.
    As originally delivered, the MCAS became active during manual 
flight (autopilot not engaged) when the flaps were fully retracted and 
the airplane's AOA value (as measured by either AOA sensor) exceeded a 
threshold based on Mach number. When activated, the MCAS provided 
automatic trim commands to move the stabilizer airplane nose down. Once 
the AOA fell below the threshold, the MCAS would move the stabilizer to 
the original position. At any time, the stabilizer inputs could be 
stopped or reversed by the pilots using their stabilizer trim switches. 
If the stabilizer trim switches were used by the pilots and the 
elevated AOA condition persisted, the MCAS would command another 
stabilizer airplane nose down trim input after 5 seconds.
    In each of the accident flights, the MCAS activated in response to 
erroneous AOA inputs, resulting in continuous command of airplane nose 
down stabilizer trim input as well as other alerts and indications. 
Multiple alerts and indications can increase pilots' workload, and the 
combination of the alerts and indications did not trigger the accident 
pilots to immediately perform the runaway stabilizer trim procedure 
during the MCAS-activated airplane-nose-down stabilizer trim input. The 
pilots' responses did not match the assumptions of the pilot responses 
to unintended MCAS operation on which Boeing based its hazard 
classifications within the safety assessment and that the FAA approved 
and used to ensure the design safely accommodates failures. Thus, the 
NTSB concluded that Boeing's functional hazard assessment of 
uncommanded MCAS function for the 737 MAX did not adequately consider 
and account for the impact that multiple flight deck alerts and 
indications could have on pilots' responses to the hazard.
    We further concluded that a standardized methodology and/or tools 
for manufacturers' use in evaluating and validating assumptions about 
pilot recognition and response to failure condition(s), would help 
ensure that system designs adequately and consistently minimize the 
potential for pilot actions that are inconsistent with manufacturer 
assumptions. Lastly, because the pilots were uncertain how to 
prioritize and respond to the multiple alerts and indications that they 
received, we concluded that aircraft systems that can more clearly and 
concisely inform pilots of the highest priority actions when multiple 
flight deck alerts and indications are present would minimize confusion 
and help pilots respond most effectively.
    Since the Lion Air accident in October 2018, Boeing has developed a 
software update to provide additional layers of protection to the MCAS 
and is working on updated procedures and training. However, we are 
concerned that the process used to evaluate the original design needs 
improvement because that process is still in use to certify current and 
future aircraft and system designs. Therefore, in accordance with our 
responsibilities as the accredited representative of the state of 
design and manufacture of the 737, we felt it necessary to issue safety 
recommendations.
NTSB Recommendations
    On September 19, 2019, the NTSB issued seven safety recommendations 
to the FAA as a result of our examination of the U.S. design 
certification process used to approve the original design of the MCAS 
system on the Boeing 737 MAX.
    The NTSB found that the accident pilots' responses to the 
unintended MCAS operation were not consistent with the underlying 
assumptions about pilot recognition and response that Boeing used, 
based on FAA guidance, for flight control system functional hazard 
assessments, including for MCAS, as part of the 737 MAX design. We 
issued these recommendations to address assumptions about pilot 
recognition and response to failure conditions used during the design 
certification process as well as diagnostic tools to improve the 
prioritization and clarity of failure indications presented to pilots.
    As a result of the NTSB's in-depth examination of the U.S. design 
certification process and assumptions used to approve the original 
design of the MCAS system on the Boeing 737 MAX, the NTSB issued the 
following seven recommendations to the FAA:

  1.  Require that Boeing (1) ensure that system safety assessments for 
        the 737 MAX in which it assumed immediate and appropriate pilot 
        corrective actions in response to uncommanded flight control 
        inputs, from systems such as the Maneuvering Characteristics 
        Augmentation System, consider the effect of all possible flight 
        deck alerts and indications on pilot recognition and response; 
        and (2) incorporate design enhancements (including flight deck 
        alerts and indications), pilot procedures, and/or training 
        requirements, where needed, to minimize the potential for and 
        safety impact of pilot actions that are inconsistent with 
        manufacturer assumptions. (A-19-10)

  2.  Require that for all other U.S. type-certificated transport-
        category airplanes, manufacturers (1) ensure that system safety 
        assessments for which they assumed immediate and appropriate 
        pilot corrective actions in response to uncommanded flight 
        control inputs consider the effect of all possible flight deck 
        alerts and indications on pilot recognition and response; and 
        (2) incorporate design enhancements (including flight deck 
        alerts and indications), pilot procedures, and/or training 
        requirements, where needed, to minimize the potential for and 
        safety impact of pilot actions that are inconsistent with 
        manufacturer assumptions. (A-19-11)

  3.  Notify other international regulators that certify transport-
        category airplane type designs (for example, the European Union 
        Aviation Safety Agency, Transport Canada, the National Civil 
        Aviation Agency-Brazil, the Civil Aviation Administration of 
        China, and the Russian Federal Air Transport Agency) of 
        Recommendation A-19-11 and encourage them to evaluate its 
        relevance to their processes and address any changes, if 
        applicable. (A-19-12)

  4.  Develop robust tools and methods, with the input of industry and 
        human factors experts, for use in validating assumptions about 
        pilot recognition and response to safety-significant failure 
        conditions as part of the design certification process. (A-19-
        13)

  5.  Once the tools and methods have been developed as recommended in 
        Recommendation A-19-13, revise existing Federal Aviation 
        Administration (FAA) regulations and guidance to incorporate 
        their use and documentation as part of the design certification 
        process, including re-examining the validity of pilot 
        recognition and response assumptions permitted in existing FAA 
        guidance. (A-19-14)

  6.  Develop design standards, with the input of industry and human 
        factors experts, for aircraft system diagnostic tools that 
        improve the prioritization and clarity of failure indications 
        (direct and indirect) presented to pilots to improve the 
        timeliness and effectiveness of their response. (A-19-15)

  7.  Once the design standards have been developed as recommended in 
        Recommendation A-19-15, require implementation of system 
        diagnostic tools on transport-category aircraft to improve the 
        timeliness and effectiveness of pilots' response when multiple 
        flight deck alerts and indications are present. (A-19-16)

    The complete safety recommendation report is attached to this 
testimony.
    Finally, it should be noted that NTSB investigators continue to 
examine the design certification process and the NTSB may issue 
additional recommendations in this area in the future if such 
recommendations are warranted.
Conclusion
    Thank you again for the opportunity to be here today to discuss the 
NTSB's role in these important international aviation accident 
investigations and to highlight our recent recommendations to FAA 
regarding the safety assessment process. I will be happy to answer any 
questions.
                                 ______
                                 
                  National Transportation Safety Board
                          Washington, DC 20594
                      Safety Recommendation Report
Assumptions Used in the Safety Assessment Process and the Effects of 
        Multiple Alerts and Indications on Pilot Performance

------------------------------------------------------------------------
 
------------------------------------------------------------------------
Accident Number:          DCA19RA017/DCA19RA101
 
Operator:                 PT Lion Mentari Airlines/Ethiopian Airlines
 
Aircraft:                 Boeing 737 MAX 8/Boeing 737 MAX 8
 
Location:                 Java Sea, Indonesia/Ejere, Ethiopia
 
Date:                     October 29, 2018/March 10, 2019
------------------------------------------------------------------------

    The National Transportation Safety Board (NTSB) is providing the 
following information to urge the Federal Aviation Administration (FAA) 
to take action on the safety recommendations in this report. They are 
derived from our participation in the ongoing investigations of two 
fatal accidents under the provisions of Annex 13 of the International 
Civil Aviation Organization. As the accident investigation authority 
for the state of design and manufacture of the airplane in these 
accidents, the NTSB has been examining the U.S. design certification 
process used to approve the original design of the Maneuvering 
Characteristics Augmentation System (MCAS) on the Boeing Company 
(Boeing) 737 MAX. We note that, since the PT Lion Mentari Airlines 
(Lion Air) accident on October 29, 2018, Boeing has developed an MCAS 
software update to provide additional layers of protection and is 
working on updated procedures and training. However, we are concerned 
that the process used to evaluate the original design needs improvement 
because that process is still in use to certify current and future 
aircraft and system designs.
    Although the NTSB's work in this area is ongoing, based on 
preliminary information, we are concerned that the accident pilot 
responses to the unintended MCAS operation were not consistent with the 
underlying assumptions about pilot recognition and response that Boeing 
used, based on FAA guidance, for flight control system functional 
hazard assessments, including for MCAS, as part of the 737 MAX 
design.\1\ We are making these recommendations to address assumptions 
about pilot recognition and response to failure conditions used during 
the design certification process as well as diagnostic tools to improve 
the prioritization and clarity of failure indications presented to 
pilots.
---------------------------------------------------------------------------
    \1\ (a) We based our preliminary findings on information from the 
publicly released preliminary accident reports. (b) While Boeing uses 
the term ``uncommanded MCAS function'' in its assessment documents, in 
this report, we are using the term ``unintended MCAS operation'' as it 
relates to our review of the accident events.
---------------------------------------------------------------------------
                          Factual Information
Accidents
    On October 29, 2018, Lion Air flight 610, a Boeing 737 MAX 8, PK-
LQP, crashed in the Java Sea shortly after takeoff from Soekarno-Hatta 
International Airport, Jakarta, Indonesia. The flight crew had 
communicated with air traffic control and indicated that they were 
having flight control and altitude issues before the airplane 
disappeared from radar. The flight was a scheduled domestic flight from 
Jakarta to Depati Amir Airport, Pangkal Pinang City, Bangka Belitung 
Islands Province, Indonesia. All 189 passengers and crew on board died, 
and the airplane was destroyed. The National Transportation Safety 
Committee of Indonesia is leading the investigation.\2\
---------------------------------------------------------------------------
    \2\ Information in this section is taken from the preliminary 
report on this accident, which can be found at https://
reports.aviation-safety.net/2018/20181029-0_B38M_PK-LQP_PRELIMI
NARY.pdf.
---------------------------------------------------------------------------
    The airplane's digital flight data recorder (DFDR) recorded a 
difference between the left and right angle of attack (AOA) sensors 
that was present during the entire accident flight; the left AOA sensor 
was indicating about 20+ higher than the right AOA sensor. During 
rotation, the left (captain's) stick shaker activated, and DFDR data 
showed that the left airspeed and altitude values disagreed with, and 
were lower than, the corresponding values from the right. The first 
officer asked a controller to confirm the altitude of the airplane and 
later also asked the speed as shown on the controller radar display. 
After the flaps were fully retracted, a 10-second automaticaircraft 
nose-down (AND) stabilizer trim input occurred. After the automatic AND 
stabilizer trim input, the flight crew used the stabilizer trim 
switches (located on the outboard side of each control wheel) and 
applied aircraft nose-up (ANU) electric trim. According to DFDR data, 
about 5 seconds after the completion of the pilot trim input, another 
automatic AND stabilizer trim input occurred. The crew applied ANU 
electric trim again. DFDR data then showed that the flaps were extended 
for almost 2 minutes. However, the flaps were then fully retracted, and 
automatic AND stabilizer trim inputs occurred more than 20 times over 
the next 6 minutes; the crew countered each input during this time 
using ANU electric trim. The last few automatic AND stabilizer trim 
inputs were not fully countered by the crew.
    During the preceding Lion Air flight on the accident airplane with 
a different flight crew, the DFDR recorded the same difference between 
left and right AOA of about 20+ that continued until the end of the 
recording. During rotation, the left control column stick shaker 
activated and continued for the entire flight, and DFDR data showed 
that the left airspeed and altitude values disagreed with, and were 
lower than, the corresponding values from the right. After the flaps 
were fully retracted, a 10-second automatic AND stabilizer trim input 
occurred, and the crew countered the input with an ANU electric trim 
input. After several automatic AND stabilizer trim inputs that were 
countered by pilot-commanded ANU electric trim inputs, the crew noticed 
that the airplane was automatically trimming AND. The captain moved the 
stabilizer trim cutout (STAB TRIM CUTOUT) switches to CUTOUT.\3\ He 
then moved them back to NORMAL, and the problem almost immediately 
reappeared. He moved the switches back to CUTOUT. He stated that the 
crew performed three non-normal checklists: Airspeed Unreliable, ALT 
DISAGREE (altitude disagree), and Runaway Stabilizer. The pilots 
continued the flight using manual trim until the end of the flight. 
Upon landing, the captain informed an engineer of IAS DISAGREE 
(indicated airspeed disagree) and ALT DISAGREE alerts, in addition to 
FEEL DIFF PRESS (feel differential pressure) light problems on the 
airplane.
---------------------------------------------------------------------------
    \3\ Two STAB TRIM CUTOUT switches on the control stand can be used 
to stop the flight crew electric and autopilot trim inputs to the 
stabilizer trim actuator. The switches can be set to NORMAL or CUTOUT. 
If the switches are moved to CUTOUT, both the electric and autopilot 
trim inputs are disconnected from the stabilizer trim motor. NORMAL is 
the default position to enable operation of the electric and autopilot 
trim.
---------------------------------------------------------------------------
    On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX 
8, Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly 
after takeoff from Addis Ababa Bole International Airport, Ethiopia. 
The flight was a scheduled international passenger flight from Addis 
Ababa to Jomo Kenyatta International Airport, Nairobi, Kenya. All 157 
passengers and crew on board died, and the airplane was destroyed. The 
investigation is being led by the Ethiopia Accident Investigation 
Bureau.\4\
---------------------------------------------------------------------------
    \4\ Information in this section is taken from the preliminary 
report on this accident, which can be found at http://www.ecaa.gov.et/
Home/wp-content/uploads/2019/07/Preliminary-Report-B737-800MAX-ET-
AVJ.pdf.
---------------------------------------------------------------------------
    The airplane's DFDR data indicated that shortly after liftoff, the 
left (captain's) AOA sensor data increased rapidly to 74.5+ and was 
59.2+ higher than the right AOA sensor; the captain's stick shaker 
activated. Concurrently, the airspeed and altitude values on the left 
side disagreed with, and were lower than, the corresponding values on 
the right side; in addition, DFDR data indicated a Master Caution 
alert. Similar to the Lion Air accident flight, a 9-second automatic 
AND stabilizer trim input occurred after flaps were retracted and while 
in manual flight (no autopilot). About 3 seconds after the AND 
stabilizer motion ended, using the stabilizer trim switches, the 
captain, who was the pilot flying, partially countered the AND 
stabilizer input by applying ANU electric trim. About 5 seconds after 
the completion of pilot trim input, another automatic AND stabilizer 
trim input occurred. The captain applied ANU electric trim and fully 
countered the second automatic AND stabilizer input; however, the 
airplane was not returned to a fully trimmed condition. Cockpit voice 
recorder data indicated that the flight crew then discussed the STAB 
TRIM CUTOUT switches, and shortly thereafter DFDR data were consistent 
with the STAB TRIM CUTOUT switches being moved to CUTOUT.
    However, because the airplane remained in a nose-down out-of-trim 
condition, the crew was required to continue applying nose-up force to 
the control column to maintain level flight. About 32 seconds before 
impact, two momentary pilot-commanded electric ANU trim inputs and 
corresponding stabilizer movement were recorded, consistent with the 
STAB TRIM CUTOUT switches no longer being in CUTOUT. Five seconds after 
these short electric trim inputs, another automatic AND stabilizer trim 
input occurred, and the airplane began pitching nose down.
Design Certification of the 737 MAX 8 and Safety Assessment of the MCAS
    The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG) 
model and is part of the 737 MAX family (737 MAX 7, 8, and 9).\5\ The 
737 MAX incorporated the CFM LEAP-1B engine, which has a larger fan 
diameter and redesigned engine nacelle compared to engines installed on 
the 737 NG family. During the preliminary design stage of the 737 MAX, 
Boeing testing and analysis revealed that the addition of the LEAP-1B 
engine and associated nacelle changes produced an ANU pitching moment 
when the airplane was operating at high AOA and mid Mach numbers. After 
studying various options for addressing this issue, Boeing implemented 
aerodynamic changes as well as a stability augmentation function, MCAS, 
as an extension of the existing speed trim system to improve aircraft 
handling characteristics and decrease pitch-up tendency at elevated 
AOA. As the development of the 737 MAX progressed, the MCAS function 
was expanded to low Mach numbers.
---------------------------------------------------------------------------
    \5\ The 737-600, -700, and -800 airplanes are part of the 737 NG 
family.
---------------------------------------------------------------------------
    As originally delivered, the MCAS became active during manual 
flight (autopilot not engaged) when the flaps were fully retracted and 
the airplane's AOA value (as measured by either AOA sensor) exceeded a 
threshold based on Mach number. When activated, the MCAS provided 
automatic trim commands to move the stabilizer AND. Once the AOA fell 
below the threshold, the MCAS would move the stabilizer ANU to the 
original position. At any time, the stabilizer inputs could be stopped 
or reversed by the pilots using their stabilizer trim switches. If the 
stabilizer trim switches were used by the pilots and the elevated AOA 
condition persisted, the MCAS would command another stabilizer AND trim 
input after 5 seconds.
    The FAA's procedures for aircraft type certification require an 
aircraft manufacturer (``applicant'') to demonstrate that its design 
complies with all applicable FAA regulations and requirements.\6\ For 
transport-category airplanes, as part of this process, applicants must 
demonstrate through analysis, test, or both that their design meets the 
applicable requirements under Title 14 Code of Federal Regulations 
(CFR) Part 25. Specifically, 14 CFR 25.671 and 25.672 define the 
requirements for control systems in general and stability augmentation 
and automatic and power-operated systems, respectively. Title 14 CFR 
25.1322 addresses flight crew alerting and states, in part, that flight 
crew alerts must
---------------------------------------------------------------------------
    \6\ Title 14 Code of Federal Regulations Part 21 defines the 
procedures for certification.

---------------------------------------------------------------------------
  (1)  Provide the flightcrew with the information needed to:

      (i)  Identify non-normal operation or airplane system conditions, 
            and

      (ii)  Determine the appropriate actions, if any.

  (2)  Be readily and easily detectable and intelligible by the 
        flightcrew under all foreseeable operating conditions, 
        including conditions where multiple alerts are provided.

Advisory Circular (AC) 25.1322-1, ``Flightcrew Alerting,'' provides 
guidance for showing compliance with requirements for the design 
approval of flight crew alerting functions and indicates that 
``Appropriate flightcrew corrective actions are normally defined by 
airplane procedures (for example, in checklists) and are part of a 
flightcrew training curriculum or considered basic airmanship.'' Title 
14 CFR 25.1309 relates to aircraft equipment, systems, and 
installations, and the primary means of compliance with this section 
for systems that are critical to safe flight and operations is through 
safety assessments or through rational analyses; AC 25.1309-1A, 
``System Design and Analysis,'' provides guidance for showing 
compliance with Title 14 CFR 25.1309(b), (c), and (d).\7\ AC 25.1309-1A 
explains the FAA's fail-safe design concept, which ``considers the 
effects of failures and combinations of failures in defining a safe 
design.'' As part of demonstrating 737 MAX 8 compliance with the 
requirements in 14 CFR 25.1309, Boeing conducted a number of airplane-
and system-level safety assessments, consistent with the guidance 
provided in AC 25.1309-1A.\8\
---------------------------------------------------------------------------
    \7\ Safety assessments are performed by the manufacturer and its 
suppliers and are reviewed and accepted by the FAA. Safety assessments 
proceed in a stepwise, data-driven manner to ensure that all 
significant single-failure conditions have been identified and all 
combinations of failures that could lead to hazardous or catastrophic 
airplane-level effects have been considered and appropriately 
mitigated. When a safety assessment cannot be performed on a new or 
complex system, a rational analysis may be performed to estimate 
quantitative probabilities and supplement qualitative analyses and 
tests. The safety assessment process outlined in AC 25.1309-1A is not 
mandatory, but manufacturers that do not conduct safety assessments 
must demonstrate compliance in another manner, such as ground or flight 
tests.
    \8\ Safety assessments can include the development of airplane-and 
system-level functional hazard assessments (to identify and classify 
potentially hazardous failure conditions), failure modes and effects 
analyses (a structured bottom-up analysis that evaluates the effects of 
each possible failure), and fault tree analyses (a structured top-down 
analysis to identify the conditions, failures, and events that would 
cause a failure condition).
---------------------------------------------------------------------------
    The NTSB reviewed sections of Boeing's system safety analysis for 
stabilizer trim control that pertained to MCAS on the 737 MAX. Boeing's 
analysis included a summary of the functional hazard assessment 
findings for the 737 MAX stabilizer trim control system. For the normal 
flight envelope, Boeing identified and classified two hazards 
associated with ``uncommanded MCAS'' activation as ``major.'' \9\ One 
of these hazards, applicable to the MCAS function seen in these 
accidents, included uncommanded MCAS operation to maximum 
authority.\10\ Boeing indicated that, as part of the functional hazard 
assessment development, pilot assessments of MCAS-related hazards were 
conducted in an engineering flight simulator, including the uncommanded 
MCAS operation (stabilizer runaway) to the MCAS maximum authority.
---------------------------------------------------------------------------
    \9\ The ``major'' classification used by Boeing indicated a remote 
probability of this hazard occurring and that it could result in 
reduced control capability, reduced system redundancy, or increased 
crew workload. Other classification categories included ``minor,'' 
``hazardous,'' and ``catastrophic.''
    \10\ In March 2016, Boeing determined that MCAS should be revised 
to improve flaps up, low Mach stall characteristics and identification. 
The preliminary hazard assessments of MCAS were re-evaluated after this 
change by pilot evaluation in the motion simulator and determined to 
have not changed the hazard classification.
---------------------------------------------------------------------------
    To perform these simulator tests, Boeing induced a stabilizer trim 
input that would simulate the stabilizer moving at a rate and duration 
consistent with the MCAS function. Using this method to induce the 
hazard resulted in the following: motion of the stabilizer trim wheel, 
increased column forces, and indication that the airplane was moving 
nose down. Boeing indicated to the NTSB that this evaluation was 
focused on the pilot response to uncommanded MCAS operation, regardless 
of underlying cause. Thus, the specific failure modes that could lead 
to uncommanded MCAS activation (such as an erroneous high AOA input to 
the MCAS) were not simulated as part of these functional hazard 
assessment validation tests. As a result, additional flight deck 
effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker 
activation) resulting from the same underlying failure (for example, 
erroneous AOA) were not simulated and were not in the stabilizer trim 
safety assessment report reviewed by the NTSB.
    Boeing indicated to the NTSB that, based on FAA guidance, it used 
assumptions during its safety assessment of MCAS hazards in the 
engineering flight simulator. Four of these assumptions were the 
following:

   Uncommanded system inputs are readily recognizable and can 
        be counteracted by overriding the failure by movement of the 
        flight controls ``in the normal sense'' by the flight crew and 
        do not require specific procedures.\11\
---------------------------------------------------------------------------
    \11\ Title 14 CFR 25.672 states the following: ``The design of the 
stability augmentation system or of any other automatic or power-
operated system must permit initial counteraction of failures of the 
type specified in Sec. 25.671(c) without requiring exceptional pilot 
skill or strength, by either the deactivation of the esystem, or a 
failed portion thereof, or by overriding the failure by movement of the 
flight controls in the normal sense.''

   Action to counter the failure shall not require exceptional 
---------------------------------------------------------------------------
        piloting skill or strength.

   The pilot will take immediate action to reduce or eliminate 
        increased control forces by re-trimming or changing 
        configuration or flight conditions.

   Trained flight crew memory procedures shall be followed to 
        address and eliminate or mitigate the failure.

Boeing advised that these assumptions are used across all Boeing models 
when performing functional hazard assessments of flight control 
systems. These assumptions were consistent with requirements in 14 CFR 
25.671 and 25.672 and guidance in AC 25-7C, ``Flight Test Guide for 
Certification of Transport Category Airplanes.'' \12\ AC 25-7C stated 
that short-term forces are the initial stabilized control forces that 
result from maintaining the intended flightpath after configuration 
changes and normal transitions from one flight condition to another, 
``or from regaining control following a failure. It is assumed that the 
pilot will take immediate action to reduce or eliminate such forces by 
re-trimming or changing configuration or flight conditions, and 
consequently short-term forces are not considered to exist for any 
significant duration [emphasis added].'' In a 2019 presentation to the 
NTSB, Boeing indicated that the MCAS hazard classification of ``major'' 
for uncommanded MCAS function in the normal flight envelope was based 
on the following conclusions:
---------------------------------------------------------------------------
    \12\ On October 16, 2012, the FAA released AC 25-7C, which revised 
version B to reduce the number of differences from the European 
Aviation Safety Agency's Flight Test Guide; provide acceptable means of 
compliance for the regulatory changes associated with amendments 107, 
109, 113, 115, 119, and 123 to 14 CFR Part 25; respond to NTSB 
recommendations; and provide a general update to reflect current FAA 
and industry practices and policies. AC 25-7C was in effect at the time 
of Boeing's safety assessments of the 737 MAX. On May 4, 2018, the FAA 
released AC 25-7D to clarify several paragraphs, revise an appendix, 
and improve usability with formatting changes.

   Unintended stabilizer trim inputs are readily recognized by 
        movement of the stabilizer trim wheel, flightpath change, or 
---------------------------------------------------------------------------
        increased column forces.

   Aircraft can be returned to steady level flight using 
        available column (elevator) alone or stabilizer trim.

   Continuous unintended nose-down stabilizer trim inputs would 
        be recognized as a stabilizer trim or stabilizer runaway 
        failure and the procedure for stabilizer runaway would be 
        followed.\13\
---------------------------------------------------------------------------
    \13\ The runaway stabilizer procedure includes holding the control 
column firmly, disengaging the autopilot and autothrottles (if 
engaged), setting the STAB TRIM CUTOUT switches to CUTOUT, and trimming 
the airplane manually.
---------------------------------------------------------------------------
                                Analysis
Assumptions about Pilot Recognition and Response in the Safety 
        Assessment
    Functional hazard assessments at the aircraft and systems levels 
are a critical part of the design certification process because the 
resulting hazard classifications (severity level) drive the safety 
requirements for equipment design, flight crew procedures, and training 
to ensure the hazard effects are sufficiently mitigated. On the basis 
of Boeing's functional hazard assessment for the MCAS, which assumed 
timely pilot response to uncommanded MCAS-generated trim input, 
uncommanded MCAS activation was classified as ``major.'' Boeing was 
then required to verify that each system that supported MCAS complied 
with the quantitative and qualitative safety requirements for a 
``major'' hazard, as provided in AC 25.1309-1A, and demonstrate this to 
the FAA in its aircraft and system safety assessments.
    On the Lion Air flight immediately before the accident flight and 
the Lion Air and Ethiopian Airlines accident flights, the DFDR recorded 
higher AOA sensor data on the left side than on the right (about 20+ 
higher on the previous Lion Air flight and the Lion Air accident flight 
and about 59+ higher on the Ethiopian Airlines accident flight). As 
previously stated, the MCAS becomes active when the airplane's AOA 
exceeds a certain threshold. Thus, these erroneous AOA sensor inputs 
resulted in the MCAS activating on the accident flights and providing 
the automatic AND stabilizer trim inputs. The erroneous high AOA sensor 
input that caused the MCAS activation also caused several other alerts 
and indications for the flight crews. The stick shaker activated on 
both accident flights and the previous Lion Air flight. In addition, 
IAS DISAGREE and ALT DISAGREE alerts occurred on all three flights. 
Also, the Ethiopian Airlines flight crew received a Master Caution 
alert. Further, after the flaps were fully retracted, the unintended 
AND stabilizer inputs required the pilots to apply additional force to 
the columns to maintain the airplane's climb attitude.
    Multiple alerts and indications can increase pilots' workload, and 
the combination of the alerts and indications did not trigger the 
accident pilots to immediately perform the runaway stabilizer procedure 
during the initial automatic AND stabilizer trim input. In all three 
flights, the pilot responses differed and did not match the assumptions 
of pilot responses to unintended MCAS operation on which Boeing based 
its hazard classifications within the safety assessment and that the 
FAA approved and used to ensure the design safely accommodates 
failures. Although a number of factors, including system design, 
training, operation, and the pilots' previous experiences, can affect a 
human's ability to recognize and take immediate, appropriate corrective 
actions for failure conditions, industry experts generally recognize 
that an aircraft system should be designed such that the consequences 
of any human error are limited.\14\ Further, a report on a joint FAA-
industry study published in 2002, Commercial Airplane Certification 
Process Study: An Evaluation of Selected Aircraft Certification, 
Operations, and Maintenance Processes, noted that human performance was 
still the dominant factor in accidents and highlighted that the 
industry challenge is to develop airplanes and procedures that are less 
likely to result in operator error and that are more tolerant of 
operator errors when they do occur, in particular errors involving 
incorrect response after a malfunction.\15\
---------------------------------------------------------------------------
    \14\ (a) Yeh, Michelle, Cathy Swider, Young Jin Jo, and Colleen 
Donovan. 2016. Human Factors Considerations in the Design and 
Evaluation of Flight Deck Displays and Controls. Version 2.0, Final 
Report--December 2016, DOT/FAA/TC-16/56. pp. 248-249. (b) The FAA's 
Pilot's Handbook of Aeronautical Knowledge, FAA-H-8083-25B, Chapter 2, 
page 2-12, states, ``Historically, the term `pilot error' has been used 
to describe an accident in which an action or decision made by the 
pilot was the cause or a contributing factor that led to the accident. 
This definition also includes the pilot's failure to make a correct 
decision or take proper action.''
    \15\ The industry study team included representatives from 
manufacturers, airlines, pilot labor organizations, and other aviation 
stakeholders. See Commercial Airplane Certification Process Study: An 
Evaluation of Selected Aircraft Certification, Operations, and 
Maintenance Processes. March 2002. The Report of the FAA Associate 
Administrator for Regulation and Certification's Study on the 
Commercial Airplane Certification Process.
---------------------------------------------------------------------------
    Consistent with this philosophy, the NTSB notes that FAA 
certification guidance in AC 25.1309-1A that allows manufacturers to 
assume pilots will respond to failure conditions appropriately is 
based, in part, upon the applicant showing that the systems, controls, 
and associated monitoring and warnings are designed to minimize crew 
errors, which could create additional hazards.\16\ While Boeing 
considered the possibility of uncommanded MCAS operation as part of its 
functional hazard assessment, it did not evaluate all the potential 
alerts and indications that could accompany a failure that also 
resulted in uncommanded MCAS operation. Therefore, neither Boeing's 
system safety assessment nor its simulator tests evaluated how the 
combined effect of alerts and indications might impact pilots' 
recognition of which procedure(s) to prioritize in responding to an 
unintended MCAS operation caused by an erroneous AOA input.\17\ The 
NTSB is concerned that, if manufacturers assume correct pilot response 
without comprehensively examining all possible flight deck alerts and 
indications that may occur for system and component failures that 
contribute to a given hazard, the hazard classification and resulting 
system design (including alerts and indications), procedural, and/or 
training mitigations may not adequately consider and account for the 
potential for pilots to take actions that are inconsistent with 
manufacturer assumptions.
---------------------------------------------------------------------------
    \16\ Title 14 CFR 25.1309(c) states, ``Warning information must be 
provided to alert the crew to unsafe system operating conditions, and 
to enable them to take appropriate corrective action. Systems, 
controls, and associated monitoring and warning means must be designed 
to minimize crew errors which could create additional hazards.''
    \17\ Per Title 14 CFR 25.1309(d)(4), compliance demonstration as 
part of aircraft certification must include analysis that considers the 
crew warning cues, corrective action required, and the capability of 
detecting faults.
---------------------------------------------------------------------------
    Thus, the NTSB concludes that the assumptions that Boeing used in 
its functional hazard assessment of uncommanded MCAS function for the 
737 MAX did not adequately consider and account for the impact that 
multiple flight deck alerts and indications could have on pilots' 
responses to the hazard. Therefore, the NTSB recommends that the FAA 
require that Boeing (1) ensure that system safety assessments for the 
737 MAX in which it assumed immediate and appropriate pilot corrective 
actions in response to uncommanded flight control inputs, from systems 
such as MCAS, consider the effect of all possible flight deck alerts 
and indications on pilot recognition and response; and (2) incorporate 
design enhancements (including flight deck alerts and indications), 
pilot procedures, and/or training requirements, where needed, to 
minimize the potential for and safety impact of pilot actions that are 
inconsistent with manufacturer assumptions.
    Further, because FAA guidance allows such assumptions to be made in 
transport-category airplane certification analyses without providing 
applicants with clear direction concerning the consideration of 
multiple flight deck alerts and indications in evaluating pilot 
recognition and response, the NTSB is concerned that similar 
assumptions and procedures for their validation may have also been used 
in the development of flight control system safety assessments for 
other airplanes. Therefore, the NTSB recommends that the FAA require 
that for all other U.S. type-certificated transport-category airplanes, 
manufacturers (1) ensure that system safety assessments for which they 
assumed immediate and appropriate pilot corrective actions in response 
to uncommanded flight control inputs consider the effect of all 
possible flight deck alerts and indications on pilot recognition and 
response; and (2) incorporate design enhancements (including flight 
deck alerts and indications), pilot procedures, and/or training 
requirements, where needed, to minimize the potential for and safety 
impact of pilot actions that are inconsistent with manufacturer 
assumptions.
    Because the FAA routinely harmonizes related standards and guidance 
with other international regulators who type certificate transport-
category airplanes, the NTSB notes that those airplanes may have been 
designed using similar standards and therefore may also be impacted by 
this vulnerability. Therefore, the NTSB also recommends that the FAA 
notify other international regulators that certify transport-category 
airplane type designs (for example, the European Union Aviation Safety 
Agency [EASA], Transport Canada, the National Civil Aviation Agency-
Brazil, the Civil Aviation Administration of China, and the Russian 
Federal Air Transport Agency) of Recommendation A-19-11 and encourage 
them to evaluate its relevance to their processes and address any 
changes, if applicable.
    As early as 2002, the joint FAA-industry study recognized that, 
while excellent guidance existed for manufacturers on various topics 
salient to the development of system safety assessments, there were no 
methods available to evaluate the probability of human error in the 
operation of a particular system design and that existing qualitative 
methods for assessing human error were not ``very satisfactory.'' The 
2002 study went on to state that the processes used to determine and 
validate human responses to failure and methods to include human 
responses in safety assessments needed to be improved.\18\ The NTSB 
notes that a number of human performance research studies have been 
conducted in the years since the certification guidance contained in AC 
25.1309-1A was put in place (in 1988) and this study was conducted and 
it is likely that more rigorous, validated methodologies exist today to 
assess error tolerance with regard to pilot recognition and response to 
failure conditions. The NTSB also believes that the use of validated 
methods and tools to assess pilot performance in dealing with failure 
conditions and emergencies would result in more effective requirements 
for flight deck interface design, pilot procedures, and training 
strategies. However, we are concerned that such tools and methods are 
still not commonplace or required as part of the design certification 
process for functions such as MCAS on newly certified type designs.
---------------------------------------------------------------------------
    \18\ Commercial Airplane Certification Process Study: An Evaluation 
of Selected Aircraft Certification, Operations, and Maintenance 
Processes. March 2002. The Report of the FAAAssociate Administrator for 
Regulation and Certification's Study on the Commercial Airplane 
Certification Process.
---------------------------------------------------------------------------
    Thus, the NTSB concludes that a standardized methodology and/or 
tools for manufacturers' use in evaluating and validating assumptions 
about pilot recognition and response to failure condition(s), 
particularly those conditions that result in multiple flight deck 
alerts and indications, would help ensure that system designs 
adequately and consistently minimize the potential for pilot actions 
that are inconsistent with manufacturer assumptions. Therefore, the 
NTSB recommends that the FAA develop robust tools and methods, with the 
input of industry and human factors experts, for use in validating 
assumptions about pilot recognition and response to safety-significant 
failure conditions as part of the design certification process. 
Further, the NTSB recommends that once the tools and methods have been 
developed as recommended in Recommendation A-19-13, the FAA revise 
existing FAA regulations and guidance to incorporate their use and 
documentation as part of the design certification process, including 
re-examining the validity of pilot recognition and response assumptions 
permitted in existing FAA guidance.
System Diagnostic Tools
    As previously discussed, Title 14 CFR 25.1322 addresses flight crew 
alerting and states, in part, that flight crew alerts must

  (1)  Provide the flightcrew with the information needed to:

      (i)  Identify non-normal operation or airplane system conditions, 
            and

      (ii)  Determine the appropriate actions, if any.

  (2)  Be readily and easily detectable and intelligible by the 
        flightcrew under all foreseeable operating conditions, 
        including conditions where multiple alerts are provided.

Multiple alerts and indications in the cockpit can increase pilots' 
workload and can also make it more difficult to identify which 
procedure the pilots should conduct. The NTSB notes that the Lion Air 
and Ethiopian Airlines accident pilots' responses to multiple alerts 
and indications are similar to the circumstances of a 2009 accident 
involving Air France flight 447, an Airbus A330, which was traveling 
from Rio de Janeiro to Paris when it crashed in the Atlantic Ocean.\19\ 
In its accident report, the Bureau d'Enquetes et d'Analyses Pour la 
Securite de L'aviation Civile (BEA) concluded that failure messages 
successively displayed on the electronic centralized aircraft 
monitoring system did not allow the crew to rapidly and effectively 
diagnose the issue (the blockage of the pitot probes) or make the 
connection between the messages that appeared and the procedure to use. 
Accordingly, the BEA recommended that EASA ``study the relevance of 
having a dedicated warning provided to the crew when specific 
monitoring is triggered, in order to facilitate comprehension of the 
situation.'' \20\
---------------------------------------------------------------------------
    \19\ Bureau d'Enquetes et d'Analyses Pour la Securite de L'aviation 
Civile. 2012. Final Report, On the accident on 1st June 2009 to the 
Airbus A330-203, registered F-GZCP, operated by Air France, flight AF 
447, Rio de Janeiro--Paris.
    \20\ The response to this recommendation, FRAN-2012-049, was 
classified as ``partially adequate,'' and the recommendation was closed 
as of February 2, 2019.
---------------------------------------------------------------------------
    Human factors research has identified that, for non-normal 
conditions, such as those involving a system failure with multiple 
alerts, where there may be multiple flight crew actions required, 
providing pilots with understanding as to which actions must take 
priority is a critical need.\21\ This is particularly true in the case 
of functions implemented across multiple airplane systems because a 
failure in one system within highly integrated system architectures can 
present multiple alerts and indications to the flight crew as each 
interfacing system registers the failure. For example, the erroneous 
AOA output experienced during the two accident flights resulted in 
multiple alerts and indications to the flight crews, yet the crews 
lacked tools to identify the most effective response.\22\ Thus, it is 
important that system interactions and the flight deck interface be 
designed to help direct pilots to the highest priority action(s).
---------------------------------------------------------------------------
    \21\ See (a) Mumaw, Randall J. 2017. ``Analysis of Alerting System 
Failures in Commercial Aviation Accidents.'' Proceedings of the Human 
Factors and Ergonomics Society 2017 Annual Meeting; and (b) Burian, 
Barbara K., Immanuel Barshi, and Key Dismukes. 2005. The Challenge of 
Aviation Emergency and Abnormal Situations NASA/TM--2005-213462. NASA 
Scientific and Technical Information Program Office. Washington, DC.
    \22\ After the Lion Air accident, on November 7, 2018, the FAA 
issued emergency Airworthiness Directive 2018-23-51, revising the 
Boeing 737 MAX Airplane Flight Manual (AFM) to expand the existing 
runaway stabilizer procedure when erroneous AOA input is detected. This 
revision provided new details about the effects and indications a pilot 
might experience due to an erroneous AOA input, such as increasing 
nose-down control forces resulting from repeated AND stabilizer trim 
inputs. It also instructed pilots to perform the existing AFM runaway 
stabilizer procedure, emphasizing that the pilot set the STAB TRIM 
CUTOUT switches to CUTOUT and that the switches stay in the CUTOUT 
position for the remainder of the flight.
---------------------------------------------------------------------------
    Research demonstrates that emergency situations increase workload 
and require additional effort to manage effectively because of the 
stress involved and the lack of opportunity for pilots to practice 
these skills compared to those used in normal operations.\23\ In 
addition, research into pilot responses to multiple/simultaneous 
anomalous situations, along with data from accidents, indicates that 
multiple competing alerts may exceed available mental resources and 
narrow attentional focus leading to delayed or inadequately prioritized 
responses.\24\ According to FAA research, ``in some airplanes, the 
complexity and variety of ancillary warnings and alerts associated with 
major system failures can make it difficult for the flightcrew to 
discern the primary failure.'' \25\ The researchers noted that better 
system failure diagnostic tools are needed to resolve this issue.
---------------------------------------------------------------------------
    \23\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005. 
The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
2005-213462. NASA Scientific and Technical Information Program Office. 
Washington, DC.
    \24\ Burian, Barbara K., Immanuel Barshi, and Key Dismukes. 2005. 
The Challenge of Aviation Emergency and Abnormal Situations. NASA/TM--
2005-213462. NASA Scientific and Technical Information Program Office. 
Washington, DC.
    \25\ Federal Aviation Administration. 1996. Federal Aviation 
Administration Human Factors Team Report on: The Interfaces Between 
Flightcrews and Modern Flight Deck Systems, June 18, 1996.
---------------------------------------------------------------------------
    Thus, the NTSB concludes that aircraft systems that can more 
clearly and concisely inform pilots of the highest priority actions 
when multiple flight deck alerts and indications are present would 
minimize confusion and help pilots respond most effectively. Therefore, 
the NTSB recommends that the FAA develop design standards, with the 
input of industry and human factors experts, for aircraft system 
diagnostic tools that improve the prioritization and clarity of failure 
indications (direct and indirect) presented to pilots to improve the 
timeliness and effectiveness of their response. The NTSB further 
recommends that once the design standards have been developed as 
recommended in Recommendation A-19-15, the FAA require implementation 
of system diagnostic tools on transport-category aircraft to improve 
the timeliness and effectiveness of pilots' response when multiple 
flight deck alerts and indications are present.
                                 ______
                                 
                            Recommendations
To the Federal Aviation Administration
        Require that Boeing (1) ensure that system safety assessments 
        for the 737 MAX in which it assumed immediate and appropriate 
        pilot corrective actions in response to uncommanded flight 
        control inputs, from systems such as the Maneuvering 
        Characteristics Augmentation System, consider the effect of all 
        possible flight deck alerts and indications on pilot 
        recognition and response; and (2) incorporate design 
        enhancements (including flight deck alerts and indications), 
        pilot procedures, and/or training requirements, where needed, 
        to minimize the potential for and safety impact of pilot 
        actions that are inconsistent with manufacturer assumptions. 
        (A-19-10)

        Require that for all other U.S. type-certificated transport-
        category airplanes, manufacturers (1) ensure that system safety 
        assessments for which they assumed immediate and appropriate 
        pilot corrective actions in response to uncommanded flight 
        control inputs consider the effect of all possible flight deck 
        alerts and indications on pilot recognition and response; and 
        (2) incorporate design enhancements (including flight deck 
        alerts and indications), pilot procedures, and/or training 
        requirements, where needed, to minimize the potential for and 
        safety impact of pilot actions that are inconsistent with 
        manufacturer assumptions. (A-19-11)

        Notify other international regulators that certify transport-
        category airplane type designs (for example, the European Union 
        Aviation Safety Agency, Transport Canada, the National Civil 
        Aviation Agency-Brazil, the Civil Aviation Administration of 
        China, and the Russian Federal Air Transport Agency) of 
        Recommendation A-19-11 and encourage them to evaluate its 
        relevance to their processes and address any changes, if 
        applicable. (A-19-12)

        Develop robust tools and methods, with the input of industry 
        and human factors experts, for use in validating assumptions 
        about pilot recognition and response to safety-significant 
        failure conditions as part of the design certification process. 
        (A-19-13)

        Once the tools and methods have been developed as recommended 
        in Recommendation A-19-13, revise existing Federal Aviation 
        Administration (FAA) regulations and guidance to incorporate 
        their use and documentation as part of the design certification 
        process, including re-examining the validity of pilot 
        recognition and response assumptions permitted in existing FAA 
        guidance. (A-19-14)

        Develop design standards, with the input of industry and human 
        factors experts, for aircraft system diagnostic tools that 
        improve the prioritization and clarity of failure indications 
        (direct and indirect) presented to pilots to improve the 
        timeliness and effectiveness of their response. (A-19-15)

        Once the design standards have been developed as recommended in 
        Recommendation A-19-15, require implementation of system 
        diagnostic tools on transport-category aircraft to improve the 
        timeliness and effectiveness of pilots' response when multiple 
        flight deck alerts and indications are present. (A-19-16)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III               JENNIFER HOMENDY
Chairman                             Member
 
BRUCE LANDSBERG
Vice Chairman
 
Report Date: September 19, 2019
 


    The Chairman. Thank you, Mr. Sumwalt. Mr. Hart, you are 
recognized.

       STATEMENT OF HON. CHRISTOPHER A. HART, CHAIRMAN, 
           JOINT AUTHORITIES TECHNICAL REVIEW (JATR)

    Mr. Hart. Thank you, Chairman Wicker, Ranking Member 
Cantwell, and members of the Committee. Thank you for inviting 
me to this hearing today. First, I would like to extend my 
condolences, joining others who have already done so, to the 
families and friends of the passengers and crew on Lion Air 
flight 610 and Ethiopian Airlines flight 302.
    The FAA created the Joint Authorities Technical Review 
because these crashes revealed a need to review the robustness 
of the aircraft certification process. The JATR, which included 
representatives from the FAA, NASA, and nine other civil 
aviation authorities was created to review the MAX 
certification process to determine whether the appropriate 
regulations were applied, to assess whether compliance with 
those regulations was shown, and to recommend improvements in 
the process.
    I commend the FAA for seeking this certification process 
peer review and for making it public. The MAX grounding was 
unprecedented. Two previous groundings were the McDonnell 
Douglas DC-10 in 1979 when an engine separated from the wing, 
and the Boeing 787 in 2013 due to battery fires. In those two 
groundings, the airplanes were rendered unairworthy. Because 
the airplanes were unairworthy, pilot competence was not an 
issue. Because those groundings resulted solely from airplane 
problems, the country where the airplanes were manufactured 
made the grounding and ungrounding decisions.
    The grounding of the MAX, on the other hand, involves 
automation that usually worked but sometimes failed, and when 
it failed, some pilots knew how to respond but some, including 
those who crashed, did not. Because the scenario was not just 
an airplane problem, but a problem of airplane system/pilot 
interaction, every country that licenses pilots must also be 
involved in the grounding and ungrounded decisions.
    As automation complexity increases, I anticipate that 
future problems are more likely to be of the airplane/pilot 
type rather than airplane only. After three JATR meetings in 
Seattle in which Boeing and the FAA were very open and helpful, 
and extensive work between the meetings, the JATR gave the FAA 
on October 11 a compilation of team members' recommendations in 
12 areas. Some of the recommendations derived from the need for 
the certification process to address how a single system 
failure may create issues in other systems.
    Other recommendations raised the issue of whether a process 
that has been based largely upon compliance should also address 
safety. As systems become more complex, the likelihood 
increases that compliance with applicable regulations will not 
necessarily ensure safety. Moreover, as systems become more 
complex, the certification process should ensure that fail-safe 
design principles prioritize the mitigation of hazards through 
design, minimizing reliance on pilot action as primary means of 
risk mitigation. Delegation will probably become more prevalent 
as regulators encounter increasing difficulty hiring and 
retaining technology leaders.
    Thus, although the recommendations do not address the 
desirability of delegation. They do recommend examining how to 
make the ODA process less cumbersome to avoid stifling 
communications. Query, for example, whether inadequate 
communications resulted in the failure to address the effects 
of evolving the Maneuvering Characteristics Augmentation 
System, MCAS, from a benign system to a more aggressive system. 
And query whether inadequate communications resulted in the 
failure to address the effects of modifying MCAS from one 
scenario to another scenario.
    Other recommendations relate to the FAA standards regarding 
the time for pilots to identify and respond to problems. JATR 
members recommend reviewing whether existing standards are 
appropriate for today's complex systems. For example, when a 
system failure results in cascading failures and multiple 
alarms, query how adequately the certification process 
considers the impact of multiple alarms, along with possible 
startle effect, on the ability of pilots to respond 
appropriately. These two crashes are the latest of several 
recent crashes in which pilots encountered scenarios that they 
had never seen before, even in training, and responded 
inappropriately. Increasing complexity and reliability 
exacerbate the challenge of training pilots to respond to 
problems that they have never seen before.
    Increasing complexity exacerbates the challenge because it 
reduces the likelihood that pilots understand the system. 
Increasing reliability exacerbates the challenge because it 
increases the difficulty of determining what types of problems 
might occur and then including those types of problems in 
training. In conclusion, the JATR members hope that their 
recommendations will continue improving aviation safety by 
helping to improve the certification process.
    Thank you again for inviting me and I look forward to your 
questions.
    [The prepared statement of Mr. Hart follows:]

       Prepared Statement of Hon. Christopher A. Hart, Chairman, 
               Joint Authorities Technical Review (JATR)
    Introduction. Chairman Wicker, Ranking Member Cantwell, and Members 
of the Committee, thank you for the opportunity to be here today in my 
capacity as Chairman of the Joint Authorities Technical Review (JATR) 
to discuss the JATR's efforts to improve aviation safety.
    Before I begin, I would like to extend my sincerest condolences to 
the families and friends of the passengers and crew on Lion Air Flight 
JT610 that crashed a year ago today, on October 29, 2019, and on 
Ethiopian Airlines Flight ET302 that crashed less than five months 
later, on March 10, 2019.
    The following describes the JATR and why it was created, discusses 
some of the recommendations that it submitted to the Federal Aviation 
Administration (FAA), and then briefly describes a training challenge 
that has come to light as a result of the JATR's efforts.
    The JATR. The Boeing 737 MAX (MAX) Flight Control System Joint 
Authorities Technical Review, created by the FAA, had its kickoff 
meeting in late April/early May 2019, and its charter was signed and 
became official on June 1, 2019. It consisted of technical 
representatives from the FAA, the National Aeronautics and Space 
Administration (NASA), and civil aviation authorities from Australia, 
Brazil, Canada, China, Europe, Indonesia, Japan, Singapore, and the 
United Arab Emirates. The FAA intentionally did not include on the JATR 
team any of its staff who were involved in the MAX certification 
process.
    I was asked to lead the JATR, in part because of my experience in 
aviation safety and accident investigation. I was at the National 
Transportation Safety Board for a total of 12 years, including as 
Chairman. I also have a regulatory perspective from 14 years at the 
FAA. To ensure a fully objective review, I was not compensated by the 
FAA for this role. I would also note that I am not a certification 
process expert, so I don't have the perspective of ``this is how we 
have always done certification and we should keep it that way.'' I was 
honored to be asked to lead this important international aviation 
safety improvement effort.
    Why the JATR. The FAA's aircraft certification process has played a 
major role in producing airliners with an exemplary safety record. 
Nonetheless, as with any system that is designed and operated by 
humans, the certification process can never be perfect, and the two 
tragic MAX crashes noted above revealed a critical need to review the 
process to determine whether improvement and modernization are 
warranted. The JATR was created to conduct that review and make 
improvement recommendations as warranted. The JATR completed its review 
on October 11, 2019, when it gave its compilation of team members' 
recommendations (not necessarily with consensus, as noted below) to the 
FAA.
    The JATR was not chartered to become involved in returning the MAX 
to service, nor was it chartered to become involved in the two accident 
investigations. Moreover, the JATR was not created to determine fault 
or blame in the certification process, but to consider whether the 
appropriate regulations and policy were applied to the MAX; to assess 
whether compliance was shown with the applicable requirements related 
to the flight control system; and to recommend improvements to the 
certification process.
    The JATR was unprecedented in that it was the first time an 
aviation safety regulator has voluntarily called for what is 
essentially an international peer review of its certification process, 
and then made that peer review public. The FAA's willingness to use 
such a process to improve safety, and doing so with such transparency, 
are indicative of the safety culture that permeates the commercial 
aviation industry that has produced such an exemplary airline safety 
record.
    Unprecedented Groundings. The grounding of the MAX was also 
unprecedented and placed the worldwide aviation industry in uncharted 
territory. The other two airliner groundings by the FAA in in the last 
40 years were the McDonnell Douglas DC-10 in 1979, after an engine 
separated from the wing shortly after takeoff; and the Boeing 787 in 
2013, due to lithium-ion battery thermal runaways and fires. In those 
two groundings, the airplanes were rendered unairworthy by mechanical 
malfunctions.
    Because the airplanes were unairworthy, the problem was solely an 
airplane problem and pilot competence was not an issue. Because those 
groundings resulted entirely from airplane problems, the primary 
country that decided when to ground the airplanes and when to return 
them to service was the country where the airplanes were manufactured--
in those two instances, the U.S.
    The MAX grounding, on the other hand, involved automation that 
usually worked but sometimes failed; and when it failed, some pilots 
knew how to handle the failure (including the pilots on the Lion Air 
MAX the day before it crashed) but some did not, even after the 
additional attention to the issue that resulted from the Lion Air 
crash; and among those who did not know how to handle the failure were 
those who crashed. Hence, the scenario was not just an airplane 
problem, but a problem of the interaction between the airplane systems 
and its pilots. Thus, not only the country where the airplane is 
manufactured, but also every country that licenses and trains pilots 
must be involved in the decisions to ground and to return to service.
    My expectation is that the international aviation community will be 
challenged to figure out how to handle this new scenario because future 
airliner problems are more likely to be of the airplane-pilot 
interaction type and less likely to be of the airplane-only type. The 
JATR was a first step in figuring out how the certification process can 
best address what may be a new normal.
    Hence, I commend the FAA's inclusion in the JATR of representatives 
from nine other civil aviation authorities because this is not just an 
FAA certification process issue but a worldwide certification process 
issue. Because most of the aviation authorities in the JATR also 
certify aviation products, this was an opportunity for the certifying 
countries to begin working together to determine how best to navigate 
this uncharted territory. Moreover, all of the aviation authorities in 
the JATR are involved in the licensing and training of pilots.
    The JATR process. The JATR met three times in Seattle, starting 
with the kickoff meeting in the Spring in Seattle (noted above) for 
initial briefings from Boeing and the FAA. At that first meeting the 
JATR was divided into seven subgroups, with the following focus areas:

        A: Applied Regulations and Policy

        B: Compliance with applicable portions of 14 CFR part 25, 
        subparts B (Flight) and G (Operating Limitations and 
        Information)

        C: Compliance with applicable portions of 14 CFR part 25, 
        subparts D (Design and Construction) and F (Equipment)

        D: Boeing Systems Engineering Practices

        E: Organization Designation Authorization (ODA)

        F: Operational Suitability, Maintenance, and Training

        G: Preliminary Accident Information

    In mid-Summer the JATR had an intensive follow-up meeting in 
Seattle with Boeing and FAA personnel, including an extensive review of 
various certification documents.
    Writing the observations, findings, and recommendations commenced 
after the second meeting, and later in the summer the JATR met again in 
Seattle to consider the document as a whole as it was shaping up. 
Boeing and the FAA were very open and helpful to the JATR team in these 
meetings and in general throughout our review. We also received notable 
support from a number of FAA aircraft certification, evaluation, and 
oversight personnel throughout the process. As the document was being 
finalized, the JATR gave Boeing and the FAA an opportunity to review 
objective information assembled by the team for the purpose of ensuring 
the factual accuracy of the information on which the JATR team members 
based their observations, findings, and recommendations. After several 
iterations, the JATR submitted its final observations, findings, and 
compilation of team members' recommendations to the FAA on October 11, 
2019.
    The Recommendations. The JATR submitted recommendations in eleven 
areas involving the certification process, and one post-certification 
area. In order to encourage diversity of views from the team, the 
JATR's charter encouraged its members to provide recommendations 
irrespective of whether they reflected consensus. Consequently, the 
JATR did not check or measure consensus.
    The initial scope of the JATR process was limited to the 
certification process itself, but the charter enabled the co-chairs, in 
their discretion, to expand the scope if warranted. Hence, one 
recommendation area pertains to post-certification activities because 
of its potential to help improve the safety of future certification 
processes.
    In no particular order of priority, the eleven recommendation areas 
regarding the certification process are:

   1.  Changed Product Rule

   2.  Development and use of up-to-date requirements and practices

   3.  Consistent interpretation and application of requirements

   4.  Changes during the certification process

   5.  Delegation of certification authority

   6.  Holistic, integrated aircraft-level approach

   7.  Human factors

   8.  Development assurance

   9.  Impact of product design changes on certification

  10.  Impact of product design changes on flightcrew training

  11.  Impact of product design changes on maintenance training

    The post-certification recommendation area is:

  12.  Post-certification corrective actions and data sharing

    Some of the recommendations are very broad in their application and 
others are more specific.
    Broad Recommendations. Some of the broader recommendations derive 
from the increasing complexity of aircraft systems, particularly 
automated systems and the interaction and interrelationship between 
systems. As aircraft systems become more complex, ensuring that the 
certification process adequately addresses potential operational and 
safety ramifications for the entire aircraft that may be caused by the 
failure or inappropriate operation of any system on the aircraft 
becomes not only more important, but also more difficult.
    Other broader recommendations raise the foundational issue of 
whether a process that has historically served the industry well for 
decades based largely upon compliance needs to be revisited to address 
not only compliance but also safety. As systems become more complex and 
may interact in unforeseeable ways, the likelihood increases that 
regulations and standards will not address every conceivable scenario. 
To the extent they do not address every scenario, compliance with every 
applicable regulation and standard does not necessarily ensure safety.
    Moreover, as systems become more complex, the certification process 
should ensure that aircraft incorporate fail-safe design principles 
that prioritize the elimination or mitigation of hazards through 
design, minimizing reliance on pilot action as primary means of risk 
mitigation.
    Specific Recommendations. Some form of delegation will probably 
become increasingly necessary as the FAA and aviation regulators 
worldwide encounter increasing difficulty hiring and retaining leading 
technologists in rapidly advancing technologies. Thus, although the 
recommendations do not address the desirability of delegation in 
general or of the ODA concept in particular, they do recommend 
examining how to make the ODA process less cumbersome and bureaucratic 
to avoid stifling adequate communications in future certification 
processes about important characteristics of what is being 
certificated.
    Query, for example, whether inadequate communications were partly 
responsible for the failure to address potential unintended 
consequences from the evolution of the Maneuvering Characteristics 
Augmentation System (MCAS) from a relatively benign system to a much 
more aggressive system; and query whether inadequate communications 
played a role in the failure to address potential unintended 
consequences that can result from designing software for one scenario--
in this case, high-speed windup turns--and then modifying the software 
for a different scenario--in this case reducing the pitch-up tendency 
at higher angles of attack at low speeds.
    Other specific recommendations relate to revisiting the FAA's 
standards regarding the time needed by pilots to identify and respond 
to problems. Although existing standards have served the industry well 
for decades, the JATR members recommended an examination of whether 
those standards remain appropriate for the complex integrated systems 
in today's airplanes. For example, when the failure or inappropriate 
operation of a system results in cascading failures and multiple 
alarms, query how adequately the certification process considers the 
impact of multiple alarms, along with possible startle effect, on the 
ability of pilots to respond appropriately. Inherent in this issue is 
the adequacy of training to help pilots be able to respond effectively 
to failures that they may never have encountered before, not even in 
training.
    The Future Training Challenge. The closer automation comes to 
completely removing the human, the more daunting are the challenges of 
becoming more automated. One of those challenges was highlighted by 
these two MAX crashes. These crashes were the latest of several crashes 
in the previous decade in which pilots encountered scenarios that they 
had never seen before, even in training, and responded inappropriately.
    The increasing complexity and reliability of automation will 
exacerbate the international aviation community's challenge of training 
pilots to respond to problems that they have never seen before. 
Increasing complexity will exacerbate the training challenge because it 
will reduce the likelihood that pilots will fully understand the 
system's capabilities and what it does and does not do. Increasing 
reliability is obviously good, but an unintended consequence is that it 
will exacerbate the training challenge because it increases the 
difficulty of forecasting what types of failures might occur, which in 
turn decreases the likelihood of including the most important potential 
failure modes in training.
    This issue is not within the scope of the JATR's charter because it 
is not a certification issue, but it has been brought to light by the 
JATR's activities. Hopefully the international aviation community will 
follow the collaboration example reflected by the JATR and work 
together to address this training challenge.
    Conclusion. The JATR members hope that their recommendations will 
continue improving aviation safety by helping to improve the 
certification process.

    The Chairman. Thank you, gentlemen. Is the work complete 
regarding the MAX for either of your organizations? Mr. 
Sumwalt?
    Mr. Sumwalt. Mr. Chairman, thank you for that question. We 
are continuing to go through scores and scores of design 
certification documents. If we need to make additional 
recommendations, we certainly will. So, to answer your 
question, our work is not completed.
    The Chairman. And Mr. Hart?
    Mr. Hart. Our work is completed because we were chartered 
to review the situation and give recommendations to the FAA. We 
did that on October 11. That completed our work and thank you 
for asking.
    The Chairman. So this particular JATR, Joint Authorities 
Technical Review, is over and disbanded?
    Mr. Hart. That is correct.
    The Chairman. Alright. Let's talk about the time between 
the first crash and the second crash. It was evident after the 
Lion crash, that the MCAS system was not working correctly. Is 
that true, Mr. Sumwalt?
    Mr. Sumwalt. Yes, sir. That is correct.
    The Chairman. And Mr. Hart, there were many factors 
involved, but the dysfunction of the MCAS was central?
    Mr. Hart. That is correct.
    The Chairman. OK. And at that point, what notice was sent 
out to other airlines and to the pilots to make it clear that 
the MCAS was the main problem?
    Mr. Sumwalt. Mr. Chairman, as you are aware today is the 1-
year anniversary of Lion Air. So, on October 29 was the crash. 
I believe it was October, or correction November the 7th when 
the FAA put out an airworthiness directive to require certain 
procedural modifications.
    The Chairman. Was that a typical airworthiness directive or 
was it highlighted as an emergency airworthiness directive?
    Mr. Sumwalt. I am not sure. Chris, do you know?
    Mr. Hart. Airworthiness directives pretty much by 
definition are considered an emergency. So I think this one was 
definitely one that is supposed to command the attention of the 
entire industry.
    The Chairman. OK, Mr. Sumwalt is consulting with staff and 
it is fine if he supplements his answer, but this was a red 
flag sent out about the MAX and the MCAS part of it. Is that 
correct? Would either of you gentlemen quarrel that this was a 
red flag warning?
    Mr. Hart. It was an industry-wide warning that everybody 
who flies this airplane needs to know about, and so to that 
extent, yes.
    The Chairman. OK. Well, is there a way that we could have 
made it more explicit? Was there something about this advisory 
that didn't get the job done, Mr. Hart?
    Mr. Hart. I am sorry, but I cannot speak for the FAA and 
their decision process on how to handle this. The decision 
process to have the airworthiness directives within days of the 
second crash was intentional to get the word out as quickly as 
possible. But I was not privy to the decisionmaking process.
    The Chairman. No, but I am referring to the way it would 
typically have been received internationally and in the 
aviation industry. This would have been taken seriously and 
been given a heightened bit of attention, is that correct?
    Mr. Hart. That certainly is the purpose of an airworthiness 
directive, yes. How people responded to it, I do not have a 
good answer to that.
    The Chairman. OK. Now did I hear you say, Mr. Hart, that 
some pilots reacted in one way which was sufficient, and some 
pilots did not for whatever reasons? If you could elaborate on 
what you were telling the Committee.
    Mr. Hart. Yes, thank you for that question. I was referring 
specifically to the fact that before the Lion Air crash, the 
day before that crash, that same problem was encountered, and 
the pilots responded to it appropriately.
    The Chairman. Well, do you think that there was a failure 
at Lion Air to notify the other crews that a problem had 
occurred, it was resolved in this fashion, and we need to be 
mindful of that? Do you know if that was communicated between 
the flight that did land safely and the one the next day?
    Mr. Hart. Thank you for the question. Unfortunately, I do 
not know the details of who told what to whom, whether it was 
the mechanics, or the other pilots. I do not know the details 
of how that information about what happened the day before was 
transmitted to the to the subsequent pilots and subsequent 
mechanics.
    The Chairman. Mr. Sumwalt, do you want to clarify anything 
that you have said based on some advice that you have been 
getting?
    Mr. Sumwalt. Well, in fact, it was an emergency 
airworthiness directive that was issued by the FAA as Mr. Hart 
has indicated.
    The Chairman. That is a term of art, an ``emergency 
airworthiness directive?''
    Mr. Sumwalt. That is correct. And that means that it does 
not allow for public comment. Oftentimes for normal 
airworthiness directive the FAA has to put it out for public 
comment unless it is an emergency airworthiness directive.
    The Chairman. Is it fair for me to characterize that as a 
red flag?
    Mr. Sumwalt. Well as Chris Hart indicated, it does indicate 
that there was something that needed immediate awareness within 
the aviation community.
    The Chairman. Senator Cantwell.
    Senator Cantwell. Thank you, Mr. Chairman, and I thank the 
second panel for being here. Wish there was many people 
listening to this panel as the first because this is the hard 
work that we have to do in getting this right and moving 
forward. And I so much appreciate, Mr. Sumwalt, NTSB's 
recommendations and Mr. Hart, your committee's recommendations.
    My colleagues and I, Senator Duckworth, Senator Blumenthal 
have already introduced legislation on the NTSB and other 
recommendations last week, and hopefully we will be able to 
move forward on those. You heard the discussion. I believe we 
are here for this issue about what happened in the cockpit and 
the level of distraction, which I think is the point, Mr. 
Sumwalt. At least two of the recommendations that we put in our 
legislation, that is your recommendation, that the FAA direct 
Boeing to have clearer corrective actions from uncommanded 
systems and that there be some sort of resolution that they 
have had in other planes to the cockpit situation so that we 
are not bombarding pilots. Also that they develop the same kind 
of assessment.
    Now when I read the circulars, and I have read many, it is 
pretty clear to me that, you know, this already should have 
been done. I mean, it is pretty clear that you have talked 
about the effectiveness--when you submit a plan for a plane you 
have to submit this alert plan. So we will see, we will find 
out at some point what alert plan was submitted and what was 
reviewed.
    But it is very clear that you have to have, you know, this 
effectiveness intended for human and machine integration, you 
know, people understanding the alerts, compatibility with other 
displays and warnings, ensuring that the system is telling the 
pilots what to do. So listen, I appreciate your recommendations 
and we are going to get them into law, trust me. The question 
becomes, what are we doing on top of something that isn't 
already clear here.
    What is it that actually we are doing and helping people 
understand. What is it we are doing here to make this system 
safer? And the reason I ask this is because as I said in my 
opening statement, I actually believe this is the issue de 
jure. I think it is for automobile safety moving forward on 
more AVs and on airplanes. There is going to be more 
integration into the cockpit. So anytime you are taking over 
command of that plane with a response, we need to know, and we 
need to understand that functionality.
    So what are these alert system requirements that were 
asking the FAA to do both for the MAX and for all planes? What 
is that really giving us that we do not currently have now in 
the statute?
    Mr. Sumwalt. Thank you for the question, Senator Cantwell, 
and thank you for your leadership and your advocacy on this 
area. We issued these seven recommendations a month ago because 
we did identify holes in the design certification process. I 
would be glad to get into some of those holes in what those 
recommendations are, but I do not want to dominate your time. I 
defer to you.
    Senator Cantwell. Well, my question was, why do you think 
this is important because you actually do not think that the 
details are there?
    Mr. Sumwalt. That is correct--the long and the short of it, 
woven throughout each of the seven recommendations is that we 
found that when pilots are faced with multiple alerts, they are 
not performing or reacting in the way that Boeing thought that 
they would react when they developed their design assumptions.
    Senator Cantwell. And what about safety management systems 
for aerospace manufacturers? What about that recommendation?
    Mr. Sumwalt. The NTSB has found the benefits of safety 
management systems in many modes of transportation including 
aviation. We do not have specifically a recommendation for an 
SMS for the manufacturers. However, we do believe that when you 
are properly analyzing and assessing your risk, that is 
improving safety. So, personally, I think that would be a good 
idea for manufacturers to have a safety management system in 
place.
    Senator Cantwell. And what does that mean to most people 
who are trying to listen to this conversation post the one we 
just had? What does that actually mean that happens?
    Mr. Sumwalt. You know, I have always looked at safety 
management systems and I like the term safety management 
instead of safety management systems because it is an active 
thing. We want to manage safety the way that we would manage 
other vital business functions. So, there are generally thought 
to be four tenets of SMS, one of which is safety risk 
assessment where you are actively assessing your risk and 
managing those risk to an acceptable level. And so that is a 
key component of a safety management system.
    Senator Cantwell. Well this issue of risk management is 
critical and that is what I believe is that you have to say, 
what are the highest risks so you can focus on it. It is clear 
no one thought this change of a new system that took outside 
information, controlled the plane, gave it different commands 
with different alerts, that do different things, it wasn't 
tested.
    So we have to implement this. The FAA was given this, I do 
not know if it was a directive or nudge before, but then they 
pulled back on a rulemaking in 2014 on this system management. 
But you believe ICAO, others are recommending this is what we 
should go forward with because it creates this robust 
discussion constantly. Is that the right way to describe it?
    Mr. Sumwalt. As a safety practitioner, I agree with that 
and I do want to say again, the NTSB has not gone on the record 
to have a recommendation for that, but from a safety 
practitioners perspective, again when you are managing your 
risk, you are managing safety.
    Senator Cantwell. Thank you. Thank you. My time has passed.
    Senator Blumenthal.
    Senator Blumenthal. Thank you. Thank you, Senator Cantwell, 
and I want to express my appreciation to Senator Cantwell and 
Senator Duckworth for the legislation that we are working on 
together and additional legislation that we hope will be based 
on your reports and others. You know, I had a lot of questions 
for our previous witness, which unfortunately I didn't have 
time to ask.
    One of them would have been, why did he call the President 
of the United States, in effect circumventing the FAA if they 
were really going to respect safety? Are either of you aware of 
the call or calls that were made by Mr. Muilenburg to the 
President of the United States seeking to prevent grounding of 
these airplanes in the immediate aftermath of the second crash?
    Mr. Sumwalt. Senator Blumenthal, I am not aware of that. I 
sat in this hearing room in March when you asked Mr. Elwell the 
same questions. I am not aware of that. We were not involved in 
the decision to ground the aircraft in any form or fashion.
    Senator Blumenthal. Mr. Hart?
    Mr. Hart. It was not within the purview of the JATR either. 
We were looking into the certification process to decide how to 
make it better.
    Senator Blumenthal. The fact of the matter is that the 
United States of America was among the last nations to ground 
those airplanes, correct?
    Mr. Sumwalt. That is certainly my understanding. Us and 
Canada.
    Senator Blumenthal. And normally the United States of 
America would be at the forefront of safety, correct? Mr. Hart?
    Mr. Hart. Good question, Senator. Just for your awareness, 
I am on record through an op-ed in USA Today to congratulate 
the FAA for waiting until they had enough data to see was this 
a one-off event because if it was a one-off event, they would 
be grounding airplanes after every crash or was it more than a 
one-off in other words----
    Senator Blumenthal. In retrospect was it a good decision to 
ground that airplane?
    Mr. Hart.--after they had enough data to see the similarity 
of the two, yes.
    Senator Blumenthal. But the United States was the last to 
have enough data for whatever the reason?
    Mr. Hart. Yes.
    Senator Blumenthal. Just saying, right?
    Mr. Hart. Well, everybody had the same data about the same 
time. I just think the U.S., the FAA has a reputation for 
waiting until it has the data to react.
    Senator Blumenthal. Let me ask you, your report found that, 
``key aspects of the MCAS function such as intended function 
description, its interfaces, and architecture were not directly 
visible to the FAA in a straightforward manner through the 
certification deliverable documents.'' I am trying to put that 
in simple English that you would use in the USA Today article. 
They didn't do full disclosure to the FAA, correct?
    Mr. Hart. In simple language, the process certainly--the 
process was complicated enough and challenging enough and 
bureaucratic enough that the communication was stifled. And so 
the communication didn't get where it needed to be when it 
needed to be there.
    Senator Blumenthal. OK. I think that answers my question. 
And that was something we should correct, correct?
    Mr. Hart. That is something that the JATR has recommended 
correcting, and yes, it does need correcting.
    Senator Blumenthal. The Wall Street Journal recently 
reported that internal Boeing surveys revealed that about 30 
percent of its employees felt potential undue pressure from 
managers regarding safety related approval. In fact, one of the 
Boeing engineers, Curtis Ewbank filed a complaint that 
asserted, ``Boeing management was more concerned with cost and 
schedule than safety or quality.'' Did your investigative work 
indicate that kind of undue pressure from Boeing on its 
employees to move the safety process at the expense of--I am 
sorry move the certification process at the expense of safety?
    Mr. Hart. Thank you for your question. Our investigation, 
our review found enough concern about undue influence that we 
recommended that it be reviewed carefully for the next time, 
the next certification process.
    Senator Blumenthal. You indicate, I think, in your 
testimony that you thought delegation would continue, which 
seems contrary to what we have found here so far that a lot of 
the thrust of the questioning has been to reverse delegation. 
So, I hope that maybe we can have your further thoughts on that 
issue. Let me just ask one more question.
    Mr. Sumwalt, on Sunday, just this past Sunday, the New York 
Times reported on Boeing's efforts to undercut regulatory 
oversight early and often. The story of Boeing sabotaging 
rigorous safety scrutiny is chilling to all of us and more 
reason to keep the 737 MAX grounded until certification is 
really and truly independent and the system is reformed.
    What are your views on the amount of delegation authority 
from the FAA to Boeing? Shouldn't we reverse the delegation 
that exist right now?
    Mr. Sumwalt. Senator Blumenthal, thank you for that 
question. The NTSB's role in all of this is to serve as an 
accredited representative to each of the respective accident 
investigations. As such, we looked at the design certification 
processes of the 737 MAX and we issued the seven 
recommendations. We have not looked at the ODA process. That is 
not something that we have done.
    Senator Blumenthal. Why?
    Mr. Sumwalt. Well because there are approximately 79 
organizations that have ODA approval. We have got about two 
people that have the expertise to dwell into the design 
certification issues. We have devoted those energies to come up 
with these seven recommendations that we issued 1 month ago. 
That is an enormous task. I am under the impression that the 
U.S. DOT IG is doing a study of this issue.
    The Chairman. As are numerous other entities. Thank you.
    Senator Duckworth.
    Senator Duckworth. Thank you, Mr. Chairman. Chairman 
Sumwalt, welcome. At the March 2019 hearing held by this 
committee's Aviation subcommittee, Chairman Wicker asked you a 
simple question concerning Lion Air flight 610, and I 
quote``what should the pilots have done,'' and you responded as 
follows, and I quote ``well, I flew the 737 for 10 years and I 
do believe that there is a procedure at least for the 
Flintstone version of the 737. I flew a very old 737, but I do 
believe that the very first thing you would do is oppose that 
motion by pulling the yoke back and that would engage the stab 
break or the stabilizer cutout function.'' And to me this 
answer makes sense. The most reliable initial human response to 
an uncommanded nose down dive is to pull back on the yoke. 
Would you concur with this view?
    Mr. Sumwalt. Yes, I do. I have actually looked at the 
procedure and it says to grasp and to hold it firmly but as you 
know as an experienced pilot, your natural reaction would in 
fact if it is going in a direction you do not intend it to, you 
would tend to oppose it, which you should. In the older models 
of the Boeing aircraft that I flew, the 727 and 737, that would 
engage the stabilizer brake and stop the stab from running. But 
as you pointed out in the earlier round, it will not do that 
when MCAS is active on the 737 MAX.
    Senator Duckworth. Right. So that is what I would like to 
add to your response is the critical importance of the column 
cutout function, whether aft or forward, is that it is not just 
limited to the very old 737, but, in fact, according to a 
former Boeing engineer who was responsible for the control law 
development, in the 757, 767, and the 747-400. In every Boeing 
airplane until the 737 MAX, uncommanded stabilizer runaway is 
stopped by column motion only. You don't have to do another 
step. Once you pull back and you have overridden it, that's it.
    There is nothing that resets and then pushes the nose back 
down 5 seconds later. There is nothing else you have to do. 
That is it in every other model of Boeing aircraft of 737s. But 
for the MAX with the MCAS malfunction, the pilot has to also 
apply the manual electric trim within the same 3 second window, 
otherwise the MCAS, which the pilots did not know was installed 
in the aircraft, could reset and put the nose back down. So now 
you are telling pilots, OK, natural reaction, you have pulled 
back, you have overridden it, you think that is it.
    But now you have to troubleshoot for a system that you do 
not know exist that is now overriding your pilot's command 
input and pulling back the yoke. Mr. Sumwalt, are you aware of 
Boeing notifying commercial 737 pilots before the Lion Air 
crash that when MCAS activates during manual flight it disables 
the aft column cutout safety function? That is, it overrides 
that safety function?
    Mr. Sumwalt. Senator Duckworth, I am under the impression 
that just as you said that prior to these two tragic crashes 
that information was not widely known within the piloting 
community.
    Senator Duckworth. Thank you. Mr. Sumwalt, the MCAS 
malfunction should have been elevated to a hazardous rating, in 
my opinion, because the aft column cutout was removed and 
worsened by tripling the stab trim rate, which made severe 
mistrim likely, especially with a persistent malfunction. Had 
Boeing done this, instead of rating it as a ``Major'' hazard, 
we would not be where we are today. Would you agree with that? 
It changes how they report to the FAA. Am I correct?
    Mr. Sumwalt. Yes, and that hazard category of major, as I 
understand it, only required there to be one angle of attack 
sensor. If it was at a higher hazard category, it would have 
required the input from two.
    Senator Duckworth. Thank you. Mr. Chairman, I would like to 
enter Peter Lemme's ``Flawed Assumptions Pave a Path to 
Disaster'' into the hearing record.
    The Chairman. Without objection.
    [The information referred to follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    Senator Duckworth. Thank you. Mr. Sumwalt, can you talk 
about the accident chain, the concept of these decisions that 
pile up and leads up to those Lion Air pilots, for example, 
fighting to save that aircraft and how these decisions add up?
    Mr. Sumwalt. Yes. As you know Senator Duckworth, the NTSB 
was an accredited representative to the Lion Air investigation 
as well as the Ethiopian accident investigation. We 
participated closely with both of them. But since the Lion Air 
is wrapped up, we have worked closely with the Indonesian 
authorities. We commented on their report. We feel that their 
report, the Indonesian report, the KNKT report is comprehensive 
and we are satisfied with that report. So, I think that report 
outlines the chain of events was not just one factor, there 
were several issues that led to that crash.
    Senator Duckworth. Thank you. I yield back.
    The Chairman. Thank you, Senator, Duckworth.
    Senator Cruz.
    Senator Cruz. Thank you, Mr. Chairman. Chairman Sumwalt, 
the NTSB report that you mentioned in your testimony stated 
that the NTSB is, ``concerned that the accident pilot responses 
to the unintended MCAS operation were not consistent with the 
underlying assumptions about pilot recognition and response 
that Boeing used based on FAA guidance for flight control 
system functional hazard assessments, including for MCAS as 
part of the 737 MAX design.'' Why do you think it was that 
Boeing made the wrong assumptions?
    Mr. Sumwalt. Senator Cruz, thank you for that question. And 
what we do know is that to simulate the MCAS or to assess the 
level of hazard, the less level of risk associated with that, 
they put Boeing pilots, test pilots, in the engineering 
simulator. And while they were flying, all of a sudden, the 
trim started moving. They wanted to see how a pilot would have 
reacted.
    And if they reacted the way that Boeing expected them to 
do, then they said OK, well the pilot will immediately 
recognize this problem. They will notice because the nose is 
starting to pitch down, they will notice because it has 
increased pressure on the control wheel, and one other thing--
and the stab trim wheel was moving. That is all correct. But 
what Boeing failed to account for in their assumptions was to 
consider that the MCAS could have failed because of another 
reason.
    The MCAS could have activated because of a failure of the 
angle of attack which would have led to numerous other alerts 
and warnings in the cockpit. So, with a failed angle of attack 
sensor, they would have had a low air speed indication on their 
primary flight display. They would have gotten a stick shaker 
or stall warning which is rattling the stick and making a lot 
of noise. They would have gotten an oral warning that says 
``air speed low, air speed low.'' They would have had various 
lights in the cockpit.
    So, the long and the short of it is that Boeing only 
evaluated pilots performance with the stab trim itself moving. 
They did not simulate or replicate how multiple failures could 
affect a pilot's performance.
    Senator Cruz. And why did the FAA processes not catch these 
failed assumptions?
    Mr. Sumwalt. Well, that is a great question, Senator. And I 
am not sure that I know the answer to that. But that is why we 
have issued these seven recommendations, is so that these 
design assumptions can be more realistic. We found in three 
incidences in the two accident flights plus the Lion Air flight 
prior to the accident flight, we have seen three cases where 
the pilots did not perform in accordance with the assumptions 
that Boeing used.
    Senator Cruz. And is a bird strike a scenario that 
engineers designing a plane should anticipate and the 
regulators focusing on a plane should anticipate?
    Mr. Sumwalt. I believe so and I believe they do in certain 
areas. I am not sure how it might apply to this. As you know, 
there is conjecture that perhaps a bird might have taken out 
the AOA sensor on the Ethiopian aircraft. I do not know if that 
is a part of the total risk assessment for the 737 MAX as it 
relates to MCAS.
    Senator Cruz. Is there any indication either Boeing or the 
FAA considered the possibility that a bird strike would share 
off the angle of attack sensor?
    Mr. Sumwalt. I do not know but I can certainly look into 
that and get back with you if you like.
    Senator Cruz. I would appreciate that very much. Mr. Hart, 
one of the key findings of the Joint Technical Review Committee 
report is that the FAA's visibility into important system 
safety information was, ``incomplete and fragmented.'' JATR 
then went on to say, if the FAA had been more involved in the 
certification of the MCAS, this, ``would likely have resulted 
in design changes that would have improved safety.'' Based on 
the JATR's findings, why would the FAA accept incomplete and 
fragmented safety information from Boeing and what can be done 
to fix that?
    Mr. Hart. Thank you for the question. That is the purpose 
of the recommendation that the communication process that the 
ODA be less bureaucratic and less complicated, so the 
communication process isn't undermined by the complexity of 
that situation. So the FAA was not adequately aware of the 
evolution of the MCAS from a relatively weak system to a much 
more robust system.
    The FAA wasn't aware of the details of how adequately the 
transformation of the MCAS from a high-speed wind up turn 
correction to a low speed angle of attack correction and were 
the assumptions properly considered in that process. The 
communications to the FAA were not adequate for it to be fully 
aware of the impact of those issues.
    Senator Cruz. Thank you.
    The Chairman. Thank you, Senator Cruz.
    Senator Blumenthal.
    Senator Blumenthal. I have just one question and you may 
consider it outside of your expertise, but the CEO of Boeing 
told us today that they made mistakes and regretted them and 
wanted to take action in response to do the right thing for the 
families who were affected, the loved ones of the victims.
    Boeing has said that it will take responsibility 
specifically for the Lion Air crash resulting in the deaths of 
189 people in Indonesia last year and the Ethiopian Airlines 
crash that killed 157 people. But it has filed court documents 
for the Lion's aircraft indicating that it will move to change 
the venue of the case to Indonesia where the plane was 
maintained if settlement talks fail. The case was filed in the 
Northern district of Illinois where Boeing is headquartered, as 
you know.
    Resolving these claims in Indonesia seems a lot less likely 
to provide justice to those families. There is no Seventh 
Amendment right to a jury trial there. There is no requirement 
of discovery. There is no rule allowing for depositions. Would 
you agree with me that equity, fairness, justice would argue in 
favor of keeping these cases in the United States?
    Mr. Sumwalt. My friend, Chris Hart, is a Harvard-educated 
lawyer.
    Senator Blumenthal. He is a Harvard Law School graduate and 
practicing lawyer in addition to being a pilot so if you want 
to defer to him, that is fine.
    Mr. Sumwalt. Absolutely.
    Mr. Hart. Thank you for the question. I am a Harvard-
trained attorney but I do not know anything about the 
litigation strategy to be able to comment on what they want to 
do regarding litigation. That is way outside of my lane. JATR 
did not consider it and I am not really--I do not consider 
myself competent enough to speak to that issue.
    Senator Blumenthal. Well in general, wouldn't you consider 
this court to the United States to be a better place to do 
justice for American families than the courts of Indonesia?
    Mr. Hart. I thank you for the question, but I am not enough 
of a litigator to be able to give you a competent answer.
    Senator Blumenthal. Thank you, Mr. Chairman.
    The Chairman. Thank you, Senator Blumenthal. We are going 
to close this hearing now.
    Senator Cantwell. Can I just ask one more thing?
    The Chairman. Sure. Senator Cantwell.
    Senator Cantwell. Thank you, Mr. Chairman for a second 
round. I just wanted to clarify, Mr. Hart, I think I heard 
earlier from the testimony from the company that they actually 
do think that the FAA knew about the level of trim. I think 
this is going to be a big issue. I think we are going to hear a 
lot more about this, but you would hope that a plan at the very 
beginning of certification would include that data then they 
would make the decisions, but I am concerned that the level of 
automation and technology and human response.
    I want to see the best engineers. I think when the 
automobile industry and Toyota went through this and we didn't 
know what happened, we basically called NASA and said would you 
look at this code and figure out what happened? OK. I do not 
want to call NASA to look at software code. I want the FAA to 
be the best technology engineers in understanding problems with 
software, problems with automation, and challenges with human 
response. That is why part of our legislation is that center of 
excellence for the FAA.
    Just by the way, I have done two other center of 
excellences, one on composite manufacturing because the FAA 
didn't know enough about composite to know how to certify the 
plane, and one on biofuels for jets because they also do not 
know how to certify fuel sources for planes if they do not 
understand jet fuel themselves. So I am a believer that we give 
the FAA the extra resources and tools so they can stay ahead or 
at least, you know, know the right parameters of debate.
    But isn't the right parameter of debate have to focus on 
this human technology interface today? Isn't that where we are? 
Because we saw those 10 years of making us safer, and yet this 
level of integration has also told us that 5 of the last 
accidents were all around this. And I think, you know, for me 
and many Americans are waking up wondering what is a pitot tube 
and, you know, an AOA sensor on the outside of the plane giving 
commands and responses to inside the cockpit without the pilots 
understanding.
    So I just feel that the FAA, and we have had this 
discussion with Captain Sullenberger, needs to understand human 
response to these automation systems. What do you say about 
that recommendation of a center of excellence, Mr. Hart or Mr. 
Sumwalt?
    Mr. Hart. Thank you for the question. It also gives you an 
opportunity to respond to Senator Blumenthal raising the same 
issue. And that is, I think that as first of all the type of 
problem we are going to see with airplane safety in the future 
in my view is not going to be things falling off the airplane 
like the DC-10 engines. It is going to be the pilot/airplane 
interaction issue.
    So the human factors piece is crucial and that is why I am 
totally on board with the human factors recommendations that 
the NTSB made. There are two problems. One is the reference to 
multiple things going wrong at the same time. I would add to 
that, it is not just multiple things going wrong, it is also 
never having seen it before even in training. That is really 
the challenge. It is when they are seeing this for the first 
time in real time, as in a series of accidents where this has 
happened, and it has been unsuccessful.
    The one exception to that was Sully when he had a kind of 
situation that he had never seen before, even in training, and 
he handled it masterfully.
    Senator Cantwell. And that--listen I think I have consulted 
him a lot about this but that is why he came to us after the 
Colgan Air and said do not change the regulations on the 
copilot for regional aircraft because you do not have enough 
time. You do not have enough time to talk. So I think if you 
are going to develop a system for certification and give it to 
the FAA, I think the FAA has to know the parameters of human 
response and what pilots are capable of, we just need a lot 
more data.
    If this is the route we are going to keep going on 
innovation, then we just need to know a lot more about what is 
that factor. I think even, I do not want to speak for him, but 
I think his perception is that that is where you have to start 
because you do not have any way to judge a system if you do not 
really understand what the human limitation is.
    Mr. Hart. And that goes to my point that the leading 
technologists in these rapidly advancing and innovative 
technologies, the leading technologists are not going to be 
with the regulator. That is why this is not an FAA problem, 
this is an international certification problem, because the 
regulators are not able to hire and retain the leading 
technologists in these rapidly advancing technologies. They are 
going to be with the companies.
    Senator Cantwell. But I want the FAA to have enough data, 
information, and understanding to ask the right questions. 
Because if they are not asking the right questions because they 
do not understand the technological impact, we are going to 
have a problem. OK, so we have to make sure they understand the 
R&D and at least the parameters, whether that is composites, 
biofuels, or cockpit automation.
    Mr. Hart. That is precisely why adequate information is so 
crucial. Straight to your point.
    Senator Cantwell. Yes.
    Mr. Hart. Thank you for making that point.
    Senator Cantwell. Thank you, Mr. Chairman.
    The Chairman. Senator Blumenthal.
    Senator Blumenthal. Just one quick question. If the FAA 
were able to pay enough to offer career opportunities would 
that affect your judgment that they cannot hire the leading 
technologist as you put it?
    Mr. Hart. I cannot speak to the totality of the 
circumstances why the regulators do not have those people but 
that is probably part of it, yes.
    Senator Blumenthal. Well, I am just really discouraged and 
frankly somewhat skeptical about your view that the FAA should 
be sort of doomed to failure and has to outsource safety.
    Mr. Hart. I do not mean to suggest they are doomed to 
failure. I am suggesting that is why I think the collaborative 
process of the delegation will continue because there is no way 
that in my view, in the way that things are currently situated, 
the FAA is going to have the expertise within house to do it 
without the collaboration.
    Senator Blumenthal. Well, putting aside the word 
collaboration, I hope we can prove you wrong by in fact 
incentivizing both financially and otherwise people with those 
skills to go to work for the FAA because that is where the 
disinterested and independent safety function belongs. If you 
outsource safety, that is doomed to failure.
    Mr. Hart. I certainly agree with you. That would be ideal. 
Yes, Senator Blumenthal.
    Senator Blumenthal. Thank you.
    The Chairman. Well, thank you very much. And thanks to the 
members of the Committee who have participated throughout. I 
have to say, this has been one of the most difficult hearings I 
have ever participated in, and I know it has been difficult for 
the family members who are still with us in the room. Some of 
them had to leave. Let me reiterate what I said at the outset, 
that this Committee, under my leadership and Senator Cantwell's 
leadership, is working to obtain as full of an answer as 
possible. We owe it to the public and we owe it to the families 
and to the victims. You have my assurance that we are not 
finished with the work.
    That said, the hearing record will remain open for two 
weeks. During this time, Senators are asked to submit any 
questions for the record. Upon receipt, all witnesses are 
requested to submit their written answers to the Committee as 
soon as possible. I thank the witnesses for appearing today, 
and the hearing is now adjourned.
    [Whereupon, at 1:16 p.m., the hearing was adjourned.]

                            A P P E N D I X

    Response to Written Questions Submitted by Hon. Roger Wicker to 
                           Dennis Muilenburg
    Question 1. Mr. Muilenburg, the Maneuvering Characteristics 
Augmentation System (MCAS) has been described as an anti-stall system 
that Boeing installed on the Boeing 737 MAX to address pitch stability 
concerns caused by the use of larger engines on the aircraft than 
earlier versions of the 737. However, it has also been said that MCAS 
was added to the 737 MAX so that it handled similarly to the 737 NG 
from a pilot's perspective.
    What was the original purpose of MCAS? What would have been the 
risks associated with the 737 MAX had MCAS not been added as a flight 
control law?
    Answer. In 2009, Boeing began to explore a possible re-engining of 
the 737 NG series airplane to improve noise pollution and fuel 
efficiency. In approximately 2010, early in the development process, 
testing and analysis showed that the contemplated design changes 
affected the airplane's handling characteristics in certain high-speed, 
high angle of attack conditions involving a rarely encountered maneuver 
known as a wind-up turn. Although most commercial pilots go their 
entire career without making such a turn in commercial flight, 
certification requirements exist for handling characteristics in these 
scenarios.
    If MCAS had not been added as a flight control law to the 737 MAX, 
a different solution would have been necessary to achieve the required 
handling characteristics. Boeing personnel, including engineers and 
pilots from multiple disciplines, considered a number of alternatives 
for improving the airplane's handling qualities in these unusual 
scenarios, including physical changes to the airplane. Ultimately, 
Boeing determined that the addition of MCAS, coupled with the 
implementation of a modified outboard wing vortex generator pattern, 
represented an appropriate solution for addressing the handling 
qualities issue. This approach in designing MCAS allowed for a 
straightforward expansion of the pre-existing Speed Trim function, as 
an integrated part of an existing flight control system. The 
incorporation of MCAS allowed Boeing to safely satisfy certification 
requirements for handling characteristics while staying within the 
framework of the existing airplane architecture, consistent with a 
fundamental airplane design principle of minimizing unnecessary 
complexity. Boeing implemented the initial MCAS requirements in early 
2012, although evaluation of the function continued afterwards, and the 
technical team recognized that further refinement of the design would 
likely be necessary going forward. The incorporation of MCAS was 
validated through rigorous testing and analysis, including piloted 
simulator sessions, wind tunnel tests, and a variety of engineering 
analytical techniques.

    Question 2. During the hearing you were asked about two sets of 
documents involving former Boeing employee Mark Forkner: (1) a November 
16, 2016 instant message between Mr. Forkner and a Boeing colleague, 
and (2) e-mails between Mr. Forkner and someone at the FAA in which Mr. 
Forkner used the phrase ``jedi mind tricking.'' Please clarify when Mr. 
Muilenburg learned of each.
    Answer. As to the instant message exchange involving former Boeing 
employee Mark Forkner: while Mr. Muilenburg does not recall seeing the 
document itself until it became public a few weeks before the hearing, 
he was made aware of the document in a briefing earlier this year, 
including the fact that the message contained a reference by Mr. 
Forkner to having unknowingly lied to regulators. Since the document 
became public, Mr. Muilenburg has had the opportunity to review the 
entire exchange and become familiar with all of its details. With 
respect to the other e-mails from Mr. Forkner that were referenced by 
Chairman Wicker in his question, Mr. Muilenburg was not aware of those 
e-mails until he read about them in the media in the weeks prior to the 
hearing.

    Question 3. Please describe the steps Boeing took after it learned 
that the AOA DISAGREE alert on the MAX was not operable on all 
airplanes.
    Answer. In August 2017, several months after the software delivery 
and the commencement of MAX deliveries, Boeing engineers identified 
that the display system software delivered to Boeing by a supplier 
incorrectly linked the AOA DISAGREE alert to an optional AOA indicator, 
after internal testing revealed that the alert was not working as 
expected.
    Immediately upon identifying the discrepancy between the 
requirements and the software, Boeing initiated its standard process 
for determining the appropriate resolution of such discrepancies. 
Boeing quickly initiated a ``problem report''--the name for the 
standard process--and assigned it to the supplier to verify Boeing's 
assessment. The supplier conducted testing and confirmed the issue 
Boeing had identified.
    Under Boeing's procedures, any inconsistency between the airplane 
requirements and the product delivered by a supplier must be 
immediately resolved if it renders the airplane unsafe. Deferring the 
solution to a later date is appropriate only if Boeing's experts can 
determine that the airplane remains safe, it remains certifiable, and 
there is no adverse operational impact. Here, to decide the appropriate 
disposition of the AOA DISAGREE alert issue, Boeing conducted a 
rigorous review that involved multiple company subject matter experts, 
including systems engineers, pilots, and crew operations specialists. 
This review determined that the absence of the AOA DISAGREE alert did 
not adversely impact airplane safety, certification, or operations, and 
therefore correction of the issue appropriately could be deferred until 
the next routine software update. The responsible authorized 
representative, who exercises authority delegated by the FAA, concurred 
with this recommendation for deferral.
    Boeing's review identified three main factors supporting the 
conclusion that deferral was permissible. First, no airplane or system 
safety assessment takes credit for the activation of the AOA DISAGREE 
alert as part of the analysis-accordingly, the absence of the alert did 
not alter the analysis in these assessments demonstrating that the 
airplane is safe. Second, based on consultations with pilots, the team 
determined that the same conditions that would activate the AOA 
DISAGREE alert would also likely cause unreliable airspeed information, 
and thereby trigger the indicated airspeed (IAS) DISAGREE alert. Thus, 
even without the AOA DISAGREE alert, the IAS DISAGREE alert would 
remain available to prompt pilot action in response to the expected 
effects of erroneous AOA data. Third, the team noted that other 
maintenance indicators on the airplane would detect a damaged AOA vane 
that remains faulty for two consecutive flights. Thus, a damaged vane 
would likely persist for only a limited amount of time before prompting 
maintenance action, even in the absence of the AOA DISAGREE alert.
    Based on these considerations, the review concluded that the 
existing functionality was acceptable until the next planned display 
system software update, when the alert and the indicator could be 
delinked, and the AOA DISAGREE alert made standard per the 
requirements. That update was scheduled for 2020, when the Dash-10 
variant of the MAX was expected to enter into service. Boeing recorded 
this disposition in its certification summary documentation for the MAX 
dated September 2017.
    Boeing personnel discussed notifying 737 MAX operators about the 
deferral decision. Boeing pilots and other technical experts considered 
issuing an Operations Manual Bulletin (``OMB'') on the issue. After 
internal discussion, it was determined that an OMB was not the 
appropriate vehicle for notification because the linkage of the AOA 
DISAGREE alert to the AOA indicator did not present a safety of flight 
issue, and because there was no specific crew guidance to be provided 
for dealing with the absence of the alert. Boeing personnel prepared a 
Fleet Team Digest on the issue, but ultimately it was not issued.
    When the MAX returns to service, all MAX airplanes will have an 
activated and operable AOA DISAGREE alert as a stand-alone, standard 
feature.

    Question 4. How many certification plans for the MAX did the FAA 
delegate to Boeing and how many did the FAA retain?
    Answer. The FAA initially accepted the Master Certification Plan 
for the 737-8 in November 2013, and it accepted the Detailed 
Certification Plans in August 2015. When the Master Certification Plan 
was initially accepted by the FAA, approximately 28 percent of the 
detailed Certification Plans were delegated. As the FAA reviewed the 
certification deliverables, those deliverables evolved. The number of 
delegated tasks increased as a result. However, even for certifications 
that are delegated, all testing and reviews that Boeing conducts to 
demonstrate compliance with applicable standards and requirements are 
subject to FAA oversight.

    Question 5. Please describe the changes Boeing has made since the 
Lion Air accident to the MAX Flight Control Computer software beyond 
updates to MCAS, and the considerations that led to those changes?
    Answer. In late March, as part of a comprehensive supplemental 
review of the updated MCAS software, Boeing discovered that a monitor 
to address erroneous processor commands was not as robust as originally 
assumed. Although this fault had never occurred in 125 million flight 
hours, Boeing decided to implement an improved monitor to avoid even 
the theoretical risk of a stabilizer runaway near the ground, where the 
flight crew would have less time to respond than at a higher altitude.
    During a simulator certification demonstration on June 26, an FAA 
pilot raised an additional concern regarding the possibility that this 
failure condition could occur at cruising altitude. The pilot 
determined that, while the flight crew could reverse the stabilizer 
runaway effect through use of the electric trim switches, this response 
might--if the crew delayed in recognizing the condition--require a 
level of piloting skills that could not be assumed. Based on this 
finding, the FAA asked Boeing to develop additional redundancies in the 
flight control computer software to prevent this type of failure. 
Boeing has since been working on new software functionality to address 
the possibility of such uncommanded stabilizer motion in all phases of 
flight
                                 ______
                                 
     Response to Written Questions Submitted by Hon. John Thune to 
                           Dennis Muilenburg
    Question 1. Both the National Transportation Safety Board (NTSB) 
and Joint Authorities Technical Review Board (JATR) reports mentioned a 
need for greater consideration of crew workload when designing flight 
control systems.
    For example, the JATR report cited a lack of communication between 
divisions within Boeing as one reason a more holistic evaluation of 
crew workload may not have been considered in the development of the 
Maneuvering Characteristics Augmentation System (MCAS).
    Could you speak to how some of the organizational changes at Boeing 
you mentioned in your testimony will help address issues with 
communication?
    Answer. The review undertaken by a committee of the Boeing Board of 
Directors following the ET302 accident made a series of 
recommendations, all accepted by the Board, that will enhance safety 
throughout the design and manufacturing process.
    First, all engineering employees now report to the Company's chief 
engineer. By keeping engineering functions within the engineering 
department, rather than having engineers report up to program leaders, 
our engineers will have the enhanced ability to holistically assess key 
factors as we develop and design flight control and other systems on 
future airplanes. This organization change will also help ensure that 
lessons learned in one program will be shared with, and considered with 
respect to, other programs.
    Second, Boeing created a Product and Services Safety organization. 
Building off of Boeing's already robust avenues for reporting 
engineering and safety concerns, this organization will further 
encourage reporting and investigation of any potential safety issues, 
by anyone within the company.
    Third, Boeing created a Design Requirements Program. This program 
will strengthen information sharing and education among our engineering 
corps regarding design issues, and also further enhance Boeing's 
ability to incorporate lessons learned and detailed after action 
reports. This will help strengthen our existing process to ensure that 
issues identified and resolved in one program become training tools 
that improve safety across all Boeing's programs.
    These changes will enhance and reinforce Boeing's safety culture, 
and help to ensure that all safety matters, including lessons learned 
from these accidents, are appropriately addressed.

    Question 2. The NTSB report mentioned that while a safety 
assessment was performed on MCAS, it may not have considered an MCAS 
activation in concert with other potential alerts and indications.
    Do you believe that the establishment of the Product and Services 
Safety organization within Boeing will provide more comprehensive 
safety assessments that adequately assess crew workload?
    Answer. While Boeing already employs a rigorous process to perform 
the safety assessments required to demonstrate compliance to the 
Federal Aviation Regulations, we expect that the Product and Services 
Safety organization will heighten Boeing's focus on all safety matters, 
including the safety assessment process. The other changes outlined in 
response to the previous question will also further enhance Boeing's 
safety processes.
                                 ______
                                 
     Response to Written Question Submitted by Hon. Jerry Moran to 
                           Dennis Muilenburg
    Question. Mr. Muilenburg, regarding the Federal Aviation 
Administration's (FAA) role in the certification process, what specific 
recommendations of change at the FAA would you suggest?
    Answer. Boeing strongly supports robust FAA oversight of the 
certification process. As the last major commercial airplane 
manufacturer in the United States, Boeing believes the certification 
process, and the FAA's role in that process, are vital to the safety of 
the traveling public, and have been an important factor driving 
substantial improvements in aviation safety in recent decades. Boeing 
supports increasing the FAA's global engagement and leadership in order 
to strengthen safety standards, safety culture, and safety-related best 
practices throughout the world.
    The certification process requires significant technical expertise 
and considerable resources. Boeing believes that any changes made 
should continue to ensure the FAA's resources are focused on areas such 
as new technologies, systems integration, and development. Moreover, 
the FAA must be able to attract and retain strong technical capability, 
commensurate with industry. To achieve those goals, Boeing supports the 
following changes:

   Increasing integration across organizations within FAA 
        Aviation Safety, especially between Aircraft Certification and 
        Flight Standards. This would facilitate earlier engagement by 
        the operational evaluation teams in the airplane design and 
        certification process, and strengthen the understanding of how 
        certification and operational decisions impact each other.

   The FAA's System Oversight capability could be strengthened 
        by setting clear expectations for applicants' processes and 
        procedures to ensure compliance for lower risk areas, as 
        identified by the FAA. This would allow FAA to dedicate the 
        majority of its resources on areas the FAA has determined to be 
        the highest safety risk.

   The rulemaking process should be strengthened so that the 
        FAA has the capability to incorporate new rules and update 
        existing rules to more quickly accommodate new technology and 
        lessons learned from the existing fleet. For example, FAA 
        should quickly incorporate International Civil Aviation 
        Organization Safety Management System standards for 
        manufacturers into domestic FAA regulations.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. Maria Cantwell to 
                           Dennis Muilenburg
    Boeing is developing a software fix to correct the deadly flaws in 
the Maneuvering Characteristics Augmentation System (``MCAS''). The 
Federal Aviation Administration (``FAA'') and international regulators 
are reviewing Boeing's work.
    I believe thorough transparency about the specific testing and 
evaluation is essential to ensure public confidence in the safety of 
the 737 MAX aircraft.
    Question 1. Will you commit to full public transparency about the 
technical details and the specific tests and evaluations conducted in 
order to correct MCAS and return the 737 MAX to service?
    Answer. Boeing is committed to keeping the public informed about 
the status of the enhancements being made to the MCAS system. Boeing 
has created a public website with information regarding the MAX to 
facilitate dissemination of information regarding the MAX. That website 
is located at http://www.boeing.com/737-max-updates/. Boeing will 
continue to provide information regarding the MAX as we work to rebuild 
the public's confidence in what we do, as well as work with our 
regulators to ensure that the public, our customers, and other 
stakeholders can understand the rigor and scope of the return to 
service process.
    Boeing has already disclosed the changes it is making to the MCAS 
system. When the MAX returns to service, MCAS will compare inputs from 
both Angle-of-Attack sensors on the MAX, it will only activate one time 
per high angle-of-attack event, and MCAS will never command more 
stabilizer input than can be counteracted by the flight crew pulling 
back on the control column.
    Boeing extensively tested these updates. As of November 26, Boeing 
has dedicated over 190,000 engineering and test hours relating to 
updates to the MAX, flown more than 1100 test and production flights, 
and conducted simulator sessions with 41 international regulators as 
well as 99 of our airline customers. Testing has included evaluation of 
the system in normal operation, operation when subject to failures (in 
both the normal and operational flight envelopes), and the potential 
effect of pilot crew error and workload. When the MAX returns to 
service, we are confident it will be one of the safest aircraft ever to 
fly.
    Moreover, the FAA established a Technical Advisory Board (TAB) to 
review Boeing's updates to MCAS. As Matthew Kiefer, a member of the 
TAB, testified before the Committee on Transportation and 
Infrastructure of the House of Representatives, this panel consists of 
independent experts, with no past involvement in the development or 
certification of the 737 MAX. In his written testimony, Mr. Kiefer 
stated that, pending final testing and the results of their review, the 
TAB ``feels the changes made to the flight control software in the B737 
MAX should vastly improve the safety of the aircraft, in keeping with 
the highly successful safety record of the previous models of the 
Boeing 737.''

    Question 2. Will you publicly release the specific results of the 
testing and evaluation of the MCAS ``fix?''
    Answer. Please see the response to Question 1.

    Question 3. The current Organization Designation Authorization 
(``ODA'') process hinders the ability of designated Boeing 
certification engineers, or ``unit members,'' from communicating 
directly with their FAA counterparts. Instead, issues are resolved 
internally within Boeing, which can lead the certification process to 
potentially be influenced by cost and delivery schedule pressures. Some 
Boeing engineers are concerned that important dialogue with FAA about 
problems is being hindered or does not happen as a result of this 
process.
    Further, Boeing recently developed a new program called 
``Verification Optimization.'' Under that program, up to 1,000 quality 
inspector positions will be cut over the next two years. Boeing quality 
inspectors have ensured mechanic work was performed per engineering 
requirements. Now, in many critical areas, mechanics will be the only 
set of eyes to verify they performed their work to Boeing 
specifications and procedures.
    Are you aware Boeing employees have raised concerns about being 
required to complete an internal review process before being allowed to 
speak with their FAA counterparts about potential problems?
    Answer. The procedures for communications between the ODA unit and 
the FAA, and the process for coordinating such communications, are 
defined in Boeing's ODA procedures manual, which is approved by the 
FAA. The procedures manual governs the conduct of Boeing's ODA unit 
members. Boeing's ODA procedures manual, as well as Boeing policy, 
contains procedures to comply with regulatory requirements by ensuring 
certain communications between Boeing and ODA unit members are 
coordinated, documented, and retained.
    Neither these regulatory requirements nor Boeing's ODA procedures 
manual prevent members of Boeing's ODA from communicating with their 
FAA counterparts. Boeing employees have multiple avenues they can use 
to raise concerns or potential problems, including within the ODA, 
within the company, and directly to the FAA.
    As discussed in more detail in response to Question 4, Boeing's 
``Verification Optimization'' program is unrelated to the ODA unit.

    Question 4. Does Boeing still plan to move forward with its plan to 
cut visual inspections by Boeing quality inspectors?
    Answer. Boeing's ``Verification Optimization'' program is part of 
Boeing's effort to ensure first-time quality and increase the overall 
quality of its products. Under this program, in coordination with the 
FAA, Boeing has introduced a robust verification plan that allows 
quality inspectors to focus on certain areas: (1) critical items or 
areas of that pose higher risks; (2) new or unique build processes; and 
(3) areas where inspection data demonstrates existing processes result 
in a high rate of defects. For areas outside these categories, quality 
is still verified by experts in the work being performed. This program 
includes continuously evaluating regulatory and design requirements for 
specific inspections, ensuring those inspections are conducted, as well 
as monitoring results to re-evaluate where additional inspections could 
be needed. Through this program, Boeing is able to effectively use its 
quality inspector workforce to focus on the areas of production most in 
need of additional inspection. Moreover, as part of this program, 
Boeing has introduced a reporting process and review panel in its 
factories to identify and report any issues or concerns.

    Question 5. Does removal of quality inspectors increase the 
likelihood of human factor errors?
    Answer. The verification optimization program does not eliminate 
checking our work. Instead, it focuses resources on more critical, 
difficult, or high risk areas where the likelihood or consequence of a 
human error is higher.

    Question 6. Reports indicate that Boeing's original design of MCAS 
called for the system to move the horizontal stabilizer only 0.6 
degrees. However, the final design authorized MCAS to move the 
horizontal stabilizer more than four times as far, by 2.5 degrees for 
each activation.
    Was FAA made aware of the change of design providing for MCAS 
movements of 2.5 degrees for each activation? If so, when and under 
what circumstances? Please specify who at FAA was made aware of the 
change of design.
    Answer. The FAA was made aware of the change in the design. Boeing 
was transparent with the FAA about MCAS's design, including changes in 
that design over time. The development and certification process for 
the MAX took over five years. During that time, Boeing worked with 
numerous FAA employees across multiple departments regarding all 
aspects of MAX certification, including MCAS. This includes FAA 
employees at the Boeing Aviation Safety Oversight Office (BASOO) within 
the FAA's Aircraft Certification Service, as well as FAA test pilots 
and other FAA personnel who participated in flight tests and evaluated 
the activation of and data related to MCAS.
    On numerous occasions, Boeing shared with the FAA and international 
regulators that MCAS's final design had changed from its earlier 
parameters, and that its operating range had expanded to include low-
speed conditions. The meetings and information exchanges regarding 
these topics began in mid-2016 and continued over subsequent months. 
The information provided to the FAA in these interactions included 
MCAS's maximum stabilizer authority of 2.5 degrees, as well as other 
aspects of the function's performance.
    In addition to these briefings, FAA personnel also observed the 
operation of expanded MCAS during certification flight testing. The 
conditions tested included MCAS's performance during low speed stall, 
and during these tests MCAS was activated nearly to the limit of its 
maximum stabilizer authority of 2.5 degrees. FAA personnel--including 
engineers, pilots, and at times both--were on board many of these 
flight tests to observe the performance of the flight conditions, 
including those involving MCAS. In some cases, FAA test pilots were at 
the controls and flew the relevant conditions. Boeing also provided the 
FAA with data related to MCAS activation in low speed conditions.
    Dan Elwell, then-Acting Administrator of the FAA, has testified 
before Congress that the certification process ``included 297 test 
flights, some of which encompassed tests of MCAS functions. FAA 
engineers and flight test pilots were involved in the MCAS operational 
evaluation flight test.''

    Question 7. If FAA was not made aware of the change of design, 
explain why Boeing failed to bring the change to FAA's attention.
    Answer. As noted in the response to Question 6, the FAA was made 
aware of the change of design.

    Question 8. Was MCAS installed on the 737 MAX for the purpose of 
ensuring the stability of the aircraft? Or was the system installed for 
the purpose of more closely approximating the handling characteristics 
of previous models of the 737 aircraft?
    Answer. MCAS was initially implemented to improve aircraft handling 
characteristics in certain rarely encountered high-speed, high-angle-
of-attack flight conditions. As development of the 737 MAX continued, 
flight testing showed that other changes to the airplane's design 
affected the 737 MAX 8's handling characteristics in certain low speed 
scenarios involving high angles of attack. Boeing analyzed both control 
law and physical changes as possibilities to address this issue and 
ultimately determined that a combination of the two approaches, 
including an expansion of MCAS's operating range to lower speeds, was 
the most promising solution for achieving appropriate and certifiable 
handling characteristics.

    Question 9. Can the 737 MAX aircraft be operated safely without 
MCAS within the normal flight envelope? Can it be operated safely 
without MCAS within the operational flight envelope?
    Answer. As described more fully in the answer to the previous 
questions, MCAS was initially implemented to improve handling 
characteristics in certain rarely encountered high angle of attack 
situations, and was expanded to achieve appropriate and certifiable 
handling characteristics in certain low-speed situations. As part of 
the safety process described more fully in the answer to Question 10, 
Boeing evaluated the loss of the MCAS function within both the normal 
and operational envelope. Loss of the MCAS function was rated minor 
within the normal flight envelope, and major within the operational 
flight envelope.

    Question 10. The Lion Air report finds that MCAS was designed to 
rely on a single Angle of Attack (``AoA'') sensor, making it vulnerable 
to erroneous input from that sensor. Did Boeing test the consequences 
of relying on only one sensor? Explain why or why not.
    Answer. The 737 MAX was a derivative of the 737 NG, an airplane 
with one of the best safety records of all large commercial aircraft. 
MCAS was an extension of the 737 NG Speed Trim System, which is also 
based on a single sensor. Boeing uses an established safety analysis 
process to implement and validate changes to an airplane design. This 
process entails a comprehensive and iterative assessment of the new 
design, and identification and resolution of any potential safety 
issues.
    Central to the safety analysis process is evaluating how a design 
performs in the presence of a series of hypothetical failure scenarios. 
In identifying and evaluating potential failure conditions, Boeing 
follows the industry standard approach of preparing functional hazard 
assessments. Boeing experts identify potential failure conditions using 
a variety of techniques, including pilot feedback and evaluation, in-
service experience, lessons from prior accidents and incidents, and 
engineering performance analysis. They then assess the level of hazard 
that these failure conditions present at an airplane level. The design 
is then validated through a combination of lab, simulator, and flight 
testing, to ensure that the probability of each identified failure 
condition is appropriate for the level of hazard assessed. The results 
of this testing are in turn evaluated by cross-functional teams of 
subject matter experts across the enterprise, and changes are made to 
the design as appropriate. The testing is then repeated after the 
incorporation of any changes. Multiple levels of review, conducted both 
at the working level and by program and functional management, occur 
throughout the process, as does regular information sharing and 
interaction with the FAA. These reviews and regulator interactions 
frequently result in direction to the team to further refine the 
design, and to conduct additional testing and analysis, in order to 
ensure that the design is safe and meets all certification and 
performance requirements and expectations.
    Boeing's evaluation of MCAS was consistent with this process. 
Boeing experts performed a thorough safety assessment for the initial 
MCAS design, with Boeing test pilots and engineers conducting a number 
of piloted simulator sessions in 2012 and 2013 to evaluate possible 
hazards. In March 2016, concurrently with developing the requirements 
for the expanded MCAS design, Boeing subject matter experts--including 
both engineers and experienced pilots--conducted an additional targeted 
assessment of the potential hazards posed by MCAS's greater stabilizer 
authority at low speeds. Among other conditions tested during the MAX 
development process, Boeing considered uncommanded MCAS operation 
resulting in unintended nose down trim to the maximum stabilizer 
authority for both the earlier and expanded MCAS designs.

    Question 11. The Lion Air report finds that the absence of guidance 
on MCAS or more detailed use of trim in the flight manuals and in pilot 
training made it more difficult for flight crews to properly respond to 
uncommanded MCAS activations.
    Did Boeing consult with pilots employed by domestic or foreign air 
carriers about the removal of information about MCAS in flight manuals 
and in flight crew training? Explain why or why not.
    Answer. In accordance with FAA regulatory guidance, flight training 
for all Boeing airplanes, including the 737 MAX, is designed to give 
pilots the knowledge, skills, and abilities necessary to safely operate 
each model on which they are licensed (or ``type-rated''). Boeing and 
the FAA coordinated closely over the course of several years in 
developing the necessary training requirements and flight manual 
content for the MAX. Many items were considered for inclusion, 
including MCAS, and the content of the manuals and training evolved 
over time, as is common. Ultimately, relying on the professional 
judgment of those involved in this process, Boeing proposed, and the 
FAA agreed, not to include a description of MCAS in the final version 
of the Flight Crew Operations Manual for the MAX. When the MAX returns 
to service, Boeing has recommend that pilots receive simulator training 
on the MAX and the flight manuals will have specific references to the 
MCAS system.

    Question 12. Have any Boeing personnel been terminated, reassigned, 
or suffered any internal disciplinary action as a result of actions or 
omissions regarding any activities concerning the certification or 
approval of the Boeing 737 MAX or any systems therein? If so, please 
provide details on the actions taken, including the dates.
    Answer. Boeing has recently made several high-level leadership 
changes to ensure that it has the right leadership going forward. 
Boeing has also made several structural changes to enhance the 
company's culture of safety and accountability. These include the 
creation of a permanent Aerospace Safety Committee within our Board of 
Directors to ensure greater Board oversight and visibility, creation of 
a Product and Services Safety organization that will, among other 
things, centralize investigations of safety concerns, and realignment 
of the engineering function within the company, to ensure technical 
accountability to the Chief Engineer. In addition, several external 
reviews are ongoing. As those conclude, we will evaluate the results of 
those reviews and will not hesitate to hold individuals accountable, 
where appropriate.

    Question 13. Is Boeing committed to returning the 737 MAX to 
service only as part of a unified review process with other 
international regulators (such as the European Aviation Safety Agency)?
    Answer. Boeing's regulators will determine the process for the 
MAX's return to service, and Boeing will support whatever process the 
FAA and other international regulators determine is appropriate. Boeing 
is working with both the FAA and other global regulators, including 
through multi-regulator assessments such as the Joint Operations 
Evaluation Board, to safely return the MAX to service worldwide. Boeing 
is committed to providing any information needed by those regulatory 
authorities to support their reviews.

    Question 14. The Lion Air report finds that the AoA DISAGREE alert 
was not correctly enabled during 737 MAX development. Did Boeing test 
the AoA sensor DISAGREE alert to ensure reliability prior to receiving 
type certification? Explain why or why not.
    Answer. Boeing tests all software it receives prior to type 
certification. Boeing's testing did not immediately detect this 
software issue. In August 2017, several months after the software 
delivery and the commencement of MAX deliveries, Boeing engineers 
identified the issue after internal testing revealed that the alert was 
not working as expected.

    Question 15. The Lion Air report finds that the crew was unable to 
effectively manage the multiple alerts, repetitive MCAS activations, 
and distractions related to numerous air traffic control 
communications. Did Boeing test the human factors impact of multiple 
alerts, repetitive MCAS activations, and other distractions that would 
make it difficult for a flight crew to manage a catastrophic failure? 
Explain why or why not.
    Answer. As described in the answer to Question 10, Boeing uses an 
established safety-analysis process, and that process was used for the 
737 MAX and MCAS specifically. Boeing experts performed a thorough 
safety assessment for the initial MCAS design, with Boeing test pilots 
and engineers conducting a number of piloted simulator sessions in 2012 
and 2013 to evaluate possible hazards. In March 2016, concurrently with 
developing the requirements for the expanded MCAS design, Boeing 
subject matter experts--including both engineers and experienced 
pilots--conducted an additional targeted assessment of the potential 
hazards posed by MCAS's greater stabilizer authority at low speeds. In 
performing this assessment, Boeing's experts applied their engineering 
judgment and piloting experience to the existing safety analysis and 
data for the earlier MCAS design, and also considered new performance 
data generated through piloted simulator testing and computer analysis 
of MCAS's operation at low speeds.
    In the initial analysis, Boeing's subject matter experts had 
concluded that MCAS's earlier design met all applicable functional 
hazard assessment thresholds. Based on their updated hazard analysis, 
Boeing's subject matter experts concluded at the end of March 2016 that 
the expanded version of MCAS also met all applicable requirements, and 
did not create any heightened risks beyond the earlier design.
    Since the accidents, a number of reports have recommended revisions 
to the safety-analysis process. Boeing is evaluating those 
recommendations, as well as the lessons learned during the process of 
returning the MAX to service, to make improvements to its safety 
analysis processes. Boeing also supports updating the industry-wide 
assumptions reflected in existing regulatory guidance.

    Question 16. To replace or to supplement flight data generated by 
external sensors, Boeing has developed such virtual technologies as 
``synthetic airspeed'' and ``synthetic AoA.'' Currently, these state-
of-the-art technologies are present only on the 787 aircraft, although 
they will reportedly be installed on the new 777X aircraft, as well. 
Exclusive reliance on external sensors such as AoA sensors raises 
concerns because of their exposure to inadvertent or intentional 
damage.
    Why weren't these state-of-the-art technologies incorporated into 
the design of the 737 MAX? Why isn't Boeing setting the standard by 
deploying the best available technologies in new aircraft?
    Answer. Boeing routinely introduces best-available and industry-
leading technologies on its airplanes. However, not every new 
technology is appropriate for every aircraft. Synthetic airspeed is a 
technology that allows for the indirect calculation of a plane's 
airspeed from various inputs, including external sensor data. Boeing 
carefully considered the possible inclusion of synthetic airspeed 
during the development of the 737 MAX, and determined not to implement 
synthetic airspeed on the 737-8. Boeing subject matter experts 
evaluated the potential advantages and disadvantages of implementing 
synthetic airspeed. This evaluation process included the relevant 
technical experts and decision-makers, and different views were 
appropriately considered. Boeing continues to assess the potential 
application of synthetic airspeed to its airplanes.

    Question 17. Why was MCAS designed with authority to ``issue'' 
uncommanded flight control inputs while relying on only one AoA 
sensor--a single point of failure with no redundancy? Did any Boeing 
employees raise concerns about the reliance on one AoA sensor during 
MCAS' development?
    Answer. Please see the answers to questions 8 and 10 regarding 
MCAS's original design. As discussed therein, the MCAS flight control 
law was designed as an extension of the 737 NG's Speed Trim System. 
That system is a single sensor design that has hundreds of millions of 
hours of safe flight.
    Regarding potential employee concerns, as is normal during the 
airplane development process, Boeing technical personnel raised and 
discussed many technical issues related to the design and development 
of the MAX, including MCAS. Boeing maintains an Employee Issue Tracking 
System, a single, common system for entering and tracking employee 
issues and complaints. Boeing has searched EITS and located no records 
indicating an employee raised concerns with the design of MCAS prior to 
the Lion Air accident in October 2018.

    Question 18. Are there other systems installed on Boeing aircraft 
which are given such authority based on data from only one sensor?
    Answer. Whether an airplane system is allowed to rely on a single 
input is determined by FAA regulation. For an aircraft to be certified, 
it must meet all regulatory requirements.
    Note: The following questions refer to the Aircraft Certification 
``Transformation'' Pre-Decisional Involvement Report, Union 
Recommendations and Dissenting Opinion that was published on February 
6, 2017. The report is attached for your reference.

    Question 19. Will Boeing upgrade the single string rudder control 
before the MAX is returned to service? Why or why not? (See Dissenting 
Opinion, 2017 sec. 12.2.3)
    Answer. Boeing's rudder control design has been certified by the 
FAA multiple times, most recently on the 737 MAX. As part of the MAX 
certification process, Boeing discussed its rudder cable design with 
the FAA in multiple meetings over several years. These meetings focused 
on how the planned changes from the certified NG design to the MAX 
could affect hazards related to engine failure as well as design 
precautions taken by Boeing to minimize such hazards in accordance with 
FAA regulations. Boeing also shared with the FAA several potential 
additional design changes. Because changes to an existing, proven 
design can increase risks in other areas, design changes were evaluated 
based on their potential utility to mitigate the overall level of risk. 
As Administrator Dickson testified before the Transportation and 
Infrastructure Committee of the House of Representatives on December 
11, 2013, adding complexity to existing systems often introduces new 
risks.
    Boeing's analysis of these potential design changes indicated that 
they would increase the overall level of risk to the airplane, by 
introducing significant new risks. In addition, the risk of this type 
of hazard for the MAX was determined to be similar to the 737 NG, an 
airplane with an excellent safety record. As a result of these 
discussions, Boeing made additional changes to the MAX floor beam 
structure to further reduce the likelihood for damage to control 
surface cables in the event of an uncontained engine rotor failure. 
Boeing and the FAA also agreed on the methods and analysis that Boeing 
would use to demonstrate regulatory compliance. Boeing worked with the 
FAA and responded to all of its concerns to ensure that the 737 MAX 
complied with applicable requirements.

    Question 20. Will Boeing upgrade the single float switch that is 
vulnerable to single failures and that can cause fuel spillage onto the 
ramp area and the potential for uncontrolled fire? Why or why not? (See 
Dissenting Opinion, 2017 sec. 12.2.3)
    Answer. The single float switch design is based on the 737 NG, 
which has hundreds of millions of hours of safe flight. During the 
certification process, Boeing discussed the design and the means of 
compliance with the FAA. As a result of those discussion, Boeing 
provided data and analysis that demonstrated Boeing's design provided 
an equivalent level of safety to existing regulatory requirements, and 
the FAA certified the design.

    Question 21. Will Boeing upgrade the engine mount on the auxiliary 
power unit, which is aluminum and not fireproof, as required by current 
regulations? (See Dissenting Opinion, 2017 sec. 12.2.3)
    Answer. The initial design of the auxiliary power unit structural 
mount on the 737 MAX is unchanged from the 737 NG, which has hundreds 
of millions of hours of safe flight. During the certification process, 
Boeing improved the design to further reduce the risk of certain 
failure scenarios beyond regulatory requirements. Boeing documented 
these changes and provided data and analysis to the FAA identifying how 
Boeing's design provided an equivalent level of safety to existing 
regulatory requirements. The FAA certified Boeing's design.
    Note: The following questions refer to the Joint Authorities 
Technical Review (``JATR'') Boeing 737 MAX Flight Control System 
Observations, Findings, and Recommendations report that was published 
on October 11, 2019. The report is attached for your reference.

    Question 22. Please describe--and provide the documents showing--
the changes Boeing has made and the testing the company has done 
regarding human factors and human system integration with relation to 
the MCAS fix, as suggested by Recommendation R7 of the JATR report.
    Answer. Boeing has engaged in extensive testing of its MCAS 
updates. As of November 26, Boeing has dedicated over 190,000 
engineering and test hours relating to the MAX updates, flown nearly 
1100 test and production flights, and conducted simulator sessions with 
41 international regulators as well as 99 of our airline customers. 
This testing included simulator sessions, with regulators, to evaluate 
workload and human factors aspects of the updated procedures, training, 
and design.
    In the process of developing the MCAS update, Boeing incorporated 
human factors considerations into the design development, analysis, and 
testing process. Boeing has ensured that human-factors-focused 
specialists participate in the design reviews of the update, review its 
relevant safety analyses, and participate in simulator sessions where 
human-factors issues were evaluated. Boeing is also ensuring that 
relevant human-factors analyses are documented in its certification 
compliance submissions. Before engaging in human factors testing, 
Boeing shared its proposed approach with regulators, and Boeing 
incorporated the feedback it received into the tests.

    Question 23. Has Boeing created an independent system safety 
function to challenge the assumptions and work of Boeing's design and 
manufacturing personnel? (JATR report pgs. 30, 32). If so, has this 
independent system safety function been applied to the MCAS fix? What 
authority did that function have in relation to the design and other 
personnel? Please describe.
    Answer. Pursuant to a recommendation by a special Board committee, 
Boeing has created an independent Product and Services Safety 
organization that, among other responsibilities, will provide an 
independent review of safety assessments completed by design personnel. 
Although this specific organization was created after design of the 
upgrades to the MCAS flight control law were begun, those updates were 
scrutinized through a similar process.

    Question 24. The JATR report (pg. VIII) found that MCAS was not 
evaluated as a complete and integrated function and that the design was 
based upon data, architecture, and assumptions that were reused from 
the past. What has Boeing done to update these evaluations?
    Answer. As part of the 737 MAX's return to service, revised 
individual system safety assessments were consolidated into one 
Integrated System Safety Assessment (ISSA) for the entire Speed Trim 
System. The ISSA combines the analysis and results of several different 
systems and components of the airplane into a single compliance 
document, providing an integrated perspective into the flight control 
system's overall level of safety. As Boeing continues to work to return 
the MAX to service, we will use knowledge we have gained from that 
process to improve our safety processes for future airplanes. Moreover, 
as discussed in the response to Question 26, Boeing also supports 
updating the industry-wide assumptions reflected in existing regulatory 
guidance.

    Question 25. Who made the ultimate decision to remove information 
relating to MCAS functionality from the Flight Crew Operating Manual?
    Answer. Consistent with the established regulatory process, the 
development of the training requirements and manuals for the MAX was a 
complex, multi-year effort that involved close coordination between 
Boeing and the FAA. Ultimately, relying on the professional judgment of 
those involved in this process, Boeing proposed, and the FAA agreed, 
not to include MCAS in required pilot training for the MAX. Likewise, 
the FAA reviewed Boeing's flight manuals, which did not reference the 
MCAS function by name. Boeing has learned from these accidents, 
however, and the responses we have received from regulators, our 
customers, and other stakeholders, and Boeing is also in the process of 
updating flight crew training and manuals to reflect the updates to 
MCAS, as appropriate.

    Question 26. What assumptions has Boeing changed regarding pilot 
response time in the flight control functional hazard assessment? What 
data and testing did Boeing engage in, and what studies, if any, did 
the company rely upon when changing these pilot response time 
assumptions? (JTAR report pg. XII)
    Answer. Boeing's design, analysis and evaluation approach is based 
on FAA guidance and published industry standards, including FAA 
Advisory Circular 25-7C \1\ (``Flight Test Guide for Certification of 
Transport Category Airplanes''). This was the approach used when 
designing and certifying the 737 MAX. Boeing supports an industry-wide 
effort to update those standards.
---------------------------------------------------------------------------
    \1\ FAA Advisory Circular 25-7C was canceled in May 2018 and 
replaced by FAA Advisory Circular 25-7D, which contains the same 
guidance on these points. This is true for all references to Advisory 
Circular 25-7C in this document.
---------------------------------------------------------------------------
    In updating MCAS, Boeing has implemented a number of changes to the 
MCAS system that will minimize the risk that pilots encounter 
erroneous, repeated or non-command limited MCAS activation. Those 
changes include:

   The flight control system will compare inputs from both 
        angle of attack sensors, and MCAS will not activate if the 
        sensors disagree by 5.5 degrees or more.

   MCAS will no longer activate repeatedly. It will provide one 
        input for each elevated angle of attack event.

   Finally, MCAS will never be able to command more stabilizer 
        input than can be counteracted by the flight crew pulling back 
        on the control column.

    This design does not require the flight crew to promptly use 
sustained electric trim to mitigate potential stabilizer failures 
caused by MCAS. Moreover, this design meets all certification 
requirements whether or not flight crews follow all of the steps in the 
Runaway Stabilizer Non-Normal Checklist. As discussed in response to 
the previous question, Boeing is also in the process of updating flight 
crew training and manuals to reflect the updates to MCAS, as 
appropriate.

    Question 27. FAA Advisory Circular (``AC'') 25.1302-1 requires a 
showing that MCAS, individually and in combination with other systems 
and equipment, is designed so that qualified flight crew members 
trained in their use can safely perform all the tasks associated with 
the systems and equipment. The JATR report (pg. 12) found that Boeing 
wrongly failed to identify MCAS as requiring compliance with 25.1302-1. 
Has Boeing now complied with sec 25.1302-1 with regard to MCAS? If so, 
how?
    Answer. As part of the MAX's return to service, Boeing will 
demonstrate compliance with 14 C.F.R. Sec. 25.1302. The specific means 
of compliance are determined by the FAA. Boeing will provide all 
necessary information to the FAA as part of the return-to-service 
process.

    Question 28. The JATR report (pg. 18) found that a review of the 
natural (bare airframe) stalling characteristics of the 737 MAX should 
be performed to determine if unsafe characteristics exist. Has this 
been conducted? If so, please provide the data and testing 
documentation underling that review and conclusions.
    Answer. As part of the MAX's return to service and in response to a 
request from a regulator, Boeing conducted both simulator sessions and 
flight testing designed to verify that the MAX's characteristics and 
systems were compliant with relevant regulatory requirements regarding 
stall identification and subsequent airplane behavior. This testing 
included tests with the Speed Trim System (including MCAS) turned off. 
The testing verified the original finding of compliance.

    Question 29. Has Boeing performed stall demonstration compliance as 
required by 14 CFR 25.201 before or after the 737 MAX was grounded? 
(JATR report pg. 18) If so, when was this done? Please describe the 
testing, analysis and results.
    Answer. As part of the initial certification process, the 737 MAX 
demonstrated compliance with 14 C.F.R. Sec. 25.201. As part of the 
MAX's return to service, Boeing is working with the FAA to demonstrate 
compliance with this section, and will provide any necessary data and 
analysis required by the FAA.

    Question 30. Prior to the crashes, 737 MAX simulators did not 
exhibit the problems that occurred and caused the crashes. What has 
Boeing done to verify that simulators accurately simulate all aspects 
and potential problems of flying the 737 MAX? How many such simulators 
exist?
    Answer. Pursuant to Federal regulation, the FAA certifies flight 
simulators for use as aviation training devices. Boeing does not 
manufacture aircraft simulators, though Boeing does provide software to 
the manufacturers of these products. Though it is impossible to 
simulate every possible aircraft malfunction or combination of 
malfunctions, the 737 MAX training simulation software contains 
hundreds of malfunction scenarios. Those scenarios were identified 
based on industry standards and an assessment of training value. The 
available malfunction scenarios are continuously reviewed based on 
changing training techniques, operator feedback, and operational data. 
For instance, in March 2019 Boeing added a malfunction scenario that 
simulates the effects of erroneously high Angle of Attack data.
    Boeing owns one MAX engineering simulator in Seattle, as well as 8 
MAX training simulators at locations around the globe. As of December 
2019, Boeing is aware of approximately 26 others worldwide.

    Question 31. Has Boeing changed its prior practice (JATR report pg. 
29) of failing to identify personnel recommending approval with 
airworthiness standards via FAA Form 8100-9 Statement of Compliance 
with Airworthiness Standards? Does this change apply to submissions 
relating to the MCAS fix? If not, please describe how Boeing identifies 
employees who make airworthiness recommendation decisions and hold them 
accountable.
    Answer. Boeing's existing Organization Designation Authority (ODA) 
procedures require the submission of signed FAA Form 8100-9 for all 
compliance data submittals except in limited circumstances, such as 
flight test reports where the FAA retained the compliance deliverable 
and conducted the test. In all cases where Boeing submits a Form 8100-
9, the individual signing the form is identified.
    Boeing's Organization Designation Authority procedures are outlined 
in its ODA procedures manual, which is the product of an agreement with 
the FAA. As such, Boeing cannot unilaterally change its ODA procedures. 
However, Boeing is evaluating changes to these procedures and will make 
any necessary changes in coordination with the FAA.

    Question 32. The JATR report recommended that all ``major hazards'' 
determined under AC 25.1309.1A, which include flight crew action in 
mitigation, should be examined to determine if they are potentially 
catastrophic. (JTAR report pg. 30) Has Boeing conducted a review of 
other systems in the 737 MAX since the accidents? Please describe what 
systems were examined, what testing and analysis was done, and what 
were the results of the examinations?
    Answer. As part of the process to return the MAX to service, Boeing 
has re-evaluated its analysis of any system that could have a failure 
effect on the flight control computer (FCC), as well as any system 
potentially affected by a failure of the FCC. Boeing used a 
comprehensive failure analysis process, focusing on cascading system 
effects as well as the flight crew's ability to cope with the failure 
during different phases of flight. The testing and analysis included 
identifying the effects of a particular failure, conducting a thorough 
review of each failure case, and, where necessary, conducting simulator 
testing to finalize the appropriate hazard classification.
    After reviewing the individual system effects for the failure 
(first, second, third order effects), Boeing prepared an airplane level 
analysis of the system effects and expected flight crew response. The 
results of the testing and analysis were provided to the FAA for use 
during the return-to-service process. As described previously, Boeing 
will use the knowledge we have gained during the process of returning 
the MAX to service to make improvements to its processes going forward.

    Question 33. The JATR report determined that the single and 
multiple failure analysis of MCAS was never performed (JTAR report pg. 
34). Please describe all possible failures of MCAS and related systems 
that were examined in the process of returning the MAX to service, and 
how Boeing intends to mitigate those potential failures.
    Answer. The JATR report indicates that an aircraft-level single-and 
multiple-failure analysis, although not a certification deliverable, 
was developed and used by Boeing in evaluating the MAX. JATR Report at 
33.
    In the process of returning the MAX to service, Boeing has 
conducted extensive testing of the updates to the MCAS flight control 
law, and has documented that testing in submissions to the FAA. This 
testing has included failure modes such as unexpected loss of MCAS 
operation and three different types of erroneous MCAS operation: (1) 
MCAS operating when unnecessary; (2) MCAS operation based on incorrect 
data input; and (3) MCAS stopping in the middle of expected operation. 
As described in the answer to the previous question, Boeing has also 
re-evaluated other potential flight-control-computer failures.
    In updating MCAS, Boeing has implemented a number of changes to the 
MCAS system that will minimize the risk that pilots encounter 
erroneous, repeated, or non-command-limited MCAS activation. Those 
changes include:

   The flight control system will compare inputs from both 
        angle of attack sensors, and MCAS will not activate if the 
        sensors disagree by 5.5 degrees or more.

   MCAS will no longer activate repeatedly. It will provide one 
        input for each elevated angle of attack event.

   Finally, MCAS will never be able to command more stabilizer 
        input than can be counteracted by the flight crew pulling back 
        on the control column.

    This design does not require the flight crew to promptly use 
sustained electric trim to mitigate potential stabilizer failures 
caused by MCAS. Moreover, this design meets all certification 
requirements whether or not flight crews follow all of the steps in the 
Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process 
of updating flight crew training and manuals to reflect the updates to 
MCAS, as appropriate.

    Question 34. The JATR report found that Boeing did not meet the 
objectives of Society of Automotive Engineers Aerospace Recommended 
Practice 4754A (``ARP4754A'') for an integrated approach to design when 
integrating complex systems like MCAS into the legacy 737. (JTAR report 
pg. 38) Please describe what Boeing has done to meet the objectives of 
ARP4754A in this regard, as it attempts to return the MAX to service.
    Answer. During the certification of 737 MAX systems, Boeing worked 
with the FAA to develop specific methods of compliance with FAA 
regulations. These methods are consistent with the intent of ARP4754A. 
As described in the answer to Question 24, for the updates to the MCAS 
flight control law, Boeing has consolidated individual system hazard 
assessments into an Integrated System Safety Assessment for the Speed 
Trim System. The ISSA combines the analysis and results of several 
different systems and components of the airplane into a single 
compliance document, providing an integrated perspective into the 
flight control system's overall level of safety.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. Amy Klobuchar to 
                           Dennis Muilenburg
    At Tuesday's hearing, you indicated that you would follow up with 
information in response to my questions on how often Boeing engineers--
rather than Federal Aviation Administration (FAA) employees--conduct 
safety certifications for Boeing aircraft.
    Question 1. What percentage of FAA certifications do Boeing 
employees--rather than FAA employees--approve for Boeing aircraft?
    Answer. The FAA initially accepted the Master Certification Plan 
for the 737-8 in November 2013, and it accepted the Detailed 
Certification Plans in August 2015. When the Master Certification Plan 
was initially accepted by the FAA, approximately 28 percent of the 
detailed Certification Plans were delegated. As the FAA reviewed the 
certification deliverables, those deliverables evolved. The number of 
delegated tasks increased as a result. For example, the FAA often will 
review a Boeing proposal for compliance, provide comments and require 
changes to that proposal and then delegate the final implementation 
work to Boeing's ODA. However, even for certifications that are 
delegated, all testing and reviews that Boeing conducts to demonstrate 
compliance with applicable standards and requirements are subject to 
FAA oversight.

    Question 2. How many Boeing engineers both work on automated 
systems for the company and then certify those systems for the FAA?
    Answer. Boeing employs approximately 16,000 engineers that work on 
designing commercial airplanes. Of those, approximately 3700 work 
specifically on airplane systems, and approximately 350 work on flight 
control systems. Approximately ten flight control engineers have 
credentials as Engineering Unit Members in the Boeing Organization 
Delegation Authority (ODA), which would allow them to make a compliance 
finding on behalf of the FAA regarding flight controls, if the FAA 
delegates such findings to Boeing's ODA.
    In response to my question regarding whether certain aircraft 
should be allowed to carry passengers in some countries and not others, 
you declined to respond and stated that you ``respect the jurisdiction 
of the regulatory authorities around the world.''

    Question 3. How would you explain that to a passenger who is 
rightly concerned about their safety?
    Answer. Boeing respects the authority of all individual civil 
aviation authorities to make decisions regarding the airspace they 
control and the pilots, maintenance personnel, and airlines they 
oversee. Individual civil aviation authorities around the world, 
working in collaboration with other regulators and the broader aviation 
community, are best positioned to determine how to achieve safety goals 
in the context of their individual regions and operations. Boeing is 
committed to ensuring the MAX returns to service worldwide, and to 
providing any information and support needed by those civil aviation 
authorities, and our customers, to achieve their goals and ensure the 
MAX safely returns to service worldwide.
                                 ______
                                 
 Response to Written Questions Submitted by Hon. Richard Blumenthal to 
                           Dennis Muilenburg
    Boeing's attempt to move all the Lion Air cases overseas to 
Indonesia. Boeing says that it will take responsibility for the Lion 
Air crash resulting in the deaths of 189 people in Indonesia last year 
and the Ethiopian Airlines crashed that killed a 157 people from a pair 
of defectively designed 737 MAX aircraft. However, your company is 
threatening not to. Boeing has filed court documents for the Lion Air 
crash indicating that it will move to change the venue of the case to 
Indonesia, where the plane was maintained, if settlement talks fail. 
The case was filed in the Northern District of Illinois, where Boeing 
is headquartered. Resolving these claims in Indonesia is a travesty of 
justice because:

   There is no Seventh Amendment Constitutional right to a jury 
        trial;

   There is no requirement of discovery, so there is limited or 
        no ability for the plaintiffs to uncover the documents showing 
        what Boeing knew, when it knew it, what information was 
        withheld from the FAA, and other critical information;

   There is no rule allowing for depositions to be taken of key 
        Boeing decision-makers; and

   There is no right to cross-examine witnesses to see what 
        they know.

    Question 1. Is the threat to move the case to Indonesia a 
litigation tactic or is this attempt to evade responsibility for 
corporate misconduct?
    Answer. In response to both MAX accidents, Boeing has offered to 
engage in mediations in the United States to resolve the families' 
claims without the need for any litigation. To facilitate this, Boeing 
arranged for a prominent Chicago mediator, a former Chief Judge of the 
Circuit Court of Cook County, to assist, and is paying the full costs 
of all mediations. Since the middle of July, Boeing has been working 
with the mediator and the families who lost loved ones in the Lion Air 
accident to settle these cases. We have resolved approximately one half 
of the Lion Air claims filed in the United States on terms that 
compensate the victims' families. We remain committed to this mediation 
process. If, at some point and despite Boeing's best efforts, an 
impasse is reached in the mediation process, the litigation may resume. 
And at that point, well-settled U.S. law will give Boeing the option of 
requesting that the court determine whether, consistent with well-
settled legal principles adopted by the United States Supreme Court, 
another jurisdiction is the appropriate venue for such cases.

    Question 2. It seems that you want the advantages of being treated 
like an American company except that you don't want to utilize U.S. 
courts, which recognize the rights of both parties in a dispute. Why 
are you threatening to move the claims filed against you to Indonesia?
    Answer. Please see the response to the previous question.

    Question 3. Traditionally, companies complain that they don't want 
to be sued in the plaintiff's backyard, yet, you are being sued in your 
home state. Why are you threatening to leave courts conveniently 
located in your backyard?
    Answer. Please see the response to your first question.
    Clarification on Boeing's support for changes to the certification 
process. On October 27, 2019, the New York Times reported on Boeing 
efforts to undercut regulatory oversight--early and often. The story of 
Boeing sabotaging rigorous safety scrutiny is chilling--and more reason 
to keep 737 MAX aircraft grounded until certification is truly 
independent and the system reformed.
    Your company has lost the trust of the public, and I am evaluating 
changes to the Organizational Designation Authorization (ODA) program. 
At the hearing, you were unclear about Boeing's position on changes to 
the current certification process.

    Question 4. Do you support reducing the amount of delegation 
authority from the FAA to Boeing to restore public trust?
    Answer. Boeing strongly supports robust FAA oversight of the 
certification process. As the last major commercial airplane 
manufacturer in the United States, Boeing believes the certification 
process, and the FAA's role in that process, are vital to the safety of 
the traveling public, and have been an important factor driving 
substantial improvements in aviation safety in recent decades.
    Delegation has strongly correlated with safety. Delegation is 
decades old; and as delegation has increased, safety has as well. The 
data does not support the idea that reducing the amount of delegation 
will result in an increase in safety. Boeing believes that any changes 
made should continue to ensure the FAA's resources are focused on areas 
such as new technologies, systems integration, and development, and 
providing the FAA with the resources needed to effectively administer 
that process as well as ensure FAA has the required technical 
expertise.

    Question 5. What is the current timeline for returning the 737 MAX 
to service and how can the public be assured of its safety?
    Answer. The relevant civil aviation authorities will determine when 
the MAX returns to service. When the MAX returns to service, it will be 
one of the most scrutinized aircraft in history, and Boeing is 
committed to ensuring that it will also be one of safest aircraft ever 
to fly.
    Boeing's decision to label MCAS failure as ``major'' rather than 
``catastrophic''. As you are aware, Boeing decided to classify failure 
of the MCAS system during flight as merely ``major''--lowering the 
classification of risk and exempting Boeing from having to fully test 
and analyze the effects of system failure.

    Question 6. How can you explain the failure to label the MCAS as 
``catastrophic?''
    Answer, Boeing engaged in a multi-step process for evaluating the 
potential safety considerations involved in the implementation of MCAS. 
At each stage of the design, development, and testing of MCAS, Boeing 
subject matter experts reviewed and evaluated the design and the 
potential safety implications of design changes.
    As authorized by applicable FAA guidance, including FAA Advisory 
Circular 25-7C (``Flight Test Guide for Certification of Transport 
Category Airplanes''), in conducting their hazard assessments, Boeing's 
subject matter experts made a series of assumptions about how a flight 
crew would react if MCAS failed or did not function as intended. 
Consistent with established FAA guidance, this included the assumption 
that the crew would recognize and address uncommanded MCAS activation 
through normal use of the control column and the electric trim 
switches, and that the crew would also be able to use the stabilizer 
cutout switches and rely on manual trimming (as outlined in the Runaway 
Stabilizer Non-Normal Procedure) to stop any unintended stabilizer 
motion. Test pilots participated in the simulator testing of MCAS and 
had vital input into the hazard analysis.

    Question 7. Why did you make this decision?
    Answer. Please see the response to question 6.

    Question 8. Could the decision to label the system as 
``catastrophic'' have prevented the MCAS failure from contributing the 
Lion Air and Ethiopian Air crashes?
    Answer. Whether hypothetical changes to the MCAS hazard rating 
could have prevented a failure of MCAS from contributing to the Lion 
Air and Ethiopian Air crashes is impossible to determine. As Boeing 
testified at the hearing, if, using hindsight, Boeing could go back and 
make changes to the MAX that would prevent the accidents, it would do 
so.
    Undue pressure put on Boeing employees to certify 737 MAX aircraft. 
The Wall Street Journal recently reported that internal Boeing surveys 
revealed that about 30 percent of its employees felt potential undue 
pressure from managers regarding safety related approvals.
    Boeing engineer Curtis Ewbank filed a complaint that asserted, 
``Boeing management was more concerned with cost and schedule than 
safety or quality.'' He further asserted that you, Mr. Muilenburg, 
publicly misrepresented the safety of 737 MAX aircraft.
    The October 11, 2019 Joint Authorities Technical Review report also 
found several instances of Boeing management exerting undue pressure on 
its own engineers performing certification activities, which, as a 
result, ``erodes the level of assurance in this system of delegation.''

    Question 9. Did you at any point misrepresent the safety of 737 MAX 
aircraft? Please explain.
    Answer. No. With that said, Boeing has learned from these 
accidents, and has made several changes to the MAX to ensure that 
accidents like these never happen again. Boeing has dedicated over 
190,000 engineering and test hours relating to the MAX updates, flown 
more than 1100 test and production flights, and conducted simulator 
sessions with 41 international regulators as well as 99 of our airline 
customers. When the MAX returns to service, we are confident it will be 
one of the most scrutinized and safest aircraft ever to fly.

    Question 10. Did personnel within the company--involved in 
performing certification activities--have compensation tied to meeting 
timeline and cost goals? Please explain.
    Answer. For members of Boeing's Organization Delegation Authority 
(ODA), Boeing's ODA manual does not permit the use of timeline and cost 
goals as part of performance evaluations.

    Question 11. Did you ever personally exert production pressures on 
any of the employees that served under you as Boeing's CEO? If not, 
have you identified who, or what, in your organization caused that 
undue pressure?
    Answer. Mr. Muilenburg was not the subject of any undue pressure 
complaint. Boeing provides a number of avenues for employees to report 
instances of potential or actual undue pressure. In accordance with 
Boeing's ODA procedures manual, which is reviewed and approved by the 
FAA, allegations of potential undue pressure must be investigated and 
rectified, where needed, in a timely manner. Boeing investigates all 
undue pressure reports and those investigations are reviewed with the 
FAA. Boeing also conducts regular self-audits and surveys of the 
workforce to identify and address potential avenues of undue pressure 
that are not specifically reported by the workforce. In addition, 
Boeing requires any manager associated with the certification process 
to take training on undue pressure every two years, to ensure that they 
can identify and address potential undue pressure issues.

    Question 12. What steps have been taken to hold individuals 
accountable and reform Boeing's safety protocols related to undue 
pressure being put on employees?
    Answer. Boeing takes all allegations of undue pressure seriously. 
The Boeing Organization Designation Authority manual requires that any 
allegation of undue pressure be promptly rectified. When appropriate, 
employee corrective action is taken. More broadly, Boeing has created a 
Product and Services Safety Organization. This organization will ensure 
that any safety issue, including issues of undue pressure, will be 
investigated and evaluated by an independent organization within the 
company.
    The need for Boeing to move away from a system of assumptions. The 
Joint Authorities Technical Review report stated that Boeing made 
critical and several unsupported assumptions underlying the 
certification of 737 MAX aircraft, including a three-second pilot 
response assumption in the event of a problem.
    These assumptions directly contributed to two horrific and 
preventable crashes.

    Question 13. As you have resubmitted a package to return the 
aircraft to service, what changes in assumptions of pilot response or 
the other assumptions outlined in that report have you made?
    Answer. Boeing's design, analysis and evaluation approach is based 
on FAA guidance and published industry standards, including FAA 
Advisory Circular 25-7C \2\ (``Flight Test Guide for Certification of 
Transport Category Airplanes''). This was the approach used when 
designing and certifying the 737 MAX. Boeing supports an industry-wide 
effort to update those standards.
---------------------------------------------------------------------------
    \2\ FAA Advisory Circular 25-7C was canceled in May 2018 and 
replaced by FAA Advisory Circular 25-7D, which contains the same 
guidance on these points. This is true for all references to Advisory 
Circular 25-7C in this document.
---------------------------------------------------------------------------
    In updating MCAS, Boeing has implemented a number of changes to the 
MCAS system that will minimize the risk that pilots encounter 
erroneous, repeated and non-command limited MCAS activation, those 
include:

   The flight control system will compare inputs from both 
        angle of attack sensors, and MCAS will not activate if the 
        sensors disagree by 5.5 degrees or more.

   MCAS will no longer activate repeatedly. It will provide one 
        input for each elevated angle of attack event.

   Finally, MCAS will never be able to command more stabilizer 
        input than can be counteracted by the flight crew pulling back 
        on the control column.

    This design does not require the flight crew to promptly use 
sustained electric trim to mitigate potential stabilizer failures 
caused by MCAS. Moreover, this design meets all certification 
requirements whether or not flight crews follow all of the steps in the 
Runaway Stabilizer Non-Normal Checklist. Boeing is also in the process 
of updating flight crew training and manuals to reflect the updates to 
MCAS, as appropriate.

    Question 14. What research have you or the FAA done to justify any 
of those changes?
    Answer. Boeing has engaged in extensive testing of these MCAS 
updates. As of November 26, Boeing has dedicated over 190,000 
engineering and test hours relating to the MAX updates, flown nearly 
1100 test and production flights, and conducted simulator sessions with 
41 international regulators as well as 99 of our airline customers. 
Testing has included evaluation of the system in normal operation, 
operation when subject to failures (in both the normal and operational 
flight envelopes), and the potential effect of pilot crew error and 
workload. When the MAX returns to service, we are confident it will be 
one of the safest aircraft ever to fly.
    The lack of documents provided to the Senate Commerce Committee. 
The House Transportation and Infrastructure Committee had received over 
500,000 pages of documents related to the certification of the 737 MAX. 
Boeing has failed to provide the same documents to the Senate Commerce 
Committee--inhibiting our ability to carry out our oversight authority.

    Question 15. Will you commit to providing these documents to the 
Senate Commerce Committee as well? Please explain.
    Answer. Boeing respects the role of both Committees in the 
oversight of the aviation industry and is committed to continuing to 
cooperate with both Committees. To date, Boeing has responded to all 
requests received from the Chairmen of both Committees, and we intend 
to continue to cooperate with such requests.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Tom Udall to 
                           Dennis Muilenburg
    Question 1. As a follow up to my questioning during the hearing, 
have you and your team engaged on what are ways to improve the ODA 
process?
    Answer. Boeing strongly supports robust FAA oversight of the 
certification process. As the last major commercial airplane 
manufacturer in the United States, Boeing believes the certification 
process, and the FAA's role in that process, are vital to the safety of 
the traveling public, and have been important factors driving 
substantial improvements in aviation safety in recent decades.
    The Organization Delegation Authority process has helped facilitate 
these safety improvements. However, there are ways to improve that 
process. For example, the FAA's System Oversight capability could be 
strengthened by setting clear expectations for applicants' processes 
and procedures to ensure compliance for lower risk areas, as identified 
by the FAA. This would allow FAA to dedicate the majority of its 
resources on areas the FAA has determined to be the highest safety 
risk. Boeing will work with all interested stakeholders to learn from 
these accidents and further increase aviation safety.

    Question 2. Accountability is critical. How will you personally or 
Boeing collectively be held accountable for decisions you made or 
pressure you exerted on your team that led to minimizing pilot training 
and failing to disclose critical information in the rush to get these 
planes in the air?
    Answer. Boeing has recently made several high-level leadership 
changes to ensure that it has the right leadership going forward. As 
described in more detail in response to Question 4, Boeing has also 
made several structural changes to enhance the company's culture of 
safety and accountability. Several external reviews are ongoing. As 
those conclude, we will evaluate the results of those reviews and will 
not hesitate to hold individuals accountable, where appropriate.

    Question 3. In 2018, you received a $13 million dollar bonus, based 
in part on Boeing surpassing a three-year economic profit goal. Was any 
part of this goal and bonus based on the sales of the 737 MAX 8--which 
seems to have been rushed to the market? Have you given any of this 
bonus back?
    Answer. Mr. Muilenburg's 2018 compensation is publicly available in 
Boeing's annual proxy statement, which can be found at www.boeing.com.

    Question 4. Please detail the changes recommended by the FAA and 
other reviewing entities that will be incorporated into Boeing's other 
product lines and planes like the Boeing 737 MAX 10?
    Answer. Boeing is taking into consideration the recent 
recommendations of a number of reviews, and making improvements to 
Boeing internal processes as they relate to how we evaluate new 
airplane system design. Boeing continues to review additional reports 
and reviews as they are completed, and will continue to incorporate 
lessons from those reviews.
    Based on the recommendation of a special board committee, Boeing is 
also making several changes to our organization and processes designed 
to enhance safety culture of the company. These changes include:

  (1)  Creating a permanent Aerospace Safety Committee within our Board 
        of Directors to oversee and ensure safe design, development, 
        manufacture, maintenance, and delivery of our products and 
        services;

  (2)  Creating a Product and Services Safety organization to review 
        all aspects of product safety;

  (3)  Realigning the Engineering function within the company, so that 
        engineers across Boeing will report directly to the Chief 
        Engineer;

  (4)  Establishing a design requirements program to further facilitate 
        the incorporation of historical design materials, data and 
        information, best practices, lessons learned, and detailed 
        after action reports to reinforce Boeing's commitment to 
        continuous improvement;

  (5)  Enhancing our Continued Operational Safety Program to aid 
        transparency and visibility of safety related issues; the 
        Continued Operational Safety Program now will require the Chief 
        Engineer's review of all safety and potential safety reports;

  (6)  To anticipate the needs of future pilot populations, re-
        examining assumptions about flight deck design and operation in 
        partnership with our airline customers and industry members;

  (7)  Expanding our Safety Promotion Center for employees to learn and 
        reflect on our safety culture and renew personal commitments to 
        safety;

  (8)  Expanding our anonymous safety reporting system to strengthen 
        safety management systems within Boeing and our supply chain;

  (9)  Investing in new capabilities, including enhanced flight 
        simulation and computing, and advanced R&D for future flight 
        decks, as well as pilot and maintenance technician training and 
        STEM education.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Tammy Duckworth to 
                           Dennis Muilenburg
    During the October 29th hearing, I asked the Chairman of the 
National Transportation Safety Board (NTSB) whether he concurred with 
my view that, ``The most reliable initial human response to an 
uncommanded nose down dive is to pull back on the yoke.''
    Chairman Sumwalt provided the following response:

        ``Yes, I do. I have actually looked at the procedure and it 
        says to grasp and to hold it firmly but as you know as an 
        experienced pilot, your natural reaction would in fact if it is 
        going in a direction you do not intend it to, you would tend to 
        oppose it, which you should. In the older models of the Boeing 
        aircraft that I flew, the 727 and 737, that would engage the 
        stabilizer brake and stop the stab from running. But as you 
        pointed out in the earlier round, it will not do that when MCAS 
        is active on the 737 MAX.''

    I submitted the following written question to The Boeing Company on 
May 17, 2019:

        ``What does Boeing believe is the natural human reaction to 
        stop a nose down trim command runaway?''

    Boeing's written response failed to address what Boeing believes 
the ``natural human reaction is to stop a nose down trim command 
runaway'' and cited the steps of the Runaway Stabilizer Non-normal 
checklist.

    Question 1. Yes or no, does Boeing concur with the view that human 
factors have proven that the most reliable initial human response to a 
runaway horizontal stabilizer movement trimming airplane nose-down is 
to oppose the motion by pulling back on the yolk? Please explain your 
answer.
    Answer. Boeing is not aware of specific research that addresses the 
issue as presented by the question. Flight crews may use the control 
column, the pitch trim switches, or a combination of both to control 
the flight path of the airplane in the presence of an uncommanded nose-
down stabilizer movement.
    Pursuant to FAA guidance, Boeing's design assumes that pilots will 
take immediate action to reduce or eliminate short-term forces that 
cause an aircraft to deviate from its intended flight path. Based on 
that assumption and Boeing's expertise, the reaction to nose-down 
stabilizer movement is to control the flight path of the airplane using 
the methods available, including use of the control column and electric 
trim switches.

    Question 2. If the answer to Question 1 is ``No,'' please confirm 
whether Boeing concurs with the view that human factors have proven 
that the most reliable initial human response to a runaway horizontal 
stabilizer movement trimming airplane nose-down is to use both aft 
column motion and the column trim switch to quickly stop the runaway 
stabilizer and restore trim? Please explain your answer.
    Answer. Based on Boeing's expertise, the reaction to nose-down 
stabilizer movement is to control the flight path of the airplane. In 
the 737 MAX, the use of aft column motion, or the column trim switches, 
or both, could typically be used by a pilot to control the flight path 
of the airplane.

    Question 3. Yes or no, does Boeing concur that for the 707, 727, 
737 (except for the MAX), 747, 757 and 767 aircraft, many safe flight 
hours demonstrate that in non-normal conditions where a uncommanded 
stabilizer trim movement is causing a nose-down dive, pilots will 
reliably respond with aft column travel to both trigger the aft column 
cutout switch to quickly stop the runaway stabilizer movement and 
prevent significant mistrim, and command sufficient airplane nose-up 
elevator to exactly offset the stabilizer mistrim? Please explain your 
answer.
    Answer. The established procedure for responding to uncommanded 
stabilizer trim movement causing nose down mistrim is contained in the 
Runaway Stabilizer Non-Normal Checklist. This procedure does not direct 
pilots to use ``aft column travel'' to address the mistrim condition; 
rather, it directs pilots to hold the control column firmly, disengage 
the autopilot and autothrottle, and then control the pitch attitude of 
the aircraft manually using the control column or main electric trim, 
as needed. If the runaway continues, it directs pilots to disable 
electric trim by use of the aisle stand cutout switch. These steps are 
designed to assist the flight crew in controlling the flight path of 
the airplane.

    Question 4. Yes or no, does Boeing concur with the view that for 
approximately 60 years of service, across the 707, 727, 737 (except for 
the MAX), 747, 757 and 767 aircraft, column cutout switches have 
enabled pilots to quickly stop the runaway stabilizer movement using 
column motion only? Please explain your answer.
    Answer. For many Boeing models, the column cutout switch is one 
method that may address a runaway stabilizer movement. However, the 
memory item procedures contained in the Runaway Stabilizer Non-Normal 
Checklist, which flight crews are required to learn and memorize, do 
not include engaging the aft column cutout switch for either the 737 NG 
or the 737 MAX.

    Question 5. Yes or no, does Boeing concur with this statement:

        ``For every Boeing airplane until the 737 MAX, uncommanded 
        stabilizer runaway is stopped by column motion only. But for 
        the MAX, with MCAS malfunction, the pilot has to also apply 
        manual electric trim within the same three second window?''

    Please explain your answer.
    Answer. No. On all Boeing airplanes there are possible stabilizer 
failures where column motion alone may not arrest the failure. The 
procedure in the Flight Crew Operations Manual for arresting an 
uncommanded stabilizer runaway on the Boeing 737 NG, as well as the 
MAX, is the Runaway Stabilizer Non-Normal Checklist. That checklist 
directs pilots that steps beyond column motion alone may be required to 
arrest a runaway stabilizer.
    In addition, Boeing assumes the ``three second window'' described 
in the statement refers to FAA regulations, including FAA Circular 25-
7C (now Circular 25-7D), that allows manufacturers to assume, in 
certain types of testing, that flight crews will not react to a 
potential hazard for up to three seconds. That guidance relates to the 
time a manufacturer should assume will pass before the flight crew 
begins reacting to a hazard, not the time required to complete 
corrective action.

    Question 6. Yes or no, prior to the 737 MAX series aircraft, did 
the Speed Trim System bypass the aft column cutout switch on the 737 NG 
or any earlier versions of the 737 that included the Speed Trim System?
    Answer. The speed trim systems on the 737 NG and earlier versions 
of the 737 do not have the aft column cutout bypass feature. That 
feature was introduced with the MCAS function, and the speed trim 
systems on the 737 NG and earlier versions of the 737 airplane do not 
include the MCAS function.

    Question 7. On almost any other Boeing aircraft, it would be 
reasonable to expect a pilot to react instantly to uncommanded 
stabilizer trim motion in manual flight. However, as installed on the 
737 aircraft, the Speed Trim System has desensitized pilots to 
stabilizer trim motion in manual flight. In speaking with 737 pilots, a 
few confirmed that the feel and sound of the Speed Trim System moving 
the stabilizer is normal and something a 737 pilot would be accustomed 
to in manual flight.
    Given that the 737 aircraft appears to be the only Boeing aircraft 
where an augmentation system exists that results in stabilizer trim 
motion in manual flight, what analysis or evidence did Boeing rely on 
to justify its assumption that a 737 MAX pilot would instantly react to 
stabilizer trim motion in manual flight caused by MCAS activation?
    Answer. Automated flight controls that move flight surfaces during 
manual flight are not unique to the 737. For the 737, during manual 
flight, the assumption of pilot recognition is predicated on an 
increase in column forces or deviation from the intended flight path. 
FAA regulatory guidance, including Advisory Circular 75-7C, allows 
manufacturers to assume that a flight crew will seek to offload 
unexpected column forces.

    Question 8. On October 30, 2019, you publicly stated, ``The 
original concept from a safety standpoint was to build the MCAS, extend 
the current Speed Trim System of the previous generation of the 737, 
that's a system that had about 200 million safe flight hours on it.''
    For those 200 million safe flight hours on the Speed Trim System 
that you referenced, did the aft column cutout switch enable pilots to 
use column motion only to quickly stop the runaway stabilizer, prevent 
significant mistrim, and preserve sufficient elevator authority to 
restore the trim efficiently?
    Answer. As explained in response to question 5, on all Boeing 
airplanes there are possible stabilizer failures where column motion 
alone may not arrest the failure. Boeing's procedures for responding to 
a runaway stabilizer do not include engaging the aft column cutout 
switch.

    Question 9. One of Boeing's safety principles is to take safe 
systems, such as the Speed Trim System, and then incrementally extend 
them. Presumably, this was the concept behind Boeing's decision to add 
the MCAS flight control law to the existing Speed Trim System. However, 
it appears that MCAS did not represent an extension of the Speed Trim 
System, but rather, MCAS activation must, and does, disable a long-
standing safety function: the aft column cutout switch.
    Please explain whether the decision to add a new flight control law 
(MCAS) to the Speed Trim System that bypasses the aft column cutout 
switch is consistent with Boeing's concept of incrementally extending 
an existing safety system.
    Answer. In designing MCAS for the 737 MAX, the decision to bypass 
the aft column cutout switch was consistent with safe and sound design 
principles, and relied on well-established, industry-wide assumptions 
and long-standing FAA guidance. In addition, as previously explained, 
engaging the aft column cutout switch was not a part of the memory 
procedure for addressing a runaway stabilizer.

    Question 10. Yes or no, does Boeing concur that MCAS bypassing the 
aft column cutout switch undermined Boeing's assumptions that limited 
mistrim to 0.6 units and assumed sufficient elevator authority would 
always be preserved? Please explain your answer.
    Answer. No. MCAS's design has always included bypassing the aft 
column cutout switch. When MCAS's design was changed to include 
operation at lower speeds, Boeing subject matter experts--including 
both engineers and experienced pilots--conducted a targeted assessment 
of the potential hazards posed by MCAS's greater stabilizer authority 
at low speeds. In performing this assessment, Boeing's experts applied 
their engineering judgment and piloting experience to the existing 
safety analysis and data for the earlier MCAS design, and also 
considered new performance data generated through piloted simulator 
testing and computer analysis of MCAS's operation at low speeds. 
Boeing's subject matter experts concluded that the updated version of 
MCAS, which still included the aft column cutout switch bypass, met all 
applicable requirements.

    Question 11. Please identify the specific compensating safety 
features Boeing installed in response to MCAS activation bypassing the 
aft column cutout switch or confirm that Boeing did not develop a 
specific compensating safety feature to bypassing aft column cutout.
    Answer. On the 737 MAX, pilots had the ability to counteract the 
effects of MCAS through use of the control column and the electric trim 
switches, or to disable MCAS through use of the aisle stand cutout 
switches. As previously stated, the memory procedure appropriate for 
responding to a runaway stabilizer did not include engaging the aft 
column cutout switch.

    Question 12. Please explain how Boeing demonstrated that when the 
737 MAX MCAS flight control law is activated during manual flight, the 
MAX series aircraft complies with Section 25.255 of Title 14, Chapter 
I, Subchapter C, Part 25, Subpart B, of the Code of Federal Regulations 
(14 CFR Sec. 25.255: Out-of-trim characteristics), despite MCAS 
activation bypassing the aft column cutout switch and tripling the stab 
trim rate.
    Answer. MCAS moves the stabilizer at a rate based on the speed of 
the airplane. Its maximum stabilizer authority is 0.27 degrees/second. 
This rate is 35 percent greater than the rate at which the pilot can 
move the stabilizer using manual electric trim when flaps are up, and 
less than the rate that the pilot can move the stabilizer using manual 
electric trim when flaps are down.
    Title 14, Code of Federal Regulations, Section 25.255 defines 
acceptable maneuvering stability and dive recovery requirements for 
out-of-trim conditions. The magnitude of the out-of-trim condition is 
defined by a three second movement of the stabilizer at its normal no-
load rate. The 737 MAX meets the required characteristics with the 
mistrim that results from a three second movement of the stabilizer at 
the flaps up trim rate. Boeing also tested a magnitude of mistrim that 
was greater than would occur from a three second movement of the 
stabilizer at the flaps up trim rate and found that MCAS met all 
applicable regulatory requirements.

    Question 13. Please confirm that between October 29, 2018 and March 
10, 2019, Boeing conducted tests in a 737 MAX simulator to observe how 
a pilot--without knowledge of MCAS--responds when he or she realizes 
that Step One of the Runaway Stabilizer procedure (hold the control 
column firmly to counter the nose-down trim command of the horizontal 
stabilizer) does NOT automatically stop MCAS from repeated activations. 
If Boeing did not conduct such a test, please provide Boeing's 
justification for this course of action.
    Answer. In the relevant time frame, Boeing did conduct extensive 
testing of pilot response to repeated MCAS activation. If a pilot only 
maintains control of the flight path of the airplane through use of the 
control column to counter MCAS's nose-down trim, MCAS, as designed and 
installed on the MAX, will not activate multiple times. MCAS will only 
reactivate if the flight crew uses electric trim. Thus, the described 
condition was not tested because it was not a possible failure mode of 
the MCAS design.

    Question 14. Yes or no, does Boeing concur that because of the aft 
column cutout switch, a Boeing 737 NG pilot, following the Runaway 
Stabilizer Non-Normal procedure, would be accustomed to, and expect, 
column motion (and only column motion) to quickly stop an uncommanded 
runaway stabilizer trimming in opposition to the column motion and 
ensure the elevator remains effective? Please explain your answer.
    Answer. No. The Runaway Stabilizer Non-Normal Checklist for the 737 
NG directs pilots to hold the column steady, disengage the autopilot, 
and to control the airplane pitch attitude manually or, as needed, with 
the use of the trim switches on the control column; it does not direct 
flight crews to apply column force until the aft column cutout switch 
engages.

    Question 15. Several of Boeing's critical assumptions appear to be 
grounded in the expectation that because the Runaway Stabilizer Non-
Normal procedure is identical for both the 737 NG and 737 MAX, pilots 
flying the 737 MAX should have been prepared to respond to a flight 
condition caused by repeated MCAS activations resulting from a single 
erroneous AOA sensor input exactly as they would respond to a runaway 
stabilizer on the 737 NG. Yet, Boeing was clearly aware that on the 737 
MAX, MCAS activation bypasses the aft column cutout switch and triples 
the stab trim rate.
    Prior to JT610 and ET302, did Boeing inform 737 MAX pilots that the 
aft column cutout switch is bypassed in the 737 MAX and thus column 
alone will not always stop the uncommanded stabilizer trim movement?
    Answer. As noted in the response to Question 14, the aft column 
cutout switch is not identified in the memory procedure for uncommanded 
stabilizer motion. Consistent with the established regulatory process, 
the development of the training requirements and manuals for the MAX 
was a complex, multi-year effort that involved close coordination 
between Boeing and the FAA. Many items were considered for inclusion, 
including MCAS, and the content of the manuals and training evolved 
over time, as is common. Ultimately, relying on the professional 
judgment of those involved in this process, Boeing proposed, and the 
FAA agreed, not to include a description of MCAS in the final version 
of the Flight Crew Operations Manual for the MAX.

    Question 16. The Federal Aviation Administration's Emergency 
Airworthiness Directive (AD) 2018-23-51 issued on November 7, 2018, was 
intended to prevent a catastrophic crash resulting from repeated MCAS 
nose-down trim commands of the horizontal stabilizer caused by an 
erroneously high single angle of attack sensor input. However, 
publishing AD 2018-23-51 failed to prevent ET302.
    Following its publication, did any Boeing employee, or employee of 
a Boeing contractor, express concerns related to AD 2018-23-51?
    Answer. Boeing maintain an Employee Issue Tracking System, a 
single, common system for entering and tracking employee issues and 
complaints. Boeing has searched EITS and located no records indicating 
an employee or contractor raised concerns with AD 2018-23-51 to Boeing 
after it was issued.

    Question 17. How many occurrences of AoA malfunction (erroneous 
high angle reading) have occurred across Boeing aircraft models without 
significant incident prior to the JT610?
    Answer. Boeing's records indicate there have been 35 total events 
of erroneous Angle of Attack data and stick shaker across the Boeing 
fleet since 1998. Of those events, 26 occurred on 737 NGs. All 35 
flights resulted in continued safe flight and landing. There have been 
more than 220 million departures in that timeframe.

    Question 18. On ET302, MCAS was activated at a high airspeed that 
appears to be far above any airspeed that MCAS should trigger. Why did 
Boeing decide not to constrain MCAS authority to prevent it from 
triggering at high airspeeds significantly above any level where MCAS 
may be safely activated?
    Answer. MCAS was initially designed to give the 737 MAX specific 
handling qualities during certain high speed maneuvers, and thus was 
intended to be active at high airspeeds. Boeing does not intentionally 
engineer a system to change the handling characteristics of the 
airplane in unexpected or uncommon situations, as such a design would 
introduce significant safety risks.

    Question 19. Please describe in detail the flight condition where 
75 degrees is a valid angle of attack value.
    Answer. Boeing is unaware of any normal flight condition where a 
plane would have a 75 degree angle of attack. However, as Boeing 
detailed in our response to your May 17, 2019 letter, Boeing's air data 
inertial reference unit does not artificially limit the data from its 
sensors.

    Question 20. Please explain why Boeing failed to note that MCAS 
activation in manual, flaps up flight, bypasses the aft column cutout 
switch in the Boeing Multi-Operator Message (MOM-MOM-18-0664-01B) sent 
in November 2018.
    Answer. Boeing's Multi-Operator Message is consistent with the 
procedures described in the Runaway Stabilizer Non-Normal Checklist. 
These Checklist procedures are also discussed at length in Boeing's 
Operations Manual Bulletin and the FAA's Airworthiness Directive issued 
after the Lion Air accident. These are the appropriate procedures to 
respond to erroneous uncommanded stabilizer trim movement (including 
erroneous MCAS activation), and they do not include engaging the aft 
column cutout switch.

    Question 21. Please explain why Boeing failed to note that the 
flight crew must use column trim switch or stabilizer aisle stand 
cutout switches to override MCAS input, and instead used the following 
more passive terminology: ``The system is designed to allow [emphasis 
added] the flight crew to use column trim switch or stabilizer aisle 
stand cutout switches to override MCAS input?''
    Answer. As noted in response to the previous question, Boeing's 
Multi-Operator Message was consistent with the procedures in the 
Runaway Stabilizer Non-Normal Checklist. In addition, it would have 
been incorrect to state that use of the column trim switch or aisle 
stand cutout switch is required to override MCAS input. Because MCAS 
input can be overridden solely by use of the control column in some 
circumstances, use of the electric trim or aisle stand cutout switches 
may not be necessary to override MCAS in those circumstances.

    Question 22. Please share with the Committee any Boeing 
communications sent after JT610 emphasizing the critical importance of 
using manual electric trim to oppose MCAS because aft column cutout 
switch is bypassed.
    Answer. Please see the response to question 20.

    Question 23. Following JT610 and prior to ET302, why did Boeing 
fail to immediately disable MCAS?
    Answer. The MCAS software is an integrated part of the flight 
control system for the MAX as certified by the FAA and cannot be 
``disabled'' per se. Following JT610, Boeing worked with the FAA to 
establish a plan to revise the MCAS software to eliminate the risk of 
erroneous AOA data leading to repeated MCAS activation.
    On November 6, 2018, a Boeing Safety Review Board (``SRB'')--
Boeing's established process for evaluating in-service safety issues--
determined that the crew workload effects of erroneous AOA input 
leading to activation of the MCAS function presented a safety issue, 
and also determined that appropriate pilot action could counteract the 
condition. That same day, Boeing issued an Operations Manual Bulletin 
(``OMB'') to the fleet calling attention to the airplane effects and 
flight deck indications of the condition, and directing flight crews to 
existing procedures to address it. Boeing also moved forward 
expeditiously to develop an update to the MAX's flight control computer 
software to eliminate the risk of erroneous AOA data leading to 
repeated MCAS activation.
    On November 7, 2018, a day after Boeing issued its OMB, the FAA 
issued an Emergency Airworthiness Directive (``AD'') requiring airlines 
to amend their Airplane Flight Manuals to include the OMB guidance. The 
FAA also convened multiple Corrective Action Review Board (``CARB'') 
meetings--the FAA's analog to Boeing's SRB process--starting in late 
November to evaluate issues relating to the airplane effects of 
erroneous AOA data and MCAS activation. Relying on the FAA's 
independent risk analysis, the CARB process largely concurred with 
Boeing's analysis of the safety issue and proposed risk mitigation 
approach. Referencing the FAA's independent risk analysis, an FAA CARB 
concluded in December 2018 that, as development of the software update 
proceeded, the MAX fleet could continue operating until the new 
software was implemented on the FAA-approved schedule.

    Question 24. Following JT610 and prior ET302, why did Boeing fail 
to immediately seek to fix MCAS based on a HAZARDOUS malfunction?
    Answer. As described above in response to Question 23, following 
the crash of JT610, Boeing immediately followed its safety process to 
determine the appropriate response. As a result of that process, Boeing 
took steps in conjunction with the FAA to develop and implement a 
software update to the flight control computer in order to eliminate 
the risk of erroneous AOA data leading to repeated MCAS activation. The 
FAA determined that Boeing should implement the software update more 
quickly than Boeing originally proposed, and Boeing accepted the FAA's 
schedule.

    Question 25. Given the centrality of the Speed Trim System to these 
matters, please address the following questions:

   Yes or no, is the implementation of the Speed Trim System on 
        the Boeing 757 fail-safe, dual-input and dual-processor design 
        with aft column cutout switch active?

   Yes or no, is the implementation of the Speed Trim System on 
        the Boeing 747-400 fail-safe, dual-input and dual-processor 
        design with aft column cutout switch active?

   Yes or no, is the implementation of the Speed Trim System on 
        the Boeing 737-700 fail-safe, dual-input and dual processor 
        design with aft column cutout switch active?

   If the answer to any of the above three questions is ``no,'' 
        please provide a detailed explanation.

    Answer. The Speed Trim System as currently implemented on all the 
listed models meets all regulatory requirements, and ensures any single 
failure of the system does not affect the ability of the aircraft to 
maintain safe flight and landing. The design for each model is dual-
processor, but it is not dual-input. The aft column cutout switch is 
active in each design, though the amount of movement required to 
activate it varies between models.

    Question 26. Yes or no, even though the 737 Speed Trim System is a 
single threaded design augmentation system that has full control of the 
stabilizer, does the 737 Speed Trim System survive without greater 
hazard classification because active aft and forward column cutout 
switches constrain malfunction?
    Answer. Hazard classifications are applied to particular failure 
modes of a system, not the system itself. There are failure modes of 
the Speed Trim System (STS), such as a stabilizer runaway driven by the 
flight control computer, which can be mitigated by the column cutout 
switches. However, other failure modes of the STS do not rely on those 
switches for mitigation. The classification of each hazard depends on 
the specific circumstances of that failure. None of the hazard 
assessments for MCAS relied on engaging the aft column cutout switch.

    Question 27. One of your primary competitors appears to require 
testing the angle of attack sensor reading at 80 to 100 knots in the 
takeoff roll when the relative wind reliably aligns the vane to the 
expected angle of incidence. Will Boeing upgrade Flight Crew Operating 
Manuals to require such a test during the takeoff roll?
    Answer. No. Boeing airplanes already electronically conduct similar 
checks. The results of those checks are captured and documented to 
ensure they are addressed by maintenance personnel. With the upgrades 
to MCAS that will be implemented as part of return to service, if the 
two AOA vanes on the 737 MAX disagree by more than 5.5 degrees, MCAS 
will be disabled for the remainder of the flight and pilots will be 
alerted that speed trim is inoperative. Boeing is continually working 
to develop ways to increase safety during all phases of flight, 
including takeoff.

    Question 28. On May 17, 2019, I submitted the follow oversight 
question to the Boeing Company:

        ``On what date did Boeing first provide the Flight 
        Standardization Board (FSB) with information on the addition of 
        the Maneuvering Characteristics Augmentation System (MCAS) 
        flight control law to the 737 MAX series aircraft to comply 
        with Federal Regulation 25.203--Stall characteristics, 
        paragraph (a)?''

    Boeing provided the following response:

        ``Boeing briefed FAA personnel involved in the FSB process for 
        the 737 MAX about MCAS at least as early as 2012. In the spring 
        of 2014, Boeing and the FAA began more formal discussions about 
        how the FSB process for the 737 MAX would proceed. During this 
        time, Boeing provided the FAA technical briefings on MCAS among 
        other aspects of the evolving airplane design. Following the 
        process set forth in FAA guidance, in February 2015 Boeing 
        submitted a preliminary draft of the Master Differences 
        Requirements and Design Operator Differences Requirements (ODR) 
        tables to the FAA for evaluation. Boeing included MCAS as one 
        of dozens of airplane features in the draft ODR table.''

    I also posed this question to Boeing:

        ``Please confirm whether Boeing ever recommended that the FSB 
        evaluate the differences between the Speed Trim System (STS) in 
        the 737 NG series and the STS in 737 MAX series that also has 
        MCAS installed, and if so, the earliest date upon which Boeing 
        advised the FSB to evaluate MCAS when conducting the 
        differences assessment.''

    Boeing provided the following response:

        ``As explained in the response to Question #1, Boeing briefed 
        FAA personnel involved in the FSB process about MCAS at least 
        as early as 2012. MCAS is an extension of the pre-existing 
        Speed Trim function, which helps stabilize airplane speed by 
        commanding stabilizer in the direction to oppose a speed 
        change, and which has been used safely on 737 series airplanes 
        for decades. Following a series of technical briefings on MCAS 
        and other airplane features in 2014, in February 2015 Boeing 
        submitted a preliminary draft of the Master Differences 
        Requirements and Design Operator Differences Requirements (ODR) 
        tables to the FAA for evaluation. Boeing included MCAS as one 
        of dozens of airplane features in the draft ODR table. 
        Ultimately, the versions of the FSB report that the FAA posted 
        for public comment and finalized in 2017 did not include MCAS 
        in the ODR table.''

    Please explain why Boeing chose not to use either response as an 
opportunity to share with my office the fact that Boeing proposed 
removing MCAS from the ODR table.
    Answer. As we stated in response to Question No. 1 on May 17, 2019, 
MCAS was included in the preliminary procedures and ODR tables that 
were sent to the FAA in February 2015. Boeing recommended removal of 
MCAS from the ODR Table in March 2016 and FAA agreed with Boeing's 
recommendation. Boeing exchanged multiple drafts of the ODR Table with 
the FAA throughout 2016 and 2017 and the versions of the FSB report 
that the FAA posted for public comment and finalized in 2017 did not 
include MCAS in the ODR Table.

    Question 29. Beyond MCAS, what other issues related to aircraft 
systems worry you and require improvement? For example, is Boeing 
planning to make the Speed Trim System fail-safe on the 737 NG?
    Answer. Boeing is continually evaluating the performance of its 
aircraft. As part of that process, Boeing identifies appropriate 
enhancements to those aircraft, and will continue to do so. The Speed 
Trim System as currently implemented meets all regulatory requirements, 
and any single failure of the system does not affect the ability of the 
aircraft to maintain safe flight and landing.
                                 ______
                                 
   Response to Written Questions Submitted by Hon. Kyrsten Sinema to 
                           Dennis Muilenburg
    The Boeing 737 Max 8 received a derivative type certificate from 
the FAA, which was based on the original type certificate the Boeing 
737-100 from 1967.
    The original 737-100 was a very different aircraft. It was 94 feet 
long, carried 115 passengers, required three pilots, and had a maximum 
takeoff weight of 42,000 kilograms. The current versions of the 737 MAX 
can be up to 50 percent longer, carry twice as many passengers, and 
have double the maximum takeoff weight.
    The FAA states that getting an amended type certificate can take up 
to 5 years, but a new type certificate, which is a more detailed 
analysis, can take up to 9 years.

    Question 1. Based on the significant changes in the aircraft since 
1967, do you believe that an amended type certificate was appropriate 
for the Boeing 737 Max 8? And going forward, do you believe FAA should 
limit the number of times an aircraft design can be amended before a 
new type certificate is required?
    Answer. An amended type certificate was appropriate for the Boeing 
737 MAX 8. Building upon existing, safe designs with a proven track 
record has continuously improved the safety record of the aviation 
industry for decades. As with all airplane development decisions, we 
make such decisions deliberately and methodically, after studying the 
current state of technology and opportunities for improving the 
existing airplane architecture, among many other factors.
    The FAA has robust regulations and processes for evaluating when an 
airplane should be a new or amended type certificate and what 
regulations to follow for each process. The MAX certification project 
followed these regulations. Setting an arbitrary limit on the number or 
timing of changes to an airplane does not advance the interest of 
safety.
    The United States has the best airline pilots in the world, and I 
believe the quality of our pilots is the reason that U.S. commercial 
aviation is the safest in the world.
    But all pilots, regardless of experience or nationality, need all 
the information about the aircraft to be able to make the right 
decisions.
    Boeing pilot manuals did not reference MCAS or describe an 
autonomous system to repeatedly lower the nose by 2.5 degrees. But 
Boeing's safety analysis expected pilots to be the primary backup for 
the system, if it failed. The pilots cannot be the backup for a system, 
if they aren't informed that the system exists, and it operates in the 
background without their knowledge.

    Question 2. Please explain Boeing's decision not to include MCAS in 
the pilot manual or pilot training, and discuss Boeing's future plans 
to fully inform pilots about background systems.
    Answer. In accordance with FAA regulatory guidance, flight training 
for all Boeing airplanes, including the 737 MAX, is designed to give 
pilots the knowledge, skills, and abilities necessary to safely operate 
each model on which they are licensed (or ``type-rated''). Rather than 
diagnose particular failures, flight training and manuals are designed 
to give pilots the knowledge, skills, and abilities necessary to safety 
respond to those failures.
    Boeing and the FAA coordinated closely over the course of several 
years in developing the necessary training requirements and flight 
manual content for the MAX. Since the accidents, the FAA and Boeing 
have worked together to develop additional MAX flight crew training, as 
well as flight manual content, that addresses the updates Boeing has 
made to MCAS. The inclusion of specific training and flight manual 
content on MCAS is consistent with the feedback Boeing has received 
from pilots and its customers, and reflects the additional knowledge 
and understanding that Boeing has gained as a result of these 
accidents.
    In designing aircraft, redundancy is key. The FAA requires aircraft 
systems that can cause hazardous or catastrophic failure to incorporate 
multiple levels of redundancy. This way, if FAA requirements are met, 
no single malfunction can lead to tragedy.
    However, the MCAS system on the Boeing 737 Max 8 had zero 
redundancy. A single faulty or damaged angle-of-attack sensor could 
cause the MCAS system to engage repeatedly, as was the case for the 
tragedies in Indonesia and Ethiopia.
    These disclosures are leading many to consider revisions to the 
FAA's Organization Designation Authorization (ODA) program. As you 
know, the FAA uses the ODA program to authorize organizations or 
companies to approve certain aspects of FAA aircraft certification.
    The DOT Special Committee is making recommendations on FAA 
certification, but I expect that Boeing has undertaken its own internal 
review of ODA and the necessary changes.

    Question 3. Based on the Boeing 737 Max 8 tragedies, what concrete 
revisions to the ODA program are required to ensure that only safe 
aircraft are certified to fly?
    Answer. Boeing strongly supports robust FAA oversight of the 
certification process. As the last major commercial airplane 
manufacturer in the United States, Boeing believes the certification 
process, and the FAA's role in that process, are vital to the safety of 
the traveling public, and have been an important factor driving 
substantial improvements in aviation safety in recent decades.
    The Organization Delegation Authority process has helped improve 
that safety record. However, there are ways to improve that process. 
For example, the FAA's System Oversight capability could be 
strengthened by setting clear expectations for applicants' processes 
and procedures to ensure compliance for lower risk areas, as identified 
by the FAA. This would allow FAA to dedicate the majority of its 
resources on areas the FAA has determined to be the highest safety 
risk. Boeing will work with all interested stakeholders to learn from 
these accidents and further increase aviation safety.
    During flight testing, Boeing increased the MCAS system from 
providing a 0.6 degree nose-down correction to a 2.5 degree nose-down 
correction--without FAA oversight.
    And according to reports, once MCAS was adjusted to provide a more 
powerful input, Boeing never flight-tested a scenario in which a broken 
angle-of-attack sensor triggered MCAS on its own, instead relying on 
simulator analysis.
    Former Boeing test pilots described a culture of pressure inside 
the company to limit flight testing, due to project delays. And in the 
text messages Boeing released last week, an employee stated: ``they're 
all so damn busy, and getting pressure from the program.''

    Question 4. Was there adequate flight testing of the revised MCAS 
system, and what will Boeing do to address schedule pressure to get 
aircraft certificated?
    The first tragic crash, involving Lion Air Flight 610, occurred on 
October 29, 2018. The second crash, involving Ethiopian Airlines Flight 
302, occurred five months later.
    Answer. The final MCAS design, including MCAS's operation at low 
speeds, was tested in flight tests, where multiple conditions involving 
the design were tested.
    Boeing has taken a number of steps to reinforce our safety culture. 
These include creating a permanent Aerospace Safety Committee within 
our Board of Directors, creating a Product and Services Safety 
organization to review all aspects of product safety, and realigning 
our Engineering function so that all engineers will report directly to 
the Chief Engineer. Moreover, pursuant to our Organization Delegation 
Authority, Boeing maintains robust procedures for ODA unit members to 
report incidents of undue pressure, and Boeing provides all employees 
multiple avenues to raise safety issues related to our products.

    Question 5. Why was the Boeing Max 8 not grounded after the Lion 
Air crash and prior to the second crash in Ethiopia? What information 
regarding the MCAS system did Boeing have prior to or immediately after 
the first crash that lead to concerns related to the Angle of Attack 
and MCAS system?
    Answer. Boeing does not have the authority to ground airplanes. 
Boeing does, however, provide civil aviation authorities and our 
airline customers with any relevant information we may receive or 
develop, so that they can make informed decisions on how to regulate 
aircraft operations.
    After the Lion Air crash, on Sunday, November 4, Indonesian 
authorities provided Boeing with data downloaded from the airplane's 
flight data recorder. That same day, Boeing convened an ``out-of-
sequence'' Safety Review Board (``SRB'') to consider and analyze the 
available data. The SRB included subject matter experts from various 
backgrounds, including senior Boeing engineers, test pilots, and 
executives responsible for safety and regulatory matters. FAA 
representatives were also in attendance. After considering the limited 
information available, the SRB decided to defer a decision on the 
potential safety issue for two days to allow time for Boeing engineers 
and pilots to conduct further testing and analysis.
    The SRB, with most of the same members present, reconvened on 
November 6, 2018. The FAA was again in attendance. With the fuller 
information then available, including additional analysis by Boeing's 
technical experts and test pilot input, the SRB identified as a safety 
issue the increased crew workload that might result if erroneous AOA 
input led to repeated MCAS activation. Although a full quantitative 
analysis of the issue had not yet been completed, the SRB made this 
determination based on a preliminary risk assessment and in recognition 
of the importance of immediately addressing the concerns identified. 
The SRB further noted the importance of appropriate action by the 
flight crew to prevent and counteract repeated MCAS activation in this 
erroneous AOA scenario.
    That same day, Boeing issued an Operations Manual Bulletin 
(``OMB'') to the fleet calling attention to the airplane effects and 
flight deck indications of the condition, and directing flight crews to 
existing procedures to address it. Boeing also moved forward 
expeditiously to develop an update to the MAX's flight control computer 
software to eliminate the risk of erroneous AOA data leading to 
repeated MCAS activation.
    On November 7, 2018, a day after Boeing issued its OMB, the FAA 
issued an Emergency Airworthiness Directive (``AD'') requiring airlines 
to amend their Airplane Flight Manuals to include the OMB guidance. The 
FAA also convened multiple Corrective Action Review Board (``CARB'') 
meetings--the FAA's analog to Boeing's SRB process--starting in late 
November to evaluate issues relating to the airplane effects of 
erroneous AOA data and MCAS activation. Relying on the FAA's 
independent risk analysis, the CARB process largely concurred with 
Boeing's analysis of the safety issue and proposed risk mitigation 
approach--although the FAA did determine that that Boeing should 
implement the flight control computer software update more quickly than 
Boeing had originally proposed, an accelerated schedule the Company 
accepted. Re Referencing the FAA's independent risk analysis, an FAA 
CARB concluded in December 2018 that, as development of the software 
update proceeded, the MAX fleet could continue operating until the new 
software was implemented on the FAA-approved schedule.

    Question 6. And why did Boeing publish a supplementary service 
bulletin regarding the Angle of Attack sensors and MCAS, but did not 
take the aircraft out of service?
    Answer. Please see the response to the previous question. Boeing 
does not have the authority to ground airplanes. After the Lion Air 
accident and continuing to today, Boeing provides civil aviation 
authorities and our airline customers any relevant information we may 
receive or develop, so that they can make informed decisions on how to 
regulate aircraft operations.

    Question 7. Do you disagree with any of the findings in the 
National Transportation Safety Board in Aviation Safety Recommendation 
Report ASR-19-01 issued on September 19, 2019 titled ``Assumptions Used 
in the Safety Assessment Process and the Effects of Multiple Alerts and 
Indications on Pilot Performance'' or audit report AV-2016-013 the 
Inspector General of the Department of Transportation issued on January 
7, 2016 titled ``Enhanced FAA Oversight Could Reduce Hazards Associated 
With Increased Use of Flight Deck Automation?''
    Answer. Boeing is deeply committed to the safety of its products 
and the safety of the aviation system and values the role of the 
National Transportation Safety Board (NTSB), as well as the reviews of 
the Office of the Inspector General (OIG), in promoting aviation 
safety.
    Boeing has already undertaken steps that align with at least one of 
the NTSB's recommendations. The NTSB recommended that FAA require 
manufacturers to consider the way cockpit design can impact pilot 
reaction to alerts and alarms that may sound in non-normal situations. 
As a result of a recommendation from a special committee of Boeing's 
Board of Directors, the company is already planning to work with our 
airline customers to re-examine the way we design our cockpits, with 
the goal of helping pilots to prioritize their attention and their 
actions when faced with multiple alerts and alarms. Boeing is taking 
this step with the recognition that pilot training and experience can 
vary significantly in different regions of the world. Boeing will 
continue to work with the NTSB, as well as the FAA, to understand the 
scope of the NTSB's recommendations and the appropriate way to 
implement them.
    Boeing will also support the FAA as it implements the 
recommendations from the OIG audit report from January 7, 2016. This 
report recommends that the FAA develop new guidance for training and 
standards to determine whether pilots receive sufficient training 
opportunities to develop, maintain, and demonstrate manual flying 
skills. Boeing continues to support the FAA's Air Carrier Training 
Aviation Rulemaking Committee to discuss, prioritize, and provide 
recommendations to the FAA concerning these types of operations and 
training considerations.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. John Thune to 
                       Hon. Robert L. Sumwalt III
    Question 1. Your testimony mentioned the inadequacy of the MCAS 
safety assessment in estimating the crew workload, since it is likely 
other alerts and indications would be activated simultaneously in the 
event of an MCAS failure.
    The National Transportation Safety Board (NTSB) recommended that 
the Federal Aviation Administration (FAA) instruct Boeing to better 
consider crew workload in the event of a system failure, including 
through the development of tools to improve the timeliness and 
effectiveness of crew responses.
    Do you believe that any of the recent organizational changes made 
by Boeing will help address this recommendation?
    Answer. The NTSB has not evaluated the recent organizational 
changes made by Boeing.

    Question 2. As you know, the aviation system is safer--and 
catastrophic incidents rarer--than ever before, but the complexity of 
aircraft flight control systems means that when failures do occur, it 
can be difficult for crew members to prioritize the appropriate and 
timely actions in response to that failure.
    How could system failure diagnostic tools be better designed to 
improve the threat and error management used by crew members in 
responding to system failures?
    Answer. The NTSB believes that aircraft systems designed to clearly 
and concisely inform pilots of the highest priority actions when 
multiple flight deck alerts and indications are present would minimize 
confusion and help pilots respond most effectively to emergency and 
abnormal operational events. By developing design standards for such 
system diagnostic tools, with the input of industry and human factors 
experts, we believe the timeliness and effectiveness of pilot response 
would be improved.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Tom Udall to 
                       Hon. Robert L. Sumwalt III
    Question 1. The NTSB recommended that manufacturers use ``less 
experienced'' pilots to test advanced equipment. Are you aware of any 
resistance to this recommendation?
    The NTSB concluded that a standardized methodology and/or tools for 
manufacturers' use in evaluating and validating assumptions about pilot 
recognition and response to failure condition(s), particularly those 
conditions that result in multiple flight deck alerts and indications 
is needed. Based on this, the NTSB recommended that the FAA develop 
robust tools and methods, with the input of industry and human factors 
experts, for use in validating assumptions about pilot recognition and 
response to safety-significant failure conditions as part of the design 
certification process. We are not aware of any resistance to 
implementation of this recommendation.

    Question 2. The Boeing 737 made its first flight in 1967 and has 
applied for 14 model changes since that time. There have been calls for 
a complete recertification of the entire 737. Do you agree that the 
entire plane should be recertified?
    The NTSB does not have a position on this.
                                 ______
                                 
   Response to Written Question Submitted by Hon. Tammy Duckworth to 
                       Hon. Robert l. Sumwalt III
    As you are aware, problems originating with a damaged or 
malfunctioning angle of attack (AOA) sensor are not limited to any 
single model of aircraft or manufacturer. Enhancing AOA sensors must be 
a priority for the entire aviation industry and regulatory system. 
Increasing awareness and improving knowledge represent critical tools 
in improving aviation safety.
    That is why I wrote to then-Acting Administrator Elwell on May 21, 
2019 to request that FAA publish a comprehensive advisory circular that 
standardizes guidance on best practices for manufacturing, operating, 
testing and maintaining AOA sensors, particularly the AOA wind vane 
component, to ensure effective compliance with all applicable 
regulatory requirements.
    Following the FAA's order revoking a repair station certificate 
from a firm that repaired and supplied the malfunctioning AOA sensor 
that contributed to the fatal crash of Lion Air Flight 610, I once 
again wrote to FAA Administrator Dickson to request that FAA publish a 
comprehensive advisory circular that standardizes guidance on best 
practices for manufacturing, operating, testing and maintaining AOA 
sensors, particularly the AOA wind vane component, to ensure effective 
compliance with all applicable regulatory requirements.
    Awareness and knowledge are critical tools in strengthening 
aviation safety.
    Question. Please address how the potential publication of the type 
of comprehensive advisory circular that I have requested would improve 
aviation safety.

        The NTSB has not issued any recommendations regarding design, 
        manufacturing, operating, testing or maintaining of AOA sensors 
        and therefore does not have a position on this matter.

        However, the Komite Nasional Keselamatan Transportasi (KNKT) of 
        Indonesia has issued one related recommendation based on its 
        investigation of the Lion Air 610 crash.\1\
---------------------------------------------------------------------------
    \1\ Komite Nasional Keselamatan Transportasi (KNKT), Final Report 
No. KNKT.18.10.35.04.

                04.R-2018-35.22
                The absence of equivalency assessment required by Xtra 
                Aerospace procedure and unavailability of procedure was 
                not detected by the FAA. This indicated inadequacy of 
                the FAA oversight.

                Therefore, KNKT recommends that the FAA improves the 
                oversight to Approved Maintenance Organization (AMO) to 
                ensure the processes within the AMO are conducted in 
                accordance with the requirements.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Tom Udall to 
                        Hon. Christopher A. Hart
    Question 1. Chairman Hart, in the JATR report, there was discussion 
of the undue pressure placed on employees at Boeing to pressure to 
employees get the plane certified without any new pilot training or 
delay. Boeing has said it is restructuring its units, and safety 
engineers will no longer be required to report directly to a business 
unit manager. Do you believe this change will relieve some pressure on 
employees?
    Answer. Because of concerns about potential undue influence, the 
JATR recommended that the FAA review its certification process, as well 
as Boeing's Organization Designation Authorization (ODA) procedures and 
work environment, to ensure that there is no undue pressure (e.g., 
Recommendation 5). Whether a specific substantive change will be 
helpful is beyond the purview of the JATR because it completed its 
review when it submitted its recommendations to the FAA, and it was 
chartered to review the certification process rather than specific 
substantive changes. I am not in a position to opine about the 
effectiveness of specific proposed substantive changes.

    Question 2. Are there other changes that Boeing should make?
    Answer. The JATR's recommendations were addressed to the FAA, not 
to Boeing, and were about how the FAA could improve its certification 
process. Although the JATR's improvement recommendations included 
recommendations to the FAA to review Boeing's processes and procedures, 
the JATR was chartered to review the certification process rather than 
specific substantive changes. Examples of Boeing's processes and 
procedures that the JATR recommended the FAA should review include Rec 
5 (ODA work environment and procedures manual), Rec 8.1 (development 
assurance process), Rec 8.2 (safety analysis process), Rec 8.4 (process 
for managing assumptions), and Rec 8.6 (process for managing 
requirements).

    Question 3. How can we ensure that pilots are fully prepared for 
the high-levels of automation in today's cockpits?
    Answer. The JATR's recommendations address two aspects of helping 
to optimize airplane/pilot interactions. First, the recommendations 
address ways that the certification process can help ensure that 
aircraft systems are designed to be adequately pilot-friendly, e.g., 
Rec 2.2, Rec 2.4, Rec 2.7, Rec 2.8, Rec 2.9, Rec 3.8, Rec 3.16, Rec 
3.17, Rec 6.1, Rec 6.2, Rec 6.3, Rec 6.4, Rec 6.6, Rec 6.8, Rec 6.9, 
Rec 6.10, Rec 7.1, Rec 7.2, Rec 8.8, Rec 9.6, and Rec 9.7. Second, the 
recommendations address ways that the certification process can help 
ensure that, upon completion of the design, pilots are aware of, and 
adequately trained regarding, the aircraft automation and other 
systems, e.g., Rec 3.9, Rec 3.11, Rec 3.14, Rec 9.1, Rec 9.2, Rec 9.3, 
Rec 9.4, Rec 10.2, Rec 10.3, Rec 10.4, Rec 10.5, and Rec 12.2.

                              [all]