[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]
STATUS OF THE BOEING 737 MAX
=======================================================================
(116-15)
HEARING
BEFORE THE
SUBCOMMITTEE ON
AVIATION
OF THE
COMMITTEE ON
TRANSPORTATION AND INFRASTRUCTURE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
MAY 15, 2019
__________
Printed for the use of the
Committee on Transportation and Infrastructure
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available online at: https://www.govinfo.gov/committee/house-
transportation?path=/browsecommittee/chamber/house/committee/
transportation
______
U.S. GOVERNMENT PUBLISHING OFFICE
37-277 PDF WASHINGTON : 2019
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
PETER A. DeFAZIO, Oregon, Chair
ELEANOR HOLMES NORTON, SAM GRAVES, Missouri
District of Columbia DON YOUNG, Alaska
EDDIE BERNICE JOHNSON, Texas ERIC A. ``RICK'' CRAWFORD,
ELIJAH E. CUMMINGS, Maryland Arkansas
RICK LARSEN, Washington BOB GIBBS, Ohio
GRACE F. NAPOLITANO, California DANIEL WEBSTER, Florida
DANIEL LIPINSKI, Illinois THOMAS MASSIE, Kentucky
STEVE COHEN, Tennessee MARK MEADOWS, North Carolina
ALBIO SIRES, New Jersey SCOTT PERRY, Pennsylvania
JOHN GARAMENDI, California RODNEY DAVIS, Illinois
HENRY C. ``HANK'' JOHNSON, Jr., ROB WOODALL, Georgia
Georgia JOHN KATKO, New York
ANDRE CARSON, Indiana BRIAN BABIN, Texas
DINA TITUS, Nevada GARRET GRAVES, Louisiana
SEAN PATRICK MALONEY, New York DAVID ROUZER, North Carolina
JARED HUFFMAN, California MIKE BOST, Illinois
JULIA BROWNLEY, California RANDY K. WEBER, Sr., Texas
FREDERICA S. WILSON, Florida DOUG LaMALFA, California
DONALD M. PAYNE, Jr., New Jersey BRUCE WESTERMAN, Arkansas
ALAN S. LOWENTHAL, California LLOYD SMUCKER, Pennsylvania
MARK DeSAULNIER, California PAUL MITCHELL, Michigan
STACEY E. PLASKETT, Virgin Islands BRIAN J. MAST, Florida
STEPHEN F. LYNCH, Massachusetts MIKE GALLAGHER, Wisconsin
SALUD O. CARBAJAL, California, Vice GARY J. PALMER, Alabama
Chair BRIAN K. FITZPATRICK, Pennsylvania
ANTHONY G. BROWN, Maryland JENNIFFER GONZALEZ-COLON,
ADRIANO ESPAILLAT, New York Puerto Rico
TOM MALINOWSKI, New Jersey TROY BALDERSON, Ohio
GREG STANTON, Arizona ROSS SPANO, Florida
DEBBIE MUCARSEL-POWELL, Florida PETE STAUBER, Minnesota
LIZZIE FLETCHER, Texas CAROL D. MILLER, West Virginia
COLIN Z. ALLRED, Texas GREG PENCE, Indiana
SHARICE DAVIDS, Kansas
ABBY FINKENAUER, Iowa
JESUS G. ``CHUY'' GARCIA, Illinois
ANTONIO DELGADO, New York
CHRIS PAPPAS, New Hampshire
ANGIE CRAIG, Minnesota
HARLEY ROUDA, California
(ii)
Subcommittee on Aviation
RICK LARSEN, Washington, Chair
ANDRE CARSON, Indiana GARRET GRAVES, Louisiana
STACEY E. PLASKETT, Virgin Islands DON YOUNG, Alaska
STEPHEN F. LYNCH, Massachusetts DANIEL WEBSTER, Florida
ELEANOR HOLMES NORTON, THOMAS MASSIE, Kentucky
District of Columbia SCOTT PERRY, Pennsylvania
DANIEL LIPINSKI, Illinois ROB WOODALL, Georgia
STEVE COHEN, Tennessee JOHN KATKO, New York
HENRY C. ``HANK'' JOHNSON, Jr., DAVID ROUZER, North Carolina
Georgia LLOYD SMUCKER, Pennsylvania
DINA TITUS, Nevada PAUL MITCHELL, Michigan
JULIA BROWNLEY, California BRIAN J. MAST, Florida
ANTHONY G. BROWN, Maryland MIKE GALLAGHER, Wisconsin
GREG STANTON, Arizona BRIAN K. FITZPATRICK, Pennsylvania
COLIN Z. ALLRED, Texas TROY BALDERSON, Ohio
JESUS G. ``CHUY'' GARCIA, Illinois ROSS SPANO, Florida
EDDIE BERNICE JOHNSON, Texas PETE STAUBER, Minnesota
SEAN PATRICK MALONEY, New York SAM GRAVES, Missouri (Ex Officio)
DONALD M. PAYNE, Jr., New Jersey
SHARICE DAVIDS, Kansas, Vice Chair
ANGIE CRAIG, Minnesota
GRACE F. NAPOLITANO, California
SALUD O. CARBAJAL, California
PETER A. DeFAZIO, Oregon (Ex
Officio)
(iii)
CONTENTS
Page
Summary of Subject Matter........................................ vii
STATEMENTS OF MEMBERS OF CONGRESS
Hon. Rick Larsen, a Representative in Congress from the State of
Washington, and Chair, Subcommittee on Aviation:
Opening statement............................................ 1
Prepared statement........................................... 3
Hon. Sam Graves, a Representative in Congress from the State of
Missouri, and Ranking Member, Committee on Transportation and
Infrastructure:
Opening statement............................................ 4
Prepared statement........................................... 6
Hon. Peter A. DeFazio, a Representative in Congress from the
State of Oregon, and Chair, Committee on Transportation and
Infrastructure:
Opening statement............................................ 7
Prepared statement........................................... 9
Hon. Garret Graves, a Representative in Congress from the State
of Louisiana, and Ranking Member, Subcommittee on Aviation:
Opening statement............................................ 11
Prepared statement........................................... 12
Hon. Pramila Jayapal, a Representative in Congress from the State
of Washington, prepared statement.............................. 69
WITNESSES
Hon. Robert L. Sumwalt III, Chairman, National Transportation
Safety Board; accompanied by Dana Schulze, Acting Director,
Office of Aviation Safety, National Transportation Safety
Board:
Oral statement............................................... 13
Prepared statement........................................... 15
Daniel K. Elwell, Acting Administrator, Federal Aviation
Administration; accompanied by Earl Lawrence, Executive
Director of Aircraft Certification, Federal Aviation
Administration:
Oral statement............................................... 19
Prepared statement........................................... 21
SUBMISSIONS FOR THE RECORD
Post-hearing responses from the Federal Aviation Administration
to requests for information from Hon. Brownley
Statement of Nadia Milleron and Michael Stumo, submitted for the
record by Hon. Garcia.......................................... 60
Photos submitted for the record by Hon. Larsen................... 71
Two letters from Sara Nelson, International President,
Association of Flight Attendants--CWA, AFL-CIO, submitted for
the record by Hon. DeFazio:
Letter of March 11, 2019, to Dan Elwell, Acting
Administrator, Federal Aviation Administration............. 77
Letter of May 14, 2019, to Hon. DeFazio...................... 78
APPENDIX
Responses from Hon. Robert L. Sumwalt III, Chairman, National
Transportation Safety Board, to questions for the record from
Hon. Henry C. ``Hank'' Johnson, Jr............................. 79
Responses from Daniel K. Elwell, Acting Administrator, Federal
Aviation Administration, to questions for the record from the
following Representatives:
Hon. Peter A. DeFazio........................................ 80
Hon. Eleanor Holmes Norton................................... 82
Hon. Steve Cohen............................................. 82
Report submitted by FAA in response to question 6 from
Hon. Cohen............................................. 87
Hon. Colin Z. Allred......................................... 84
Hon. Henry C. ``Hank'' Johnson, Jr........................... 85
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
May 10, 2019
SUMMARY OF SUBJECT MATTER
TO: Members, Subcommittee on Aviation
FROM: Staff, Subcommittee on Aviation
RE: Subcommittee Hearing on ``Status of the Boeing
737 MAX''
PURPOSE
The Subcommittee on Aviation will meet on Wednesday, May
15, 2019, at 10:00 a.m. in 2167 Rayburn House Office Building
to hold an oversight hearing titled, ``Status of the Boeing 737
MAX.'' The hearing will explore the Lion Air Flight 610 and
Ethiopian Airlines Flight 302 accidents, the resulting
international grounding of the Boeing 737 MAX aircraft, and
actions needed to ensure the safety of the aircraft before
returning them to revenue service. The Subcommittee will hear
testimony from the National Transportation Safety Board and the
Federal Aviation Administration.
BACKGROUND
The Federal Aviation Administration's (FAA) mission is to
provide the safest, most efficient aerospace system in the
world. According to the FAA, the risk of a fatal commercial
aviation accident in the United States has been cut by 95
percent since 1997. There has only been one commercial airline
passenger fatality in the United States in more than 90 million
flights in the past decade.\1\ Prior to that single passenger
fatality in April 2018, the last fatal domestic commercial
airline accident occurred in February 2009, when Colgan Air
Flight 3407 crashed near Buffalo, New York, killing all 49
onboard and one person on the ground. However, in a span of
five months, there have been two fatal commercial airline
accidents involving U.S.-designed and manufactured Boeing 737
MAX aircraft operated by foreign air carriers outside the
United States, raising safety concerns. According to the Flight
Safety Foundation, worldwide, there were more than 50 fatal
airline accidents a year through the early and mid-1990s,
claiming well over 1,000 lives annually.\2\ Fatalities dropped
from 1,844 in 1996 to just 59 in 2017, then rose to 561 last
year and 209 already this year (primarily due to the two 737
MAX accidents).\3\
---------------------------------------------------------------------------
\1\ On April 17, 2018, Southwest Airlines Flight 1380 experienced
an engine failure, resulting in loss of an engine inlet and cowling.
Fragments struck the airplane's fuselage and damaged a cabin window,
killing one passenger onboard.
\2\ David Koenig and Tom Krisher, ``Recent Airline Crashes Run
Against Trend Toward Safer Flying'', U.S. News and World Reports and
Associated Press, May 6, 2019, Available at: https://www.usnews.com/
news/business/articles/2019-05-06/recent-airline-crashes-run-against-
trend-
toward-safer-flying/
\3\ Id.
---------------------------------------------------------------------------
I. FOREIGN AIR CARRIER ACCIDENTS INVOLVING BOEING 737 MAX
A. LION AIR FLIGHT 610
On October 29, 2018, Lion Air Flight 610 (JT610)--a Boeing
737 MAX--a domestic flight en route to Pangkal Pinang from
Jakarta, crashed approximately 11 minutes after takeoff into
the Java Sea at 450 miles per hour, killing all 189 on board
(184 passengers and 5 crew).
According to the preliminary accident report by Indonesia's
Komite Nasional Keselamatan Transportasi (KNKT),\4\ after
departure, the aircraft's left and right angle of attack (AoA)
sensors, which measure the angle between the airplane's wings
and the oncoming air, provided the pilots inaccurate readings
(a 20-degree difference between left and right sensors). This
faulty data made the accident aircraft believe it was in a
stall and therefore activated a Boeing system on the 737 MAX
called the ``maneuvering characteristics augmentation system''
(MCAS). The MCAS--designed to help pilots avoid stalls, which
occur at excessively high angles of attack--pushes the nose of
the aircraft down to allow the aircraft to regain airspeed.
However, due to faulty AoA data, the MCAS on JT610 reactivated
(i.e., pushed the nose of the aircraft down) more than two
dozen times during the 11-minute flight and the pilots' manual
attempts to counter the MCAS were ultimately futile.
---------------------------------------------------------------------------
\4\ Translated means ``Transportation Safety National Committee''
or ``National Transportation Safety Committee''.
---------------------------------------------------------------------------
The preliminary report provides information on the flight
crew including \5\:
---------------------------------------------------------------------------
\5\ ET302 Preliminary Report available at http://www.ecaa.gov.et/
documents/20435/0/Preliminary+Report+B737-800MAX+%2C%28ET-AVJ%29.pdf/
4c65422d-5e4f-4689-9c58-d7af1ee17f3e.
---------------------------------------------------------------------------
Pilot in Command: 8,122 flight hours (1,417 hours
in the B737, and 103 hours in the 737 MAX)
First Officer: 361 flight hours (207 hours in the
B737, and 56 hours in the 737 MAX)
According to the preliminary accident report, there were
problems reported by flight crews operating the aircraft on
October 26, 27, and 28, 2018. The pilots of the flight
immediately preceding the accident flight (on October 28, 2018)
experienced similar problems to the accident flight. On the
October 28, 2018, flight, despite experiencing problems, the
pilots continued flying with manual trim and without auto-pilot
until safely landing at Jakarta. They reported problems to the
airline and the aircraft was serviced, tested, and determined
ready for flight.
On November 7, 2019, the FAA issued an Emergency
Airworthiness Directive (AD) requiring operators of the 737 MAX
to ``revise their flight manuals to reinforce to flight crews
how to recognize and respond to uncommanded stabilizer trim
movement and MCAS events.'' \6\ Specifically, the AD stated
that in the event of an ``erroneously high [AoA] sensor input .
. . there is a potential for repeated nose-down trim commands
of the horizontal stabilizer. This condition, if not addressed,
could cause the flight crew to have difficulty controlling the
airplane, and lead to excessive nose-down attitude, significant
altitude loss, and possible impact with terrain.'' \7\ The AD
identified existing flight crew procedures to be used in such
circumstances.
---------------------------------------------------------------------------
\6\ Elwell, Daniel K, Federal Aviation Administration, Testimony
before for the Senate Commerce Committee, Aviation and Space
Subcommittee, hearing on State of Airline Safety: Federal Oversight of
Commercial Aviation, p.7 (March 27, 2019).
\7\ FAA Emergency Airworthiness Directive, AD # 2018-23-51 (Nov. 7,
2018), available at http://rgl.faa.gov/Regulatory_and_Guidance_Library/
rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-
51_Emergency.pdf.
---------------------------------------------------------------------------
The Indonesian government's KNKT is leading the ongoing
accident investigation. As mentioned previously, on November
27, 2018, the KNKT issued a preliminary report on the Lion Air
crash. The preliminary report was compiled prior to the
recovery of the cockpit voice recorder and does not contain
analysis. The final report, which will include the probable
cause(s) of the accident, is expected later this year. The
National Transportation Safety Board (NTSB) is assisting with
this investigation.
B. ETHIOPIAN AIRLINES FLIGHT 302
On March 10, 2019, Ethiopian Airlines Flight 302 (ET302)--a
Boeing 737 MAX--en route from Bole International Airport in
Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed approximately
six minutes after takeoff. The accident resulted in the death
of all 157 people on board (149 passengers and 8 crew members).
According to the Ethiopian Ministry of Transport's
preliminary accident report, faulty AoA data from one sensor
triggered the MCAS during flight, pulling the nose of the
aircraft down, before it ultimately crashed into terrain.
Unlike the Lion Air pilots, the Ethiopian Airline pilots cut
off the trim (disconnecting the electric portion of the plane's
stabilizer), in accordance with Boeing's emergency checklist
described in the FAA's Emergency AD issued months prior. The
pilots did not reduce the throttles after takeoff and the
aircraft accelerated between 450 and 500 knots. As depicted in
the image below, manually countering MCAS activation at
excessive airspeed can be difficult or nearly impossible due to
the downward force on the plane's tail. According to the
report, the pilots reactivated the automated system and the
plane went nose down again. The pilots were unable to recover.
The preliminary report provides information on the flight
crew including \8\:
---------------------------------------------------------------------------
\8\ Lion Air 601 Preliminary Report available at https://
reports.aviation-safety.net/2018/20181029-0_B38M_PK-LQP_PRELIMINARY.pdf
---------------------------------------------------------------------------
Pilot in Command: 6,028 hours (5,176 hours in the
B737; hours in MAX not provided)
First Officer: 5,174 hours (4,286 hours in the
B737; hours in MAX not provided)
Immediately following the accident, foreign civil aviation
authorities began grounding the Boeing 737 MAX planes. On March
11, 2019, the FAA issued a Continuous Airworthiness
Notification to the International Community (CANIC) for 737 MAX
operators, describing the FAA's activities following the Lion
Air accident in support of continued operational safety of the
737 MAX fleet. On March 13, two days later, the FAA ordered a
temporary grounding of the fleet operated by U.S. airlines or
in U.S. territory. The Boeing 737 MAX remains grounded today.
The Ethiopian government is leading the accident
investigation. As mentioned above, on April 4, 2019, Ethiopia's
Ministry of Transport's Aircraft Accident Investigation Bureau
issued a preliminary report on the Ethiopian Airlines crash. A
final report detailing probable cause(s) of the accident is
expected within the year. The NTSB is assisting with this
investigation as well.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Seattle Times article, ``Why Boeing's emergency directives may have
failed to save 737 MAX,'' by Dominic Gates on April 3, 2019.
C. ISSUES TO BE CONSIDERED IN 737 MAX ACCIDENT INVESTIGATIONS:
An aviation accident rarely has one probable cause. Rather,
accident investigators consider a number of factors, including:
operations, weather, human performance, survival factors, and
aircraft structures, power plants, and systems, to name a few.
In terms of the two 737 MAX accidents, as the U.S. is the
state of design and manufacture, the FAA and NTSB are serving
as technical experts to examine aircraft design and
certification. In accordance with Annex 13 to the U.N.
International Civil Aviation Organization, Indonesia and
Ethiopia will (respectively) be responsible for examining a
number of factors, including: pilot experience, pilot training,
operational factors, and aircraft maintenance.
International Pilot Training Standards: According to
International Civil Aviation Organization (ICAO) Standards and
Recommended Practices, the pilot-in-command requires an Airline
Transport Pilot Licence (ATP). An ATP requires a pilot have
``completed not less than 1500 hours of flight time. Further,
``[t]he Licensing Authority shall determine whether experience
as a pilot under instruction in a flight simulation training
device is acceptable as part of the total flight time of 1500
hours. Credit for such experience shall be limited to a maximum
of 100 hours, of which not more than 25 hours shall have been
acquired in a flight procedure trainer or a basic instrument
flight trainer.'' \9\
---------------------------------------------------------------------------
\9\ See ICAO Annex 1, Personnel Licensing, section 2.6 Airline
transport pilot (ATP) licence
---------------------------------------------------------------------------
ICAO also provides standards to obtain a Multi-Crew Pilot
Licence (MPL), which ``allows a pilot to exercise the
privileges of a co-pilot in a commercial air transportation on
multi-crew aeroplanes.'' \10\ ICAO Standards for an MPL are set
at a minimum of 240 hours ``as the minimum number of actual and
simulated flight hours performing the functions of the pilot
flying and the pilot non-flying.'' \11\ The ICAO Standard
``does not specify the breakdown between actual and simulated
flight hours and thus allow part of the training curriculum
that was traditionally conducted on aeroplane to be done on
flight simulation training devices.'' \12\ The applicant pilot
is required to meet ``all the actual flying time for a private
pilot licence plus additional actual flying time in instrument,
night flying and upset recovery.''
---------------------------------------------------------------------------
\10\ See https://www.icao.int/safety/airnavigation/Pages/
peltrgFAQ.aspx#anchor24
\11\ Id.
\12\ Id.
---------------------------------------------------------------------------
FAA Certification: Given that the FAA will need to review
and approve any software fix proposed by Boeing and determine
whether changes to the 737 MAX training program are needed in
order to get the aircraft back in revenue service, this
memorandum will focus on FAA's certification processes.
II. OVERVIEW OF THE FAA'S CERTIFICATION PROCESSES
All aircraft and aviation products are subject to FAA
certification prior to their sale and usein the United States.
The FAA is responsible for regulating aviation safety, which
includes approvingthe design and manufacture of new aircraft
and aviation products before they enter the National Airspace
System (NAS).\13\ The FAA's Office of Aviation Safety
encompasses two offices that handle certification processes:
the Aircraft Certification Service and the Flight Standards
Service. See Appendix 1 for a depiction of these divisions'
functions. The FAA administers regulations regarding the design
and production of aircraft and their constituent systems as
well as continued operational safety.\14\
---------------------------------------------------------------------------
\13\ See 49 U.S.C. Sec. Sec. 44702, 44704; GAO-14-829T at 1.
\14\ See, e.g., 14 C.F.R. part 21, et seq.
---------------------------------------------------------------------------
A. BOEING 737 MAX
According to the FAA, the process to issue a type-
certificate for the Boeing 737 MAX, from initial application to
final certification, took five years.\15\ The process included
297 certification flight tests, including tests of the MCAS
functions. The final type certificate was issued in March 2017.
The FAA reports it was ``directly involved'' in the System
Safety Review of the MCAS.\16\
---------------------------------------------------------------------------
\15\ Supra note 2, pg. 6.
\16\ Id.
---------------------------------------------------------------------------
B. AIRCRAFT CERTIFICATION SERVICE
The FAA's Aircraft Certification Service is responsible for
issuing ``type certificates'' (approvals) to manufacturers and
designers for new products that are to be used in the NAS,
including aircraft, engines, propellers, and aircraft parts;
ensuring the continued operational safety of those products
through their life cycles; and developing regulations and
guidance in this area.\17\ The Aircraft Certification Service
has 1,370 staff members, which includes engineers, inspectors,
flight test pilots, technical advisors, and others. This
staff--in local certification offices across the country--
manages ``certification projects'' during which engineers and
other specialists determine whether a new product complies with
FAA regulatory standards and, if so, issues a certificate for
the product. The applicant company and FAA staff work closely
during each phase of the product certification process, from
design conceptualization to certification, and then through the
product's remaining life cycle to ensure continued
airworthiness.\18\
---------------------------------------------------------------------------
\17\ See GAO-14-829T at 7. Note that the FAA may also issue
``supplemental type certificates'' for modifications to an original
design with a type certificate.
\18\ GAO-15-550T at 3-4.
---------------------------------------------------------------------------
Aircraft Certification Service staff who process and
approve aircraft products also oversee the continued
operational safety of those products. The staff, therefore,
relies on a project sequencing system to prioritize, on a
nationwide basis, certification submissions based on resource
availability.\19\ The FAA prioritizes overseeing the continued
operational safety of products already in the NAS over issuing
new certifications and approvals.\20\
---------------------------------------------------------------------------
\19\ GAO-14-829T at 5.
\20\ GAO-14-829T at 6.
---------------------------------------------------------------------------
C. FLIGHT STANDARDS SERVICE
The FAA's Flight Standards Service is responsible for
issuing certificates and approvals to pilots and operators of
aircraft, ranging from large airlines to small charter outfits.
Flight Standards Service grants certificates to air operators
(e.g., air carriers and taxi services) and air agencies (e.g.,
flight schools and repair stations); ensures the continued
operational safety of those persons and entities (through
surveillance, inspection, investigations, and enforcement); and
determines standards and regulations necessary for continued
operational safety.\21\ Flight Standards Service also manages
the system for registration of civil aircraft and all airmen
records.\22\ Flight Standards Service includes 5,157 staff
members, across 119 field offices. Unlike the Aircraft
Certification Service's national prioritization of
certification submissions, Flight Standards reviews
applications on a first-come, first-served basis. According to
the Government Accountability Office (GAO), the Flight
Standards Service struggles to keep up with its certification
workload.\23\ The U.S. Department of Transportation (DOT)
Inspector General in 2014 found that Flight Standards Service
had a significant backlog of applications, with over 100
applicants waitlisted for more than three years.\24\
---------------------------------------------------------------------------
\21\ See 49 U.S.C. Sec. Sec. 44703, 44705-10; GAO-14-829T at 7;
FAA, Flight Standards Service (AFS), https://www.faa.gov/about/
office_org/headquarters_offices/avs/offices/afs/.
\22\ See Flight Standards Service (AFS), supra note 12.
\23\ GAO-14-829T at 6.
\24\ U.S. Dep't of Transp. Office of Inspector Gen., AV-2014-056,
Weak Processes Have Led to A Backlog of Flight Standards Certification
Applications, Federal Aviation Administration 2 (June 12, 2014).
---------------------------------------------------------------------------
D. ORGANIZATION DESIGNATION AUTHORIZATION
Since even before the FAA was formed over 60 years ago, the
federal government has delegated some safety certification
responsibilities to technical experts in the industry. As
airplanes, engines, and their constituent systems became
increasingly complex, Congress authorized the FAA to leverage
the product-specific knowledge among appropriately-qualified
employees of manufacturers to determine a new product's
compliance with the applicable provisions of the Federal
Aviation Regulations. Through its organizational delegation
authority (originally authorized by Congress in 1958), the FAA
may authorize private designees (manufacturers and repair
stations) to act on behalf of the agency in conducting certain
safety certification actions, while the FAA retains ultimate
responsibility for overseeing compliance; the FAA established
the organization designation authorization (ODA) program in
2005 to consolidate all existing organizational delegation
types into one program.\25\ A designee may receive authority to
examine, inspect, and test aircraft and persons for the purpose
of issuing certificates.\26\ Once a designee establishes
through inspections and tests that an aviation product comports
with FAA standards, the FAA will conduct a risk-based review of
the designee's work, issuing a type certificate if the product
meets minimum safety standards. According to the GAO, in terms
of the breadth or scope of activities performed by FAA
designees, designees perform more than 90 percent of FAA's
certification activities.\27\
---------------------------------------------------------------------------
\25\ See 49 U.S.C. Sec. 44704(e); GAO-14-829T at 4.
\26\ GAO-14-829T at 4.
\27\ U.S. Gov't Accountability Office, GAO-13-442T, Aviation
Safety: FAA Efforts Have Improved Safety, but Challenges Remain in Key
Areas 3-4 (Apr. 16, 2013). In a May 7, 2019 email to Committee staff,
the GAO clarified that the 90% number refers to the breadth or scope of
FAA activities designees can do work on rather than the amount of
certification work done by designees.
---------------------------------------------------------------------------
The delegation program allows the FAA to leverage limited
resources to focus on the areas of highest-risk and make timely
certification decisions. Under the delegation program, there
are ODA unit members and individual designees. ODA unit members
are appointed under the umbrella of a specific company ODA.
Individual designees are assigned specific delegated functions
by the FAA and can work across multiple companies and projects.
To date, FAA reports 4,646 unit members and 2,653 individual
designees (covering engineering and manufacturing
responsibilities) supporting certification activities
nationwide. Currently, there are 79 Aircraft Certification
Service ODAs.
E. LEGISLATION
The FAA Reauthorization Act of 2018 (P.L.115-254) includes
several provisions aimed at improving and enhancing the FAA's
certification process. For example, the legislation requires
the FAA to implement a safety-systems approach and encourages
risk-based oversight efforts. The legislation also encourages
full utilization of the FAA's existing delegation authorities
(i.e., ODA) so that the agency can focus on the highest-risk
items and new and novel technologies during the certification
process. Finally, the legislation improves workforce training
for FAA aviation safety inspectors and safety engineers for
certification programs including ODA oversight.
III. NATIONAL TRANSPORTATION SAFETY BOARD
The NTSB is an independent agency charged with the
investigation of transportation accidents in the United States.
When an aviation accident or serious incident occurs outside of
the United States, the NTSB participates in the investigation
in accordance with the Chicago Convention of the International
Civil Aviation Organization and the Standards and Recommended
Practices (SARPS) provided in Annex 13 to the Convention.\28\
---------------------------------------------------------------------------
\28\ https://www.ntsb.gov/investigations/_layouts/ntsb.aviation/
foreign.aspx.
---------------------------------------------------------------------------
The NTSB is assisting both the Indonesian-led investigation
of the Lion Air crash as well as the Ethiopian-led
investigation of the Ethiopian Air crash. Boeing is serving as
a technical advisor for the investigations in its role as the
manufacturer of the 737 MAX. The FAA is also serving as
technical advisor as the certifying authority for the 737 MAX.
IV. REVIEWS OF THE BOEING 737 MAX
Subsequent to the two fatal foreign airline Boeing 737 MAX
accidents, DOT, the FAA, and Boeing have stood up various
panels, including:
SAFETY OVERSIGHT AND CERTIFICATION ADVISORY COMMITTEE SPECIAL COMMITTEE
On March 25, DOT announced it would create the Special
Committee to review the FAA's Aircraft Certification Process
(Special Committee) under the new authority granted by the FAA
Reauthorization Act of 2018.\29\ The Special Committee is
tasked with reviewing the procedures of the FAA for the
certification of new aircraft, including the Boeing 737
MAX.\30\ The Special Committee's review of the certification
process includes the ``FAA certification process workplan,
process timeline, Organization Designation Authorization,
Designated Engineering Representatives Authorization/
Certification, Authorized Representation Certification and
oversight thereof.'' \31\ The Special Committee will focus
primarily on the Boeing 737 MAX 8 certification process from
2012 to 2017 and make recommendations for how the process could
be improved.\32\ Its findings and recommendations will then be
presented directly to the DOT Secretary and the FAA
Administrator for their consideration.\33\
---------------------------------------------------------------------------
\29\ Federal Aviation Administration (FAA), DOT Announces Special
Committee to Review FAA's Aircraft Certification Process (2019),
available at https://www.transportation.gov/briefing-room/dot1619
\30\ Id.
\31\ Department of Transportation (DOT), Letter to General McDew
(2019), available at https://www.transportation.gov/sites/dot.gov/
files/docs/briefing-room/337281/gen-darren-mcdew.pdf
\32\ Id.
\33\ Id.
---------------------------------------------------------------------------
SAFETY OVERSIGHT AND CERTIFICATION ADVISORY COMMITTEE (SOCAC)
On March 25, DOT announced it will stand up the
Congressionally-mandated Safety Oversight and Certification
Advisory Committee. The SOCAC is required to advise the
Transportation Secretary on policy-level issues related to FAA
safety certification and oversight programs, including efforts
to streamline aircraft and flight standards certification
processes, utilization of delegation authorities, risk-based
oversight efforts, and training programs. The SOCAC will
develop training and continuing education objectives for FAA
engineers and safety inspectors. While not directly tasked with
Boeing certification, aircraft certification is a key tasking
of the committee.
JOINT AUTHORITIES TECHNICAL REVIEW
On April 2, the FAA established a Joint Authorities
Technical Review (JATR) \34\ to conduct a comprehensive review
of the certification of the automated flight control system
(MCAS) on the Boeing 737 Max, including evaluating aspects of
its design and pilots' interaction with the system, determining
its compliance with all applicable regulations and identifying
future enhancements that might be needed.\35\
---------------------------------------------------------------------------
\34\ FAA, FAA Updates on the Boeing 737 MAX: FAA Establishes Joint
Authorities Technical Review (JATR) for Boeing 737 MAX (2019),
available at https://www.faa.gov/news/updates/?newsId=93206
\35\ On March 26, 2019, Chair of the House Committee on
Transportation and Infrastructure Peter DeFazio (D-OR) and Chair of the
Subcommittee on Aviation Rick Larsen (D-WA) sent a letter to Acting
Administrator Daniel K. Elwell of the Federal Aviation Administration
(FAA), urging the FAA to engage an independent, third-party review
composed of individuals with the technical skills and expertise to
objectively assess the corrective measures proposed for the 737 MAX by
Boeing.
---------------------------------------------------------------------------
The JATR is chaired by former NTSB Chairman Chris Hart and
comprised of a team of experts from the FAA, National
Aeronautics and Space Administration (NASA), and international
aviation authorities, including China, Indonesia, Australia,
Brazil, Canada, Singapore, the United Arab Emirates (UAE), and
the European Union Aviation Safety Agency (EASA).\36\ The JATR
had its first meeting on April 29, 2019, and is expected to
last three months from the date it was established.\37\ The
JATR is not tied to the FAA's decision for return to service of
the 737 MAX. That decision will be based upon FAA's assessment
of the sufficiency of the proposed software updates and pilot
training to address known issues for grounding the aircraft.
---------------------------------------------------------------------------
\36\ Id.
\37\ Id.
---------------------------------------------------------------------------
BOEING BOARD OF DIRECTORS REVIEW COMMITTEE
On April 5, 2019, Boeing announced it was creating a panel
that will examine the design and development of its
aircraft.\38\ According to Boeing's statement, the panel will
examine ``company-wide policies and processes for the design
and development of its aircraft'' and will also ``confirm the
effectiveness of [its] policies and processes for assuring the
highest level of safety on the 737-MAX program, as well as
[its] other airplane programs, and recommend improvements to
[its] policies and procedures.'' \39\
---------------------------------------------------------------------------
\38\ Boeing, Statement from Boeing CEO Dennis Muilenburg: We Own
Safety--737 MAX Software, Production and Process Update (2019),
available at https://boeing.mediaroom.com/2019-04-05-Statement-from-
Boeing-CEO-Dennis-Muilenburg-We-Own-Safety-737-MAX-Software-Production-
and-Process-Update
\39\ Id.
---------------------------------------------------------------------------
V. ONGOING INVESTIGATIONS
U.S. HOUSE OF REPRESENTATIVES COMMITTEE ON TRANSPORTATION AND
INFRASTRUCTURE
On March 13, 2019, Chairman Peter A. DeFazio and
Subcommittee on Aviation Chairman Rick Larsen launched an
investigation by the Committee on Transportation and
Infrastructure into the certification of the Boeing 737 MAX.
DOT INSPECTOR GENERAL
On March 19, 2019, Secretary Elaine Chao requested the DOT
Inspector General (DOT IG) to conduct an audit, ``to compile an
objective and detailed factual history of the activities that
resulted in the certification of the Boeing 737-MAX 8
aircraft.'' \40\
---------------------------------------------------------------------------
\40\ The IG reports similar audit requests were submitted by the
Chairman and Ranking Member of the Senate Committee on Appropriations,
Subcommittee on Transportation, Housing and Urban Development, and
Related Agencies; and Senator Richard Blumenthal (D-CT). See https://
www.oig.dot.gov/sites/default/files/Audit%20Annoucement%20-
%20FAA%27s%20
Oversight%20of%20the%20Boeing%20737%20MAX%20Certification.pdf.
---------------------------------------------------------------------------
On March 19, 2019, Chairman DeFazio and Aviation
Subcommittee Chairman Rick Larsen asked DOT IG to investigate
the certification process for the Boeing 737 MAX, including how
each of the new features on the plane, including the AoA
sensors and the MCAS, were tested and certified. The request
also seeks investigation of the FAA's decision not to revise
pilot training programs and manuals to reflect flight critical
automation systems; how new features of the aircraft were
communicated to airline customers, pilots and foreign civil
aviation authorities; whether ODA authority contributed to any
of the factors FAA considered in its decision-making; and a
status report on how corrective actions have been implemented
since the Lion Air crash in October 2018.
On March 29, 2019, Chairman DeFazio, Ranking Member Sam
Graves, Aviation Subcommittee Chair Larsen, and Aviation
Subcommittee Ranking Member Garret Graves requested that the
DOT IG launch an investigation of international pilot training
standards and training for commercial pilots operating outside
of the United States, including training for the Boeing 737
MAX.
U.S. DEPARTMENT OF JUSTICE
According to multiple news sources, it was reported that
the Department of Justice (DOJ) is conducting a criminal
investigation into the FAA's certification of the Boeing 737
MAX.\41\ Reports indicate the investigation began after the
October 2018 Lion Air crash and is primarily focusing on the
certification process.\42\ According to news reports, the FBI
Seattle Office and the Justice Department's criminal division
in Washington state are leading the investigation.\43\
---------------------------------------------------------------------------
\41\ See Steve Miletich, FBI Joining Criminal Investigation into
Certification of Boeing 737 MAX, The Seattle Times, March, 20, 2019,
available at https://www.seattletimes.com/business/boeing-aerospace/
fbi-joining-criminal-investigation-into-certification-of-boeing-737-
max/; Evan Perez and Shimon Prokupecz, Justice Department Issues
Subpoenas in Criminal Investigation of Boeing, CNN, March 21, 2019,
available at https://www.cnn.com/2019/03/20/business/boeing-justice-
department-subpoenas/index.html
\42\ Id.
\43\ Id.
---------------------------------------------------------------------------
VI. NEXT STEPS
After the October 2018 Lion Air crash, Boeing announced
that the company is working on a design change to implement a
software patch for the MCAS. Boeing continues to work on the
certification documentation required to certify the MCAS
software enhancement and the associated pilot training
material. The FAA is responsible for reviewing and approving
this and any other design changes to the 737 MAX. According to
the FAA, the ``737 MAX will return to service for U.S. carriers
and in U.S. airspace only when the FAA's analysis of the facts
and technical data indicate that it is appropriate.\44\''
---------------------------------------------------------------------------
\44\ Elwell, supra note 5, pg. 9.
---------------------------------------------------------------------------
There are more than 370 Boeing 737 MAX worldwide, with
fewer than 100 operated by U.S. airlines and grounded at this
time.\45\ Southwest Airlines is the top 737 MAX operator in the
United States.
---------------------------------------------------------------------------
\45\ https://www.cnbc.com/2019/03/13/boeing-shares-fall-after-
report-says-us-expected-to-ground-737-max-fleet.html
---------------------------------------------------------------------------
WITNESSES
Daniel Elwell, Acting Administrator, Federal
Aviation Administration, Accompanied by Earl Lawrence,
Executive Director Aircraft Certification, FAA
Robert L. Sumwalt, Chair, National Transportation
Safety Board, Accompanied by Dana Schulze, Acting Director,
Office of Aviation Safety, NTSB
APPENDIX 1. Certification in the FAA's Office of Aviation Safety.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Source: GAO presentation of FAA information. GAO-14-728T
STATUS OF THE BOEING 737 MAX
----------
WEDNESDAY, MAY 15, 2019
House of Representatives,
Subcommittee on Aviation,
Committee on Transportation and Infrastructure,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m. in
room 2167, Rayburn House Office Building, Hon. Rick Larsen
(Chairman of the subcommittee) presiding.
Mr. Larsen. The subcommittee will come to order. I want to
thank folks for coming this morning. We will get started here.
The ranking member of the subcommittee and full committee
will be here soon enough. And I want to thank Mr. Mitchell for
sitting in.
Good morning, and thank you today to the witnesses for
joining the subcommittee's discussion on the status of the
Boeing 737 MAX.
Three hundred and forty-six people died in the Ethiopian
Airlines flight 302 crash near Addis Ababa, Ethiopia, and the
Lion Air flight 610 crash en route to Jakarta, Indonesia.
Congress has an obligation to the traveling public, and the
victims of these accidents and their families, to ensure the
safety of air travel. If the public does not feel safe about
flying, then they won't fly. If they don't fly, airlines don't
need to buy airplanes. If they don't need to buy airplanes,
then airplanes don't need to be built. And if there is no need
to build airplanes, we don't need jobs in aviation. Therefore,
it is very clear that the foundation of the U.S. aviation
system is safety.
And this committee will continue to maintain safety as its
guiding principle, and will use the tools at its disposal to
reduce the likelihood of tragedies like this from happening
again.
I want to start by updating the subcommittee members and
the public on the committee's work to date. Chair DeFazio and I
continue to engage with the FAA, the National Transportation
Safety Board, Boeing, pilots, aviation stakeholders, and others
about these accidents.
First, on March 19th, Chair DeFazio and I requested the
Department of Transportation inspector general, or the DOTIG,
assess the FAA's approach to certifying the Boeing 737 MAX.
Second, the committee's oversight and investigations team
continues to work with the FAA and Boeing on the records
request Chair DeFazio and I sent on the certification of the
MAX.
Third, the committee sent a separate, bipartisan DOTIG
request to evaluate aircraft cockpit automation and
international pilot training standards.
Fourth, following a request from Chair DeFazio and I for a
third-party review of the certification of Boeing's anticipated
737 MAX software update and related training, the FAA
established a Joint Authorities Technical Review, or JATR, and
a Technical Advisory Board, or TAB.
The JATR's independent review will ensure thorough
oversight of the process, and rebuild public confidence that
the U.S. is the global standard in aviation safety.
In addition, the TAB, composed of the U.S. Air Force, the
Volpe National Transportation Systems Center, and NASA, will
provide an independent review of the proposed software change
and integration into the MAX flight control system.
I encourage all members of the subcommittee to personally
continue monitoring the situation, and staff is available for
any questions you might have surrounding the investigation, and
can provide you with updates as they become available.
What I hope to hear from witnesses today: Acting
Administrator Elwell and Chairman Sumwalt, the subcommittee
understands certain information about actions cannot be
publicly discussed at this time because some investigations are
ongoing. However, there is still important information that
this subcommittee can learn in today's hearing.
For instance, Mr. Elwell, I will look forward to hearing
more about the FAA's decisionmaking regarding the certification
of the 737 MAX. I want you to clarify the ODA process, as well
as the agency's role in determining risk assessments assigned
to key safety features on the aircraft, most notably the angle
of attack, or AOA, sensors, and the Maneuvering Characteristics
Augmentation System, or MCAS, and whether these features should
have been designated as safety critical.
A recent Wall Street Journal article reported an internal
FAA review concluded the agency itself failed to perform proper
oversight of the certification of the MCAS system. If that is,
in fact, true, the ODA program is not working as Congress
intended.
I also want to hear more about FAA's role in the
development of associated pilot training for the MAX, including
opportunities for input from pilots and engagement with Boeing
on the related flight manuals.
Additionally, I am interested in the JATR and the TAB's
future processes, and how the work of these two groups align
with the recently established Safety Oversight and
Certification Advisory Committee, as mandated under the FAA
bill we passed last year.
And finally, from you I want to hear what steps the FAA
will take between now and when the 737 MAX is permitted to fly
again.
Mr. Elwell, the FAA has a credibility problem. The FAA
needs to fix its credibility problem. This committee will work
with the FAA as it rebuilds public and international confidence
in its decisions. But our job is oversight, and the committee
will continue to take this role seriously.
Chairman Sumwalt, I look forward to learning more about the
NTSB's collaboration with foreign investigation authorities,
and your insights on the preliminary reports for JT610 and
ET302 accidents.
Congress must find answers to what happened surrounding
these two accidents and ensure the safety of the Boeing 737 MAX
for the sake of the flying public.
The FAA must take steps to restore public confidence in the
ability to maintain the safest aerospace system in the world.
Today's hearing comes at the beginning of the committee's
investigative process, and is the first of what will likely be
a series of hearings on the MAX. The committee will continue
its thorough investigation until it fully understands all the
issues surrounding the 737 MAX accidents. And the committee
will not hesitate to act to ensure the safety of the U.S.
aviation system.
I will continue to work with Chair DeFazio throughout this
process, as well as subcommittee members, the FAA, the NTSB,
Boeing, aviation stakeholders, and families of the victims.
Thank you again to the witnesses today. I look forward to
hearing you address these issues I have outlined in my
statement.
[Mr. Larsen's prepared statement follows:]
Prepared Statement of Hon. Rick Larsen, a Representative in Congress
from the State of Washington, and Chair, Subcommittee on Aviation
Good morning and thank you to today's witnesses for joining the
Subcommittee's discussion on the ``Status of the Boeing 737 MAX.''
Three hundred forty-six people died in the Ethiopian Airlines
Flight 302 crash near Addis Ababa, Ethiopia and the Lion Air Flight 610
crash en route to Jakarta, Indonesia.
Congress has an obligation to the traveling public and the victims
of these accidents and their families to ensure the safety of air
travel.
If the public doesn't feel safe about flying then they won't fly;
if they don't fly, airlines don't need to buy airplanes; if they don't
need to buy airplanes, then airplanes don't need to be built; and if
there is no need to build the airplanes, then there will be no jobs.
Therefore, the foundation of the U.S. aviation system is safety.
This Committee will continue to maintain safety as its guiding
principle and will use tools at its disposal to reduce the likelihood
of tragedies like these from happening again.
t&i committee efforts
I will start by updating the Subcommittee Members on the
Committee's work to date.
Chair DeFazio and I continue to engage with the Federal Aviation
Administration (FAA), National Transportation Safety Board (NTSB),
Boeing, pilots and aviation stakeholders about these accidents.
First, on March 19, Chair DeFazio and I requested the Department of
Transportation Inspector General (DOT IG) assess the FAA's approach to
certifying the Boeing 737 MAX.
Second, the Committee's oversight and investigations team continues
to work with the FAA and Boeing on the records requests Chair DeFazio
and I sent on the certification of the 737 MAX.
Third, the Committee sent a separate, bipartisan DOT IG request to
evaluate aircraft cockpit automation and international pilot training
standards.
Fourth, following a request from Chair DeFazio and I for a third-
party review of the certification of Boeing's anticipated 737 MAX
software update and related training, the FAA established a Joint
Authorities Technical Review (JATR) and a Technical Advisory Board
(TAB).
The JATR's independent review will ensure thorough oversight of the
process and rebuild public confidence that the United States is the
global standard in aviation safety.
In addition, the TAB, composed of the U.S. Air Force, the Volpe
National Transportation Systems Center, and NASA, will provide an
independent review of the proposed software change and integration into
the MAX flight control system.
I encourage all Members to personally continue monitoring this
situation.
Staff is available for any questions you may have surrounding the
investigation and can provide you with updates as they become
available.
what i hope to hear from witnesses
Acting Administrator Elwell and Chairman Sumwalt, the Subcommittee
understands certain information about the accidents cannot be publicly
discussed at this point because the investigations are ongoing.
However, there is still important information this Subcommittee can
learn in today's hearing.
For instance, Mr. Elwell, I look forward to hearing more about the
FAA's decisionmaking regarding the certification of the 737 MAX.
I would like you to clarify the ODA process, as well as the
agency's role in determining risk assessments assigned to key safety
features on the aircraft, most notably, the Angle of Attack (AOA)
sensors and Maneuvering Characteristics Augmentation System (MCAS), and
whether these features should be designated as safety critical.
A recent Wall Street Journal article reported an internal FAA
review concluded the agency failed to perform proper oversight of the
certification of the MCAS system. If true, the ODA program is not
working as Congress intended.
I would also like to hear more about the FAA's role in the
development of associated pilot training for the 737 MAX, including
opportunities for input from pilots and engagement with Boeing on the
related flight manuals.
Additionally, I am interested in the JATR and TAB's future
processes and how the work of these two groups aligns with the recently
established Safety Oversight and Certification Advisory Committee, as
mandated under the FAA Reauthorization Act of 2018.
Finally, I would like to hear what steps the FAA will take between
now and when the Boeing 737 MAX is permitted to fly again.
Administrator Elwell, the FAA has a credibility problem. The FAA
needs to fix its credibility problem.
This Committee will work with the FAA as it rebuilds public and
international confidence in its decisions, but our job is oversight and
the Committee will continue to take this role seriously.
Chairman Sumwalt, I look forward to learning more about the NTSB's
collaboration with the foreign investigation authorities and your
insights on the preliminary reports for the JT610 and ET302 accidents.
next steps
Congress must find answers to what happened surrounding these two
accidents and ensure the safety of the Boeing 737 MAX for the sake of
the flying public.
The FAA must take steps to restore public confidence in its ability
to maintain the safest aerospace system in the world.
Today's hearing comes at the beginning of the Committee's
investigative process and is the first in what will be a series of
hearings on the 737 MAX.
The Committee will continue its thorough investigation until it
fully understands all the issues surrounding the 737 MAX accidents.
The Committee will not hesitate to act to ensure the safety of the
U.S. aviation system.
I will continue to work with Chair DeFazio throughout this process
as well as Subcommittee members, FAA, NTSB, Boeing, aviation
stakeholders and families of victims.
Thank you again to today's witnesses and I look forward to hearing
you address the issues I outlined in my opening statement.
Mr. Graves of Missouri. A lot of Graveses in there.
Mr. Larsen. A lot of Graveses.
Mr. Graves of Missouri. Thank you, Chairman Larsen, and I
do want to thank you and Ranking Member Graves for holding this
hearing.
I want to extend my condolences to the families and friends
of the accident victims. Their loss is why it is important that
we understand what occurred and what is needed to get the 737
MAX safely back in the air.
Safety is the highest priority, and we have to regularly
examine our safety programs. And while we are in early stages
of this investigation, many appear to have already concluded
that the FAA's process is to blame. Should the various
investigations reveal problems with the certification of the
737 MAX, then Congress can and should act. But any actions
Congress or regulators consider have to be based on facts, and
not panicked desire just to do something.
I reviewed the Lion Air and the Ethiopian preliminary
accident reports and I feel strongly about sharing my thoughts
with this committee based on my experience and perspective as a
pilot with an ATP rating.
First, with Lion Air, there were flight control problems
reported by the pilots flying the same aircraft on the 3 days
prior to the accident flight. On the flight the day before the
accident flight the pilots experienced the identical issues,
yet they flew more than an hour with the autopilot off and
trimmed the plane manually. Unfortunately, it doesn't appear
that they fully reported the problems. Yet based upon those
reports, the aircraft was serviced and it was cleared for
flight.
The preliminary accident report prepared by Ethiopian
authorities concludes that the pilots followed proper
procedures, but there are several facts that absolutely
contradict that conclusion.
First, the aircraft accelerated throughout the entire
flight. The pilots never pulled the throttles back after
setting them for full thrust at takeoff. The aircraft actually
accelerated to between 450 to 500 knots, which is far beyond
the maximum speed, certified speed, of the MAX 8 of 340 knots.
That fundamental error appears to have had a domino effect on
the events that followed after that.
After an apparent faulty sensor caused the planes MCAS to
pitch the plane's nose down, the pilots did follow procedures
by turning off the automated system, and they tried to manually
trim the airplane. However, they were simply going too fast to
manually trim that plane. If you can imagine driving down the
road in a car going 100 miles an hour and trying to push the
door open, you know what I am talking about.
The pilots, both in their twenties, with less than 160
total hours combined time in the 737 MAX, then reactivated the
automated system. The plane went nose down again, and the
pilots were unable to recover that aircraft.
No operating procedure that I know of or have ever heard of
directs a pilot to reactivate a faulty system. The Lion Air and
Ethiopian pilots desperately tried to save their passengers,
but the facts and the preliminary report reveal pilot error as
a factor, one of the factors--and there are always many factors
in these situations, in these tragically fatal accidents.
To focus on one single cause fails to see the forest for
the trees. So we are developing an MCAS software fix, but we
can never eliminate every risk or anticipate all scenarios, no
matter how much technology is in the cockpit. Failures will
occur. That is the reason why I have stated this time and time
again, that the most important safety feature you can have in
any aircraft is a well-trained pilot that can fly the aircraft,
regardless of what the investigations conclude.
Airlines have to ensure that their pilots are sufficiently
trained and experienced to handle the aircraft in which they
are in. Pilots can master the cockpit's technology, but they
have to be able to fall back on their training to fly the
plane. That is first and foremost: fly the plane, not just fly
a computer.
For me, the action report reaffirms my belief that pilots
trained in the United States would have successfully been able
to handle this situation. The reports compound my concerns
about quality training standards in other countries, and that
is why I have asked the DOT inspector general to look at
international pilot training.
And in the end these facts are irrefutable: the U.S.
aviation system is the world's safest, thanks to our FAA
leadership. And despite sensational reports claiming that the
agency's international standing is in question, our FAA remains
the gold standard for safety in the United States. In the last
decade in the United States there have been nearly 7 billion
passengers flown on 90 million flights with 1 fatality. And
this includes 57,000 flights in the MAX 8, 737 MAX 8. While one
loss of life is too many, that is a remarkable safety record
that we can be proud of here in the U.S.
And one reason our system is safe is the collaborative
process between the FAA, pilots, manufacturers, airlines,
mechanics, everybody up and down the line. This decades-old
system or structure has worked so well that last Congress we
overwhelmingly voted to uphold and improve the agency's
aircraft certification process. And I caution those who want to
blame the FAA process that jumping to conclusions only serves
to erode confidence in the U.S. aviation system when the safety
record absolutely speaks for itself.
We have preliminary information, we do not have the final
reports, nor the benefit of the investigative work that has yet
to be completed. But what we do know does not justify
abandoning the FAA's proven system that has made air travel
here in the United States the safest mode of transportation in
history.
And again, I want to thank you all for holding this
hearing, and I would yield back the balance.
[Mr. Graves of Missouri's prepared statement follows:]
Prepared Statement of Hon. Sam Graves, a Representative in Congress
from the State of Missouri, and Ranking Member, Committee on
Transportation and Infrastructure
Thank you Chairman Larsen and Ranking Member Graves for holding
this hearing.
I want to extend my condolences to the families and friends of the
accident victims. Their loss is why it is important we understand what
occurred and what is needed to get the 737 MAX safely back in the air.
Safety is the highest priority, and we should and do regularly
examine our safety programs.
While we are early in the investigations, many appear to have
already concluded that the FAA's processes are to blame. Should the
various investigations reveal problems with the certification of the
737 MAX, Congress can and should act. But any actions Congress or
regulators consider must be based on facts, not a panicked desire to
``do something.''
I reviewed the Lion Air and Ethiopian preliminary accident reports
and I feel strongly about sharing my thoughts with this committee based
on my experience and perspective as a pilot with an ATP.
First, with Lion Air, there were flight control problems reported
by pilots flying the same aircraft on the three days preceding the
accident flight. On the flight the day before the accident flight, the
pilots experienced identical issues, yet flew more than an hour with
the autopilot off and trimming the plane manually. Unfortunately, it
does not appear that they fully reported the problems. Yet, based upon
those reports, the aircraft was serviced and cleared for flight.
The preliminary accident report prepared by the Ethiopian
authorities concludes that the pilots followed proper procedures, but
there are several facts that contradict that conclusion.
First, the aircraft accelerated throughout the flight; the pilots
never pulled back the throttles after setting them at full thrust for
takeoff. The aircraft actually accelerated to between 450 and 500
knots--far beyond the maximum certified speed of 340 knots. That
fundamental error appears to have had a domino effect on all the events
that followed.
After an apparent faulty sensor caused the plane's MCAS to angle
the plane's nose down, the pilots did follow the procedures by turning
off the automated system and trying to manually trim the plane.
However, they were simply going too fast to manually level the plane--
imagine trying to open a car door at 100 mph.
The pilots--both in their 20s and with less than 160 total hours
combined flying a 737 MAX--then reactivated the automated system. The
plane went nose-down again, and the pilots were unable to recover. No
operating procedures that I know of direct a pilot to reactivate a
faulty system.
The Lion Air and Ethiopian pilots desperately tried to save their
passengers, but the facts in the preliminary reports reveal pilot error
as a factor in these tragically fatal accidents. To focus on a single
possible cause fails to see the forest for the trees.
Boeing is developing an MCAS software fix, but we can never
eliminate every risk or anticipate all scenarios, no matter how much
technology is in the cockpit. Failures will occur.
The most important safety feature in any cockpit is a well-trained
pilot. Regardless of what the investigations conclude, airlines must
ensure their pilots are sufficiently trained and experienced to handle
the aircraft. Pilots can master the cockpit's technology, but they must
be able to fall back on their training to fly the plane--not just fly a
computer.
For me, the accident reports reaffirm my belief that pilots trained
in the United States would have successfully handled the situation. The
reports compound my concerns about quality training standards in other
countries. That is why I asked the DOT Inspector General to look at
international pilot training.
In the end, these facts are irrefutable: the U.S. aviation system
is the world's safest thanks to FAA's leadership. And despite
sensational reports claiming the agency's international standing is in
question, the FAA remains the gold standard for safety.
In the last decade in the United States, there have been nearly 7
billion passengers on 90 million flights, with only one fatality; this
includes 57,000 flights of the 737 MAX. One life lost is one too many,
but that is a remarkable safety record.
One reason our system is safe is the collaborative process between
FAA, pilots, manufacturers, airlines, and mechanics. This decades-old
structure has worked so well that last year, Congress overwhelmingly
voted to uphold and improve the agency's aircraft certification
process.
I caution those who want to blame FAA's process that jumping to
conclusions only serves to erode confidence in the U.S. aviation system
when the safety record speaks for itself. While we have preliminary
information, we do not have the final reports, nor the benefit of the
investigative work yet to be completed. What we do know does not
justify abandoning FAA's proven system that has made air travel the
safest mode of transportation in history.
Mr. Larsen. Thank you, Representative Graves. I recognize
Chair DeFazio.
Mr. DeFazio. Thank you, Mr. Chairman. You know, I don't
want anyone to think that we are going to walk out of here
today with all the answers; we aren't. We are very much in the
beginning of our investigation. The FAA has only begun to turn
over documents which we requested a couple of months ago, but
the Secretary assures me they will be fully cooperative.
On the other hand, Boeing has yet to provide a single
document. I am hoping they will provide the documents we have
requested voluntarily, and in the not too distant future.
This is a very complex issue, and it has raised questions
that do, worldwide, question the FAA and its certification
process. And we have got to get to the bottom of this.
First, I want to recognize the parents who are here today
of 24-year-old Samya Stumo.
And I am sorry for your loss, it shouldn't have happened.
So they deserve answers and accountability, as does the
flying public in the United States and worldwide. The
subcommittee chairman went through the investigations we have
begun and asked for. Those are ongoing.
I have been on the committee a long time. It was only after
the ValuJet tragedy this committee had rejected my amendment to
strip the FAA of an ancient promotional authority left over
from the time of the beginnings of flight. And I had been
defeated in committee, it wasn't in the Senate bill. But,
strangely enough--I was a pretty junior Member--I got a phone
call saying, ``Where would we put your provision in the bill?''
I said, ``Well, it is not conferenceable. It was rejected
in my committee, it is not in the Senate bill.'' In those days
we followed the rules; we don't anymore. I was surprised. But
they put it in the bill, and we took away, ostensibly, the
promotional authority.
And then for years I questioned the number of hours
required to sit in the second seat in the cockpit. I pointed
out that it took three times as many hours to be a hairdresser
in the State of Oregon as to be copilot in a commercial
aircraft. And it was only after Colgan that we changed the
rules.
You know, we shouldn't have to have tragedies to change the
rules, if the rules need to be changed. And now we have another
tragedy. Now the question is what were the factors.
Now, I find it--you know, the ranking member said a number
of things I could agree with about training and that.
But I got a question. Why, until the plane went down, the
first plane, Lion Air, it wasn't even in the manual that this
automated system existed. It wasn't in the manual. Now, that is
odd, because the pilots were the redundancy. How the hell are
you the redundancy if you don't know something?
There is something called a startle factor. And yes, I am
not a commercial pilot, but I have got to tell you if you are
at a low altitude and suddenly the plane starts automatically
pitching itself down every 10 seconds, there is going to be a
lot of people who are going to have trouble dealing with that.
And you know, so why wasn't it known?
And, in fact, also the disagree light issue. The disagree
light was disabled unless you bought an optional package. We
now hear, oh, that was an accident, a software problem. We
weren't trying--but people thought the disagree light was
there. They didn't know it was inoperable. And Boeing knew for
more than a year before that crash, that the disagree light
didn't work unless you bought their optional package, which
Lion Air didn't, and a whole heck of a lot of other people
didn't buy.
How did that get certified? How can we have a single point
of failure on a modern aircraft, single point of failure, one
faulty sensor, one sensor sheared off by a bird, whatever
happened in Ethiopia. One faulty sensor installed improperly,
whatever happened in Indonesia. How can you have a critical
safety system certified? Those are the questions we have got to
answer as we go through this process.
I have got a whole list of things here. I am not going to
go through them because I want to get to the witnesses. But I
got to say this is--you know, we shouldn't have to be here
today.
[Mr. DeFazio's prepared statement follows:]
Prepared Statement of Hon. Peter A. DeFazio, a Representative in
Congress from the State of Oregon, and Chair, Committee on
Transportation and Infrastructure
Thank you, Chair Larsen, for calling today's oversight hearing on
the ``Status of the Boeing 737 MAX.'' And, thank you to everyone for
attending our first hearing on the Boeing 737 MAX.
I say first because I want to be clear: I am under no illusion that
we will walk out of here today with all of the answers we are in search
of.
The issues surrounding the Boeing 737 MAX are complex and far-
reaching, and this Committee is still in the early stages of what will
be a deliberate, robust investigation. This is the first in a series of
hearings. As more information becomes available through the Committee's
oversight work, we will have additional hearings.
But here's what we do know for sure right now.
The tragedies of the two fatal Boeing 737 MAX accidents in a span
of five months have shocked the aviation industry and the flying public
around the globe.
We lost 346 lives, people with families and loved ones whose lives
will never be the same.
That includes the parents of 24-year-old Samya Stumo--who are here
in the audience today.
Their daughter was flying from Ethiopia to Kenya for work when
Ethiopian Airlines flight 302 went down.
They deserve answers and accountability, as does the general flying
public.
That's why I, along with Subcommittee Chair Larsen, launched an
investigation immediately following the Ethiopian Airlines accident to
conduct vigorous oversight of the Federal Aviation Administration (FAA)
and Boeing, to examine what went wrong with the 737 MAX, and how we can
make certain it never happens again. We have also requested the
Department of Transportation Inspector General examine the FAA's
certification process for the 737 MAX. We will not leave any stone
unturned.
For 30 years, I have been a staunch safety advocate. My
responsibility, this Committee's responsibility, is to ensure the
flying public it is safe. So please be assured, I plan to continue my
decades long record of advancing safety at no expense. When changes
need to be made, we will make them. As I've said before, the FAA exists
to protect the public. It does not exist to promote or protect any part
of the regulated industry.
Today, we will receive testimony from the National Transportation
Safety Board on what we know to date about the two aviation accidents
and ongoing investigations into their probable cause or causes; and an
update from the Federal Aviation Administration (FAA) on what it knows
to date, the work being undertaken to audit and review issues
surrounding the certification of the 737 MAX, and how it plans to make
certain that this aircraft is safe to fly before it is ungrounded.
MCAS and AoA Sensors:
Since FAA grounded the fleet in March, we have learned that pilots
were not made aware of this new system on the MAX, the maneuvering
characteristics augmentation system, or MCAS. We have also read
troubling reports that certain safety features were installed but not
operational, or optional and not required.
Aviation is a system based on checks and cross-checks. How can an
aircraft be certified if the failure of a single Angle of Attack (AoA)
sensor results in MCAS activation, pulling the nose of a plane downward
without pilot command? Where was the redundancy? If pilots were
supposed to be the backstop for an AoA failure, why were pilots not
informed the new system was on their plane and expected to know how to
respond appropriately?
There are many questions we need to examine.
Pilot Training:
In light of increased automation, are some of the safety
assumptions made by the FAA and Boeing the right assumptions?
Do we need to improve the process for determining and
evaluating what pilots are trained on before they fly a new aircraft?
Do we need to enhance international pilot training
standards?
What is the role of the FAA and manufacturer for
certifying U.S. aircraft that we know will be flown by pilots with
varying levels of training and experience?
Optional Safety Features:
Who made the decision that AoA indicators or gauges--that
could have given pilots an early and clear indication of what was
happening to the plane--are optional?
Why did the AoA disagree light, which is standard on the
previous 737s and supposedly on the 737 MAX, not work without the extra
cost optional indicators?
FAA Certification/Organization Designation Authorization (ODA):
The agency's stellar record and leadership is now being questioned.
Did Boeing design a system that was flawed, or was the FAA fully
knowledgeable of the system?
Since the 1950s, the FAA has relied on a system of delegating
certain certification authorities to manufacturers. And it has done so
safely.
However, for years, I have raised questions about how the FAA
oversees the work of manufacturers that have been delegated these
responsibilities. And I am going to continue to ask them.
Does the FAA have sufficient resources to oversee the
delegation program?
Does the FAA have enough internal expertise to oversee
the most sophisticated engineering work in the world?
What firewalls exist between manufacturers and its FAA-
designated representatives to ensure proper oversight and that there is
no undue influence placed on them?
We must get to the bottom of these questions and where precisely
decisions were made and why. These decisions cost lives. They are tough
questions and I plan to get answers. Our Committee's investigation is
going to be thoughtful and deliberate; we are going to get it right.
Returning the plane to service:
MAX aircraft are currently sitting idle. There is tremendous
pressure to get the planes back up in the air. But before that happens,
the FAA must make sure that every problem is identified and fixed, and
every pilot that is certified to fly the plane knows everything there
is to know and is properly trained.
Chair Larsen and I have called for a third-party review of what
Boeing proposes to improve the design of the MCAS and what pilot
training is deemed necessary.
This will be critical to inform FAA's decisionmaking as well as
ensure public confidence in the process. And to that end, I am pleased
that the FAA has launched a Joint Authorities Technical Review (JATR)
to review the certification of the MAX as well as a Technical Advisory
Board (TAB).
Comprised of experts from the U.S. Air Force, the Volpe National
Transportation Systems Center, and NASA, the TAB has been tasked with
conducting an independent review of Boeing's proposed software change
and its integration into the 737 MAX flight control system.
Restoring public confidence and trust in the FAA's decisionmaking
and in the safety of Boeing's airplanes will be critical to the
restoration of the MAX to revenue service.
The world is watching, and the FAA and Boeing must get it right.
This third party review panel, with independent expertise, will help to
ensure that the FAA has all the information needed to make its
decision.
Nearly 12 million people fly each day around the world, and many on
U.S.-certified aircraft. We must ensure that safety is the top priority
at every turn--for manufacturers, suppliers, airlines, the FAA, and all
involved in the aviation industry.
Again, this will be the first in a series of hearings. I assure you
that we are monitoring the FAA's decisions at every turn, and we will
go as far as the investigation takes us.
I look forward to hearing from the witnesses. Thank you and I yield
back.
Mr. DeFazio. And you know, with that, I am going to yield
back the balance of my time.
Mr. Larsen. Thank you, Chair DeFazio. I recognize the
ranking member of the subcommittee, Representative Graves.
Mr. Graves of Louisiana. Thank you, Mr. Chairman, and I
want to thank you for holding this hearing today.
This is about people. And I don't think any of us need to
lose sight of that. And I want to express my sympathy for your
loss and for the loss of all of the victims of these tragic
crashes. I am going to say it again. This is about people, and
this isn't about politics, it is not about emotion. This is
about people.
And we need to take every single lesson we can extract from
these accidents and make sure that we learn from them, and make
sure that we apply them to future flights because, while the
air travel today is the safest form of transportation, it
doesn't mean we should at all rest on our laurels and say we
are good. We need to continue learning. We need to figure out
every mistake, error that was made in this case, and make sure
that it doesn't happen again.
As we know, the 737 MAX has been grounded since March 13th,
following the second international incident in 5 months, the
Lion Air and the Ethiopian Air accidents. While the accident
investigations into both crashes continue, and we need to make
sure we understand all the factors that contribute to the
accidents, it is clear that the Maneuvering Characteristics
Augmentation System, or MCAS, does appear to be a factor in
both accidents. Boeing has announced that they are working on a
software fix, and we await its submission to the FAA for
certification.
There are multiple investigations underway by the
Department of Transportation, by the inspector general, and
others. And as those investigations continue, it is important
that we set the record straight. It is important that we, as I
said, learn, and that we make air travel even safer.
It's been very concerning, watching folks in many cases
being pseudo experts. Look, it takes thousands of hours to even
get to the flight deck of a plane in the United States. And,
look, let's be honest. With the exception of Sam, the ranking
member of the full committee, not many of us have an
extraordinary amount of experience in flying planes.
This is a technical issue. There is a lot that goes on
behind the scenes and a very, very technical process. We need
to be very careful to make sure that we are not acting on
emotion, that we are not making this political, that we are
operating on facts, and we are truly taking steps that are
going to improve aviation safety to make sure that every single
lesson can be extracted and applied.
No one gets applause when a plane lands safely after an
uneventful flight. The baseline for safety for commercial
aviation is zero, zero fatalities and zero accidents. It took a
long time to reach that level of safety. And sadly, many of our
safety gains followed tragic accidents. Any deviation from our
current baseline means that we have to look at how the accident
occurred and how to prevent in the future.
But I want to be clear: the changes and the reforms that we
make in the wake of these accidents must be based on fact, and
must preserve the essence of the aviation system that has led
to this unprecedented level of safety right here in the United
States.
Aviation accidents are the result of a series of events.
There is not just one cause often. As we all know, the two
accidents that we are discussing today did appear to have
multiple factors that were included. We are going to wait for
that final conclusion to ultimately determine what exactly
contributed, but we believe that there were multiple steps.
While reviewing the FAA certification process it is also
important that we look at those other factors, including the
operations, the maintenance programs, the pilot experience
requirements, the pilot training programs of the air carriers
involved, and how those factors may have also applied to or
affected the outcome.
We need to understand the whole system, and whether the
checks and balances and redundancies that are needed in any
airline safety program are present and adhered to in these
accidents, in these disasters.
Today is not an investigative hearing. We are a long way
from the final accident reports and the completed
investigations. We are here today to learn more about the
Nation's response to these accidents, and what the next steps
are before the 737 MAX possibly returns to service.
I want to commend the FAA Acting Administrator, Dan Elwell,
for your leadership and for your accessibility. While we await
the Senate's confirmation of the FAA Administrator, I do know
the FAA is in good hands. I want to hear more from the
witnesses about the various reviews and accident
investigations, including FAA's Technical Advisory Board and
Joint Authorities Technical Review. But I also want to be
clear. No matter what other countries say, I have not seen
anything that questions my confidence in FAA's safety judgment
to date, and I continue to plan to work with you on a daily
basis to ensure we understand all the facts. Thanks again, Mr.
Chairman. And I yield back the balance.
[Mr. Graves of Louisiana's prepared statement follows:]
Prepared Statement of Hon. Garret Graves, a Representative in Congress
from the State of Louisiana, and Ranking Member, Subcommittee on
Aviation
Thank you, Mr. Chairman, for calling today's hearing.
I want to express my condolences for the families and friends of
those tragically lost in the two accidents.
As we know, the Boeing 737 MAX has been grounded in the United
States since March 13, following its second international accident in
five months. While the accident investigations into both crashes
continue, and other factors certainly contributed to those accidents,
it is clear that the Maneuvering Characteristics Augmentation System
(MCAS) played a role in both accidents. Boeing has announced that it is
working on a software update to address issues with the MCAS, and we
await its submission to the FAA for certification.
Multiple investigations into several different aspects of these
accidents are underway, including by this Committee and the DOT
Inspector General. As those investigations continue, it is important to
begin setting a record so that we can ensure that we learn from these
accidents and make international aviation even safer.
We all say it so often that it's almost trite, but safety is the
top priority of the aviation industry and this subcommittee.
No one gets applause when a plane lands safely after an uneventful
flight. The safety baseline for commercial aviation is zero fatalities,
zero accidents. It took a long time to reach this level of safety; and
sadly, many of our safety gains followed tragic accidents. Any
deviation from our current baseline means that we have to look at how
the accident occurred and how to prevent it in the future.
But I want to be clear, the changes and reforms we make in the wake
of these accidents must be based upon fact and must preserve the
essence of an aviation system that has led to an era of unprecedented
safety here in the United States.
Aviation accidents are the result of a series of events; there is
never just one cause.
As we all know, the two 737 MAX accidents occurred in Indonesia and
Ethiopia. While we are reviewing the FAA's certification processes, it
is equally important that we look closely at the operations;
maintenance programs; pilot experience requirements; and the pilot
training programs of the two air carriers involved. We need to
understand the whole system, and whether the checks and balances and
redundancies that are needed in any airline safety program were present
and adhered to in these accidents.
Today is not an investigative hearing. We are a long way from the
final accident reports and completed investigations. We are here today
to learn more about our Nation's response to these accidents and about
what the next steps are before the Boeing 737 MAX returns to service.
I want to commend Acting Administrator Dan Elwell for his exemplary
leadership during the past several months. While we await the Senate's
confirmation of the President's nominee to be the next FAA
administrator, I know that FAA is in good hands. I want to hear more
from the witnesses about the various reviews and accident
investigations, including the FAA's Technical Advisory Board and Joint
Authorities Technical Review. But I also want it to be clear that, no
matter what other countries say, I have complete confidence in the
FAA's aviation safety judgment.
Mr. Larsen. Thank you, Mr. Graves. I am now going to move
to questions, and I want to welcome our witnesses.
I know I have you seated Elwell to Sumwalt, but I actually
want to go Sumwalt to Elwell, in terms of order, to let Chair
Sumwalt discuss a little bit about the investigations as they
sit today. But I want to welcome our witnesses.
Mr. Dan Elwell, Acting Administrator, Federal Aviation
Administration. He is accompanied by Earl Lawrence, Executive
Director of Aircraft Certification of the FAA, and I understand
Mr. Lawrence is here for technical support, is available to
answer questions, but Mr. Elwell will be giving the testimony.
And then Mr. Sumwalt is Chair of the National
Transportation Safety Board, and he is accompanied by Ms. Dana
Schulze, Acting Director, Office of Aviation Safety of the
NTSB.
As well, Chair Sumwalt will give the testimony for NTSB,
and Director Schulze is available to help with any technical
questions.
Without objection, our witnesses' full statements will be
included the record.
Since your written testimony has been made part of the
record, the subcommittee does request you limit your oral
testimony to 5 minutes.
And Chair Sumwalt, you are recognized now for 5 minutes,
thank you.
TESTIMONY OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL
TRANSPORTATION SAFETY BOARD; ACCOMPANIED BY DANA SCHULZE,
ACTING DIRECTOR, OFFICE OF AVIATION SAFETY, NATIONAL
TRANSPORTATION SAFETY BOARD
Mr. Sumwalt. Thank you, and good morning, Chairman Larsen,
Ranking Member Graves, Chairman DeFazio, and Ranking Member
Graves, members of the subcommittee. Thank you for allowing the
NTSB to testify before you this morning.
As you mentioned, accompanying me this morning is Ms. Dana
Schulze, who is the acting director of the NTSB's Office of
Aviation Safety.
As you are well aware, during a recent 5-month period there
have been two crashes involving the 737 MAX. Tragically, these
two crashes have claimed 346 lives. And I say this next
statement with all sincerity, it is not a cliche, but our
thoughts and prayers go to the families of those victims.
Now, unlike the NTSB's involvement in domestic aviation
accidents, where we have a statutory responsibility to
investigate every civil aviation accident that occurs within
the U.S., our involvement with international investigations is
vastly different. The NTSB's role in accident investigation in
accidents that occur outside of the United States is governed
by Annex 13 to the Convention of the International Civil
Aviation Organization, to which 193 countries, including the
U.S., are signatories.
Annex 13 states that a safety investigation be led in the
country in which the accident occurs, known as the state of
occurrence. Thus, the KNKT of Indonesia is leading the
investigation into last year's Lion Air crash. And likewise,
the Ethiopia Accident Investigation Bureau is leading the
investigation into the Ethiopian Airlines crash.
When the accident involves a U.S. operated or registered
aircraft, or U.S. designed or manufactured aircraft, as these
aircraft were, the NTSB appoints an accredited representative.
This is a highly skilled NTSB investigator whose purpose is to
coordinate the input of all U.S. interests, including NTSB,
FAA, and U.S. companies such as the manufacturers and others
that can provide technical expertise.
It is important to note that the state of occurrence leads
the investigation and controls the release of public
information from that accident investigation, not the NTSB.
Now, that said, NTSB participation in foreign accident
investigations enables access to investigative data and
information needed by the FAA, the manufacturer, or the
operator to address safety deficiencies, as well as by the
NTSB, so we can issue safety recommendations when necessary. We
work closely with the involved accident investigation
authorities to ensure that we receive the information we need
to sufficiently address safety deficiencies.
Following last year's Lion Air crash we immediately
dispatched investigators to Indonesia to participate in the
Indonesian Government's investigation. An NTSB investigator was
stationed onboard one of the search vessels to help identify
recovered aircraft components. And once the cockpit voice
recorder was recovered in January, we recalled four
investigators who were furloughed during the partial Government
shutdown. Their role was to assist with the recorder download
and analysis.
We responded immediately to the Ethiopian Airlines crash by
sending a team of investigators to Ethiopia. And once the
recorders were sent to our aviation counterparts in France, the
BEA, we dispatched investigators to France to assist with the
recorder download and read-out.
Within 30 days of each crash the Indonesian and Ethiopian
authorities issued a preliminary report regarding their
respective investigations. NTSB provided technical comments for
each of these reports.
Last week Ms. Schulze traveled to Addis to meet with
Ethiopian officials regarding the investigation, and in the
coming weeks the U.S. team will return to Ethiopia to work
further with those authorities.
Because the U.S. is the state of design and certification
of the 737, we are also examining the design certification
process as a part of our participation in these foreign-led
investigations. Our review is continuing, and if we uncover
safety deficiencies we are prepared to quickly issue safety
recommendations aimed at correcting such deficiencies.
Our commitment to the traveling public, and especially to
those families affected by these two tragic events, is to bring
all of our experience and expertise in support of the
international effort to determine why these accidents occurred
and, most importantly, to ensure that no similar accident like
these occurs again.
Thank you. We will be happy to answer your questions.
[Mr. Sumwalt's prepared statement follows:]
Prepared Statement of Hon. Robert L. Sumwalt III, Chairman, National
Transportation Safety Board
Good afternoon, Chairman Larsen, Ranking Member Graves, and Members
of the Subcommittee. Thank you for inviting the National Transportation
Safety Board (NTSB) to testify before you today.
Congress established the NTSB in 1967 as an independent agency
within the United States Department of Transportation (DOT) with a
clearly defined mission to promote a higher level of safety in the
transportation system. In 1974, Congress reestablished the NTSB as a
separate entity outside of the DOT, reasoning that ``no federal agency
can properly perform such (investigatory) functions unless it is
totally separate and independent from any other . . . agency of the
United States.'' \1\ Because the DOT has broad operational and
regulatory responsibilities that affect the safety, adequacy, and
efficiency of the transportation system, and transportation accidents
may suggest deficiencies in that system, the NTSB's independence was
deemed necessary for proper oversight.
---------------------------------------------------------------------------
\1\ Independent Safety Board Act of 1974 Sec. 302, Pub. L. 93-633,
88 Stat. 2166-2173 (1975).
---------------------------------------------------------------------------
The NTSB is charged by Congress with investigating every civil
aviation accident in the United States and significant accidents in
other modes of transportation--highway, rail, marine, and pipeline. We
determine the probable cause of the accidents we investigate, and we
issue recommendations to federal, state, and local agencies, as well as
other entities, aimed at improving safety, preventing future accidents
and injuries, and saving lives. The NTSB is not a regulatory agency--we
do not promulgate operating standards nor do we certificate
organizations and individuals. The goal of our work is to foster safety
improvements, through formal and informal safety recommendations, for
the traveling public.
Our Office of Aviation Safety investigates all civil domestic air
carrier, commuter, and air taxi accidents; general aviation accidents;
and certain public-use aircraft accidents, amounting to approximately
1,400 investigations annually. We also participate in investigations of
major airline accidents in foreign countries that involve US carriers,
US-manufactured or -designed equipment, or US-registered aircraft.
For the last decade, the US aviation system has experienced a
record level of safety, and the number of US-registered civil aviation
accidents has declined overall.\2\ Aviation deaths in the United States
decreased from 412 in 2016 to 350 in 2017. Nearly 94 percent of
aviation fatalities (330 instances in 2017) occur in general aviation
accidents, with the remainder primarily in Title 14 Code of Federal
Regulations (CFR) Part 135 operations, which include charters, air
taxis, and air medical services flights. Until 2018, there had been no
passenger fatalities as a result of accidents involving US air carriers
operating under the provisions of 14 CFR Part 121 since the crash of
Colgan Air flight 3407 in 2009. Between February 2009, when Colgan Air
crashed near Buffalo, New York, and April 2018, there were no passenger
fatalities involving 14 CFR Part 121 US air carriers.\3\ On April 17,
2018, a Boeing 737-700 experienced an engine failure at cruise
altitude, resulting in damage to a cabin window and the partial
ejection of a passenger, who subsequently died from her injuries.\4\
Over the last several decades, significant advances in technology,
important legislative and regulatory changes, and more comprehensive
crew training have contributed to the current level of aviation safety.
However, we continue to see accidents and incidents that remind us of
the need to be ever vigilant.
---------------------------------------------------------------------------
\2\ National Transportation Safety Board, 2017 preliminary aviation
statistics [https://www.ntsb.gov/investigations/data/Documents/
AviationAccidentStatistics_1998-2017_
20181019.xlsx]. Accident data for calendar year 2018 are still being
validated and have not yet been released.
\3\ National Transportation Safety Board, Loss of Control on
Approach, Colgan Air, Inc., Operating as Continental Connection Flight
3407, Bombardier DHC 8 400, N200WQ [https://www.ntsb.gov/
investigations/AccidentReports/Reports/AAR1001.pdf], Rpt. No. AAR-10/01
(Washington, DC: NTSB, 2012). In 2013, there were two fatal accidents
involving nonscheduled cargo flights operating under Part 121--National
Air Cargo crash [https://app.ntsb.gov/pdfgenerator/
ReportGeneratorFile.ashx?EventID=20130429X12734&AKey=1&RType=Final&IType
=MA] after takeoff at Bagram Air Base, Afghanistan, and United Parcel
Service flight 1354 [https://app.ntsb.gov/pdfgenerator/
ReportGeneratorFile.ashx?EventID=20130814X15751&
AKey=1&RType=Final&IType=MA] crash during approach in Birmingham,
Alabama.
\4\ The Southwest Airlines flight 1380 [https://www.ntsb.gov/
investigations/Pages/DCA18MA142.aspx] investigation is ongoing. An
investigative hearing [https://www.ntsb.gov/news/events/Pages/2018-
DCA18MA142-IH.aspx] was conducted on November 14, 2018.
---------------------------------------------------------------------------
This testimony will explain our role in international
investigations and inform the subcommittee about our current
participation in recent accidents involving Boeing 737 MAX 8 aircraft
in Indonesia and Ethiopia.
ntsb's role in foreign investigations
The NTSB participates in the investigation of aviation accidents
and serious incidents outside the United States in accordance with the
Chicago Convention of the International Civil Aviation Organization
(ICAO) and the Standards and Recommended Practices (SARPS) provided in
Annex 13 to the Convention.\5\ If an accident or serious incident
occurs in a foreign state involving a US-registered civil aircraft, US
operator, or US-designed or manufactured aircraft, and the foreign
state is a signatory to the ICAO Convention, that state is responsible
for the investigation and controls the release of all information
regarding the investigation.\6\
---------------------------------------------------------------------------
\5\ ICAO is a UN specialized agency that manages the administration
and governance of the Convention on International Civil Aviation
(Chicago Convention), (https://www.icao.int/about-icao/Pages/
default.aspx).
\6\ There are 193 Member States of ICAO, including both Indonesia
and Ethiopia, (https://www.icao.int/MemberStates/
Member%20States.English.pdf).
---------------------------------------------------------------------------
In accordance with the ICAO Annex 13 SARPS, upon receiving a formal
notification of the accident or serious incident that may involve
significant issues, the NTSB may designate the US Accredited
Representative and appoint technical advisors to carry out the
obligations, receive investigative information and updates in
accordance with the annex, provide consultation, and receive safety
recommendations from the state of occurrence. The advisors may include
NTSB investigators with subject matter expertise, as well as others
from US manufacturers, operators, and the Federal Aviation
Administration (FAA).
The following are the key objectives of our participation in
international aviation accident investigations:
Identify safety deficiencies affecting US aviation
interests
Capture safety lessons learned to prevent accidents in
the US
Facilitate credible and comprehensive accident
investigations where US interests are concerned
Given the international nature of air transportation and the
leading role the United States plays in developing aviation technology,
our participation in foreign investigations is essential to enhancing
aviation safety worldwide. In 2018, we appointed accredited
representatives to 324 international investigations, and traveled to
support work on 17 of those investigations.\7\
---------------------------------------------------------------------------
\7\ The NTSB appointed an accredited representative to 203
accidents, 97 incidents, and 24 other safety-related occurrences in
2018. NTSB traveled in support of 9 of these accidents and 8 of the
incidents.
---------------------------------------------------------------------------
recent boeing 737-max 8 crashes
On October 29, 2018, a Boeing 737 MAX 8, operated by Lion Air,
crashed into the Java Sea shortly after takeoff from Soekarno-Hatta
International Airport, in Jakarta, Indonesia, killing all 189
passengers and crew on board. The Komite Nasional Keselamatan
Transportasi (KNKT) of Indonesia, who is leading the investigation,
released a preliminary report on the accident on November 27, 2018.\8\
On March 10, 2019, a Boeing 737 MAX 8, operated by Ethiopian Airlines,
crashed after takeoff from Addis Ababa Bole International Airport in
Ethiopia, killing all 157 passengers and crew, including 8 American
citizens. The investigation is being led by the Ethiopia Accident
Investigation Bureau (AIB), which released a preliminary report on
April 4, 2019.\9\
---------------------------------------------------------------------------
\8\ Komite Nasional Keselamatan Transportasi, Preliminary Report
No. KNKT.18.10.35.04 [https://knkt.dephub.go.id/knkt/ntsc_aviation/
baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf].
\9\ Ethiopia Accident Investigation Bureau, Report No. AI-01/19
[http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-
800MAX+%2C%28ET-AVJ%29.pdf/4c65422d-5e4f-4689-9c58-d7af1ee17f3e].
---------------------------------------------------------------------------
Because the MAX 8 was designed, certified, and manufactured in the
United States, in accordance with ICAO Annex 13, the United States is
afforded the right to participate in both investigations. Accordingly,
the NTSB appointed accredited representatives to assist in both ongoing
investigations.
Following last year's Lion Air crash, the NTSB immediately
dispatched investigators to Indonesia to participate in the Indonesian
government's investigation. An NTSB investigator was stationed onboard
one of the search vessels during the search for the critical ``black
boxes''--the flight data recorder (FDR) and cockpit voice recorder
(CVR). When the CVR was recovered on January 14, 2019, the NTSB
recalled four investigators from furlough (due to the partial
government shutdown) to assist with properly transcribing the
recorder's content.\10\
---------------------------------------------------------------------------
\10\ Due to a lapse of appropriations from December 22, 2018,
through January 25, 2019, the NTSB furloughed all investigative staff.
In accordance with the provisions of the Anti-Deficiency Act (including
sections 1341(a)(1)(B) and 1342 of Title 31, United States Code),
allowable agency functions were limited to those where ``failure to
perform those functions would result in an imminent threat to the
safety of human life or the protection of property.'' Due to the
potential safety issues associated with the Lion Air crash, the NTSB
responded by recalling four investigative staff from furlough to
participate in the CVR readout.
---------------------------------------------------------------------------
In response to the Ethiopian Airlines crash, the NTSB also
appointed an accredited representative, whom we dispatched to Ethiopia
with a team of investigators. Once the recovered recorders were sent to
the Bureau d'Enquetes et d'Analyses pour la Securite de l'Aviation
Civile, we sent recorder, flight crew operations, and human factors
investigators to France to assist with downloading and reading out the
recorders' contents.
In accordance with ICAO Annex 13, technical advisors from the FAA,
Boeing, and General Electric have accompanied NTSB investigators to the
Lion Air and Ethiopian Airlines accident sites to provide their
specialized technical knowledge regarding the aircraft and its systems.
Although the NTSB is actively involved in these investigations,
ICAO Annex 13 requires that, as the states of occurrence, Indonesia and
Ethiopia are responsible for leading their respective investigations.
As such, they control the release of all investigative information to
the public related to those accidents. Annex 13 provides for other
involved states to gain timely access to investigative information for
the purposes of continued operational safety, however. As a result,
NTSB participation in foreign accident investigations enables safety
deficiencies to be promptly addressed by the FAA, the manufacturer, or
the operator, as well as others deemed appropriate, and through NTSB
safety recommendations, when needed. Because the United States is the
state of design and certification of the aircraft involved in these
accidents, we are examining relevant factors in the US design
certification process to ensure any deficiencies are captured and
addressed, including by NTSB safety recommendations, if necessary.
Summary of Lion Air 610 Preliminary Report
The FDR recovered from the Lion Air crash contained about 69 hours
of data, covering the last 18 flights prior to the accident flight. The
preliminary report released by the KNKT indicated that the left angle-
of-attack (AOA) sensor \11\ on the accident aircraft was replaced on
October 27, 2018, due to an ongoing airspeed and altitude issue that
had been reported by previous flight crews (there was a difference
between the captain's and first officer's displayed airspeed and
altitude). The aircraft's next flight--which was also the flight prior
to the accident flight--occurred on October 28, 2018, from Ngurah Rai
International Airport in Bali to Jakarta. On this flight, the FDR data
indicate that the captain's AOA data was approximately 20 degrees
higher than the first officer's AOA data, from airplane startup until
the end of the flight. The FDR data also indicate that the captain's
stick shaker activated immediately after rotation, followed by an
airspeed and altitude miscompare warning.\12\ As the airplane continued
its climb after takeoff, the captain noticed that the stabilizer was
automatically trimming in the airplane nose down (AND) direction. As a
result, the captain engaged the automatic trim system cut-out switches
and adjusted the stabilizers manually. The flight crew informed air
traffic control (ATC) that they had an urgent situation and then
conducted three different non-normal checklists. The flight crew
elected to continue to their destination, Jakarta, and the remainder of
the 96-minute flight was uneventful. After landing in Jakarta, the
captain wrote up two issues in the maintenance logs: 1) there was a
disagreement between the captain's and first officer's airspeed and
altitude data, and 2) there was a fault in the elevator feel system.
The maintenance personnel flushed the left pitot/static system and
cleaned the electrical connector plug for the elevator feel computer.
Both systems were then tested on the ground and no faults were noted.
---------------------------------------------------------------------------
\11\ Angle of attack (AOA) is the angle between the relative wind
and the wing chord line. The 737 MAX has two AOA sensors, one on each
side of the forward fuselage, that measure the direction of airflow
relative to the airplane during flight using a mechanical vane in each
sensor.
\12\ The stick shaker warns a pilot of an impending wing
aerodynamic stall through vibrations on the control column, providing
tactile and aural cues.
---------------------------------------------------------------------------
The next day, October 29, 2018, Lion Air flight 610 departed from
Jakarta. The FDR indicated that the captain's AOA data was about 20
degrees higher than the first officer's AOA data, from airplane startup
until the end of the flight. The FDR data indicates that the captain's
stick shaker activated immediately after rotation, followed by an
airspeed and altitude miscompare warning. The first officer asked ATC
to advise them of their airspeed and altitude, then indicted that they
were experiencing a flight control problem and subsequently asked to
return to the airport for landing. After the flaps were retracted, the
data show that there was a 2.5-degree automatic AND stabilizer
activation, followed by the flight crew commanding airplane nose up
(ANU) stabilizer with ANU trim. The FDR data show that another
automatic AND stabilizer activation occurred several seconds after the
first, which was countered by the flight crew with ANU trim. The flight
crew then extended the flaps, which stopped the automatic AND trim
inputs. About 2 minutes later, the flight crew again retracted the
flaps. There were then 25 automatic AND stabilizer activations that
occurred until the end of the flight (approximately 6:20 minutes). The
flight crew commanded ANU stabilizer trim after each of these automatic
inputs. In the last 50 seconds, the ANU input by the crew was not
sufficient to completely counter the AND inputs, and the stabilizer
moved to almost the full AND position before the end of the data.
The captain of the accident flight had about 6,000 total flight
hours, with about 5,100 hours on the Boing 737. The first officer had
about 5,200 total flight hours, with about 4,300 hours in the Boeing
737. We do not have information regarding the number of flight hours in
a Boeing 737 MAX.
Summary of Ethiopian Airlines 302 Preliminary Report
On March 10, 2019, Ethiopian Airlines flight 302 departed Addis
Ababa. According to the preliminary report released by the AIB, the FDR
data indicate that during startup, taxi, and takeoff ground roll, the
captain's and first officer's AOA data was normal and identical. The
throttle levers were set to takeoff and remained in the takeoff
position for the entire flight. Several seconds after rotation, the
captain's AOA data stepped up to about 75 degrees and his stick shaker
activated, while the first officer's AOA data remained in the normal
range throughout the flight. Concurrently, the flight crew received an
airspeed and altitude disagree warning (the captain's airspeed and
altitude values were lower than the first officer's values). Shortly
after this, the flight crew also received an anti-ice warning. The
captain then attempted to engage the autopilot three times; the
autopilot engaged after the third attempt, as the airplane climbed
through about 1,000 feet above the ground. The airplane continued to
accelerate, and the flight crew retracted the flaps when the airspeed
was about 240 knots. The flight crew then requested to maintain the
runway heading (instead of turning on course), and reported that they
were having flight control problems.
Shortly after the autopilot disengaged, an AND command moved the
stabilizer approximately 2.5 degrees in the nose down direction (from
4.6 to 2.1 units), and the airplane momentarily descended as the
Enhanced Ground Proximity Warning System (EGPWS) annunciation alerted.
Approximately 3 seconds after the AND stabilizer movement stopped, the
flight crew commanded ANU stabilizer input of about 0.3 degrees (from
2.1 to 2.4 units). Approximately 5 seconds after the end of the ANU
stabilizer motion, a second automatic AND stabilizer command occurred,
and the stabilizer moved about 2.0 degrees AND (from 2.4 to 0.4 units).
The flight crew interrupted the automatic movement by commanding 1.9
degrees of ANU stabilizer trim (from 0.4 to 2.3 units). During this
time, the captain asked the first officer to help him, and there were
three EGPWS aural alerts. Shortly after, the first officer stated
``stab trim cut-out'' two times. The captain agreed and the first
officer confirmed that the stabilizer trim cut-out switches were
engaged. The FDR data indicates that, after that, there was another AND
command recorded without any corresponding movement of the stabilizer
(which is consistent with the stabilizer cut-out switches being
engaged). The first officer told ATC that the flight would like to
level off at 14,000 feet, and that they were having flight control
problems. For the next approximately 2.5 minutes, the stabilizer
position moved about 0.2 degrees AND (from 2.3 to 2.1), and aft force
continued to be applied to the control columns, which remained aft of
the neutral position. During this time, the captain asked the first
officer if the trim was functional. The first officer replied a short
time later that the trim was not working but asked if he could try it
manually. The captain told him to try. About 8 seconds later, the first
officer replied that it was not working. About 32 seconds before the
end of the recording, at approximately 13,400 feet, the flight crew
commanded two ANU momentary electric trim inputs, and the stabilizer
moved about 0.2 degrees ANU (from 2.1 to 2.3 units). Then, about 5
seconds after the last crew-commanded electric trim inputs, an
automatic AND stabilizer command moved the stabilizer about 1.3 degrees
(from 2.3 to 1.0) over approximately 5 seconds, and the airplane began
to pitch nose down. The flight crew applied additional aft column
force, but the airplane continued to pitch nose down, eventually
reaching 40 degrees nose down. During the pitch over, the captain's
airspeed increased to about 460 knots, and the first officer's airspeed
reached about 500 knots; the captain's AOA data decreased and varied
proportionally to the normal load factor.
The captain of the accident flight had about 8,100 total flight
hours, which included about 1,400 hours in a Boeing 737 and about 100
hours in the Boeing 737 MAX. The first officer had about 360 total
flight hours, including about 200 hours in the Boeing 737 with about 56
hours in a Boeing 737 MAX.
conclusion
Thank you again for the opportunity to be here today to discuss the
NTSB's role in international aviation accident investigations and to
highlight our current participation in recent accidents involving
Boeing 737 MAX 8 aircraft in Indonesia and Ethiopia. I will be happy to
answer any questions.
Mr. Larsen. Thank you, Chair Sumwalt.
I now recognize Acting Administrator Dan Elwell for 5
minutes.
TESTIMONY OF DANIEL K. ELWELL, ACTING ADMINISTRATOR, FEDERAL
AVIATION ADMINISTRATION; ACCOMPANIED BY EARL LAWRENCE,
EXECUTIVE DIRECTOR OF AIRCRAFT CERTIFICATION, FEDERAL AVIATION
ADMINISTRATION
Mr. Elwell. Chairman Larsen, Ranking Member Graves,
Chairman DeFazio, Ranking Member Graves, thank you for the
opportunity today to discuss aviation safety and the issues
surrounding the Boeing 737 MAX.
I also want to take this opportunity to express my
sincerest condolences on behalf of the entire FAA to the
victims and their families of both Ethiopian Airlines flight
302 and Lion Air flight 610.
I want to emphasize at the outset that the FAA welcomes
scrutiny that helps make us better. That is how our global
leadership and aviation safety will endure.
As you all know, the FAA grounded the U.S. 737 MAX fleet on
March 13th, 2019. That decision was based upon crash site
findings and satellite data that together indicated some
similarities between the Ethiopian and Indonesian accidents
that warranted further investigation of the possibility of a
shared cause. And I will focus my remarks today on events since
the grounding--in particular, the various ongoing reviews of
the FAA's processes and the work being done towards safely
returning the 737 MAX to service.
Our commitment to safety and fact-based, data-driven
decisionmaking has been the guiding principle in all of this.
After the grounding, several reviews were initiated to assess
the FAA processes, separate from evaluating any particular
technical fix for the 737 MAX.
On March 19th, Secretary Chao asked the Department of
Transportation's inspector general to conduct an audit of the
Boeing 737 MAX 8 certification with the goal specifically to
compile an objective and detailed history of the activities
that led to certification. That audit is ongoing, with the
cooperation of the FAA.
Secretary Chao on March 25th announced the establishment of
a special committee to review the FAA's procedures for the
certification of new aircraft, including the Boeing 737 MAX.
The special committee is an independent body whose findings and
recommendations will be presented directly to the Secretary and
the FAA Administrator.
On April 2nd the FAA launched a Joint Authorities Technical
Review, JATR, to review the certification of the 737 MAX
automated flight control system. The JATR is chaired by former
NTSB Chairman Christopher Hart, and comprises a team of U.S.
experts and international aviation authorities.
The 737 MAX return to service is not contingent on these
reviews. Rather, the reviews are geared towards developing
systemic improvements for the future. Now I will talk about the
FAA's efforts to safely return the 737 MAX to service here and
abroad. As the FAA discussed in an informational notice for 737
MAX operators on March 20th, Boeing has been working on a
service bulletin that would specify the installation of new
flight control computer operational program software, and has
developed flightcrew training related to this software.
On April 12th the FAA met with safety representatives of
the three U.S.-based commercial airlines that fly the Boeing
737 MAX, as well as the pilot unions for those airlines. And
this unprecedented meeting was an opportunity for the FAA to
hear individual views from operators and pilots. The FAA
recently solicited public comment on a draft report prepared by
the FAA's Boeing 737 MAX Flight Standardization Board. That
board consists of pilots, and we use it to evaluate Boeing's
proposed training associated with Boeing's proposed software
enhancements for the 737 MAX.
On May 6th we initiated a multi-agency Technical Advisory
Board, or TAB, to review Boeing's MCAS software update and
system safety assessment. The TAB includes experts from the
U.S. Air Force, NASA, Volpe, and the FAA. And none of these
experts were involved in the original certification of the 737
MAX. The TAB's recommendations will directly inform our
decisions on the 737 MAX fleet's return to service.
And next week, on May 23rd, the FAA will host a meeting of
directors general of civil aviation authorities from around the
world to discuss the FAA's activities toward ensuring the safe
return of the 737 MAX to service. This meeting is part of the
FAA's efforts to work with other civil aviation authorities to
address specific concerns related to the 737 MAX, in keeping
with the FAA's longstanding cooperation with our international
partners.
As our work continues I want to offer this assurance: In
the U.S., the 737 MAX will return to service only when the
FAA's analysis of the facts and technical data indicate that it
is safe to do so.
This concludes my prepared statement. I welcome your
questions.
[Mr. Elwell's prepared statement follows:]
Prepared Statement of Daniel K. Elwell, Acting Administrator, Federal
Aviation Administration
Chairman Larsen, Ranking Member Graves, Members of the
Subcommittee:
Thank you for the opportunity to appear before you today to discuss
aviation safety and the issues surrounding the Boeing 737 MAX. On
behalf of the United States Department of Transportation and the
Federal Aviation Administration, we would like to take this opportunity
to, once again, extend our deepest sympathy to the families of the
victims of the Ethiopian Airlines and Lion Air accidents.
Safety is the core of the Federal Aviation Administration's mission
and our top priority. With the support of this Committee, we have
worked tirelessly to take a more proactive, data-driven approach to
oversight that prioritizes safety above all else inside the FAA and
within the aviation community that we regulate. The result of this
approach is that the United States has the safest air transportation
system in the world. Since 1997, the risk of a fatal commercial
aviation accident in the United States has been cut by 94 percent. And
in the past ten years, there has been one commercial airline passenger
fatality in the United States in over 90 million flights. But, one
fatality is one too many, and a healthy safety culture requires
commitment to continuous improvement.
Our commitment to safety and fact-based, data-driven decision
making has been the guiding principle in the FAA's response to the two
fatal accidents involving the Boeing 737 MAX airplane outside the
United States. Today, I would like to provide you with an overview of
the FAA's certification and oversight processes, our current actions
with respect to the 737 MAX, and the steps that the FAA is taking to
foster safety enhancements here and abroad.
the faa is a data-driven agency focused on safety
As the aerospace system and its components become increasingly more
complex, we know that our oversight approach needs to evolve to ensure
that the FAA remains the global leader in achieving aviation safety. In
order to maintain the safest air transportation system in the world,
during the past two decades the FAA has been evolving from a
prescriptive and more reactive approach for its safety oversight
responsibilities to one that is performance-based, proactive, centered
on managing risk, and focused on continuous improvement. A key part of
this transition has been the adoption of safety management systems, or
SMS, within the FAA. The evolution toward SMS began internally at the
FAA more than 15 years ago, starting with the FAA's Air Traffic
Organization and expanding across the FAA to include all of our lines
of business. Consistent with recommendations of the International Civil
Aviation Organization (ICAO), we have been working towards
implementation of SMS in various sectors. For example, as of March 9,
2018, scheduled commercial air carriers, regulated under 14 CFR part
121, are required to have an SMS.
Safety is not just a set of programs that can be ``established'' or
``implemented.'' It is a way of living and working, and it requires the
open and transparent exchange of information. We know that it takes
collaboration, communication, and common safety objectives to allow the
FAA and the aviation community to come together, to identify system
hazards, and to implement safety solutions. This approach gives us
knowledge that we would not otherwise have about events and risks.
Sharing safety issues, trends, and lessons learned is critical to
recognizing whatever might be emerging as a risk in the system. The
more data we have, the more we can learn about the system, which in
turn allows us to better manage and improve the system.
To be clear, the SMS approach does not diminish the FAA's role as a
safety regulator. Any party that the FAA regulates remains responsible
for compliance with the FAA's regulatory standards, and the FAA does
not hesitate to take enforcement action when it is warranted.
aircraft certification
Information sharing is a cornerstone of aviation safety and has
significantly contributed to the United States' outstanding safety
record. One of the FAA's core functions, aircraft certification, has
always relied on the exchange of information and technical data. The
FAA certifies the design of aircraft and components that are used in
civil aviation operations. Some version of our certification process
has been in place and served us well for over 60 years. This does not
mean the process has remained static. To the contrary, since 1964, the
regulations covering certification processes have been under constant
review. As a result, the general regulations have been modified over 90
times, and the rules applicable to large transport aircraft, like the
Boeing 737 MAX, have been amended over 130 times. The regulations and
our policies have evolved in order to adapt to an ever-changing
industry that uses global partnerships to develop new, more efficient,
and safer aviation products and technologies. What has not changed is
that, for any new project, the FAA identifies all safety standards and
makes all key decisions regarding certification of the aircraft.
The FAA focuses its efforts on areas that present the highest risk
within the system. The FAA reviews the applicant's design descriptions
and project plans, determines where FAA involvement will derive the
most safety benefit, and coordinates its intentions with the applicant.
When a particular decision or event is critical to the safety of the
product or to the determination of compliance, the FAA is involved
either directly or through the use of our designee system.
The use of designation, in some form, has been a vital part of our
safety system since the 1920s. Congress has continually expanded the
designee program since creation of the FAA in 1958, and it is critical
to the success and effectiveness of the certification process. Under
this program, the FAA may delegate a matter related to aircraft
certification to a qualified private person. This is not self-
certification; the FAA retains strict oversight authority. The program
allows the FAA to leverage its resources and technical expertise while
holding the applicant accountable for compliance. During the past few
years, Congress has endorsed FAA's delegation authority, including in
the FAA Reauthorization Act of 2018, which directed the FAA to delegate
more certification tasks to the designees we oversee.
In aircraft certification, both individual and organizational
designees support the FAA. The FAA determines the level of involvement
of the designees and the level of FAA participation needed based on
many variables. These variables include the designee's understanding of
the compliance policy; consideration of any novel or unusual
certification areas; or instances where adequate standards may not be
in place.
The Organization Designation Authorization (ODA) program is the
means by which the FAA may authorize an organization to act as a
representative of the FAA under strict FAA oversight. Currently, there
are 79 ODA holders. ODA certification processes allow FAA to leverage
industry expertise in the conduct of the certification activities and
focus on important safety matters. The FAA has a rigorous process for
issuing an ODA and only grants this authorization to mature companies
with a proven history of designing products that meet FAA safety
standards. ODA holders must have demonstrated experience and expertise
in FAA certification processes, a qualified staff, and an FAA-approved
procedures manual before they are appointed. The FAA delegates
authority on a project-by-project basis, and the manual defines the
process and procedures to which the ODA must adhere when executing the
delegated authority. The ODA holder is responsible to ensure that ODA
staff are free to perform their authorized functions without conflicts
of interest or undue pressure.
There are many issues that will always require direct FAA
involvement, including equivalent level of safety determinations, and
rulemakings required to approve special conditions. The FAA may choose
to be involved in other project areas after considering factors such as
our confidence in the applicant, the applicant's experience, the
applicant's internal processes, and confidence in the designees.
Something that is not well understood about the certification
process is that it is the applicant's responsibility to ensure that an
aircraft complies with FAA safety regulations. It is the applicant who
is required to develop aircraft design plans and specifications, and
perform the appropriate inspections and tests necessary to establish
that an aircraft design complies with the regulations. The FAA is
responsible for determining that the applicant has shown that the
overall design meets the safety standards. We do that by reviewing data
and by conducting risk-based evaluations of the applicant's work.
The FAA is directly involved in the testing and certification of
new and novel features and technologies. When a new design, or a change
to an existing design, of an aircraft is being proposed, the designer
must apply to the FAA for a design approval. While an applicant usually
works on its design before discussing it with the FAA, we encourage
collaborative discussions well in advance of presenting a formal
application. Once an applicant informs the FAA of the intent to develop
and certify a product, a series of meetings are held both to
familiarize the FAA with the proposed design, and to familiarize the
applicant with the certification requirements. A number of formal and
informal meetings are held on issues ranging from technical to
procedural. Once the application is made, issue papers are developed to
provide a structured way of documenting the resolution of technical,
regulatory, and administrative issues that are identified during the
process.
Once the certification basis is established for a proposed design,
the FAA and the applicant develop and agree to a certification plan and
initial schedule. In order to receive a type certificate, the applicant
must conduct an extensive series of tests and reviews to show that the
product is compliant with existing standards and any special
conditions, including lab tests, flight tests, and conformity
inspections. These analyses, tests, and inspections happen at a
component-level and an airplane-level, all of which are subject to FAA
oversight. If the FAA finds that a proposed new type of aircraft
complies with safety standards, it issues a type certificate. Or, in
the case of a change to an existing aircraft design, the FAA issues an
amended type certificate.
facts concerning the boeing 737 max
While the FAA is always striving to improve safety, the
certification processes described above are extensive, well-
established, and have consistently produced safe aircraft designs for
decades. The Boeing Company has designed and built 14 variations of its
original model 737 since the FAA issued the original type certificate
in 1967. Following standard certification procedures, and based on the
information Boeing provided, the FAA determined in February 2012 that
the 737 MAX qualified as an amended type certificate project eligible
for management by the Boeing ODA. The formal application was submitted
in June 2012. Under such an arrangement, FAA subject matter experts are
directly involved in safety related aspects of the project. For
example, the FAA was directly involved in the System Safety Review of
the Maneuvering Characteristics Augmentation System (MCAS).
The process from initial application to final certification took
five years; the 737 MAX was certified in March 2017. The process
included 297 certification flight tests, some of which encompassed
tests of the MCAS functions. FAA engineers and flight test pilots were
involved in the MCAS operational evaluation flight test. During the
FAA's continued oversight of airworthiness standards, as we obtain
pertinent information, identify potential risk, or learn of a system
failure, we analyze it, mitigate the risk, update the certification
requirements and require operators to implement the mitigation.
737 max accidents and the decision to ground the fleet
On October 29, 2018, a Boeing 737 MAX 8 operated by Lion Air as
flight JT610 crashed after taking off from Soekarno-Hatta Airport in
Jakarta, Indonesia. Flight JT610 departed from Jakarta with an intended
destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20
a.m. (local time), and crashed into the Java Sea approximately 13
minutes later. One hundred and eighty-four passengers and five
crewmembers were on board. There were no survivors. An Indonesian-led
investigation into the cause of this accident is ongoing, supported by
the National Transportation Safety Board (NTSB), FAA, and Boeing. A
preliminary report prepared by the Indonesian National Transportation
Safety Committee was released in November 2018.
On November 7, 2018, based on all available and relevant
information, including evidence from the Lion Air accident
investigation and analysis performed by Boeing, the FAA issued an
Emergency Airworthiness Directive. The airworthiness directive requires
operators of the 737 MAX to revise their flight manuals to reinforce
and emphasize to flight crews how to recognize and respond to
uncommanded stabilizer trim movement and MCAS events. The FAA continued
to evaluate the need for software and/or other design changes to the
aircraft including operating procedures and training as additional
information was received from the ongoing Lion Air accident
investigation. On January 21, 2019, Boeing submitted a proposed plan
for an MCAS software enhancement to the FAA for certification. To date,
the FAA has tested a prototype of this enhancement to the 737 MAX
flight control system in both the simulator and the aircraft. FAA
flight test engineers and flight test pilots performed a preliminary
evaluation of the prototype which included aerodynamic stall situations
and recovery procedures.
On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing
737 MAX 8, crashed at 8:44 a.m. (local time), six minutes after
takeoff. The flight departed from Bole International Airport in Addis
Ababa, Ethiopia with an intended destination of Nairobi, Kenya. The
accident site is near Bishoftu, Ethiopia. One hundred and forty-nine
passengers and eight crewmembers were on board. None survived. An
Ethiopian-led investigation into the cause of this accident is ongoing,
supported by the NTSB, FAA, and Boeing. A preliminary report prepared
by the Aircraft Accident Investigation Bureau of Ethiopia was released
in April 2019.
Following the second accident, the FAA gathered all of the data it
had regarding 737 MAX operations in the United States and continued to
review information from the investigation as it became available. On
March 11, 2019, the FAA issued a Continuous Airworthiness Notification
to the International Community (CANIC) for 737 MAX operators. The CANIC
included a list of all of the activities the FAA had completed in
support of the continued operational safety of the 737 MAX fleet. These
activities included the airworthiness directive issued on November 7,
2018, ongoing oversight of Boeing's flight control system enhancements,
and updated training requirements and flight crew manuals.
After issuing the CANIC, the FAA continued to evaluate all
available data and aggregate safety performance from operators and
pilots of the 737 MAX, none of which provided any data to support
grounding the aircraft. Also, at that time, other civil aviation
authorities had not provided any data to the FAA that warranted action.
The FAA's initial review of flight safety data for U.S. operators
showed no systemic performance issues and provided no basis to order
grounding the aircraft.
On March 13, 2019, however, the Ethiopian Airlines investigation
developed new information from the wreckage concerning the aircraft's
configuration just after takeoff that, taken together with newly
refined data from satellite-based tracking of the aircraft's flight
path, indicated some similarities between the Ethiopian Airlines and
Lion Air accidents that warranted further investigation of the
possibility of a shared cause that needed to be better understood and
addressed. Accordingly, the FAA made the decision to ground all 737 MAX
airplanes operated by U.S. airlines or in U.S. territory pending
further investigation, including examination of information from the
aircraft's flight data recorders and cockpit voice recorders.
post-grounding actions
On March 19, 2019, Secretary Chao asked the U.S. Department of
Transportation's Inspector General to conduct an audit of the
certification for the Boeing 737 MAX 8, with the goal specifically to
compile an objective and detailed factual history of the activities
that resulted in the certification of the Boeing 737 MAX 8 aircraft.
That audit is ongoing, with the cooperation of the FAA.
On March 20, 2019, the FAA issued a second CANIC with updated
information for operators of the 737 MAX. Specifically, the CANIC
notified operators that Boeing had begun work on a Service Bulletin
that would specify the installation of new flight control computer
operational program software and had developed flightcrew training
related to this software. Boeing is still to submit the final software
package for certification. The FAA's ongoing review of this software
installation and training is an agency priority, as will be the roll-
out of any software, training, or other measures to operators of the
737 MAX.
On March 25, 2019, Secretary Chao announced the establishment of a
Special Committee to review the FAA's procedures for the certification
of new aircraft, including the Boeing 737 MAX. The Special Committee to
Review FAA's Aircraft Certification Process is an independent body
whose findings and recommendations will be presented directly to the
Secretary and the FAA Administrator. The Special Committee is formed
within the structure of the Safety Oversight and Certification Advisory
Committee (SOCAC) created by section 202 of the FAA Reauthorization Act
of 2018.
Further, on April 2, 2019, the FAA announced it was establishing a
Joint Authorities Technical Review (JATR) to conduct a comprehensive
review of the certification of the automated flight control system on
the Boeing 737 MAX. The JATR is chaired by former NTSB Chairman
Christopher Hart and comprises a team of experts from the FAA, National
Aeronautics and Space Administration (NASA), and the aviation
authorities of Australia, Brazil, Canada, China, the European Union,
Indonesia, Japan, Singapore, and the United Arab Emirates. On April 29,
the JATR initiated its review, with members tasked to provide the FAA
with their findings regarding the adequacy of the certification process
and any recommendations to improve the process. Completion of the
JATR's work is not a prerequisite for returning the 737 MAX to service.
Additionally, on April 12, 2019, the FAA convened a meeting at the
agency's Washington, D.C. headquarters with safety representatives of
the three U.S.-based commercial airlines that have the Boeing 737 MAX
in their fleets, as well as the pilot unions for those airlines. The
meeting covered three major agenda items: a review of the publicly
available preliminary findings of the investigations into the Lion Air
and Ethiopian Airlines accidents; an overview of the anticipated
software enhancements to the MCAS system; and, an overview of pilot
training. Each presentation corresponding to the agenda, delivered by
FAA subject matter experts, allowed for an open exchange between all
participants. This meeting was an opportunity for the FAA to hear
individual views from operators and pilots of the 737 MAX as the agency
evaluates what needs to be done before the FAA makes a decision to
return the aircraft to service in the United States.
The FAA recently solicited public comment on a draft report
prepared by the FAA's Boeing 737 MAX Flight Standardization Board
(FSB). The FSB is a panel that FAA utilizes to evaluate and determine
the sufficiency of proposed training developed by Boeing and related to
the proposed software enhancements for the 737 MAX aircraft. An FSB is
generally comprised of qualified pilots from FAA's Certificate
Management Offices, foreign authorities, and industry. The FSB report
outlines the minimum guidelines for an air carrier training program.
The comment period on the draft report has been extended multiple times
to ensure ample opportunity for public input. The FAA will review this
input before making a final assessment.
On May 6, 2019, the FAA initiated a multi-agency Technical Advisory
Board (TAB) review of the MCAS software update and system safety
assessment in order to determine sufficiency. The TAB consists of a
team of experts from the U.S. Air Force, NASA, Volpe National
Transportation Systems Center, and the FAA. None of the TAB experts
have been involved in any aspect of the Boeing 737 MAX certification.
The TAB is charged with evaluating Boeing and FAA efforts related to
the software update and its integration into the flight control system.
The TAB will identify issues where further investigation is required
prior to approval of the design change. Although the JATR is broadly
considering certification of the flight control systems, the TAB is
evaluating the proposed technical solutions. The TAB's recommendations
will directly inform the FAA's decision concerning the 737 MAX fleet's
return to service.
On May 23, 2019, the FAA will host a meeting of Directors General
of civil aviation authorities from around the world to discuss the
FAA's activities toward ensuring the safe return of the 737 MAX to
service. This meeting is part of the FAA's efforts to work with other
civil aviation authorities to address specific concerns related to the
737 MAX, in keeping with the FAA's longstanding cooperation with its
international partners. As recent events have reminded us, aviation
does not have borders or boundaries. The FAA is focused on continuous
safety improvement here at home and internationally through our ongoing
engagement with other civil aviation authorities and industry
stakeholders throughout the world. Aviation remains the safest mode of
transportation in the United States and globally, and we advance this
level of safety by sharing issues, trends, and lessons learned
throughout the world. The United States is the gold standard in
aviation safety. The FAA is resolute in its commitment to maintaining
that standard. In our quest for continuous safety improvement, the FAA
welcomes external review of our systems, processes, and
recommendations. And the 737 MAX will return to service for U.S.
carriers and in U.S. airspace only when the FAA's analysis of the facts
and technical data indicate that it is safe to do so.
This concludes my prepared statement. I will be happy to answer
your questions.
Mr. Larsen. Thank you very much for your statements, both
of you.
We are now going to move to Member questions. Each Member
will be recognized for 5 minutes, and I will start by
recognizing myself.
Administrator Elwell, this week the Wall Street Journal
reported the FAA internal review tentatively determined senior
agency officials did not participate in or monitor critical
safety assessments of the 737 MAX flight control system.
It also noted the FAA deferred to Boeing's early safety
classification and the subsequent analysis of potential hazards
that were performed with limited oversight by the agency.
Is that report accurate? And, if accurate, what explanation
does the FAA have for, I guess, falling down on the job?
Microphone.
Mr. Elwell. Thank you for that question, Chairman Larsen. I
think you are talking about the Wall Street Journal article of
yesterday. And we take all those articles and those charges or
reports seriously. But, frankly, there is nothing in that
article that led me to anything that I am aware of. So we will
certainly see what we can find out about it.
But--and I will ask my colleague, Earl, if he is aware of
what the article----
Mr. Larsen. Before you get to Mr. Lawrence, so the article
reported that the FAA's own assessment determined tentatively
that senior agency officials were not involved in this
assessment.
Mr. Elwell. I am not aware of an internal assessment----
Mr. Larsen. Mr. Lawrence?
Mr. Elwell [continuing]. That has reached that conclusion.
Mr. Lawrence. I am not aware of the internal assessment
that the article refers to.
Mr. Larsen. OK. Well, we have some homework, and you do,
too. But I think it does relate to the next set of questions
with regards to the ODA and the use of the ODA process.
Mr. Elwell, you previously stated--it was reported that you
stated that a full reversion of certification activities to the
FAA would require 10,000 additional FAA inspectors and $1.8
billion. I am not here to argue whether it is one more or one
less than that, but has the FAA considered moving back to the
previous designated--in June--representative system away from
the AR system? And what would that cost be?
Mr. Elwell. Chairman Larsen, I don't know what that cost
would be. I know that there are a number of investigations and
audits, as several opening statements have pointed out, that
are designed to look at the process.
I also know that our risk-based, data-driven systems
approach has, as Ranking Member Graves stated, led to the U.S.
safest system in history, and in the world. I am very, very
careful to make sure that the results of any inquiries,
investigations, audits bring us actionable information.
I mean, as I said, we welcome those investigations. We
welcome the audits. They make us better. But at this point, to
say that we are willing to go back to something before we have
gone through those investigations, I am not prepared to say
that. I really want to see what these investigations and these
audits have to say about our processes.
Mr. Larsen. So the current system with authorized
representatives, however, has ODA participants reporting, I
understand, to managers, as opposed to engineers. And under the
DER system the ODA designees were reporting to engineers.
Are you, through your assessment, looking at whether a
change from reporting to engineers, who can monitor engineers,
versus to managers, who are looking more at budgets--are you
looking at whether that process needs to be changed? Is that
going to be part of the--say, the blue ribbon commission's
look?
Mr. Elwell. Sir, I am not aware of any limit on what we are
going to look at. We are going to look at everything.
I would say that the Organization Designation
Authorization, ODA, as it exists today, is a process that has
developed over decades. We have had ODA in one form or another
since the beginning of the FAA. We have had delegation of
authority since 1927. The concept isn't new, it is the
administration of it.
In my mind, if we have robust oversight, and we have all
the protections in place to guard against conflicts of interest
or undue pressure, which I believe we currently have, it is a
good system. But it can always be made better. I mean, that is
what we are all about.
Mr. Larsen. And I will just conclude on that point, though,
that--I guess putting the faith in the evolution of the system
to get to where we are today isn't necessarily a positive
assessment of the system that we have. Just because it has
evolved since 1927 doesn't mean it has evolved to the place
where it needs to be or should be, and it perhaps has over-
evolved in this case, if you will.
So with that I will yield 5 minutes to Ranking Member
Graves of Louisiana.
Mr. Graves of Louisiana. Thank you, Mr. Chairman.
Raise your hand if you have a pilot's license in this room.
Raise your hand if you have been flying a plane when the
stick shaker has gone off.
So, wait, could you do that again? Hands up if the stick
shaker has gone off. So three of you, four of you. And did any
of you not turn the plane around, or come back and land when
that happened? Raise your hand if you kept going. Thank you.
Mr. Chairman, I just want to make note that no one raised
their hand in terms of continuing the flight. And the reason I
ask that question is that in both accidents stick shakers went
off and the planes didn't turn around. And I just--I find that
interesting, that in this case the planes didn't turn round.
Mr. Elwell, there has been a lot of confusing information
in the news media regarding what happened. And I have read a
few times where there has been reference to ``self-
certification.'' Could you clarify that? Do companies self-
certify their own aircraft?
Mr. Elwell. Mr. Graves, no, sir, they don't. We don't have
a program of self-certification.
ODA empowers private individuals at a company that has an
ODA program to do certain tasks and make certain decisions.
They are delegated with that authority that we then oversee.
And this isn't something that we give lightly. To be granted an
ODA is a privilege that a company earns. We have about 79 or 80
of them, I think.
And it is important to note that the vetting that is
required of the individuals in an ODA program and the ODA
program itself is very thorough and robust.
And to your point, Mr. Chairman, we are not resting on
that. We don't ever stay static on anything in the FAA, safety-
related. So we will continue to look at that.
And I have to my right Mr. Earl Lawrence, who is our
resident expert on ODA and the process, if I can allow him to
elaborate.
Mr. Lawrence. Thank you. I would like to build one point
under Mr. Elwell's comments, and it goes back to Chairman
Larsen's comment earlier.
In an ODA system we don't have engineers reporting to just
managers. We have engineers reporting to engineers, and those
engineers all have to be approved and vetted by the FAA. So the
head of an ODA is an engineer who has all those skills and
experiences that has to be approved by FAA engineers, as well.
Mr. Graves of Louisiana. Thank you.
Mr. Elwell, another question. Again, a lot of interesting
articles regarding the potential ungrounding of the MAX. Could
you describe the steps that the plane would have to go through
in order to be ungrounded, or to be able to fly again?
Mr. Elwell. Yes, sir. So I think that--just to go back a
little bit, it is important to lay the groundwork for it. We
grounded the U.S. fleet when we had the data to establish a
potential causal link between two accidents. That is the
justification for a grounding. And it is important that you
establish a link, because you then have what you need to
mitigate--to unground, or to remove the prohibition order.
So what we will do is we will receive Boeing's application
for a design modification to the MCAS system, and we will
thoroughly evaluate that and their system safety analysis. We
will evaluate the training required to certify that new
software system. And once we have made our analysis, we have
consulted with the TAB--which, by the way, is a third party,
third set of eyes that I think this committee recommended a
month or two ago that should be employed in this instance, and
we agree, and we initiated the TAB. And once we are absolutely
convinced of the safety, return to service, and we will do it.
Mr. Graves of Louisiana. Chairman Sumwalt, very quick, yes
or no. Do you believe that there are processes, programs, or
procedures that domestic airlines follow that may have
prevented these, based on your preliminary--prevented these
accidents, based on your preliminary reports?
Mr. Sumwalt. Ranking Member Graves, I apologize. Maybe it
is my ears, maybe it is the acoustics in the room. I am not
having--I am having difficulty hearing the question.
Mr. Larsen. We will have to come back to it. But we will,
we will.
I recognize Chair DeFazio for 5 minutes.
Mr. DeFazio. Thank you, Mr. Chairman.
Administrator Elwell, we were both in the Air Force. You
were a pilot, I wasn't. But my understanding is that the Air
Force has a minimum of two angle-of-attack sensors on its
planes, and sometimes as many as four. Does that sound right to
you?
Mr. Elwell. Sir, there are different numbers, depending on
the size of the aircraft.
Mr. DeFazio. Right. But never one.
Mr. Elwell. As far as I know, never one.
Mr. DeFazio. Right, OK.
Mr. Elwell. The planes I flew in the Air Force had at least
two.
Mr. DeFazio. OK. Then is the MCAS a safety critical system,
in your opinion?
Mr. Elwell. I didn't make that designation, but it seems to
me that, yes, it is.
Mr. DeFazio. OK, then why would it trigger with a single
point of failure? I mean isn't that kind of standard, that we
never have a safety critical system trigger off a single point
of failure?
Mr. Elwell. Sir, a single point of failure means that if
that component, or that part of the aircraft fails, it will
lead to an accident.
Mr. DeFazio. Well, in this case it led to triggering the
MCAS, which is safety critical.
Here, let me read you something. This--I got this from a
very, very experienced 737 pilot. ``If MCAS is not stopped by
the pilots at the completion of two full MCAS cycles--10
seconds, pause, 5 seconds, 10 seconds--horizontal stabilizer is
at or very close to the full nose-down limit of travel. At this
point the pilots do not have enough elevator authority to
overcome the horizontal stabilizer, and the nose of the
aircraft will continue to fall. The aircraft is no longer
controllable in pitch. The only possible recovery is to trim
the aircraft nose up, so the horizontal stabilizer moves to a
flyable position. This pilot would characterize an MCAS runaway
as having high potential to result in a drastic abrupt
maneuver.'' That sounds pretty radical.
I mean--now, why--in this case the argument is the pilots
are supposed to correct the system. But until after Lion Air,
the pilots didn't know the system was installed. Is that
correct?
Mr. Elwell. Yes, sir.
Mr. DeFazio. And the pilots also didn't know that the
disagree light didn't work unless you bought the optional
package of safety, which included more--another set--you had
both the disagree light, and then you had, I guess, digital
gauges that showed what the angle-of-attack sensors were--or
seeing, or feeling, or doing.
So when did the FAA become aware that the disagree light
wasn't working which had been on, I guess, all previous models
of the 737?
Mr. Elwell. Sir, if I could go back to the 737 pilot?
Mr. DeFazio. Yes.
Mr. Elwell. So I wasn't a 737 pilot in my commercial days,
but I had the opportunity to fly the MAX sim a month or so ago,
and I would offer on the mechanics of it that at the moment
that a pilot--and we are trained our entire careers--the moment
you feel the airplane doing something you didn't command it to
do, you instinctively trim in the other direction. And if that
doesn't work, you do a memory procedure called runaway stab
trim.
Mr. DeFazio. Right.
Mr. Elwell. So the--I am not going to take issue with his
comments about two bursts of the MCAS, what it might do, but I
know----
Mr. DeFazio. That is an elapsed time period of 20 seconds.
Mr. Elwell. Yes, I----
Mr. DeFazio. It is 20 seconds. I mean that is pretty quick.
And if you are at a low altitude I think it is, you know,
pretty--but let's go back to the issue of----
Mr. Elwell. Disagree light?
Mr. DeFazio. When the FAA was informed by Boeing. Boeing
knew at, I believe, about a year before they informed the FAA
that the disagree light didn't work.
Mr. Elwell. So, sir, our--we have looked at this, and
software engineers discovered the anomaly. And the anomaly was
tied to the MCAS software. Part of the change to the----
Mr. DeFazio. But the question--just no, I get that. I mean
we can get into details. But the point is a year elapsed before
Boeing told the FAA. What actions did the FAA take at that
point in time? Did you consider that inappropriate behavior by
Boeing?
Mr. Elwell. Sir, I am concerned that it took a year, and we
are looking into that, and we are going to fix that. Once we
learned that the light was not operable, then we made the
decision that it is not a safety critical display. It is not a
safety critical display. It is advisory. There are no actions
that the pilot takes to an AOA disagree light. And so it did
not rise----
Mr. DeFazio. Well, it would alert them to that--that
whatever the runaway problem is due to is due to, at that
point, the angle-of-attack indicators.
Mr. Elwell. Actually, the notice of that is tactile. One
yoke is shaking, and the other isn't. That is, by definition,
AOA disagree.
Mr. DeFazio. Yes.
Mr. Elwell. So the light is advisory.
Mr. DeFazio. OK. Then why is it there at all?
Mr. Elwell. It is good for maintenance. So if you get an
AOA disagree light in flight, you know to tell maintenance on
the ground, ``Hey, check. One of these is not calibrated
correctly, or is off.''
Mr. DeFazio. OK. So then, really, you don't think it is
significant that Boeing didn't tell people the system was in
the plane, and didn't tell people that disagree light didn't
work. None of that was problematic?
Mr. Elwell. Oh, I actually think--I think that is an issue,
sir, and we are going to look into it. It shouldn't take a year
for us to find out that that discovery was made.
Mr. DeFazio. I appreciate that, and I really would want to
know the answer.
And in fact, the Dallas News--and this is off of a tape
recording, so I think it is accurate--this was pilots talking
to--after they found out there was an MCAS system in the plane
after Lion Air, talking to a Boeing engineer, and they said,
``Why wouldn't you tell us about the system?''
``I don't know that understanding this system would have
changed the outcome,'' he said. ``In a million miles you are
going to maybe fly this airplane, maybe you are once going to
see this, ever. We try not to overload the crews with
information that is unnecessary.'' I mean do we really think
that--that was unnecessary, that it wasn't even in the manual,
and they didn't know about it?
I mean there is a lot of stuff in that manual that you
don't really need to know.
Mr. Elwell. Yes. Well, Mr. Chairman, I can't comment on
that conversation. And I think you were quoting Boeing.
Mr. DeFazio. Yes.
Mr. Elwell. I, as a pilot, when I first heard about this, I
thought that there should have been more text in the manual
about MCAS, I agree.
Mr. DeFazio. And Mr. Lawrence, in response to the chairman
you said that the engineer reports to an engineer. Can that
engineer to which the report is rendered also be a manager at
Boeing?
Mr. Lawrence. They would be a manager in the organizational
delegation--organization itself----
Mr. DeFazio. Right. Could they be--have managerial status
at Boeing and they are paid by Boeing? Is that correct?
Mr. Lawrence. They are paid by Boeing. That is correct.
Mr. DeFazio. OK, thank you. Just one other question.
Now we have had 14. If we could, put up on the screen the
flight deck 67, flight deck 17. Well, I thought we were going
to put it up. But anyway, I have it here. You can't see it, but
you would be familiar with it. We are getting used to our new
electronics.
[Slide]
Mr. DeFazio. But when you think of--there it is, now.
Pretty different airplanes, you know, their computer screens,
GPS, everything is digital. The other is analog, you know, very
different planes. And this is 14 variations later.
And I think we have got to question the system where if
you--I think, if you took the 737-100 and compared it to a MAX,
you would say, wow, these are different types. But we sort of
gradually got there, kept moving and moving and moving through
14 variations, and never determined that it would have to go
through a more rigorous process as a new type, and including
pilot retraining and those sorts of things.
I mean doesn't that raise some questions about how you kind
of get this creep over 14 variations over however many years
that is, 67--42 years?
Mr. Elwell. Sir, I know that begs the question. I would
remind, though, that the amended type certificate of the MAX
was amending the NG. And if you had the NG and the MAX side by
side, then you could see the similarities. They are so close as
to be amended----
Mr. DeFazio. Wasn't the NG amended from the 900?
Mr. Elwell. Correct.
Mr. DeFazio. Which was amended from the----
Mr. Elwell. Yes, sir.
Mr. DeFazio. So, I mean, that is kind of a creep, that
seems to me. I think there is a question there that we should
look at.
Mr. Elwell. Well, and as I said before, in the beginning of
your questions, we welcome that examination. If there is
something wrong with the extension of a family--and of course,
that is something that the 737 has, multiple iterations. But
again, we are certifying to the last one.
Mr. DeFazio. OK. All right. With that, thank you, Mr.
Chairman.
Mr. Larsen. Thank you. I know we have a 5-minute rule. I am
going to indulge the chair. I have 8\1/2\ minutes and I wanted
to afford that for the ranking member of the committee, as
well. So I recognize Mr. Graves, the ranking member, for up to
8\1/2\ minutes.
Mr. Graves of Missouri. Thank you, Mr. Chairman. Could we
bring it back up the--on the screen?
[Slide]
Mr. Graves of Missouri. Because we keep focusing on the
angle-of-attack indicator. So if you see on the right the 737
MAX, that screen in front of both the pilot and the copilot,
with the blue above and the brown below, that is your primary
angle-of-attack indicator. That is your artificial horizon.
Every aircraft out there has to have that to be certified.
The one on the left, the older version--that is digital, on
the right. The one on the left is what we call analog. And if
you see the circle in front of both the pilot and the copilot,
and there is white above and black below, it is the same thing.
That is your artificial horizon. That is your primary angle-of-
attack indicator--in fact, all of my years of flying, I don't
think I ever had an actual--what we are talking about--angle-
of-attack indicator in any of the aircraft I have ever flown.
But what is interesting, too, is--and we failed to--and I
go back to this--you got to know how to fly the plane, fly the
plane. In the Ethiopian Airlines incident you can look outside.
That is the critical angle-of-attack indication right there.
Look outside the airplane when you are flying it. You can tell
if you are at a critical angle of attack, because you are going
to be pitched up. You are going to be getting close to a stall
situation. Those are your two main angle-of-attack indicators.
First of all, look outside when you are flying the plane. And
second of all, look at your artificial horizon.
And I guess my first question is for Administrator Elwell.
And at this point we know--and we always know there are so many
other things to look at in these investigations. You know, not
just FAA certification activities with the 737 MAX, but many,
many other things. And what I want to get to is the preliminary
report shows that there were a lot of misidentifications on
what was occurring in the aircraft, and misapplication of
safety procedures, and in training itself.
And as a pilot--and I want you to talk to us as a pilot--
can you provide us some context as to what actions or inactions
by the pilots or the airline, for that matter, also require
some close examination in the course of this, in this
investigation?
Mr. Elwell. Yes, sir. Thank you for that question.
As a pilot--I mentioned a little bit earlier that in the
U.S., training focuses on hand flying, manual flying. There are
other parts of the world in other countries that focus on
flight control management. But in the U.S., from the first
training you do as a pilot--Air Force for me, but it is the
same in civil--it is flying the aircraft.
And what was going on--it has already been pointed out that
there was a false indication of a stall--immediately
recognizable to the trained pilot as a false indication because
one yoke was shaking, the other wasn't.
What concerns me about the data from the flight data
recorder is the apparent lack of recognition of runaway stab
trim. Runaway stab trim is taught at the earliest stages of
aircraft that have stab trim motors, and it is so important--to
Chairman DeFazio's point about time, elapsed time, it is so
important that you don't pull out a checklist, you don't open
and look at what is next. It is memorized, and you are tested
on it all the time, and you turn off those stab trim motors.
In the Lion Air accident it is significant that, even
though the airplane was pitching against the pilot's commands--
that is classic runaway stab trim--the stab trim motors in 13
minutes were never turned off. And I think you made the point,
sir, in your remarks that, in the case of the Ethiopian Air
flight, they did turn them off, although they didn't adhere to
the emergency AD that we put out on November 8th. They did turn
the stab trims off, but they never controlled their airspeed.
And then, subsequently, about a minute before the end of the
flight, they turned them back on. Both of those things are
unfortunate, obviously.
And I have to point out in deference to my colleague here
to my left, Chairman Sumwalt, these investigations are ongoing.
And as you said, there are so many pieces to any accident. I
have never looked at an accident where there weren't three, or
four, or five links to the chain, any one of which, if it
hadn't gone wrong, the plane would have survived. So we know
that there is going to be and there are factors.
But as a pilot, as you asked me, that is what I saw, the
lack of control and the speed on Ethiopian and the apparent not
doing the stab trim cut-out switch procedure.
Mr. Graves of Missouri. We come back to it, and we keep
coming back to it, and forgetting that, you know, once they set
those throttles to full power, they never retired them. And I
have used that analogy--the analogy before, when you are in a
car and you are speeding towards a brick wall, full speed, you
are going to take your foot off the gas. That is what most
people would do. But they accelerated right through their
certified maximum speed of a--the MAX 8, and just kept on
accelerating.
Throughout the entire process that aircraft kept
accelerating. And when you get those kind of pressures against
the control surfaces, it makes it very, very hard to do
manually. And you know--and again, this comes back to so many
times pilot training.
This is what worries me more than anything else. And I hate
to disparage, you know, another country and what their pilot
training is, but that is what scares me in all of this, is
climbing on an aircraft or an airline, you know, that is
outside U.S. jurisdiction. I know what we have in the U.S., and
I know what we are capable of, and I know the quality of our
pilots, and the--what they have to go through to get to that
point.
And I just think it is--you know, it just bothers me that
here we are, we just--we continue to tear down our system based
on, you know, what has happened in another country--two other
countries, and particularly given the qualifications and--you
know, and what we are learning about the training standards.
But that last part was more editorial than anything else,
Mr. Chairman. I will yield back.
Mr. Larsen. Thank you, Ranking Member Graves. I now
recognize Representative Norton for 5 minutes.
Ms. Norton. Thank you, Mr. Chairman. No, we don't want to
tear down our system, we want to restore confidence in our
system, Mr. Elwell. And I am sure that you are concerned that
this impressive record may well be shattered.
I regard it as a purpose of this hearing, as your answers--
to help us, if we can, restore confidence in a system--and, by
the way--most Members, maybe except me, use every single week
to go back and forth to the Congress.
So this loss of confidence, this--despite this wonderful
10-year record, seems to have been shattered. And so just let
me ask you a question preliminarily, Mr. Elwell.
I think most members of the public, after one crash, would
have said, ``Oh, that is unusual.'' Well two crashes. Why did
it take so long, compared to other countries that made the
decision almost immediately after the Ethiopian Airlines
accident? In fact, as I recall it, the President made the
announcement. But, as is his want, he probably was perhaps
preempting the FAA. But that is where the announcement came
from.
If anything, it signals the importance that somebody should
speak up. So I think the public--which will be interested in
this hearing--wants to know why did it take you so long after
the Ethiopian Airlines accident. Explain that to this
committee.
Mr. Elwell. Ms. Norton, thank you for that question. The
FAA is a data-driven, risk-based systems approach to all things
safety. When we take an action, and whether it is the grounding
of an aircraft, or an airworthiness directive, or----
Ms. Norton. Other countries weren't data driven? That is
the difference between you and other countries?
Mr. Elwell. I can't speak to the decisionmaking of other
countries. I can tell you this. A number of countries that
grounded their 737 MAX fleets called us immediately after and
asked what data we had. Several countries asked, after
grounding their fleets, ``What are we going to need''----
Ms. Norton. That means that they were looking at real-time,
real-life evidence, even if it may have contradicted the data.
Are you still as reliant on data as you were then, compared
to other countries? Today would you be reliant only on data?
Mr. Elwell. Well ma'am, that is a great question. We made
our decision to ground the aircraft when we had the data that
linked the two flights, data to link the flights.
But we weren't just sitting, waiting for the cockpit voice
recorder or the flight data recorder. We were examining, as the
regulator of our 737 MAX fleet, what is going on with our
fleet. And we drew data on 57,000 flights. And we were talking
constantly with our neighbor to the north.
Ms. Norton. That was after the first?
Mr. Elwell. After--from the first accident, but up through
Ethiopia, to find out are we--the fleet that I am responsible
for regulating, are they experiencing any anomalies? And there
were zero in 57,000 flights. So I had to----
Ms. Norton. Can I ask you this, Mr. Elwell?
Mr. Elwell. I am sorry, ma'am?
Ms. Norton. Could I ask you this, then? OK. Again we see
reliance--and I would say perhaps over-reliance--on data. Did
the President make this call, or did the FAA make this call?
Mr. Elwell. FAA is the safety regulator. FAA made the call
to----
Ms. Norton. And he only made the announcement, is that what
you are saying? You were prepared to make that call yourself
after the second accident?
Mr. Elwell. Yes ma'am.
Ms. Norton. OK. He preempted you, but you were prepared to
do it. You wouldn't have waited for a third accident. The data
told you after the second accident.
Mr. Elwell. Yes, ma'am. Yes, ma'am.
Ms. Norton. Could I ask you, Mr. Elwell, does the FAA
mandate pilot training on all of its systems in which--this was
news to me--in which the pilot is considered the redundancy for
the system's failure? Most of us didn't know that the pilot was
so considered.
Mr. Larsen. Mr. Elwell, you have to take that question for
the record.
Mr. Elwell. I am sorry, sir?
Mr. Larsen. You will have to take the question for the
record.
Mr. Elwell. OK.
Mr. Larsen. And I recognize Mr. Mitchell, Representative
Mitchell, for 5 minutes.
Mr. Mitchell. Thank you, Mr. Chair. The effectiveness, the
success of the aviation system in North America, has been based
on safety, reliability, and transparency in decisionmaking,
both in terms of certification of aircraft, pilot
qualifications, and when there are incidents.
Mr. Elwell, you recall last week there was a briefing for
members of the committee on the 737 MAX certification. I asked
a question. I asked what the FAA had done in the process of
reviewing and certifying the MCAS system. To be honest with
you, sir, I got a whole description of what the system did and
didn't do, but I didn't get an answer to my question. At no
point did I. And then we are greeted by, as Mr. DeFazio notes,
this Wall Street Journal article.
So I will ask the question again. I will ask it for the
record. And I will ask you to submit in writing to the
committee. What were the steps the FAA took in reviewing the
MCAS system and the accompanying training? Because I have asked
it now three times, and I have--to be blunt with you, sir, with
all due respect, I haven't gotten a direct answer. And the
committee deserves it.
Mr. Elwell. We will get that answer for you, sir.
Mr. Mitchell. That would be deeply appreciated. And I would
like it straight up. What was the engagement in the system
throughout the process in detail. Don't worry about boring me.
I don't believe that the chair is going to be bored by reading
this. I certainly am not. We need to understand that, because
there is a critical component of this.
Mr. Elwell. Yes, and I can assure you that the MCAS system
was examined and certified, because it was a new system to the
MAX.
Mr. Mitchell. It was.
Mr. Elwell. And we retained it, and we had the oversight of
that, and we certified it.
Mr. Mitchell. Well, as you may recall, I asked the question
and didn't get an answer that was anywhere close to
satisfactory. I would appreciate it.
Let's transition to a--as was noted, the 737 MAX has flown
57,000 flights in North America without an incident.
Part of the difference is the training of the aviators, the
pilots. I mean I have done some instruction. I don't have a
pilot's license, I didn't have enough time. But it was clearly
made to me--first thing, you aviate, you fly the plane. Then
you navigate, then you communicate. So, yes, I have seen a
stick shaker, they made me do it. It is interesting.
I am concerned that--and I am trying to be respectful,
because they are deceased--the pilot in command of the
Ethiopian Air was 29 years old, and was reported to have 8,100-
and-change hours of flight. Now, let me give you some examples.
Close friends of mine who are commercial pilots flew for major
corporations. He is 58, has 17,000 hours. Another gentleman is
63, also flew for major corporations and private flight. He is
63 years old, has 20,000 hours. The second--their first officer
had 361 hours.
Have you--I mean, do we not have concerns with not only the
training of pilots in other nations, but the reliability of
their logs to try and claim 8,100 hours at age 29? How many
pilots do you know that have over 8,000 hours at 29 years of
age?
Mr. Elwell. Mr. Mitchell, I don't know anybody at 29 years
old that has 8,100 hours, but I am not going to say that that
is not possible.
And the answer to your question is do we want to examine
and take a very hard look at the training standards, globally?
Yes, absolutely. We have been involved--the U.S. has led on
pilot training for many years, and we do that at the
International Civil Aviation Organization, the U.N. body that
provides that guidance for standards around the world.
Mr. Mitchell. I think it needs to be an issue that we
address, and as we deal with this, because clearly the
disparity is concerning to me.
One quick question. I guess I would also ask you to submit
this for the record, because time is going to run short. In
reference to my colleague's question, part of the reason for
the delay, or the delayed response of the United States, is we
got our data from Canada, did we not?
Mr. Elwell. Indirectly. Yes, sir.
Mr. Mitchell. We didn't have the data with the same level
of specificity that Canada had, because we don't have access to
that system that they use for air traffic control. Correct?
Mr. Elwell. We do have access to it, sir. But Canada got it
first because it came from a company that the air traffic
services in Canada----
Mr. Mitchell. Would you submit that whole process, that
whole timeline, in writing to the committee, please?
Mr. Elwell. Yes, sir. We will do----
Mr. Mitchell. Thank you, sir. One last comment. I believe
that we have got the most advanced aviation system in the
world. We will find multiple factors that contribute to this
terrible tragedy, one of which will be we didn't see things
that could have come up. It is hard to sometimes have a crystal
ball. But when you do recertify this aircraft, I will be among
the first to buy a ticket to fly the plane, because I have
faith in our aviation system. I have faith in the FAA. And I
have faith in Boeing and the aircraft they fly. I will buy one,
I will fly it somewhere to make the point that we have to trust
our aviation system.
Thank very much. I yield back.
Mr. Elwell. Thank you, sir.
Mr. Larsen. Thank you. And I now recognize Representative
Lipinski for 5 minutes.
Mr. Lipinski. Thank you, Mr. Chairman. Sitting here in
front of the family of a victim of one the crashes of a 737
MAX, and looking at the pictures of the victims, it is crystal
clear what the responsibility of the FAA, the NTSB, and our
committee is right now. We need to get to the bottom of what
happened, so we can do whatever we can to ensure the safety of
air passengers.
And from what we know so far, it seems to me, at least--
although there--it sounds like there may be--have been other
factors, but it seems that something went wrong with the FAA's
safety certification of the 737 MAX, and 346 people died.
We need to figure out what went wrong. If it was the
certification process itself, we need to fix it to avoid a
repeat. If it was the problem with the lack of compliance with
the process, then we have to hold accountable whoever it was
that was not compliant, the FAA and/or Boeing.
In addition, further steps must be taken to ensure
compliance. No, this is not a legal proceeding here, and I know
that we are in the early stages of the investigation of the
crashes and the certification of the MAX. But stories we have
heard about the process of certification so far are troubling.
The guiding principle of the FAA and manufacturers must be
safety, not getting a highly valued plane out more quickly.
A question was raised earlier by Chairman DeFazio about why
the 737 MAX was not required to get its own type certificate.
To me this is very troubling. It seems to me that because it
didn't have to get its own type certificate it could move more
quickly through the process. Now I am not a pilot, and I will
defer to the pilots on this committee when it comes to issues
of their experience as pilots.
But I am a mechanical engineer. I know that this plane--
Boeing needed to compete with Airbus, they--in order to have
more fuel efficient planes, they put new engines on the plane.
The engines had to be put further forward on the wings. These
changes in aerodynamics caused the need for the MCAS system.
And it seems to me that the MCAS system fundamentally changes
the way the Boeing 737 flies. How was this not a major change
that required a new type certificate?
Mr. Elwell. Thank you for that question, Mr. Lipinski, and
I am glad you asked it, because--and I appreciate that you are
an engineer. Actually, the MCAS was put into the 737 MAX for
the opposite reason. It doesn't make it fly differently. The
MCAS was put--designed into the airplane to make it fly and
feel for the pilots exactly like the NG--
Mr. Lipinski. Yes, but it was a change. It was a
fundamental change----
Mr. Elwell. Yes, it was a change----
Mr. Lipinski [continuing]. To how it flies. I understand it
was put in there to try to make it fly the same way. But the
system itself was a change.
Mr. Elwell. So the MCAS was added to a system that was on
the--that is on the NG called the speed trim system. It is--and
I am not an engineer, but it is a layer below, a software layer
below the speed trim system. And, as you said, the MCAS was put
in because the engines were--brought the CG a little bit
forward on the airplane. The test flights demonstrated that in
a high angle-of-attack regime the yoke didn't feel the same to
the pilots as the NG. The MCAS pushed the nose over, so that
controllability and the feel on the yoke would be the same.
And the flight test pilots deemed that it was identical,
and then the flight standardization board pilots, which were
actually line pilots that we enlisted to fly both planes,
found--came to the same conclusion.
Mr. Lipinski. Well, I am hopeful that this was not a
situation where the desire was just to get the plane out more
quickly, that it wasn't a situation where safety was not the
priority, because that must be the priority. As I said, for the
FAA, for the manufacturer, safety must be the priority. I
understand how important Boeing is as an American company, but
safety must always come first.
Mr. Elwell. Sir, I----
Mr. Lipinski. Thank you, I yield back.
Mr. Elwell. I couldn't agree more. Thank you, sir.
Mr. Larsen. Represent Spano for 5 minutes.
Mr. Spano. Thank you, Mr. Chairman. And before I begin I
too want to extend my sincere condolences and regrets to the
members of the family who are here today. I can't imagine what
you are going through. And thank you for being here. I am very
grateful that you are here.
My first question is to Mr. Elwell. Can you help me
understand? Describe in a little bit more detail the FAA's
delegation authority. What are the things we delegate? What are
the things that we don't delegate? Those things that we do
delegate, how does the FAA oversee the actions of designees?
Just generally, thank you.
Mr. Elwell. Thank you, sir, for that question. The key word
in your question--detail--begs that after I introduce that I
am--I would like to hand off the detail of the ODA to Earl, who
is our resident expert.
I will just start by saying the Organization Designation
Authorization, as it has come to be known, ODA, is a
longstanding principle in certification, and it is a way in
which the FAA leverages the expertise within the manufacturing
entity. It is very important we understand that, without
leveraging their engineering expertise, it would be virtually
impossible to have the system that we have today.
So as far as the details of how the ODA is administered,
I--Earl?
Mr. Spano. I appreciate that, and I appreciate it is a
longstanding process, but I think the public would like to
know----
Mr. Elwell. Yes, sir.
Mr. Spano [continuing]. So that they can have some level of
confidence that the FAA is doing the job that we expect them to
do. What is delegated, what is not, how do we oversee that?
Mr. Elwell. Thank you.
Mr. Lawrence. So thank you for the question, because I
think there is a lot of misunderstanding of our delegation
process. I would like to simplify our, sir, process in four key
areas.
And the first and foremost is setting the standards. What
are the rules and requirements for any design to meet?
Next are another layer of test protocols and standards. So
it is how you are going to show compliance.
The third level is the actual doing of the tests and the
calculations.
And then the fourth is the overview of all those results,
and the approval.
Only in that third level, the actual doing of a test, is
where delegation is used. FAA is fully responsible for setting
the standards that all tests must comply with, and setting the
standards for the minimum safety for that aircraft, and then
reviewing it all in the end. We never give up that authority.
We take advantage of the expertise of the people who are
actually building and designing the aircraft to assist us in
reviewing those tests and those procedures, particularly on
things that have been done over and over and over again over
many years.
I want to highlight that it took us 5 years and over
110,000 man hours to certify the 737 MAX. I don't think that
was a quick process or just a cursory review. We apply the same
rigorous standards on whether it is a derivative design or
original design. And I am proud of my team for their abilities
and their expertise in reviewing any certification project.
Mr. Spano. Thank you. Thank you, Mr. Lawrence.
The next question for Chairman Sumwalt. If you would, just
help us--help me understand. Over the last maybe two or three
decades, you know, what is the state of commercial airline
safety here in the United States? Give us a, if you would, a
brief sketch in 1 minute and 12 seconds.
Mr. Sumwalt. Well, I think generally speaking, the state of
the airline industry in the United States over the last few
decades has increasingly gotten safer and safer. That--as it
was pointed out earlier, we had one fatality in the past
decade. One is too many. And, of course, we have the families
of the Colgan 3407 crash here. There were 50 lives lost there.
So it is good, but good is not good enough.
Mr. Spano. And then one final question. It has been
mentioned that we don't--we can't control, necessarily, some of
the pilot training protocols abroad. Are there any mechanisms,
if any, that we have at our disposal to ensure that other
countries, you know, do require their pilots to have the
training that we feel is appropriate? And if so, what are those
mechanisms?
Mr. Sumwalt. Yes, ICAO, International Civil Aviation
Organization, outlines the standards and recommended practices
for member states to follow. There are 193 states that are
subscribers to or signatories to ICAO. So----
Mr. Larsen. And you can get further information on that, as
well.
I also remind the subcommittee that we have asked, through
a bipartisan letter to the DOTIG for the international pilot
training standards, and some other information, as well. When
we get that we will share it with the full committee.
I recognize Representative Cohen for 5 minutes.
Mr. Cohen. Thank you, sir. I express my sadness at the loss
of the individuals and for the parents to be present here, and
all the relatives.
Mr. Elwell, I believe it was every country grounded the MAX
before we did. Every country. Is it because they were too quick
to draw a conclusion from two airplanes going down in similar
circumstances, and realizing the flying public should be
protected in their countries? Or was it because we were just so
much better at using data and not being concerned with the fact
that there were two identical--or close to identical--crashes?
How were we last?
Mr. Elwell. Mr. Cohen, as I mentioned earlier, the FAA is
data-driven, risk-based systems approach. We don't deviate from
that, because it is critically important that that is how we
operate.
You mentioned we were the last. As far as we know--and we
have talked to these countries who grounded their fleets--we
were the first country to ground because of a data that linked
the two accidents, which is critically important--us and
Canada. I must say Canada also waited until we had that data,
and the data was not available until the radar tracks were
refined to suggest--and evidence we found on the ground--that
linked the two flights.
Mr. Cohen. So the opposite of data is common sense? The
other countries acted on what looked like, with common sense,
that there is a causal connection and a reason to think two
airplanes fall out of the sky and they crash with similar
problems with keeping the plane under control after takeoff and
high speeds, and that is--because you don't have the data yet
you are jeopardizing another airplane? It just seems like
common sense should have taken control. Data is fine, but
sometimes it is just right before your eyes.
There was a story or an article written that pilots of
planes that didn't crash in the United States kept noticing the
same basic pattern of behavior that is suspected to have been
behind these two crashes. This was in the Dallas Morning News
review of voluntary aircraft incident reports, the NASA
database. Pilots all safely disabled the MCAS and kept their
planes in the air. But one of the pilots reported to the
database that it was ``unconscionable that a manufacturer, the
FAA, and the airlines would have pilots flying an airplane
without adequately training or even providing available
resources and sufficient documentation to understand the highly
complex systems that differentiate this aircraft from prior
models.''
Mr. Elwell, how can it be that we didn't tell the pilots
about MCAS, and implore them to be aware of it in the
situation? This was the system that was put in to allow there
to be--what was, arguably, a new airplane to compete with
Airbus, and we didn't tell the pilots?
Mr. Elwell. So, Mr. Cohen, the reports that you are
referring to, they are called a ASRS. It is a--reporting a
indemnified safety reporting system. There were--in the 50,000
flights in the MAX we had 24 reports that mentioned--from
pilots that mentioned some sort of anomaly on pitch. None of
those reports were related to the MCAS, zero.
And so--and as I mentioned--we scanned and filtered every
one of those flights for evidence that there was MCAS or AOA
anomalies in the U.S. fleet. That is what FAA needs to do. It
is what we did. There were no reports of MCAS anomalies
reported on the MAX.
Mr. Cohen. Has the FAA considered requiring that pilots
that fly the MAX get simulator training?
Mr. Elwell. I am sorry, do you mean----
Mr. Cohen. In the future, that anybody that flies a 737
MAX, that there be a simulator, and that they be trained in
that simulator?
Mr. Elwell. Well, so we need to wait for the Boeing
application of the fix. Once we have the official application
of the fix, we will be able to determine if and exactly what
sort of training will be required for MAX pilots.
Mr. Cohen. And one last question. Media reports indicated
that Boeing underestimated the capability of MCAS by a
magnitude of four times in its initial submission with the FAA,
and the FAA only found out about it from Boeing's notice to
airlines explaining MCAS after the Lion Air accident.
For the record, can you please confirm this account? And if
that is not correct, please clarify the timeline.
Mr. Elwell. I will get an answer for you on that question,
sir. I am not familiar with----
Mr. Cohen. OK, we will put in our written questions.
Mr. Larsen. Take it for the record.
Mr. Cohen. I yield back the balance of my time.
Mr. Larsen. The Chair recognizes Representative Balderson
for 5 minutes.
Mr. Balderson. Thank you, Mr. Chairman. I also would like
to express my condolences to the families that are here, and my
thoughts and prayers are with you.
Administrator Elwell, thank you for being here today in
this important hearing. There are currently 79 aircraft
certification service ODAs. Are you aware of any International
Civil Aviation Organization standards or recommended practices
that directly conflict with the FAA's use of the Organization
Designation Authorization program?
Mr. Elwell. Sir, I am not aware of any. I will tell you
that ODA is a practice shared by all countries who do
certification. And in some countries they use it much more than
we do. But please, if you would let me defer to my colleague,
Earl, on the specificity of your question.
Mr. Lawrence. So delegation is used in--universally
throughout the certification process, and in all countries. And
I guess I would highlight that the 737 MAX was a dual
certification in this case, with EASA, the European safety
organization, and the FAA. And so all the decisions and review
of the delegation and those activities was conducted by both
agencies at the same time. So I think that shows the
reinforcement and the comfortableness of another authority in
how we use delegation to assist us.
Mr. Balderson. Thank you very much. Administrator Elwell,
you state that any party the FAA regulates remains responsible
for compliance with the FAA's regulatory standards, and the FAA
does not hesitate to take enforcement action when it is
warranted.
Can you provide examples of when FAA enforcement action was
taken as a result of noncompliance, and how the FAA was able to
discover violations of your regulatory standards?
Mr. Elwell. So there are examples of when we have had to
take enforcement action. In particular, there have been several
actions taken with ODA. I think--and Earl will correct me, if I
am wrong--I believe that we have denied ODA authority--a
certificate for ODA--on at least one occasion. And then within
the ODA organizations, our oversight will occasionally discover
somebody not following.
You have to understand that the organization itself is run
by a manual that is written specifically for the activities
that the ODA is allowed to do. And when that manual is not
followed, then, you know, the oversight catch that--it will
step in.
But Earl, is there amplification on that?
Mr. Lawrence. Just to build a little bit on Mr. Elwell's
comments there, we have removed one ODA, but there are multiple
findings, as we say. We audit every single one of these
entities on an annual basis.
And per the direction of this committee in our
reauthorization bill, you have asked us to stand up a new ODA
oversight office. And Mr. Elwell signed off on setting that
office up in April. And that will change us to not just waiting
for an annual basis. That will transition us to a constant
overview of data flow, so we will be constantly monitoring, and
not just relying on annual audits. So it will reinforce that to
an even greater extent, our oversight.
Mr. Balderson. All right. Thank you both very much.
I yield back my remaining time, Mr. Chairman.
Mr. Larsen. Thank you, Representative Balderson. The Chair
recognizes Representative Titus for 5 minutes.
Ms. Titus. Thank you, Mr. Chairman. I represent Las Vegas,
and about half of the 42 million people come by plane. And so
having high safety standards is very important.
When this first happened, though--I fly back and forth on
Southwest every weekend--first thing I did was call to see if
the flight I had scheduled was one of these that was in
question. Then I realized, if I am scared to fly on that, I
don't want my family, my friends, my constituents, or my
visitors to fly on that plane, too. So it is very important
that we get to the bottom of this. So I thank the chairman for
having this hearing.
We have heard a lot of defense from you this morning about
ODAs and the emphasis on data being the reason you grounded the
plane. And that all sounds fine, but the public perception was
that it took so long for us to do it. We were the last ones to
do it is because the FAA was just too cozy with Boeing, that
you were in bed with those that you were supposed to be
regulating, and that is why it took so long. So that is the
impression the public has, and what we need to deal with.
Now the emphasis shifts from not the grounding, but the
ungrounding. So I would ask you what process you are going to
use to unground this plane. I know you have created some new
organizations within the agency. I think on the 2nd, Mr.
Elwell, you announced the formation of the Joint Authorities
Technical Review team to--you know, that includes a number of
representatives from other countries to--including Ethiopia and
Indonesia to investigate your certification process. Last week
you announced a multi-agency Technical Advisory Board to review
the proposed software fix.
These don't have regulatory authority, but I wonder, are
you going to use their decisions before you move to ungrounded?
Are you going to have their consensus? What is it going to look
like to the public if you ignore them and they just become
window dressing? Would you address now the next step?
Mr. Elwell. Thank you, ma'am. Thank you for that question,
because it is very important. We have established the safety
record that we have by doing just what you alluded to:
listening, getting feedback, getting suggestions.
We have been incredibly transparent throughout the process,
and that is what we are with all of the countries we deal with,
with the stakeholders in the aviation industry. The TAB that
you mentioned and described perfectly in the JATR--the TAB, by
the way, as I mentioned earlier, Chairman DeFazio recommended
that over a month ago and we agreed wholeheartedly. And we will
listen. And, in fact, they are in--they are reviewing right
now. We have already received, I believe, a couple of
suggestions.
We are also--as I mentioned in my opening remarks, we are
going on May 23rd to meet with--we invited 57 countries that
grounded the MAX, and invited their civil aviation authority
directors to come and talk to us--and us to them, more
importantly--explaining to them exactly the process, our safety
analysis.
We will not allow the 737 MAX to fly in the U.S. until it
is absolutely safe to do so, and we will use every tool, every
data gathering capability we have, to ensure that is the case.
You have that as a personal commitment and as a commitment of
45,000 passionate aviation professionals in the FAA.
Ms. Titus. And what role will Boeing play in this process?
Mr. Elwell. So Boeing will submit their application for the
update to the MCAS software. The formal and final submission we
expect--I don't know, Earl, the next week or so? And at that
point we will do test flights, we will do analysis. We will
present it to the TAB. The TAB will look it over. We will do a
thorough and robust safety analysis. We will determine, based
on--the software fix they give us will determine what level of
training will be required of 737 MAX pilots.
And then, once we have established all of that, and
internally the FAA review says that the 737 MAX is safe to fly,
then the prohibition order will be lifted, and we will present
whatever mandates are tied to this new software.
Ms. Titus. And do you believe you have the resources and
the expertise without depending on the ODAs to provide that
final oversight and make that guarantee that it is safe to fly
again?
Mr. Elwell. Yes ma'am. I do.
Ms. Titus. And how do you reassure us of that?
Mr. Elwell. I point to an organization, the FAA's diligence
in safety that has produced a record that--it is, in many ways,
remarkable in the U.S.
I also point, as I just said, the FAA--I have never seen,
outside of Chairman Sumwalt's organization, a more dedicated
organization of safety professionals. I am awed every day I
come to work. They are amazing.
And I will tell you they are--I am a little bit worried
about morale right now, to be honest with you, across the FAA.
It is critically important to me that we--and, of course, to
the world and to the U.S.--that we get this right. But it is
important for public confidence, as you said. And it is
important for the morale of the great professionals that are
doing the work to get this airplane safely back in the air. And
we are not going to do it till it is safe.
Ms. Titus. Thank you. Thank you, Mr. Chairman.
Mr. Larsen. Thank you, Representative Titus. I recognize
Representative Massie for 5 minutes.
Mr. Massie. Thank you, Mr. Chairman. I would like to widen
our focus here a little bit and talk about the types of data we
collect, flight data; how we collect it; and what we do with it
after it is collected, not just in these particular incidents,
but other incidents. Because I find it odd that 2 weeks, 30
days after the incident there is still speculation and guessing
about what the pilots did, how did they react, and we don't
know.
Probably just about everybody in this room has a camera in
their pocket. And earlier in this hearing we saw a picture of a
1967 flight deck of a 737 versus a 2017 flight deck of a 737
MAX. And I understand why in 1967 there weren't cameras in the
cockpit. Can you speak to why we don't have cameras in the
cockpit, cameras that are cheap and would answer so many of
these questions we are still speculating about, it seems? Mr.
Sumwalt, please.
Mr. Sumwalt. Thank you very much for that question. The
NTSB has, in fact, recommended that----
Mr. Massie. I am talking about for commercial flights, of
course.
Mr. Sumwalt. That is right. Cockpit image recorders should
be required for commercial flights. We have--for airline
flights. We have made that recommendation, and it has not been
acted upon.
Mr. Massie. Why hasn't it been acted upon?
Mr. Sumwalt. Well, that is a great question, and it is a
question that the regulators should answer.
Mr. Massie. Can I ask you, Mr. Elwell? You have a thought
on that?
Mr. Elwell. So the FAA works with our colleagues at the
NTSB very closely. And we take every recommendation the NTSB
makes, and we examine it, and we evaluate it for safety of
flight. And that is our first and foremost consideration. And
Chairman Sumwalt and I have not always disagreed on all the
recommendations, but I think we would both say that the--this
semi-symbiotic relationship that we have has been part and
parcel of where we are today and the safety record we have
today.
Mr. Massie. Let me ask about the way we collect the data.
Can you explain to my constituents why, for $10, they can get
internet on a flight for the whole flight, yet we are still
chasing down a physical black box to find out what happened in
the cockpit? Why do we have to go to the crash site to recover
the data in this day and age? And why is all the data lost if
we can't find the black box?
Mr. Sumwalt or Ms. Schulze, if you would like to answer.
Ms. Schulze. Sure, thank you for that question.
Mr. Massie. I am not advocating getting rid of the black
box. I am saying why can't we augment it with some streaming.
Ms. Schulze. Sure. And I think the industry has been
looking at this, from a technical standpoint, to understand
what is technically feasible. But I think that is something
that would be an important backup to the equipment on the
aircraft, which is still a valuable tool. And in these
accidents, extremely valuable for us to understand what was
going on in the--on the aircraft and in the cockpit.
Mr. Massie. It is hard for me to explain to my constituents
who get on the plane and get internet why it is not technically
feasible. Now, I know why it wouldn't work in every situation,
but--and why you need the black box.
But let me go to my third question, which is what do we do
with the data after we retrieve it. Mr. Sumwalt, why doesn't
the NTSB publish all data from the black box immediately upon
retrieval?
Mr. Sumwalt. Well, thank you very much. We do eventually
publish that. And let me point out that the NTSB uses a party
system. So when we have the data, the manufacturer has it, it
is shared with the manufacturer, with the FAA, with anybody who
needs it to be able to understand the circumstances of that
crash so that they can make immediate safe----
Mr. Massie. Let me just--I appreciate your answer, but I
said ``immediately,'' and you said ``eventually.''
Mr. Sumwalt. OK. If we are talking about public release of
the information, yes, that does become available when we open
the public docket.
Mr. Massie. Why not make it immediate? What benefit is
conveyed upon society by withholding that data from the
manufacturer, the person who actually made the equipment? Why
aren't they allowed to have it immediately? And why is the NTSB
allowed to withhold or block them from getting that data when--
and I wanted--I am talking about the difference between
immediately and eventually, because lives could be lost
eventually.
Mr. Sumwalt. All right, let me make an important
clarification. The manufacturer and the FAA has access to that
information immediately when we have it. They are part of our
process. They are in the room reviewing the data immediately
with us.
Mr. Massie. OK, I am glad to have your assurance on that. I
have some manufacturers that have experienced different
results.
Thank you, Mr. Chairman.
Mr. Larsen. Thank you. I recognize Representative Stanton
for 5 minutes.
Mr. Stanton. Thank you very much, Mr. Chairman. We are here
today because of the unspeakable loss of 346 lives in the
tragic crash of Lion Air's flight 610 and Ethiopian Airlines
flight 302. Our aviation system is the safest in the world, but
these accidents have shaken the public's confidence and trust.
We owe it to the people whose lives were lost and their
families to get to the bottom of what happened and address any
issues within the FAA's certification process to ensure the
safety of not only this aircraft, but the system as a whole.
The MAX should not be returned to service until the safety
of the aircraft is assured by FAA, Boeing, and its operators.
Back-to-back crashes demand the reviews of Boeing and FAA
responses that are underway.
We need to get to the bottom of why a single point of
failure was permitted in the MAX. Commercial aviation,
especially in the United States, is so safe, in large part,
because of safety redundancies. Based on preliminary reports, a
single point of failure appears to have played a significant
role in these tragedies.
Now there have been reports of certain optional safety
features of the MAX were sold as extras. And my question is for
Mr. Elwell. Is it common to have safety features offered as
optional and not mandatory?
Mr. Elwell. Mr. Stanton, any safety-critical component to
the certification of an aircraft is not optional. It is part of
the certification of the aircraft.
Mr. Stanton. Would those features, which were not in either
the Lion Air or Ethiopian planes, have made a difference in
aiding the pilots to more quickly identify the MCAS system was
triggering?
Mr. Elwell. In my opinion, no. And I think you are
referring to the AOA disagree light.
Mr. Stanton. Yes.
Mr. Elwell. Yes, sir.
Mr. Stanton. Should these be required features?
Mr. Elwell. I actually would like to defer to Mr. Lawrence.
Mr. Stanton. Please.
Mr. Lawrence. So AOA disagree indicator was not on the
original 737. It was first introduced on the NG model. It is a
maintenance alert, so we do not consider it part of our
critical items. And I am, you know, not aware of which other
aircraft may or may not have it installed.
Mr. Stanton. As far as you know, what are Boeing's plans to
incorporate these features on all Boeing aircraft?
Mr. Lawrence. Are they looking to incorporate the AOA
indicator on all Boeing aircraft?
Mr. Stanton. Yes.
Mr. Lawrence. My understanding is it is not on other Boeing
aircraft. It was just the NG--in the manner that it was
displayed.
Mr. Stanton. I understand that the software modifications
for the MCAS system are in process. Can you describe the status
of the modifications you would expect for the MAX?
And then how confident are you that these will reduce
another incident involving a runway stabilizer trim event?
Mr. Elwell. So----
Mr. Stanton. Please.
Mr. Elwell. I will let Earl modify or get into more detail
in my answer.
Mr. Stanton. Please.
Mr. Elwell. But we are expecting the formal application of
the MCAS update, software update, soon. We do know the basic
parameters of--there are three pieces to that fix that would,
in--once established and once put on airplanes, would render
the scenarios that were perpetuated in the Lion Air and the
Ethiopian accidents--they wouldn't happen the way they happened
there.
But I will let Earl elaborate any further on that.
Mr. Stanton. Mr. Lawrence?
Mr. Lawrence. I--yes, thank you. The software--I would call
it the beta version for this audience here--has been submitted
to us. And the reason why they submitted it to us is so we can
stick it in the simulator, so we can test it, so we can also
look at their system safety analysis, and see whether it will
appropriately address it.
The key thing the new software does is look at both angle-
of-attack indicators to assure that a single failure will not
cause the system to initiate, and future changes.
Mr. Stanton. All right, one more question for Mr. Elwell.
You are a U.S. Air Force Academy graduate, combat pilot during
Operation Desert Storm, commercial pilot for 16 years, with
more than 6,000 hours combined civilian and military flight
time. It is very impressive experience. Do you think the FAA
should have mandated training for the MCAS system for pilots,
knowing what we know now?
Mr. Elwell. Sir, thank you for that question. The
investigations and the audits and the reviews currently
underway are going to make their recommendations. I am going to
answer you the way you asked the question, as a pilot, as
somebody who has----
Mr. Stanton. Please.
Mr. Elwell [continuing]. Devoted my entire life to flying
and safety.
I--at the beginning, when I first heard of this, thought
that the MCAS should have been more adequately explained in the
ops manual and the flight manual, absolutely. We, in our
emergency airworthiness directive that we issued on November
8th after Lion Air, we added explanation of MCAS, and we also
reminded our own operators and the world via a document we call
a CANIC. We reminded pilots when to engage runaway pitch trim
procedures, and we added a note to those instructions.
When we complete our overview, when we complete our safety
analysis, I expect that we will have amplified MCAS
description, in addition to anything else that we think and we
find is needed to make pilots more aware and respond better to
an anomaly.
Mr. Stanton. Thank you, thank you.
Mr. Larsen. Thank you. We are going to proceed on our side
of the aisle with questions. And then, if there's a Member of
the Republican Party that shows up that hasn't asked questions,
then they will get in line at the appropriate time.
So we will go with--next is Representative Craig. You are
recognized for 5 minutes.
Mrs. Craig. Thank you, Mr. Chairman. I too want to express
my sincere condolences to the family members who are here today
for the lives that were lost.
Mr. Elwell, as you may know, before I came to Congress I
worked in a similarly highly regulated space, the medical
device industry, where one malfunctioning defibrillator or a
pacemaker could result in an innocent life lost. We heeded
strict compliance and reporting requirements to disclose
aftermarket malfunctions to the Government through the FDA's
Adverse Event Reporting System. This aftermarket reporting was
and continues to be justified.
With that in mind, I would like to learn more about the
manufacturer aftermarket reporting requirements that allow the
FAA to be notified about certain failures, malfunctions, or
defects. Because, according to media reports, Boeing first
discovered that the angle-of-attack sensor disagree light
software was malfunctioning a few months after delivery of the
MAX in May of 2017. At that time they learned the disagree
light wouldn't work unless airlines also had the optional AOA
indicators. Therefore, 80 percent of pilots flying Boeing's MAX
believed an indicator light would show when, in fact, it would
not.
But it wasn't until Lion Air, in October of 2018, over a
year later, that Boeing finally notified FAA that most planes
were flying with software malfunctions. Furthermore, the New
York Times reported yesterday that pilots from American
Airlines pressed Boeing executives to work urgently on a fix.
In a closed-door meeting they even argued that Boeing should
push authorities to take an emergency measure that would likely
result in the grounding of the MAX.
So with that, I have three yes-or-no questions, and then I
have a fourth.
Did Boeing have an obligation to report this aftermarket
software malfunction to the FAA?
Mr. Elwell. Boeing software engineers did write a PR--what
is the--performance report? Problem report.
Mrs. Craig. OK.
Mr. Elwell. They followed their procedures. Because it is
not--the AOA disagree light was not a critical safety display--
it is advisory only for maintenance recording--it languished.
And I am not happy with a 13-month gap between finding that
anomaly and us finding out about it. And we are going to look
into that, we are looking into that, and we will make sure that
software anomalies are reported more quickly.
Mrs. Craig. So that was a yes.
Did Boeing have an obligation to report this aftermarket
software malfunction to existing airline customers for them to
be aware of and submit a service difficulty report if
necessary? Did Boeing have that responsibility, yes or no?
Mr. Elwell. I am sorry, can you repeat the question? I
didn't get the beginning----
Mrs. Craig. Yes. Did they have an obligation to report this
aftermarket software malfunction to existing airline customers?
Is there an obligation on their part to report this malfunction
to consumers, as well?
Mr. Elwell. So the Boeing ODA and the Boeing software
engineers respond to their procedures. I am going to defer to
Earl on whether or not they--that the standards and the ODA
manual requires that.
Mr. Lawrence. The obligation is to evaluate the anomaly to
the internationally approved standards, and procedures for
looking at that. If those procedures indicate that it is an
item that meets a certain level, then yes, it would have to be
reported to the other airlines and to the FAA.
In this particular case, the approved procedures designated
the risk of this item not being in a working condition did not
require immediate action. It did require action, and that is
what we are talking about, we would like to see quicker
reaction than 13 months in the future.
Mrs. Craig. And can you confirm, Mr. Elwell, that Boeing
continued to deliver planes with a nonfunctioning disagree
light, even after the discovery that it was only operational
with add-ons, and even after the Lion Air accident?
Mr. Elwell. I believe that the 737 MAX was delivered after
the software engineers discovered that anomaly, yes.
Mrs. Craig. Thank you. And finally, do you believe our
current aftermarket reporting requirements are adequate to
protect airline passengers?
Mr. Elwell. Mrs. Craig, we have an IG report. We have the
blue ribbon panel, or the special committee. We have the JATR
that we formed. This committee's investigation has been
initiated, and we are gathering reams and reams of data. All of
these reviews are going to look at the process, top to bottom,
and come back with recommendations. I fully expect that, when
this is all done, we are going to have recommendations that
will make us better. In addition, we are going to continue to
scrutinize our process. We are going to make sure that it
doesn't take 13 months to find out that there is a software
anomaly.
But I just want to remind everyone here let's not make the
AOA disagree light the issue. The AOA disagree light is an
advisory. And the AOA disagree light would not have changed in
either accident. I want to make sure everybody understands.
Don't make something that isn't a critical safety item a
critical safety item, because there are enough critical safety
items for us to focus on.
Mrs. Craig. Thank you. I yield back.
Mr. Larsen. The Chair recognizes Representative Davids, the
vice chair of the subcommittee, for 5 minutes.
Ms. Davids. Thank you, Mr. Chairman. And I too would like
to extend my condolences to the family members who have lost
loved ones and are here today.
And I think it is really important for us to recognize that
the relationship that exists between this committee and the FAA
and the NTSB is one that is clearly geared toward making sure
that we are operating the safest airline industry, aerospace
industry, and our airways here in this country.
And I have been very happy to hear the desire for just an
evaluation of where are the things that we can actually address
to make sure that, no matter what, these types of tragedies
don't occur in the future.
And you know, as a member of this committee, I take our
constitutional duty of oversight very seriously. And I know
that you take the FAA's duty to safety very seriously, as well.
And because of that, I want to take a step back and ask how
often--and you mentioned in your testimony that the regulations
and safety certification procedures are constantly reevaluated.
Can you talk a little bit about how often the process is
reevaluated to make sure that when new technologies are coming
along, and we have got new standards that might be developing,
how often are we evaluating the actual process of the
certifications?
Mr. Elwell. Thank you for that question.The FAA, as an
organization, is constantly collecting data, evaluating data,
taking action, and reviewing. It is the safety management
system approach to everything we do. It is never static.
Having said that, we don't change just to change.
We pull data, we review, we analyze data. We do this both
internally and we do it externally. We have what is called--and
I don't know how far you want me to go into this, but we have
an organization called the Commercial Aviation Safety Team that
was formed in 1997. The goal there was to gather data from all
stakeholders in the commercial aviation ecosystem, and to
collect all that data voluntarily, and analyze that data, come
up with safety enhancements.
Since 1997 we have generated over 100 voluntary safety
enhancements the entire industry uses, and they use them to
this day. And we have reduced the commercial aviation fatality
rate by 95 percent since 1997. And that is exactly from what
you just asked, from analyzing our processes, gathering data,
coming up with solutions, implementing those solutions, and
then evaluating the results of that implementation.
Ms. Davids. And then can--I would actually like to hear
about the exchange of information between the NTSB and FAA.
Earlier you mentioned that when the NTSB has gone through
and looked at some of the--probably some of the previous
accidents, that--at least on one occasion, a recommendation to
include video recordings in the cockpit has been made. How
often are the--who is making the decision about which
recommendations by the NTSB are being adopted into the safety
protocols?
And can you talk a little bit about what that process looks
like?
Mr. Elwell. Is that----
Ms. Davids. Maybe a little bit about how are the
recommendations made, and then how do you decide whether or not
you are going to accept those recommendations?
Mr. Sumwalt. Right. I will make it quick. The NTSB
investigates transportation accidents. And when we find areas
that could enhance safety as a result of that accident or
crash, we issue safety recommendations. We issue them to the
appropriate recipient. We issue for aviation accidents--more
than likely they would go to the regulator, who, of course, is
the FAA in this case.
Mr. Elwell. And we receive the NTSB recommendations, and
then we have to go through a process to evaluate those
recommendations against the whole system.
Chairman Sumwalt, we have had this conversation. They have
sometimes the enviable luxury of looking at a single event, or
a single issue. We take every recommendation in its totality
for the whole system. And that is why we continue to
collaborate, and we continue to evaluate all the
recommendations to determine whether or not they can be
implemented.
But the unifying thing between NTSB and FAA is an
unshakable desire to improve this system, and make the system
safer.
Mr. Larsen. The Chair recognizes Representative Brownley
for 5 minutes.
Ms. Brownley. Thank you, Mr. Chairman. I too want to
express my condolences to the family who is here today. My
daughter lives in Africa, and has lived and worked in Africa
for the last 5 years. She has lived in a couple of different
places. She lived in Nairobi. And my daughter has taken this
flight from Addis Ababa many, many times. So this particular
crash really hit me hard in my gut. But my condolences to you.
I also wanted to follow up on that camera in the cockpit
suggestion. So you make the suggestion to the regulator, but
none of those suggestions are made public. That doesn't come to
Congress.
Mr. Sumwalt. Thank you for that question. We do not issue
recommendations directly to Congress. However, when Congress
asks for our input, we do in fact provide a list of all open
recommendations. And thankfully, oftentimes those
recommendations end up getting folded into legislation.
Ms. Brownley. And then, when the FAA doesn't agree with
recommendations, does that report come to Congress?
Mr. Elwell. Ma'am, I don't think so. I don't think so. But
I will check. I will check and make sure.
[The information from the Federal Aviation Administration
follows:]
Post-hearing response from the Federal Aviation Administration to
request for information from Hon. Brownley
All NTSB accident investigation reports, the recommendations
stemming from the investigations, and the FAA response to those
recommendations, along with the NTSB's status of those recommendations,
are available to Congress and the public through the NTSB's web page.
Ms. Brownley. Thank you.
Mr. Elwell, in your testimony, you stated that any party
that the FAA regulates remains responsible for compliance with
the FAA's regulatory standards, and the FAA does not hesitate
to take enforcement action when it is warranted. So was there
ever a time through the 737 MAX certification that enforcement
was warranted?
Mr. Elwell. The 737 MAX certification began in January 2012
and ended in March 2017, so----
Ms. Brownley. Was there ever----
Mr. Elwell [continuing]. Five years----
Ms. Brownley [continuing]. Was it ever warranted to----
Mr. Elwell. I will defer to Earl if we took enforcement
action specifically on anything with regard to the MAX.
Mr. Lawrence. I do not believe we took any enforcement
action regarding the MAX during that 5 years.
What would have happened, because it was a certification
activity, is any time we would have gotten any concerns from
any of the engineers that were working it we would have
evaluated those and addressed them right then and there, before
the final certification.
Ms. Brownley. OK. But there--in terms of some of this self-
certification process that is part of the certification
process, there was never a need to take any enforcement action?
Mr. Lawrence. Not----
Ms. Brownley. Yes or no. I have got a lot of questions.
Mr. Lawrence. Not for these particular items----
Ms. Brownley. OK, OK, very good.
Also, Mr. Elwell, in your testimony you say the FAA
identifies all safety standards, identifies all safety
standards, and makes all key decisions regarding certification
of the aircraft.
So, from your perspective, does that ultimately mean that
the buck stops with you?
Mr. Elwell. Yes, ma'am, it does.
Ms. Brownley. Thank you.
Also, in your testimony you talked about the process for
certification included 297 certification flight tests. And you
say then some of which encompassed tests of the MCAS functions.
Can you tell me how many times that that was tested? You gave
the number for the overall process, but not for the MCAS.
Mr. Elwell. Yes, 297 flights, 133 we flew and the others we
contributed in some way or another.
I don't know the number of test flights where the MCAS was
evaluated----
Ms. Brownley. Do you have that in a record somewhere?
Mr. Elwell. We certainly would have that, and get that back
to you. Yes, ma'am.
[The information from the Federal Aviation Administration
follows:]
Post-hearing response from the Federal Aviation Administration to
request for information from Hon. Brownley
During the certification of the 737 MAX, the MCAS function, which
is part of the primary flight control system, was tested by the FAA,
including in engineering simulator familiarization/evaluations and
airplane flight tests. This was done in conjunction with stalls and
maneuvering characteristics testing and included steep turns and upset
recovery maneuvers.
Airplane handling qualities were evaluated during stalls, steep
turns, and upset recovery scenarios with MCAS failure modes (MCAS off).
The certification testing of the flight control system had four areas:
stall speed performance; maneuvering characteristics; stall
characteristics; and control system malfunctions.
The FAA flew 24 of the 30 flight tests on the flight control
system. MCAS was active during these flights, except during testing of
the failure mode with MCAS disabled. The flight test breakdown is as
follows:
For stall speed performance, there were seven flight
tests--the FAA flew all seven.
For maneuvering characteristics, there were seven flight
tests--the FAA flew three of the seven.
For stall characteristics, there were seven flight tests,
three with planned MCAS involvement--the FAA flew six of the seven.
For control system malfunctions, there were nine flight
tests--the FAA flew eight of the nine.
Ms. Brownley. OK, very good. You also went on in your
testimony to talk about Secretary Chao and the U.S.
Department's inspector general report. Do you have any idea
when that report will be available to the public?
Mr. Elwell. I think you are referring to the IG report----
Ms. Brownley. Yes.
Mr. Elwell [continuing]. She directed on certification. I
can't--I don't want to set a date for the IG, but I--generally,
those investigations take 9 to 18 months.
Ms. Brownley. Thank you. Secretary Chao also announced the
establishment of a special committee to review the FAA's
procedures for certification. You stated that that will be
presented directly to the Secretary and the FAA Administrator.
What about to the public and to Congress?
Mr. Elwell. Ma'am, typically this--the special committee
that will be formed under the SOCAC, it is, for lack of a
better term, a blue ribbon panel. And in my experience over my
career, blue ribbon panel results are often made public. But I
won't speak for the Secretary as to how those results will be
disseminated. But I can, again, get that answer for you,
absolutely.
[The information from the Federal Aviation Administration
follows:]
Post-hearing response from the Federal Aviation Administration to
request for information from Hon. Brownley
The Department of Transportation will keep Congress apprised of the
Special Committee report.
Ms. Brownley. Thank you. I have more questions, but my time
is up and I yield back.
Mr. Larsen. The Chair recognizes Representative Allred for
5 minutes.
Mr. Allred. Thank you, Mr. Chairman. And thanks to our
panels for being here. I represent Dallas, which is home to
Southwest Airlines and American Airlines, two of our best
airlines here in the country, who have also invested heavily in
the 737 MAX. We also have Boeing in our area, and I recognize
the investment that they have made in this, and the price that
it is costing our airlines, the grounding of the MAX. And I
also, of course, recognize what this is doing to Boeing.
But I think that our role on this committee--and your role,
obviously, as I know you agree--that the FAA is--our motivation
for being here is that we want to make sure that our airspace
is the safest in the world, that we continue to be the gold
standard. I have been asked a lot about the MAX in Dallas, and
then I always say that, you know, we still are the gold
standard for safety, and that we will remain that.
And so my questioning in these next couple minutes is
getting at making sure we maintain that. Because when we spoke
back in March, when you briefed us in a private briefing, I
mentioned to you reports from pilots with concerns being raised
about the MAX, and you kind of downplayed some of those. And
then, as the Dallas Morning News recently reported, and as some
of my colleagues have mentioned, a recording between the
American Airlines pilot union and Boeing on November 27, 2013,
the pilots expressed a number of concerns to the Boeing
executives.
And my question to you is was the FAA made aware by Boeing
or by anyone else about that meeting, or about any of the
pilots' concerns?
Mr. Elwell. Well, thank you for that question, Mr. Allred.
My first indication of that meeting was when I read about it in
the article. And I can't--obviously, I can't speak to a private
meeting.
I will tell you this, though. My understanding is that
meeting happened not long after the Lion Air accident. And I
will tell you, as a lifelong pilot, that when an accident
happens anywhere, and it is--and it includes an airplane you
fly, it becomes visceral. It is an emotional response, pilots
who fly an airplane, when they see one go down. And I would
imagine that there was heightened emotions in that meeting.
I will tell you that when I was briefed and they explained
the Lion Air and what we--the data we gathered, and told me
about the MCAS, and I learned that it wasn't explained in the
manual, my pilot juices started flowing, and I said, ``Well,
we--let's look--we need to look into that.''
So I don't discount what was reported in that meeting, and
I understand it, but I can't comment on it, what was said in
the meeting.
Mr. Allred. OK. Do you know if there were any ODA designees
present at that meeting for Boeing?
Mr. Elwell. I have no idea.
Mr. Allred. OK. If not, should there be a requirement
placed on manufacturers like Boeing to disclose the concerns of
pilots when they are presented in a fashion like that? Should
the FAA have been made aware of that?
Mr. Elwell. My--sir, my initial reaction to that question
would be any time a manufacturer that the FAA has regulatory
oversight over becomes aware of a critical safety item, it
should be made known to the FAA.
And I will defer to Earl if that is actually part of a
regulatory----
Mr. Lawrence. It is actually a regulatory requirement, that
if they become aware of anything that is critical to safety,
they need to disclose that to us.
Mr. Allred. So after one crash, when a major pilot union is
expressing their concerns, that should have been raised to FAA?
Mr. Elwell. Again, if it is a critical safety of flight
item, either procedural----
Mr. Allred. I would say, just--you know, I am not a pilot.
I would say, though, if we have had a crash, and our
professional pilots here, domestically, are expressing their
concerns, that that is something that the FAA should know
about. And so I think that that is something we need to look at
here, in Congress, to make sure that you have that information
as quickly as possible.
Mr. Elwell. If I could add, Mr. Allred, at the same--at
around that same time, since Lion Air accident and forward to
today, my communications--I happen to have been an Allied
Pilots Association member for 16 years. I had regular
conversations with the leadership of the Southwest Airline
Pilots Association, the Allied Pilots Association and the Air
Line Pilots Association on a regular basis, because we thrive
on transparency, we thrive on communication.
And I had regular conversations with them, including an
April 12th meeting where we brought in the unions of all three
of our U.S. operators of the MAX and their flight departments,
and we had a give-and-take for about 2\1/2\ hours.
Mr. Allred. Well, thank you. And just, Mr. Chairman, for
the record, if we could, I would like to have an answer on the
MCAS not being in the manual, and how the decision was reached
by the FAA not to require that.
If you could submit that for the record, I would appreciate
that.
Mr. Elwell. Yes, sir.
Mr. Larsen. For the record.
So we will proceed with the second round of questioning,
and I will recognize myself for 5 minutes and go to Mr. Sumwalt
and Ms. Schulze with regards to the ET302 report as an example
of how we work in a supporting manner, as opposed to a lead.
Are there things in the ET302 report that you would
characterize differently if you were writing it?
Mr. Sumwalt. Well, I will take a stab at that, and then let
Dana mention it.
The Ethiopian Government has not had the number of
investigations that we have had. And I say that not in a
bragging manner, but we have been in business for a long time.
They have not had many major accidents in Ethiopia, so they
don't have the level of experience that we do. Again, I am not
bragging, nor making a condescending statement. It is just a
fact.
As a result of that, they are moving very cautiously and
very deliberately. And so, as far as the rest of that, I will
defer to Dana.
Ms. Schulze. Thank you for the question, Chairman Larsen.
And in fact, we are very pleased that the Ethiopian Government
did release a report publicly. That information was critically
important, of course, to the FAA and Boeing, but it was also
critically important to other airlines flying the aircraft and,
frankly, other regulators worldwide, to understand all the
factors.
With that said, as with--we see in many preliminary reports
issued by different countries they are perhaps not exactly as
the NTSB would format the information, or produce it, but I
would say that the preliminary report is just that, it is the
information that was available at the time. And so I would
caution that that is not everything, by any stretch. And some
of that information will need to be expanded further. And we
are, of course, working very closely with the Ethiopian
Government to make sure that we contribute and participate in
that work.
Mr. Larsen. Does ICAO provide a rubric, or a standard
format for developing and for actually reporting the results of
the investigation?
Mr. Sumwalt. Yes. The short answer to that is yes. ICAO
Annex 13 outlines the standards and the recommended practices.
Mr. Larsen. And to your satisfaction, in the case of ET302,
the Ethiopian Government is following those standards and
practices?
Mr. Sumwalt. They are. But Dana was just in Ethiopia last
week, and I think she could further elaborate.
Ms. Schulze. Yes, they are following the Annex 13 practice.
And we, as a state, or state of manufacture, have our
accredited representative as part of the investigation, along
with our advisors.
And so I was in Addis to meet with the investigative agency
to reinforce the U.S. support, and our participation in the
follow-on investigation at this point that will go forward. So
yes, they are following the process, and we are going to
continue to work closely with them on that in all areas.
Mr. Larsen. So in the case of the Lion Air and Ethiopia--
well, I guess when we apply our standard of timelines we tend
to think it takes a year to get a final report out from NTSB,
about, give or take. Do you anticipate it will be a year for
the Lion Air report, and a year from the crash for the ET302
report?
Mr. Sumwalt. Yes. In the case of Lion Air they have said
that they would--they are planning to get the report out by the
12-month anniversary.
As far as Ethiopian?
Ms. Schulze. It is very early in the stage for Ethiopia,
and I--we couldn't say. But the Indonesian Government is
planning to have a report released in the--towards the fall.
Mr. Larsen. All right, thanks.
Administrator Elwell, regarding next week's meeting in--was
it next week in Dallas--with the directors general, what is the
FAA's goal in this meeting?
Mr. Elwell. Thank you for that question, sir. The goal is
to offer all of these countries who have grounded or prohibited
flight in their airspace, 737 MAX, the benefit of all the
information and all the thinking we, as the state of design,
have to offer them.
It has been mentioned several times in this hearing that
there is the perception, at least, of a crisis in confidence,
particularly with regard to the airplane, and maybe larger. It
is my hope that we get to, in a way, sort of fix a process that
didn't, in my opinion, go in a way that we are used to
internationally on the initial--at the accident.
Internationally, we are collaborative 99 percent of the
time. When the Ethiopian accident happened, it was not a
collaborative process from Sunday night to Wednesday morning,
despite our best efforts and attempts to have conversations. I
know countries act, and they act for various reasons.
This--on the ungrounding, I think it is just critically
important that, as a global aviation community, we do what we
do best. We collaborate. We exhibit transparency. We answer the
questions that I am sure these countries are going to have of
us. And then, at the end of the day--it will be, literally, a
day-long agenda and regimen with them--my hope is that they
have the confidence in our work and our analysis to make their
ungrounding decisions, if that is where the discussion is, as
close to our decision as possible, because I think that is
important for the world, to have some level of confidence.
Mr. Larsen. Thank you. I did notice two Members came in
after we started the second round. In fairness, though, I did
promise the ranking side a set of questions, unless they want
to be kind enough to let us go to the Members who came in for a
first round. I am just trying to figure out what the rules are.
All right, I would recognize Mr. DeFazio.
Mr. DeFazio. Thank you, Mr. Chairman. Just in answer to an
earlier question, I did change the law a number of years ago,
and I think the--Mr. Sumwalt is aware of this. You do have to
respond when they submit things to you. You can say yea or nay,
but you do have to meaningfully respond. It used to be that you
would send things over, and they would never respond and ignore
them. So you should be getting yeas or nays out of the FAA when
you send things over.
Mr. Elwell. Mr. Chairman, you are right. And I didn't
realize that was the question. But absolutely, we are required
to tell them that we are doing it, or not doing it, or why.
Mr. DeFazio. It used to be that they went into the ether.
Now they have to at least tell you that they don't agree. In
any case, just to clarify that.
And so, to Mr. Lawrence, my understanding is originally the
Europeans and the Brazilians said retraining of pilots was
required. Later, for whatever reason, the Europeans decided it
wasn't. Is that correct?
Mr. Lawrence. That is not my understanding of it.
Mr. DeFazio. OK. What about the Brazilians?
Mr. Lawrence. Again, there was----
Mr. DeFazio. So that new----
Mr. Lawrence [continuing]. Lots of discussions. And my
understanding is----
Mr. DeFazio. So that list of 40 or 60 things--can't
remember the exact number--that the Brazilians had about the
plane that they thought were significant differences doesn't
exist?
Mr. Lawrence. I actually have a email here, sir, from the
Brazilians that recalled that, and said that was a mistake.
Mr. DeFazio. It was a mistake to say all those things that
would require retraining, and so then they just withdrew it?
Mr. Lawrence. I think the context of all of these things is
these are discussions when we evaluate aircraft.
Mr. DeFazio. Right, OK.
Mr. Lawrence. And they meant everything in that
discussion----
Mr. DeFazio. OK, so--all right. So--all right, fine. But
that is something that we are going to be looking into, and I
have asked for both the Brazilians and the Europeans to
respond, because there is questions on why they changed their
mind, or when they changed their mind, or how they changed
their mind in this process.
Now to the Administrator, so it is an amended type
certificate, because there is an artificial system, the MCAS,
which makes it fly like the earlier versions, the NG and
others. Now, if we have essentially neutered the MCAS--all you
have to do is pull on the yoke--does it now fly the same as all
the earlier planes? And so it is still an amended type, or is
it now a new type?
Mr. Elwell. So, Mr. Chairman, actually, in the MAX pulling
back the yoke doesn't----
Mr. DeFazio. It will in the future, my understanding, the
fix.
Mr. Elwell. No, the fix won't include the yoke pull back
cut-out.
Mr. DeFazio. OK, all right. That was reported----
Mr. Elwell. Because that disables----
Mr. DeFazio [continuing]. And the staff was under that
impression. OK. So but--all right. So MCAS is going to be
modified to work off both sensors. That is the only major
change?
Mr. Elwell. So----
Mr. DeFazio. Except it will only trigger once.
Mr. Elwell. Correct, and there is one more. And I can't--
and the engineers can't--imagine a scenario where this would
happen, but in the Lion Air and Ethiopian incidents, the MCAS
kept re-engaging because it still was receiving the signal that
it needed to engage, until it reached a point with the motion
of the stabilizer--this is the stabilizer, the back of the
airplane that--pilots always have to do that--but it reached a
point where they did not have yoke authority to reverse the----
Mr. DeFazio. Right.
Mr. Elwell. The third part of the fix is, no matter if it
re-engages more than once--and it would have to completely
reset and go back to this--to the proper--it will always give
the pilots 1\1/2\ Gs of authority. It will always give--it will
never go to full deflection. So even in the chance that it
powers several times, the pilots will have yoke authority.
Mr. DeFazio. OK. Just also for an earlier point you made
about us leading the world and ICAO on training standards, I
would point out that Congress had to mandate that change after
Colgan Air, because I had been trying for many years and we
hadn't gotten there. And so that was something that wasn't
initiated--and this was before your time--by FAA, it was
something that was mandated by the Congress.
Thank you, Mr. Chairman.
Mr. Larsen. All right, thank you. After consulting the
committee rules, Members get a first round. And so we will
start with Mr. Carbajal from California.
Mr. Carbajal. Thank you, Mr. Chair. Administrator Elwell,
in the last several years FAA has moved to utilization of ODA
authority to speed up the certification process. How does the
agency determine whether or not it has enough inspectors or
engineers to provide adequate oversight?
Mr. Elwell. Thank you for that question, sir. I would make
a slight correction. The Organization Designation
Authorization, ODA, that you referenced actually wasn't put in
place to speed up certification. It was put in place so that a
robust certification process could happen with collaboration
between the FAA and the manufacture of design. And the detail
about that is really in the wheelhouse of Mr. Lawrence, as the
head of certification.
Mr. Lawrence. So I believe your question was about our
oversight, and how do we maintain that and the ratio.
There are multiple programs, depending on the type of
oversight, whether it is manufacturing, whether it is oversight
of an air carrier, or whether it is over the design. And we
evaluate that on an annual basis to make sure that we have
sufficient resources to oversee those particular items, and
they are done individually, and they are influenced by other
factors such as a company's financial status, whether there are
pilots on strike--and, you know, we take all the external
items, not just their performance, in consideration about what
resources we have on their oversight.
Mr. Carbajal. That sounds very vague to me. There are no
standards that dictate the number of engineers or inspectors
that you need to have on site?
Mr. Lawrence. The standards don't articulate a ratio when
it comes to an ODA of a specific number of our resources to a
specific number of their resources. What the standards dictate
is that we have the individuals necessary to do the oversight.
The reason why it is not a single one-size-fits-all is because
of the different types of ODAs and the way they are structured.
When it comes to Boeing it is such a big one, and it is so
critical to us, we established a specific Boeing oversight
office that--that is their sole job, to provide that day in and
day out, so that their attention is not split in between
oversight of another ODA or another manufacturer. They are
focused solely on making sure that the ODA and Boeing's
performance meet our expectations.
Mr. Carbajal. Thank you. In October 2015 the Department of
Transportation Office of Inspector General recommended that FAA
adopt a new oversight approach for ODA holders by developing
new evaluation criteria and risk-based tools. The inspector
general recently testified that this report recommendation is
still open. What is the status of this effort, and why has it
taken so long to do so?
Mr. Elwell. Sir, thanks for that question. We, the FAA,
welcome the evaluation, the audit, the review that the IG
offers, that this committee offers. Every time somebody does--
an entity within the FAA or externally, we learn something new
and we get better. It is how we have reached the level of
safety we have today.
And the recommendation you referred to, the 2015
recommendation about ODA oversight, I am going to let Earl
answer the specifics of that. But what it has taken us is from
a sort of a strict adherence to an annual review to something
that is more akin to the way we do our oversight and the way we
do our regulation in the system today, which is much more data-
driven, risk-based, performance-based, so that we have the
freedom to go and inspect an ODA five times in a year if we
need to, if the data suggests.
But I will let Earl explain the specifics.
Mr. Lawrence. Well, I will just add, in the interest of
time, that we accepted every single one of those
recommendations. We have implemented them all, except for one.
And it is not because we don't accept it, it is just it takes a
period of time to implement fully all those recommendations. So
we accept them all, and we are grateful for those, and they are
guiding us going forward.
Mr. Carbajal. So how much longer is it going to take to
implement this one?
Mr. Lawrence. So the last one is tied into implementation
of direction from this committee, as well, to change the way we
provide oversight, to have a dedicated organizational
delegation office. That was designated by Mr. Elwell in April.
And so that has started, and it will take us at least the
summer to restructure and get everything in place to implement
that.
So I am hoping by the end of this calendar year we will
have completed that final recommendation, as well.
Mr. Carbajal. Thank you very much. Mr. Chairman, I yield
back.
Mr. Larsen. Thank you. The Chair recognizes Representative
Garcia for 5 minutes.
Mr. Garcia. Thank you, Mr. Chairman. First I ask unanimous
consent to enter into the record a statement written by the
parents of Samya Rose Stumo, who was just 24 years old when she
was killed in the March 10th crash of a Boeing MAX 8 airplane
while on a mission to help others with healthcare in low- and
middle-income countries. Her parents, as all of you know, Nadia
Milleron, and her father, Michael Stumo, are tirelessly
advocating for greater airline safety. And of course they have
joined us during the duration of the hearing today.
Mr. Larsen. Without objection, so ordered.
[The information follows:]
Statement of Nadia Milleron and Michael Stumo, Submitted for the Record
by Hon. Garcia
Our names are Nadia Milleron and Michael Stumo. We are the parents
of Samya Stumo who lost her life on March 10, 2019, in the crash of
Ethiopian Airlines Flight 302 aboard a Boeing 737 Max 8 airliner. Words
cannot capture the grief we still feel and that will fill our lives
forever.
We make this statement today to try to express to this important
congressional Committee about the impact that a plane crash has on the
lives of so many. It was not just our family that needlessly suffered
the loss of our beloved 24-year-old daughter who had so much to give
the world. There were 157 people on that plane that crashed into a
field, making it their burial ground. Although we immediately rushed to
Ethiopia to recover what we thought would be her body, we began to
realize that there were no bodies. In fact, the remains, what little
might have been left of Samya and of everyone else on that plane, were
such small body fragments that they could not be recovered. We were
forced to leave Ethiopia without her body.
We wake up every morning thinking of our Samya, and we go to bed
each night hoping that she did not suffer too much in the last moments
of her life. It was a wonderful life she had and one where only dreams
lay ahead. She was traveling to make life better for others, helping to
set up ThinkWell offices in countries that could benefit from better
health care delivery. She was such a giving person. We are so proud of
all that she accomplished and the mark that she left on so many in her
short life. As we talk to other families who lost loved ones, these
stories of love, of pride, of accomplishment, of loss are repeated over
and over again.
But now we turn to you, as congressional leaders, to make sure that
other families do not suffer from preventable airplane crashes in the
future. Families of the victims have not been included in the process,
we need to be included at all levels from here on out.
The Boeing 737 Max 8 airplane needs to remain grounded until all
independent investigations are complete. Investigations are ongoing by
this Committee, the Joint Authorities Technical Review, the Department
of Transportation Inspector General, The DOT Blue Ribbon Panel, the FBI
and the FAA Technical Advisory Board. The purpose of these
investigations is to discover everything necessary to identify and
correct problems.
A stunning array of news stories are consistently revealing more
potential problems with design, safety procedures, software, hardware,
manufacturing and certification. Flyers and governments across the
world, including our family, have had our trust in Boeing and in the
Federal Aviation Administration shaken. The Boeing culture of
engineering safety may have been destroyed in favor of a Boeing
management culture of profit extraction.
A third crash would kill more people and destroy the credibility of
Boeing and the FAA.
The Federal Aviation Administration has a clear path forward to re-
establish credibility and protect flyer safety. It can wait until all
investigations are complete to determine all problems including the
relationship among hardware, software, manufacturing, design,
certification and pilot operation. Doing so would convince us, victims'
families and the world that the FAA and Boeing are serious in putting
flyers first.
Starting the ungrounding process before all investigations,
including criminal investigations, are complete, would not.
Mr. Garcia. Thank you, Mr. Chairman. I will waive my
statement to ask questions, as the hour is late as it pertains
to this hearing.
Mr. Elwell, would you please confirm that proper operation
of MCAS was considered a critical or essential safety feature
in your certification of Boeing 737 MAX aircraft?
Mr. Elwell. Yes, sir. The MCAS was certified as a critical
safety product in the total certification of the aircraft.
Mr. Garcia. Would the plane have been certified without it?
Mr. Elwell. That is too subjective for me to answer. I
can't give you an answer for the record on that.
Mr. Garcia. Mr. Lawrence, sir?
Mr. Lawrence. I can maybe add a little context to it. The
MCAS system was installed to make sure that it was in
compliance with a specific regulation or handling
characteristics. So that was the method Boeing chose to meet
that requirement. They would have to meet that requirement. If
they didn't do it through MCAS they would have had to meet that
requirement through some other means, which could have been a
structural change.
Mr. Garcia. What review functions were delegated to
Boeing's engineers and Boeing engineer managers serving as
outside evaluators?
Mr. Elwell, or either one of you?
Mr. Elwell. Sir, could you repeat the beginning of that
question?
Mr. Garcia. What review functions were delegated to Boeing
engineers and Boeing engineer/managers serving as outside
evaluators?
Mr. Elwell. Sir, I am going to defer to Earl on the
specifics of that question.
Mr. Lawrence. So I believe, sir, you are referring to the
organizational delegation members who are employees of Boeing,
and their oversight.
Mr. Garcia. That is correct.
Mr. Lawrence. And I make the distinction, because Boeing--
the company, not the ODA--is responsible for compliance, and
must show all the compliance finding. The members of the ODA
and that structure, which--all members are approved and vetted
by the FAA--are the reviewers of whatever Boeing the company
does first, before we have our third set of eyes on the work
that they do.
Am I answering your question, sir?
Mr. Garcia. I think so. Let me change gears, as the clock
is ticking.
In light of the apparent malfunctions of the MCAS in these
crashes, have you considered the adequacy of your review of the
MCAS and any other essential critical safety equipment on the
737 MAX or other airplanes?
Mr. Elwell. Mr. Garcia, thank you for that question, sir.
That is exactly what we are doing. It is what the IG is going
to look at, as directed by the Secretary, the processes by
which we certify aircraft. The Joint Authorities Technical
Review is going to look at the flight control computer system
and the certification thereof. And of course, the special
committee, or the blue ribbon panel that has been--also
commissioned by the Secretary--is going to look at the process
that we used for certifying the MCAS, 737 MAX, and our
certification processes, writ large.
Again, these are reviews and audits and investigations
that, because they have been helpful in making us better, we
welcome them. And we will participate to the extent that we are
able, and look forward to the recommendations.
Mr. Garcia. Thank you. And to Chairman Sumwalt, do you
think that the outcome of the investigations that are ongoing
will result in greater training of pilots from other countries?
Mr. Sumwalt. Congressman Garcia, that is hard to say. We
need to figure out everything involved in each of these actions
to actually make that determination. Of course, as you know,
ultimately the determination on training will be up to the
regulator.
Mr. Garcia. Thank you. I yield back, Mr. Chair.
Mr. Larsen. Thank you. The Chair recognizes Representative
Brown for 5 minutes.
Mr. Brown. Thank you, Mr. Chairman. Earlier in the hearing
Chairman DeFazio was asking about engineers reporting to
managers. The point was made that often these managers are
engineers. For me, what that raises is really just the
fundamental question of the independence of the engineers who
are making these decisions, these assessments, evaluations
about compliance, whether it is design, or build-out of these
components or an aircraft.
The investigation around the Challenger shuttle explosion
in 1986 found instances where engineers and employees raised
concerns about the shuttle that were not efficiently taken into
consideration by management. And I know, you know, obviously,
NASA and FAA are different, and the processes are different.
But my concern is that this could be another example of a
management failure, and not necessarily or exclusively an
engineering failure. Sometimes managers are influenced by
factors other than safety and quality, and that is the nature
of large organizations. Maybe it is profit. Maybe it is public
pressure to deliver something.
So I would like to ask about the mechanisms that are in
place at the management level to ensure that engineering
software and labor concerns are adequately taken into account
when evaluating new and old products. The FAA is responsible
for ensuring that its products are brought to market, all
reasonable efforts have been made to properly characterize risk
and ensure public safety is fully protected. At the core of
this function is the independence of engineers who are
conducting the evaluation.
So, Mr. Elwell, what processes does the FAA have in place
to maintain the independence of its engineering assessments for
certifying flight worthiness, and ensuring that there is an
environment that engineers understand that their professional
engineering opinion will be valued and supported?
Mr. Elwell. Thank you for that question, Mr. Brown. That is
exactly what we have endeavored to instill in the ODA process
from its inception. And that is a freedom of the ODA members to
come to the FAA with any and all--in fact, it is trained, every
ODA member is vetted by the FAA before that member is approved.
Things such as integrity, professionalism, experience in
certification, all of those things are weighed.
I would point out not only has ODA been a refined process
for decades, it has also been endorsed by Congress in a number
of FAA reauthorizations that have actually expanded in statute
our responsibilities to increase ODA. And I say that only to
point out that ODA, when done right, is indispensable to the
safety of this system and to the health and growth of our
aviation ecosystem.
Having said that, the investigations that have been
initiated as a result of these accidents we are going to follow
with great interest, and we are going to take the
recommendations and the findings to make the systems----
Mr. Brown. Let me ask this followup, and I appreciate that.
In the course of evaluating the safety of the 737 MAX
during the certification, were there any dissenting opinions
raised during the evaluation of its flight worthiness? And is
the process set up where an engineer may disagree with another,
and raise that independently to the FAA?
Mr. Elwell. Is your question did that happen, or is that
something----
Mr. Brown. Yes, did it happen, did it happen, and does that
happen.
Mr. Elwell. I don't know if we have record of that, and
Earl could address that. But I would----
Mr. Brown. Well, let's--Earl, can you address that?
Mr. Lawrence. We do not have a specific record of a--for
example, a written complaint from one of the Boeing engineers,
or a concern. But I want to reinforce that there is dialogue in
between FAA engineers and Boeing engineers along the whole
process. And they do express concerns, they do have technical
debates, and that is a normal part of the process.
And I want to highlight that the FAA sets the standards,
and the FAA is the final decisionmaker. And we do that to
protect the engineers, as you are articulating, that they can't
change the standards. It will be--they evaluate whether they
are meeting those standards. And when they see undue pressure,
there is--we actually require the Boeing ODA to have a whole
reporting system, which--they have a process to evaluate any of
those concerns and report it back up.
Mr. Brown. Thank you. Thank you, Mr. Chairman.
Mr. Larsen. Thank you. Continuing with the first-round
questions, Mr. Lynch, Representative Lynch, is recognized for 5
minutes.
Mr. Lynch. Thank you very much. Thank you, Mr. Chairman,
for holding this hearing. And I want to thank the witnesses for
your help.
Mr. Lawrence, the issue around the sensors and the fact
that--at least it is alleged in some of the press reports that
the purchasing airlines were not aware that certain sensors
were inactive. Have you dealt with that in terms of your own
investigation and your own review of what has happened in both
of these airline accidents?
Mr. Lawrence. So, sir, I believe you are referring to the
angle-of-attack enunciator or indicator in the cockpit?
Mr. Lynch. Right.
Mr. Lawrence. That was discovered by Boeing. It was not
reported to the airlines upon their discovery. It was evaluated
as an item under our software standards that did not have to be
reported, because there wasn't an associated pilot action with
that indicator.
So, since there was not an associated pilot action to take
based on that--it was really there for a maintenance alert--
then they were required to update it and bring it back into
working condition, but they were not required to report it at
that time.
Mr. Lynch. So going back to the bifurcation between the
FAA's responsibility versus the responsibilities that we
designate back to the manufacturer, is that something that, if
it were a core FAA function, would have been made aware--would
have been--that information would have been made aware to the
airlines themselves? Or is that something that would have gone
undiscovered, regardless?
Mr. Elwell. Sir, if there had been--if it--to your
question, if it had been a critical safety of flight item it
would have been immediately reported, and would have been
required to be immediately reported. That--it took too long. We
don't need the IG investigation, the JATR, or the special
committee to tell us that 13 months was too long for us to find
out that there was a software anomaly. And you have our
commitment that we are going to look into that and fix that.
Mr. Lynch. OK. The--as I read the Organization Designation
Authorization--this is the program where FAA hands off
responsibilities to Boeing--there is definitely, in my mind, an
asymmetry in technological ability that Boeing has here, and I
am worried about regulatory capture, if you will.
Under the ODA it says that only noncritical matters will be
shifted to Boeing. And when I hear the full committee chairman
say that this is a single point of failure--in retrospect, do
you agree that that, you know, the designation to Boeing for
this responsibility should have been kept with the FAA?
Mr. Elwell. Thanks for that question, Mr. Lynch. We are
going to wait for the investigations on process for an analysis
of--there are three different studies right now engaged on the
737 MAX certification.
In general, in ODAs we delegate to the manufacturer
noncritical items so that we can focus on the safety-critical,
or new and novel aspects of the certification of the aircraft.
Mr. Lynch. OK, I----
Mr. Elwell. The MCAS----
Mr. Lynch. Let me reclaim my time. And I understand that,
and I fully respect that.
Let me just go back. And I know other Members have said
this already, but this is a devastating pair of accidents here,
and my heart and my prayers go out to all the victims and their
families.
You also realize that this cannot happen again, right? This
cannot happen again. If this--if we lose another aircraft, and
I am in a--I am in the city of Boston. And so planes taking off
from Logan under these circumstances, 40 seconds out, 1 minute
and 40 seconds out, would land in very densely settled
neighborhoods, and would be totally devastating. So we have to
get this right, and I trust you will do that. Thank you.
Mr. Larsen. Thank you, Representative Lynch. We will go
to--continue second rounds now, and start with Representative
Balderson.
Mr. Balderson. Thank you very much, Mr. Chairman. My first
question is to both witnesses, and it is on behalf of Ranking
Member Graves.
His question was how do U.S. airline operations and safety
programs differ from non-U.S. airlines?
Mr. Elwell. Sir, the--each state is responsible for its own
safety programs. We have a set of standards set--guidance,
really, but adhered to, internationally. We have--as Chairman
Sumwalt said earlier, we have--193 nations participate in the
International Civil Aviation Organization, a U.N. body, who
adhere to those standards, aviation standards, across all
aspects of the aviation ecosystem.
Those minimums must be met or exceeded for any country to
fly to our country, or to have a cochair relationship with one
of our carriers to fly to our country. But it is up to each
country to determine whether or not they are going to adhere to
the minimums or raise them. And in the U.S., clearly, our
standards for--in almost every category far exceed ICAO
standards. That is not to say that the ICAO standards in any
area are necessarily too low. But we wouldn't have the safety
record that we have in our country if we hadn't raised the bar.
And the important thing here, sir, is that we don't just
raise the bar in our own little silo here in the U.S. aviation.
We have been proactive internationally for decades. And, as
Chairman DeFazio mentioned, one of the things that this
committee--that he championed, which is upset training and
stall training that was added to the training for our pilots,
in large part as a result of the Colgan incident--we went to
ICAO and we made the case, and it was accepted at ICAO, that
that additional training should be an international standard.
And we are now in the process of ensuring that that is
implemented globally.
Mr. Sumwalt. Congressman, the NTSB has nothing to add to
what Acting Administrator Elwell said.
Mr. Balderson. Thank you very much. My next question is to
Mr. Elwell.
There have been numerous reports in the media that the
certification of the MAX was rushed. How long did the
certification of the MAX take?
Mr. Elwell. Sir, the certification of the MAX began with
the application in January 2012, and it ended and was
certificated by former FAA Administrator Michael Huerta in
March of 2017. The whole process took 5 years, just around 5
years. The average for an amended type certificate is somewhere
between 3 and 5.
So I certainly wouldn't characterize it as rushed. We
adhere to the principle that a certification is done when all
of the standards and the regulations are complied with, not a
day before or day after. And that is the criteria we used for
the MAX.
Mr. Balderson. OK, thank you. One followup. Do you know the
typical amount of time a European Union Aviation Safety Agency
certification takes?
Mr. Elwell. Sir, I personally don't. But Earl, are you--do
they have an average?
Mr. Lawrence. I don't know what their average is, but on
average projects that we have been involved on with some of
theirs has been 3 years.
Mr. Balderson. OK, thank you. Mr. Chairman, I yield back my
remaining time.
Mr. Larsen. All right. The Chair recognizes the vice chair
of the subcommittee, Representative Davids from Kansas, for 5
minutes.
Ms. Davids. Thank you, Mr. Chairman. So I wanted to get
into a little bit more about the distinction between the light
the sensor will set off, the--I don't remember the
differentiating----
Mr. Elwell. The AOA disagree light?
Ms. Davids. Disagree light. So the disagree light is
something separate and apart from the MCAS system, or the
augmentation system actually engaging, right?
So the light is--has been the focus of the--and maybe it is
the canary in the coal mine, I don't know, but I think the
bigger issue is if the system engages and pilots have to
respond to it, or are forced to respond to it, the training and
the notice that that might be the case is--seems there is a
little bit of a disconnect, or a concern of many members on the
committee.
So what prompted the emergency airworthiness directive that
was issued in November 2018? I know the Lion Air tragedy
happened, and then after that the emergency airworthiness
directive was issued. And it specifically called for operators
of the 737 MAX to revise their flight manuals to reinforce and
emphasize to flightcrews how to recognize and respond to
uncommanded stabilizer trim movement and MCAS events. What
prompted that directive?
Mr. Elwell. So thank you for that question. Soon after the
accident it was apparent--the Lion Air accident--it was
apparent that it was an MCAS event. And it is important to note
that the MCAS is designed so that if it engages when it is
supposed to--in other words, in certain angles of attack, which
means nose high to the airstream--and under certain conditions,
if it were to function, it is designed such that the pilots
would not even know that it is operating.
So, by definition, if it operates when it is not supposed
to, which is what happened in both of these cases, pilots would
immediately know that something, maybe not the MCAS--and this
is why it is very important--an analogy, I think, that makes
sense in this regard is if someone in a restaurant is choking
you don't find out what they are choking on before you
administer the Heimlich. It is exactly the same in runaway
pitch trim.
When a pilot feels the nose going over in his hands he will
feel it in the yoke. He is trained from the beginning--at least
U.S. pilots, and it is not to say that international are not--
that is runaway pitch trim. And when the MCAS kicked in when it
wasn't supposed to, it drove the nose over in the pilot's
hands. They could feel it.
So what--when we looked at that data, and realized by--the
flight data recorder showed that the runaway pitch trim
procedure was not done with Lion Air in the entirety of the
flight--we knew that this needs to be emphasized. And that is
what the emergency AD did. It said, ``Remember, if you get a
pitch over activity in an airplane and you didn't tell the
airplane to do it, that is runaway pitch trim. Run the runaway
pitch trim procedure.'' That is why we put it in an emergency
AD.
We also added--and this was important--that before you run
that procedure, before you physically turn off those stab trim
motors, you still are able to use the trim switch on the yoke,
trim the pressure off the yoke so that, instead of feeling it
pushing you over and pulling it back, and fighting it, trim off
that pressure so the yoke is in a neutral state. Very important
to do that before turning off those motors. That was also in
those instructions, and that became critically important with
the Ethiopian accident.
Ms. Davids. So what is the process to follow up on an
emergency airworthiness directive to ensure that--the flight
manuals and the reinforcement of the process that is supposed
to be followed--how do you make sure that once you have sent
out the directive, that it is actually being adhered to?
Mr. Elwell. I am going to ask Earl to watch me on this
answer. But when we, the FAA, issue an emergency AD and it
applies to an aircraft that has worldwide use, it is married up
with a manufacturer's directive--which, in this case, Boeing
put out. And it is also--we do what is called a Continuous
Airworthiness Notification to the International Community. A
CANIC is also distributed globally, pointing to the emergency
AD.
Once we do that, then it is incumbent upon every civil
aviation authority that is a state of registry for that
aircraft, that oversees their airlines, their training, to make
sure that that manufacturer's bulletin and the FAA AD are
adhered to.
Ms. Davids. Thank you, Mr. Chairman.
Mr. Larsen. Thank you. I have a few questions for wrap-up.
First for Chair Sumwalt. How would you characterize the
ongoing communications now between the NTSB and the Indonesian
investigators and Ethiopian investigators?
Mr. Sumwalt. Very good. And, of course, Dana was in
Ethiopia last week to ensure that we maintain those good
relationships.
Mr. Larsen. Same with Indonesia?
Mr. Sumwalt. Indonesia is very good, as well.
Mr. Larsen. All right, great.
Mr. Elwell, we talked about the TAB, the Technical Advisory
Board. Is it your intent that the FAA would not make a decision
to unground the 737 MAX unless TAB recommendations were
implemented?
Mr. Elwell. Mr. Chairman, I--it is my intent to have any
TAB recommendation dealt with and adjudicated. Ultimately, the
decision to unground rests on me, rests on the FAA. I have sole
responsibility for it. So I am not going to sit here today and
put some responsibility on the TAB that I shouldn't. But the
whole reason that we created the TAB, and that they are working
with us and looking at the process right now, is so that we can
benefit from their expertise.
Mr. Larsen. OK. So before we wrap I want to give both of
the witnesses a chance to add anything that they would like,
and I will start with Chair Sumwalt.
Mr. Sumwalt. Well, thank you. I think we have heard
questions about pilot training. And maybe that there may be
different standards throughout the world. And I think it is
important to point out that if an aircraft manufacturer is
going to sell airplanes all across the globe, then it is
important that pilots who are operating those airplanes in
those parts of the globe know how to operate them. And I think
that is important.
Just to say that the U.S. standards are very good--and this
might be a problem with other parts of the globe--I don't think
that is part of the answer. And I don't mean this--I hate to
use this term, but the airplane has to be trained to the lowest
common denominator. Thank you.
Mr. Larsen. Administrator Elwell?
Mr. Elwell. Mr. Chairman, first I want to say again how
sincerely aggrieved we all are, the loss of lives in both of
these accidents. It is the reason why we do what we do, is to
prevent that. So when it happens it is horrific, and it drives
us.
And if I could leave this committee and the American public
with anything, it is that the 45,000 professionals at the FAA
and Secretary Chao and this committee, we are all united in the
goal to make sure that we look at everything possible. And that
is why all of these investigations, these audits, these reviews
are so critically important, because we are going to learn from
them, and we are going to honor the people who passed in these
accidents, and we are going to make it better.
Mr. Larsen. Thank you. No further questions from the
subcommittee?
Seeing none, I want to thank each of our witnesses today
for your testimony. Your contribution to today's discussion has
been informative and very helpful.
I would ask unanimous consent the record of today's hearing
remain open until such time as our witnesses have provided
answers to any questions that will be submitted to them in
writing, and unanimous consent that the record remain open for
15 days for any additional comments and information submitted
by Members or witnesses to be included in the record of today's
hearing.
Without objection, that is so ordered.
And if no other Members have anything to add, this
subcommittee stands adjourned.
[Whereupon, at 1 p.m., the subcommittee was adjourned.]
Submissions for the Record
----------
Prepared Statement of Hon. Pramila Jayapal, a Representative in
Congress from the State of Washington
Mr. Chairman, thank you for the opportunity to submit this
statement for the record for today's Transportation and Infrastructure
Aviation Subcommittee hearing on the ``Status of the Boeing 737 MAX.''
On March 13, 2019, the Federal Aviation Administration (FAA)
grounded the Boeing 737-MAX series planes after two similar accidents
in Indonesia and Ethiopia led to the death of 346 people. I am on
record supporting this decision and have called for an urgent
investigation into any safety issues around the 737-MAX.\1\ I commend
the House Committee on Transportation and Infrastructure's decision to
launch an investigation into the FAA certification process and
oversight of the Boeing 737-MAX planes.\2\
---------------------------------------------------------------------------
\1\ https://twitter.com/RepJayapal/status/1105903235540418560
\2\ http://dearcolleague.us/2019/04/co-sign-letter-to-faa-on-
certification-and-oversight-of-boeing-737-max-series-planes/
---------------------------------------------------------------------------
As the representative of Washington's Seventh District--which
encompasses most of Seattle and surrounding areas including Shoreline,
Vashon Island, Lake Forest Park, Edmonds and parts of Burien and
Normandy Park--I recognize and deeply appreciate the contributions of
generations of Boeing workers to our district. We have a skilled,
deeply rooted aerospace workforce in our region that is committed to
building the best planes possible. These jobs--and the success of
Boeing--fuel our district's economy.
Unfortunately, reports have emerged that many of these workers'
concerns about safety issues went ignored or were quieted in the lead
up to the recent tragic crashes of Boeing aircraft. For example,
according to an investigative report from the Seattle Times published
May 5, 2019, senior engineers employed by Boeing whose job it was to
act on behalf of the FAA faced heavy pressure from Boeing leadership to
``limit safety analysis and testing so the company could meet its
schedule and keep down costs.'' \3\ In fact, one of these engineers
working on the MAX program was removed from the program after raising
concerns about the aircraft's fire-suppression system around its
engines.
---------------------------------------------------------------------------
\3\ https://www.seattletimes.com/business/boeing-aerospace/
engineers-say-boeing-pushed-to-limit-safety-testing-in-race-to-certify-
planes-including-737-max/
---------------------------------------------------------------------------
I am also concerned about preliminary investigations revealing that
neither the Lion Air nor Ethiopian Airlines aircraft that crashed
included ``optional'' safety instruments that Boeing sold to carriers
for an extra cost and the FAA did not require to be added to 737-MAX
jets. These two instruments were designed to alert pilots to possible
malfunctions of an automated anti-stall system called MCAS, which in
both of these crashes may have been triggered by faulty data from an
angle-of-attack sensor. The malfunction of this system in both cases
pushed the planes' noses down, with the pilots struggling to gain
control of their plane.\4\
---------------------------------------------------------------------------
\4\ https://www.washingtonpost.com/transportation/2019/04/11/
markey-introduces-bill-bar-aircraft-manufacturers-charging-additional-
fees-safety-features-boeing-did/?utm_term=
.4a56a1619623
---------------------------------------------------------------------------
My deepest concern is the growing evidence that Congress has
allowed the FAA to delegate increasingly more authority to Boeing to
certify the safety of its own airplanes--which is directly jeopardizing
the lives of air travelers.\5\ Congress must seriously and quickly
review whether the agency is retaining sufficient oversight of safety
certification processes, and if it is not, we must increase the
resources of the FAA to conduct this oversight and ensure the safety of
these planes. I am particularly concerned that the FAA's reliance since
2004 on Organization Designation Authorization (ODA) to certify the
safety of aircraft represents a conflict of interest. Under this
system, the Authorized Representatives who work on safety issues on
behalf of the FAA actually report to Boeing managers, as opposed to FAA
technical managers as safety certification officers did prior to
2004.\6\
---------------------------------------------------------------------------
\5\ https://www.politico.com/story/2019/03/21/congress-faa-boeing-
oversight-1287902
\6\ https://www.seattletimes.com/business/boeing-aerospace/
engineers-say-boeing-pushed-to-limit-safety-testing-in-race-to-certify-
planes-including-737-max/
---------------------------------------------------------------------------
Federal oversight authorities have repeatedly raised concerns about
the ODA system and the FAA's delegation of authority to Boeing. In 2012
and then in 2015 again, the Department of Transportation inspector
general raised concerns about weak FAA oversight of Boeing. The 2015
audit raised concerns that FAA's office overseeing safety inspections
for Boeing was understaffed.\7\ The 2012 report found that FAA managers
who review safety features on new and modified aircraft designs had
faced retaliation for speaking up about their concerns, which pre-dated
the 737 Max development.\8\
---------------------------------------------------------------------------
\7\ https://www.oig.dot.gov/sites/default/files/
FAA%20Oversight%20of%20ODA%20Final%20
Report%5E10-15-15.pdf
\8\ https://www.bloomberg.com/news/articles/2019-03-18/boeing-had-
too-much-sway-checking-own-planes-faa-workers-warned
---------------------------------------------------------------------------
I welcome the stated commitment from the inspector general of the
Department of Transportation that FAA will revamp its ODA oversight
process by the end of July 2019 \9\ and I am grateful for the focus by
the Transportation and Infrastructure Committee on this issue.
---------------------------------------------------------------------------
\9\ https://www.rollcall.com/news/congress/faa-administrator-
defends-decisions-boeing-737-max
---------------------------------------------------------------------------
I also urge the FAA to fully and fairly investigate 737-MAX safety
issues and specifically reports that Boeing managers ignored or
silenced concerns raised by senior engineers during safety inspections,
and then make available the report and underlying evidence from the
investigation to the public in a timely manner.
Finally, I support the call from Aviation Subcommittee Vice Chair
Sharice Davids urging the FAA to ensure that any upgrades to the 737-
MAX series planes made by Boeing in response to these accidents
maintain aviation safety as a first priority. These upgrades should not
be ``optional'' items for planes with added costs. I also support Vice
Chair Davids' request that these upgrades are transparent to, and
include proper training for, pilots, mechanics and the many other
skilled workers using and servicing these planes as well as the flying
public.\10\
---------------------------------------------------------------------------
\10\ http://dearcolleague.us/2019/04/co-sign-letter-to-faa-on-
certification-and-oversight-of-boeing-737-max-series-planes/
---------------------------------------------------------------------------
In conclusion, I look forward to working with Aviation Subcommittee
Chairman Larsen on this issue moving forward. I express my deep
gratitude to him for his commitment to the safety of the flying public
and to the generations of Boeing workers in our region. I thank the
Chairman for submitting this statement on my behalf for this hearing
today.
Photos Submitted for the Record by Hon. Larsen
Silhouettes of Victims
Stella Konarska and son Adam; Poland and Kenya
Adam Konarski; Poland
Micah Messent; Canada
Danielle Moore; Toronto, Canada
Melvin Riffel; Redding, California
Bennett Riffel; Redding, California
Samya Rose Stumo; Sheffield, Massachusetts
Marcelino Rassul Tayob; Mozambique
Christine Alalo; Uganda
George Kabau; Kenya
Bernard Musembi Mutua; Kenya
Two Letters from Sara Nelson, International President, Association of
Flight Attendants--CWA, AFL-CIO, Submitted for the Record by Hon.
DeFazio
March 11, 2019.
Dan Elwell
Acting Administrator
Federal Aviation Administration, 800 Independence Ave., SW.,
Washington, DC 20591
Dear Administrator Elwell,
The Association of Flight Attendants-CWA is incredibly grateful to
you for your constant efforts to maintain the safest transportation
system in the world. Your leadership has been extraordinary in some of
the most challenging times and we are so thankful.
We write today to advise you that crew and passengers are
expressing concerns about the 737 MAX 8 after the March 10, 2019 crash
of Ethiopian Airlines Flight 302, relatively closely following the
tragedy of Lion Air Flight 610 on October 29, 2018. We fully support
the investigative process and caution the public to avoid drawing
conclusions prior to uncovering the facts of the incident. However, the
second accident in less than five months involving the same model
airplane gives rise to concerns and a quick jump to conclusions that
undermine full confidence in the aircraft type. We encourage the
relevant authorities to take steps immediately to address concerns and
ensure the safety of the 737 MAX fleet.
We support and encourage the Federal Aviation Administration (FAA)
to work closely with Boeing and its suppliers, the National
Transportation Safety Board (NTSB), the U.S. airlines that operate this
airplane model, maintenance and training providers, and affected
employee groups, to review all potential issues that could contribute
to these two catastrophic outcomes. This review should be
comprehensive, considering at minimum the certification basis,
maintenance practices, operational procedures, and crew training
aspects of the 737 MAX program, and it should be open and transparent,
to ensure the public's confidence in its conclusions and
recommendations.
It may be helpful to communicate the steps that U.S. airlines have
taken to implement the requirements outlined by the FAA in the December
6, 2018 737 MAX Flight Control Airworthiness Directive.
Thank you for all your work to keep U.S. commercial aviation safe.
Sincerely,
Sara Nelson
International President
__________
May 14, 2019.
Hon. Peter A. DeFazio
Chairman
Committee on Transportation and Infrastructure, U.S. House of
Representatives, Washington, DC 20515
Chairman DeFazio,
The Federal Aviation Administration (FAA) must address the flying
public's concerns about the relationship between the FAA, the airlines,
and the manufacturers that it regulates. For decades, the U.S. aviation
system has been the aviation safety model for the world. However, that
position must be earned and continually strengthened.
In order to accomplish this, the FAA should ensure that federal
regulations and statutes governing aviation safety are implemented and
unquestionably enforced. To accomplish this, the FAA may well need to
increase its inspector and certification workforce, as well as their
compensation in order to make these positions more competitive with the
private sector. This will require an FAA Administrator with a proven
record of leadership, demonstrated efforts to improve aviation safety,
and the ability to work with all stakeholders, including aviation
labor.
Congress voted to strike ``promotion'' of air commerce from the
FAA's mandate with the passage of the FAA Reauthorization Act of 1996,
following that year's loss of 110 passengers and crew on ValuJet Flight
592. However, the conference report stated that ``The managers do not
intend for enactment of this provision to require any changes in the
FAA's current organization or functions. Instead, the provision is
intended to address any public perception that might exist that the
promotion of air commerce by the FAA could create a conflict with its
safety regulatory mandate.'' \1\
---------------------------------------------------------------------------
\1\ See https://www.pbs.org/wgbh/pages/frontline/flyingcheap/
safety/cosy.html, 2-9-2010
---------------------------------------------------------------------------
The FAA's performance of its aviation safety mandate is again in
question after two fatal 737 MAX crashes. This time, real changes are
needed in how the FAA ensures the safety of the airplanes and
operations that it regulates.
AFA believes that Boeing's credibility directly relates to the
credibility of U.S. aviation. It's important to Flight Attendants that
the credibility and the leadership of U.S. aviation is maintained
around the world.
Lives must come first always. But a brand is at stake as well. And
that brand is not just Boeing. It's America and what it means in
international aviation and by extension in the larger world more
generally--that U.S. aviation sets the standard for safety, competence,
and honesty in governance of aviation.
Sincerely,
Sara Nelson
International President
Appendix
----------
Questions from Hon. Henry C. ``Hank'' Johnson, Jr. for Hon. Robert L.
Sumwalt III, Chairman, National Transportation Safety Board
Question 1. What safety measures does NTSB want to see implemented
before the plane returns to service?
Question 1a. Do you believe there were adequate protections in
place prior to the Lion Air and Ethiopian Air crashes?
Answer. The National Transportation Safety Board's (NTSB's)
participation in the ongoing Lion Air and Ethiopian Airlines
investigations is for the purpose of assisting the lead agencies, in
their respective countries, in determining how the airplane, human(s),
and operating environment might have played a role in the accidents. As
part of that work, the investigators are collecting and evaluating
available evidence to assess protections applicable to each of those
areas. That work is ongoing, and the NTSB is working closely with the
respective lead agencies to assist in identifying deficiencies. In
particular, as the lead representative for the state of design and
manufacture of the aircraft, the NTSB is examining the original
certification process used to approve the Maneuvering Characteristics
Augmentation System (MCAS) function on the Boeing 737 MAX. The
certification process is the mechanism by which the manufacturer and
the Federal Aviation Administration (FAA) determine the safety
protections needed to ensure an acceptable level of safety risk in
service. This investigative work is ongoing, and where deficiencies are
identified, the NTSB will make safety recommendations, as appropriate.
Question 1b. Why didn't the NTSB reevaluate safety precautions in
the 737 MAX after the Lion Air flight?
Answer. As part of supporting the Komite Nasional Keselamatan
Transportasi (KNKT) of Indonesia's investigation of the Lion Air crash,
NTSB experts supported the development and analysis of recorder data,
wreckage, and other investigative facts with the participation of the
FAA and Boeing as technical advisors. Based on the available facts in
the Lion Air accident investigation, Boeing issued a flight Operations
Manual Bulletin to provide enhanced safety precautions in pilot
procedures related to a runaway stabilizer failure condition and began
updating the Boeing 737 MAX MCAS software for implementation, once
certified. As part of their continued operational safety role, the FAA
immediately mandated use of the new Boeing procedure through an
Emergency Airworthiness Directive that was also provided to foreign
regulatory agencies of countries operating the Boeing 737 MAX and began
work with Boeing on certification planning for the updated MCAS
software.
In addition to applying its expertise to this early evidence
collection and analysis process, NTSB investigators also assisted KNKT
in the examination of maintenance and design certification factors
directed by the available evidence in the Lion Air accident. The NTSB's
examination of design certification factors related to the approval of
the MCAS function on the Boeing 737 MAX is ongoing as is the NTSB's
support of the Ethiopian Aircraft Accident Investigation Bureau's
investigation into the broader aircraft, human(s), and operating
environment factors that contributed to the Ethiopian Airlines
accident.
Question 1c. During investigation into the 737 MAX sensor defect,
has NTSB encountered additional safety concerns that will further
prolong the grounding of the 737 MAX?
Answer. In addition to this fact-gathering and our support of the
foreign agencies, as noted above, the NTSB has been examining the
design and certification of the MCAS since our investigators initially
responded to the Lion Air accident. This work entails careful
examination of the certification artifacts with respect to applicable
regulations, standards and guidance, technical methods, and
communications that were part of the aircraft certification process.
This examination is ongoing, and where deficiencies or areas for
improvement are found, the NTSB will make safety recommendations.
Regarding the pending new design, the FAA is the regulatory agency
charged with making decisions regarding an airplane's certification as
well as continued operational safety (COS). Questions related to the
recertification effort and/or the FAA's COS actions, such as the return
to service of the Boeing 737 MAX, are best referred to them.
Question 2. As technical advisor to the ongoing investigations of
the Lion Air and Ethiopian Airlines flights, has Boeing been
cooperative with NTSB's assessments and input?
Question 2a. Do you believe Boeing will remain cooperative although
they initially opposed the grounding of the 737 MAX?
Question 2b. Has there been any disagreement between Boeing and
NTSB on the safety assessments?
Question 2c. Has Boeing been allowed to have its own mechanics
assist in the safety assessments?
Question 2d. Would you say that it's ever appropriate for
interested companies to be allowed to assess their own safety on behalf
of the government?
Answer. Boeing has, and continues to be, cooperative and fully
supportive of the NTSB as well as the Indonesian and Ethiopian
investigations. In accordance with the International Civil Aviation
Organization (ICAO) Annex 13, Boeing, FAA, and GE Aviation are
technical advisors to the U.S. Accredited Representative, appointed by
the NTSB. Accredited representatives provide the engineering and
technical information necessary for the foreign authorities to conduct
the investigations. This framework is an essential part of the Annex 13
process to ensure that investigators have the technical information
needed to address safety concerns. We believe the productive working
relationship between the NTSB and all our technical advisors will
continue throughout the entirety of these investigations.
Questions from Hon. Peter A. DeFazio for Daniel K. Elwell, Acting
Administrator, Federal Aviation Administration
Question 1. Mr. Elwell, when I asked you at the hearing if the
Maneuvering Characteristics Augmentation System or MCAS was a safety
critical system, you acknowledged that in your opinion you thought MCAS
should be classified as a safety critical system. Will MCAS be
recertified by the FAA as a safety critical system before the 737 MAX
flies again, and if not why not?
Answer. MCAS is not a standalone system. It is part of the 737 MAX
primary flight control system. Whether a system is safety critical or
not is based on the outcome of the system safety assessment. We will
apply the same methodology and policies in evaluating and certifying
the modified MCAS design. However, we will also take into consideration
the preliminary report information from the two accidents.
Question 1a. Assuming MCAS is reclassified as a safety critical
system, which it was not during the Amended Type Certification review
when the 737 MAX entered service in 2017, what additional steps will be
taken by both Boeing and the FAA to reclassify MCAS as a safety
critical system?
Answer. MCAS is not a standalone system. It is part of the 737 MAX
primary flight control system, which was classified as a safety
critical system. During the certification program, MCAS was a necessary
part of the flight control system in order for it to meet FAA safety
regulations. We do not expect that to change when the MCAS software
change is FAA-approved and incorporated.
Question 2. Acting Administrator Elwell, at the hearing you
acknowledged that Boeing developed MCAS so that the 737 MAX would feel
the same to pilots used to flying the 737 NG. In fact, there are
significant structural design changes to the 737 MAX from the previous
737 NG model, most notably the larger engines that were placed further
forward on the wings. This changed the aerodynamics of the aircraft in
flight, and MCAS was intended to make the 737 MAX appear to pilots as
though it was the same airplane as the 737 NG, even though it was not.
Reports have indicated that Boeing sought to avoid a new type
certificate for the MAX and instead pursued an amended type
certificate. It seems clear this was intended so that Boeing could
avoid going through a new type certificate process with the 737 MAX and
instead pursue the amended type certificate program primarily because
of the way MCAS impacted the flying characteristics of the aircraft.
Boeing has now proposed significant revisions to how MCAS works on the
737 MAX. I am concerned that MCAS has been expected to transform
significant structural design changes to the 737 MAX into something it
is not, the 737 NG aircraft.
Question 2a.Please provide a written explanation of all of the
post-Lion Air and Ethiopian Airlines proposed changes to MCAS by
Boeing.
Answer. The FAA is working with Boeing on the software changes
being made to the MCAS function as part of the primary flight control
system. Boeing's proposed changes include:
1) To correct potential erroneous signals from the angle-of-attack
(AOA) sensors, the two signals (left and right) will be compared and
averaged. The average will be used to determine whether MCAS is
activated.
2) When the left and right AOA sensors disagree by more than 5.5
degrees, MCAS functionality will be inhibited.
3) There will be one MCAS input for each situation that activates
MCAS, rather than multiple inputs.
4) If MCAS is activated, the input will be limited to ensure the
pilot can maintain control of the stabilizer.
In addition to approving the Boeing software change described
above, the FAA will require incorporation of the change and any
associated training we identify for 737 MAX pilots before the agency
approves the airplanes for return to service.
Question 2b. Please also provide an assessment of whether these
changes to MCAS will satisfy the requirements necessary for the 737 MAX
to remain an amended type certificated airplane. In other words, does
the modified version of the MCAS system offset the structural design
changes on the 737 MAX compared to the 737 NG--or should the 737 MAX go
through a new type certificate process before flying again?
Answer. The 737 MAX is a design derivative of the 737-800NG. The
determination to classify the 737 MAX as an amended type design, which
is approved with an Amended Type Certificate (ATC), was consistent with
FAA regulations and current guidance.
The primary changes in the MAX were: a 4-5 percent weight increase;
new engines with a minimal increase in thrust; a longer nose gear; a
slightly higher tailcone; fly-by-wire spoilers; and new winglets.
Some examples of significant design changes that might require a
new TC are: a change in the number of engines from 2 to 4, or 4 to 2; a
change in the placement of engines, from underwing to body-mounted; a
change in wing placement, high-wing to low-wing; thrust changes that
change airplane speeds from subsonic to supersonic; change in materials
from metal to composite; and a change in the type of airplane tail, T-
tail to V-tail or cruciform.
The software change to modify the MCAS will not result in a
significant design change such that the 737 MAX would require a
recertification or a new type certificate.
Question 3. A recent FAA Organization Designation Authorization
(ODA) Scorecard examined the authorities of qualifying companies to
move forward with certain projects without a Project Notification
Letter (PNL) from FAA. The Scorecard shows that prior to 2015, 14% of
the 36 companies surveyed had authority to proceed with certain
projects without a PNL. However, by 2018, 89% of the 36 companies
surveyed had such authority.
Question 3a. How is the FAA ensuring that this increase in ODA
authority is not degrading safety or appropriate FAA oversight?
Answer. Organizational Designation Authority (ODA) has long been a
key part of the FAA's use of delegation. The FAA grants ODA authority
based on the needs of the agency. The FAA may issue an ODA once it
determines that a company or organization meets stringent eligibility
requirements, including professional integrity, technical competency,
and a history of compliance assurance. When application is made for
type certification, the FAA reviews the program and determines what can
be delegated, the level of involvement the agency will have, and what
the FAA intends to retain. This determination is based on the ODA
holder's demonstrated safety record and performance.
The FAA has a robust delegation oversight program, which the agency
conducts through supervision and inspection. In addition to our review
of audits and an annual assessment, the FAA conducts an on-site
detailed inspection every two years. The inspection is a means for the
FAA to assess whether the ODA holder's procedures are adequate, the ODA
unit has complied with the procedures, and the ODA unit makes technical
decisions that are acceptable. Poor performance by the ODA holder,
Boeing in this case, can result in more FAA involvement, suspension, or
termination of the ODA privilege.
In accordance with the FAA Reauthorization Act of 2018 (P.L. 115-
254), on March 5, 2019, Acting Administrator Dan Elwell approved the
formation of the Aviation Safety ODA Office. Among other functions,
this office will facilitate system-level oversight for standardized
application of policy, proficiency of ODA and field office staff in
executing oversight processes and monitoring of risk and performance
issues.
Question 3b. What impact has this growth in authority for
qualifying companies to proceed with qualifying projects without a PNL
had on the safety of commercial aviation?
Answer. Submission of a Project Notification Letter (PNL) is a step
in the certification process as project details are discussed,
including what will be delegated and what level of involvement the FAA
will have in the project. FAA ODA policy allows ODAs to omit the PNL
step for certain Supplemental Type Certificate (STC) projects, when
there are sufficient procedures in their FAA-approved ODA manual to
complete the project.
PNL projects must meet all appropriate and applicable standards.
This process of omitting the PNL step is only for companies that have
proven capability and have a successful history of producing compliant,
safe products. We are simply streamlining the process for those
companies.
Questions from Hon. Eleanor Holmes Norton for Daniel K. Elwell, Acting
Administrator, Federal Aviation Administration
Question 4. Mr. Elwell, media reports indicate that the FAA may not
necessarily require training for new systems in which the pilot is
considered the redundancy in case of a system failure. Can you explain
the FAA's policy on training for new systems on an existing type
certificate (like the MAX), and explain the training differences in
terms of (1) systems that treat the pilot as the redundancy; and (2)
systems that have a technological redundancy built in?
Answer. Required training for systems differences or maneuvers is
based on FAA regulations. 14 CFR Part 61--Certification: Pilots, Flight
Instructors, and Ground Instructors, Part 121--Operating Requirements:
Domestic, Flag and Supplemental Operations, and Pilot Practical Test
Standards for an added type rating drive the requirements for training,
regardless of redundancy.
Questions from Hon. Steve Cohen for Daniel K. Elwell, Acting
Administrator, Federal Aviation Administration
Question 5. Mr. Elwell, media reports indicate that in its initial
submission to the FAA, Boeing underestimated the capability of MCAS to
move the stabilizer trim wheel by a magnitude of four times (from .6 to
2.5 degrees nose-down position), and the FAA only found out about the
increased capability from Boeing's notice to airlines explaining MCAS
after the Lion Air accident. Can you please confirm this account? And
if this is not correct, please clarify the timeline.
Answer. The MCAS function, which is part of the primary flight
control system, has a range of pitch motion with which to change the
nose-high attitude of the airplane. Nose-high attitude is the position
of the airplane's nose above that of level flight. The MCAS function
bases the necessary amount of stabilizer input on the speed of the
airplane. At high airspeeds, less stabilizer input is necessary to
correct a nose-high attitude, so 0.6 is sufficient. At low airspeeds,
since the stabilizer is less effective and needs more input to correct
a nose-high attitude, 2.5 is required.
The actual stabilizer input is scalable, with the minimum being 0.6
and the maximum being 2.5. This is how flight control systems are
designed and it is to be expected that Boeing would use this tried-and-
true control methodology in the design of the 737 MAX. It is correct
that changes to MCAS allowing 2.5 degrees of movement during some low
airspeed scenarios were implemented by Boeing after the initial system
safety assessment (SSA) was provided to the FAA. This change was
processed by the ODA and was not required to be separately communicated
to the FAA when it was made, as the most serious scenario had already
been addressed in the SSA.
The FAA ensures that the worst-case scenarios or most critical
conditions of airplane operation are tested. In this case, it was the
high-speed condition. Even little changes in airplane attitude can be
critical at high speeds, as everything happens faster and pilots have
less time to react. In the low-speed condition, the pilot has more time
to react and unexpected pitch attitudes can be more easily corrected.
Question 5a. Follow-up: If correct, because the FAA only initially
reviewed the .6 movement, would another review have been warranted?
What is the threshold for revisiting the analysis with new information?
And along those lines, what is Boeing's obligation to report the change
to FAA?
Answer. Another review would not have been necessary. Small control
surface (the stabilizer, in this case) movements are needed at high
speeds. At low speeds, inputs must be larger to effect the necessary
response in airplane attitude. The most critical condition is the high-
speed condition, and the FAA tested this condition both in the
simulator and during flight test. If Boeing had presented another
similar or equally critical condition, that would have warranted
another FAA review. With respect to Boeing's reporting obligations,
they are required to follow their FAA-approved ODA procedures manual.
Typically, changes in design, function, and configuration, if deemed
significant, are expected to be reported to the FAA.
Question 6. Mr. Elwell, at the hearing I asked you about reports in
the Dallas Morning News that appeared to describe nose down situations
in 737 MAX aircraft in the U.S. that seemed similar to the MCAS
malfunctions on the Lion Air and Ethiopian Airlines planes before they
crashed. You responded that out of 50,000 737 MAX flights in the U.S.
there were 24 reports from pilots that had a pitch anomaly with the
nose pointed down and that none of those reports were related to the
Maneuvering Characteristics Augmentation System or MCAS. I am
interested in learning more about how the FAA determined that none of
these reports were related to MCAS. Please provide the Committee with a
more detailed written response regarding how the FAA determined none of
those pilot reports were related to MCAS. Please also include all
reports, studies, analysis or memorandums that were completed by the
FAA regarding the 24 reported incidents you mentioned.
Answer. Please find attached a short summary table of the 24
Aviation Safety Reporting System (ASRS) reports, along with the full
report, dated March 14, 2019. The 24 incidents date from October 2017
through December 2018, with no reports after December through the
report's publication date. Please note that these reports are
voluntarily submitted, confidential, and non-punitive. These incidents
are not corroborated by NASA, the FAA, or NTSB. The existence or number
of reports on a specific topic cannot be used to infer prevalence of
that problem in the National Airspace System.
[The summary table follows; the report dated March 14, 2019, is on
pages 87-122.]
Quick Reference Table of 737 MAX Aviation Safety Reporting System (ASRS)
Reports
------------------------------------------------------------------------
ASRS Reports/Date Synopsis FAA disposition
------------------------------------------------------------------------
1 ACN: 1604159...... Pilot reported Flight Management
12/2018........... failure to descend Computer
on approach. programming error.
Not related to
MCAS.
------------------------------------------------------------------------
2 ACN: 1603503...... Pilot reported Nothing to do with
12/2018........... departing with an flight control
equipment list system or MCAS.
paperwork
discrepancy.
------------------------------------------------------------------------
3 \\ Reports 3 and 4 are from the same airplane and event. Report
3 is the pilot's report and report 4 is from the co-pilot.
Questions from Hon. Colin Z. Allred for Daniel K. Elwell, Acting
Administrator, Federal Aviation Administration
Question 7. Mr. Elwell, can you please explain why MCAS was not in
the initial manual (and Flight Standardization Board report)? What was
the rationale for that decision? Is the FAA revisiting that decision?
Answer. While Boeing 737 MAX training requirements do not
specifically address MCAS, existing pilot procedures do include the
knowledge to deal with an MCAS event, which manifests itself as runaway
stabilizer. The responsive actions for runaway stabilizer trim are
identical in both the 737NG and 737 MAX airplanes.
It is important to note that MCAS is not a ``system'' that can be
independently operated by the pilots. It is software code that operates
in the background as part of the larger automated flight control
system. The autonomous nature of the system did not interface with any
normal, non-normal, or emergency checklists. Due to the autonomous
nature of the system, it did not impact pilot knowledge, skills, or
abilities, and therefore did not necessitate differences training.
Questions from Hon. Henry C. ``Hank'' Johnson, Jr. for Daniel K.
Elwell, Acting Administrator, Federal Aviation Administration Board
Question 8. The Organization Designation Authorization (ODA)
program is intended to give the FAA more room to address high-risk
issues and nuanced technologies by allowing some regulatory delegation
to technical experts, like Boeing. If the intent is for the FAA to
streamline its effectiveness, why do you believe that knowledge of some
of the 737 MAX's safety nuances slipped through the cracks?
Answer. FAA does not consider any safety aspect of a certification
project a nuance. To be granted an Organization Designation
Authorization (ODA), a company must have a positive safety record, a
history of compliance to FAA regulations, and a proven level of
technical capability. Leveraging ODAs to work on the low-risk portions
of a certification program allows the FAA to focus resources on the
higher-risk areas and new and novel technologies and applications.
The FAA focused significant resources on certification of the 737
MAX--over 110,000 hours of FAA staff time were devoted to this effort.
Boeing showed compliance with all of the applicable design regulations
in an acceptable manner and the FAA concurred on the system safety
assessment Boeing presented.
Nevertheless, the FAA is always looking to improve established
certification processes. Both Secretary Chao and Acting Administrator
Elwell have gone on record as welcoming scrutiny and input on areas of
improvement. In support of this, several reviews related to the
certification process have been initiated which will provide:
potential process improvements;
information on the manner in which the certification
process was applied to the 737 MAX flight control system;
input on how the FAA certifies new technologies, in
general;
a complete program review of the 737 MAX certification
program; and
a technical assessment of the proposed software change to
the MCAS portion of the flight control system.
Question 8a. Does the FAA entrust similar regulatory practices to
their other manufacturing partners?
Answer. The FAA grants ODA authority based on the needs of the
agency. There are 70 ODAs that hold design approval authority, with
some ODA companies specializing in after-market modifications known as
supplemental type certificates and some producing replacement parts
under a Parts Manufacturing Approval. The larger companies that have
ODAs may have several types of ODA authority. The FAA assesses all ODA
applicants using the same rigorous criteria, including safety record,
history of compliance, and technical capability. Each ODA is then
delegated authority on a project-by-project basis according to those
criteria.
Question 8b. Have there been lapses in safety information from
those partners as well?
Answer. The FAA has a rigorous ODA oversight program. Each ODA must
have a proven record of compliance assurance and is responsible for
ensuring that its compliance assurance process is robust. ODAs are also
charged with finding non-compliances and fixing their system as
necessary to ensure no recurrence of non-compliances.
Annually, the FAA and the ODA company review performance using the
ODA Scorecard process, implemented in 2016. The Scorecard captures
any disconnects between the company and the FAA. To date, FAA review of
Scorecards has not indicated any lapses in safety information. The FAA
is always working to improve ODA processes, with the goal of certifying
safe products.
Question 8c. Do you think the designee program may need to be revisited
as a pitfall for coverup or error?
Answer. Delegation has been a key part of the FAA's authority for
decades, and allows the FAA to leverage expertise and focus resources
on the most safety-critical issues. As evidence of the agency's strong
commitment to continuous improvement, however, the FAA is constantly
reviewing established processes in search of ways to improve effectiveness,
and ensure allocated resources continue to target areas with the most
significant safety implications.
Question 9. It is undeniable that concerns about the FAA/Boeing
partnership have eroded public trust. What steps are your entities
taking to mitigate these concerns as you set your sights on flying
the planes?
Answer. The word ``partnership'' mischaracterizes how the FAA and a
company work together. The FAA regulates companies to ensure their
designs are compliant and safe. During certification, both the FAA
and the company have defined roles and responsibilities. The FAA
has similar relationships with all of the companies and ODA holders
that we regulate.
The FAA has been meeting regularly with foreign civil aviation
authorities (CAAs), industry groups, and airlines to provide updates
on all activities. The FAA will continue this outreach to these entities
as the airplane are returned to service. The following are examples of
the many activities the FAA has led to provide information to these
entities and address concerns raised.
The FAA, as the State-of-Design agent, has had ongoing engagement with
countries that own and operate the 737 MAX. To keep technical experts
around the globe apprised of 737 MAX-related efforts, the FAA conducted
a series of 10 webinars in April and May to share information and provide
technical assistance to many authorities in a number of areas.
On May 23, Acting Administrator Elwell hosted a meeting for Directors
General from countries with 737 MAX airplanes. Fifty-nine represen-
tatives from 31 countries, along with representatives from the European
Aviation Safety Agency and the International Civil Aviation Organization
(ICAO), attended and participated in an open dialogue about the status
of the 737 MAX fleet and the steps FAA intends to take to return the
fleet to service in the United States. The FAA will continue this
outreach to support these countries as they work through their own
programs and processes to return their own 737 MAX fleets to service.
Acting Administrator Elwell also hosted a meeting with safety representa-
tives of U.S. commercial airlines that fly the 737 MAX and pilots of those
airlines. The interactive discussion addressed the 737 MAX flight
control system, questions about pilot training, and the return
to service process.
Once the design change is approved, there are several activities
the FAA plans to conduct, including:
Issuing a Continued Airworthiness Notification (CANIC);
Issuing an Airworthiness Directive (AD);
Amending or cancelling the grounding order;
Issuing a public statement about the return to service; and
Publishing the Flight Standardization Board report.
In addition, the FAA's Office of Communications will broadcast
information worldwide through contact with media and news organi-
zations, website postings, and updates to FAA's social media platforms.
The FAA will continue to provide updates through these channels as
they occur.
Question 9a. Would you agree that greater transparency in this process
has the potential to optimize safety for pilots and passengers?
Answer. The FAA has made a strong effort to be transparent in
executing its State-of-Design responsibilities. The FAA has shared
actions, the timeline of what the agency knew and when, and the FAA
process to certify a design change for the 737 MAX and ensure it is
safe to fly. Both Secretary Chao and Acting Administrator Elwell have
publicly stated that the FAA welcomes scrutiny of the established
certification process, in general, and the certification of the
737 MAX and new technologies, specifically.
To these ends, the FAA is supporting, and in some cases leading,
a number of reviews and audits currently underway. The Department
of Transportation Office of the Inspector General has already begun
its audit, and the work of the Joint Authorities Technical Review
panel, the Technical Advisory Board, and Secretary Chao's Special
Committee is ongoing.
Continuous improvement is part of the FAA's safety culture, and
demands that the agency never stop looking for ways to strengthen
its processes and improve safety. The findings and recommendations
from these audits and panels will provide important input as the FAA
continues to pursue improvements in established regulations,
processes, and policies.
Report Submitted by FAA in Response to Question 6 From
Hon. Steve Cohen
Search Request No. 7284
B737 MAX Aircraft Safety Reports
March 14, 2019
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
TH: 262-7
MEMORANDUM FOR: Recipients of Aviation Safety Reporting System Data
SUBJECT: Data Derived from ASRS Reports
The attached material is furnished pursuant to a request for data from
the NASA Aviation Safety Reporting System (ASRS). Recipients of this
material are reminded when evaluating these data of the following points.
ASRS reports are submitted voluntarily. Such incidents are independently
submitted and are not corroborated by NASA, the FAA or NTSB. The
existence in the ASRS database of reports concerning a specific topic
cannot, therefore, be used to infer the prevalence of that problem
within the National Airspace System.
Information contained in reports submitted to ASRS may be clarified
by further contact with the individual who submitted them, but the
information provided by the reporter is not investigated further.
Such information represents the perspective of the specific individual
who is describing their experience and perception of a safety
related event.
After preliminary processing, all ASRS reports are de-identified
and the identity of the individual who submitted the report is
permanently eliminated. All ASRS report processing systems are
designed to protect identifying information submitted by reporters;
including names, company affiliations, and specific times of incident
occurrence. After a report has been de-identified, any verification
of information submitted to ASRS would be limited.
The National Aeronautics and Space Administration and its ASRS current
contractor, Booz Allen Hamilton, specifically disclaim any
responsibility for any interpretation which may be made by others
of any material or data furnished by NASA in response to queries
of the ASRS database and related materials.
Becky L. Hooey, Director
NASA Aviation Safety Reporting System
CAVEAT REGARDING USE OF ASRS DATA
Certain caveats apply to the use of ASRS data. All ASRS reports
are voluntarily submitted, and thus cannot be considered a measured
random sample of the full population of like events. For example,
we receive several thousand altitude deviation reports each year.
This number may comprise over half of all the altitude deviations
that occur, or it may be just a small fraction of total occurrences.
Moreover, not all pilots, controllers, mechanics, flight attendants,
dispatchers or other participants in the aviation system are equally
aware of the ASRS or may be equally willing to report. Thus, the data
can reflect reporting biases. These biases, which are not fully known
or measurable, may influence ASRS information. A safety problem such
as near midair collisions (NMACs) may appear to be more highly concen-
trated in area ``A'' than area ``B'' simply because the airmen who
operate in area ``A'' are more aware of the ASRS program and more
inclined to report should an NMAC occur. Any type of subjective,
voluntary reporting will have these limitations related to quantitative
statistical analysis.
One thing that can be known from ASRS data is that the number of
reports received concerning specific event types represents the lower,
measure of the true number of such events that are occurring. For example
if ASRS receives 881 reports of track deviations in 2010 (this number
is purely hypothetical), then it can be known with some certainty that
at least 881 such events have occurred in 2010. With these statistical
limitations in mind, we believe that the real power of ASRS data is
the qualitative information contained in report narratives. The pilots,
controllers, and others who report tell us about aviation safety
incidents and situations in detail_explaining what happened, and
more importantly, why it happened. Using report narratives effectively
requires an extra measure of study, but the knowledge derived is well
worth the added effort.
Report Synopses
ACN: 1604159 (1 of 24)
Synopsis
B737 MAX8 Captain reported failure to descend as charted while flying
the RNAV (RNP) Z approach to Runway 17R at DEN due to an FMC programming error.
ACN: 1603503 (2 of 24)
Synopsis
B737 MAX Captain reported departing with deferred maintenance and
complex MEL, but noticed MEL sticker was not properly applied.
ACN: 1597380 (3 of 24) Reports 1597380 and 1597286 refer to the same
event.
Synopsis
B737MAX Captain reported an autopilot anomaly in which led to an
undesired brief nose down situation.
ACN: 1597286 (4 of 24) Reports 1597380 and 1597286 refer to the same
event.
Synopsis
B737 MAX First Officer reported that the aircraft pitched nose down
after engaging autopilot on departure. Autopilot was disconnected and
flight continued to destination.
ACN: 1593701 (5 of 24)
Synopsis
B737 MAX8 First Officer reported an altitude deviation due to an
intermediate level off by the aircraft automation.
ACN: 1593699 (6 of 24)
Synopsis
737MAX8 Captain reported a slot in the cockpit center pedestal
allowed flight documents to slip through and collect on aircraft
wire bundles.
ACN: 1593021 (7 of 24)
Synopsis
B737MAX Captain reported confusion regarding switch function and
display annunciations related to ``poor training and even poorer
documentation''.
ACN: 1593017 (8 of 24)
Synopsis
B737MAX Captain expressed concern that some systems such as the MCAS
are not fully described in the aircraft Flight Manual.
ACN: 1590012 (9 of 24)
Synopsis
B737-MAX8 Captain reported the autothrottles failed to move to the
commanded position during takeoff and climb.
ACN: 1587343 (10 of 24)
Synopsis
Off duty Flight Attendant reported being unable to see the B737 Max
cabin safety demonstration because the passenger seats are too high.
ACN: 1583127 (11 of 24)
Synopsis1B737 MAX Captain reported an unstabilized approach into DEN due
to human factors and aircraft familiarization.
ACN: 1583028 (12 of 24)
Synopsis
B737 MAX-8 Captain reported the engine fuel burn was higher than
expected.
ACN: 1572630 (13 of 24)
Synopsis
B737 MAX-8 crew reported failing to follow the engine start procedure
resulting in an aborted engine start.
ACN: 1568887 (14 of 24)
Synopsis
B737-800 Captain reported making a sudden stop to avoid a collision
with a fuel truck on the ramp.
ACN: 1565207 (15 of 24)
Synopsis
B737NG Captain reported the aircraft Wi-Fi was not working in cruise,
which affected the ability to access the flight plan on the iPad.
ACN: 1560763 (16 of 24)
Synopsis
B737-800 First Officer reported that departing out of BWI, the
aircraft is unable to make the 17000ft. restriction at FOXHL on
TERPZ 6 departure.
ACN: 1555013 (17 of 24)
Synopsis
B737 MAX First Officer reported feeling unprepared for first flight
in the MAX, citing inadequate training.
ACN: 1550073 (18 of 24)
Synopsis
Maintenance personnel reported that on Boeing 737MAX, Maintenance
Control is not receiving ACARS or Electronic Logbook write-ups the
flight crew sends.
ACN: 1538699 (19 of 24)
Synopsis
B737 MAX pilots reported flying through the final approach course
and descending below published altitudes due to confusion with the
new style instrument displays.
ACN: 1517486 (20 of 24)
Synopsis
A pilot reported a tug driver and ramp crew did not follow proper
procedures during pushback.
ACN: 1501507 (21 of 24)
Synopsis
B737 Max First Officer reported that the flight number disappears from
the digital display after the aircraft has landed making it difficult to
communicate with ATC from landing to the gate.
ACN: 1495437 (22 of 24)
Synopsis
B737-MAX Captain reported an unresolved threat of a wingtip strike during
crosswind landing and takeoff operations.
ACN: 1488017 (23 of 24)
Synopsis
Captain reported procedural issues with the FMS on the 737-MAX in
reference to descent capabilities.
ACN: 1486024 (24 of 24)
Synopsis
B737 Max flight crew reported that an Auto Shutdown of the Number
Two engine on engine start was probably due to the First Officer
activating the Isolation switch and the Pack switch during the start.
Report Narratives
ACN: 1604159
Time / Day
Date : 201812
Local Time Of Day : 0601-1200
Place
Locale Reference.Airport : DEN.Airport
State Reference : CO
Altitude.MSL.Single Value : 10500
Environment
Light : Daylight
Aircraft
Reference : X
ATC / Advisory.TRACON : D01
ircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Initial Approach
Airspace.Class B : DEN
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 501
Experience.Flight Crew.Type : 11195
ASRS Report Number.Accession Number : 1604159
Human Factors : Human-Machine Interface
Human Factors : Situational Awareness
Events
Anomaly.Deviation_Altitude : Undershoot
Anomaly.Deviation_Altitude : Excursion From Assigned Altitude
Anomaly.Deviation_Procedural : Clearance
Detector.Person : Flight Crew
Detector.Person : Air Traffic Control
When Detected : In-flight
Result.Flight Crew : Returned To Clearance
Result.Flight Crew : Became Reoriented
Result.Air Traffic Control : Issued Advisory / Alert
Assessments
Contributing Factors / Situations : Human Factors
Primary Problem : Human Factors
Narrative: 1
We planned for the Visual to Runway 16L and talked about the possible
assignment to 17R. When checking in with Approach we were advised to
expect 17R. We briefed and programmed the RNP Z 17R. AS we approached
the IAF I was preparing for what to do (i.e. what fix to use based on
location of active waypoint) and/or the state of the IAF (i.e. active
waypoint or not). To the best of my recollection, the IAF was on LSK
L2, then I placed it IAF under IAF, although a review after the fact
stated we ``could'' place in on top of it. We both complied with VVMI
prior to execution. The aircraft continued on downwind with no descent.
Almost simultaneously, as we noticed the wrong picture on the MAP
display, the Controller asked us if we were descending. By this time
I had disconnected automation and was following the purple line while
both of us were monitoring altitude restrictions based on our clearance.
The Pilot Monitoring reprogrammed the approach and the rest of the
flight was uneventful. No further calls from ATC, altitude, or course
deviations occurred. Consider calling the field in sight and requesting
visual approach. We do believe that the IAF (since we were close to it)
might have auto-sequenced from L2 to L1 (active), and as we know the
programming in this case would have been different. Therefore, maybe
a closer look at the distance remaining to the active waypoint might
have helped prevent this situation.
Synopsis
B737 MAX8 Captain reported failure to descend as charted while
flying the RNAV (RNP) Z approach to Runway 17R at DEN due to an
FMC programming error.
ACN: 1603503
Time / Day
Date : 201812
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Weather Elements / Visibility : Rain
Light : Night
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Mission : Passenger
Flight Phase : Parked
Component
Aircraft Component : Aerofoil Ice System
Aircraft Reference : X
Problem : Malfunctioning
Person
Reference : 1
Location Of Person : Company
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 357
ASRS Report Number.Accession Number : 1603503
Human Factors : Time Pressure
Human Factors : Confusion
Human Factors : Distraction
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Deviation_Procedural : MEL
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : Became Reoriented
Assessments
Contributing Factors / Situations : Chart Or Publication
Contributing Factors / Situations : Equipment / Tooling
Contributing Factors / Situations : Human Factors
Contributing Factors / Situations : Weather
Contributing Factors / Situations : MEL
Contributing Factors / Situations : Procedure
Primary Problem : Human Factors
Narrative: 1
ZZZ had terrible weather. We were already hours late when our aircraft
arrived. The previous crew wrote up wing anti- ice not working.
Outstation Maintenance arrived, and Dispatch and I determined that we
could depart with a MEL (Minimum Equipment List) that allows us to fly
in icing conditions. MEL was VERY complex and confusing. It required
us to start a [B737] Max 8 with an air cart and start the number 2 engine
first. I was concerned about the Safety of doing that in the dark and in
heavy rain, so I made sure the ground crew and I were completely
confident in our procedures.
A new release with MEL arrived, logbook was completed by Outstation
Maintenance, and we began the process of starting the number 2 engine.
During that time, we also were dealing with three different runway
changes at ZZZ (XXL then XYL then XZL) which also meant three different
SIDS (Standard instrument Departure) and complete re-briefing of takeoff,
departure and engine out procedures. Also had to coordinate a crossbleed
start. Then, our release expired and we had to get with Dispatch to
reload the flight.
Amid all these distractions, we didn't realize that Maintenance never
placed a sticker in the flight deck or logbook. I reviewed the logbook
after Maintenance was done, but totally forgot about the stickers. I
guess the major distraction was how the MEL and the MAX 8 AOM (Aircraft
Operations Manual) differed with each other on this procedure, and
lack of clear directions on working with this MEL. Flight was
completed in ZZZ1 and we went to the hotel. I think a clearer AOM
or MEL is needed on this problem.
Synopsis
B737 MAX Captain reported departing with deferred maintenance and
complex MEL, but noticed MEL sticker was not properly applied.
ACN: 1597380 (Reports 1597380 and 1597286 refer to the same event.)
Time / Day
Date : 201811
Place
Locale Reference.ATC Facility : ZZZ.TRACON
State Reference : US
Altitude.MSL.Single Value : 2000
Environment
Weather Elements / Visibility : Snow
Weather Elements / Visibility : Rain
Aircraft
Reference : X
ATC / Advisory.TRACON : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Climb
Airspace.Class B : ZZZ
Component
Aircraft Component : Autoflight System
Aircraft Reference : X
Problem : Malfunctioning
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 626
ASRS Report Number.Accession Number : 1597380
Human Factors : Human-Machine Interface
Human Factors : Confusion
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Detector.Automation : Aircraft Other Automation
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : FLC Overrode Automation
Result.Flight Crew : Overcame Equipment Problem
Result.Aircraft : Equipment Problem Dissipated
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Primary Problem : Aircraft
Narrative: 1
It was day three of six for me and day three with very good FO (Firs
Officer). Well rested, great rapport and above average Crew coordination.
Knew we had a MAX. It was my leg, normal Ops Brief, plus I briefed our
concerns with the MAX issues, bulletin, MCAS, stab trim cutout response
etc. I mentioned I would engage autopilot sooner than usual (I generally
hand fly to at least above 10,000 ft.) to remove the possible MCAS threat.
Weather was about 1000 OVC drizzle, temperature dropping and an occasional
snow flake. I double checked with an additional personal walkaround just
prior to push; a few drops of water on the aircraft but clean aircraft,
no deice required. Strong crosswind and I asked Tug Driver to push a
little more tail east so as not to have slow/hung start gusts 30+.
Wind and mechanical turbulence was noted. Careful engine warm times,
normal flaps 5 takeoff in strong (appeared almost direct) crosswind.
Departure was normal. Takeoff and climb in light to moderate turbulence.
After flaps 1 to ``up'' and above clean ``MASI up speed'' with LNAV
engaged I looked at and engaged A Autopilot. As I was returning to my
PFD (Primary Flight Display) PM (Pilot Monitoring) called ``DESCENDING''
followed by almost an immediate: ``DONT SINK DONT SINK!''
I immediately disconnected AP (Autopilot) (it WAS engaged as we got
full horn etc.) and resumed climb. Now, I would generally assume it
was my automation error, i.e., aircraft was trying to acquire a miss-
commanded speed/no autothrottles, crossing restriction etc., but frankly
neither of us could find an inappropriate setup error (not to say there
wasn't one).
With the concerns with the MAX 8 nose down stuff, we both thought
it appropriate to bring it to your attention. We discussed issue at
length over the course of the return to ZZZ. Best guess from me is
airspeed fluctuation due to mechanical shear/frontal passage that
overwhelmed automation temporarily or something incorrectly setup
in MCP (Mode Control Panel). PM's callout on ``descending'' was
particularly quick and welcome as I was just coming back to my
display after looking away. System and procedures coupled with CRM
(Resource Management) trapped and mitigated issue.
Synopsis
B737MAX Captain reported an autopilot anomaly in which led to an
undesired brief nose down situation.
ACN: 1597286 (Reports 1597380 and 1597286 refer to the same event.)
Time / Day
Date : 201811
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.MSL.Single Value : 2000
Aircraft
Reference : X
ATC / Advisory.Tower : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Takeoff
Airspace.Class C : ZZZ
Component
Aircraft Component : Autopilot
Aircraft Reference : X
Problem : Malfunctioning
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Not Flying
Function.Flight Crew : First Officer
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 511
ASRS Report Number.Accession Number : 1597286
Analyst Callback : Attempted
Events
Anomaly.Aircraft Equipment Problem : Critical
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : Regained Aircraft Control
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
Day 3 of 3 departing in a MAX 8 after a long overnight. I was well
rested and had discussed the recent MAX 8 MCAS guidance with the Captain.
On departure, we had strong crosswinds (gusts > 30 knots) directly off
the right wing, however, no LLWS or Micro-burst activity was reported
at the field. After verifying LNAV, selecting gear and flaps up, I set
``UP'' speed. The aircraft accelerated normally and the Captain engaged
the ``A'' autopilot after reaching set speed. Within two to three seconds
the aircraft pitched nose down bringing the VSI to approximately 1,200
to 1,500 FPM. I called ``descending'' just prior to the GPWS sounding
``don't sink, don't sink.'' The Captain immediately disconnected the
autopilot and pitched into a climb. The remainder of the flight was
uneventful. We discussed the departure at length and I reviewed in
my mind our automation setup and flight profile but can't think of
any reason the aircraft would pitch nose down so aggressively.
Synopsis
B737 MAX First Officer reported that the aircraft pitched nose
down after engaging autopilot on departure. Autopilot was disconnected
and flight continued to destination.
ACN: 1593701
Time / Day
Date : 201811
Local Time Of Day : 1201-1800
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.MSL.Single Value : 33000
Environment
Light : Daylight
Aircraft
Reference : X
ATC / Advisory.Center : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Climb
Airspace.Class A : ZZZ
Component
Aircraft Component : FMS/FMC
Aircraft Reference : X
Problem : Improperly Operated
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : First Officer
Function.Flight Crew : Pilot Not Flying
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 454
Experience.Flight Crew.Type : 454
ASRS Report Number.Accession Number : 1593701
Human Factors : Distraction
Human Factors : Training / Qualification
Events
Anomaly.Deviation_Altitude : Undershoot
Anomaly.Deviation_Procedural : Clearance
Result.Flight Crew : Returned To Clearance
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Primary Problem : Human Factors
Narrative: 1
We were climbing from FL 330 given a clearance to FL 360. Aircraft
briefly leveled at initial cruise altitude FL 340 before Aircrew in
tervention. [Center] queried if we received the clearance to FL 360.
As a result of the brief delay [Center] issued brief off course vectors
to both us and converging traffic. Causal factors were equipment: not
much experience in MAX-800, as a result, still have to search for
everything. Automation: Upon receipt of FL 360 clearance and after
the Captain dialed the MCP Altitude 36,000 FT, I should have, but
failed to, ensured the cruise altitude reflected FL 360. Engaging
the ALT INTV button would have facilitated the process. The solution
is to Verify/Verbalize/Monitor. Verifying the CDU cruise altitude
(NAV 2/3) would have prevented the temporary level off. Monitoring
would have mitigated the delay at FL 340 but could have been timelier.
As a relatively new First Officer, I had not seen this issue. However,
I could have done a better job with VVM (Verbalize, Verify, Monitor)
to back up the Captain with his duties while flying. Had I seen the
momentary level off, I might have been able to alert ATC of it,
avoiding any confusion or deviation of what the expectations were.
Synopsis
B737 MAX8 First Officer reported an altitude deviation due to an
intermediate level off by the aircraft automation.
ACN: 1593699
Time / Day
Date : 201811
Local Time Of Day : 0601-1200
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Light : Daylight
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Parked
Component
Aircraft Component : Cockpit Furnishing
Manufacturer : Boeing
Aircraft Reference : X
Problem : Design
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Not Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 428
ASRS Report Number.Accession Number : 1593699
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Flight Deck / Cabin / Aircraft Event : Other / Unknown
Were Passengers Involved In Event : N
When Detected : Pre-flight
Assessments
Contributing Factors / Situations : Equipment / Tooling
Primary Problem : Equipment / Tooling
Narrative: 1
ATIS sheet fell through the slot forward of the center pedestal and
the blank off plate. We had Maintenance come out to remove it. We
discovered 20 other ATIS sheets mixed into the wiring. The aircraft
is only six months old. Severe potential fire hazard!
Synopsis
737MAX8 Captain reported a slot in the cockpit center pedestal allowed
flight documents to slip through and collect on aircraft wire bundles.
ACN: 1593021
Time / Day
Date : 201811
Place
Altitude.AGL.Single Value : 0
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Flight Phase : Parked
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Total : 21200
Experience.Flight Crew.Last 90 Days : 178
Experience.Flight Crew.Type : 3342
ASRS Report Number.Accession Number : 1593021
Human Factors : Training / Qualification
Human Factors : Confusion
Events
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Flight Crew
When Detected : Pre-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Company Policy
Contributing Factors / Situations : Human Factors
Contributing Factors / Situations : Manuals
Contributing Factors / Situations : Procedure
Primary Problem : Manuals
Narrative: 1
This was the first flight on a Max for both pilots. Unfamiliarity with
flight deck displays led to confusion about display annunciations and
switch function. The Flight Manual does not address at least one
annunciation, or the controls for the display_or if it does, neither
pilot could find the explanation. I have spent literally days looking
for an explanation, could not find one, and that is why I wrote this
report. It shouldn't be this hard to figure out what I'm looking at.
On the First Officer side ND, on the ground only, there is a MAINT
annunciation. We both saw it, couldn't find any immediate explanation
for it on the ground, and didn't address it until airborne. I
researched the FM (Flight Manual) for an explanation, accomplishing
a word search of the term MAINT. There are only two references I could
find: the overhead MAINT light (a no go item) and the CDS MAINT light
(a QRH item). There is no explanation of the ND MAINT annunciation.
We spent the entire hour flight trying to find the meaning of this
annunciation and came up empty handed. We determined to check it out
once we landed (if the light came on again). Sure enough, after parking,
the MAINT annunciation came back on the ND display. We called Maintenance
to check out the light. We waited to make an ELB entry, unsure if one was
required. Turned out, an ELB entry was not required.
The mechanic explained the light was part of a menu for maintenance
use only on the ground.
In addition, there are two selector knobs that are under-explained
(i.e., not explained) in the manual, and we were uncertain what their
purpose was. One is under the Fuel Flow switch and the other under the
MFD/ENG TFR display switch. These knobs don't seem to work in flight.
The First Officer offered to hit the SEL function in flight, to test
it out, but I thought something irreversible or undesirable might
happen (not knowing what we were actually selecting), so we did not
try it out in flight. The mechanic later explained SEL on the First
Officer side was used on the ground by maintenance to toggle between
the maintenance functions. I forgot to ask what my side did, and still
don't know.
Finally, in the Captain's preflight procedure in the bulletin, it
says, ``Selector .�1A.�1A. C''. What selector is this referring to?
Is this the same selector under the Fuel Flow switch, (which is shown
in the MAX panels on the L position, as if that is the normal
position?) This is very poorly explained. I have no idea what switch
the preflight is talking about, nor do I understand even now what this
switch does.
I think this entire setup needs to be thoroughly explained to pilots.
How can a Captain not know what switch is meant during a preflight
setup? Poor training and even poorer documentation, that is how.
It is not reassuring when a light cannot be explained or understood
by the pilots, even after referencing their flight manuals. It is
especially concerning when every other MAINT annunciation means
something bad. I envision some delayed departures as conscientious
pilots try to resolve the meaning of the MAINT annunciation and which
switches are referred to in the setup.
Synopsis
B737MAX Captain reported confusion regarding switch function and
display annunciations related to ``poor training and even poorer
documentation''.
ACN: 1593017
Time / Day
Date : 201811
Place
Altitude.AGL.Single Value : 0
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Flight Phase.Other
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
ASRS Report Number.Accession Number : 1593017
Human Factors : Confusion
Human Factors : Training / Qualification
Events
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Flight Crew
When Detected : Pre-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Manuals
Primary Problem : Manuals
Narrative: 1
The recently released 737 MAX8 Emergency Airworthiness Directive directs
pilots how to deal with a known issue, but it does nothing to address
the systems issues with the AOA system.
MCAS (Maneuvering Characteristics Augmentation System) is implemented
on the 737 MAX to enhance pitch characteristics with flaps UP and at
elevated angles of attack. The MCAS function commands nose down stabilizer
to enhance pitch characteristics during steep turns with elevated load
factors and during flaps up flight at airspeeds approaching stall. MCAS
is activated without pilot input and only operates in manual, flaps up
flight. The system is designed to allow the flight crew to use column
trim switch or stabilizer aisle stand cutout switches to override MCAS
input. The function is commanded by the Flight Control computer using
input data from sensors and other airplane systems.
The MCAS function becomes active when the airplane Angle of Attack
exceeds a threshold based on airspeed and altitude. Stabilizer incremental
commands are limited to 2.5 degrees and are provided at a rate of 0.27
degrees per second. The magnitude of the stabilizer input is lower at
high Mach number and greater at low Mach numbers. The function is reset
once angle of attack falls below the Angle of Attack threshold or if
manual stabilizer commands are provided by the flight crew. If the
original elevated AOA condition persists, the MCAS function commands
another incremental stabilizer nose down command according to current
aircraft Mach number at actuation.
This description is not currently in the 737 Flight Manual Part 2,
nor the Boeing FCOM, though it will be added to them soon. This
communication highlights that an entire system is not described in
our Flight Manual. This system is now the subject of an AD.
I think it is unconscionable that a manufacturer, the FAA, and the
airlines would have pilots flying an airplane without adequately
training, or even providing available resources and sufficient
documentation to understand the highly complex systems that
differentiate this aircraft from prior models. The fact that this
airplane requires such jury rigging to fly is a red flag. Now we know
the systems employed are error prone_even if the pilots aren't sure
what those systems are, what redundancies are in place, and failure
modes.
I am left to wonder: what else don't I know? The Flight Manual is
inadequate and almost criminally insufficient. All airlines that
operate the MAX must insist that Boeing incorporate ALL systems
in their manuals.
Synopsis
B737MAX Captain expressed concern that some systems such as the MCAS
are not fully described in the aircraft Flight Manual.
ACN: 1590012
Time / Day
Date : 201810
Local Time Of Day : 0001-0600
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 1000
Environment
Light : Daylight
Aircraft
Reference : X
ATC / Advisory.Tower : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Takeoff
Airspace.Class C : ZZZ
Component
Aircraft Component : Autothrottle/Speed Control
Aircraft Reference : X
Problem : Improperly Operated
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Instrument
Experience.Flight Crew.Last 90 Days : 419
ASRS Report Number.Accession Number : 1590012
Human Factors : Confusion
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Speed : All Types
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : Overcame Equipment Problem
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
After 1000 feet I noticed a decrease in aircraft performance. I picked
up that the autothrottles were not moving to commanded position even
though they were engaged. I'm sure they were set properly for takeoff
but not sure when the discrepancy took place. My scan wasn't as well
developed since I've only flown the MAX once before. I manually
positioned the thrust levers ASAP. This resolved the threat, we were
able to increase speed to clean up and continue the climb to 3000 feet.
1Shortly afterwards I heard about the (other carrier) accident and am
wondering if any other crews have experienced similar incidents with
the autothrottle system on the MAX? Or I may have made a possible
flying mistake which is more likely. The FO (First Officer) was still
on his first month and was not able to identify whether it was the
aircraft or me that was in error.
Synopsis
B737-MAX8 Captain reported the autothrottles failed to move to the
commanded position during takeoff and climb.
ACN: 1587343
Time / Day
Date : 201810
Place
Altitude.AGL.Single Value : 0
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : General Seating Area
Reporter Organization : Air Carrier
Function.Flight Attendant : Off Duty
ualification.Flight Attendant : Current
ASRS Report Number.Accession Number : 1587343
Human Factors : Situational Awareness
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : FAR
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Passenger
Detector.Person : Flight Attendant
Were Passengers Involved In Event : Y
When Detected : Taxi
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
I was pass riding this flight on the new 737 Max. From my seat towards
the rear of the aircraft, with seats that appear to be higher, it was
impossible to see the Flight Attendant perform the safety demo. It was
brought to my attention when overhearing a nearby passenger comment that
they could not see the demo asking if they were supposed to be able to see it.
Synopsis
Off duty Flight Attendant reported being unable to see the B737 Max
cabin safety demonstration because the passenger seats are too high.
ACN: 1583127
Time / Day
Date : 201810
Local Time Of Day : 1801-2400
Place
Locale Reference.Airport : DEN.Airport
State Reference : CO
Altitude.MSL.Single Value : 7000
Environment
Flight Conditions : VMC
Aircraft
Reference : X
ATC / Advisory.Tower : DEN
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Flight Phase : Initial Approach
Airspace.Class B : DEN
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Instrument
Experience.Flight Crew.Total : 18000
ASRS Report Number.Accession Number : 1583127
Human Factors : Situational Awareness
Events
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Inflight Event / Encounter : Unstabilized Approach
Detector.Person : Flight Crew
When Detected : In-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Primary Problem : Human Factors
Narrative: 1
The purpose of this [report] is to explain a situation where I
unintentionally used a high rate of descent to recapture a glide
path landing in DEN in a 737 MAX. I have flown the MAX a few times
[before] but this was the first time I've flown it in a high density
altitude airport. The landing was uneventful and I felt like I was in
control the entire final approach but the rate of descent was higher
than I anticipated or normally use due to my hesitancy to quickly revert
from reliance on technology to visual approach procedures. I understand
the emphasis on visual approaches in training and safety.
After an uneventful flight to DEN we were given a left downwind turn
to base for DEN runway 16L outside of LEETS at 7000 feet. It was a clear
night so I accepted the visual when offered and slowed appropriately for
the final decent. To increase my familiarity of the MAX, prior to top of
descent, I briefed and intended to engage ARM III below 5000 feet AGL
and set up the HUD to do so. As we neared LEETS I pushed the Approach
ARM button (with 7000 feet in the MCP) but my attention was outside
and on the flight display system when I made a rookie mistake. I didn't
notice that the Approach mode did not arm.
I have flown the 737 MAX a few times and was familiar with, what I
believe to be, slightly different descent characteristics. Also, I
armed the speed brakes but apparently when I did so the handle was
slightly past the detent. I don't know if the ARM switch wouldn't
engage as a result of this or not? Also I don't know if the Landing
Attitude Modifier behaves differently due to the speed brake handle
not precisely set in detent? Of course since I had 7000 feet in the
MCP as we flew past LEETS I lost vertical path display and in the
moment(s) it took to evaluate what was happening, I got high on path.
The vertical guidance displays were now unusable so I abandoned the
idea of the CAT III practice and adjusted to a high rate of descent
to visually get on the PAPI. Since DEN is 5434 feet I rationalized
that a higher descent rate was appropriate due to the high density
altitude and called ``stable'' at 1000 feet with a 1200 feet rate of
descent but correcting. When I adjusted the throttles, the speed brake
green light went to amber and the FO (First Officer) quickly and
correctly armed the speed brake. I didn't get enough power in soon
enough and ended up getting three reds on the PAPI and a ``Glide Slope
'' announcement to which I adjusted up to regain path. I continued to
an uneventful landing.
As a result of this situation which happened very quickly, I will 1)
recommit to confirming buttons arm when pushed, 2) recommit to confirming
the speed brake handle is fully in the arm detent (in addition to the green
arm light) 3) react more swiftly to visual methods (or go around) when a
ppropriate when displays don't appear as expected and 4) continue to ensure
stabilized approaches or go around as necessary.
Synopsis
B737 MAX Captain reported an unstabilized approach into DEN due
to human factors and aircraft familiarization.
ACN: 1583028
Time / Day
1Date : 201809
Environment
Light : Daylight
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Nav In Use : GPS
Flight Phase : Cruise
Component
Aircraft Component : Powerplant Fuel System
Aircraft Reference : X
Problem : Malfunctioning
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying1Qualification.Flight Crew : Instrument
1Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 420
Experience.Flight Crew.Type : 9000
ASRS Report Number.Accession Number : 1583028
Human Factors : Troubleshooting
Events
Anomaly.Deviation_Procedural : Weight And Balance
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Inflight Event / Encounter : Fuel Issue
Detector.Person : Flight Crew
When Detected : In-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
My concern is that some MAX 8 aircraft are burning significantly more
fuel than what is calculated on the Dispatch release. Perhaps the fuel
bias on these aircraft needs to be reevaluated. On this particular flight,
the burn rate was so high that the Pilots referred to the MAX AOM
(Aircraft Operator Manual) to look up what constitutes a fuel leak.
Our flight plan fuel was for a burn of 21,600 pounds from push to
touchdown. Our actual burn was 22,900 pounds (actual fuel load of 28,100
at push minus our 5,200 pounds at touchdown. We pulled into the gate with
5,000 pounds). This was 1,300 pounds more fuel burned than planned.
Other than a direct to ZZZ shortly after departing ZZZ1, we flew the
flight planned altitude and routing. I also slowed to .76 Mach a couple
of times for pockets of turbulence. Winds were close to flight plan and
there was minimal off-course maneuvering to avoid a couple of buildups.
Based on another long MAX 8 flights where we burned more than flight plan,
I kept a detailed fuel log this flight. We pushed with 700 pounds fuel
more than flight plan. Fifty minutes into the flight we were plus 500
pounds of fuel over flight plan.
At 1+20 into the flight, we were plus 300 pounds. At 1+49 we were at
the calculated flight plan fuel. Eleven minutes later we were at -300
pounds from flight planned fuel. Around that point we contacted Dispatch
through ACARS to let them know our fuel was not trending well. We got
into the books and ran the Fuel Leak QRH just in case. The flight
attendants scanned the engines and the wings. Everything checked out ok
with respect to the QRH, except we had an unusual fuel burn. Dispatch,
the FO (First Officer), and I came up with a plan to update our status
over ZZZ and also over ZZZ2. At 2+11, we were -500 pounds for fuel. The
fuel trend stayed constant at -500 pounds from flight plan for the
duration of the flight from that point onward.
The weather was VFR at ZZZ3 so we elected to continue over ZZZ and
also ZZZ2. I was concerned as my calculations had us landing with
less than 5,000 pounds. Dispatch said his calculations had us landing
with 6,300 pounds. Dispatch was very helpful throughout the majority
of the flight providing updates on weather and asking our fuel status.
Dispatch also asked that I call him after landing. We landed uneventfully
other than fuel being 900 pounds lower than the Dispatch Release after
flying the flight plan. After landing, I walked around the aircraft
and went into the main gear well. My concern was a potential fuel leak.
I noted none nor any abnormal fuel smells.
After that, I called Dispatch and we had a conference call with
Maintenance. The Maintenance Controller said they were noting that
several MAX 8 aircraft are not fuel efficient. He said they think the
Boeing-recommended engine cleaning cycle is not frequent enough. I was
told during this call that when the LEAP engines are dirty they lose all
of their efficiency. If this is the case, shouldn't the fuel bias on
these aircraft be adjusted accordingly? From now on, I am going to plan
on an extra 400 pounds per hour of fuel on each MAX 8 I fly on a leg longer
than two and a half hours.
Synopsis
B737 MAX-8 Captain reported the engine fuel burn was higher than
expected.
ACN: 1572630
Time / Day
Date : 201808
Local Time Of Day : 1201-1800
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Light : Daylight
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Component
Aircraft Component : Engine Starting System
Aircraft Reference : X
Problem : Improperly Operated
Person : 1
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 354
ASRS Report Number.Accession Number : 1572630
Human Factors : Other / Unknown
Person : 2
Reference : 2
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Not Flying
Function.Flight Crew : First Officer
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Instrument
ASRS Report Number.Accession Number : 1573224
Human Factors : Other / Unknown
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Automation : Aircraft Other Automation
When Detected : Taxi
Result.Flight Crew : Overcame Equipment Problem
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Contributing Factors / Situations : Manuals
Primary Problem : Human Factors
Narrative: 1
We were pushing back from the gate in a MAX 8 and were starting the
number 2 engine. The FO (First Officer) configured the air conditioning
panel before the tick on the EGT was gone, causing the EEC (Electronic
Engine Controller) to abort the engine start. Once we saw the white
box flashing, we aborted the engine start, reviewed the QRC, and
followed the QRH guidance. After confirming with Maintenance (and a
review of the [operation manual]) a second successful start was made.
We conducted a briefing about the MAX engine start and the items that
we were going to see, and time limits associated during our normal
preflight briefings. I was very surprised when the aborted start
happened due to the fact that we had reviewed the start process.
I will continue to brief the engine start procedures with a bigger
emphasis on the EGT roll back.
Narrative: 2
[Report narrative contained no additional information.]
Synopsis
B737 MAX-8 crew reported failing to follow the engine start procedure
resulting in an aborted engine start.
ACN: 1568887
Time / Day
Date : 201808
1Local Time Of Day : 1801-2400
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Flight Conditions : VMC
Light : Night
Aircraft
Reference : X
ATC / Advisory.Ramp : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
Experience.Flight Crew.Total : 11000
ASRS Report Number.Accession Number : 1568887
Human Factors : Situational Awareness
Events
Anomaly.Conflict : Ground Conflict, Critical
Detector.Person : Flight Crew
When Detected : Taxi
Result.Flight Crew : Took Evasive Action
Assessments
Contributing Factors / Situations : Human Factors
Primary Problem : Human Factors
Narrative: 1
Upon taxi into gate, [guidance system] was active, both pilots
cleared ramp area. Approximately 20 ft remaining FO yells for me
to stop. I immediately stopped aircraft and FO [advised] fueler was
backing up into our safety zone. We were in a B737 MAX with the split
winglets and thus the clearance provided below the wingtip was
considerably less. After speaking with ramp [personnel] who reviewed
the ramp video, I believe the monitoring and quick response of the FO
averted possible damage or impact to aircraft. Ramp fueler personnel
inattentive to position on ramp. [Not] all ramp personnel may be
accustomed to the 737 MAX winglet design and the increased clearance
required. Training for this may be beneficial.
Synopsis
B737-800 Captain reported making a sudden stop to avoid a collision
with a fuel truck on the ramp.
ACN: 1565207
Time / Day
Date : 201808
Place
Altitude.MSL.Single Value : 33000
Environment
Flight Conditions : VMC
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Cruise
Component : 1
Aircraft Component : Data Transmission and Automatic Calling
Aircraft Reference : X
Problem : Malfunctioning
Component : 2
Aircraft Component : Other Documentation
Aircraft Reference : X
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Experience.Flight Crew.Last 90 Days : 50
Experience.Flight Crew.Type : 2978
ASRS Report Number.Accession Number : 1565207
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : Overcame Equipment Problem
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
At cruise flight, our Wi-Fi stopped working. I then saw that I was
unable to access the Pilot Mobile app. Since I do not routinely copy
the flight plan to iBook or acrobat (we are not required to do this),
I was unable to access the flight plan. I've lost Wi-Fi before but not
had this problem. Maybe it's a 737max thing. My First Officer had a
copy on iBook and airdropped it to me. Later we were able to restore
the Wi-Fi and I could login to pilot mobile but the [flight plan]
was not there anymore.
Synopsis
B737NG Captain reported the aircraft Wi-Fi was not working in cruise,
which affected the ability to access the flight plan on the iPad.
ACN: 1560763
Time / Day
Date : 201807
Local Time Of Day : 0601-1200
Place
Locale Reference.Airport : BWI.Airport
State Reference : MD
Altitude.MSL.Single Value : 17000
Environment
Light : Daylight
Aircraft
Reference : X
ATC / Advisory.TRACON : PCT
Aircraft Operator : Air Carrier
Make Model Name : B737-800
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Nav In Use : GPS
Flight Phase : Climb
Route In Use.SID : TERPZ 6
Airspace.Class E : PCT
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Not Flying
Function.Flight Crew : First Officer
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Instrument
Experience.Flight Crew.Last 90 Days : 230
Experience.Flight Crew.Type : 1600
ASRS Report Number.Accession Number : 1560763
Events
Anomaly.Deviation_Altitude : Crossing Restriction Not Met
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Flight Crew
When Detected : In-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Airspace Structure
Primary Problem : Airspace Structure
Narrative: 1
I have flown out of BWI on the TERPZ 6 to either OTTTO or RAMAY the
last three weeks. Each time I have flown a 737-800 or MAX8. The first
two times in the 737-800 we had to adjust our climb out speed below
the ECON Schedule (which was around 300) to make the 17,000ft., or
above restriction at FOXHL (FMC warnings were received ``unable next
altitude''). In the 737 MAX8, it was less. So by starting early to
adjust our profile we were able to meet the restriction. It appears
like a trend that heavy 737-800 aircraft in summertime will have a hard
time meeting the climb restriction, and if you do not catch it soon
enough you may not make the FOXHL restriction.
[Suggestion].In the Departure Section of the SID add a note. If
departing the TERPZ 6 to OTTTO or RAMAY be aware that high gross
weights and hot temperatures may not allow you to climb via the FMC
ECON Speed and meet the 17,000ft., or above restriction at FOXHL.
Synopsis
B737-800 First Officer reported that departing out of BWI, the
aircraft is unable to make the 17000ft. restriction at FOXHL on
TERPZ 6 departure.
ACN: 15550130
Time / Day
Date : 201806
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Undifferentiated or Other Model
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Parked
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : First Officer
Function.Flight Crew : Pilot Not Flying
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Total : 10861
Experience.Flight Crew.Type : 1660
ASRS Report Number.Accession Number : 1555013
Human Factors : Human-Machine Interface
Human Factors : Training / Qualification
Events
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Inflight Event / Encounter : Weather / Turbulence
Detector.Person : Flight Crew
When Detected : Pre-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Company Policy
Contributing Factors / Situations : Human Factors
Contributing Factors / Situations : Manuals
Contributing Factors / Situations : Procedure
Primary Problem : Company Policy
Narrative: 1
I had my first flight on the Max [to] ZZZ1. We found out we were scheduled
to fly the aircraft on the way to the airport in the limo. We had a little
time [to] review the essentials in the car. Otherwise we would have walked
onto the plane cold.
My post flight evaluation is that we lacked the knowledge to operate the
aircraft in all weather and aircraft states safely. The instrumentation
is completely different_My scan was degraded, slow and labored having had
no experience w/ the new ND (Navigation Display) and ADI (Attitude Director
Indicator) presentations/format or functions (manipulation between the
screens and systems pages were not provided in training materials. If
they were, I had no recollection of that material).
We were unable to navigate to systems pages and lacked the knowledge
of what systems information was available to us in the different phases
of flight. Our weather radar competency was inadequate to safely
navigate significant weather on that dark and stormy night. These are
just a few issues that were not addressed in our training.
I recommend the following to help crews w/ their introductory flight
on the Max: Email notification the day before the flight (the email
should include: Links_Training Video, PSOB and QRG and all relevant
updates/FAQ's) SME (Subject Matter Expert) Observer_the role of the
SME is to introduce systems navigation, display management, answer
general questions and provide standardized best practices to the next
generation aircraft.
Additionally, the SME will collect de-identified data to provide to
the training department for analysis and dissemination to the line
pilots regarding FAQs and know systems differences as well best
practices in fly the new model aircraft.
Synopsis
B737 MAX First Officer reported feeling unprepared for first flight
in the MAX, citing inadequate training.
ACN: 1550073
Time / Day
Date : 201806
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Nav In Use : FMS Or FMC
Flight Phase : Cruise
Component
Aircraft Component : Air/Ground Communication
Aircraft Reference : X
Problem : Design
Person
Reference : 1
Location Of Person : Company
Reporter Organization : Air Carrier
Function.Maintenance : Other / Unknown
ASRS Report Number.Accession Number : 1550073
Human Factors : Communication Breakdown
Communication Breakdown.Party1 : Maintenance
Communication Breakdown.Party2 : Flight Crew
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Maintenance
When Detected : In-flight
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Equipment / Tooling
Primary Problem : Ambiguous
Narrative: 1
Ever since the 737MAX, it seems most 737 controllers are not getting
ACARS messages or Electronic Logbook write-ups the crew sends. The
messages are not coming through on Maintenance Control ACARS/ELB page
or through the Maintenance Control's alert manager application.
Yesterday on a flight, I received a call from dispatch asking if I
could answer the crew. Since I had not received any messages and no
other controllers had either we were in the dark. Dispatcher gave me
the info I proceeded to reply to Captain's inquiry, also telling him
to message both dispatch and Maintenance Control, as we were not
receiving the messages from him. We never got a response, but dispatch
called and said Captain received our message and problem was resolved.
After this situation, I decided to try and test it out on another
aircraft, which had just arrived in our base. I sent a test log
page. Again, we did not receive any pop up on Maintenance Control
[page] or Maintenance Control's alert manager informing us of the
write-up.
Synopsis
Maintenance personnel reported that on Boeing 737MAX, Maintenance
Control is not receiving ACARS or Electronic Logbook write-ups the
flight crew sends.
ACN: 1538699
Time / Day
Date : 201804
Place
Locale Reference.ATC Facility : ZZZ.TRACON
State Reference : US
Relative Position.Distance.Nautical Miles : 15
Altitude.MSL.Single Value : 3000
Environment
Flight Conditions : VMC
Aircraft
Reference : X
ATC / Advisory.TRACON : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737 Undifferentiated or Other Model
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Initial Approach
Airspace.Class B : ZZZ
Person : 1
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : First Officer
Function.Flight Crew : Pilot Not Flying
Qualification.Flight Crew : Instrument
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Multiengine
Experience.Flight Crew.Last 90 Days : 496
Experience.Flight Crew.Type : 2200
ASRS Report Number.Accession Number : 1538699
Human Factors : Situational Awareness
Human Factors : Human-Machine Interface
Human Factors : Training / Qualification
Human Factors : Distraction
Person : 2
Reference : 2
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying
Qualification.Flight Crew : Multiengine
Qualification.Flight Crew : Air Transport Pilot (ATP)
Qualification.Flight Crew : Instrument
Experience.Flight Crew.Last 90 Days : 327
ASRS Report Number.Accession Number : 1538699
Human Factors : Troubleshooting
Human Factors : Confusion
Human Factors : Human-Machine Interface
Events
Anomaly.Deviation_Altitude : Overshoot
Anomaly.Deviation_Track / Heading : All Types
Anomaly.Deviation_Procedural : Clearance
Detector.Automation : Aircraft Other Automation
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : FLC Overrode Automation
Result.Flight Crew : Became Reoriented
Result.Air Traffic Control : Provided Assistance
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Company Policy
Contributing Factors / Situations : Human Factors
Primary Problem : Aircraft
Narrative: 1
While on a 300 degree intercept heading, at an assigned altitude of
3000 feet, autopilot engaged, we received clearance ``Maintain 3000 ft
until established, cleared for the ILS Approach'', and were handed over
to the Tower. The pilot flying ``armed'' VOR/LOC, which was verified on
the FMA (Flight Mode Annunciator). Approaching the extended centerline
of the runway, the pilot flying determined that VOR/LOC had failed to
``capture'' and was overshooting the final. The pilot flying then made
immediate correction back toward centerline via manual input with the
control yoke, which disengaged the autopilot in all axes. The pilot
flying noted there was no ILS ``raw data'' presented on his EADI (
Electronic Attitude Direction Indicator). Pilot not flying noted he
did have CDI (Coursed Deviation Indicator) and glideslope pointers,
but did not have VOR/LOC capture yet. Both pilot flying and pilot not
flying verified that proper frequencies and inbound courses were set
correctly.
The pilot flying had the runway in sight visually at that point and
continued hand flying toward the runway. The pilot not flying's FMA
then ``captured'' VOR/LOC, while pilot flying's remained in ``arm''.
At that time we were outside of the Final Approach Fix. We then received
instruction from Final Monitor to climb back to 3000 feet. The pilot
flying immediately returned to altitude, while maintaining centerline
track to the runway visually. In the distraction, we had inadvertently
descended to approximately 2450 feet. Inside of the Final Approach Fix,
pilot flying set and descended to 2700 feet. Pilot not flying's FMA
remained in VOR/LOC with glideslope pointer descending the scale
toward the ``centered'' position, while pilot flying's ``raw data''
indications remained blank, with VOR/LOC ``armed'' on his FMA. At, or
just prior to, ZZZZZ at 2700 feet, LOC and glideslope indications
suddenly appeared, and VOR/LOC captured on the pilot flying's FMA. Pilot
flying selected APP mode on the MCP (Mode Control Panel). Glideslope
immediately``captured'' on the pilot flying's FMA, and indications
remained normal withoutfurther anomaly. Approach and landing were
made on without incident.
Contributing factors were this was the first flight of a morning trip.
Also both pilots first flight in MAX aircraft so there was a lot of
looking around for information that has become instinctual in the NG.
The weather was ragged SCT-BKN layer between 3000-3200 feet. More time
in the MAX aircraft would be helpful. Time spent looking for information
on redesigned display layout was definitely a distraction. I have never
seen such a disparity between Captain and First Officer instrumentation
like we experienced, where one side has good data and the other has none
(assuming both are tuned/setup identically, which ours were). I'm not
sure if this issue is MAX specific. As the pilot monitoring, I should
have done a better job monitoring our altitude, especially after the a
utopilot was disconnected. I became too distracted by the problem and
trying to quickly correct it. I should have recognized and called out
the altitude deviance.
Narrative: 2
[Report narrative contained no additional information.]
Synopsis
B737 MAX pilots reported flying through the final approach course
and descending below published altitudes due to confusion with the new
style instrument displays.
ACN: 1517486
Time / Day
Date : 201802
Local Time Of Day : 1201-1800
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Light : Daylight
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Undifferentiated or Other Model
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
ASRS Report Number.Accession Number : 1517486
Human Factors : Communication Breakdown
Human Factors : Training / Qualification
Events
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Ground Event / Encounter : Other / Unknown
Detector.Person : Flight Crew
When Detected : Aircraft In Service At Gate
When Detected : Taxi
Assessments
Contributing Factors / Situations : Company Policy
Contributing Factors / Situations : Airport
Contributing Factors / Situations : Procedure
Contributing Factors / Situations : Human Factors
Primary Problem : Procedure
Narrative: 1
As we contacted the Pushback Driver for the required exchange of call
outs, we finished running the Before Pushback Checklist. The First
Officer and I, and Company Dispatcher doing his annual qualification
on the jumpseat, were all listening on the Flight interphone to the
exchange between the Pushback Driver and me. All call outs were normal
up to the pushback call for ``Brakes Set''. Once the return reply
``Brakes Set'' was said by me, at that second the communication plugs
were pulled and the communications ended. All three of us in the
cockpit heard the headset connection plugs pulled out along with
the door shut. I also watched the Ramp Agent walk away with the box
in hand.
This was very disturbing because we were starting the new 737 MAX
engines, and number 2 was not stable and running yet. I was hoping
for them to stay until we cleared them off, as per procedure. They all
started to walk off without even any hand signals. I opened my window,
and with number 1 still shut down, I got the attention of the nearby
Wing Walker, and asked him to tell the pushback to ``hook back up''.
After enduring their looks as if I had asked them to do something
insane, they hooked back up. At this point all three of us in the
cockpit listened to what I could only call a cover up for their poor
and improper adherence to our procedures.
We didn't have any communication problems during this push; it was
crystal clear, all up to this re-plug in. It was still very clear;
however, every time I made a call or statement on the interphone, it
was followed by the pushback saying ``can you hear me''. I changed
the pace of my calls, different intervals, and was never interrupted,
just the reply, ``can you hear me'' after each of my responses. You
could tell they were making a joke out of this. I stated on the
intercom that this entire pushback is so wrong, and their attitudes
showed they don't care. ``I will write this up, and this activity
will stop''.
After my comments, he responded in a manner that showed he heard
me just fine. All three of us in the cockpit listened and observed
this low moment in communications intended for Safety. The other two
Crew Members are willing to verify this report. This type of unsafe,
anti-procedure behavior cannot be tolerated. This is becoming a
nationwide trend, with this being one of the worst examples. I'm sure
excuses will be made concerning poor communications involving equipment.
I will not buy that excuse in this example. The attitudes on the Ramp
came through loud and clear on this day that they do not buy into our
Company procedures.
Synopsis
A pilot reported a tug driver and ramp crew did not follow proper
procedures during pushback.
ACN: 15015070
Time / Day
Date : 201711
Local Time Of Day : 1801-2400
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Light : Night
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Component
Aircraft Component : Data Processing
Problem : Design
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Not Flying
Function.Flight Crew : First Officer
Qualification.Flight Crew : Air Transport Pilot (ATP)
ASRS Report Number.Accession Number : 1501507
Human Factors : Confusion
Human Factors : Human-Machine Interface
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Detector.Person : Flight Crew
When Detected : Taxi
Result.General : None Reported / Taken
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Primary Problem : Aircraft
Narrative: 1
I have flown the MAX aircraft for four legs on two separate occasions.
The first time I flew it we landed and taxied clear at Bravo and I went
to call Ground. I had gotten used to looking for the flight number in
its new location, digitally displayed on the dash. I keyed the MIC and
looked for the call sign, only to see that it had disappeared. While
this only caused a temporary distraction, at busy airports it's not
ideal. Since the flight number disappearing on landing doesn't make
any sense at all, I figured it was an anomaly to that particular
aircraft. However, I noticed the same occurrence on all four legs that
I've flown MAX aircraft (2 different aircraft). The last time this
happened was [a flight the day prior].
From best I can tell, the disappearance of the flight number is
linked to either weight on wheels or airspeed. For example, when
the airspeed drops below a certain value, the flight number
disappears. Nonetheless, this is very distracting and occurs at
absolutely the worst possible time as things get very busy for a
First Officer (FO) as we exit the active runway, call Ground, and
get our taxi instructions to the gate. Even more frustrating, is
that it makes no sense whatsoever for the call sign to disappear
at that time in the flight. It would seem that it should disappear
once the aircraft blocks in at the gate. I'm hopeful that this
[report] may shed some light on this issue and create an impetus
for a software fix to allow the call sign to remain visible until
the aircraft blocks in at the gate.
Preventative Measures: 'I think this whole issue could be fixed with
a simple software change. Please inquire to see what possibility
exists to allow the flight number to remain visible until the aircraft
blocks in at the gate.'
Synopsis
B737 Max First Officer reported that the flight number disappears
from the digital display after the aircraft has landed making it
difficult to communicate with ATC from landing to the gate.
ACN: 1495437
Time / Day
Date : 201711
Place
Altitude.AGL.Single Value : 0
Aircraft
Reference : X
ATC / Advisory.Tower : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737 Next Generation Undifferentiated
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Landing
Flight Phase : Takeoff
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Qualification.Flight Crew : Air Transport Pilot (ATP)
ASRS Report Number.Accession Number : 1495437
Analyst Callback : Attempted
Events
Anomaly.No Specific Anomaly Occurred : All Types
Detector.Person : Flight Crew
When Detected : Pre-flight
Result.General : Work Refused
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
Takeoff wingtip strike in the Max threat is not addressed. [Company]
ops specs call for rotation on takeoff towards 10 degrees of pitch.
Operations Manual states in a note ``In some instances (gusty
crosswinds, windshear) it may be necessary to hesitate at 10 degrees
until liftoff occurs''. As the pitch increases, the wingtip clearance
decreases since the 737 is a highly swept wing aircraft and the wing
tips are aft of the center of rotation for pitch. In other words as
the nose rises while the plane is on the runway, the wingtips go down.
There are crosswind landing wingtip strike concerns when landing the
[B737] Max with the cross control technique. This wingtip strike is
of concern at a body angle of approximately 5 degrees at max crosswind
(33 knots) during a cross control landing.
1In [the operating manual concerning] Takeoff in Gusty Wind or Strong
Crosswind Conditions it states regarding liftoff, under sub paragraph
Rotation and Takeoff, ``The aircraft is in a side slip WITH CROSSED
CONTROLS at this point. A slow, smooth recovery from this side slip
is accomplished after liftoff by slowly neutralizing the control wheel
and rudder pedals''. Translation and concern is this_by the [operating
manual] definition of crosswind takeoff techniques, the aircraft will
be, during a strong crosswind takeoff, up to an approximately 5 degree
higher pitch attitude (10 degrees, mentioned above) than during landing
with the aircraft in a fully cross controlled state until well after
liftoff. This guarantees, by the [operating manual] and sim pilot [B737]
Max landing instruction training, a severe wingtip runway strike!
At max crosswind there will be insufficient wing tip clearance during
a textbook crosswind takeoff in gusty wind conditions. No mention is made
of any [B737] Max takeoff guidance in any documents I can find, even
though by current takeoff technique guidance and wing tip strike
charts, an incident is guaranteed by my observation, at crosswinds
well below max demonstrated crosswind limits. If I am correct, this
must be addressed prior to line flying the [B737] Max. I cannot in good
conscience fly the [B737] Max with crosswinds until this threat is addressed.
Synopsis
B737-MAX Captain reported an unresolved threat of a wingtip strike
during crosswind landing and takeoff operations.
ACN: 1488017
Time / Day
Date : 201710
Local Time Of Day : 1201-1800
Environment
Light : Night
Aircraft
Reference : X
Aircraft Operator : Air Carrier
Make Model Name : B737 Undifferentiated or Other Model
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Descent
Component
Aircraft Component : FMS/FMC
Aircraft Reference : X
Problem : Design
Problem : Malfunctioning
Person
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying
Qualification.Flight Crew : Air Transport Pilot (ATP)
Experience.Flight Crew.Type : 522
ASRS Report Number.Accession Number : 1488017
Human Factors : Human-Machine Interface
Human Factors : Troubleshooting
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : Published Material / Policy
Anomaly.Deviation_Procedural : FAR
Detector.Person : Flight Crew
When Detected : In-flight
Result.Flight Crew : FLC Overrode Automation
Assessments
Contributing Factors / Situations : Aircraft
Primary Problem : Aircraft
Narrative: 1
During training, for the 737-MAX there was no mention that using the
Altitude Intervention (ALT INTV) button would change the FMC altitude.
However, when we entered a lower altitude from cruise altitude and
selected the ALT INTV button, the MCP altitude was entered into the
FMC. When we received a new lower altitude and entered it in the MCP
and with VNAV selected the aircraft did not start a descent like
previous NG aircraft.
We noticed that the FMC had a new cruise altitude that we had not
entered through the FMC. (The altitude had automatically been entered
from the MCP.) We selected the ALT INTV button to allow the aircraft
to descend again. This happened two or three times.
This safety issue was unexpected and could lead to an altitude
violation and safety hazard. 737-MAX FRM (Fault Reporting Manual)
4.1.3 item 10 Altitude Intervention switch: under ``push-(during VNAV
cruise)'' states: ``Lower FMC cruise altitude cannot be entered using
ALT INTV switch.'' Our aircraft DID reset the FMC altitude with the ALT
INTV switch.
Synopsis
Captain reported procedural issues with the FMS on the 737-MAX in
reference to descent capabilities.
ACN: 1486024
Time / Day
Date : 201710
Local Time Of Day : 0001-0600
Place
Locale Reference.Airport : ZZZ.Airport
State Reference : US
Altitude.AGL.Single Value : 0
Environment
Light : Daylight
Aircraft
Reference : X
ATC / Advisory.Ground : ZZZ
Aircraft Operator : Air Carrier
Make Model Name : B737 Undifferentiated or Other Model
Crew Size.Number Of Crew : 2
Operating Under FAR Part : Part 121
Flight Plan : IFR
Mission : Passenger
Flight Phase : Taxi
Component
Aircraft Component : Pneumatic Valve/Bleed Valve
Aircraft Reference : X
Problem : Improperly Operated
Person : 1
Reference : 1
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Captain
Function.Flight Crew : Pilot Flying
Qualification.Flight Crew : Air Transport Pilot (ATP)
Experience.Flight Crew.Last 90 Days : 609
Experience.Flight Crew.Type : 13800
ASRS Report Number.Accession Number : 1486024
Human Factors : Distraction
Human Factors : Situational Awareness
Person : 2
Reference : 2
Location Of Person.Aircraft : X
Location In Aircraft : Flight Deck
Reporter Organization : Air Carrier
Function.Flight Crew : Pilot Flying
Function.Flight Crew : First Officer
Qualification.Flight Crew : Air Transport Pilot (ATP)
Experience.Flight Crew.Type : 950
ASRS Report Number.Accession Number : 1486042
Human Factors : Human-Machine Interface
Human Factors : Situational Awareness
Human Factors : Communication Breakdown
Communication Breakdown.Party1 : Flight Crew
Communication Breakdown.Party2 : Flight Crew
Events
Anomaly.Aircraft Equipment Problem : Less Severe
Anomaly.Deviation_Procedural : Published Material / Policy
Detector.Person : Flight Crew
Were Passengers Involved In Event : N
When Detected : Taxi
Result.Flight Crew : Returned To Gate
Assessments
Contributing Factors / Situations : Aircraft
Contributing Factors / Situations : Human Factors
Contributing Factors / Situations : Procedure
Primary Problem : Procedure
Narrative: 1
It was the second day ever to fly together and the first flight for
both of us in the MAX. Normal pushback. We received Impending Hot Start
on Number 2 engine with auto shutdown. My attention was totally outside
the aircraft as I was in the process of clearing the Ground Crew off.
My attention was drawn back inside to see the white flashing box around
the EGT with the motor rolling back. At the time, the F/O (First Officer)
had no idea what may have caused it, so we ran appropriate QRH items
for a suspected malfunction, started number 1 engine, and taxied back
to the gate, making a logbook write-up, and calling Maintenance.
Having time to discuss what may have happened, looking through
numerous publication sources, and sleeping on it, the F/O is now
sure that he prematurely isolated/ventilated just momentarily, but
long enough to steal the air source causing an incomplete and auto
aborted start. Despite being patient and pre-briefing that we would
not rush our first MAX experience in any way, anxiousness over the
newness and the longer start process must have still affected our
pacing. The Isolation switch to Isolate and the Pack switch to ON
before engine rollback obviously caused the engine to shut down.
More training would be great, and hands-on training would certainly
have been beneficial. Still, we felt prepared, but the hype of the
new aircraft with the unfamiliar pacing caused an unfortunate situation.
Narrative: 2
It was a normal pushback. The Captain indicated to start number
2 engine. I followed procedures for start and everything appeared
normal. During the end of the start, I thought I heard the Captain
say ``Start number 1.'' I was looking at the number 2 engine EGT
and it had appeared to peak so I reached up and selected isolation
valve CLOSED and right pack ON. I then reached over to start number 1.
When I glanced down at the number 2 EGT I realized there was still a
red tick mark so I did not start number 1. Within a second or two, I
noticed the number 2 engine EGT box white and flash and the Oil Pressure
light illuminate and the engine rolled back. We accomplished the Aborted
Start Checklist, started the number 1 engine and taxied to Gate XX.
When I heard start number 1, I should have verified that a full
rollback had indeed taken place prior to moving my hand away from the
start lever. Instead since it appeared the temperature had peaked I
made an assumption that it was incorrect. Obviously, this was a new
variant so out of an abundance of caution we went back to the gate
instead of attempting another start. In hindsight I should have also
voiced turning on the pack more loudly to Maintenance, but at the
time we were not really sure what caused the rollback. There is
already a note in the Aircraft Operating Manual regarding pack usage
during start. This was just a pure mistake on my part in turning on
the switch to early.
Synopsis
B737 Max flight crew reported that an Auto Shutdown of the Number Two
engine on engine start was probably due to the First Officer
activating the Isolation switch and the Pack switch during the start.