[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]
THE BOEING 737 MAX: EXAMINING THE DESIGN, DEVELOPMENT, AND MARKETING OF
THE AIRCRAFT
=======================================================================
(116-40)
HEARING
BEFORE THE
COMMITTEE ON
TRANSPORTATION AND INFRASTRUCTURE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
OCTOBER 30, 2019
__________
Printed for the use of the
Committee on Transportation and Infrastructure
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online at: https://www.govinfo.gov/committee/house-
transportation?path=/browsecommittee/chamber/house/committee/
transportation
__________
U.S. GOVERNMENT PUBLISHING OFFICE
38-282 PDF WASHINGTON : 2019
--------------------------------------------------------------------------------------
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
PETER A. DeFAZIO, Oregon, Chair
ELEANOR HOLMES NORTON, SAM GRAVES, Missouri
District of Columbia DON YOUNG, Alaska
EDDIE BERNICE JOHNSON, Texas ERIC A. ``RICK'' CRAWFORD,
RICK LARSEN, Washington Arkansas
GRACE F. NAPOLITANO, California BOB GIBBS, Ohio
DANIEL LIPINSKI, Illinois DANIEL WEBSTER, Florida
STEVE COHEN, Tennessee THOMAS MASSIE, Kentucky
ALBIO SIRES, New Jersey MARK MEADOWS, North Carolina
JOHN GARAMENDI, California SCOTT PERRY, Pennsylvania
HENRY C. ``HANK'' JOHNSON, Jr., RODNEY DAVIS, Illinois
Georgia ROB WOODALL, Georgia
ANDRE CARSON, Indiana JOHN KATKO, New York
DINA TITUS, Nevada BRIAN BABIN, Texas
SEAN PATRICK MALONEY, New York GARRET GRAVES, Louisiana
JARED HUFFMAN, California DAVID ROUZER, North Carolina
JULIA BROWNLEY, California MIKE BOST, Illinois
FREDERICA S. WILSON, Florida RANDY K. WEBER, Sr., Texas
DONALD M. PAYNE, Jr., New Jersey DOUG LaMALFA, California
ALAN S. LOWENTHAL, California BRUCE WESTERMAN, Arkansas
MARK DeSAULNIER, California LLOYD SMUCKER, Pennsylvania
STACEY E. PLASKETT, Virgin Islands PAUL MITCHELL, Michigan
STEPHEN F. LYNCH, Massachusetts BRIAN J. MAST, Florida
SALUD O. CARBAJAL, California, Vice MIKE GALLAGHER, Wisconsin
Chair GARY J. PALMER, Alabama
ANTHONY G. BROWN, Maryland BRIAN K. FITZPATRICK, Pennsylvania
ADRIANO ESPAILLAT, New York JENNIFFER GONZALEZ-COLON,
TOM MALINOWSKI, New Jersey Puerto Rico
GREG STANTON, Arizona TROY BALDERSON, Ohio
DEBBIE MUCARSEL-POWELL, Florida ROSS SPANO, Florida
LIZZIE FLETCHER, Texas PETE STAUBER, Minnesota
COLIN Z. ALLRED, Texas CAROL D. MILLER, West Virginia
SHARICE DAVIDS, Kansas GREG PENCE, Indiana
ABBY FINKENAUER, Iowa
JESUS G. ``CHUY'' GARCIA, Illinois
ANTONIO DELGADO, New York
CHRIS PAPPAS, New Hampshire
ANGIE CRAIG, Minnesota
HARLEY ROUDA, California
Vacancy
CONTENTS
Page
STATEMENTS OF MEMBERS OF CONGRESS
Hon. Peter A. DeFazio, a Representative in Congress from the
State of Oregon, and Chair, Committee on Transportation and
Infrastructure:
Opening statement............................................ 1
Prepared statement........................................... 5
Hon. Sam Graves, a Representative in Congress from the State of
Missouri, and Ranking Member, Committee on Transportation and
Infrastructure:
Opening statement............................................ 7
Prepared statement........................................... 10
Hon. Rick Larsen, a Representative in Congress from the State of
Washington, and Chair, Subcommittee on Aviation:
Opening statement............................................ 12
Prepared statement........................................... 12
Hon. Garret Graves, a Representative in Congress from the State
of Louisiana, and Ranking Member, Subcommittee on Aviation:
Opening statement............................................ 13
Prepared statement........................................... 14
Hon. Eddie Bernice Johnson, a Representative in Congress from the
State of Texas, prepared statement............................. 32
WITNESSES
Dennis Muilenburg, President and Chief Executive Officer, The
Boeing Company; accompanied by John Hamilton, Chief Engineer,
Boeing Commercial Airplanes:
Oral statement............................................... 15
Prepared statement........................................... 17
SUBMISSIONS FOR THE RECORD
Slides Submitted for the Record by Hon. DeFazio:
Slide based on Boeing's MCAS ``Preliminary Design Decision
Memo,'' Nov. 8, 2012
Slide based on Boeing's MCAS ``Coordination Sheet,'' June 11,
2018, No. 1................................................ 22
Slide based on Boeing internal email from Aero-Stability and
Control group employee, Dec. 17, 2015...................... 23
Slide based on Boeing's ``737 MAX Software Update'' Webpage.. 24
Slide based on Boeing's ``737 MAX, 777X, and 787-9 Executive
Review,'' March 4, 2014, No. 1............................. 40
Slide based on Boeing's ``737 MAX, 777X, and 787-9 Executive
Review,'' March 4, 2014, No. 2
Two (2) slides based on Boeing PowerPoint presentation to FAA
on Dec. 17, 2018........................................... 77
Slide based on Boeing's MCAS ``Coordination Sheet,'' June 11,
2018, No. 2................................................ 79
Two (2) slides based on Boeing's ``737 MAX Training''
brochure, July 20, 2017.................................... 87
Slide based on Boeing internal email, ``Subject: MAX
Differences Training approved at Level B!!!!!'' Aug. 16,
2016....................................................... 88
Slide based on Boeing email, from Mark Forkner to individual
at FAA, Nov. 3, 2016....................................... 89
Slide based on undated Boeing PowerPoint presentation from a
Boeing manager at Boeing's Commercial Airplanes division,
No. 1...................................................... 100
Slide based on undated Boeing PowerPoint presentation from a
Boeing manager at Boeing's Commercial Airplanes division,
No. 2...................................................... 101
Slide based on Boeing's ``Flight Crew Operations Manual'' for
Lion Air, Aug. 16, 2018, No. 1............................. 109
Slide based on Boeing's ``Flight Crew Operations Manual'' for
Lion Air, Aug. 16, 2018, No. 2............................. 110
``Final Aircraft Accident Investigation Report
KNKT.18.10.35.04,'' Submitted for the Record by Hon. Crawford.. 31
Article entitled, ``FAA Discovers New Safety Concern During
Boeing 737 MAX Test,'' Submitted for the Record by Hon.
Mucarsel-Powell................................................ 83
Flight Crew Operations Manual Bulletin for The Boeing Company,
No. TBC-19, Issued Nov. 6, 2018, Submitted for the Record by
Hon. Plaskett.................................................. 95
List A, Submitted for the Record by Hon. DeFazio:
MCAS Preliminary Design Memo--TBC-T&I 010920 (p.1), 010926
(p.7)...................................................... 119
AOA Sensor email string--TBC-T&I 10584-10586................. 121
Slide presentation to Ethiopian Air--TBC-T&I 001999-002000;
002018..................................................... 124
Email string on Level B Training Intent--TBC-T&I 048705,
048706, 048707, 048708..................................... 127
PowerPoint on Training Marketing--TBC-T&I 000588 (p.1),
000597 (p. 10)............................................. 131
FAA Letter of Dec. 13, 2018--TBC-T&I 297016.................. 133
Boeing Letter of Jan. 30, 2019--TBC-T&I 29017-297018......... 134
FAA Letter of March 1, 2019--TBC-T&I 297019-297020........... 136
Email on Level B Training--TBC-T&I 010892-010894............. 138
FAA Memo of June 30, 2017, from Transport Airplane
Directorate to Aircraft Certification Service (AIR)
Voluntary Safety Oversight Board........................... 141
Boeing presentation of Nov. 2016, ``Undue Pressure: Key
Learnings and Next Steps''................................. 144
Letter of Feb. 22, 2019, from FAA Aircraft Certification
Service to Boeing.......................................... 152
Letter of March 1, 2019, from FAA Aircraft Certification
Service to Boeing.......................................... 157
List B, Submitted for the Record by Hon. DeFazio:
Coordination Sheet--Revision D--TBC-T&I 029160-029166........ 159
Coordination Sheet--Revision G--TBC-T&I 030584-030592........ 166
Flight Crew Operations Manual--TBC-T&I -050498; -050514; -
051408..................................................... 175
MCAS Development and Certification Overview--TBC-T&I 130073-
130074; 130075-130117...................................... 178
Presentation on Stall Characteristics--TBC-T&I 033941-033942,
033944-033945, and 033947.................................. 202
Transmittal Letter and Revision O of Certification Plan--TBC-
T&I 371200-371201, TBC-T&I 371202 (p.1), 321228 (p. 27),
371503 (p. 302)............................................ 207
Presentation to EASA--TBC-T&I 371753, 371755, 371758, 371767,
and 371768................................................. 212
Flight Test Certification Report--TBC-T&I 055903-055914...... 215
Email chain and memo on promise of No Simulator training--
FAA-DeFazio 32883-32890.................................... 227
FAA memo of March 10, 2014, on rudder cable--FAA-T&I 30223-
30228...................................................... 235
Issue Paper of March 21, 2016, on rudder cable--FAA-DeFazio
28872-28888................................................ 241
Safety Review Program Findings and Recommendations--FAA-
DeFazio 28922-28937........................................ 258
APPENDIX
Questions from Hon. Peter A. DeFazio for Mr. Muilenburg.......... 275
Questions from Hon. Rick Larsen for Mr. Muilenburg............... 280
Questions from Hon. Salud O. Carbajal for Mr. Muilenburg......... 280
Questions from Hon. Sharice Davids for Mr. Muilenburg............ 281
Questions from Hon. Sam Graves of Missouri for Mr. Muilenburg.... 281
Questions from Hon. Garret Graves of Louisiana for Mr. Muilenburg 282
Questions from Hon. Brian Babin for Mr. Muilenburg............... 287
Questions from Hon. Jenniffer Gonzalez-Colon for Mr. Muilenburg.. 288
THE BOEING 737 MAX: EXAMINING THE DESIGN, DEVELOPMENT, AND MARKETING OF
THE AIRCRAFT
----------
WEDNESDAY, OCTOBER 30, 2019
House of Representatives,
Committee on Transportation and Infrastructure,
Washington, DC.
The committee met, pursuant to notice, at 10:05 a.m. in
room 2167, Rayburn House Office Building, Hon. Peter A. DeFazio
(Chairman of the committee) presiding.
Mr. DeFazio. The Committee on Transportation and
Infrastructure will come to order.
I ask unanimous consent that the chair be authorized to
declare recesses during today's hearing.
Without objection, so ordered.
I also ask unanimous consent that the chair and ranking
member of the full committee be recognized for 10 minutes each
during the first round of questions.
Without objection, so ordered.
Before I begin I want to explain an administrative matter
regarding some of the documents we may use in today's hearing,
and that will be entered into the record. I will be making two
unanimous consent requests in reference to two documents, list
A and list B.
First, the documents contained on list B are marked
``export control.'' We have been advised by the House General
Counsel that the Constitution provides ample authority for us
to release these documents and the documents from Boeing.
Boeing's attorneys agreed to the release of these documents. I
see nothing that is export-sensitive in these documents. The
FAA stamped every document they sent us as ``export control.''
However, to prevent confusion with regards to documents
with ``export control'' markings on them, I will be making a
unanimous consent request regarding the release of these
documents, pursuant to the Export Control Act.
Second, I will be making a unanimous consent request to
enter the documents on list A into the hearing record. This
list includes the export control documents on list B, as well
as additional documents. The ranking member's staff is aware of
all these, and has reviewed all these documents that are on
both lists.
And with that I ask unanimous consent that the documents on
list B be disclosed pursuant to 50 U.S. Code, section----
Mr. Graves of Missouri. Mr. Chairman?
Mr. DeFazio. Yes?
Mr. Graves of Missouri. I want to reserve my right to
object at this point.
Mr. DeFazio. The gentleman is recognized.
Mr. Graves of Missouri. The reason for doing that is we
have had two--at least two, that I can remember--hearings
noting Chinese infiltration of American industries, and that
includes rail, maritime, transit, you name it, and they would
love to have the opportunity to get their hands on technology
from the aviation industry, as well. And it concerns me in a
big way.
We have talked about this and gone over this. These
documents have all been made available to everybody on the
committee. Making these documents available to the public, or
putting them out there in the public domain, I think, is a real
problem. I do. And I think we are cutting ourselves off at the
legs when it comes to that technology. It concerns me. It
concerns me in a big way, and I really want us to think about
that, moving forward.
Having said that, I will withdraw my right to object, and
allow this to move forward, because I do want to get answers. I
think we can get the answers without these, but I do want to
get the answers, so will remove that request.
Mr. DeFazio. Well, I thank the gentleman. And I didn't take
a back seat to anybody in the issues regarding China. I voted
against most-favored-nation status, opposed them going into the
WTO. I have raised concerns for decades about their theft of
U.S. technology, and their unfair trade practices. So I
certainly share the gentleman's concerns.
I have reviewed these documents. I don't think there is
anything in there that will be of any utility to the Chinese.
But in any case, I recognize your concerns. So I just have to
finish reading this list B. It will be disclosed pursuant to 50
United States Code section 4820(h)2(b)2, because withholding
such information is contrary to the national interest.
Without objection, so ordered.
In addition, I ask unanimous consent to enter all the
documents on list A into the hearing record.
Without objection, so ordered.
[The information follows:]
List A and List B, Submitted for the Record by Hon. DeFazio
List A is on pages 119-158. List B is on pages 159-273.
Mr. DeFazio. Let's proceed now to the hearing.
I first want to recognize the families who are here today.
I have met twice with families. I don't know if have met with
all of you who are here today. And I want to convey my utmost
condolences. It is 1 year and 1 day after the Lion Air crash, a
very somber day. We shouldn't have to be here, but we are. And
we are going to get to the bottom of this, and we are going to
fix it, and we are going to see it never happens again.
With that, I would thank the witnesses for being here, Mr.
Muilenburg, Mr. Hamilton, this is the fourth hearing the
committee has held, our first full committee hearing. Given the
extraordinary interest of members of the committee, I felt it
best to do it in full committee. I know that Boeing told us
that they wanted to wait until the airplane was ungrounded, but
I felt it was very important for them to testify before that
happened.
We are here today because 346 people--sons, daughters,
fathers, mothers--died on two MAX aircraft within a 5-month
period. Something went drastically wrong.
As you know, our committee has been conducting a very
robust investigation for a long time. We have never undertaken
an investigation of this magnitude, to the best of my
knowledge, in the history of this committee, which is the
second oldest committee in the United States Congress.
And we have received hundreds of thousands of pages of
documents from Boeing. They have been cooperative in providing
those documents, and agreeing that we could use those documents
in the public hearing. And we have received tens of thousands
of pages from the FAA. We have conducted some interviews with
FAA employees. We have others we wish to interview, and we have
requested to interview Boeing employees, but we are told that
we have to be in line behind the Justice Department. So those
are still forthcoming.
There are a lot of unanswered questions that we need to get
to the bottom of. We know that a new and novel system called
MCAS took these two planes into an uncontrollable attitude
after it repeatedly triggered, having to do with a faulty or
missing sensor. The system was wired to one sensor.
And in May, then-Acting Administrator Elwell sat there, and
I asked him, was MCAS a safety-critical system? He said yes.
Then how could it have been approved to trigger with a single
point of failure? He had no answer to that. How could the FAA
approve it? How could the manufacturer do that? He had no good
answer. We are going to continue to pursue the roots of this
problem.
We do know that at one point, Boeing had planned to inform
pilots about MCAS. In fact, it was in the first version of the
flight manual when it was a relatively benign system. But when
it became a radical system which could trigger a catastrophic
failure, it came out. Some of that was discussed in the Senate
yesterday and it will be discussed here again today,
particularly quoting from Boeing's chief test pilot. And his
instant messages seem inexplicable.
Secondly, we do know that Boeing engineers actually
proposed placing a MCAS annunciator in the cockpit. But again,
that came out in later versions, or in the actual production
version.
And then it wasn't until after Lion Air that Boeing
informed anyone. And still at that point, I think, soft
peddling MCAS, that it was in the plane. I have talked to a lot
of pissed off pilots. They said, ``We were the backup system?
How can we be backup, if we don't know something is going to
take over our plane?'' There is quite a bit of discontent out
in the aviation community about that.
We now know that Boeing and the FAA assume pilots would
appropriately react in 4 seconds. Four seconds. But Boeing had
information, which we will get to a little later in this
hearing, that some pilots might react in 10 seconds or longer.
And, if that happens, the results would be catastrophic, and
result in the loss of the aircraft, as happened twice.
We now know from the very beginning of the plane's
development Boeing was--they had a phone call. The phone call
was, hey, major customer, we are going to buy Airbus. They have
better fuel economy, and the pilots don't need retraining,
which is very expensive and disruptive of our schedules. So
Boeing, from day one, had to meet that. Instead of a clean
sheet airplane, they got the 12th or 13th iteration of the 737
amended type certificate. That meant big engines mounted
forward, flies differently.
Then they had to develop a system to make it fly the same
as the others, so it wouldn't have to go through pilot training
or recertification. And that drove the whole process.
We do know that Boeing offered Southwest Airlines $1
million per plane rebate if the pilots had to be retrained.
Imagine what the pressures were from the top on down to mid-
level, low-level engineers. You are saying, ``What? No, no, no.
Can't have that. It has cost us a million bucks a plane, $300
million for that one contract.'' Maybe other contracts had the
same provision. Cost us our marketing advantage. Slow things
down.
And then, there has been a lack of candor all through this.
Boeing learned that the AOA, angle-of-attack, disagree light,
which was a standard feature on all Boeing 737s, did not work
on this plane, unless someone bought the upgraded package. We
were told that was an inadvertent software error in developing
the upgraded package, but--that may be so.
But Boeing decided to delay the fix for 3 years, until
2020. They didn't tell the FAA, they didn't tell the customers,
and they didn't tell the pilots about this until after the Lion
Air crash. That is inexplicable. They say, ``Well, it is not
necessary for safe operation of the MAX,'' but keeping
everybody in the dark and having that--there it is, it is
there, it is right in front of the pilot, it is not lighting
up. Well, it can't light up, even if there is disagreement.
And it was included in the flight manual, unlike MCAS. Wow.
So you include something in the manual that doesn't work, but
something that is going to work and potentially cause
catastrophic issues is not in the manual. What was that all
about?
We know there was the tremendous pressure on production.
Boeing whistleblowers have contacted us regarding features
engineers wanted to put on the MAX, but were denied because of
the rush to get this plane out the door and compete.
We have from an internal whistleblower a survey conducted
November 2016 that 39 percent of Boeing employees surveyed,
they experienced undue pressure. Twenty-nine percent said they
were concerned about consequences. Consequences? You might lose
your job, I guess, if they reported these incidents.
We now know at least one case where a Boeing manager
implored then-vice president, the general manager of the 737
program, to shut down the 737 MAX production line because of
safety concerns several months before the first tragic Lion Air
crash.
There is a lot we don't know. We don't know what would
happen if a different path had been followed here, exactly.
We don't know, if these pilots had had simulator training
that replicated this system, what would have happened.
We don't know why Boeing designed a plane with a safety
critical system assigned to a single point of failure.
Inexplicable, inexcusable. And, as far as I know, unprecedented
in the history of passenger aviation production.
We do know, and we have seen that pressures from Wall
Street, market forces, have a way of influencing the decisions
of the best companies in the worst way, endangering the public,
jeopardizing the good work of countless, countless hardworking
employees on the factory lines. And I hope that is not the
story that is ultimately going to be written about this long-
admired company.
So we need today, Mr. Muilenburg, Mr. Hamilton, we need
answers. But we also know that we need reforms on how
commercial aircraft are certified, and how manufacturers--not
just Boeing, all--are watched and overseen by the regulators.
This hearing today and investigation is not just about getting
answers to our questions, but how to make the system safer and
prevent future tragedies.
[Mr. DeFazio's prepared statement follows:]
Prepared Statement of Hon. Peter A. DeFazio, a Representative in
Congress from the State of Oregon, and Chairman, Committee on
Transportation and Infrastructure
Thank you, Mr. Muilenburg and Mr. Hamilton, for being at today's
hearing, ``The Boeing 737 MAX: Examining the Design, Development, and
Marketing of the Aircraft.'' This is the fourth hearing our committee
has held on the 737 MAX since May, but the first full committee hearing
on this subject.
I know Boeing wanted to wait to testify until after the airplane
was ungrounded, but I thought it was important you appear before our
committee before the MAX returned to service.
You are here today because 346 people--sons, daughters, fathers,
and mothers--died on two Boeing 737 MAX aircraft in the span of 5
months. If you need a reminder of the lives that have been devastated
by these tragedies, you can look to the family members of those on Lion
Air flight 610 and Ethiopian Airlines flight 302 who are sitting to
your left. Their lives have been forever changed as a result of these
two crashes, crashes that could have been avoided.
Something went drastically wrong, a total of 346 people died, and
we have a duty to fix it.
As you know, our committee has been conducting a robust
investigation of the design, development, and certification of Boeing's
737 MAX since March. In fact, our investigation is the most extensive
and important investigation this committee has undertaken during my
time on the committee.
Over the last several months, we have received hundreds of
thousands of pages of documents from Boeing and others, and our staff
is continuing to review those records. Our investigation is not
complete, and we will continue to investigate these issues until we
have clear answers to our questions. The family members of those who
died, many of whom are here today, deserve answers too.
There are areas we are exploring that remain murky, and we need to
bring clarity to those issues. But there is a lot we have learned over
the past 7 months, and we expect you to answer a number of questions to
improve our understanding of what happened and why.
mcas
We now know that a single point of failure triggered a novel flight
control system that put these two flights into unrecoverable dives. As
a result of this single point of failure--the angle-of-attack sensor--
the maneuvering characteristics augmentation system (MCAS) led to
repeated and continuous nose-down trim commands in both accidents, and
the chain of events that followed and ultimately led to both aircraft
impacting water or terrain.
We now know that at one point Boeing had planned to inform pilots
about MCAS in their flight manuals, but then reversed course and
removed virtually every reference of MCAS from the pilot operating and
training manuals. As if it never existed.
We now know that Boeing engineers proposed placing an MCAS
annunciator inside the cockpit itself, but that initial decision failed
to materialize in the final versions of the 737 MAX. It was not until
after Lion Air flight 610 plunged into the waters off the coast of
Indonesia 1 year ago that pilots even became aware of MCAS and its
capabilities. Even after these accidents, Boeing attempted to downplay
MCAS and its abilities although they knew that a malfunctioning MCAS
could lead to catastrophe in certain circumstances
We now know that while Boeing and the Federal Aviation
Administration (FAA) assumed pilots would appropriately react to an
MCAS malfunction resulting in stabilizer trim run-away within 4
seconds, Boeing had information that some pilots might react in 10
seconds or longer, and that if that happened, the results would be
catastrophic, resulting in the loss of the aircraft.
pilot training
We now know that from the very beginning of the plane's
development, Boeing touted the limited training required for pilots to
switch from flying the older 737 NG to the new 737 MAX--known as
``differences'' training. Why is that important? Well, limiting pilot
training translated into key marketing incentives to sell the MAX to
airlines--it would not only save airlines money on training for their
pilots, it would help get the plane approved and to market faster.
We now know that Boeing offered Southwest Airlines a rebate of $1
million per airplane if pilots ended up needing simulator training in
order to fly the 737 MAX. By the time of the Lion Air crash, Southwest
had already ordered nearly 300 of the aircraft. Failure to ensure the
FAA provided Level B, or nonsimulator, training would have cost Boeing
hundreds of millions of dollars and given its competitor an advantage.
lack of candor
We now know that in August 2017, Boeing learned that the angle-of-
attack (AOA) disagree alert--a standard, standalone feature on all 737
MAX aircraft that indicates to pilots when the readings from the left
and right AOA sensors disagree--did not work on aircraft unless they
also purchased an optional AOA indicator feature. Despite becoming
aware of this issue, Boeing decided to delay a fix for 3 years--until
2020--failing to inform the FAA, its airline customers, and 737 MAX
pilots about this flaw until after the Lion Air crash.
Even if the AOA disagree alert is not necessary for safe operation
of the MAX, as Boeing states, the company kept everyone, including
regulators, in the dark regarding its inoperability for more than a
year. And during this time, Boeing continued delivering new aircraft to
customers with nonfunctioning AOA disagree alerts and did not inform
airlines or pilots the alerts were not functioning. In fact, the AOA
disagree alert was included in the 737 MAX flight crew operating
manual, including the one provided to Lion Air in August 2018. The
actual fix was relatively simple and a software update could have been
done quickly, but it wasn't, and it is still unclear why.
undue pressure
We now know that at least one internal Boeing whistleblower said
Boeing sacrificed safety for cost savings on some features that
engineers intended to deploy on the MAX during the development process.
We now know from an internal Boeing survey conducted in November
2016, provided to the committee from a whistleblower, that 39 percent
of those Boeing employees surveyed said they experienced undue pressure
and 29 percent said they were concerned about ``consequences'' if they
reported these incidents.
We now know of at least one case where a Boeing manager implored
the then-Vice President and General Manager of the 737 program to shut
down the 737 MAX production line because of safety concerns, several
months before the Lion Air crash in October 2018.
unanswered questions
But there is still a lot that we don't know. We don't know what the
results would have been if different actions were taken. We don't know
what would have happened if more information was shared with the FAA.
We don't know what would have happened if the pilots of these two
doomed 737 MAX aircraft had been required to undergo simulator training
prior to flying the MAX.
We are still unclear about why Boeing designed the 737 MAX to rely
on a single point of failure that the company knew could potentially be
catastrophic. This was inexplicable and inexcusable. We may never know
what key steps could have been taken that would have altered the fate
of those flights, but we do know that a variety of decisions could have
made those planes safer and perhaps saved the lives of those on board.
Mr. Muilenburg, I've worked on consumer and aviation safety issues
for a long time, in this very room in fact. And I have seen how
pressures from Wall Street have a way of influencing the decisions of
the best companies in the worst way, endangering the public and
jeopardizing the good work of countless workers on the factory lines. I
hope that's not the story that will be written about your long-admired
company.
So we need answers from you today, Mr. Muilenburg, but more
importantly, I believe the 737 MAX accidents show that we need reforms
in how commercial aircraft are certified and how manufacturers, like
Boeing, are watched and overseen by the regulator. Our investigation
and this hearing are not just about getting answers to our questions,
but about making the aviation system safer, for all who travel, and
ensuring tragedies like those in Indonesia and Ethiopia never happen
again.
Mr. DeFazio. With that, I yield time to the ranking member.
Mr. Graves of Missouri. Thank you, Mr. Chairman, for
holding this hearing.
I do want to extend my condolences to the families and
friends of the accident victims. I can't imagine how hard it is
to you to sit and go through this process.
I am going to divert from my statement for just a minute
and associate myself with a couple of comments that the
chairman made. And I, too, as a pilot, having a piece of
equipment in an airplane that I don't know about is something
that concerns me in a big way. And that comment about pilots
saying, ``What, we are the backup system,'' it does concern me.
But I do want to point out, though, as well, when it comes
to Airbus--because it was mentioned, too, that there were
customers that wanted to look at Airbus as opposed to the
Boeing product, but in an Airbus aircraft the pilot is the
backup system. You can't shut it off.
The same--similar system, I should say, very similar system
in an Airbus that is in a Boeing MAX, MCAS, you can't shut it
off. It overrides the pilot. Overrides the pilot, whereas MCAS
can be shut off, and that is one of the things about, you know,
when it comes to being a pilot, you want to be able to shut a
system off that has failed, and be able to fly the airplane.
And that is what I have harped on and harped on over and over
and over again.
And it is my hope that Mr. Muilenburg's testimony today is
going to help us understand the decisions that Boeing made
between 2009 and 2017 regarding the design and certification of
the 737 MAX. Some of those decisions were reviewed and approved
by the Boeing Organization Designation Authorization, or the
ODA. We keep using that term, obviously. It is on behalf of the
FAA. And while the Boeing ODA was authorized to act for the
FAA, as the regulator of the FAA, they retain the ultimate
responsibility for overseeing the compliance with all safety
regulations. It still lies within the FAA.
And I know the chairman said we have still got a lot of
other people to hear from. We are hearing from the Boeing
leadership today. At the time of these decisions, to get a
complete picture, I would like to hear from the FAA officials
that were there at the time, between 2012 and 2017, when these
decisions were being made. And I hope that I can get a
commitment--and I am sure you don't have any problem with
that--to do that.
Mr. DeFazio. I commit that we will be hearing from FAA.
Mr. Graves of Missouri. Because we have got to hear from
everybody. That is the bottom line. I have said before, many
times, the various investigations, they reveal problems.
If these investigations reveal problems with certification,
then I think Congress should act to fix those specific and
identifiable problems. That is going to be the issue,
identifying what those problems are.
But in the aftermath of these accidents, we can't address
safety of the aviation system by focusing on one single factor.
And there is never one single factor that contributes to an
accident. I have heard safety experts refer to the swiss cheese
model of accident causation. In this model, if you use this
model, you have layers, many layers of accident protection that
are visual. If you visualize them as slices of cheese with
holes that represent the weaknesses, some of those weaknesses
are due to conditions. Others are due to active failures.
But when an accident occurs, when all of those holes of
weaknesses, when they line up, that is when you have a
catastrophic failure. And in the context of the 737 MAX, we
have to consider all of those layers, all of them, when it
comes to the protection and safety, when we try to determine
what weaknesses are out there, and try to figure out what those
weaknesses are.
So, as an investigator, the Indonesian Government said
about the Lion Air accident--and I quote--``If one of those
nine contributing factors did not happen, the crash would not
have happened.'' One particular layer, the design and
certification of the 737 MAX, that is the focus of a number of
investigations.
And earlier this year Boeing took responsibility for the
MCAS design weaknesses, and they have been working on a
software fix which we are waiting to hear about.
But other weaknesses, Boeing, with the FAA's oversight--we
are going to address--they include pilot displays, operation
manuals, crew training. Today we are going to hear about the
status of all of those efforts.
But I want to hear about how these efforts line up with the
recommendations of the Joint Authorities Technical Review, or
the JATR. The first completed review of the MAX certification
by individuals with vast aviation and technical expertise is
due out--is obviously due soon.
But while the JATR didn't call for an end to the FAA's
delegation programs, it did highlight some bureaucratic
efficiencies in the relationship between Boeing and the FAA,
and we have to address those. And I know we will.
The FAA concurred with the JATR's report, and is committed
to working on these recommendations, which is good. We,
obviously, have to have oversight to make sure that that
happens.
But lastly, Mr. Muilenburg, I want to hear about recently
shared documents relating to Boeing's former chief technical
pilot for the 737. And I am sure you are going to do that.
But other investigations are moving forward, as well. Last
month the National Transportation Safety Board, they issued a
recommendation report which largely focused on the assumptions
that were made during the design and certification process
related to human factors. Design and certification cannot be
the sole focus of our efforts, and I have said this before.
That is only one layer of that cheese model that I talked
about.
In the last few months other weaknesses that appear to have
played a role in these accidents have surfaced. Reports earlier
this month called into question evidence submitted to the Lion
Air investigation, which related to the installation,
calibration, and testing of the faulty angle-of-attack sensor.
There has also been whistleblower statements and other
reports raising significant concerns with the Lion Air and
Ethiopian Airlines operation and maintenance programs.
The former chief engineer for Ethiopian Airlines filed a
whistleblower complaint alleging significant problems with that
airline's maintenance, training, and recordkeeping.
He also alleges that the air carrier went into the
maintenance records of the 737 MAX a day after the accident.
And, unfortunately, operational pressures and lack of
robust safety culture can negatively impact aviation safety.
That is another layer of that model that I talked about. The
NTSB has confirmed that, along with certification, operational
factors are going to be the focus of its accident
investigations.
In addition, along with its own MAX certification review,
the Department of Transportation--their IG, their inspector
general, at the request of the committee's leadership--is soon
going to begin a review of the international training standards
in the impact of automation, which is another thing that I have
talked about as a potential problem.
But I want to be crystal clear in reviewing these areas,
that this is not an effort to blame the pilots, and I don't
blame the pilots, and I don't absolve Boeing of its
responsibility.
But a September New York Times magazine article described
the changing nature of the airline industry, and the impact it
is having on airmanship. And the article refers to a decade-
long transformation of the entire business of flying, in which
airplanes became so automated and accidents so rare that a
cheap air travel boom was able to take root around the world.
And this boom in air travel resulted in the need for more and
more pilots. But the pool of experienced pilots couldn't keep
up.
I remember getting letters from airlines all over the
world, just simply because I had ATP on my license, getting
letters, offering me jobs to quit what I was doing and come fly
for them.
But I will continue to repeat this. Pilots can master
cockpit technology. But when the technology fails, they have to
be able to fly the plane, not just fly the computer. And to be
clear, none of this is a reflection on Lion Air or Ethiopia's
pilots' professionalism or character. They were fighting for
their lives. That is the bottom line.
But instead, it is a reflection on the broader pressures
that are present today in the global aviation economy. And it
is incumbent on the airline whose name is on the side of that
airplane to ensure that their pilots are properly trained to
the level that they need to be, and not rushed into the
cockpits to meet those demands.
That is where some of this blame lies, in Ethiopia in
particular. The Government owns the airline, and they put
pilots in there that--something above their head. It is not the
pilot's fault. You have to look at who put them in that
position to be responsible for hundreds of lives.
So in line with that swiss cheese model and other layers of
protection, such as pilot actions, airline operations,
maintenance, training programs, they must also be explored, and
all of those weaknesses have to be addressed.
And I still believe that the FAA remains the gold standard
in aviation safety. And once the agency certifies the fixes to
the MAX, I will gladly volunteer to be the very first person,
right alongside Administrator Dickson, in the very first flight
of the MAX 8.
In regard to the two 737 MAX accidents, I think all of
those issues need to be addressed, but only after we have had
the benefit of various investigative work that has yet to be
completed. Jumping to conclusions before that work is done only
risks more harm than good.
The bottom line is the U.S. safety record speaks for
itself. And I will stand up to anybody that tries to question
that. The FAA's proven system has made air travel the safest
mode of transportation in history.
And with that, I appreciate the opportunity and the
deference, Mr. Chairman. And I look forward to today's hearing,
and yield back anything I have left.
[Mr. Graves of Missouri's prepared statement follows:]
Prepared Statement of Hon. Sam Graves, a Representative in Congress
from the State of Missouri, and Ranking Member, Committee on
Transportation and Infrastructure
Thank you, Mr. Chairman. I want to extend my condolences to the
families and friends of the accident victims.
It is my hope that Mr. Muilenberg's testimony today will help us
understand decisions Boeing made between 2009 and 2017 regarding the
design and certification of the 737 MAX. For example, as a pilot, I
would also be concerned about having a piece of equipment or software
in my cockpit that I didn't know about.
Some of Boeing's decisions were reviewed and approved by the Boeing
Organization Designation Authorization, or ODA, Office on behalf of the
FAA. While the Boeing ODA was authorized to act for the FAA, as the
regulator the FAA retained ultimate responsibility for overseeing
compliance with safety regulations.
Mr. Chairman, today we are hearing from Boeing leadership involved
at the time of these decisions, but to get a complete picture I hope I
can get your commitment to hold a committee hearing in the near future
to receive testimony from the FAA officials in charge between 2012 and
2017 when decisions related to the 737 MAX certification were made and
approvals granted.
As I've said before, if the various investigations reveal problems
with the certification, Congress should act to fix those specific,
identifiable problems. But, in the aftermath of these accidents, we
can't address the safety of the aviation system by focusing on a single
possible cause.
Safety experts often refer to the ``Swiss Cheese Model of Accident
Causation.'' In this model, layers of accident protection are
visualized as slices of cheese, with holes representing weaknesses.
Some weaknesses are due to existing conditions, and others are due to
active failures. An accident occurs when holes or weaknesses in the
many layers all line up.
In the context of the 737 MAX, we must consider all layers of
protection and address all weaknesses discovered. As an investigator
for the Indonesian Government said about the Lion Air accident, ``If
one of the nine contributing factors did not happen, the crash would
not have happened.''
One particular layer--the design and certification of the 737 MAX--
is the focus of a number of investigations. Earlier this year, Boeing
took responsibility for MCAS design weaknesses and has been working on
a software fix. Other weaknesses Boeing, with the FAA's oversight, will
address include pilot displays, operation manuals, and crew training.
Today, I look forward to hearing about the status of those efforts.
I also want to hear about how these efforts line up with the
recommendations of the Joint Authorities Technical Review (JATR)--the
first completed review of the MAX's certification by individuals with
vast aviation and technical expertise.
While the JATR did not call for an end to the FAA's delegation
programs, it did highlight ``bureaucratic inefficiencies'' in the
relationship between Boeing and the FAA. The FAA concurred with the
JATR's report and has committed to working on the recommendations.
Lastly, Mr. Muilenburg, I want to hear about recently shared
documents related to Boeing's former Chief Technical Pilot for the 737.
Other investigations are also moving forward, and last month the
National Transportation Safety Board (NTSB) issued a Recommendation
Report, which largely focused on assumptions made during the design and
certification process related to human factors. But, design and
certification cannot be the sole focus of our efforts. That's only one
layer of the cheese.
In the last few months, other weaknesses that appear to have played
a role in the accidents have surfaced.
Reports earlier this month called into question evidence submitted
to the Lion Air investigation related to the installation, calibration,
and testing of a faulty angle-of-attack sensor. There have also been
whistleblower statements and other reports raising significant concerns
with Lion Air and Ethiopian Airlines' operations and maintenance
programs. The former chief engineer for Ethiopian Airlines filed a
whistleblower complaint alleging significant problems with that
airline's maintenance, training, and recordkeeping. He also alleges
that the air carrier went into the maintenance records of the 737 MAX a
day after it crashed.
Unfortunately, operational pressures and lack of a robust safety
culture can negatively impact aviation safety--another layer of the
cheese. The NTSB has confirmed that, along with certification,
operational factors will be a focus of its accident investigations.
In addition, along with its own MAX certification review, the
Department of Transportation Inspector General, at the request of this
committee's leadership, will soon begin a review of international
training standards and the impact of automation.
I want to be crystal clear that reviewing these areas is not an
effort to blame pilots or absolve Boeing of its responsibility.
A September New York Times Magazine article describes the changing
nature of the airline industry and its impact on airmanship. The
article refers to ``a decades-long transformation of the whole business
of flying, in which airplanes became so automated and accidents so rare
that a cheap air-travel boom was able to take root around the world.''
The boom in air travel resulted in a need for more and more pilots, but
the pool of experienced pilots couldn't keep up with demand. In fact,
I've gotten letters from airlines offering me jobs because my license
has an ATP (airline transport pilot) on it.
I'll continue to repeat this: pilots can master cockpit technology,
but when that technology fails, they must be able to fly the plane--not
just fly a computer.
To be clear, none of this is a reflection on the Lion Air and
Ethiopian pilots' professionalism or character. Instead, it's a
reflection on the broader pressures present in today's global aviation
economy.
But it is incumbent on the airline whose name is on the side of
that airplane to ensure their pilots are properly trained and not
rushed into the cockpit to meet those demands.
So, in line with the ``Swiss cheese model,'' other layers of
protection--such as pilot actions, airline operations, maintenance, and
training programs--must also be explored and any weaknesses must be
addressed.
I still believe that the FAA remains the gold standard for safety,
and once the agency certifies the fixes to the MAX, I would gladly
volunteer to be on the first flight alongside Administrator Dickson.
In regard to the two 737 MAX accidents, any issues should be
addressed, but only after we have the benefit of various investigative
work yet to be completed. Jumping to conclusions before that work is
complete risks doing more harm than good.
Bottom line: the safety record speaks for itself--the FAA's proven
system has made air travel the safest mode of transportation in
history.
Mr. DeFazio. I thank the gentleman. I would now turn to the
chairman of the subcommittee, Mr. Larsen.
Mr. Larsen. Thank you, Chair DeFazio. I will be brief,
because I want to get to the reason why we are here today. That
is for questions to, and clear and direct answers from, Boeing.
But yesterday I did release a video opening statement, and
you can find my full comments there.
But in summary I want to say this, that the 346 lives lost
in Lion Air 610 and Ethiopian Airlines 302 crashes are constant
reminders of the importance of this committee's work and what
is at stake if we do not address systemic safety issues in U.S.
aviation today.
Some of the victims' family members are here with us today.
Others are watching the livestream. And your presence and
tireless advocacy are critical to what we are doing today. I
want to thank you for that. You deserve answers, and you
rightfully expect Congress to act.
Following the recent release of recommendations from the
JATR or the NTSB, the Indonesian authorities, and Boeing
itself, though, I do want to say I see one undeniable
conclusion: The process by which the Federal Aviation
Administration evaluates and certifies aircraft is itself in
need of repair.
It is no accident that there are few airplane accidents. It
makes it all the more tragic when there is one. It makes it
even worse when there are two.
So, as the committee's investigation continues, we should
maintain safety as our guiding principle, and use all the tools
at our disposal to ensure the safety of the traveling public.
With that I yield back.
[Mr. Larsen's prepared statement follows:]
Prepared Statement of Hon. Rick Larsen, a Representative in Congress
from the State of Washington, and Chairman, Subcommittee on Aviation
Thank you, Chair DeFazio.
I will be brief, because I want to get to the reason why we are all
here: for questions to and clear, direct answers from Boeing.
Yesterday, I released a video opening statement, where you can find
my full comments.
The 346 lives lost in the Lion Air 610 and Ethiopian Airlines 302
crashes are constant reminders of the importance of this committee's
work and what is at stake if we do not address the systemic safety
issues in U.S. aviation today.
Some of the victims' family members are with us today and others
are watching the livestream. Your presence and tireless advocacy are
essential to our process.
You deserve answers and rightfully expect Congress to act.
Following the recent release of recommendations from the JATR,
NTSB, Indonesian authorities and Boeing itself, I see one undeniable
conclusion: The process by which the Federal Aviation Administration
evaluates and certifies aircraft is itself in need of repair.
As the committee's investigation continues, we will maintain safety
as our guiding principle and use all the tools at our disposal to
ensure the safety of the traveling public.
Thank you.
Mr. DeFazio. I thank the gentleman. I now turn to the
ranking member on the Subcommittee on Aviation, Mr. Graves from
Louisiana.
Mr. Graves of Louisiana. Thank you, Mr. Chairman, and thank
you for holding this hearing today.
Yesterday was 1 year since the Lion Air tragedy. And I,
too, want to join everyone sitting up here in offering our
condolences to all of the Ethiopian family victims, the
Indonesian family victims.
Here we are in Washington. And everybody in this town--
everybody, nearly, in this town, you sit up here and you are
dealing with billions and trillions of dollars and all these
crazy acronyms and processes, and none of it often makes sense,
or fits the common sense test. And oftentimes you see people
that just forget about objectives. Why are we actually doing
this? What is the purpose of this whole process that we go
through, the regulations, the procedures? Why?
And at the end, it is always about people. That is what we
are here for. We are here for people, for fellow Americans,
fellow citizens. And it is amazing to me, just being here, how
often that is forgotten.
I am sorry to every one of you, and your pictures are
incredibly powerful.
You know, I used to be a rock climbing instructor. And when
we would go out there, we would have somebody's son or
daughter, somebody's brother or sister. And when you are out
there, rock climbing, look, there is no room for error. None.
You lose somebody on a rock, there is no room for error. Air
travel is the same thing.
There is no room for--you can't, ``Oh, we are going to pull
over to the side of the road and see what is going on. I hear a
noise coming out of the engine.'' That is not an option. This
process has got to stay focused on the risks that air travel
poses, the fact that you can't pull over to the side of the
road, that you have got to have redundancies.
And look, there is an awful lot going on right now with all
of the different reports, investigations that are going on, and
I am going to run through those in a minute. But there is an
awful lot going on.
But, for example, if there truly was one AOA sensor that
could potentially engage MCAS, that is not the proper
redundancies. And when you are looking at the risk that is
posed in this case, it is unacceptable. It is unacceptable.
A while back I had the chance to represent the State of
Louisiana in the Deepwater Horizon disaster, and spent a lot of
time with the families there, and spent many days in the court,
listening to testimony. And I do believe, and I think that the
judge found, that there was an inappropriate culture of
focusing on the wrong objectives. And oftentimes people can be
looking at stock prices, or economics, or how many people can
we fit in here, or how fast can this jet travel, or what have
you. I am going to say it again: This is 100 percent about
people.
And I have heard people talk about this whole process and
say that, well, this process was short-circuited. Well, you
know, you can look back, and you can look at the 737-6. -7, -8,
-9, you can look at the A319, A320, A321, the E190, E195, the
C919, and many versions of those aircraft. And you know what?
Every single one of those actually was certified or approved in
a shorter period of time than the MAX. So it is not just about
how long, it is what we actually do during that process.
What are we doing during the process to make sure that this
is a safe aircraft, to make sure that we are not putting folks
at undue risk?
Now, I have heard a lot of people talk about a lot of
different ideas, and solutions, and things that they want to do
as we move forward, and people posing solutions right now. And
certainly we need to extract every single lesson learned that
we can.
But right now--and I somehow ditched my list--right now we
have investigations, the Indonesian authorities, the Ethiopian
authorities, the NTSB, we have the JATR, we have the Technical
Advisory Board, the TAB. We have the Office of Special Counsel
that is working with the whistleblower complaint. We have the
Secretary of Transportation that set up a special committee.
Boeing is doing an internal investigation. We have so many
different investigations that are going on.
One thing that we have got to make sure that we do is focus
on facts. One thing that I have seen in this body in the 4\1/2\
years that I have been here is us responding emotionally to
things, and not responding to facts. And we will go and do
something that may make us feel good, but does not--does not--
actually respond to the facts.
And so, as we move forward--and I am sure I left out some
of the investigations that are ongoing--but as we move forward,
we have got to make sure that we are acting on the facts. And
every single outcome, every single problem that we have
identified, we have got to make sure that we truly base our
solutions on those facts to where this doesn't happen again.
Lastly, Mr. Chairman, the families shared a number of
concerns that I think are right on. And I do want to ask that
Boeing get back to us on these. And it was things like fully
disclosing the MCAS fix before the plane is allowed to fly, if
it is allowed to fly again; fully defining the role of the MCAS
system. All right, all right, I will submit----
Mr. DeFazio. I would suggest----
Mr. Graves of Louisiana. I will.
Mr. DeFazio. You could submit those for the record, or you
could ask during the question period.
Mr. Graves of Louisiana. Thank you. I yield back.
[Mr. Graves of Louisiana's prepared statement follows:]
Prepared Statement of Hon. Garret Graves, a Representative in Congress
from the State of Louisiana, and Ranking Member, Subcommittee on
Aviation
Thank you, Mr. Chairman.
Yesterday was the anniversary of the Lion Air tragedy, and I want
to let the families of those lost in that incident and in the Ethiopian
crash know that I'm keeping their loved ones in mind as I sit here
today.
Here in Washington, we all regularly talk about budgets in the
billions of dollars, and a soup of acronyms, processes, and programs.
Sometimes it can be easy to forget why we're really here--what all
these processes and programs are for. This is about people. That's
truly why we are here, and we can't lose sight of that throughout this
process.
So it's thinking of those we lost that motivates me to ensure that
we, as members of both this committee and of the Congress, are
thoughtful about our role in the aftermath of these incidents.
I'm pleased that Boeing is here today to tell us how the
development of MCAS evolved, and the flaws in that process. We know
from NTSB's preliminary recommendations that certain incorrect
assumptions and incomplete reviews of how multiple systems interact
allowed those flaws to become fatal. We know this from the results of
some of the expert investigative work that has been completed to date.
In air travel, there is no room for error, and that's why it's
critical to have safety redundancies. We are closely reviewing the
results and recommendations from the investigations which have already
wrapped: FAA's Joint Authorities Technical Review (JATR); NTSB's, which
has issued preliminary recommendations; Boeing's internal review, which
yielded recommendations that are already being implemented; and the
Indonesian accident report, released late last week.
It's my hope that the committee will hear from and consider the
findings of the yet-to-be-concluded certification and accident
investigations so that we can make sure we know what went wrong and
leverage those findings and recommendations to ensure something like
this doesn't happen again.
I also hope we hear from FAA officials who were in charge of the
agency when the certification process for this aircraft was conducted
and its type certificate approved. This information will crucially
inform the committee on our next steps.
We certainly need to extract every single lesson learned so far,
but it's critical that we also take into consideration the many ongoing
investigations into these accidents when we have their results: the
Ethiopian accident report, Secretary Chao's special committee, the DOT
Inspector General's reports, and several other international reviews.
It is very important that we wait for these experts to complete
their work and carefully review their findings and recommendations.
Once we have a better understanding of what happened and all the
factors involved, we will ask ourselves: what changes do we need to
make to ensure the highest levels of safety and prevent future
accidents?
As Congress, we have to act on facts--not on emotion--to address
every single problem identified so that this doesn't happen again. But
acting before we know the whole picture is both a disservice to those
we lost and dangerous to those who will fly in the future.
Mr. DeFazio. I thank the gentleman.
With that we will turn to the witness for an opening
statement.
TESTIMONY OF DENNIS MUILENBURG, PRESIDENT AND CHIEF EXECUTIVE
OFFICER, THE BOEING COMPANY; ACCOMPANIED BY JOHN HAMILTON,
CHIEF ENGINEER, BOEING COMMERCIAL AIRPLANES
Mr. Muilenburg. Chairman DeFazio, Ranking Member Graves,
Congressman Larsen, Congressman Graves. Thank you. And to the
whole committee, we appreciate the opportunity to be here
today, and we are going to do our best to answer all of your
questions.
Before we get started, I too would like to acknowledge the
families that are here with us today and, again, wanted to tell
you I am sorry. And I have had the opportunity to talk with
some of you and hear your stories, and we are deeply, deeply
sorry, and we will never forget. And I want you to know that.
And we are committed to making the improvements that we need to
make. We are committed.
And I had the chance to hear some of those stories, and see
the photos, and listen to the personal stories, and it does get
to a business that is about people. And I think Congressman
Graves said it well. That is where our hearts will always be.
And I know all of Boeing, our 150,000 people, feel the same
way, and they think about this every day. We will carry the
memories----
Mr. Lynch. Can you speak a little closer into your
microphone?
Mr. Muilenburg. Yes, sir.
Mr. Lynch. Just so--a little more audible. Thank you.
Mr. DeFazio. Yes, again, just pull it toward you, Mr.
Muilenburg.
Mr. Muilenburg. Is that better? Thank you. Sorry. Please
know that we carry the memories of these accidents with us, and
the loved ones, the memories of them, they will never be
forgotten. And their memories will drive us every day to make
our airplanes safer and make this industry safer. And we are
committed to doing that.
I am grateful to have the opportunity to be here today to
say this to the families personally. And I want to let you all
know that we are dedicated to learning. We are learning. We
still have more to learn. We have work to do to restore the
public's trust, and we will do everything possible to prevent
accidents like this from ever happening again.
Mr. Chairman, I know this committee has many questions
about the MAX, and we will do our best to answer those today.
And while investigations are still underway, we note both
accidents involved the repeated activation of a flight control
software system called MCAS, which we have already talked
about. That system responded to erroneous signals from the
angle-of-attack sensor.
Based on that, we have enhanced MCAS in three ways. First,
it will now compare information from both sensors, instead of
one, before activating. Second, MCAS will only activate a
single time. And third, MCAS will never provide more input than
the pilot can counteract using the control column alone. Pilots
will also continue to have the ability to override MCAS at any
time.
We have brought the best of Boeing to this effort. We have
spent over 100,000 engineering and test hours. We have flown
more than 800 test flights. And we have conducted simulator
sessions with 545 participants from 99 customers and 41 global
regulators. I have flown on a couple of flights myself. This
has taken longer than expected, but we are committed to getting
it right.
During this process we have worked closely with the FAA and
other regulators. We have provided them with documentation, had
them fly the simulators, answered their questions. And
regulators around the world should rigorously scrutinize the
MAX and only approve its return when they are completely
satisfied with its safety. The public deserves nothing less.
Mr. Chairman, today and every day, over 5 million people
will board a Boeing airplane and fly safely to their
destination. Decades of cooperation and innovation by industry
and regulators and the rigorous oversight of this committee
have reduced accidents by more than 95 percent over the last 20
years. But no number other than zero accidents is ever
acceptable. We can and must do better.
We have been challenged and changed by these accidents. We
have made mistakes, and we have learned, and we are still
learning. And we are improving. We established a permanent
aerospace safety committee for our board. We have stood up a
new safety organization, and we strengthened our engineering
organization so that all 50,000 engineers now report up through
Boeing's chief engineer.
We are also helping to rebuild the communities and the
families impacted by these accidents. We have pledged $100
million to this effort. We have hired renowned experts in this
area to ensure families can access these funds as quickly as
possible. No amount of money can bring back what was lost. But
we can at least help the families meet their financial needs.
Mr. Chairman, I started at Boeing more than 30 years ago as
a summer intern in Seattle. I was a junior at Iowa State
University studying engineering, and I had grown up on a farm
in Iowa. My parents taught me the value of hard work and
integrity. I was awestruck to work at the company that brought
the jet age to the world and helped land a person on the moon.
Today I am still inspired by what Boeing does, and by the
remarkable men and women who are committed to continuing its
legacy. But these heartbreaking accidents and the memories of
the 346 lives lost are now a part of that legacy. It is our
solemn duty to learn from them, and we will.
Recently there has been much criticism of Boeing and our
culture. We understand and deserve this scrutiny. But I know
the people of Boeing. They are more than 150,000 of the hardest
working, most dedicated, honest people you will ever meet. And
their commitment to safety, quality, and integrity is
unparalleled, and it is resolute. We will stay true to those
values because we know our work demands it. It demands the
utmost excellence.
So thank you for this opportunity to convey to the world
that we are committed to changing, and to making sure that
accidents like these never happen again.
Mr. Chairman, thank you for listening. And I look forward
to your questions.
[Mr. Muilenburg's prepared statement follows:]
Prepared Statement of Dennis Muilenburg, President and Chief Executive
Officer, The Boeing Company
Chairman DeFazio, Ranking Member Graves, members of the committee:
good morning and thank you for inviting me to be here today.
I'd like to begin by expressing my deepest sympathies to the
families and loved ones of those who were lost in the Lion Air Flight
610 and Ethiopian Airlines Flight 302 accidents, including those who
are here in the room today. I wanted to let you know, on behalf of
myself and all of the men and women of Boeing, how deeply sorry I am.
Please know that we carry the memory of these accidents, and of your
loved ones, with us every day. They will never be forgotten, and these
tragedies will continue to drive us to do everything we can to make our
airplanes and our industry safer.
Mr. Chairman, I know that you and your colleagues have many
questions about the 737 MAX. My colleague John Hamilton, Chief Engineer
for Boeing Commercial Airplanes, and I will do our best today to answer
them. While the Ethiopian Airlines accident is still under
investigation by authorities in Ethiopia, we know that both accidents
involved the repeated activation of a flight control software function
called MCAS, which responded to erroneous signals from a sensor that
measures the airplane's angle of attack.
Based on that information, we have developed robust software
improvements that will, among other things, ensure MCAS cannot be
activated based on signals from a single sensor, and cannot be
activated repeatedly. We are also making additional changes to the 737
MAX's flight control software to eliminate the possibility of even
extremely unlikely risks that are unrelated to the accidents.
We have brought the very best of Boeing to this effort. We've
dedicated all resources necessary to ensure that the improvements to
the 737 MAX are comprehensive and thoroughly tested. That includes
spending over 100,000 engineering and test hours on their development.
We've also flown more than 814 test flights with the updated software
and conducted numerous simulator sessions with 545 participants from 99
customers and 41 global regulators. This process has taken longer than
we originally expected, but we're committed to getting it right, and
return-to-service timing is completely dependent on answering each and
every question from the FAA.
I have flown on two of the demonstration flights myself and seen
first-hand the expertise and professionalism of our teams. Mr.
Chairman, I could not be more confident in our solutions--and I could
not be more grateful to the men and women who have worked so hard to
develop and test these improvements always with safety at the
forefront. When the 737 MAX returns to service, it will be one of the
safest airplanes ever to fly.
During this process we have been working closely with the FAA and
other regulators. We've provided documentation, had them fly the
simulators, and helped them understand our logic and the design for the
new software. All of their questions are being answered. Regulators
around the world should approve the return of the MAX to the skies only
after they have applied the most rigorous scrutiny, and are completely
satisfied as to the plane's safety. The flying public deserves nothing
less.
We know that it's not just regulators that need to be convinced. We
know the grounding of the MAX is hurting our airline customers, their
pilots and flight attendants, and most importantly, the people who fly
on our airplanes. Our airline customers and their pilots have told us
they don't believe we communicated enough about MCAS--and we've heard
them. So we have partnered with customers and pilots from around the
world as we've developed our solutions. We have welcomed and encouraged
their questions and given them opportunities to test those solutions
firsthand in simulators. And subject to regulatory approval, additional
and enhanced training and educational materials will be available for
pilots who fly the MAX.
We have learned and are still learning from these accidents, Mr.
Chairman. We know we made mistakes and got some things wrong. We own
that, and we are fixing them. We have developed improvements to the 737
MAX to ensure that accidents like these never happen again. We also are
learning deeper lessons that will result in improvements in the design
of future airplanes. As painful as it can be, the process of learning
from failure, and even from tragedies like these, has been essential to
the advances in airplane safety since the industry began roughly a
century ago. And it is one of the reasons that travel on a large
commercial airplane is the safest form of transportation in human
history.
Mr. Chairman, this is something we must not lose sight of. Today
and every day, over 5 million people will board a Boeing airplane and
fly safely to their destination. Whether it's their first flight or
their millionth mile, we want it to be a great experience--and most
importantly, a safe one. Decades of work and innovation throughout the
industry, as well as the oversight of the FAA, this committee, and
regulators around the world have reduced the risks of air travel by
more than 95 percent over the last twenty years. But no number, other
than zero accidents, is ever acceptable.
For 103 years, Boeing has been dedicated to making the world a
safer and better place. Our founder, Bill Boeing, established our first
safety council in 1917, the first full year of the company's existence,
beginning a commitment to safety that we have carried forward as a core
value ever since. The engineers who design our airplanes, the
machinists who work in our factories, and the many others who
contribute to the extraordinarily complex work of building and
maintaining commercial airplanes do so with pride and honor. Ensuring
safe and reliable travel is core to who we are. Our customers and the
traveling public, including our own families, friends, and loved ones,
depend on us to keep them safe. That's our promise and our purpose.
But we also know we can and must do better. We have been challenged
and changed by these accidents, and we are improving as a company
because of them. We established a permanent aerospace safety committee
of our Board of Directors; stood up a new Product and Services Safety
organization that will review all aspects of product safety and provide
streamlined reporting and elevation of safety concerns; and
strengthened our Engineering organization by having all engineers in
the company report up through Boeing's chief engineer. We also are
investing in advanced research and development in new safety
technologies and are exploring ways to strengthen not just the safety
of our company but our industry as a whole. We have a shared bond of
safety across the entire aerospace community.
We recognize it is not just our airplanes and our company that
needs to be supported and strengthened. We also must help rebuild the
communities and families affected by these accidents. Our first step
was our pledge of $100 million to them. We hired Ken Feinberg and
Camille Biros, renowned experts in this area, to ensure families can
access this money as quickly as possible. Of course, no amount of money
can bring back what has been lost. But we can at least help families
meet their financial needs. Our people also have donated more than
$750,000 of their own money to these funds--a tremendous example of the
giving spirit our teams consistently display in the communities where
they live and work across the globe.
Mr. Chairman, I've worked at Boeing my entire career. It started
more than 30 years ago when Boeing offered me a job as a summer intern
in Seattle. I was a junior at Iowa State University studying
engineering, having grown up on our family farm in Iowa. It's beautiful
land with rolling hills where my siblings and I milked cows and baled
hay. Our parents taught us the value of hard work, integrity, and
respect for others. Back then, I drove my 1982 Monte Carlo from Iowa to
Boeing's operations in Seattle, crossing the Rocky Mountains for the
first time. I was awestruck at the opportunities I had to work on
projects that mattered at the company that brought the Jet Age to the
world and helped land a person on the moon. I was amazed by the people
of Boeing. Today, I'm still inspired every day by what Boeing does and
by the remarkable men and women who are committed to continuing its
legacy.
These heartbreaking accidents--and the memories of the 346 lives
lost--are now part of that legacy as well. It's our solemn duty to
learn from them and change our company for the better. I can assure you
that we have learned from this and will continue learning. We have
changed from this and will continue changing. The importance of our
work demands it.
In the months since the accidents, there has been much criticism of
Boeing and its culture. We understand and deserve this scrutiny. But I
also know the people of Boeing, the passion we have for our mission,
and what we stand for. There are over 150,000 dedicated men and women
working for Boeing around the world--and their commitment to our
values, including safety, quality, and integrity, is unparalleled and
resolute. No matter what, we will stay true to those values because we
know our work demands the utmost excellence.
Over the last few months, I've had the opportunity to visit many of
our Boeing teams, talk about our safety culture, and gain ideas for how
we can be better still. Last week, I saw our team in San Antonio--made
up of 40 percent veterans--beaming with pride as they support the C-17
fleet for our men and women in uniform. Earlier, I talked with our
people in Philadelphia building Chinook helicopters; in St. Louis
testing F/A-18 Super Hornets; and in Charleston, South Carolina, and El
Segundo, California, connecting the world with the 787 Dreamliner and
advanced satellites. I've also met with our people in Huntsville,
Alabama, and New Orleans, Louisiana, who are building the rocket that
will return humans to the moon and then travel on to Mars and those at
Kennedy Space Center, Florida, who are preparing to launch the CST-100
Starliner that will commercialize space travel. I've spent time also
with our teams in Everett, Washington, who are testing the new 777X
long-range jet and in Renton, Washington, where 12,000 amazing people
pour their hearts into building the 737 MAX. These are the people of
Boeing. I wish you could all meet them. They change the world. They are
Boeing.
I'm here today, honored to serve as the leader of this incredible
team--talented engineers, machinists and all those who design, build
and support our products. I want to answer all of your questions and
convey to the world that we are doing everything in our power to make
our airplanes and our industry safer and prevent an accident like this
from ever happening again.
And, Mr. Chairman, you have my personal commitment that I will do
everything I can to make sure we live up to that promise.
Thank you for listening, and I look forward to your questions.
Mr. DeFazio. I thank the gentleman. As I stated at the
outset, with consultation with the minority, both myself and
Mr. Graves will open with 10 minutes, and then we will move to
other Members for 5 minutes in the usual order.
Mr. Muilenburg, it is clear, obviously, from everything we
know, and the Lion Air report now, that MCAS was a major factor
that contributed. But Boeing's position, at least prior to
these crashes, was it was an autonomous system and it operated
in the background. Is that correct?
Mr. Muilenburg. Mr. Chairman, that was the design approach,
yes.
Mr. DeFazio. Yes. So--but the question is, how do we get to
that?
And we have a slide. You will be able to see it right in
front of you.
Staff?
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. Yes, this was a concept design for the flight
deck in 2012. And, as you can see in the bottom, right-hand
corner, there was an MCAS alert indicator. So at least at some
point some on the engineering and design staff felt it would be
important to make the pilots aware of the system, and to have
an indicator light. Do you agree that that was originally
proposed?
Mr. Muilenburg. Congressman, understand that was part of an
early trade study at that point, and very, very common that
early in the design stage we would evaluate different flight
deck systems.
Mr. DeFazio. OK, thank you. So--but obviously, the final
version did not have that. That light was--I mean there was no
indication, either in the manual or on the flight deck, of the
presence of MCAS.
Mr. Muilenburg. Congressman, John can answer that question.
Mr. Hamilton. Yes, Chairman. The MCAS light issue pointed
out, the intent of it was to signal an MCAS failure. It is
important to note that in these accidents the MCAS system did
not fail.
Mr. DeFazio. Right, it triggered.
Mr. Hamilton. And it would not have lit up.
Mr. DeFazio. So--but it was----
Mr. Hamilton. But the functionality of the MCAS light was
actually--the reason it was deleted was because the
functionality was incorporated into the speed trim fail light,
which----
Mr. DeFazio. Right.
Mr. Hamilton [continuing]. You can see just adjacent to
that.
Mr. DeFazio. Right.
Mr. Hamilton. The MCAS is a----
Mr. DeFazio. OK. Thank you.
Mr. Hamilton [continuing]. Extension of a speed----
Mr. DeFazio. Thank you. Thank you for that. But when it was
a relatively benign system, .6 degrees, it was in the manual.
And then when it went to a repeated 2\1/2\ degrees, it came out
of the manual. Is that correct?
I have seen very early versions of the manual that indicate
that you had MCAS in the manual. Your test pilot asked FAA to
take it out, and it came out.
Mr. Muilenburg. Congressman, if I could try to clarify,
because you are asking questions that span into a couple of
areas, just if I could clarify----
Mr. DeFazio. Well----
Mr. Muilenburg. So there was--the intent--the MCAS
inclusion in the training manual, that was an iterative process
that was occurring in parallel to the extension of MCAS to low-
speed operation, which I believe is what you are referring to.
Mr. DeFazio. Right.
Mr. Muilenburg. So the extension of MCAS to low-speed
operation, that was done and flight tested from a period of
around the middle of 2016----
Mr. DeFazio. Right. Yes, we understand that, and we
understand some of the problems in the way it was tested, and
it wasn't tested with the AOA failure. But that is good for
now.
A key assumption was reaction time. And, with the AOA
failure, the MCAS activates, and it is 2.5 degrees every 10
seconds, pretty radical. And Boeing assumed it would take
pilots 4 seconds to recognize and react to runaway stabilizers,
is that correct?
Mr. Muilenburg. Mr. Chairman, again, this--we do what we
call hazard analysis for the airplane design.
Mr. DeFazio. Four seconds was the assumption.
Mr. Muilenburg. In this particular case that was the
assumption. That is a----
Mr. DeFazio. OK.
Mr. Muilenburg [continuing]. Longstanding industry
assumption for systems like this.
Mr. DeFazio. Right. Lion Air reports--says it took pilots 8
seconds to react. And then we have information provided to the
committee by Boeing, which will now be the second slide.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. And it says there a slow reaction time
scenario, 10 seconds, found the failure to be catastrophic. Do
you think that was clearly--was this document ever clearly
communicated to the regulators, that a 10-second delay, which
doesn't seem like a lot of time to me, particularly when you
look at the NTSB report and the cacophony going on on the
flight deck, and particularly in the case of Lion Air, when
they didn't even know the system existed, did--was the FAA
aware of this, this document?
Mr. Muilenburg. Chairman, I can't speak to this specific
document.
Mr. DeFazio. OK.
Mr. Muilenburg. John may be able to.
But I do think it is important to note that, as part of the
design process, we use a set of industry standard practices on
these timelines. This is a common part of our hazard analysis--
--
Mr. DeFazio. Yes, but you----
Mr. Muilenburg. That was shared with the FAA----
Mr. DeFazio. Right. I understand. And I understand what the
industry standard was. But, I mean, it does cause a little
concern. Ten seconds. I mean, you can say, ``Gee, really good
pilots can do it in less than 10 seconds.'' Pilots aren't at
the top of their game every day, and particularly in the first
iteration, at least, when they weren't even aware of the
system. I think that assumption should have rung some alarm
bells.
Do you think, in retrospect, it was a mistake to not inform
pilots of the existence of the MCAS system?
Mr. Muilenburg. Congressman, a few things on that. And I
agree, we made some mistakes on MCAS. And as we have gone back
and taken a look at this, moving from a single sensor to a dual
sensor feed is an important part of that. Providing additional
training information----
Mr. DeFazio. Right.
Mr. Muilenburg. Which--the feedback we have gotten from the
pilots, as you noted, is part of that. And then revisiting
these decades-long industry standards. I think you see a
similar recommendation out of the----
Mr. DeFazio. Right. Of course----
Mr. Muilenburg. We believe----
Mr. DeFazio. The question would be why was it just
originally wired to one sensor, which--again, single point of
failure. As then-Acting Administrator Elwell said in May, a
safety critical system, that is just not done.
As the NTSB said, multiple alerts and indication can
increase pilots' workload. The combination of the alerts and
indications did not trigger the accident pilots to immediately
perform the runaway stabilizer functions.
OK. Mr. Hamilton, are you aware of any other aircraft out
there that has a safety critical system that is dependent upon
a single point of failure?
Mr. Hamilton. Chairman, single-point failures are allowed
in airplane design. Regulation 25.1309 actually discusses that,
and talks about different hazard categories. And----
Mr. DeFazio. And this one----
Mr. Hamilton. We have----
Mr. DeFazio. This one was deemed to be catastrophic. I know
there are three categories. You didn't deem it to be
catastrophic, although, in looking at the 10 seconds, you said
it was catastrophic. It was classified as major, as I recall.
Mr. Hamilton. Yes, catastrophic is one category. And so
when we test out systems, we do look at their impact on the
airplane when there are failures. And we did look at 10
seconds, but we also then took it into the simulator with
pilots, and the typical reaction time was 4 seconds----
[Slide]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. I put up another document. It is right in
front of you there. And 12-17-2015, I don't know if you are
aware of this, but this was raised by one of your engineers.
``Are we vulnerable to single AOA sensor failures with the MCAS
implementation or is there some checking that occurs?''
Did you ever receive this communication, and did you
respond to that engineer?
Mr. Hamilton. Chairman, I did not actually receive this
communication, but I am aware of the communication recently as
it surfaced. In talking with the engineer, I think it
highlights that our engineers do raise questions in an open
culture. They question things. But it also followed our
thorough process, and was determined that the single sensor,
from a reliability and availability standpoint, met the hazard
category and the safety----
Mr. DeFazio. Well, of course, we don't know what happened
in Ethiopia, but there is some speculation a bird sheared it
off. They are pretty delicate little things out there,
actually. I have seen them.
[Slide]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. And now, of course--a final slide here is now,
as you emphasize, flight control will now compare inputs from
both AOA sensors. And I guess the question is why wasn't it
that way from day one?
Mr. Muilenburg. Mr. Chairman?
Mr. DeFazio. Why wasn't it that way from day one? If you
can do it now, with an extra wire, or a software fix, or
whatever, why didn't you do it from day one? Why not have that
redundancy?
Mr. Muilenburg. Mr. Chairman, we have asked ourselves that
same question over and over. And if back then we knew
everything that we know now, we would have made a different
decision.
The original concept, from a safety standpoint, was to
build the MCAS, extend the current speed trim system on the
previous generation of 737. That is a system that had about 200
million safe flight hours on it. So one of our safety
principles is to take safe systems, and then incrementally
extend them. That was the safety concept behind the original
decision.
Mr. DeFazio. All right. Well, thank you.
Mr. Muilenburg. We learned since then.
Mr. DeFazio. Right.
Mr. Muilenburg. And that is----
Mr. DeFazio. My time----
Mr. Muilenburg [continuing]. When we moved to this new
design.
Mr. DeFazio. Sure. My time has expired, and I want to turn
to the ranking member.
The ranking member, Mr. Graves, is recognized.
Mr. Graves of Missouri. It is hard to know where to start.
Now I want to go back to the--just kind of for
clarification--to that first slide with the MCAS, can we bring
that up?
Mr. DeFazio. Just bring that first slide back up, please,
for Sam, the one that shows the flight deck with the MCAS.
[Slide]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. There.
Mr. Graves of Missouri. The MCAS warning light, to me,
would be--this is, I guess, more of an editorial comment. Have
you ever been in your car and the check engine light comes on?
And we are--``What the heck?'' OK. So what is it? Is it the oil
pressure? Is it the oil temperature? Is it the vacuum? I don't
know what it is. It is just a general check engine.
And the stuff that is more important to me, you know, is
the stuff that is on the left, because MCAS manifests itself as
a trim issue. It is a runaway trim issue, which, again, I go
back to training.
And you have memory items. Every pilot is--I shouldn't say
that--in the United States, pilots are taught to have memory
items. You instantly go through those when you have a failure.
You start through that checklist in your mind. And we have--
some of them are even goofy little rhymes, or whatever, to help
you remember. And you go through each one of these processes.
In the case of Ethiopian Air--I still come back to this,
too--they never retarded the throttles. They set the throttles
for takeoff, and they never pulled them back. They went right
through the maximum certified speed of 736 or 737 MAX 8, right
on through, right up to 500 miles per hour, way beyond the
maximum certified speed. That is the reason they can't manually
trim the airplane, is because it is going so fast.
And I have used that analogy, too. Go down the road at 70
miles an hour. Try opening the door. See if you can open the
door, and see what the pressures are against the door of your
car. The more pressure there is, the faster you are going, the
more pressure there is, and the harder it is to try to reverse
those pressures.
But you go through those memory items, and you immediately
start ticking down. And the chairman is right, in terms of,
what is the average, you know? Is it 4 seconds to react, 10
seconds to react?
And I guess that is one of the flaws that we need to be
thinking about is, I guess we are going to have to start
building airplanes to the least common denominator in terms
of--and that is a poor choice of words, I guess you might say,
but the least common denominator in terms of, internationally,
we have got to start thinking about--if we are going to export,
we are going to have to start thinking about international
training standards.
And I know that is one of the things that is being looked
at, in how they train. Did they have those memory items? Could
they tick them off? Most pilots will sit there, and they will
do it in the shower. You go through your memory items. I do it
all the time in the shower, just sit there and tick through my
memory items on engine failure, trim failure, whatever those
might be.
But I guess we are making assumptions, and the FAA is
making assumptions, manufacturers are making assumptions about
pilot training experience. And in the aftermath of these two
accidents--and I am going to--this question is for Mr.
Muilenburg--do you believe that these assumptions, particularly
for aircraft that are going to be operated outside of the
United States, do we need to revisit those assumptions?
Mr. Muilenburg. Congressman, we believe we need to go take
a look at those longstanding industry assumptions. As you well
point out, those are used across manufacturers, not just
Boeing. And these are things that have produced safe airplanes
for decades. But we do believe that it is appropriate to go
take a hard look at those. We may need to make some revisions.
I think the JATR report has identified the same thing, and
we think that would be a good area for us all to look at on
behalf of aviation safety. We are committed to doing that and
supporting that study.
And one of the areas for the future that we are investing
in is we think about pilot-machine interface, and how to do
that most effectively. And, as you pointed out earlier, a large
generation of new pilots will be needed over the next 20 years,
and we need to be thinking about designing our airplanes for
that next generation.
Mr. Graves of Missouri. With the benefit--and it is always
dangerous to--because hindsight is always 20/20, but knowing
what you know now, would the Boeing Company have done things
differently? Would you have done things differently, in terms
of certification of the 737 Max?
Mr. Muilenburg. Congressman, yes, we would have. We have
learned, as I mentioned earlier, we made some mistakes. We
discovered some things we didn't get right. And we own that. We
are responsible for our airplanes. Any accident with one of our
airplanes is unacceptable. And that is our responsibility. We
own it. We are going to fix it. We know what needs to be done.
And that is where we are focused, going forward.
Mr. Graves of Missouri. I am going to make a comment here,
and this is--it is as a result of this. And the unfortunate
part is we lost life. We lost loved ones, friends, and life was
lost as a result of these accidents. And, you hope that it is
never going to happen again. The unfortunate reality is one of
these days it will happen again.
But I have harped on this, and this is something that
concerns me. And I have talked, too, about the difference in
the United States in pilot training, and pilot training in
other countries. But something that concerns me, and I want
everybody to hear this. In the United States, what I am afraid
of is we are going down the same direction that we are seeing
in other countries when it comes to getting pilots to the point
where they can fly.
No matter what, we can build the most perfect airplane that
is never going to cause a problem, or it is never going to get
itself into a bad situation. And sure enough, sooner or later,
it is going to get into a bad situation, and it is going to
require a pilot to figure out what is wrong, and then to come
back and fly that airplane.
But here in the United States, I think we are dumbing down.
And again, this is a criticism of our system, because this is
what I am afraid we are going to. And I want to think about
this as we move forward, because I think it needs to be
addressed. But in the United States, we taught spin training
and stall training in your basic piloting skills for your
private pilot's license. Before you get commercial, before you
get your airline transport rating, you are taught--or you were
taught--basic stall characteristics and how to get out of a
spin.
Today you can't do that. An instructor is not allowed to
let a stall fully develop. At the first warning--this is what
it states in the book--at the first warning of a stall, they
have to recover or they fail their check ride immediately. That
means if the light comes on, or if the buzzer goes off, they
have to recover immediately. They can't let that stall develop.
So we're teaching them how to--and this is happening in
other countries, because many countries do base their system
off our system, as well, but sooner or later you are going to
get an airplane into a stall. But we are not teaching anybody
how to get out of that stall and how to recognize it. We are
teaching them how to not get into it. Well, that is never going
to happen. Sooner or later, you are going to get into a
problem.
And this concerns me because we have changed. We have
rewritten our--and I have got a problem with the FAA allowing
this, but we have rewritten our instruction manuals to not
allow this to happen, to not allow these items that will
ultimately happen. We aren't teaching pilots how to fix them,
how to correct them, how to get out of them, how to save the
people that are in the plane with them, heaven forbid that
should happen. Again, that is me harping because it concerns
me, and it concerns me in a big way. The United States is
behind other countries in, ultimately, going down that road.
And I think we have to get back to basic piloting.
And there is nothing wrong with technology. I think
technology is great. But the most important safety component in
any airplane is a pilot that can fly the damn plane, and not
just fly the computer.
I think I have got a minute left. Actually, I will just
yield back.
Mr. DeFazio. OK, I thank the gentleman. I now recognize
the--how do we do this, in order of--OK. We do this in order of
seniority and appearance. And so first would be Ms. Norton.
Ms. Norton. Thank you very much, Chairman DeFazio. I can't
say enough about the importance of this hearing.
I appreciate you, Mr. Muilenburg, being here. Ranking
Member Graves asked had you flown--I think you even said in
your testimony that you had flown on the 737 MAX since the
fixes or corrections have been made. That is your testimony?
Mr. Muilenburg. Ma'am, yes. I have flown on a couple of
test flights as part of that----
Ms. Norton. Test flights. I understood those to be test
flights.
But the chairman mentioned that we are trying to get to the
roots of the problem so it doesn't happen again, so the FAA--so
that airlines like Boeing--and so my questions really go to
penalties, whether they have made any difference, penalties
paid or outstanding--essentially, to compliance, so the
Congress can decide what, if anything, it can do. Everybody has
an obligation here. Boeing, to be sure, but so does Congress.
So the record I have--and I ask you, Mr. Muilenburg, did
Boeing enter into a settlement agreement with FAA in an effort
to resolve what were then multiple enforcement cases against
Boeing that were either pending or under investigation? That
was in 2015.
Mr. Muilenburg. Congresswoman, I am not familiar with the
details of that, although I am aware----
Ms. Norton. I simply asked did you enter into settlement
agreements. Surely you know whether you entered into settlement
agreements.
Mr. Muilenburg. John, you----
Ms. Norton. I didn't ask you about the details.
Mr. Hamilton. Congresswoman, that is correct. We did enter
a settlement agreement in 2015.
Ms. Norton. Thank you. Is it also true that Boeing had to
immediately pay $12 million into the U.S. Treasury as a result?
Mr. Hamilton. That is correct.
Ms. Norton. Continuing, is it true that Boeing faced up to
$24 million in additional penalties through 2020, if certain
conditions were not met?
Mr. Hamilton. Yes, Congresswoman. In working with the FAA,
they were really looking for creating a longstanding agreement
with us to build a good foundation on elevating compliance----
Ms. Norton. I am just asking you about the $24 million.
Mr. Hamilton. And----
Ms. Norton. My time is limited--in additional penalties
through 2020 if the conditions were not met.
Mr. Hamilton. There was----
Ms. Norton. Wasn't that the agreement, the understanding?
Mr. Hamilton. There was a--yes, there was a deferred
penalty.
Ms. Norton. Now I am just going to list quickly the
obligations: improve management and accountability, internal
auditing, supplier management, more stringent quality and
timeliness of regulatory submissions, simplify specifications.
I could go on. Surely, you understood that that was the
agreement, those were the agreement.
Yet in designing and developing and manufacturing the 737
MAX, Boeing has run into issues, problems--characterize them as
you will--in meeting the obligations in most of these
categories. Would you agree, Mr. Muilenburg?
Mr. Muilenburg. Congresswoman, we have identified many of
those challenges through the MAX development program, and some
of those are in the areas that----
Ms. Norton. And you have had issues in meeting them. Some
of this has resulted in the problems that bring us here today.
Mr. Muilenburg. Congresswoman, I can't give you any
specific examples that link the two.
I don't know, John, if you have got any----
Ms. Norton. I didn't ask you that.
Mr. Muilenburg [continuing]. Thoughts on that?
Mr. Hamilton. Yes, the--some of these agreements were
agreements that you would make over the course of the 5 years.
Each year we provide a progress report to the FAA on our
progress on that. And there is still----
Ms. Norton. Yes. And so you--I am not saying you are not
making progress. I am saying the issues----
Mr. Hamilton. There are still----
Ms. Norton [continuing]. As you say, are in black and
white.
Mr. Hamilton. There is still opportunity in the time
remaining to meet all obligations of the settlement agreement.
Ms. Norton. Within the last decade Boeing has had two
worldwide groundings of relatively new airplanes, the 787
Dreamliner, the 737 MAX, and encountered many compliance issues
in the time since Boeing paid that $12 million settlement
payment. And I am assuming it was paid.
Has the FAA assessed any additional financial penalties on
Boeing to the 2015 agreement?
Mr. Hamilton. No, we are not aware of any additional
penalties.
Mr. DeFazio. OK. The time of the gentlelady has expired. It
would be, first, Mr. Crawford.
Mr. Crawford. Thank you, Mr. Chairman.
Mr. Muilenburg, are you aware of any aviation accident that
can be attributed to a single factor?
Mr. Muilenburg. Congressman, no. I think the history of
aviation shows that these accidents are very--and they are very
unfortunate, but in many cases they involve multiple factors.
Mr. Crawford. Mr. Hamilton, do you agree with that?
Mr. Hamilton. Yes. As Ranking Member Graves pointed out,
James Reason's swiss cheese model, all accidents are typically
due to a number of contributing causes.
Mr. Crawford. The Indonesian National Transportation Safety
Committee recently issued its final report into the Lion Air
610 flight, finding nine contributing factors for the crash.
Other than the design of the aircraft, those factors include
the miscalibration of sensors during repairs, a lack of flight
and maintenance documentation, and failure by the flight crew
to appropriately respond to an emergency situation. To quote
one of the Indonesian flight investigators, ``The nine factors
have to happen together. If one of these nine contributing
factors did not happen, the crash would not have happened.''
Mr. Chairman, I have a copy of that report here, and I ask
for unanimous consent that it be included in the record.
Mr. DeFazio. Without objection.
[The information follows:]
``Final Aircraft Accident Investigation Report KNKT.18.10.35.04,''
Submitted for the Record by Hon. Crawford
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
The document is retained in the committee files and available at:
https://www.flightradar24.com/blog/wp-content/uploads/2019/10/JT610-PK-
LQP-Final-Report.pdf
Mr. Crawford. Thank you, Mr. Chairman, and I will yield
back.
Mr. DeFazio. I thank the gentleman. Next on our side would
be Representative Eddie Bernice Johnson.
Ms. Johnson. Thank you, Mr. Chairman. And thank our
witnesses for being here.
I would like to ask unanimous consent to put an opening
statement in the record.
Mr. DeFazio. Without objection.
[Ms. Johnson's prepared statement follows:]
Prepared Statement of Hon. Eddie Bernice Johnson, a Representative in
Congress from the State of Texas
I thank the chairman and ranking member for having this hearing
today, as it allows us to examine the current priorities and critical
concerns with the Boeing 737 MAX aircraft. I am eager to hear from Mr.
Muilenburg, the president and CEO of the Boeing Company.
My interests are specific as to how we as a legislative body can
adequately address the promotion of aviation safety; potential avenues
of reform in the agency certification processes; and long-term
influences on consumer flight experiences.
As to safety, the Boeing 737 MAX was marketed as a safe,
modernairplane; however, after two major failures and hundreds of
people losing their lives, we now know that the 737 MAX is not a safe
plane and consequently has been grounded.
As to the agency certification process, we must ensure that the
planes that are certified to fly go through the most comprehensive
certification process modernly available, so that we may avoid these
tragic failures in flight. We are experiencing a serious crisis of
trust in aviation safety. The importance of an appropriate
certification process for large aircraft in the United States is now
more pertinent than ever. If the safety certification process merits
reexamination and reform, we must advocate for transparency. This will
avert not only the reduction of the United States position of authority
on aviation safety, but also the endangerment of hundreds of lives in
preventable accidents.
My district in Texas is a major hub for aviation, and with the
significance of this industry and the jobs that the airline industry
provides, I am dedicated to addressing the imminent and long-term
concerns regarding the grounding and ensuing safety concerns of the 737
MAX aircraft. This is of significant concern to me, as both American
Airlines and Southwest Airlines are prominent entities at the Dallas
Fort Worth International Airport and the Dallas Love Field Airport and
had previously employed a significant number of this aircraft model.
Therefore, the operational implications of the grounding and safety
certification of the Boeing 737 MAX are literally a matter of life and
death.
Again, I look forward to the testimony of Mr. Muilenburg and the
answers to my questions. With this hearing, I join the efforts of my
colleagues in Congress to meaningfully and comprehensively address
these urgent concerns on both the national and global scale.
Ms. Johnson. Mr. Muilenburg, Mr. Mark Forkner's position as
chief technical pilot on the 737 MAX was in place at the time
of the accident. Who did he report to?
Mr. Muilenburg. Congresswoman, he was an engineer in our
Commercial Airplanes division. I am not sure who he reported to
directly, but he reported up through our engineering team.
John, if you----
Mr. Hamilton. Actually, he was in the training department,
so he worked through the training organization.
Ms. Johnson. OK. So there was a chain of command in some
way?
Mr. Muilenburg. Yes.
Mr. Hamilton. Yes.
Ms. Johnson. OK. In March of 2016 he asked the FAA if it
was OK to remove all references to the MCAS in the flight crew
operations manual and training materials. When he made this
request, was he acting on his own, outside the scope of what he
was supposed to be doing as the chief technical pilot?
Mr. Muilenburg. Congresswoman, part of Mr. Forkner's
responsibility included discussions on training with the FAA,
but that is more than a single individual. There is a large
team that does that work, together with the FAA and other
stakeholders. And typically, they will discuss the contents of
the training manual and make iterations on that manual over
time to try to optimize it for the pilots.
Ms. Johnson. Was there some way that it was called to his
attention, this request was made? And what was the inside
discussion?
Mr. Muilenburg. Congresswoman, I apologize, I could not
hear your question.
Ms. Johnson. The first question you responded to, which is
related to the second one, and that is when he made the request
to remove all references to the MCAS and the flight crew
operations manual and training materials, when he made that
request, was he acting on his own? And you said that it was a
number of people.
So I am saying was he just--talked a--did he have any
reprimand in any way for this request being made, or was it a
group request?
Mr. Muilenburg. Congresswoman, part of that discussion on
whether to include MCAS in the training manual, that was an
iterative process over several years, and included many people
beyond Mr. Forkner.
And typically, what we do is we want to include in the
training manuals the items that the pilots need to fly the
airplane. I think Ranking Member Graves described it well
earlier. We don't want to put more information in the training
manual than required. We want to focus on the information that
is needed to fly the airplane.
And so, typically, over a multiyear timeframe, we will make
decisions on whether to include things or not, depending on
whether they meet our criteria for what is beneficial to the
pilots.
Ms. Johnson. Was he or anybody else in Boeing rewarded in
any financial way for removing this requirement, and making it
simpler for you?
Mr. Muilenburg. Congresswoman, no. That is part of our
obligation. Our responsibility is to provide the best training
manuals we can.
I know the discussion around MCAS has included a--there has
been a lot of discussion about whether to include it or not.
But again, our focus has been on providing the information the
pilot needs to fly the airplane, rather than the information
that would be used to diagnose a failure. And that difference
between flying the airplane and diagnosing a failure is a
really important safety concept in our training manuals.
Ms. Johnson. Well, do you recall any discussion that was
made around anybody objecting to this decision to remove this
MCAS from pilot training materials?
Mr. Muilenburg. Congresswoman, I can't point you to a
specific document, but I know there were discussions, debates
on whether to include MCAS or not. That is part of our healthy
engineering culture. We bring up ideas, we debate. We encourage
that open discussion. That is how we ultimately optimized the
content of the training manual.
Ms. Johnson. Have you reconsidered the removal of this
material from your training manual, operational manual?
[No response.]
Ms. Johnson. Have you had any discussion to reconsider
removal of that material?
Mr. Muilenburg. There were discussions and debates amongst
the team. Again, that was happening during that multiyear
timeframe as MAX was being developed.
I don't know, John, if you want to add to that.
Mr. Hamilton. No, I agree. But I would say, since these
accidents, we understand that pilots do want more information,
and we are going to incorporate that in our flight crew
training manual and flight crew operations manual.
Mr. Muilenburg. That has been----
Ms. Johnson. Thank you. My time----
Mr. Muilenburg [continuing]. One of our key learnings----
Mr. DeFazio. The time of the gentlelady has expired. Just a
quick interjection in reference to the single point of failure.
I mean there was Turkish Airlines flight 981, where a DC-10
went down because the rear cargo door blew out. There was USAir
flight 427, the rudder problem that we had, which was the
subject of hearings in this committee. It was ultimately
determined that the rudder hardovers--we had two of those
single point of failure. And then we had the jack screw on the
Alaska flight. You know, the--so there have been a number. And
in this case MCAS was a major factor. It wasn't the only
factor.
With that, Representative Gibbs.
Mr. Gibbs. Thank you, Chairman. My condolences to the
families, too, prayers as you struggle through this very
difficult time.
On the MCAS, the sensor--and my understanding is on the
angle-of-attack sensors there is actually two sensors, but only
one was tied into the MCAS system. Is that correct?
Mr. Muilenburg. Congressman, that is correct. Depending on
sequencing of the flight control computers, one sensor would
feed MCAS. But on different flights it could be either sensor.
But one sensor at a time.
Mr. Gibbs. OK, because--one thing, I am not a pilot. I fly,
obviously, frequently. But, you know, when my friend down here,
Garret Graves, talks about how important it is, you can't just
pull off to the side of the road--redundancy.
So I don't know what you guys were thinking, because
sensors, I know from my background in agriculture, a lot of
times when we have problems, it is usually a sensor failure
that, you know, shuts the system down, because the sensor is
failing. Just an analogy. And an airplane, I think redundancies
really would be key.
And so I think we have all learned a lesson there, that we
are going to not just depend on one sensor. Correct? You have
learned that?
Mr. Muilenburg. Congressman, that is one of the lessons
learned here. We tried to rely on a previous architecture. We
have learned, and we are moving to a two-sensor architecture.
Mr. Gibbs. Now, the MCAS system, I am old school, I guess.
Maybe my kids and my grandkids might see it different. But
every once in a while on stuff that I operate--on your phone or
whatever, you got to reboot it. And so I have to agree with, I
believe, the chairman, but definitely Ranking Member Graves
talks about make sure we have the pilots be able to fly the
plane. I know these systems have added safety, overall, we have
less issues and tragedies because of the systems. But we have
got to make sure humans have to be able to override it.
So that is really concerning to me, when I heard that the
Airbus doesn't have that ability to override. I think that is
something the FAA ought to be looking at. I don't know. That
just raises a question with me.
But pilot training, testing. And I know we talked about
these two catastrophic accidents happened in Lion Air and
Indonesia and Ethiopia. And my understanding is--nothing
against the pilots, I know they were trying to save their lives
and everything, that is no doubt. But their training maybe
wasn't what it should have been, reports I have read.
I guess, if I was Boeing, a large manufacturer of very
sophisticated pieces of equipment, aircraft--what was Boeing's
plan in the future--you sell these sophisticated aircraft
around the world--to make sure, other than just relying on
their Government regulators--because I think I want to make
sure that the people that are maintaining them, the people that
are flying them have the training and the knowledge and the
ability, continuing training.
Moving forward, because this is one area I think we can
make sure we prevent things like this happening, and not rely
totally on the infrastructure itself, the asset itself, the
technology itself, but make sure we got the human technology,
the human behind that.
So I guess I would hear your comments on what, going
forward, what is Boeing going to do when they make these sales,
to make sure that you are confident that the people that
maintain the aircraft and fly the aircraft have the training
and the ability--what Boeing's role would be, moving forward.
Mr. Muilenburg. Congressman, I think you raise a very good
point. And that broader area of comprehensive global aviation
safety is an area where we are going to make additional
investments, going forward. An element of that is helping to
build the talent pipeline. By most estimates, the world will
need about 44,000 new commercial airplanes over the next 20
years, and about 1.5 million new pilots and aviation
technicians. So we have a responsibility to help build that
talent pipeline.
We are also going to take a look at the pilot machine
interface on our airplanes, and designing that for the next
generation, as technology is rapidly evolving. We are investing
heavily in that area, future flight deck design.
We are also investing in additional simulation
infrastructure around the world to provide additional training
capacity, working with airline customers around the world.
Those are just a few examples of what we are doing.
Mr. Gibbs. I am just curious on the case of the two cases
here, the Ethiopian and Lion Air, you know, the two cases, did
you have simulators over there, training? Or how has that
worked here in the past? What has been the involvement of
Boeing?
Mr. Muilenburg. John, are you aware of exactly what
training capacity they have?
Mr. Hamilton. I am not specifically aware of what Ethiopia
has, from a simulator standpoint.
Mr. Muilenburg. Congressman, if we could take that
question, we will follow up with the details there. I know we
have a team that is locally engaged with both airlines, and we
will follow up with the details on simulation infrastructure--
--
Mr. Gibbs. Yes, I appreciate that, because I think, moving
forward, we rely too much on our computers and our--all that.
And we know that machines do break, too.
So I yield back. Thank you, Mr. Chairman.
Mr. DeFazio. I now turn to the chair of the subcommittee,
Mr. Larsen.
Mr. Larsen. Thank you, Mr. Chair.
Mr. Muilenburg, as we are looking forward prospectively, we
need to do our job looking retrospectively a little bit to
understand the certification process. That has been the focus
of this committee's long-term investigation since March. And so
I want to touch on that a little bit.
You said today and you said yesterday at the Senate hearing
that ``We,'' that is Boeing, ``We have made mistakes and we got
some things wrong.'' Can you name three specific mistakes
Boeing made in this process?
Mr. Muilenburg. Congressman, I would point out
implementation of the angle-of-attack disagree alert. We got
that wrong, upfront. The implementation was a mistake, and we
have subsequently fixed that, going forward.
Mr. Larsen. Second?
Mr. Muilenburg. Secondly, we have learned about the MCAS
architecture, the changes that we have already talked about.
Clearly, we have some areas to improve there.
Mr. Larsen. And third?
Mr. Muilenburg. And thirdly, I would say, in the broader
area of communication, documentation across all of the
stakeholders, and doing that in an efficient and comprehensive
manner, we have identified some improvements we need to make
there.
Mr. Larsen. Can you identify individuals, then, who made
these mistakes within Boeing?
Mr. Muilenburg. Congressman, across all three of those
areas, these are large teams that work together across our
company, our supply chain. We have about 900 supplier companies
that work in our 737 supply chain alone: the FAA, other global
regulators, airlines. So in each of these three areas, there
are broad, integrated teams. There is no one individual that
makes decisions within these. These generally are engineering
teams that build consensus with all of the stakeholders.
Mr. Larsen. So does that make this an organizational or
cultural problem, as opposed to an individual problem and that
led to these mistakes?
Mr. Muilenburg. Congressman, I think it is important, from
an accountability standpoint--you know, my company and I are
accountable. That accountability starts with me. And our board
recently took some actions regarding my position.
Mr. Larsen. I was going to ask.
Mr. Muilenburg. Yes.
Mr. Larsen. How have you been held accountable through
this?
Mr. Muilenburg. Yes. So, Congressman, to your question, our
board has recently taken some actions on my position, and I
fully support that. That will allow me again to focus even more
on safety in our internal operations. And these decisions are
directed at safety.
I have also taken some management actions. We know there
are still a number of other reviews underway. And as those
reviews are completed, if we need to take additional actions,
we will. And those will be firm. And in some cases, they are
not individual actions, but to--as you pointed out, they are
organizational or structural actions. And these are equally
important.
And we have recently announced changes to our safety review
board structures to elevate them and make them more
transparent. I now receive weekly data reports, very detailed
level, on our safety review boards. We stood up a new safety
organization under Beth Pasztor. She now reports directly to
our chief engineer, who reports to me, instead of being down in
the businesses.
Our board has set up a new aerospace safety committee that
is chaired by Admiral Giambastiani. Just Friday we announced
the addition of Admiral Richardson, who has a deep, deep
background in safety. He will be a member of that committee.
And then we have also realigned our entire engineering
organization, roughly 50,000 engineers now all report directly
to our chief engineer, who reports to me. And again, this will
create additional transparency, visibility, and independence,
all with a focus on safety.
Mr. Larsen. So I can't help but think, when I hear that,
and when I read the JATR report, and read the NTSB
recommendations from September, and read the Indonesian
accident investigation report, that there are changes that we
need in how we certify aircraft and components in the FAA
process, that what we have now went too far, and that we don't
have a handle.
We hold the FAA accountable. The FAA is supposed to then
hold the OEMs, the original equipment manufacturers,
accountable. I am not convinced, based on reading these reports
and looking at Boeing's own actions, that that is being done
adequately. And I would like to hear your view on what--well,
do you agree with me or not?
Mr. Muilenburg. Congressman, we believe there are also
improvements we can make to that process. And as you are very,
very familiar with the delegated authority process, that
process, we do think, is very important to fundamental safety.
It broadly--it contributes to the 95-percent improvement in
safety we have seen over the last two decades. But we need to
make sure we have the balance right, and we support the reviews
that have been announced on that. I think that----
Mr. Larsen. Well, if I could just--and I will finish here,
Mr. Chair--if the bookends on this are what former--well,
Acting Administrator Elwell said at one time it would be $2
billion and 10,000 more inspectors. If that is one bookend, and
the other bookend is what we have today, I think that we ought
to be pulling out a book somewhere between those two bookends.
And right now we are--we have gone too far.
And with that I yield back.
Mr. DeFazio. I thank the gentleman. Representative Davis?
Mr. Davis. Thank you, Mr. Chair. And, as a matter of fact,
I want to kind of add to what my colleague from the State of
Washington was asking about, and it is about the certification
process.
As he just asked, there is one bookend of what the FAA
actually believes could be done with billions more dollars in
inspectors. We have the current certification process. I don't
want to see a knee-jerk reaction here.
Look, it breaks my heart, and everybody's heart in this
room, to look over and see those pictures. And I know it does
yours, too. These are real people who were affected by tragic
accidents that we are here to get answers for. But we also want
to make sure that we don't see any more in rooms like this.
I have many of my constituents who work at your facilities
in St. Louis and in Mascoutah, Illinois. I know every one of
those constituents that put on that Boeing uniform and go to
work every day, it breaks their heart when they see accidents
and tragedies like we have witnessed. They want to do the best
job they can to put a safe plane in the air. They want to make
sure no one cuts corners.
So this certification process, tell us, so we don't have
that knee-jerk reaction, what do you think the sweet spot is
from those bookends that Mr. Larsen was talking about?
Mr. Muilenburg. Congressman, I applaud the focus on safety
and people. As you point out, we always have to remember what
we are doing here is providing safe travel for people around
the globe, and lives depend on what we do. So we have to get it
right.
I think the certification system that we have today is a
solid system that has been built up over decades. We have seen
very significant improvements in safe travel over the last two
decades--as I mentioned, about a 95-percent improvement. That
is a result of the current certification system. So we need to
maintain what is good in that current system. There is,
clearly, a lot of goodness.
I think we have identified a couple of areas where we could
look at refinements. And one of the areas we talked about is
standards, these longstanding industry standards around pilot-
machine interface, and the assumptions behind that. I think we
are all eager to take a look at that as a potential area of
reform.
And I think, as John has well pointed out, there are some
aged regulations on the books that could be updated to
represent current technology, and that would also be
beneficial.
Mr. Davis. Well, that is good to hear. And I certainly hope
all of us here, we as policymakers, can ensure that we don't
have that knee-jerk reaction. Because we all have the same
goal. And there is probably not many more in the country that
fly as much as we do. So we understand the safety of the
aviation industry. But it is those instances where safety might
have been compromised, which is why you are here.
And I appreciate Boeing, and I appreciate you admitting
mistakes and talking about the administrative decisions that
you are making as a team at Boeing to ensure that those
mistakes aren't made in the future.
We have seen some disturbing whistleblower complaints,
complaints from former Boeing executives and workers about
processes and the culture that may exist at certain facilities.
What are you doing to address some of those to ensure that the
culture at Boeing, at all of their facilities, is up to par
with the facilities that I know my constituents work at in St.
Louis and in Mascoutah?
Mr. Muilenburg. Yes. Well, Congressman, you raise a very
good point. And we want our employees to speak up. When they
have concerns, issues, we want a culture where they are willing
to speak up. So I encourage those reports. We want to hear what
our employees' concerns are.
We conduct surveys to bring those up, as well, and we
provide reporting channels where, if employees want to bring up
anonymous concerns, they can. And those get immediate followup
action. And I think it is important, when you take a look at
those--the whistleblower complaints, other points that you have
brought up, this is part of our culture of providing visibility
on issues. That is how we get better, as a company.
And I can also tell you, as you know, I know the 150,000
people of Boeing. You know them from St. Louis and Mascoutah. I
know them, as you do. These are honest, hardworking, dedicated
people that know the work they do directly affects lives. And
they want to do it right, and they want to do it with
excellence. And we want a culture where people can bring up
concerns.
And my commitment, the culture of our company--I know John
shares this, as does the rest of my team--is to be responsive
to those inputs, to hear our employees, to take action, and to
do that consistent with our values.
Mr. Davis. Well, I hope the message you take from today's
hearing when you go back is thank you for the good job that
many of your employees do on a daily basis, but we also expect
results. And we want to see those results in all of your
facilities.
And my time is up. I yield back, and I thank you both for
being here.
Mr. DeFazio. I thank the gentleman. The Representative from
California, Mrs. Napolitano.
Mrs. Napolitano. Thank you, Mr. Chairman. Our collective
prayers are with the families on their tremendous loss, and I
am glad you are here, showing us--keeping us aware of it.
Mr. Muilenburg, my question is regarding FAA's organization
delegation authority, known as ODA, that allows your company to
oversee certain FAA certification activities. The FAA's Boeing
Aviation Safety Oversight Office, or BASOO, not only oversees
the Boeing 737 MAX program, but it also oversees other Boeing
commercial transport aircraft programs, including the 777 and
the 787 Dreamliner.
There are approximately 45 FAA employees that work in
BASOO, but there are 1,500 Boeing employees that work in the
organization, ODA, program. These Boeing employees have a dual
role of working for Boeing and representing the Government's
interests through the FAA.
Mr. Muilenburg, do you believe that having 45 FAA employees
overseeing all of the critical safety decisions Boeing makes
every day regarding commercial aircraft is adequate? Yes or no?
Mr. Muilenburg. Congresswoman, I can't give you what would
be the exact right number. We do respect the FAA's oversight
authority. We think----
Mr. DeFazio. Well, she didn't--sir, she did ask for a yes-
or-no answer. Do you believe that is an adequate number, given
the scope of their duties?
Mr. Muilenburg. Mr. Chairman, I can't answer that
specifically.
Mr. DeFazio. OK, all right.
Mr. Muilenburg. I think that is the FAA's call. All I want
to say is we fully support the FAA's oversight. We think strong
oversight----
Mrs. Napolitano. Thank you, sir.
Mr. Muilenburg [continuing]. Is part of what makes the
system safe.
Mrs. Napolitano. Thank you. I think the tragedy of Boeing
737 MAX doesn't just highlight cultural problems at Boeing
regarding production and Boeing's commitment to safety, but I
think also highlighted a failure by the FAA to provide
appropriate oversight of critical issues that impacted safety
and ultimately led to the accidents of both Lion Air and
Ethiopian Airlines.
I think the current oversight structure is a critical--very
critical--issue, and one that Congress is going to have to need
to evaluate in the wake of these accidents.
Thank you, Mr. Chairman. I yield the remaining time to you.
Mr. DeFazio. Thank you, Mrs. Napolitano.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. I want to return to the market pressures, the
fact that you had to design a plane that was more economical
and couldn't require pilot training, and I would, you know,
refer to--the first slide here is during an executive review
of, unfortunately, it is an Ethiopian Airlines plane, talking
about the MAX advantage. And it was just relentless pressure.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. And the next slide, which is, you know, no
flight simulator required. We have had questions about the
communications of your test pilot, and we have the polling from
your own employees about the pressures.
There is going to be, ultimately, a determination whether
you directly concealed, inadvertently concealed, provided in a
fragmented manner the full MCAS in its radical form,
information to the regulators, and that is something we are
also going to pursue with the regulators, what their
understanding was.
Let me just ask a quick question.
I know you know why we are here today: 346 people died on 2
of your airplanes in 5 months. And you are helping us to try
and delve into what we need to fix, because we need to change
the law.
But part of this process, really, is taking full
accountability for what went wrong, for the death of 346
innocent people on two 737 MAX flights. So my question is a
simple one, and I hope you can give me a direct response.
Who bears the principal responsibility at Boeing for the
cascading events that resulted in the crash of Lion Air flight
610 and Ethiopian Airlines flight 302?
I know that you have lost your board chair. You are still
CEO, you still serve on the board. I did happen to look at your
compensation last year. You received after that crash a $15
million bonus.
What are the consequences? Who is taking principal
responsibility? Who is going to be held accountable, fully
accountable? I know you fired one person.
Mr. Muilenburg. Mr. Chairman, my company and I are
responsible. We are responsible for our airplanes. And we know
there are things we need to improve. We own that. We are going
to fix it, and we are responsible. I am responsible.
Mr. DeFazio. OK.
Mr. Muilenburg. I am also accountable.
Mr. DeFazio. All right.
Mr. Muilenburg. And I described the actions that we took
earlier. And, as additional reviews are completed, as
additional studies are completed, we will take additional
action.
But I am accountable, my company is accountable. The flying
public deserves safe airplanes. That is our business.
Mr. DeFazio. Thank you.
Mr. Woodall?
Mr. Woodall. Thank you, Mr. Chairman. I wanted to pick up
where the chairman left off with the no flight simulator
required slide.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. Woodall. I am a lawyer, I am not an engineer. But I
don't understand the regulatory distinction between a
derivative type and a new type.
Is the requirement of a new flight simulator a disqualifier
to fit in under a derivative certificate?
Mr. Hamilton. No, let me explain. The 737 is a family of
airplanes. It is one of the safest family of airplanes flying
in the world today. And many pilots will fly an NG first flight
in the morning, they could fly a MAX as the second flight of
the day, back in the NG on the third flight of the day.
And so one of the market requirements the customers want is
to be able to make it a seamless transition from an NG to a
MAX.
Mr. Woodall. Well, let me go back, then, because the New
York Times reported in 2011, as competition grew with Airbus,
that it was Boeing's position that we didn't want a derivative
type, that it was a brandnew, clean-sheet design that is what
customers wanted.
And so, was the presumption at that time that you were
going to do a brandnew, clean-sheet design, going to create a
brandnew type certificate, and no new flight simulator was
going to be required?
Mr. Hamilton. Congressman, I was actually the chief
engineer of the 737 at that time, and we had actually had
product studies, as we normally do, looking at reengining,
since 2007.
We also had a product development organization that was
looking at a new airplane. And just like any good company, we
were looking at both options, and competing them internally
about what made sense to bring to the market. At the end of the
day, what the customers really wanted was to have an airplane
they could seamlessly transition from their 737s into this
future airplane. They----
Mr. Woodall. Well, when we talk about who takes
responsibility, candidly, I am concerned that we may have
created a regulatory environment that makes it so difficult for
you to get a new type certificate that you try to stuff all of
these changes that should never be stuffed in under a
derivative certificate.
But what you are telling me is, no, it is your customers
who demand that you get derivative certificates, and we, from a
regulatory perspective, are not complicit in making it too hard
to declare that new model.
Mr. Hamilton. I would say that a derivative type cert is
not necessarily any easier than a new type cert. I think, as
someone alluded to, we took over 5 years to do the derivative
type cert, which is very consistent with what we do for a new
type cert.
So they are actually very complementary. And if you look at
the MAX's certification, it was very comprehensive.
Mr. Woodall. All right. So when we go back to the IG's
report that quotes an FAA official as saying, ``The 737 MAX is
not a simple derivative of its previous models, it is a very
complex modification incorporating many new and novel features.
Boeing is doing everything it can to be exempt from the new
certification rules and keep the aircraft the same type rating
with minimal training differences,'' that has nothing to do
with the length of the approval process, that has everything to
do with the economic pressures Boeing is under to meet customer
demand of pilot similarity in a continuing model?
Mr. Hamilton. Yes, the MAX was--with technology we
determined that we could get the same amount of fuel
efficiency, the same amount of carbon dioxide reductions, the
same amount of noise reductions that we pretty much could with
a new type--a new airplane. And it was a desire from the
customers.
So, yes, that informed some of the decisions we made, but
it wasn't about--how we approached certification. It was about
design choices we made.
Mr. Woodall. Let's go back to the FAA partnership, then,
because I--and I appreciate what you said yesterday in your
Senate testimony, Mr. Muilenburg, about ODA making American
aviation and world aviation safer. I believe that to be true,
and I very much worry that, in every tragedy, that the tendency
is to swing the pendulum back too far the other direction.
When an FAA official says the MAX is not a simple
derivative, it is a very complex modification, it does
incorporate new and novel features, what role does Boeing have
in requiring the FAA to go ahead and sign off on that
derivative type, instead of saying, ``No, we have now looked at
your engineering, this is not a derivative type, you must go
back and begin this process again''?
Is ODA implemented in FAA's decision of whether to certify
a new type or not?
Mr. Hamilton. Congressman, I used to run the ODA, and I was
actually leading the ODA at the time. This is not an ODA
function at all.
This is Boeing as--the applicant, the OEM, we go discuss
with the FAA what the certification basis should be for the
airplane. And it is--ultimately, it is the FAA's decision. They
set the requirement, they set the cert basis. And then we, as a
company, as the applicant, we have to follow that. It is not an
ODA function at all in establishing the cert basis.
Mr. Woodall. I hope we will bring those FAA officials in,
Mr. Chairman, so that we can ask that question, because that is
the point of failure, if there is a point of failure in this
regulatory process.
Mr. DeFazio. OK.
Mr. Woodall. I yield back.
Mr. DeFazio. I thank the gentleman. Mr. Lipinski is next.
Mr. Lipinski. This is not a court, and this is not a
criminal hearing, but 346 people died in 2 crashes of Boeing
737 MAX planes that should not have been certified to fly by
the FAA.
I said at a hearing earlier this year, ``Something went
wrong in the certification process of this plane. Either the
FAA certification process itself is at fault, Boeing is at
fault in their role in the process, or both.'' After I made
this statement, I was upbraided by some in the industry for
questioning the process.
But this committee has a responsibility to get to the
bottom of what went wrong in the certification process for the
737 MAX so we can make changes to that process and assure the
public, especially those in this audience and everyone who lost
loved ones, assure them that they will not be flying in unsafe
planes again.
Now, sitting here, we heard about accountability. I am not
sure what accountability means if accountability means, Mr.
Muilenburg, you received a $15 million bonus after these planes
crashed. I am not sure who has been held accountable here for
this.
Two planes crashed. Even after the first plane crashed, I
still don't really understand how you have--I am an engineer,
but I am asking a lot of questions back here. People who are
more expert than me--I don't understand how you have this
single point of failure. Chairman DeFazio went through that,
but it was raised, as the chairman mentioned.
There is also another case. There was an internal ethics
complaint that alleged that an engineer recommended the
synthetic airspeed system be put in, which is in the 787
Dreamliner, and was rebuffed because of ``cost and potential
pilot training impact.''
There is a lot of reasons mistakes are made. The problem,
the bigger problem, is if mistakes were made for financial
reasons. And there are a lot of things that seem to point to
that in this whole process, and that is what is so concerning.
And how did that happen in Boeing? How did Boeing allow that to
happen? How did the certification process allow that to happen?
In order to get a new type certificate, it takes,
generally, a longer amount of time. I think most people will
agree, Mr. Hamilton, it takes a longer amount of time. It also
risks having--most likely you are going to have to require
pilot training.
So all these point back to ways of saving money, and that
is a big problem. How do we stop that?
Now, I want to ask--the JATR team found that MCAS was not
evaluated--and this is something--I was listening to the Senate
testimony yesterday, Mr. Muilenburg, and you didn't seem to
agree with this. And I want to get your--what you say here: The
JATR team found that MCAS was not evaluated as a complete and
integrated function in the certification documents that were
submitted to the FAA. Is that true?
Mr. Muilenburg. Congressman, the MCAS system was certified
with the FAA.
Mr. Lipinski. Was it evaluated as a complete and integrated
function, or was it step by step without ever having FAA look
at it as a complete and integrated system? Because that is what
is the important piece of this.
Mr. Muilenburg. Yes, I think what the JATR report points
out--and this is an area where we support further looks, as
well--is when we think about what we call a cross-system
integration, and how we do certification of that.
So, for example, a multiple failure mode analysis, high
pilot workload conditions, we do think that is an area where we
want to look more deeply.
The MCAS system and the MAX were certified to our current
standards for how we do those analyses. But, as the JATR points
out----
Mr. Lipinski. Well, it was a completely--it was a very
different system. I think that is very, very important, and
that is something that FAA should have required, and I think it
should have been provided.
But in my last few seconds here I want to ask. As the 737
MAX reenters service, will Boeing require airlines to conduct
similar training on MCAS for all pilots?
Mr. Muilenburg. Congressman, those decisions are the
purview of the regulatory authorities around the world. And we
will respect their----
Mr. Lipinski. Will Boeing lose----
Mr. Muilenburg [continuing]. Their decisions.
Mr. Lipinski. Will Boeing have to give money back to any of
the airlines if that is the case?
Mr. Muilenburg. Congressman, money doesn't factor into this
decision. It is about safety. So we----
Mr. Lipinski. But if it is in the contract, that is a
question.
My time is up.
Mr. DeFazio. I thank the gentleman. Representative Katko?
Mr. Katko. Thank you, Mr. Chairman. And I thank all of my
colleagues for all these questions today.
In my previous life I was an organized crime prosecutor,
and routinely had to sit with victims--and victims' families,
more often. And the pain I see on your faces is exactly the
pain I saw on those victims' faces. So I just want to recognize
that, and recognize that--I hope you understand we are taking
this very, very seriously.
And I understand, Mr. Muilenburg, last night they had an
opportunity to meet with the victims' families. I would like
to--I know what--it always had a huge impact on me and how I
carried out my cases, and it motivated me to do better, and to
get to the bottom of the problem. So I want to hear what it was
like for you, and what was discussed.
Mr. Muilenburg. Congressman, I want to respect the privacy
of the families, but I can perhaps, if you will allow me, just
broadly describe our discussion.
We wanted to listen. And each of the families told us the
stories about the lives that were lost. And those were
heartbreaking. I will never forget that.
So we talked about their stories, we listened. And we,
further into the conversation, you know, talked about safety,
talked about changes, talked about what my company has learned,
what I have learned. We talked about our commitment to never
letting this happen again, to preventing any future accidents
like this. You know, it was--one thing I wanted to convey to
the families.
But, you know, these stories, they are always going to be
with us. And I wish we could change that. And all we could do
is--we have to remember these people. It brought me back to
remembering that, you know, lives literally depend on what we
do at the Boeing Company. That is why I came to this company as
a farm kid from Iowa, right? That is what I wanted to work on.
And these stories brought that all back.
Mr. Katko. Well----
Mr. Muilenburg. So we are never going to forget that, and
the commitments we shared with the families, and working in
their communities going forward, that is very important to us.
And we are going to follow up.
Mr. Katko. I can tell you I never forgot any of those
conversations with the victims of--murder victims, and what
have you, their families. I can remember it like it was
yesterday. And I hope you remember that, and it motivates you
and your company, going forward, to do better than you have
done.
Mr. Hamilton, from an engineering standpoint, I want to
switch gears a bit. My colleagues have done a terrific job of
asking about this particular issue. But I am concerned about
other things with respect to air safety, as well.
And with my work on the Committee on Homeland Security, I
am--and my chairmanship on the Subcommittee on Cybersecurity,
Infrastructure, Protection, and Innovation, very, very, very
concerned about supply chain anywhere in public transit. We
have made a lot of noise in this committee about what New York
City was doing with their subway systems, and we made noise
with Metro here, as well. And so I am concerned that, you know,
what you are doing to ensure that the supply chain is good, and
is sound, and you are not getting it from bad actors?
And also, what you are doing to ensure that the ever-
spreading and ever-metastasizing cybersecurity problem doesn't
infect the airlines themselves.
Mr. Hamilton. Certainly. You know, we do have a global
supply chain, and we carefully do audits of our suppliers to
determine, first of all, should we get something from that
supplier or not, and then we have robust followup processes,
both looking at their quality controls, their producibility,
and oversight of our supply chain. And this is one of the
things that the FAA has asked us to strengthen. And we are
doing that. We have taken some actions on that, as well.
And every day we get reports in on how the suppliers are
doing, and whether or not we need to invest and put more
actions to improve their operations.
Do you want to talk cybersecurity, overall?
Mr. Muilenburg. Yes.
Mr. Hamilton. Yes.
Mr. Muilenburg. In addition to that, as John well pointed
out, we have got about 12,000 companies in our supply chain
here in the U.S., mostly mid- and small-sized businesses. So,
in many cases, we assist them with their cybersecurity
infrastructure, as well. That is a very important
infrastructure to us across our Boeing enterprise. And my CIO,
who reports directly to me, is responsible for that.
We also have a continuous effort on the cybersecurity of
not only our systems, but our products. So cyber-hardening our
airplanes for the future, ensuring that nobody can gain access
to those airplanes, is a very important safety design principle
for us. And our engineering team spends time on that every day.
Mr. Katko. Thank you very much. I am out of time.
I yield back, Mr. Chairman.
Mr. DeFazio. I thank the gentleman. With that I recognize
Representative Cohen.
Mr. Cohen. Thank you, Mr. Chair.
Mr. Hamilton, on the 30th of March in 2016, Boeing asked
the FAA if it was OK to remove all references to MCAS from the
flight crew operations manual and training material. That
request was based, in part, on Boeing's representation that
MCAS ``only operates way outside of the normal operating
envelope.'' Is that not true?
Mr. Hamilton. I believe that is true, that we--I can't
verify the date, but I believe----
Mr. Cohen. Right.
Mr. Hamilton [continuing]. What you are saying is true.
Mr. Cohen. So let me suggest this to you, or ask you. On
March the 30th, the same day, Boeing's chief technical pilot at
the time, Mark Forkner, emailed the FAA with the following
request, ``Are you OK with us removing all reference to MCAS
from the operating manual and the training as we discussed, as
it's completely transparent to the flight crew and only
operates way outside of the normal operating envelope?'' The
``normal operating envelope'' being the term the flight
conditions a commercial airline passenger might reasonably
experience. Is that correct?
Mr. Hamilton. As Mr. Muilenburg has discussed, it is an
iterative process that we go back and forth with the FAA on
what needs to be in the training manual and what doesn't. And
collectively, the FAA and Boeing reached an agreement that the
description of the MCAS did not need to be in the training
manual.
Mr. Cohen. And Mr. Forkner requested that. Is that correct?
Mr. Hamilton. Yes, and Mr. Forkner's role, as chief
technical pilot, would be the prime interface with the FAA on
that.
Mr. Cohen. So he said it was way outside the normal
operating envelope, talking about conditions or airplane
maneuvers that are beyond what a commercial airline passenger
would normally experience. Right?
That is right, isn't it, Mr. Hamilton, that Mr. Forkner
said that it was outside the normal procedures, you normally
wouldn't have that occur on a commercial airline.
Mr. Muilenburg. Referring to the MCAS envelope being
outside?
Mr. Hamilton. Yes, MCAS should have been transparent to the
pilots and assist them only as they approached what we refer to
as high alpha, or high attitude-type conditions.
Mr. Cohen. All right. MCAS didn't activate outside the
normal operating envelope on Lion Air. In fact, MCAS activated
within the normal operating envelope on that flight. Is that
not correct?
Mr. Hamilton. Yes, MCAS reacted to a faulty sensor input,
and operated as it was designed, yes.
Mr. Cohen. So Captain Forkner repeated this representation
to the FAA as late as January of 2017 after Boeing had changed
MCAS to operate at lower speeds, and just a few short months
before the FAA finally certified the plane.
In a recently released email exchange in which he was
discussing changes that were needed for MAX pilot training, he
reminded the FAA, ``Delete MCAS, recall we decided we weren't
going to cover it in the flight crew operating manual or the
CBT, since it's way outside the normal operating envelope.''
Let's get it out of the flight crew operations manual and
outside the computer-based training.
In hindsight, would you not agree that Captain Forkner
either, one, did not understand; two, downplayed; or, at worst,
three, concealed the fact that, under a scenario that--known to
Boeing, the failure of a single angle-of-attack sensor, MCAS
could activate within the normal operating envelope?
Mr. Hamilton. Again, I was not part of those conversations.
You know, I think that was part of the--was leading up to the
fleet standardization board meeting, and understanding what
needed to be presented in that meeting.
Mr. Cohen. You might not have been part of it, but you are
an expert. You are an engineer. You are a vice president of
Boeing.
Mr. Hamilton. That is correct.
Mr. Cohen. Would you not agree, in hindsight, that Forkner
either did not understand; downplayed it; or concealed a fact
that, under a scenario known to Boeing, failed to tell--to talk
to--MCAS to--acted about what would go on?
Mr. Muilenburg. Congressman----
Mr. Cohen. Mr. Hamilton, would you answer my question?
Mr. Hamilton. Absolutely. Congressman, you know, I don't
know what was going through Captain Forkner's mind, what he
knew, what he didn't know, I don't want to speculate on that.
Mr. Cohen. Mr. Muilenburg, do you want to respond?
Mr. Muilenburg. Congressman, the only point I was adding is
that the MCAS is originally designed--the idea is for it to
operate outside the normal envelope. And then the extension to
the low-speed envelope, which I think you are referring to,
again, that was something that was tested and certified with
the FAA from roughly mid-2016 to early 2017.
Mr. Cohen. Let me ask you this, Mr. Muilenburg. You said
you are accountable. What does accountability mean? Are you
taking a cut in pay? Are you working for free from now on until
you can cure this problem?
These people's relatives are not coming back. They are
gone.
Mr. Muilenburg. Yes.
Mr. Cohen. Your salary is still on. Is anybody at Boeing
taking a cut, or working for free to try to rectify this
problem, like the Japanese would do?
Mr. Muilenburg. Congressman, it is not about the money for
me. That is not why I came to Boeing----
Mr. Cohen. Are you giving up any money?
Mr. Muilenburg. Congressman, my board will conduct a
comprehensive review. That----
Mr. Cohen. So you are saying you are not giving up any
compensation at all. You are continuing to work and make $30
million a year after this horrific two accidents that caused
all of these people's relatives to go, to disappear, to die?
You are not taking a cut in pay at all?
Mr. Muilenburg. Congressman, again, our board will make
those determinations----
Mr. Cohen. You are not accountable, then. You are saying
the board is accountable.
Mr. Muilenburg. Congressman, I am accountable, sir.
Mr. DeFazio. The gentleman's time has expired. With that we
would turn to Representative Graves.
Mr. Graves of Louisiana. Mr. Muilenburg, did you fly on a
737 MAX prior to these disasters?
Mr. Muilenburg. Congressman, I don't recall flying on a MAX
prior to, no.
Mr. Graves of Louisiana. Mr. Hamilton?
Mr. Hamilton. Yes.
Mr. Graves of Louisiana. Do you have any idea how many
times?
Mr. Hamilton. I don't recall the exact number, no.
Mr. Graves of Louisiana. Once? Ten times? Any ballpark?
Mr. Hamilton. Yes, it was probably--I could count on one
hand.
Mr. Graves of Louisiana. I flew on one. I don't know how
many times, but I know at least once before.
My point is that I am--there are all sorts of things that
have come out, including the text messages and other things
that some folks have said, ``This is a smoking gun.'' I am
going to assume that you all wouldn't have ridden on an
airplane if you believed that something was wrong. Is that a
safe assumption?
Mr. Hamilton. Yes.
Mr. Graves of Louisiana. All right. So here is where I want
to transition, all right?
So I talked earlier about all the reports that I did from
memory. I think the only one I left out was the Department of
Transportation's inspector general report. We have got outcomes
of a number of reports, including NTSB, Indonesian accident
report. We have got the Boeing board and others that have come
out.
How do we know that this new process is actually going to
have the integrity to where you don't just feel it is right,
FAA doesn't just feel it is right, that it actually is right?
Does that question make sense?
Mr. Muilenburg. When you say ``new process,'' Congressman--
--
Mr. Graves of Louisiana. So my point is that, before, you
flew. I flew.
Mr. Muilenburg. Yes.
Mr. Graves of Louisiana. We all believed that it was right.
Now we are potentially going to unground this craft at some
point. How do we know that this new process is actually going
to work and yield the right outcome?
Mr. Hamilton. You know, I would say that, number one, the
software changes we are making are going to prevent our pilots
from ever being in this condition again.
But also, the FAA is doing a very robust, thorough review
of all our documentation, of all our testing, and that is
partially why it is taking this long.
But I feel that, very confidently, that when we get through
this, the FAA will clearly say that this airplane is safe.
Mr. Graves of Louisiana. As I mentioned, you have got
outcomes, at least preliminary outcomes, from NTSB, Indonesia,
from the Boeing board and others. Based on what you have seen
so far, are there any of these expert recommendations that you
disagree with?
Mr. Hamilton. You know, I think the NTSB recommendations,
the JATR recommendations, they are all--and even the
Indonesians' recommendations, I think, you know, we are still
reviewing all of them.
But I would say, after my initial look at them, I think
there are some very good recommendations, and we are looking
forward to working with the FAA and the industry to address
those, yes.
Mr. Graves of Louisiana. Are you implementing those
recommendations now on your efforts on the 777X as it goes
through certification?
Mr. Hamilton. I would say absolutely, based on the lessons
learned coming out of the MAX, we are absolutely applying those
to the 777-9.
Some of the recommendations, though, we need to work with
the FAA on how they want to respond to some of those.
Mr. Graves of Louisiana. I would appreciate if you could
come back to the committee after looking through some of the
recommendations of NTSB and others and advise us of any
recommendations that you do not concur with.
Secondly, if you could provide the committee and follow up
with--just helping us to better understand what changes Boeing
is making. And, look, I understand you are part of the system.
The airlines play an important role, the FAA plays an important
role, and others. But what changes you are making to where--you
felt it was right, OK, before--and making sure that there are
changes.
Lastly, I was going through five recommendations from some
of the families, and I want to ask that you follow back up with
us: publicly disclose the MCAS fix; clearly define the utility
of MCAS; address the concern of the culture within Boeing that
might have been prioritizing the wrong things; ensuring that
there were not efforts to conceal the MCAS and its role, which
I think goes back to defining; and also ensuring that the
entire plane is viewed as an integrated system, as opposed to
components, individually, that may not recognize their role in
the larger system.
Mr. Muilenburg. Congressman, we will follow up on all
those.
Mr. Graves of Louisiana. Thank you very much. I yield back.
Mr. DeFazio. I thank the gentleman. We are going to
recognize--what? Yes, one more Member, and then the panel has
requested a break, which I think is quite reasonable, of 15
minutes.
So I will recognize Representative Sires, and then we will
have a 15-minute break, and then we will return.
Mr. Sires. Chairman, thank you for holding this hearing. It
is very important.
Mr. Muilenburg, in the spring and summer of 2018, did the
former general manager of the 737 program ever raise safety
concerns with you about production pressure on Boeing's
employees who were involved in the final assembly of the 737
MAX at Boeing's Renton, Washington, facility? Yes or no?
Mr. Muilenburg. Congressman, yes, I am aware of some
concerns that were raised----
Mr. Sires. So yes?
Mr. Muilenburg [continuing]. In that time period.
Mr. Sires. OK. I would like to read from an email that was
sent to the general manager of the 737 program in June 2018, 4
months before the Lion crash, and 2 months before the plane was
delivered to Lion Air.
The email comes from a senior manager on the final assembly
team for the 737 MAX, and it reads like this: ``I have some
safety concerns that I need to share with you, as the leader of
the 737 program,'' he wrote. . . . ``Today we have 38
unfinished airplanes located outside the factory. The following
concerns are based on my own observations and 30 years''--30
years--``of aviation safety experience. . . .
``My first concern,'' he states, ``is that our workforce is
exhausted. Employees are fatigued from having to work at a very
high pace for an extended period of time. . . . Fatigued
employees make mistakes. . . .
``My second concern is schedule pressure is creating a
culture where employees are either deliberately or
unconsciously circumventing established processes. These
process breakdowns come in a variety of forms adversely
impacting quality. . . .
``Frankly, right now all my internal warning bells are
going off. And for the first time in my life, I'm sorry to say
that I'm hesitant about putting my family on a Boeing
airplane.''
The employee was so concerned that he recommended shutting
down the production. And he states, ``I don't make this
recommendation lightly,'' he wrote. ``I know this would take a
lot of planning, but the alternative of rushing the build is
far riskier.
``Nothing we do is so important that it is worth hurting
someone.''
Mr. Muilenburg, I know this employee also wrote to you,
personally, in December 2018, after the Lion Air crash, as he
spoke with Boeing's assistant general counsel several times
after that.
My question is what have you done to ensure the safety
issues Boeing employees raised are properly addressed?
I mean you went through before a whole litany of what you
do with employees. It seems that this one must have escaped
somewhere.
Mr. Muilenburg. Yes, Congressman, I am familiar with that
last communication that you referenced, where the employee
sent--or I believe he was a previous employee, a retired
employee----
Mr. Sires. He is retired, yes.
Mr. Muilenburg. I will double check that.
Mr. Sires. He went on to retire after 30 years.
Mr. Muilenburg. He--I recall his email. And we did have
several followup sessions with him. I told him I appreciated
the fact that he brought up those issues and concerns.
We do know that our team, who, at that point, was running a
production line that was operating at 52 737s a month--it was a
high-rate line at that point, as we had been ramping up
production from 42 to 47----
Mr. Sires. So what did you do about it?
Mr. Muilenburg. We took a number of actions on taking a
look at each of the work locations within the factory, each of
the production stops. We implemented some additional quality
checkpoints in the process.
We also just took a look at his concerns, because he was
not actually in the factory at that point, but he raised some
good concerns, so we went back and took a look at his concerns.
And in some cases we identified areas where we thought his
issues had already been addressed, and we provided that
information back to him.
But this is part of our continuous process in our
factories. It is very, very important that we set up a culture
where, again, safety is first in the factories. And that comes
with quality, as you well pointed out. And safe work is also
work that is done in position. And that is one of the big focus
areas for us.
What happens in high-rate factories like ours, if--in the
production factory, if they have work that gets behind, and it
gets out of position, that is when injuries can happen. So our
objective is to make sure work can happen in position. That is
a safer work environment. And that is an area where we have
been very, very focused in our safety efforts, and we will
continue to be.
So we take those inputs seriously. We evaluated them, we
responded, and we are continuing to take action.
Mr. Sires. My time is up, and I thank you.
Mr. DeFazio. Just one quick followup. Did you reduce the
rate of production at that point in time, given his concerns,
from 52?
Mr. Muilenburg. Congressman, we are currently running the
737----
Mr. DeFazio. No, at that time. I mean at that time. Did you
reduce it----
Mr. Muilenburg. Sir----
Mr. DeFazio [continuing]. Given the concerns he expressed?
Mr. Muilenburg. Sir, we did not change the production rate.
Mr. DeFazio. OK, all right, thank you.
Mr. Muilenburg. Again, I think it is very important that,
when you change a production rate in a line like ours, any
change up or down----
Mr. DeFazio. Sure, I understand there is a whole supply
chain. That is good.
Mr. Muilenburg. Stability is preferred.
Mr. DeFazio. If you want your 15 minutes we are going to
have to break now. So we will recess the committee for 15
minutes.
[Recess.]
Mr. DeFazio. OK, the committee will come back to order.
Which side are we on? We are on this side, right?
So Representative Babin?
Dr. Babin. Yes, sir, Mr. Chairman. Thank you very much.
I would like to join the others in acknowledging those in
attendance here today who lost loved ones in the accidents, and
offer my very sincerest condolences to you, and thank you for
being here today.
In the interest of time, I would like to get right to it.
Instead of directing my questions to one of you, specifically,
I would like to address these to both of you, and let you
decide who is best fit to answer.
I think there is a feeling out there that, after the Lion
Air crash in Indonesia, Boeing sat back and did nothing in
terms of addressing the causes of the accident. And since the
second crash in Ethiopia, we have heard a lot from Boeing and
the rest of the industry about how the information gleaned from
these tragic accidents helped to ensure that they are not
repeated.
With that in mind, what did Boeing do after the Lion Air
crash to ensure that those circumstances were not repeated? And
do you have any specific examples of lessons learned that you
can share with all of us that have positively impacted the
entire commercial aviation arena beyond just Boeing or the MAX,
specifically?
If you can, give that to me, one of you, as quickly as
possible.
Mr. Muilenburg. Yes, Congressman, I am going to ask Mr.
Hamilton to answer that.
Dr. Babin. OK.
Mr. Muilenburg. But if I could, just very quickly, I also
need to correct a statement I made on a question from
Congressman Sires, where he referenced a concern that had been
brought up by a retired employee. I responded to a question
about whether the vice president, GM, of the program, had
talked to me. And I said yes to that. That was incorrect.
My initial reception of that input was direct from the
employee, and I just wanted to clarify that to make sure it was
right. We did follow up, and I referenced several actions that
were ongoing in our factory concurrently. And the letter from
the employee addressed several of those topic areas, but I just
wanted to clarify that was separate from the actions that we
were taking. And----
Dr. Babin. OK, thank you. Just very, very quickly, Mr.
Hamilton, because I have got some other things I want to say.
Mr. Hamilton. Certainly. In the--so I--in my previous role
I led our accident investigation teams to some of the accident
sites, including some of the ones that the chairman announced
earlier, and I have led the corrective actions.
In the hours following the Lion Air accident, we convened a
group of experts from around the company and started
postulating on what possibly could have happened, given the
limited data that was available. We quickly identified that
this MCAS activation could have been a scenario. We started
running that through our labs, running scenario planning. And
once the flight data recorder came up later in the week, and it
verified what we had, we went--started working on a software
change immediately to start working that.
Dr. Babin. OK.
Mr. Hamilton. And separately, convened a safety board and
determined that that was not enough, just a software change, to
mitigate the risk. And we determined that, while the crew--the
captain of Lion Air was trimming out the airplane as it was
getting MCAS when he handed over the control, it didn't quite
follow the assumptions that we had based the design on. So we
knew we needed to put an operation manual bulletin out to
remind crews----
Dr. Babin. OK, let me interrupt you because I have got some
other----
Mr. Hamilton. OK.
Dr. Babin [continuing]. Other things I want to have, but I
think I will just submit those for the record.
But I do want to use my remaining time to be perfectly
clear about something. As unfortunate as these tragedies are,
systems sometimes fail. And we will continue to learn from them
until they don't fail. In the meantime, we need highly trained
humans in the loop to make judgment calls when things go awry.
That means ensuring that the operators of these complex systems
know how to triage problems in order to put a plane safely on
the ground in the case of an emergency.
The day before the Lion Air crash, when the identical
problem occurred, an off-duty pilot riding in the cockpit
correctly identified the problem and guided the crew to disable
the MCAS and save the airplane. Let me be clear: This plane
absolutely should not have been in the air on October the 29th
in 2018, another human error.
But this is an indicator that a well-trained crew
potentially could have averted this disaster, and all that to
say that there are plenty of things that Boeing should have
done better. Also, human errors.
And I am sorry to say that even on this committee there are
those who claim that Boeing's decisions are made only with the
almighty dollar in mind. Are we under the illusion that Boeing
makes money when tragedies like these occur? Hard to imagine
that Boeing would intentionally suppress information that would
make the public safer and their product ultimately better.
We should be using these opportunities to seek out
solutions, not trying to hang blame on a company that has as
much desire to keep their passengers safe as we do. Let's not
forget that more than 5 million people fly safely on Boeing
planes every single day.
We must be very careful not to erode American leadership
when it comes to safety in aviation. America is unquestionably
the gold standard when it comes to commercial aviation, and
Boeing has played a major role in getting us to that point.
And, just for the record, I serve no parochial interest in
Boeing's commercial aviation program in my District 36 in the
State of Texas.
So I would yield back, and I will submit my questions--
further questions, then. Thank you, Mr. Chairman.
Mr. DeFazio. I thank the gentleman.
Mr. Muilenburg, since you just made a clarification about
your response to Representative Sires, I just want to get this
straight. You heard directly from this individual, the
individual who, 4 months before Lion Air, said that he was
hesitant about putting his family on a Boeing airplane after he
complained about schedule pressure, exhaustive workforce, et
cetera? He corresponded with you directly?
Mr. Muilenburg. Congressman, as I recall, the--it was via a
letter that I received. I am not sure if it was electronic or
physical, but it was via a letter from him. I did talk to him--
--
Mr. DeFazio. Right. And in response to my followup you said
you didn't reduce production at that point in time, despite
having an exhausted workforce, despite all the other concerns
he raised. You didn't reduce production because you were
concerned about your supply chain.
Now, this--just reflect on this for a second. You talked
about your upbringing, modest upbringing. But now, you know,
you are a very highly paid CEO of a vaunted American
institution, the Boeing Company. And as Mr. Cohen pointed out,
and I pointed out at the beginning, after Lion Air you get a
$15 million bonus. And you say people are being held
accountable.
This gentleman quit the company after 30 years in the
industry because his concerns weren't being addressed. But you
are leading us to believe that they were significantly
addressed. I am sorry, I just don't buy that.
And with that I recognize Mr. Mitchell.
Mr. Garamendi? John, sorry.
Mr. Garamendi. No need. You were carrying on a line of
questions that I want to pursue.
Mr. Muilenburg, you are the chief executive officer. Do you
set the pace for the company? Do you set the standards? Do you
set the purpose and goal for the company?
Mr. Muilenburg. Congressman, that is part of my
responsibility.
Mr. Garamendi. So the answer is yes, you do those things?
Mr. Muilenburg. Yes, sir.
Mr. Garamendi. Good. And as the chairman just said, did you
receive a $30 million remuneration from the company in 2018?
Stock, wages, et cetera?
Mr. Muilenburg. Congressman, I recall my salary was roughly
$23 million that year.
Mr. Garamendi. Then I suppose this is incorrect. It came
from Seattle Times. It says $30 million.
You have at least three employees that have left the
company--Adam Dickson, Rick Ludtke, and also a whistleblower in
Charlotte--all of which said the company's goal is profit over
quality. Are they correct?
Mr. Muilenburg. Those comments are not accurate.
Mr. Garamendi. Then what is the company's standard for
quality over profit?
Mr. Muilenburg. Our core values as a company, top of that
list: safety, quality, and integrity.
Mr. Garamendi. I see. So in 2016, when Boeing started
asking for time and cost reductions as part of a manager's
performance evaluation, the gentleman that said that, Mr.
Dickson, is he incorrect? That is not what happened in 2016?
Mr. Muilenburg. Congressman, I am not familiar with the
specific communication, but it is true that we incentivize our
team to perform from a cost and schedule standpoint, as well.
Mr. Garamendi. Is that contrary to quality and safety?
Mr. Muilenburg. Congressman, no, it is not.
Mr. Garamendi. So which is most important?
Mr. Muilenburg. Most important, clearly, safety comes
first.
Mr. Garamendi. And we have the----
Mr. Muilenburg. And quality.
Mr. Garamendi [continuing]. 737 MAX to prove that that is
incorrect.
Mr. Muilenburg. Congressman, I disagree with that premise,
respectfully.
It is very true that we operate in a competitive
environment around the world. We are the last remaining big,
commercial airplane builder in the U.S. It is a competitive
environment.
Mr. Garamendi. And you are the most recent to have lost 2
airplanes and 346 people dying as a result of a problem with
your quality and your airplane. Is that correct?
Mr. Muilenburg. Congressman----
Mr. Garamendi. It is correct.
Mr. Muilenburg. As I said, safety and quality are our top
priorities.
Mr. Garamendi. I see.
Mr. Muilenburg. And safety and quality go hand in hand with
operational----
Mr. Garamendi. Would you like to talk to me about the
quality of the KC-46? Would you like to go into detail about
the abject lack of quality in an airplane that the U.S.
Government is purchasing, or wants to purchase from you, the
KC-46? You want to talk about the boom? You want to talk about
the inability to keep cargo in place? Shall we talk about the
quality there?
Or would you like to talk about the quality of the
Dreamliner?
Mr. Muilenburg. Congressman, I agree that we have----
Mr. Garamendi. You got a problem.
Mr. Muilenburg. We have had some improvements to make on
quality.
Mr. Garamendi. You have a systemic problem in your company.
You are reaching for profit, which, incidentally, was very,
very significant in 2018. Was it not? Fifteen billion dollars
of cash, plus a significant increase in the profit.
You are driving profit, you are not driving quality, and
you sure as heck are not driving safety.
Mr. Muilenburg. Congressman----
Mr. Garamendi. I just gave you three examples.
Mr. Muilenburg. Congressman, I disagree with your premise.
Our business model is safe airplanes. That is the only
sustainable business model for Boeing. We work in a long-cycle
business. It takes 5 to 10 years to bring a new product to the
market. When those products come to market, they are typically
used by our customers for decades, both military and commercial
customers. The only sustainable business model for our company
is safety. That is what we are built on. That is why we have
lasted 103 years.
Mr. Garamendi. Yes, well----
Mr. Muilenburg. That is why we are the only U.S. builder of
big, commercial airplanes remaining today.
Mr. Garamendi. Three of your principal product lines--the
MAX, 737 MAX; the KC-46; and the Dreamliner--all have quality
issues. They certainly all--certainly the case of the MAX, they
have a serious safety issue. And I would posit the reality that
you are pushing profits over quality and safety.
And those three examples of three of your main product
lines--and I see I am out of time, so I have to yield back.
Mr. DeFazio. I thank the gentleman. And now I would turn to
Mr. Mitchell.
Mr. Mitchell. Thank you, Mr. Chair. We are talking about
346 lives here. And we refer to it as an accident. It is not an
accident. It reflects a failure. It reflects multiple failures.
And I think we need to stop talking about accidents. It is a
tragedy. Accidents are mistakes on the road that people make, a
bad choice, and it is a fender-bender. This is far from that.
Safety begins at design. That is where it starts. I met
individually with the FAA, the safety people there. I have met
with some of your folks, as you are well aware. And here is one
of the things that troubles me. The word ``assume'' was used
way too often for my comfort level.
I was CEO of a business much smaller than yours. We didn't
build aircraft. Making assumptions, we know the old saying
about assume--I won't use it here, but we know what it means.
You talk about changing your culture. I challenge the FAA
to change how they approach thinand when they are dealing with
assumptions, they have a separate team, what I will refer to as
a red team, or something, to test the assumptions. The worst
thing in the world are assumptions.
You have talked about restructuring your team and what you
are doing with safety. Who is going to test assumptions in your
organization, given the assumptions killed people?
Mr. Muilenburg. Congressman, that is a responsibility that
I count on for--what we call our engineering function. So, as
we have recently announced, we have realigned all of our
engineers to report directly to chief engineer, as opposed to
the programs----
Mr. Mitchell. Let me stop you, because time is limited. I
appreciate it.
But you are--unless you have a separate group doing that
independently, outside of the other decisionmaking--you--
literally, there is pollution there. There is impact on that.
They have got to do it totally independently. How are you doing
that? Or are you doing that?
Mr. Muilenburg. Congressman, in addition to the realignment
internally, typically, in all of our design programs we bring
in external experts. We often bring in senior advisory groups.
We will bring in what we call nonadvocate groups. Sometimes we
will tap a team from another part of Boeing to do what we call
a nonadvocate review of other parts of Boeing to get cross
checks. So we use resources from a number of different areas.
Mr. Mitchell. I would ask, if you would, that, for the sake
of the committee here, that you explain how it is you are going
to go forward with testing your assumptions under--given--in
light of where we are at now, not how it has been in the past--
what are we going to do about it? Because we have to look
forward. We have to look forward, based upon the experience you
have had.
And I would challenge that assumptions in the FAA, they
assumed MCAS--said MCAS was going to operate in the background.
Well, it certainly didn't when things went awry. And in this
circumstance we had, it wasn't in the background. It was pretty
much in the foreground.
A question for you, an additional question real quickly, if
I can.
The March 4, 2014, slide that was shown earlier about the
commonality between the NG and the MAX, it said 2 days or less
of training would be required. The problem with that is that
MCAS wasn't referenced in the training manual. So it just
didn't matter. Right? It wasn't in the training----
Mr. Muilenburg. Congressman, again, the training was
focused on trying to respond to the effects of a failed MCAS,
which is what we call a runaway stabilizer----
Mr. Mitchell. But that is what we got.
Mr. Muilenburg [continuing]. Training, and that is what is
included in the training, is how the pilot will respond to a
runaway stabilizer.
Mr. Mitchell. Well, that wasn't in the manual, nor was it--
based on talking with a variety of the pilots--was it covered
prior to the Lion Air crash.
So, in fact, they didn't know it was there. How do you
train on something you don't know is there, that hasn't said
upfront, ``Here is what is going to happen under these
circumstances''? How do you train for that? You don't.
Mr. Muilenburg. Congressman, as I mentioned, we--one of the
things we have learned is we need to provide more MCAS
documentation, which we are doing. The intent was that the
training for MCAS was to train on the failure mode, runaway
stabilizer, as opposed to training on--diagnosing the system
itself.
But we have learned that we need to provide more
information on MCAS, and that is what we are doing, going
forward.
Mr. Mitchell. Let me in the last 50 seconds or so I have--I
am not operating on the basis--or I am not--that profit is
somehow evil. I was a CEO of a for-profit company. I don't
believe that that incentivized Boeing to do things that are
adverse. I think you had competitive pressures you were dealing
with from Airbus, and it had impact.
I don't care about your or any of your management team's
bonuses. What you are compensated is up to your board. I will
say, again, it was a much smaller company I was CEO of, but if
I was CEO of a company that I led into--I was responsible for
that was mine, and in this set of circumstances, and I owned 38
percent of the company, I would be submitting my letter of
resignation to the board of directors. Because I am responsible
for it, ultimately.
So one last question. This is a simple yes or no, Mr.
Muilenburg. Have you submitted or offered your letter of
resignation to your board of directors?
Mr. Muilenburg. Congressman, I have not. I am responsible.
These two accidents happened on my watch. I feel responsible to
see this through.
As I mentioned earlier, I grew up on a farm in Iowa. My dad
taught me that you don't run away from challenges. And this is
a challenging situation. My responsibility is to stick to it,
and to help our team work through it, and to get Boeing ready
for the future. I feel a keen sense of responsibility to do
that. And I am confident that that is what we are going to do,
as a company.
Mr. Mitchell. Thank you.
Mr. DeFazio. Mr. Johnson would be next.
Mr. Johnson. Thank you, Mr. Chairman. I would like to
extend my heartfelt condolences to the families affected by
these two tragedies. Looking at the faces of the deceased,
their lively, smiling faces, I am deeply saddened that they are
no longer with you. But my sadness can in no way match the
grief that you must feel. And thank you all for being here.
Mr. Muilenburg, I trust you would agree that the crews of
Lion Air flight 610 and Ethiopian Airlines flight 302 were
faced with multiple alerts and indications during the accident
sequences, correct?
Mr. Muilenburg. Congressman, my understanding of the
accidents is that is correct.
Mr. Johnson. And you would agree that they received air
speed disagree indicators, correct?
Mr. Muilenburg. Congressman, I believe, from what we
understand, they had air speed disagree, as well as other----
Mr. Johnson. Altitude----
Mr. Muilenburg [continuing]. Flight deck alerts occurring.
Mr. Johnson. Altitude disagree indications, correct?
Mr. Muilenburg. That, and also, I believe, stick shaker
alerts, as well.
Mr. Johnson. And you would agree that they received various
other cautions and warnings during that period, correct?
Mr. Muilenburg. Congressman, that is my understanding, yes.
Mr. Johnson. The National Transportation Safety Board
reported in October, in reference to these tragedies, that
``multiple alerts and indications can increase pilots'
workload.'' Do you agree with that statement?
Mr. Muilenburg. Congressman, yes, that statement makes
sense. Yes.
Mr. Johnson. And the NTSB further observed that ``industry
experts generally recognize that an aircraft system should be
designed such that the consequences of any human error are
limited.'' Do you agree with that statement, as well?
Mr. Muilenburg. Congressman, I believe that is consistent
with our design approaches, yes.
Mr. Johnson. And the NTSB went on to note that ``the
industry challenge is to develop airplanes and procedures that
are less likely to result in operator error, and that are more
tolerant of operator errors when they do occur.'' Do you agree
with that statement?
Mr. Muilenburg. Congressman, I think that is one area where
we have learned from both of these accidents, is an area that
we need to revisit some of our longstanding principles and
design guidelines around that. I believe that is an important
area for us to address, going forward.
Mr. Johnson. So you would agree that, in terms of the
design of the 737 MAX and the 730 MAX, MCAS and angle-of-attack
sensing systems were not designed such that the consequences of
human error were limited. You would agree with that, correct?
Mr. Muilenburg. Congressman, on the MCAS, as we said, we
have identified some areas where we need to improve. And it is
related----
Mr. Johnson. That is one of them, correct?
Mr. Muilenburg [continuing]. To pilot workload.
Mr. Johnson. That is one of them, correct, the sequence
that was not designed to accommodate--well, let me put it like
this.
In other words, you would agree that the 737 MAX's MCAS and
angle-of-attack sensing systems were not designed such that the
consequences of any human error were limited. You would have to
agree with that statement.
Mr. Muilenburg. Congressman, again, from that standpoint,
we designed the system to longstanding industry standards. But
one of the----
Mr. Johnson. But it was----
Mr. Muilenburg [continuing]. Things we have learned from
these accidents is we need to change----
Mr. Johnson. This one was not designed so as to accommodate
the possibility of human error, in terms of dealing with the
MCAS system.
But let me move on. The company has indicated in court
filings that you intend to try to stop all litigation in the
United States, and ensure that, as far as the Indonesian crash.
Any litigation would be confined to Indonesia, and not in the
court system of the United States. Correct?
Mr. Muilenburg. Congressman, I can't comment on that. I am
just not familiar with the details of that.
Mr. Johnson. Well, so are you here to say that your company
would not take efforts to protect itself from the U.S. court
system, insofar as the victims of these air crashes are
concerned? You trying----
Mr. Muilenburg. Congressman, if I could take that question,
we will get back to you. I don't know the answer.
Mr. Johnson. Well, you are attempting to settle things out
of court with a $100 million fund available for claimants.
Correct?
Mr. Muilenburg. Congressman, I believe the $100 million
fund that you are referring to is one that we recently set up
that is completely separate from any legal proceedings. And it
is being administered by Mr. Feinberg. That is intended to be
completely separate from any legal proceedings, with the idea
that we can more quickly assist the families and communities.
So I believe----
Mr. Johnson. Participation in that system caused the
aggrieved individual's family, next of kin, to then waive their
ability to go to court later?
Mr. Muilenburg. Congressman, the $100 million fund that you
are referring to, if I am understanding what you are referring
to----
Mr. Johnson. Yes.
Mr. Muilenburg [continuing]. Is completely separate from
any legal proceeding.
Mr. Johnson. Participating in the $100 million fund would
not bar them litigation thereafter?
Mr. Muilenburg. That is correct. They are completely
separate.
Mr. Johnson. Thank you.
Mr. DeFazio. However, I will say, Mr. Muilenburg, I am
incredulous that you don't know whether or not your company is
attempting to avoid the U.S. courts for liability regarding
Lion Air. Seriously? You don't know that, as a fact? You know
nothing about that? You know nothing--that would seem to me it
would be a pretty damn big thing. Like, U.S. courts--oh, let's
go over to Indonesia.
We go through this with the maritime industry, where
mariners on these foreign-flagged ships aren't allowed access
to U.S. courts. And you are telling me that this--you are not
aware of your legal strategy regarding Indonesia? You really
aren't?
Mr. Muilenburg. Congressman, I am not familiar with that
strategy. I do have a legal team with the responsibility----
Mr. DeFazio. Well, I----
Mr. Muilenburg. Congressman, my focus has been on safety.
Mr. DeFazio. Yes. Well, we will get back to that.
With that, Mr. Palmer.
Mr. Palmer. Thank you, Mr. Chairman.
Mr. Muilenburg--and, Mr. Hamilton, you may want to comment
on this--but the Indonesian Government's final accident report
identified nine contributing factors that resulted in the crash
of Lion Air flight 610. One of those factors was the absence of
guidance on the MCAS, or more detailed use of trim in the
flight manuals and the flight crew training that made it
difficult for the flight crews to properly respond to the
uncommanded MCAS.
And I bring this up in the context that it was reported
that, after the initial certification--and I guess this was
discovered, obviously, after the plane was certified--that the
adjustment in the horizontal tail was greater by a factor of 4
than what was certified. Can either of you address that?
Mr. Hamilton. I think you are referring to the MCAS
authority with low speed versus the high speed. So originally,
we did wind tunnel testing back in 2011, and determined we were
going to need to do something for the handling characteristics
for high-speed windup turns. And that is where we developed the
original MCAS.
During flight testing in 2016 we identified that there was
some additional work we had to do to satisfy for low speed. And
that is where we used the MCAS, to address that.
There is a difference in the authority, but that is
partially because, when you are going low speed, you need to
move the stabilizer a little bit more to get the pitching
moment you need to address the handling quality.
Mr. Palmer. Well, my----
Mr. Hamilton. But that was all part----
Mr. Palmer. My question here is, in the training--according
to what the Indonesian Government found--was the training based
on the original certification, or did it take into account both
certifications?
Mr. Hamilton. So----
Mr. Palmer. Were the flight manuals and the crew training
adequate to address both situations?
Mr. Hamilton. Yes, sir. We were open and transparent with
the FAA on the authority between the high speed and the low
speed, all the way through the certification development. And
they understood that prior to certification. And the decision
on----
Mr. Palmer. That is not the question. The question is did
you provide adequate, detailed instructions for both situations
for----
Mr. Hamilton. When we were having conversations with the
FAA about what should be in the training manual, we were
accounting for both the high speed and low speed, yes.
Mr. Palmer. But was it adequate?
Mr. Hamilton. We believed it was sufficient, as Mr.
Muilenburg has said, because we wanted to train pilots on how
to react to the behavior of the airplane, regardless of what is
causing it. And a runaway stabilizer is a memory item that we
expected crews would be able to react to and take action.
We have learned since these accidents that we need to take
further action.
Mr. Palmer. There is also some criticism that has been
reported about the fact that Boeing tends to use the same
design for planes, rather than build a new plane. And in the
case of the 737 MAX, you were basically using an old design
and--that required the MCAS system, because you used larger
engines and moved them more forward on a plane. Is that also
accurate?
Mr. Hamilton. We evolved the 737 family through the years,
but we have also updated the safety requirements that it is
certified to through the years.
And it is not uncommon, as you are developing a new type
design airplane, that you find things in flight tests and have
to make a software change, or some other control law change to
address that.
Mr. Palmer. Yes. But more specifically, you were in the
process of a totally new design. And these were on parallel
paths, weren't they, for this 737 MAX? You--I mean it--that is
what has been reported, I believe.
Mr. Muilenburg. John, you referenced the early trade
studies?
Mr. Hamilton. Yes, the early trade studies were--we were
looking back in 2007 of reengining, and also looking at a
brandnew airplane. And those were both being developed and
looked at, and we made a decision back in 2011 to proceed
forward with the----
Mr. Palmer. OK. Was the decision based on what is the best,
safest design, or based on what you could get to market?
Mr. Hamilton. You know----
Mr. Palmer. In a timely manner.
Mr. Hamilton. Safety guided the decision. And, you know,
pilots fly the family of airplanes. And, from a safety
standpoint, it is important that crews are able to transition
from one airplane to the next without having to think about
``Am I in a MAX or an NG?'' They want them to feel and operate
the same way. And that is----
Mr. Palmer. Well, that is a matter of time.
Mr. Hamilton [continuing]. The highest safety issue.
Mr. Palmer. And training. That is a matter of time and
training.
I want to say this, that--hearing some of the questions
that have been directed toward you today, I do not think that
Boeing in any way intends to produce an unsafe product. I do
think, though, having worked in engineering, mistakes are made.
I think sometimes people make decisions that have very bad
outcomes. And I think that might be an issue here.
I have children who fly. I fly every week. And I think
everybody in this room probably flies in a Boeing product. And
when they put on that seatbelt, they want to know the plane is
going to take off safely, fly safely, and land safely. And that
ought to be the sole point of this hearing. Retribution and any
other thing that comes after that, I think, will be handled in
the courts of law. But from the perspective of transportation
safety, we want safe planes.
I yield back.
Mr. DeFazio. I thank the gentleman.
Mr. Muilenburg, this took me 30 seconds with a Google
search. June 10th, Business Insider: ``The company is arguing
for the cases to be moved from the U.S. to Indonesia.'' And you
would have us believe that you are not aware that your legal
team--they are so far distant from you, you don't talk to them,
this hasn't been discussed on the board?
You know, my wife was the risk manager for the city of
Eugene, Oregon, for a long time. She had to pay the claims.
When a big claim came, just a couple of million bucks, against
the city, she was involved, the city manager was involved, the
legal team was involved, everybody was involved.
You are looking at hundreds of millions, billions of
dollars of claims you are trying to move to a country, and this
expert says having a trial in another country with a different
legal--less scope for close scrutiny of Boeing would render the
cases worthless. And you don't know that that is happening,
that you are making that pleading?
Mr. Muilenburg. Congressman, I am aware of those articles.
But as I stated earlier----
Mr. DeFazio. OK.
Mr. Muilenburg. I am not----
Mr. DeFazio. Would you then please----
Mr. Muilenburg. I am not----
Mr. DeFazio [continuing]. Tell us--would you please respond
to the committee after you consult with your lawyers? Have they
filed to move these cases to Indonesia in any court in the
United States, or do they intend to?
Mr. Muilenburg. Mr. Chairman, we will follow up with that
information.
Mr. DeFazio. Thank you.
Ms. Titus?
Ms. Titus. Thank you, Mr. Chairman. Well, like my
colleagues, I have been concerned about some of the text
messages and emails that have come out in the documents for
this case, especially some of those by your chief technical
pilot. I believe his name is Mark Forkner. So let me ask you
about those.
As I understand it, Boeing has nearly 5,000 737 MAX orders
pending. Is that correct?
Mr. Muilenburg. Congresswoman, I believe we have 4,400
aircraft in backlog.
Ms. Titus. And many of those are to airlines that operate
outside the United States.
Mr. Muilenburg. The majority of the backlog is outside of
the United States, yes.
Ms. Titus. Well, I want my constituents to feel safe,
whether they are getting on one of your planes in Las Vegas or
Las Palmas. So let me ask you about some of these emails that
Captain Forkner sent.
We know that he sent these at the same time that he was
discussing some of the concerns about the MCAS system. He talks
about flying around the world--and this is a quote--``Jedi
mind-tricking'' foreign customers into purchasing your
aircraft. I am not quite sure what Jedi mind-tricking is, but
he uses it frequently.
In one of the emails he says, ``It is 6:30 a.m. here. Just
getting ready to hit breakfast, then try and Jedi mind-trick
these people into buying some airplanes!''
Here is another one: ``No, I have been working to certify
the new 737-8 MAX with all the regulators all over the world,
led by the AEG. It was a huge deal, but I got what I wanted, at
least so far. You know me, I usually get what I want.''
Then a little later he says, ``Things are calming down a
bit for my airplane cert, at least for now. I am doing a bunch
of traveling through the next few months, simulator
validations, Jedi mind-tricking regulators into accepting the
training that I got accepted by FAA.''
So I would ask you what Jedi mind-tricking is, and, if--
given these comments, would it be fair to state that your
company misled foreign regulators to get your aircraft
certified?
Mr. Muilenburg. Congresswoman, I am not quite sure what Mr.
Forkner meant in those emails. We haven't been able to talk to
him, given he has departed the company and has legal
representation. But any thought that we would try to trick
customers or deceive customers is just not consistent with our
values. And that would not be tolerated.
So I am not sure what he meant, but that is not our
approach.
Ms. Titus. Well, what is your approach when it comes to
international customers? What do you think is your
responsibility, especially those that have less stringent pilot
training requirements, when you sell a new aircraft abroad?
Mr. Muilenburg. Congresswoman, we work with regulatory
authorities around the world. So typically, those decisions are
made by the authority in that jurisdiction. And we, with the
FAA and other regulators, support that.
We also work with the airlines in those other countries.
And together we work on training standards. Ultimately, those
are decisions that are made by the regulatory authority in that
jurisdiction.
Ms. Titus. Well, since that captain is no longer with you,
have you kind of changed or modified in any way your engagement
with foreign regulators, or are you still just using the Jedi
mind-tricking approach?
Mr. Muilenburg. Congresswoman, I appreciate your question.
I can tell you, again, I am not quite sure what Mr. Forkner
meant, but that does not represent the people of Boeing. It
does not represent the people who work with our international
regulators.
Ms. Titus. And you are not trying to Jedi mind-trick us
here today on this committee?
Mr. Muilenburg. Congresswoman, I am telling you the truth.
Ms. Titus. Thank you. I yield back my time to the chairman.
Mr. DeFazio. I thank the gentlelady. There is little time
remaining. I am a ``Star Wars'' fan, so I know what Jedi mind-
tricking means. Perhaps you watched ``Star Wars,'' too.
But here is one other observation I would like to make. We
have brought up your $15 million bonus after the Lion Air
tragedy, and Boeing has established a fund of $100 million. And
I just did the math. That means that each of the 436 families
would receive 1 percent of your compensation that you got last
year. You know, that does not seem to be--you know, and--but
you are telling us there have been consequences, you are
responsible. And yet, these families will get 1 percent of what
you got paid.
And you talk a lot about your upbringing as a farm boy. I
appreciate that. I grew up a little different. My dad was a
teacher. He ran a camp for inner-city kids in the summer. I
carried golf clubs for rich people. You are no longer an Iowa
farm boy. You are the CEO of the largest aircraft manufacturer
in the world. You are earning a heck of a lot of money. And so
far the consequence to you has been, oh, you are not chairman
of the board any more. I don't know what extra bonus the
chairman gets. I know the members of the board get one-quarter-
million bucks a year.
So I haven't seen, convincingly, that there have been
consequences, except one guy got fired and the chief, the
leader of the 737 program, retired in disgust because he
wouldn't want to put his family on the airplane.
With that, who am I recognizing? Mrs. Miller.
Mrs. Miller. Thank you, Chairman DeFazio. And to all of
you, my heart absolutely goes out to you. Having lost a family
member in a horrible crash, while it was not an airplane, I do
know the consequences to children that don't have a parent, and
spouses that are missing their loved ones. And it is so hard.
And my heart does go out to you.
Also, I think it is very important that safety and quality
should always be the highest priority for airline
manufacturers. We need to be prepared if technology fails us.
With the new technological advancements in all of our
industries, it is a possibility that one day there might be a
time when we have to decide whether to put our faith in our
training and our intuition, or on a machine. Millions of people
fly every day. And while there is new technology in the
aviation industry, it is critical that pilots be prepared if a
mechanical problem occurs.
With that being said, as we move forward into the future,
it is of the utmost importance that we continue to advance and
perfect technology before introducing new equipment into the
market. We can support innovating and new technology as an
added benefit, but we also cannot overlook safety, efficiency,
or quality in the aviation industry.
Restoring confidence in air travel is not a political
issue. It is a societal issue. Our world has become so much
smaller, once we were able to fly. And it is imperative that
the airline manufacturers perfect new technology and guarantee
safe, flawless, and exceptional airplanes.
Mr. Muilenburg, can you quickly walk us through the safety
assessment evaluation Boeing conducted for the MCAS?
Mr. Muilenburg. Congresswoman, I will attempt to do that.
John will be more familiar with the details.
Mrs. Miller. Well, do it together, if you need to.
Mr. Muilenburg. We conducted our typical safety review
boards and safety system analyses as part of that development.
So safety is one of the core parameters that we look at
throughout the design, test, and certification process. And
that ultimately leads to the certification by the FAA. So that
was a very disciplined process, consistent with our normal
procedures.
I don't know, John, if you want to add detail to that.
Mr. Hamilton. Any time we bring forward a new system or
something to that effect we do a failure effects analysis of,
when something is going to fail, what is the effect of that.
We separately then do a fault hazard assessment, where we
then look at all the different faults, and we make an
assessment based on what is the hazard category, per
regulations.
Then we build a fault tree, which is a top-down look at
what is the probability of these events happening. And, again,
this is all built to meet regulations.
And then we put together a system safety assessment, which
culminates all the information from these different actions,
and that is the compliance deliverable that we submit to the
FAA for----
Mrs. Miller. Did Boeing evaluate pilot response to
erroneous MCAS activation?
Mr. Hamilton. Yes, we evaluated, if the MCAS operated
uncommanded, what the pilot response would be.
Mrs. Miller. Did it also show if it could trigger other
alarms?
Mr. Hamilton. We considered that in the analysis.
Mrs. Miller. OK. In your testimony, Mr. Muilenburg, you
mentioned your dedication to safety and culture, and the time
you spent traveling to visit different Boeing teams. How can we
restore confidence in our air travel, and guarantee industry
transparency and communication from top to bottom?
Mr. Muilenburg. Congresswoman, I believe those changes
start with us: my company, myself, and our structure. I
mentioned a number of changes we have made internally around
safety structures: a new safety organization, a new board,
safety committee, realigning our engineering workforce. Those
are all actions we are taking to increase focus on safety, and
increase transparency. And I believe that is part of rebuilding
confidence.
We are also paying close attention to all the independent
reviews that are being done, the Government reviews, any other
actions we might take together to improve the certification
process. I think those are actions that will help, as well.
And then, frankly, we still have a lot of work to do to
rebuild the public's trust. And we are going to make sure that
the changes we are making to the MAX today will prevent
accidents like this from ever happening again. That is our
focus. And it is going to take time to rebuild the public's
confidence, once we get the airplane back up for the fleets.
And we are going to be working side by side with our airline
customers, and side by side with the flying public to help
rebuild that confidence.
Mrs. Miller. Thank you. I yield back my time.
Mr. DeFazio. I thank the gentlelady.
Mr. Lowenthal?
Mr. Lowenthal. Thank you, Mr. Chair. And I, too, join with
my colleagues in offering our sympathy and our concern. And, as
Representative Graves said right at the beginning of this
hearing, this is all about you, the people. I can't imagine
what you are going through, but I am so glad you are here to
keep us focused that it is all about the people who have been
impacted.
So my questions, or my concerns, Mr. Muilenburg, really
have to do with the certification process. You know, the JATR,
that report, the technical review, found that, despite
significant advances being made since the MAX was originally
certificated in 1967, these advances, which have led to
significant improvements in the safety of air transportation,
the MAX failed to incorporate many of these designs and
technology advancements, as they were deemed impractical.
What is the reason Boeing failed to include the latest
safety features in the MAX, like those Boeing included in other
aircrafts like the 787 Dreamliner?
Mr. Hamilton. Congressman, I want to take an attempt at
that.
So, as we are developing a product--and again, I want to go
back to--one of the biggest ways we can have safety is--the
pilots to be able to transition from one airplane to the next
and not have to have a big difference. Whether it is the crew
alerting system, or how the systems operate----
Mr. Lowenthal. So what you are--excuse me. So what you are
saying is you did not include these improvements because it was
difficult for the pilots to transition?
Mr. Hamilton. It is not a question of if it is difficult.
It is we want the crews to not have to think about which model
they are in, so that they are--the training that they have gone
through applies to either model, and they handle each airplane
exactly--because the--when you walk on the airplane, you want
the pilots to be comfortable flying that product.
Mr. Lowenthal. So the question is, then, as you point out,
this is an aircraft that was originally certificated--certified
in 1967, has not had a full certification since, and the reason
had to do with the ease in which pilots could move between
different aircrafts of the same family.
I want to go on. The JATR report found that there were no
Federal criteria for determining ``when the core attributes of
an existing design make it fundamentally incapable of
supporting the safety advancements introduced by the latest
amendments to airworthiness standards.''
So for the FAA, they don't have a Federal criteria when you
have to go to a full assessment versus this. What criteria does
Boeing use to decide when it is time to upgrade the original
design and have a recertification?
Mr. Hamilton. So, Congressman, there is actually
regulations in part 21 of the FARs that defines when you need
to do a new type cert, versus an amended type cert. And we
follow that process. We have conversations with the FAA about--
--
Mr. Lowenthal. Well, the FAA has no specific standard. You
are saying Boeing just follows that the FAA--what the FAA--
there is no specific criteria that you use, independent of the
lack of standards that the FAA actually specifies?
Mr. Hamilton. We follow the FAA regulations on new types
of----
Mr. Muilenburg. The standard you just mentioned.
Mr. Hamilton. Yes.
Mr. Lowenthal. OK. Last question. So I am very unclear on
what that answer means.
The JATR report also found that the requirements of an
amended type certificate certification process, like the MAX
went through, focuses only on change and areas affected by the
change, which may fail to recognize the whole aircraft system
which could be affected by seemingly small changes. Do you
agree with the assessment by the JATR report?
Mr. Muilenburg. Congressman, we are taking a look at all of
the recommendations from that report. I believe there are 12
recommendations that are being considered. And one of those
areas is this systemwide analysis----
Mr. Lowenthal. Right.
Mr. Muilenburg [continuing]. Failure mode analysis. And we
have identified that as a potential area for improvement, going
forward. So that is an action that we look forward to
supporting, and making appropriate changes. I think it is an
area worth looking at.
Mr. Lowenthal. So your--you have not--or you are looking at
the report--decided how in the future aircraft designs that
seek to fall under an amended type certificate, rather than a
new type certification--you are discussing, and you will be
looking at when an amended type or a full certification is
going to be needed?
Mr. Hamilton. We look forward to working with the FAA and
the rest of the industry on any changes that may be required to
part 21 on when you apply for one, versus the other.
But you know, the amended type cert is still--you upgrade
to the later amendments, later safety requirements, as you make
changes to the airplane. So I just want to imply that, you
know, the MAX--the requirements that the MAX is certified to,
even though it is an amended type cert, it is meeting some
later safety requirements than earlier versions of the 737.
Mr. Lowenthal. And--thank you, and I yield back.
Mr. DeFazio. Oh, well--Mr. Brown?
Mr. Brown. Thank you, Mr. Chairman. First, let me offer
my----
Mr. DeFazio. I don't know.
Mr. Brown [continuing]. My condolences to the families,
friends, the communities of the 346 men, women, and children
who lost their lives in this tragedy.
Mr. Muilenburg, I believe that you are sincerely sorry, as
well. I also know that you wake up every day with the
responsibility and the accountability for a large organization.
And while your values may be on safety, often in a large
organization there are interests like profits, and production
rates, promoting that product, and also personal incompetence
among the 150,000 people. Not all of them are the most
proficient and competent. And those factors can eat away at
times at your ability to achieve that most important value of
safety.
Mr. Muilenburg, according to the Indonesia Air report,
during discussions and communications with the FAA beginning in
March 2016, Boeing proposed removing MCAS from the flight crew
operator's manual and differences tables, and you have been
asked about that. That has been brought to your attention.
I too am a pilot. I flew in the Army. A much simpler
airframe, never a commercial aircraft. And what I valued was
information, the operator's manual, even technical manuals. My
emergency checklist, which is a quick reference handout. It is
all important information. Sometimes I would look and I would
say, ``It is a lot of information,'' but I knew it was my
professional responsibility to prioritize that information.
And my concern here is that Boeing did not give the pilots
the information that they needed. And what makes it
particularly troubling is sort of like the environment in which
this is happening. And a lot of this has already been raised
and brought to your attention.
An environment in which your chief technical pilot talks
about Jedi mind tricks to convince regulators to accept a lower
level of training, I don't know what a Jedi mind trick is, but
I know what a trick is. And it is particularly troubling when
Boeing has the expertise, you have the data, far superior to
what the regulators have, and the chief guy on your team that
is interfacing with the regulator is playing tricks to
negotiate down training levels, coupled with the fact that--and
as the chairman put on the screen, your promotional material as
you build your 737 MAX fleet.
Millions of dollars will be saved because of the
commonality with the next generation 737, rebates and contracts
with Southwest. If you don't have to use a simulator, which is
much more expensive to train a pilot, if you have to use a
simulator, a $1 million rebate on the airframe. So this is the
environment that we are observing in Boeing, and it questions
whether or not that profit and promotion is undermining safety.
I want to ask you this question. Mr. Cohen was asking you
about--from the same line--Indonesia Air report: ``Boeing also
considered that the procedure required to respond to any MCAS
function was no different than the existing procedures and that
crews were not expected to encounter MCAS in normal
operation.'' I don't want to ask you about the normal
operation; Mr. Cohen did.
Existing procedures, that is the runaway----
Mr. Hamilton. Runaway stabilizer.
Mr. Brown [continuing]. Stabilizer trim.
Mr. Hamilton. Yes.
Mr. Brown. But they are not the same procedure, are they?
Mr. Hamilton. No, it is a common procedure between the NG
and the MAX.
Mr. Brown. When you have an MCAS failure, it is not really
a failure. But when the MCAS is defective, it is not the same
emergency procedure as a runaway stabilizer trim.
Mr. Hamilton. Actually, when it--when the MCAS were to
fail, or if a motor were to fail, there is various causes of
runaway stabilizer----
Mr. Brown. OK, let me ask you this. Stabilizer trim fails.
I can use a manual trim button, or I can control the column.
And if it is a true runaway stabilizer trim, I won't be able to
disrupt that failure. Is that correct?
Mr. Hamilton. No. With a runaway stabilizer, you can--as
you say, you can counter it with the----
Mr. Brown. If I counter it, and I don't get the result that
I want, then I go to the cutoff. Is that correct?
Mr. Hamilton. You go to the cutoff procedure.
Mr. Brown. Right.
Mr. Hamilton. Yes.
Mr. Brown. However, with the MCAS failure, I can actually
interrupt the stabilizer trim failure. Isn't that correct?
Mr. Hamilton. That is true.
Mr. Brown. Because it happened 15-plus times in the
Indonesia Air, didn't it?
Mr. Hamilton. Yes, the----
Mr. Brown. Right. So you are saying that you don't put it
in the documentation because the emergency procedure is the
same. But, in fact, it is not.
And what I am wondering is, when you look particularly at
the Indonesia Air, the very first time that the MCAS fails is
when the flaps go to zero, full retraction. And you provided no
information in any of these manuals that said, hey, you know
what, when you go to full flap retraction, you are activating
this new system.
Isn't that right, that there is nothing in the manuals that
tells a pilot when they have activated the system? Is that
right?
Mr. Hamilton. That was correct, and we are making changes
now to add that material to the training manual and the
operations manual----
Mr. Brown. And the MCAS was probably the first computer,
right, software system that manipulated a primary flight
control in the 737. Isn't that right? The first--not a pilot-
induced flight control, change in a flight control, the first
computer software system that actually manipulated a primary
flight control. That is MCAS, isn't it?
Mr. Hamilton. Well, actually, the auto pilot that----
Mr. Brown. OK, OK, OK. Everyone knows the auto pilot. Aside
from the auto pilot, right? Isn't that right? MCAS was the very
first computer software that actually manipulated primary
flight control?
[No response.]
Mr. Brown. Yes or no? Or you don't know? Chief engineer?
Mr. Hamilton. I guess, with the words you are using, I
would say that the auto pilot does satisfy that.
Mr. Brown. OK. Second, then, would be--the MCAS would be
the second one, right?
Mr. Hamilton. There is a yaw damper function on the rudder
that moves independent of the pilots.
Mr. Brown. Do you have--in the quick reference handbook, do
you have a procedure for addressing a failure in that?
Mr. Hamilton. I----
Mr. Brown. You probably do.
Mr. Hamilton. I would have----
Mr. Brown. You probably do. But you don't have it for the
MCAS. That is the--as a pilot, you didn't give them the
information they needed.
Mr. Muilenburg. Congressman, as we said, that is one area
where we have learned, and we are coming back, and we are
adding that information to the manual.
Mr. Brown. Thank you, Mr. Chairman.
Mr. DeFazio. Mr. Mitchell?
Mr. Mitchell. Thank you, Mr. Chair. Boeing and Boeing
aircraft is an iconic brand in this country. I have been asked
by a number of constituents and people, ``Will you fly the 737
MAX? Will you take that flight?''
I will say publicly I will--given the scrutiny, I will fly
it as soon as it is allowed to go back in the air, because I
believe it will be the most scrutinized aircraft in the history
of this country.
I do want to talk to you a little bit about some of the
continuing questions that Mr. Garamendi had. Boeing's tanker
they are supplying to the military, it has some significant
issues. However, when a similar system was put on it to the
MCAS, the Pentagon required that it fire only once. Only once.
Why on the 737 MAX was another approach taken, where it
could--and did--fire repeatedly? As my colleague says,
significantly, what was the--why the difference in approach,
given a similar issue with the aircraft, or similar concern
with the aircraft?
Mr. Hamilton. So the MCAS was--again, it was designed for--
as you approached a stall. When pilots do fly into stall,
oftentimes they may overcorrect and fly back into a stall. But
it was intended that, if you were in a stall condition, and----
Mr. Mitchell. Let me stop you. I understand stall. I am--
had flight instruction, I understand. But you haven't answered
my question.
Why the difference between the tanker, where the Pentagon
required it only fire once--that was the criteria put forth as
they are going through the--taking that aircraft--and the
commercial aircraft had a repeated and, in fact, accentuated--
you changed the standard on it, it went to a more powerful
motion. Ultimately, why the difference? What motivated that?
Mr. Hamilton. Well, the Air Force set some of the
requirements for the tanker that we followed.
Mr. Muilenburg. Congressman, if I could just add----
Mr. Mitchell. Sure, please.
Mr. Muilenburg [continuing]. Add a bit to that. John is
correct. The concept behind MCAS on the tanker was for a
different purpose, a different part of the flight envelope, as
I understand it. We can provide additional details on that, but
the reason the design requirements are different is that it was
designed for a different part of the flight envelope, and for a
different handling qualities purpose. But we will----
Mr. Mitchell. I appreciate that----
Mr. Muilenburg. If we could follow up with the details, we
will.
Mr. Mitchell. I would appreciate that. But I think, just to
be honest about it, I think we may--we, collectively, the FAA
and Boeing, made an error in understanding where it would apply
in the flight envelope, in terms of the MCAS, because it
clearly occurred within the flight envelope, and it occurred
catastrophically. So we are back to my earlier question about
assumptions, because they failed.
Question two for you. When doing the simulator testing, I
saw some documentation that it wasn't possible to simulate no
angle-of-attack data or flawed angle-of-attack data to test
pilot response, that, in fact, it wasn't included as part of
the simulator. So, therefore, there was no way to figure out
whether 4 seconds would work, or 10 seconds, never mind all the
other things that may happen.
Can you shed some light on that?
Mr. Hamilton. Yes. When we evaluated the MCAS failure, we
did not actually input a faulty AOA sensor input, because the
simulators didn't--couldn't simulate that. But we simulated the
actual MCAS failure.
Mr. Mitchell. Well, let me ask you a question.
Mr. Hamilton. We have subsequently----
Mr. Mitchell. I understand----
Mr. Hamilton [continuing]. Gone forward and actually
updated the----
Mr. Mitchell. Let me ask you a question. You have got how
many other sensors on the aircraft? Are there any others that
you didn't simulate in order to test the--what would happen, in
terms of aircraft performance or pilot response?
Mr. Hamilton. I can't answer that question off the top, but
we could follow up with you on that.
Mr. Mitchell. I would like you to answer for the committee,
because I am astonished, not only with information which I have
raised, as well, to the pilots, training requirements for the
pilots regarding MCAS.
Then, in fact, in your--it appears to me in your testing
process you didn't test whether or not flawed data from a
single AOA would, in fact, cause catastrophic problems, which,
in fact, it did. They couldn't test it on a simulator. They
didn't see it, because they didn't have it. They had other
problems, but they didn't see that, your pilots, which are more
experienced than some that are flying this aircraft. So I would
appreciate that information.
I will yield back. Thank you, Mr. Chair.
Mr. DeFazio. I thank the gentleman. Just--you did raise a
point that Mr. Hamilton responded to about why the repeated
actuation at a very radical angle, and he said, ``Well,
sometimes pilots tend to overcorrect, and they can fall back
into a stall again.''
Well, that kind of contradicts your whole reasoning that
they are going to figure this all out in 4 seconds and fly
perfectly. I mean I think you have just created something that
goes back to your other study, which said if it takes as long
as 10 seconds, the plane is going in.
With that I would recognize Mr. Espaillat and then
Malinowski.
Mr. Espaillat. Thank you, Mr. Chairman. I first want to
extend my condolences to the families that are here today. My
district suffered a similar tragedy with flight 587 back in
2001, which, unfortunately, went down in Rockaway of New York
City, and I know the kind of hurt that many of you are going
through. So my heart goes out to you, my condolences and
sympathies to you all.
Mr. Muilenburg, the National Transportation Safety Board
recommended that the Federal Aviation Administration develop
standards for improved aircraft system diagnostic tools to help
the pilots better identify and respond to the kind of failures
they met. Will you provide this committee with your absolute
assurance that any future Boeing airplane will include such a
system?
Mr. Muilenburg. Congressman, I am not exactly sure what
system you are referring to. I am familiar with the NTSB
recommendation, and it is one that we are taking a look at. But
there are many----
Mr. Espaillat. And are you committed to following those
recommendations provided by the NTSB to upgrade and improve
your Boeings so that in the future you will not have these
kinds of tragedies?
Mr. Muilenburg. Congressman, we are currently evaluating
those recommendations. We think that topic area is certainly
one we want to look at. We will get into the details, but we--
--
Mr. Espaillat. You cannot give us any assurance whatsoever
that any of those recommendations that are given by NTSB you,
as of today, you are completely sure that you will include them
in any future Boeing production?
Mr. Muilenburg. Congressman, our intent here is to evaluate
all of those recommendations. We haven't completed those
evaluations yet, but any opportunity we have there to improve
safety is certainly----
Mr. Espaillat. And what is the timeline for the evaluation?
When do you think you will be completed with those evaluations?
Mr. Hamilton. Congressman, those recommendations are made
to the FAA. So we will have to work with the FAA on how they
want to move forward with adopting those recommendations.
Mr. Espaillat. There is--from this entire horrible
experience there is not one modification, there is not one
single meritorious change that you will make in the production
of a Boeing as of today, right now?
Mr. Hamilton. Well, I think, as a result of these
accidents, we are making changes to the software of the
airplane, we are making changes to the training, to the
procedures.
Mr. Espaillat. What kind of changes have you made for the
airplanes?
Mr. Hamilton. For the airplanes?
Mr. Espaillat. Yes.
Mr. Hamilton. So we are making three changes to the
software that address the MCAS issue. We are making additional
changes that further address pilots flying towards stall, and
addressing some of those issues, as well.
Mr. Espaillat. Are any of those changes included in these
recommendations by the National Transportation Safety Board?
Mr. Hamilton. I think, when you look at the first
recommendation that talks about the MAX, I think it does
address that first one, yes.
Mr. Espaillat. OK, thank you. My next question, really
quickly, is, Mr. Muilenburg, the Joint Authorities Technical
Review report states that the MCAS ``used the stabilize trim to
change the column force feel, not trim the aircraft . . . and
that this is a case of using the control surface in a new way
that the regulations never accounted for.''
While I understand that you personally maintain that the
MAX was designed and certified to the company's standards, will
you agree that this is an example of where the regulations have
not kept pace with changes in the industry?
Mr. Muilenburg. Congressman, I don't know if I would
characterize it as not keeping pace. It is true that the MCAS
implementation is new and different, and we are evaluating what
lessons learned we have from that.
So again, all of the JATR recommendations are currently
being evaluated, and we are going to take a hard look at all of
them.
Mr. Espaillat. Just let me conclude by saying that I know
that all of this has to be assessed. I remember back when we
had flight 587, the length of time that it took. But there are
particular changes that could be adopted immediately that are
no-brainers, and that these families, I think, deserve to hear
from you with regards to what kind of improvements you will
make.
As passengers may consider getting on a Boeing in the
future, I think it is incumbent upon you to give responses to
these families, and this Congress.
Mr. Hamilton. Yes, so we are making a number of software
changes, as I mentioned, that will prevent the pilots from ever
getting into this situation ever again.
But also, I would tell you that, as the FAA is diligently
going through all the documentation, they are taking lessons
learned from these accidents and applying criteria to us that
goes above and beyond what the current guidance and regulatory
standards are. And so I would say we are working to a higher
level of standard already with that.
Mr. Espaillat. Thank you to both of you.
Thank you, Mr. Chairman. I yield.
Mr. DeFazio. The gentleman--Mr. Balderson is recognized.
Mr. Balderson. Thank you, Mr. Chairman.
First I want to thank the families and loved ones of the
victims that are in attendance today. Your strength does not go
unnoticed by everyone in this room and those watching on TV. So
my thoughts and prayers are with all of you, and thank you so
much for being here.
Mr. Muilenburg, thank you for being here. Following the
grounding of 737 MAX, Boeing stated in a CBS news report,
``Safety and quality are absolutely at the core of Boeing's
values. Speaking up is a cornerstone of that safety culture,
and we look into all issues that are raised.''
When the 737 MAX was being certified, what procedures were
in place to ensure the safety concerns from designers,
engineers, test pilots, or mechanics were properly investigated
and addressed by Boeing?
Mr. Muilenburg. Congressman, in addition to the specific
updates that John well described on software and training,
which are an important part of that answer, we are also making
significant restructuring of how we do our work. We have set up
a new safety organization that will report to a new vice
president, reporting to our chief engineer, creating a direct
line of communication back to me.
We have restructured all of our safety review boards within
the company, so that they are elevated and, again, provide more
ready access, detailed access to safety data. Any safety
concerns that our employees might raise will also come through
this new organization.
That includes setting up an updated anonymous reporting
system. So if we have any employees that have a safety concern,
if they wish to remain anonymous, they can report it up through
that system. That will come directly to me, and it will also
independently go to our aerospace safety committee inside of
our board of directors to make sure all of those get the right
response.
Mr. Balderson. Thank you. My followup would be did Boeing
have a process to ensure these safety concerns or whistleblower
reports were made available to the FAA during its certification
of the plane?
Mr. Muilenburg. Congressman, yes. Our intent is to share
this information. Again, as we gather data, safety concerns are
raised, our intent is always to try to share information with
the FAA. That is----
Mr. Balderson. And I know you have answered some of that,
so thank you.
You have discussed some recent actions from Boeing to
enhance safety. These include having all Boeing engineers
report to Boeing's chief engineer, as well as new anonymous
reporting systems. You just talked about that. Can you provide
more information on how this anonymous reporting system will
work?
Mr. Muilenburg. Congressman, I will be happy to follow up
with the information. It will be modeled after our existing
ethics hotline structure, which has proven to be very
effective. And our intent is to have a similar model here.
Mr. Balderson. OK.
Mr. Muilenburg. And, if helpful, we can provide additional
details on how it is structured and how it works.
Mr. Balderson. Yes, please, thank you very much.
Do you believe it should be mandatory for aircraft
manufacturers like Boeing to immediately provide the FAA with
safety reports or safety concerns that have been filed through
the company's internal channels?
Mr. Muilenburg. John, you could comment on that.
Mr. Hamilton. So we actually have a bulletin board, an
electronic bulletin board, where we take all the fleet data
that comes in, anything that meets the criteria that the FAA
established on reporting to them. We post it to that, they have
total visibility of that.
If we have potential safety issues that--we can post those
to the board, as well. So the FAA then can do an independent
review of that.
Mr. Balderson. OK. Thank you, Mr. Hamilton.
Mr. Chairman, I yield back my remaining time. Thank you
very much.
Mr. DeFazio. I thank the gentleman. Now Mr. Malinowski.
Mr. Malinowski. Thank you, Mr. Chairman.
Mr. Muilenburg, we have been over a lot of this, but just
to be clear, it is fair to say that Boeing pushed the FAA and
regulatory agencies around the world to not require simulator
training to fly the MAX.
Mr. Muilenburg. Congressman, our design objective was level
B training.
Mr. Malinowski. Understood. And, of course, we have been
over the issues with the manual not including information on
the MCAS system.
With all of that in mind, let me ask you, just very simply,
was Boeing aware that MCAS could pose, under realistic, real-
world circumstances, a catastrophic risk?
Mr. Muilenburg. Congressman, as part of that broader hazard
analysis that John described earlier, we evaluate a broad set
of scenarios. And that is included in that system safety
assessment document.
John, is that----
Mr. Hamilton. FHA, FHA.
Mr. Muilenburg. In the FHA?
Mr. Hamilton. Yes.
Mr. Muilenburg. OK.
Mr. Malinowski. OK. Well, we have another slide, I think,
that may be worth looking at, if folks could put it up.
[Slide]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. Malinowski. OK, thank you. This is from a presentation
that Boeing developed for the FAA in December of 2018, after
the Lion Air accident, before the Ethiopian Airlines crash.
And, as you will see, the slide states that if there were the
loss of one angle-of-attack sensor, and the other received a
bad reading, the situation was ``potentially catastrophic
before crew recognition of issue.''
And underneath it states, ``Crew training supports
recognition and appropriate flight crew action.'' And so it
does appear from this and other evidence we have seen that
Boeing understood how important crew training would be to
prevent these kinds of crashes within a month of the first
crash.
And given how quickly Boeing came to that answer, and
before many details of the first crash were available, I have
to assume that you were aware before the first crash, as well.
And yet you actively worked against simulator training. Do you
have an explanation for this?
Mr. Muilenburg. Congressman, I will try to answer that.
And I don't know, John, if you have--you want to jump in on
that?
Mr. Hamilton. So----
Mr. Muilenburg. Go ahead.
Mr. Hamilton. The training that we recognize on this is--
when you transition from an NG to a MAX--you do simulator
training in the original NG training. And that same basic
training would apply here.
If you were new to the MAX, there would be simulator
training that would be required as part of that. And so that is
how that item got addressed.
Mr. Malinowski. Let me also ask you this. Going back a
little bit in time, did Boeing lobby for the provisions in the
2003 aviation bill that established this ODA program, which has
delegated so many of these basic decisions about whether a
plane is safe to fly to industry? Did Boeing lobby for those
provisions?
Mr. Muilenburg. Congressman, I am not familiar with the
details back in that timeframe. But you know, Boeing has been
engaged in the ODA process and discussions over that time
period.
Mr. Malinowski. And it is probably--is it fair to say that,
since that time period, Boeing has vigorously lobbied the FAA,
and lobbied Congress to lobby the FAA to speed up the
certification process?
Mr. Muilenburg. Congressman, we have advocated efficiency
in certification, and trying to do things efficiently across
all the stakeholders where we can provide better interfaces and
exchange of data. So----
Mr. Malinowski. Well, that is----
Mr. Muilenburg. Efficiency in the process has been----
Mr. Malinowski. Very bureaucratic language, but I think
that means yes. And I think it is something worth reflecting
on, because I think this is--there is a larger story here.
There is a reflexive tendency among corporate lobbyists in this
town to always lobby for streamlined and faster provisions, and
less regulation.
And here we have a case--because they see it as in the
company's interest. And here we have a case where 346 people
died, number one, most important. And in terms of the company's
interest, how much money did Boeing lose in the second quarter
of 2019?
Mr. Muilenburg. Congressman, we wrote off billions of
dollars.
Mr. Malinowski. Yes. Can you reflect a little bit on this?
Is this one of the lessons you have learned, that perhaps this
reflexive pattern of lobbying for faster and faster procedures
to make it easier for you to get planes to market is not
necessarily in the company's best interest?
Mr. Muilenburg. Congressman, I have to disagree with the
premise under the question. We never lobby for something that
is going to harm safety. If there are places where we can gain
efficiency, the idea is to always enhance the safety of the
regulatory system. That is our intent. We have no desire to
reduce safety. Our business model is about safe airplanes. And
that is the only sustainable approach.
So I understand the point you are making, but our intent is
to try to be part of the regulatory system that drives safety.
Mr. Malinowski. I yield back.
Mr. DeFazio. I thank the gentleman. We would now go to
Representative Stanton.
Mr. Stanton. Thank you very much, Mr. Chairman.
It is clear that during your tenure, Mr. Muilenburg, the
top brass at Boeing too often put shareholders before safety,
profit before people's lives. And, as a result of the singular
focus in getting the MAX to market as quickly as possible, and
the actions that were taken, and many that were not taken, 346
innocent people lost their lives.
Today we have heard a lot about the MCAS and its role in
these tragedies. The evidence our committee has outlined today
and in the months leading up to this hearing shows that Boeing
did not even follow its own design requirements when it created
this MCAS system and put it on the MAX.
Here is what deeply troubles me: Not only did you fail to
follow your own design requirements for MCAS, but you also went
to great lengths to hide the existence of MCAS from your
customers, and even from pilots, who are absolutely vital to
the safe operation of the MAX.
Mr. Hamilton, you are Boeing's chief engineer. It is your
job to make sure MCAS works properly. I want to ask you a few
questions about Boeing's internal MCAS requirements. Those
design requirements were described in detail in Boeing's own
coordination sheets.
These coordination sheets were updated as MCAS moved
through the design process. But two sheets--one from March
2016, one from June 2018--did not change. Even after Boeing
started using a newer, more powerful version of MCAS, these two
sheets were never changed. Even more than a year after the 737
MAX entered service, there were still no changes.
First slide, please.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. Stanton. I would like to focus on this slide on two
specific design requirements of MCAS.
Design requirement number 4--and you can see it highlighted
on the screen--states, ``MCAS shall not have any objectionable
interaction with the piloting of the airplane.''
My time is short, so I need yes-or-no answers, Mr.
Hamilton. Did MCAS affect the piloting of Lion Air flight 610?
Mr. Hamilton. The crew has always had the ability to
override MCAS with the trim switches on the wheel.
Mr. Stanton. Let me ask it another way. Did the pilots in
the Lion Air flight struggle to counteract the activation of
the MCAS system?
Mr. Hamilton. As the captain was flying the airplane, as
you look at the flight data recorder, the captain continually
trimmed out the MCAS inputs for multiple times.
Mr. Stanton. Did MCAS affect the piloting of Ethiopian
Airlines flight number 302?
Mr. Hamilton. That accident is still under investigation. I
think we will need to----
Mr. Stanton. Mr. Muilenburg, you are the CEO. The buck
stops with you. You are ultimately responsible for making sure
that you adhere to your design requirements. That didn't happen
here, did it?
Mr. Muilenburg. Congressman, again, we have learned some
things from these accidents. We are coming back and we are
updating the MCAS design and the training materials.
As we went through our process, we, at each step, tried to
make the decisions that are consistent with our process and the
data we had. But clearly, we didn't get it all right.
Mr. Stanton. Mr. Muilenburg, are you willing to give a yes-
or-no answer to that direct question? You didn't--that didn't
happen here, did it?
That is really a yes-or-no question. It is a tough
question, but it deserves a fair and direct response.
Mr. Muilenburg. Congressman, I tried to give you my direct
response. It is a complicated question with a----
Mr. Stanton. Thank you.
Mr. Muilenburg [continuing]. An answer that we----
Mr. Stanton. Reclaiming my time, Mr. Hamilton, design
requirement number 11--you can also see it on this slide--it
says, ``MCAS shall not interfere with dive recovery.'' Did MCAS
affect the dive recovery of Lion Air Flight number 610?
Mr. Hamilton. Ultimately, after multiple MCAS inputs that--
--
Mr. Stanton. That was really intended as a yes-or-no
question. You have had plenty of time--it is a tough one, but
it deserves a yes-or-no answer. Did MCAS affect in any way the
dive recovery of Lion Air flight number 610?
Mr. Hamilton. When the MCAS wasn't trimmed out, as we
assumed it would be, it caused the airplane to go into a dive
that the crews were not able to recover from.
Mr. Stanton. Mr. Hamilton, was MCAS a contributing factor
into the dive, as noted in the final accident report released
by Indonesian investigators?
Mr. Hamilton. Yes.
Mr. Stanton. Did MCAS affect the dive recovery of Ethiopian
Airlines flight number 302?
Mr. Hamilton. Yes.
Mr. Stanton. Mr. Muilenburg, as CEO, I am going to ask you
the same question. Did MCAS affect the dive recovery of Lion
Air flight number 610 and Ethiopian flight number 302?
Mr. Muilenburg. Congressman, we know MCAS was a factor in
both accidents, and there were a number of things occurring in
both accidents. We know MCAS was a contributing factor, and we
know we need to make some updates to it, and that is what we
are doing.
Mr. Stanton. Mr. Hamilton, I appreciate your direct answer
to that question.
Did you--this is back to Mr. Muilenburg.
Did Boeing fail to meet your own design requirements, as it
relates to MCAS?
Mr. Muilenburg. Congressman, we are still evaluating
everything we have learned from those accidents. I think what
you see here is that there are cases where we have implemented
against a requirement set where we have learned we need to make
some improvements. And that is what we are doing with the
updates.
Mr. Stanton. It is clear that the design to the MCAS
stabilization system was fundamentally and tragically fatally
flawed. The Lion Air and Ethiopian Airlines tragedies don't
just show the fault of the MCAS design, they also show that the
system did not even meet Boeing's own design criteria.
It is crystal clear to me, through the course of this
investigation, that relinquishing approval of MCAS by the FAA
was a grave mistake with severe consequences.
Safety must be our top priority, and Congress must act. We
owe nothing less to the victims and their families. I yield
back.
Mr. DeFazio. We will now move on to Ms. Mucarsel-Powell.
Ms. Mucarsel-Powell. Thank you, Mr. Chairman. I have been
sitting here, listening to the testimony, and I think that it
is clear to me that so much of what we have heard today, and
also some of the testimony from yesterday, is that, to a large
extent, this is a story about a company cutting corners, taking
shortcuts, sacrificing safety to achieve maximum profits.
And at the end, what is it that we have to show for it?
Three hundred and forty-six lives were lost, due to the
negligence of what happened in those two flights.
Mr. Muilenburg, for me it is very important to focus on the
families of the victims that, as you see, are sitting right
here. I know that the company started the Boeing financial
assistance fund, which provides $50 million in financial
assistance to the families of the victims, and $50 million to
support education and economic empowerment. So, by my
calculation, that comes out to $144,500 to each of the families
of the 346 people that were killed in those two flights.
My question, my first question, have you--did you ever
reach out to the families before Boeing made this announcement
in July, Mr. Muilenburg?
Mr. Muilenburg. Congresswoman, I did not reach out
personally before that----
Ms. Mucarsel-Powell. Thank you. How did you communicate
about this fund with the families, that you had created this
fund for them?
Mr. Muilenburg. Congresswoman, our reach out to the
families is an area where I think we clearly needed to improve.
I feel terrible about these two accidents. And having spent
time talking with the families the last----
Ms. Mucarsel-Powell. But my question is how did----
Mr. Muilenburg [continuing]. Couple of days----
Ms. Mucarsel-Powell. How did you do that? How did you
communicate with the families about this fund?
Mr. Muilenburg. Our Boeing global engagement team reached
out. We had connections back into the--into both the--Ethiopia
and Indonesia, working with our airline customers----
Ms. Mucarsel-Powell. So you never personally reached out to
any of the families.
Mr. Muilenburg. I did not personally. And again, that is
something I regret, and I wish I had done----
Ms. Mucarsel-Powell. Mm-hmm, thank you.
Mr. Muilenburg [continuing]. I had done that earlier.
Ms. Mucarsel-Powell. How did you and how are you now
working with the families to determine the best way to use
these funds?
Mr. Muilenburg. Congresswoman, a couple of things. One, for
the first $50 million that you identified, we have asked Mr.
Ken Feinberg, an expert in this area, to administer that fund.
So he is already, you know, making progress with many of the
families. We will continue that.
On the second $50 million----
Ms. Mucarsel-Powell. And----
Mr. Muilenburg [continuing]. We have engaged with the
families. That was one of the topics of discussion at our
meeting last evening, and we are going to continue that, going
forward----
Ms. Mucarsel-Powell. Thank you, Mr. Muilenburg. And it was
reported in this article that--by CNBC--that the families of
the 737 MAX have only until December 31st, 2019, to file a
claim with Boeing, with the Boeing compensation fund. Is that
correct?
Mr. Muilenburg. Congresswoman, I am not sure if that is the
deadline. But my expectation is that it----
Ms. Mucarsel-Powell. Why put a deadline?
Mr. Muilenburg. Congresswoman, it is not something that I
have----
Ms. Mucarsel-Powell. I mean there are so many families----
Mr. Muilenburg [continuing]. Established----
Ms. Mucarsel-Powell [continuing]. That are here, just
trying to seek basic justice. I want you to take a look at
them, just for 1 second, because, obviously, you haven't spoken
to them.
Mr. Muilenburg. Well, Congresswoman, I----
Ms. Mucarsel-Powell. So I am going to continue, thank you,
Mr. Muilenburg.
Can you assure us today that if these families accept these
funds, they will not in any way hinder anybody's ability to sue
or take any legal action against the company?
Mr. Muilenburg. Yes, Congresswoman. This fund is completely
separate from any legal activities.
Ms. Mucarsel-Powell. So you give me that assurance today?
Mr. Muilenburg. Yes.
Ms. Mucarsel-Powell. Thank you. Now I want to ask for
unanimous consent to introduce this article that I found, ``FAA
Discovers New Safety Concern During Boeing 737 MAX Test.''
Mr. DeFazio. Without objection.
[The information follows:]
Article entitled, ``FAA Discovers New Safety Concern During Boeing 737
MAX Test,'' Submitted for the Record by Hon. Mucarsel-Powell
https://www.washingtonpost.com/local/trafficandcommuting/faa-discovers-
new-safety-concern-during-boeing-737-max-test/2019/06/26/6ebfacf2-9868-
11e9-830a-21b9b36b64ad_story.html
faa discovers new safety concern during boeing 737 max test
By Michael Laris
June 26, 2019 at 7:57 p.m. EDT
The Federal Aviation Administration has discovered a potential
problem connected to the flight control computer on Boeing's 737 Max
jets that, in rare circumstances, could force the plane to dive in a
dangerous, uncontrolled fashion.
Highly experienced FAA test pilots were concerned that they could
not ``quickly and easily follow the required recovery procedures,''
according to a person familiar with the testing who spoke on the
condition of anonymity to discuss the findings Wednesday.
The problem is not the same as the faulty data issue that
investigators say contributed to the crashes of 737 Max planes in
Indonesia and Ethiopia.
In each of those two crashes, investigators say bad information
from an external sensor caused an automated feature known as the
Maneuvering Characteristics Augmentation System (MCAS) to automatically
push the planes' noses down.
In the latest case, the problem ``was traced to how data is being
processed by the flight control computer'' itself, according to the
person familiar with the findings.
The aircraft has been grounded since March.
``The FAA recently found a potential risk that Boeing must
mitigate,'' the agency said in a statement. ``The FAA will lift the
aircraft's prohibition order when we deem it is safe to do so.''
The FAA made the discovery during simulator sessions meant to test
the plane's overall flight control software and Boeing's proposed fixes
to its MCAS feature. Its testing procedures are designed to find and
``highlight potential risks,'' the FAA said.
``Boeing agrees with the FAA's decision and request, and is working
on the required software,'' the company said in a statement.
A company spokesman declined to answer questions about how long it
will take to address the new issue or why Boeing itself had not
discovered the risk earlier.
Boeing said addressing the issue ``will reduce pilot workload by
accounting for a potential source of uncommanded stabilizer motion.''
``Uncommanded stabilizer motion'' is a reference to an automatic
adjustment in the position of the horizontal stabilizer on the plane's
tail, which can make the aircraft ascend or descend.
The person familiar with the testing said the FAA pilots were
unable to quickly follow the steps Boeing and the FAA have described
when pilots experience a ``runaway'' horizontal stabilizer.
The FAA discovery raises the potential for a lengthy delay if
Boeing is unable to address the problem by making software changes and
instead has to consider hardware upgrades. The agency has instructed
Boeing to come up with a plan for fixing the issue, which it will
evaluate.
Boeing has been working on a fix to its MCAS software for eight
months, the company said. That update makes the MCAS system reliant on
two external sensors, rather than just one, and prevents the feature
from firing repeatedly, as occurred in the two crashes, which killed
more than 300 people.
``Boeing will not offer the 737 Max for certification by the FAA
until we have satisfied all requirements for certification of the Max
and its safe return to service,'' the company said in its statement.
Ms. Mucarsel-Powell. Thank you. Changing subjects for a
second, are you expecting this aircraft, the 737 MAX, to fly
any time in the near future?
Mr. Muilenburg. Congresswoman, we are working with the FAA
on that. We have currently set a baseline for----
Ms. Mucarsel-Powell. When----
Mr. Muilenburg [continuing]. Our purposes of----
Ms. Mucarsel-Powell. When is that date expected?
Mr. Muilenburg. The fourth quarter, this----
Ms. Mucarsel-Powell. So----
Mr. Muilenburg. Before the end of the year.
Ms. Mucarsel-Powell. So soon? So you are going to feel--
because I have lost all confidence, Mr. Muilenburg. I sit on
the Transportation and Infrastructure Committee. I have been
listening to your testimony and heard some of your testimony
yesterday, and I think many of the families have asked for your
resignation.
And I have thought for a long time I don't want to blame
you. But at some point you have to take full responsibility of
the negligence of these two flights. And I want to ask you. Are
you going to be stepping down as CEO of Boeing?
Mr. Muilenburg. Congresswoman, I--no.
Ms. Mucarsel-Powell. No?
Mr. Muilenburg. Congresswoman----
Ms. Mucarsel-Powell. It doesn't surprise me.
Mr. Muilenburg. It is important----
Ms. Mucarsel-Powell. Because I saw something else. Boeing
increases CEO's pay 27 percent to $23.4 million last year. This
was last year.
Mr. Muilenburg. Congresswoman----
Ms. Mucarsel-Powell. So, obviously, you don't want to step
down.
Mr. Muilenburg. My company----
Ms. Mucarsel-Powell. But I think that, at some point, to
build trust and confidence in your company--because I do agree
with you there are thousands of employees that work in this
company that don't deserve to be put through this. But it is
you, as the CEO, that takes full responsibility for what
happened. And I have not heard you doing that.
Mr. Muilenburg. Congresswoman----
Ms. Mucarsel-Powell. And with that, thank you, I yield back
my time.
Mr. Muilenburg. Congresswoman, if I could respond to that,
I am responsible. I take responsibility for these two accidents
that occurred on my watch. I feel responsible to carry that
through.
As I mentioned earlier, I grew up on a farm in Iowa. My dad
taught me responsibility, and he asked--what he told me is to--
when they are faced with challenges, to carry through. And I
don't want to run away from challenges. My intent is to see
this through. I think that is part of my responsibility----
Ms. Mucarsel-Powell. Mr. Muilenburg, if you had an ounce of
integrity you would know that the right thing to do is to step
down.
Mr. DeFazio. OK, the gentlelady's time has expired. I would
now recognize the ranking member, Mr. Graves.
Mr. Graves of Missouri. Would you like to finish what you
were saying?
Mr. Muilenburg. Well, Congressman, thank you. Again, I
understand the congresswoman's view here, and I respect those
inputs. But, as I said, the way I was brought up, when faced
with a tough challenge like this, something that occurred on my
watch, I have a keen sense of responsibility to see it through.
And I think that is part of what I owe to these families, and
to their memories. And I am committed to doing that.
To me this is about being responsible and ensuring safe
travel for the future. That is my focus.
Mr. Graves of Missouri. Thank you. I yield back.
Mr. DeFazio. Mr. Allred?
Mr. Allred. Thank you, Mr. Chairman. I want to begin by
offering my sincerest condolences to the families who are here
today. As the father of an 8-month-old child, I am particularly
devastated to see the babies in these pictures.
I do believe that Boeing is a great American company, and
that is part of why I am so frustrated that we are here today.
I also want to say that the FAA has failed in its duty to
make sure that we fix--and we must ensure in this committee
that we fix--this process to make sure that this never happens
again.
Industry capture of safety regulation in any area is not
only dangerous to the public, it is bad business. This has cost
Boeing dearly, and it has cost our airlines dearly. That is why
it is so important that we get this right.
Mr. Muilenburg, I hope that you are gathering from today's
hearing that our concern isn't with the mistakes that were
made. We are certainly concerned about that, but we understand
that mistakes happen. Even the greatest companies make
mistakes. It is the concealment, it is the purposeful
concealment that bothers so many of us, with an obvious
financial drive behind it.
That the pilots didn't know about this is unacceptable.
That you implemented this new system and had airlines rely on
you to deliver a safe and reliable aircraft, and you did not do
that, it is unacceptable.
And that we in this committee only are finding out some of
this information last month, you come here and you are telling
us how sorry you are about what has happened, but yet we have
to have whistleblowers tell us some of this information about
what is going on inside Boeing. We only got some of this
information on October 18th about these texts that are going on
with some of your people. You have not fully complied with us.
We have had to fight and scratch for all the information that
we have to try and fix this system. And that makes me angry,
and it makes me feel like your use of the word
``accountability'' has a very different meaning than mine.
Now, this is not about pilot error. I have heard some of my
colleagues mention pilot error. This is about catastrophic
design flaw, and regulatory failure that has caused us to lose
hundreds of lives. Two of your aircraft, sir, have gone down.
In Dallas, where I represent, we have two airlines,
Southwest Airlines and American Airlines, both of which have
extensive hubs in my area. They have invested heavily in your
aircraft. This grounding and these catastrophes have cost them
over $1 billion. They have canceled 9,500 flights in the last
quarter alone--that is American, alone. And their hardworking
employees are feeling the financial effects of your negligence.
Now, when the 737 MAX flies again, after it has gone
through the needed changes that are just now being done, which
I think some of this process has shown that you knew should
have been done in the first place, it will be a profitable
aircraft for your company.
And so, my question to you is how will you compensate the
airlines and their employees who have lost so much due to your
negligence?
Mr. Muilenburg. Congressman, we have been working with a
number of airlines, including American and Southwest. As you
might have seen in our last quarterly report, we took charge of
several billion dollars associated with what we call customer
compensation. Those discussions with those two airlines and
many others around the country and around the world are
ongoing. And our intent is to make things right with our
customers.
We feel terrible about the impact it has had. We know the
flying public has been affected, we know these airlines have
been affected. We know their communities have been affected.
And we have a deliberate engagement approach with each and
every airline, and we are working our way through that. And we
have set aside a financial impact associated with that that you
have seen in our public reports.
Mr. Allred. Well, we are going to be following this
closely, because there are hardworking employees of both these
airlines who have no role in this, who are doing their best,
who have been impacted by this.
I fly Southwest twice a week. Every time I get on a plane
someone asks one of the flight attendants whether or not it is
a MAX. You have a lot of work to do, sir.
I yield back.
Mr. DeFazio. Ms. Davids would be next, the vice chair of
the subcommittee.
Ms. Davids. Thank you. Well, first I would like to again
extend my condolences to the families that are here. And I
appreciate your continued willingness to show up and be a part
of this process.
Aviation is extremely important to Kansas, the State that I
hail from. And our State has a strong aviation history, and it
is vital to my State's economy. And it is vital to the U.S.
economy. I think you know that already.
Mr. Muilenburg, to piggy-back off of so much of the
questioning we have heard today, and what we heard from you
today, and what we heard from you yesterday in the Senate, you
have reiterated time and time again Boeing's commitment to
safety and pilot training. But we have seen a number of
documents, the committee has reviewed a number of documents
with an emphasis on an effort to minimize pilot training
requirements for the 737 MAX.
My interest is having you provide some clarity on the
apparent inconsistencies that we are hearing and seeing. Would
you agree that pilot training is important to Boeing?
Mr. Muilenburg. Yes.
Ms. Davids. And when Boeing marketed the MAX to potential
airline customers, did they assure the customers that, if they
purchased the MAX, it would be unlikely that they would need to
put their pilots through timely and costly simulator training?
Mr. Muilenburg. One of our design requirements that we
worked with our airline customers was to do what we call level
B training, computer-based training, as a design objective.
Ms. Davids. OK. I have some slides.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. So this--I have a PowerPoint presentation from
a 737 MAX training that one of the marketing officials provided
from July 2017, which was a few months after the FAA certified
the MAX.
Can you go to the second slide, please?
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. This graphic shows a quote, if you will look in
the box here. ``We had marketed 2 days previously. A 3- to 4-
hour course has now been approved.''
Mr. Muilenburg, after FAA's 2017 certification, did
Boeing's marketing representatives emphasize to potential
customers that FAA had reduced the length of pilot training
that Boeing had originally expected?
Mr. Muilenburg. Congresswoman, I am not familiar with those
discussions.
I don't know, John, if you have any awareness----
Mr. Hamilton. No, I do not.
Mr. Muilenburg. We can certainly follow up on that
question.
Ms. Davids. OK. Well, it is clear from this slide that
Boeing had expected a different number of days of training than
what it ultimately ended up with.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. So this slide here contains text from an email
chain on August 2016 from chief technical pilot Mark Forkner,
which announces to a large group at Boeing that the FAA
approved the level B training, and that it was--first of all,
it--the entire email contains a lot of exclamation points. He
was very enthusiastic. And he noted that, ``This culminates
more than 3 years of tireless and collaborative efforts across
many business units.'' You can see the rest of the text here.
Mr. Muilenburg, level B designation means the 737 MAX was
subject to computer-based pilot training requirements, and not
more extensive simulator requirements, correct?
Mr. Muilenburg. Congresswoman, that is correct for the
differences training between the models. The baseline training
for the 737 MAX is a 20-plus-day training program that includes
significant simulator time.
Ms. Davids. So, in a separate email chain--can you bring up
the next slide, please?
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. We are very familiar with this quote by this
time in the day. Mr. Forkner, in November 2016, tells an FAA
official that he was working on ``Jedi mind-tricking regulators
into accepting the training'' that he got accepted by the FAA.
Mr. Muilenburg, the push across Boeing to limit cost of
pilot training requirements on the MAX, despite the company's
commitment to safety and pilot training, is clear. From the
questions we have heard today, the slides we have heard, what
is up here right now, this is your chance to provide some
clarity on how you mesh all of this information with your
continued statements about commitment to safety.
Mr. Muilenburg. Yes. Congresswoman, I think it is a very
good question. And the idea here is that incremental training
adds to safety.
We don't make training decisions based on economics. We try
to make training decisions based on safety. And as John pointed
out earlier----
Ms. Davids. If it wasn't based on economics, what was it
based on, that you were trying to push to reduce----
Mr. Muilenburg. On safe operations for our airlines.
So many of our airline customers who received the 737 MAX,
they also fly 737 NGs. And a typical pilot, in a given day, may
have a flight on an NG and a flight on a MAX. And it is----
Ms. Davids. What you are saying right now sounds
inconsistent with the information that we have been seeing,
that you are committed to safety, and that you are not taking
into account the economic impacts of the pilot training that
people would have to do.
Mr. Muilenburg. Could----
Ms. Davids. The last thing I want to say is, based on what
Congresswoman Mucarsel-Powell said, can you tell us right now,
if this article is correct in that December 31st, 2019, is the
last chance that families are able to file a claim for the
Boeing compensation fund, that you will extend that? Because
that is only 2 months from now, and that seems completely
ridiculous, that people only have until December 2019.
Mr. Muilenburg. So, Congresswoman, I--until that was
mentioned earlier, I just hadn't recalled that deadline. But I
can tell you that is something that we can extend, and I would
be--I will give my team that direction. If----
Ms. Davids. Thank you.
Mr. Muilenburg. If there are families that we can help, and
more time is needed, we will take the time. Our commitment here
is to try to help the families. And I know, you know, monetary
help never relieves the pain, it never will, but hopefully we
can help in the communities.
And I don't want to put any kind of artificial timeline on
that. So if that is the constraint, we will remove it.
Ms. Davids. Thank you. I yield back.
Mr. DeFazio. Mr. Garcia?
Mr. Garcia. Yes. Thank you, Mr. Chairman. To the families
and friends of those who perished, thank you for bearing
witness to what was really lost in the catastrophes.
I would like to explore with you, Mr. Muilenburg, some of
the financial forces that may have contributed to the
catastrophe, as it relates to the corporation. If you would,
answer some simple questions in a yes-or-no format.
One of your primary duties as CEO is to focus on increasing
the price of the company's stock. Is that right? One of your
duties?
Mr. Muilenburg. Congressman, one of our objectives----
Mr. Garcia. OK.
Mr. Muilenburg [continuing]. Is to increase the
shareholders value, yes.
Mr. Garcia. I will take that as a yes. Is your total
compensation or realized gains tied to Boeing's stock
performing well?
Mr. Muilenburg. That is one component of it, yes.
Mr. Garcia. OK. Mr. Muilenburg, do you know what the stock
price was when you became CEO?
Mr. Muilenburg. Congressman, I do not.
Mr. Garcia. It was $140 a share. That is a June 5, 2015,
number.
What was the stock price at the last trading day before the
Ethiopian Air accident this year, would you know that?
Mr. Muilenburg. I don't know.
Mr. Garcia. Let me help you. It was $422 a share on March
8.
So in a little over 4 years your company's stock rose. It
tripled. From 1999 to 2009 it went from $42 to $49 a share. But
from 2015 to 2019 it tripled, from $140 per share to $422 a
share. Very significant.
In fact, you and your board authorized a $20 billion stock
buyback program in December of 2018, 2 months after the Lion
Air incident, that helped drive up the price of Boeing stock.
You own shares of company stock, correct?
Mr. Muilenburg. That is correct.
Mr. Garcia. So, in short, you benefitted personally from
increasing the stock price. In fact, a report from the American
Prospect, shows you made over $95 million from 2015 to 2018.
You were pocketing almost $2 million a month, almost half from
stock dividends.
The way I see it, your relentless focus on stock price and
your company's bottom line may have negatively affected
employee performance. Would you agree?
Mr. Muilenburg. Congressman, I don't agree with that. Our
business model is about safe airplanes. It is a----
Mr. Garcia. So you don't think that----
Mr. Muilenburg [continuing]. Long-cycle business.
Mr. Garcia. You don't think that employees felt pressured
to perform?
Mr. Muilenburg. Congressman, the realities of the
competitive environment, the pressure to perform, is there. But
that is never----
Mr. Garcia. Well----
Mr. Muilenburg [continuing]. Equal to safety. Safety----
Mr. Garcia. But in November----
Mr. Muilenburg [continuing]. Is very----
Mr. Garcia [continuing]. Of 2016 Boeing conducted an
internal survey which--in which over 40 percent of employees
stated they felt undue pressure.
Curtis Ewbank, a Boeing employee, said, ``Boeing management
was more concerned with cost and schedule than safety and
quality.''
Another, Adam Dickson, said--a Boeing engineer said his
managers warned in ``very directly and threatening ways'' that
pay was at risk if targets weren't met.
It is pretty clear there has been a culture of greed and
compromising safety at Boeing.
Mr. Muilenburg, you did everything to drive profits over
safety. You skirted recertification requirements or regulators
at every corner, and your employees even admit to lying to the
FAA.
There are basically two ways that this plays out. You
either truly didn't realize you had a defective plane, which
demonstrates gross incompetence and/or negligence, or you did
know you had a defective plane, but still tried to push it to
market, in which case it is just clear corruption. Either way,
Mr. Muilenburg, you are the captain of this ship. A culture of
negligence, incompetence, or corruption starts at the top, and
it starts with you. You padded your personal finances by
putting profit over safety. And now 346 people, including 8
Americans, are dead on your watch.
Today you said you made mistakes and you are accountable.
If Ex-Im Bank isn't reauthorized and the MAX is left grounded,
you might be asking us for a bailout. That bill--the Ex-Im Bank
is before the Financial Services Committee. I think it is time
that you submitted your resignation, don't you?
Mr. Muilenburg. Congressman, I respectfully disagree with
your premise on what drives our company.
Mr. Garcia. OK. Well, whether or not you or your colleagues
are incriminated in the ongoing criminal investigation, the
facts remain. It was either gross negligence, incompetence, or
corruption. You are at the top. I think it is pretty clear to
me, to the families of the victims, and the American public
that you should resign and do it immediately.
I yield back, Mr. Chairman.
Mr. DeFazio. Next would be Mrs. Fletcher.
Mrs. Fletcher. Thank you, Mr. Chairman. Thank you very much
for being here today, and thank you for holding this very
important hearing. I join my colleagues in expressing my
deepest condolences to the families and the friends who are
here with us today, and those who can't be here with us. And,
of course, they are in our minds and--as are the victims. And I
think that that really needs to remain our focus as we are here
today.
We convened this hearing to get the facts and to understand
better what we can do, as Members of Congress, to prevent a
tragedy like this from ever happening again. And we understand
that these are real people whose lives have been affected,
lives have been lost, and lives have been forever changed. And
so I remain aware of that. And we want to do what we can.
And so, one of the things that has been an issue that we
have touched on a little bit earlier today, but I want to
follow up on, is this delegation of certification authority. I
think this is a critical place where Congress really needs to
reassess whether this is a program that should continue.
And I understand--and there have been questions about this
earlier--that Boeing was really able to avoid installing some
of the latest safety features by using this amended
certification. And I think both Boeing and the FAA failed to
evaluate the impacts of the MCAS on the whole aircraft system
because of this.
So, Mr. Muilenburg, my question is for you, first. The JATR
recommends that the FAA needs to ensure that engineers have
open lines of communication to the FAA certification engineers
without fear of punitive action or process violations. Do you
agree with that recommendation?
Mr. Muilenburg. Congresswoman, we agree with having those
open communications, yes.
Mrs. Fletcher. And what changes, if any, has Boeing made to
improve the relationship and ensure that Boeing employees have
the access they need to make safety determinations?
Mr. Muilenburg. Congresswoman, one of the big changes we
announced roughly 2 weeks ago now was a standup of a new safety
organization. It is centralized within Boeing, a direct
reporting line to our chief engineer, who reports to me. That
will include our ODA representatives, the delegated authority
representatives. I think that will enhance transparency,
directness of communication lines with the FAA, and also
increase independence from our airplane programs to create that
functional strength.
So those are changes we have announced, and are now
implementing.
Mrs. Fletcher. And are other changes under consideration,
or is that the extent of your recommendation at this time?
Mr. Muilenburg. We have multiple recommendations or actions
that are underway. That includes the standup of a new aerospace
safety committee for our board that is headed up by Admiral
Giambastiani that includes a restructuring of all of our safety
review boards across the company, so they now are integrated,
companywide.
We are standing up a new design requirements organization
that, as technology continues to evolve, we can do a better job
of sharing those technologies and requirements across the
company.
And we have realigned our engineering organization
structure so all--roughly 50,000 Boeing engineers now report
directly to our chief engineer.
Mrs. Fletcher. OK, thank you.
Mr. Muilenburg. There are additional actions underway, and
investments for the future. So that list I just gave you is----
Mrs. Fletcher. OK, sure.
Mr. Muilenburg. Consider that a set of initial actions with
more to follow.
Mrs. Fletcher. Thank you. I want to move on to a couple
more things before my time expires.
Were any Boeing employees subject to punitive action during
the development of the 737 MAX for reporting issues to FAA
staff?
Mr. Muilenburg. Congresswoman, I am not aware of any such
cases. If there were cases like that, we don't accept
retaliation. There is no tolerance for retaliation. So I can't
personally say I am aware of any. But let me check the records
to see if there are any there.
Mrs. Fletcher. Thank you, I would appreciate that.
Mr. Muilenburg. But I can tell you, from a policy
standpoint, we do not tolerate retaliation.
Mrs. Fletcher. I would appreciate if you could get back to
the committee on whether any employees were subjected to
punitive action. I understand that you don't know that, sitting
here today, for a fact.
Another recommendation is that the JATR recommends
increased FAA involvement in safety critical areas that are
currently delegated to Boeing. I understand Boeing has
implemented these changes to internal processes. Have you
identified any changes to the delegation process that Congress
can help with, as we evaluate these issues?
Mr. Muilenburg. Congresswoman, we are starting to evaluate
those opportunities. So discussions are ongoing with the FAA
and others. We think the area of human-machine interface, and
how we set those industry standards and the requirements for
how pilots operate in a high-workload environment, that is a
place where we can work together on new standards.
There are also some older regulations that are currently on
the books that could be updated to take advantage of new
technologies, and we are identifying a specific list in that
area.
So those are two examples. And I would anticipate there
will be more.
Mrs. Fletcher. Thank you. I see I have exceeded my time.
But if you could send those recommendations to this committee,
that would be much appreciated. Thank you.
And I yield back.
Mr. DeFazio. The gentlelady, Delegate Plaskett.
Ms. Plaskett. Thank you very much.
Good afternoon, everyone, and thank you all for your
patience in being here today to hear some of the answers from
Boeing. Thank you, those of you who are in the audience, and
condolences to your families, as well as to those, I guess, and
others in the airline industry who are really looking very
closely at what we all have here to say.
Mr. Muilenburg, I wanted to ask you some questions
particularly about MCAS.
Following the Lion Air flight 610 accident last year,
Boeing issued a bulletin for the 737 MAX. The subject concerned
``Uncommanded nose down stabilizer trim due to erroneous angle
of attack (AOA) during manual flight.'' While this bulletin
describes in detail what can occur during an AOA failure,
including nose down trim in increments lasting up to 10
seconds, and that ``repetitive cycles . . . continue to occur
unless the stabilizer trim system is deactivated,'' I note that
not once does the bulletin mention by name what, in fact,
causes such a nose down command, which is MCAS.
And I have a copy of a Boeing flight crew operations manual
bulletin number TBC-19, page 51. I would ask that this be
entered into the record.
Mr. DeFazio. Without objection.
[The information follows:]
Flight Crew Operations Manual Bulletin for The Boeing Company, No. TBC-
19, Issued Nov. 6, 2018, Submitted for the Record by Hon. Plaskett
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. Plaskett. Thank you.
Sir, why was MCAS not mentioned in the November 6 bulletin?
Mr. Muilenburg. Congresswoman, I am going to ask John to
add to this one, but it is--what we were attempting to do with
that bulletin was to, again, remind pilots of that existing
emergency procedure around runaway stabilizer. And the
reference to multiple inputs is the behavior that you would
expect the airplane to see as a result of MCAS.
So the idea is, again, provide the pilots information about
the behavior of the airplane, as opposed to diagnosing the
specific system. So that was the intent----
Ms. Plaskett. So you--the intent was which one?
Mr. Muilenburg. The intent was to inform them of the
failure mode that MCAS could cause.
Ms. Plaskett. OK.
Mr. Muilenburg. Rather than try to provide details on MCAS.
Since then, again, feedback from the pilots, we know we
need to provide more information on MCAS itself, in addition to
the effects of MCAS, and that is part of the update we are
making to the training manual.
Ms. Plaskett. In providing the effects of MCAS, would it
have been easier--or to summarize it by using the term
``MCAS''?
Mr. Muilenburg. It perhaps could have. I think that is one
of the things we have learned now, is the pilots would like to
have additional information on just the definition of MCAS,
itself, in addition to the effects of its failure modes.
Again, our goal is to optimize what is in the training
manual, so we don't add more information than what is useful
for the pilots. Clearly----
Ms. Plaskett. How large are your training manuals?
Mr. Muilenburg [continuing]. We could have done better
here.
Ms. Plaskett. How large are the training manuals?
Mr. Muilenburg. I can't comment on that. I don't know,
John, have you got a----
Ms. Plaskett. They are pretty substantive, aren't they?
Mr. Hamilton. They are very substantive, yes.
Ms. Plaskett. So why would that have been any more of a
difference to add that?
I saw you nodding your head, sir. Did you want to add
anything?
Mr. Hamilton. Well, they are very substantial in size. But
we do go through a process of trying to evaluate what is the
right level of information to be in there. We can incorporate
all kinds of information.
In hindsight, you know, and in response to the pilots'
requests, we are going to put the material in the training
manuals on MCAS. We are going to tell them exactly what the
need--we are going to have a lot more information there to
address this.
Ms. Plaskett. So is that the decision as to why it was
ultimately excluded, because it was seen as, what, not
something that the pilots would have----
Mr. Muilenburg. Again, our intent was to provide
information on how to fly the airplane, not necessarily
diagnose the system failures. And that is always a balance that
we try to get in our training materials.
And clearly, here, we need to provide more information for
the pilots----
Ms. Plaskett. So the reference to MCAS was excluded. Was
the reference to MCAS excluded in order to not bring attention
to the system--pilots were unaware about it? No?
Mr. Muilenburg. Congresswoman, the intent was to provide
the training materials that the pilots would need to fly the
airplane, rather than try to educate them on the system
details.
And again, that is an area where we fell short, and we need
to provide additional information. And we are going to----
Ms. Plaskett. So in that same bulletin, just very quickly,
Boeing describes how erroneous AOA can cause, potentially, many
indications, and as many as four different alerts or lights:
IAS disagree, ALT disagree, et cetera.
Do you believe, if several of these indications went off
simultaneous in a cockpit, a pilot would be confused about how
to respond?
Mr. Hamilton. So, Congresswoman, when you have an AOA--in
the case of Lion Air, where it was miscalibrated, once it got
to a certain threshold, and you--you had a difference in
altitude, then it would trigger that altitude disagree. When it
got to a certain airspeed disagree, then--so they would--they
might not come all on at the same time, but they are probably
fairly closely linked together on that.
Ms. Plaskett. OK, so the question was would a pilot be
confused on how to respond. And then I yield back.
Mr. Hamilton. Yes. So the OMB was really about, if you have
an AOA issue, it can trigger a number of different indications
on the flight deck, and--to help you identify what could be
going on. And if you have the stabilizer moving, then perform
the runaway stabilizer procedure.
We subsequently went out, at the request of our customers,
with a detailed message about MCAS, and explained what it was.
Mr. DeFazio. Mr. Carbajal?
Mr. Carbajal. Thank you, Mr. Chair. And I want to start by
also offering my condolences to the families that are here, and
those that--loved ones that have been mourning all of those
that were lost in these unfortunate tragedies.
Mr. Muilenburg, I want to dispense with a lot of what my
colleagues have already touched on, and just dive into some
really poignant, specific questions. So a very brief answer is
what I am looking for.
Boeing did not consider erroneous MCAS activation to
present a catastrophic risk, correct?
[No response.]
Mr. Carbajal. Let me repeat that. Boeing did not consider
erroneous MCAS activation to present a catastrophic risk.
Correct?
Mr. Muilenburg. Congressman, I believe the hazard analysis,
if that is what you are referring to, we--John, help me out.
Mr. Hamilton. Yes, that is correct.
Mr. Muilenburg. We had a----
Mr. Hamilton. A single MCAS event----
Mr. Carbajal. So is that correct or not?
Mr. Hamilton. A single MCAS event was not considered, I
think you used the word, ``catastrophic''?
Mr. Carbajal. Yes.
Mr. Hamilton. Yes, that is correct.
Mr. Carbajal. Thank you. And as a result of that lower
classification of risk, Boeing did not perform detailed
evaluations--failure modes, effect analysis, and fault tree
analysis--to fully understand the effects of erroneous MCAS
activation, correct?
[No response.]
Mr. Carbajal. I am just looking for yes or no.
Mr. Hamilton. We did a thorough analysis of it using our
processes that we have used, and we did consider multiple
inputs into MCAS.
Mr. Carbajal. But did you do the failure modes and effect
analysis and the fault tree analysis? Yes or no?
Mr. Hamilton. No.
Mr. Carbajal. Thank you. In fact, in simulator tests,
Boeing didn't even simulate erroneous MCAS activation to the
full 2.5 degrees of stabilizer motion, correct?
Mr. Hamilton. Congressman, I think I will have to follow up
with you, because I believe we did go to beyond 2.5. I think we
went to 3.0.
Mr. Carbajal. If you could follow up, that would be great.
Boeing didn't consider repetitive, erroneous MCAS
activations in those tests, did it?
Mr. Hamilton. Could you----
Mr. Carbajal. Boeing didn't consider repetitive, erroneous
MCAS activations in these tests.
Mr. Hamilton. We did consider multiple MCAS inputs.
Mr. Carbajal. Did Boeing assume pilots would be the
redundancy to save the airplane during an erroneous MCAS
activation?
Mr. Hamilton. We assumed that pilots could recognize it and
trim it out, and----
Mr. Carbajal. So is that a yes?
Mr. Hamilton. Yes.
Mr. Carbajal. In retrospect, given that the erroneous
activation of MCAS played a critical role in both 737 MAX
crashes, would you agree that this was a flawed assumption that
the pilots were the backup?
Mr. Hamilton. We used an industry standard that has been
around for a long time, and--around pilots' actions. And in
these cases, that assumption did not play out in these
accidents----
Mr. Carbajal. So is that a yes or a no?
Mr. Hamilton. It is an assumption that didn't play out, and
I think it is one of the things that we need to address, going
forward.
Mr. Carbajal. So that would be a yes.
Mr. Hamilton. If you could restate your question, I will--
--
Mr. Carbajal. In retrospect, given the erroneous activation
of MCAS played a critical role in both 737 MAX crashes, would
you agree that this was a flawed assumption that the pilots
were the backup?
Mr. Hamilton. Yes, I would say that the assumption needs to
be addressed.
Mr. Carbajal. So yes?
Mr. Hamilton. Yes.
Mr. Carbajal. Thank you.
Mr. Hamilton. Yes.
Mr. Carbajal. Mr. Chair, I yield back.
Mr. DeFazio. I thank the gentleman. We begin what will
hopefully be a brief second round. I appreciate the witnesses
and the members of the committee who have hung in here.
Mr. Muilenburg, do you know how many 737 MAX aircraft
Southwest Airlines had ordered from Boeing, prior to the Lion
Air crash?
Mr. Muilenburg. Congressman, I don't know the exact
number----
Mr. DeFazio. OK.
Mr. Muilenburg [continuing]. But we can find it for you.
Mr. DeFazio. Well, we were told it was 280. And do you
contest the fact that Southwest Airlines would have gotten a $1
million rebate per plane, had the pilots had to go through a
simulator training?
Mr. Muilenburg. Chairman, I believe that was part of the
contract structure----
Mr. DeFazio. OK.
Mr. Muilenburg [continuing]. We had with Southwest.
Mr. DeFazio. Did you have contracts like that with other
customers?
Mr. Muilenburg. Congressman, I don't know if there are any
other customers with that specific clause, but it is not
uncommon for us to have incentive clauses in these----
Mr. DeFazio. Right.
Mr. Muilenburg [continuing]. Contracts.
Mr. DeFazio. So that would have totaled, obviously, $280
million that would have had to have been paid. Because I think
a real key issue is how we got to this point, and how MCAS was
not in the manual. That has been my question since way back
when.
Let's move on to undue pressure, key learnings, and next
steps. Slide?
[Pause.]
Mr. DeFazio. Slide?
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. There it goes. This was a survey, which was
provided to us by a whistleblower. It was in 2016.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Mr. DeFazio. If we go to the next slide, ``I am concerned
about consequences if I report potential undue pressure, 29
percent.''
Then, if we go to the next slide, ``When these engineers
are also ARs, lines are frequently blurred between when the
engineer is acting in an applicant SME role and when they are
in an AR role.'' That was 2016.
And I will give you, in a minute, a chance to respond, but
it seems like you didn't pay much attention to the survey and
the undue pressure because we then have--and I may have read it
improperly before, but he says he was the leader of the 737
program. He was writing to the general manager. He talks about
workforce exhausted, schedule pressure. ``I am sorry to say I
am hesitant about putting my family on a Boeing airplane.''
That is 2 years later.
It doesn't seem like anything was done to relieve the undue
pressure in this culture where people were afraid for their
jobs, and there was confusion, you know, which also points to
why we need to change this process between, you know, SMEs and
ARs and--wait, wait a minute, which hat do I have on, and they
are switching hats.
In 2003 I said I don't understand how this is going to work
when I voted against this process. I said so someone works for
Boeing, gets paid from Boeing, and then someone else works for
Boeing and is paid from Boeing, but this person is totally
stovepiped over here, and firewalled. They are not responsive
to Boeing, they are just responsive to the regulator, but that
is not true, because apparently they go back and forth between
being a development engineer or being, you know, the AR.
I mean what happened between 2016 and 2018? Apparently not
much. Can you point to any significant steps that were taken to
change the culture and relieve this undue pressure?
Mr. Muilenburg. Congressman, I can. And John will feel free
to add in, as well.
Mr. Hamilton. Yes.
Mr. Muilenburg. First of all, this survey is a survey that
we proactively do with our ODA team. The goal here is to
identify any sources of undue pressure.
So, in this case, these are the survey results that we
proactively sought. We gathered all of these results. We have
shared them with the FAA, and we have taken followup actions
associated with these inputs.
Mr. DeFazio. But then----
Mr. Muilenburg. The----
Mr. DeFazio. That is good, but I am asking for, like,
really concrete examples. When you have the leader of the 737
team, 2 years later, workforce exhausted, schedule pressure, it
doesn't sound like those things were effective.
Mr. Muilenburg. Yes, Congressman, if I could, I am
attempting to answer the question, and I----
Mr. DeFazio. Yes, go ahead.
Mr. Muilenburg. A very important topic.
Mr. DeFazio. Sure.
Mr. Muilenburg. You will also see on this survey data here
that over 90 percent of our employees are comfortable raising
issues. And I think the number is 97 percent understand the
process for doing so. Those are very high scores. We would
still want them higher. But we try to create a culture where
employees can speak up and raise issues, so we can take action
in response. So that is the culture we are trying to
incentivize.
Now, I will say it is true that we have competitive
pressures every day. We operate in a tough, globally
competitive world. But that never, never takes priority over
safety.
And I know we have had this discussion, but I could tell
you our culture, as a company, the only long-term sustained
business model is safety. And that is because our airplanes
last for decades. And having a culture where people are willing
to speak up, including the people that responded to this
survey, is part of creating that culture.
Now, John, you might be able to comment on specific actions
we have taken.
Mr. Hamilton. Yes, I think there are actually two separate
things.
So this was actually looking at the ARs, and the undue
pressure. And that is a defined area that the FAA has us act
on. We do do recurrent training with the managers in
engineering, manufacturing, and quality about how they deal
with ARs, and how they need to be treated, and what is undue
pressure. And we do take followup actions.
We do audits, and the FAA has come in and actually audited
what we did, and they have agreed with what actions were taken.
I think, you know, the other pressures that were alluded to
later, 2 years later, it was not an AR, to my understanding.
And I think that just--it talks about more the pressures that--
--
Mr. DeFazio. Well, the----
Mr. Muilenburg. Yes, and again, as I mentioned earlier, I
did receive a letter from that individual. And I think he
raised some good points, things that we want our people to
raise.
We, subsequent to that, evaluated those. We talked to our
737 team----
Mr. DeFazio. But you didn't reduce the production rate, as
you said earlier. You stated----
Mr. Muilenburg. Yes.
Mr. DeFazio. If I could--I don't want to prolong this too
much----
Mr. Muilenburg. Well, production rate stability, again,
sir, is actually better for safety. Consistency in the factory
is safer for our workers.
Mr. DeFazio. Unless it is moving a little too quick.
So just to go back to the issue of how this all happened,
and it started with a phone call in 2011. I brought that out at
the beginning. You had an exclusive Boeing customer who called
and said, ``Can't match Airbus fuel economy and no pilot
retraining necessary. We are buying all Airbus.''
And then you--you know, I mean, the story is that we didn't
rush, except you were looking at--I mean you have a 50-year-old
airframe here, some of which--some of the reasons--the problems
we had and, you know, why you had to develop MCAS, as opposed
to a more stable platform, was because we are dealing with a
50-year-old airframe.
You have still got hydraulic controls. In the newer planes,
my understanding is, when you have something serious going on,
you actually get prioritization in a more visible way. The
disagree light didn't even work.
But we are being told that safety was always paramount,
people didn't feel pressure, things weren't rushed. I just
don't buy that. And instead of building a clean-sheet design,
you might have lost market share for a year or two to Airbus,
but then you would have come along with a fabulous, 21st-
century airplane that probably would have been better than the
Airbus, and you wouldn't be going through what you are going
through today.
That was a critical mistake that was made back then, and I
believe it exerted pressure throughout the organization from
the top down, and it is going to be very hard--very hard--to
restore confidence.
And again, when you have the guy who was the leader of the
737 program saying, ``I am sorry to say I am hesitant of
putting my family on a Boeing airplane,'' that is a very sad
comment on what has happened to the culture of the company.
With that, Representative Brown?
Mr. Brown. Thank you, Mr. Chairman. I just want to ask a
question to clarify my question about computer software. You
may recall that question.
I do want to preface first by saying that, look, I know the
difference between hindsight and at-the-moment. In hindsight,
everything is clear. Today we see MCAS as a much more
significant part of the flight control system.
But I still believe that MCAS, at the moment, while you
were designing, developing, and promoting it, I think it was a
big deal that you actually just underappreciated. So let me
just ask this question here.
So you have the flight control system, a number of
components are in it: flight control surfaces, like the
stabilizer, and controls, right, cockpit controls, like the
yoke or the control arm. You have linkages between the two.
On the 737, all of the flight control surfaces operate by a
cockpit control, input by a crew.
The MCAS, as I understand it, is the only computer software
that actually operates a flight control surface without crew
input. Is that true?
Mr. Hamilton. No, sir.
Mr. Brown. You say yes or no?
Mr. Hamilton. I said no, sir.
Mr. Brown. OK.
Mr. Hamilton. As I mentioned earlier, the yaw damper is--
operates independent of the crew, and it moves the rudder
surface in response to wind gusts. And so--up to 3 degrees. And
so crews don't put any input on that, it just happens
automatically, based on----
Mr. Brown. OK. Fair enough, and I appreciate that
clarification.
The emergency procedures. I am--you know, and I think, Mr.
Muilenburg, you have mentioned this in testimony, I have heard
it before from Boeing, and even when Mr. Carbajal was asking
questions. The emergency procedure for a runaway stabilizer,
first of all, the condition is an uncommanded stabilizer trim
movement occurs continuously, which means--let's say the
stabilizer goes down, which means the nose is going to go down.
You try to make the correction, either the trim button or the
yoke, and you are not getting any relief, right? That is a
runaway stabilizer trim, right?
Mr. Hamilton. To do----
Mr. Brown. Yes or no?
Mr. Hamilton. That could be a--how it might behave.
Mr. Brown. Uncommanded stabilizer trim movement occurs
continuously. Stabilizer goes down, the nose goes down, right?
Mr. Hamilton. Right.
Mr. Brown. Right, OK. So now, if it is continuous, which
means I do the control--either the trim button or the control
yoke--I don't get any relief, and then the quick reaction
handbook says do the runaway cutoff, right?
Mr. Hamilton. Well, when you say you don't get any relief
from the----
Mr. Brown. Which means if I do either the trim button or
the control column, and I were to take my hands off, it would
still be going down.
Mr. Hamilton. So then that sounds like you have multiple
failures going on. You have something that is driving the
stabilizer in the initial spot, and now you have something else
that is causing----
Mr. Brown. No, I am talking about an uncommanded stabilizer
trim movement occurs continuously, and that trim movement
causes a nose down.
Mr. Muilenburg. In which case you trim with the thumb----
Mr. Brown. Right, but if I trim and nothing happens, that
is a runaway stabilizer trim, isn't it?
Mr. Hamilton. That would be a runaway stabilizer trim, but
I am saying that is two different failures that could
potentially----
Mr. Brown. OK. So if I have a runaway stabilizer trim, OK,
it is continuous. But with the MCAS activation, it is not
continuous.
Mr. Hamilton. Correct. It moves to a certain position and
it stops.
Mr. Brown. It stops, and I can do some correction, like
they did on Lion Air. And then 5 seconds later on Lion Air,
MCAS activated again.
So the concern I have is when you say that the emergency
procedure should be the same, but the conditions are different.
One is continuous and one is intermittent. It happens, it stops
when I provide input, and then it kicks in again.
And I know you have got litigation pending, and maybe that
is why you don't want to answer the question. But that is----
Mr. Muilenburg. Congressman, let me try. And John can----
Mr. Brown. Yes.
Mr. Muilenburg [continuing]. Help me here, but--so the
runaway stabilizer procedure, whether it is caused by MCAS or
some other failure mode, the procedure is to trim the airplane,
manage your power, and then hit the cutout switch if it
continues. So----
Mr. Brown. But as a pilot, don't you recognize it because,
like it says in the QRH, it is continuous?
Mr. Muilenburg. So----
Mr. Brown. Right? Is that right?
Mr. Muilenburg. I think----
Mr. Brown. It is continuous?
Mr. Muilenburg. I think the difference you are pointing out
is that there is some runaway stabilizer modes where it is one
continuous----
Mr. Brown. Right.
Mr. Muilenburg. And in the case of MCAS, it is still a
continuous movement, but it can happen multiple times.
Mr. Brown. Right. And----
Mr. Muilenburg. But----
Mr. Brown. And here is the point. Here is the point.
Mr. Muilenburg [continuing]. Multiple time----
Mr. Brown. There is nothing in the documentation, though,
that says to the pilot what continuous is. The pilot is
thinking, like, hey, continuous means I try to change it and it
ain't changing. That is continuous. But if it changes, but then
comes back, that is not really continuous. That is
intermittent.
Mr. Hamilton. Yes, I think----
Mr. Brown. And this is where--and so, with the Lion--you
said you are making changes in documentation.
Mr. Hamilton. Yes.
Mr. Muilenburg. Yes, sir.
Mr. Brown. I really hope that you are looking at an
emergency procedure, a quick reaction procedure, OK, that
expressly addresses MCAS and the intermittent nature of MCAS,
if it continues to be intermittent.
Mr. Muilenburg. And, Congressman, to that point, that is
one of the software changes we made. It is no longer
intermittent. It can only operate once.
Mr. Brown. Got it.
Mr. Hamilton. Yes.
Mr. Brown. Thank you, Mr. Chairman. I yield back.
Mr. DeFazio. Mr. Larsen?
Mr. Larsen. Thank you.
Mr. Muilenburg, yesterday, in response to some media
reports and a question about them, you denied media reports
that say that there were significant changes to MCAS low-speed
extension that were not fully vetted by the FAA. You said they
were fully vetted.
But the Indonesian accident authorities found FAA's
response to the revised system safety assessment was simply to
accept the submission. It seems to me there is a difference
between the FAA accepting the submission, versus the FAA fully
vetting the changes.
So if that was the case, do you--and this gets to the--kind
of the heart of some of these certification questions, on
whether enough or too much has been given through the authority
to Boeing, or to any other manufacturer.
Can you help me score that circle, what ``fully vetted'' by
FAA means, versus what simply----
Mr. Muilenburg. Yes, sir.
Mr. Larsen [continuing]. ``Accepting the submission''
means? Because it seems like there is no way to score that
circle.
Mr. Muilenburg. Congressman, let me try. And then, John, if
you want to----
Mr. Hamilton. OK.
Mr. Muilenburg. Or do you have a comment you wanted to----
Mr. Hamilton. Yes, Congressman. I think, you know, there
has been some implications here about the ODA and what the role
was.
The system safety assessment, the certification
deliverable, was retained by the FAA. It was not delegated to
the ODA until the very end, after the FAA had reviewed it and
provided comments back to the ODA and said, ``If these comments
are incorporated in the system safety assessment, then the AR
is delegated to fly in compliance.'' But the FAA had reviewed
that document for several months.
Mr. Muilenburg. And Congressman, if I could just add in,
just to try to square this off with the comments you heard
yesterday, what I was referring to is that, during that time
period from--it was mid-2016 to early 2017--the fact that we
extended MCAS to the low-speed operation----
Mr. Larsen. Right.
Mr. Muilenburg [continuing]. Envelope, that was discussed
with the FAA in many ways. We conducted multiple flight tests.
Some of those included FAA pilots on board the aircraft. And
that ultimately led to the certification of the airplane with
the MCAS software, including the extension to low-speed
operations.
And that--we are talking about two ends of the same
equation there.
Mr. Larsen. Yes. So--and I appreciate that. I know you
won't mind, though, that we are going to continue to go through
the documents you have provided us, and go through FAA
documents, as well, to clear that up from our end of things.
Mr. Muilenburg. And Congressman, I do think we have also
identified some areas where we need to improve the
documentation in some cases, recording of decisions and making
sure those were communicated----
Mr. Larsen. Yes.
Mr. Muilenburg [continuing]. To all parties. And that is
one of the areas of improvement that we have also identified,
and working that jointly with the FAA.
Mr. Larsen. And related to that, sort of the paper trail
side of things, Mr. Hamilton, in October, on October 20th a
statement from Boeing referenced that--back to Mr. Forkner--his
comments in these text message exchanges reflected a reaction
to a simulator program that wasn't functioning properly, as
opposed to how many of us read it, that being an MCAS not
functioning, and then him making his comments that it did.
However, if it is only--from my understanding, if it was--
does it matter if it was just a simulator problem, or if it was
deeper MCAS?
There is no paper trail that I am aware of yet that tells
me anything was fixed, whether it was an MCAS problem that was
fixed, or if it was a simulator problem that was supposed to be
fixed. If we are using the simulators that are supposed to be
fixed in order to test the--a 737 MAX, I don't feel any better
about that, either.
Mr. Muilenburg. OK----
Mr. Larsen. So is there a paper trail? To whom did Forkner
report this? Who is ultimately responsible for fixing the
simulator, if that, in fact, is what it was? And can we--and I
hope that we can get those documents.
As well I am going to ask--I want to ask the FAA the same
thing, not just how far up the ladder did he have to report,
but across to the FAA, and letting them know about the
simulator.
Mr. Muilenburg. Congressman, again, we are not completely
sure what he meant in that message----
Mr. Larsen. Well, join the crowd.
Mr. Muilenburg [continuing]. That he talked about, but it
appears he was working on a simulator, and he is referencing
the low-speed extension of MCAS.
Mr. Larsen. Right.
Mr. Muilenburg. We need to confirm that. We do know that he
was working at that time on a simulator. At least our best
understanding is that he was at that time working on what we
call an unqualified simulator. So it was a newer simulator that
was being brought up to standard. It was not yet at a position
where it fully represented the airplane, itself. And----
Mr. Larsen. Would he have known that? Was he supposed to
have known that?
Mr. Muilenburg. He----
Mr. Larsen. Why----
Mr. Muilenburg. Yes----
Mr. Larsen. And why was he----
Mr. Muilenburg. He knew that he was----
Mr. Larsen. Why was----
Mr. Muilenburg [continuing]. He was operating--again, our
understanding here; we haven't talked directly to him--our
understanding is that he was in a simulator development
process. And it appears from his comments that he was surprised
about some feature. Having spent some time in simulators, it is
not uncommon for us to have to work on the software to get it
to be fully representative of the airplane, over time.
Now, regarding the paper trail on that simulator, I don't
know if we have any details on that, but we can follow up.
Mr. Larsen. And we will follow up. I am over my time, and
there are other Members. We will follow up with that.
Mr. Muilenburg. I----
Mr. Larsen. So thank you. I got to say thanks.
Mr. DeFazio. I would like to recognize----
Ms. Davids. Thank you, Chairman.
Mr. Muilenburg, I would like to talk to you about the AOA
disagree alert, and that Boeing recently admitted that the AOA
disagree alert on the 737 MAX that was supposed to be a
standard feature on all MAX planes was inoperable on MAXes
where they didn't purchase the optional AOA indicator.
And it seems as though about 20 percent of the MAX
airplanes purchased, the AOA indicator--so the AOA disagree
alert was inoperable on 80 percent of the aircrafts. Does that
sound right to you?
Mr. Muilenburg. Congresswoman, I can't give you the exact
number, but it was correct that it was not implemented
correctly. We made a mistake on that, and we discovered that.
Our engineers discovered it, and we have subsequently----
Ms. Davids. OK, that is----
Mr. Muilenburg [continuing]. Made that fix.
Ms. Davids. That is good for now.
Mr. Muilenburg. And all our airplanes will have that
standard, going forward----
Ms. Davids. When did Boeing learn that the AOA disagree
alert wasn't operable on that 80 percent of the aircrafts?
Mr. Muilenburg. Congresswoman, I can get back to you with
the exact timelines, but it was--I don't want to guess on the
exact timelines, but it was----
Ms. Davids. OK, when did you personally----
Mr. Muilenburg [continuing]. Discovered by our engineers,
and then it was----
Ms. Davids. When did you personally learn about it?
Mr. Muilenburg. I just don't recall the exact timelines. I
do know that there was a lag between our discovery and it being
reported to the FAA. And again, that is----
Ms. Davids. Was there a lag between the discovery and your
finding out, and then the FAA finding out?
Mr. Muilenburg. Congresswoman, the communication timeline
on the AOA disagree alert was too long. The communications were
not done the way we should have done them. And that is one of
the reasons we have revised our review board structures.
Ms. Davids. So--I agree with you, that it was too long.
I also want to just note the issue of candor that
Congressman Allred brought up as it relates to the
communications that Boeing had with the regulators and its
customers and, thus, the flying public.
So it was only after the Lion Air accident, as I understand
it, when Boeing learned of the defect. It waited 3 years--you
waited 3 years, until 2020, to actually fix the problem.
Mr. Hamilton. So, Congresswoman, in 2017 is when we
identified the discrepancy. We immediately convened a review
board to understand whether or not it was a safety issue or
not. We analyzed it, and determined it was not critical for
safety of flight. We notified the FAA just after, I believe,
the Lion Air accident. The FAA independently convened their own
safety board, and----
Ms. Davids. So before you--you continued to manufacture the
MAX and distribute it to the customers. Did you--at that time
were you providing these MAX aircraft to--with a known defect
to your customers without telling them that?
Mr. Hamilton. Congresswoman, yes, the airplane did not
conform to the spec that--the disagree was not working. I am
not sure why we didn't notify the customers of that. But we----
Ms. Davids. Who would have been the one to decide not to
notify the customers?
Mr. Hamilton. The----
Ms. Davids. Was it your marketing team?
Mr. Hamilton. No, it would have been----
Ms. Davids. Was it----
Mr. Hamilton. It probably would have been somebody on the
engineering team on the 737 program.
Ms. Davids. OK. So it might not be a safety critical thing,
according to you, but this certainly raises ethical issues, I
would say, and issues of candor, which we have been talking
about.
And I want to bring up--I think we have got a couple of
slides here.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. OK, so this is the cover of the flight crew
operations manual, or FCOM--lots of acronyms here--delivered to
Lion Air in August of 2018. I want to note that this is 1 full
year after Boeing learned that the AOA disagree alert on the
737 MAX airplanes--that it didn't--which they didn't purchase
the AOA indicator on, that it wasn't fully functioning, and
that Lion Air didn't purchase the indicator on the disagree--I
think I need the next slide.
[Slide]
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Ms. Davids. The disagree alert was inoperative. So this
shows the August 2017--that Boeing became aware that the
disagree alert wasn't working. And it wasn't until after the
Lion Air crash in October 2018 that they let the FAA know.
I guess, regardless of whether or not you classify the AOA
disagree alert as a safety feature or--a critical safety
feature, it was required on the aircraft, was it not?
Mr. Hamilton. It was part of our configuration spec. But
there was no crew action associated when you get the disagree
message. So it was for crew awareness.
Ms. Davids. So you are saying it--so it was part of your
what?
Mr. Muilenburg. Congresswoman, it was part of the airplane
baseline. It should have been implemented on the airplanes. It
was not correctly implemented. We made a mistake.
A sister safety review board was brought together, as John
described. They came to the conclusion that they could
implement that in the 2020 timeframe, in the next software
cycle, as you referenced.
Ms. Davids. How do you decide----
Mr. Muilenburg. That did not get----
Ms. Davids. How do you decide which things are baseline
that you are not going to adhere to, and which ones you are?
Mr. Muilenburg. Yes, Congresswoman, we missed on this one.
We made a mistake. We made a mistake. And we have owned up to
that. We need to fix it.
Ms. Davids. OK.
Mr. Muilenburg. One of the reasons----
Ms. Davids. My time has expired. Hopefully we will get to
ask you another question, because we, at some point, need to
get to how we make sure, as legislators, that this doesn't
happen again.
I yield back.
Mr. DeFazio. Representative Fletcher?
Mrs. Fletcher. Thank you, Chairman DeFazio. I want to
circle back to another topic that is related to information
given to the operators, which is the pilot training following
the Lion Air crash once there was a determination to work on
the fix to the MCAS system.
There is an ongoing conversation about what additional
pilot training, if any, would be required. So I just want to
make sure that I understand. I have a couple quick questions.
Following the Lion Air crash, Boeing began developing a
software update for MCAS, correct?
Mr. Hamilton. Correct.
Mrs. Fletcher. OK. And, as part of the software update
process, does Boeing need approval of associated pilot training
standards by the FAA's flight standard service?
Mr. Hamilton. Not necessarily for that specific change at
the time.
Mrs. Fletcher. Well, it is my understanding that in
December of 2018 Boeing met with the FAA's transport aircraft
evaluation group to discuss and plan, evaluate, and validate--
--
Mr. Hamilton. That was----
Mrs. Fletcher [continuing]. The MAX, the system
enhancements, correct?
Mr. Hamilton. That was subsequent, yes.
Mrs. Fletcher. And part of that conversation was that the
FAA tasked Boeing with proposing pilot training related to the
MCAS software fix that would be evaluated and documented in the
FAA's flight standardization board report.
What level of pilot training did Boeing propose to the FAA?
Mr. Hamilton. That would have been level B training, which
is a classroom or CBT, computer-based training, training.
Mrs. Fletcher. Would it surprise you to learn that Boeing
recommended level A training at that time?
Mr. Hamilton. I am not aware of that.
Mrs. Fletcher. You are not aware that Boeing recommended
level A pilot training, instead of level B?
Mr. Hamilton. No, I am not aware.
Mrs. Fletcher. OK. Mr. Muilenburg, are you aware that
Boeing recommended level A training instead of level B?
Mr. Muilenburg. No, I am not aware of that.
Mrs. Fletcher. Well, according to a letter from Boeing to
the FAA, Boeing represented that, for the MCAS enhancement,
level A training would only be required. And Boeing stated in
the letter that its position, which--I have the letter here in
front of me, and I am happy to present to you all--that Boeing
believes that the rationale for the original recommendation was
still applicable, and that Boeing believes there isn't a
difference relating to the MCAS flight control law doesn't
affect pilot knowledge, skills, abilities, or flight safety.
Do you still believe that statement is true?
Mr. Hamilton. With the software changes being made, it was
going to prevent the MCAS from operating like it did in the
accident flight. So yes.
Mrs. Fletcher. You still believe that level A training
would be the appropriate level of training?
Mr. Hamilton. It--the software changes will prevent the
pilots from ever seeing that type of condition again.
Mrs. Fletcher. Do you understand that the FAA responded to
that by saying that they didn't--they cautioned Boeing that
level A training might not be the appropriate level of
training, and that, while they were willing to evaluate the
proposal, that Boeing was proceeding at its own risk?
Mr. Hamilton. I am not familiar with that.
Mrs. Fletcher. Mr. Muilenburg, are you familiar with that
recommendation from the FAA, that to proceed with only level A
training, Boeing would be proceeding at its own risk?
Mr. Muilenburg. Congresswoman, I am not. But we can
certainly follow up on that, and we will.
Mrs. Fletcher. Thank you. It is my understanding that,
following that exchange between the FAA and Boeing, that the
FAA said that it would be OK to proceed with scheduled flight
simulation tests.
Are you aware of that part of the process, that flight
simulator tests were scheduled?
And do you know when those were, earlier this year?
Mr. Hamilton. What timeframe are you referring to?
Mrs. Fletcher. Well, the simulator tests were scheduled for
March 13th, 2019. Are you familiar with those tests?
Mr. Hamilton. I recall that there were some simulator tests
done in Miami around that time, yes.
Mrs. Fletcher. And what date did the Ethiopian Airlines
crash take place?
Mr. Hamilton. It was March--it was in March of----
Mrs. Fletcher. March 10th, 2019, before the simulator
tests.
Thank you, Mr. Chairman. I yield back.
Mr. DeFazio. I thank the gentlelady.
I just want to--in response to a previous question I
believe Mr. Hamilton said that the FAA was completely aware of
the much-enhanced MCAS system.
But the finding of the JATR was finding F2.7-A, ``The FAA
was not completely unaware of MCAS; however, because the
information and discussions about MCAS were so fragmented and
were delivered to disconnected groups within the process, it
was difficult to recognize the impacts and implications of this
system. If the FAA technical staff had been fully aware of the
details of the MCAS function, the JATR team,'' an independent
group, ``believes the agency likely would have required an
issue paper for using the stabilizer in a way that it had not
been previously used. MCAS used the stabilizer to change the
column force feel, not trim the aircraft. This is a case of
using the control surface in a new way that the regulations
never accounted for and should have required an issue paper for
further analysis by the FAA. If an issue paper had been
required, the JATR team believes it likely would have
identified the potential for the stabilizer to overpower the
elevator.''
So there is a breakdown there, and we have just got to
determine whether it was intentional, unintentional, how much
of it lays on Boeing, and how much of it lays on the FAA. But
in this case, they seem to be laying a lot of it on Boeing, and
the communications.
Mr. Brown had a quick clarification.
Mr. Brown. Thank you, Mr. Chairman, I really appreciate it.
Mr. Hamilton, again, you know, in my response to the
questions about the flight control systems and the role of
computer software, you offered up two examples: one is the yaw
damper and the other is the auto pilot.
These systems, both of them, as you know, are engaged by
switches on the flight deck by the pilot. The switches and the
operations are clearly documented in flight and training
manuals. The crew knows when they are activated. In fact, I
know that, at least in the case of the yaw damper, and maybe
even the auto pilot, there is a warning light when it fails.
Those systems are not in the same category as MCAS, which
operates behind the scene.
So I will just conclude by saying, at the moment, during
the design, development, and promotion of MCAS, MCAS was the
only computer software that operated the flight control systems
without knowledge from the pilots or pilot input. And, for me,
as a pilot, that is a big deal, and not just in hindsight, but
at the moment, during the design, development, and promotion.
It should have been a big deal to everybody involved.
Thank you, Mr. Chairman. I yield back.
Mr. DeFazio. I thank the gentleman, and I recognize the
ranking member, Mr. Graves.
Mr. Graves of Missouri. Thanks. I want to--just a point of
clarification, as well, because there has been a lot of
emphasis put on the AOA indicators in the cockpit, whether they
should be in the cockpit or not in the cockpit.
And there is a difference between an AOA indicator and an
AOA sensor. And the AOA sensors in disagreement, obviously, had
an impact on the MCAS system. But the AOA indicator in the
cockpit--an AOA indicator isn't a primary flight system. It is
not even a secondary flight system. In fact, in all my
thousands of hours of flying, I don't think I have ever been in
an airplane that has an AOA indicator in it.
And there is a--there has been a lot of emphasis placed on
these AOA indicators in the cockpit. And it is a little
frustrating, because, to be quite honest with you, it--those
are more for a maintenance reference than they are for--they
are not a flight instrument, by any stretch.
But with that, Chairman, I appreciate this hearing.
Mr. DeFazio. I thank the gentleman. I am told that Ms.
Davids has a brief question.
Ms. Davids?
Ms. Davids. Thank you, Chairman.
So the certification process is my primary concern here, as
a legislator, as a Member of Congress who sits on the T&I
Committee. Our job is to create the framework under which
regulations will be promulgated, that are going to be the
things that keep the flying public safe.
And I think that--the first thing I want to say is that
this might be the first time in Boeing's history that we are
facing a situation where the culture of the company's top
management was controlled more by a profit motive because of
short-term concerns than by the long-term business model that
you keep bringing up of safety.
Based on all of the things that we have seen here today, I
am interested in figuring out how we make sure that, as we come
up with that framework that might need to be reevaluated,
whether it is the type certification, amended type
certification, or, when we drill down into it, what gets into a
manual or not, and how much pilot training is required.
I have heard you say a number of times the system can be
improved. And I am wondering if you have some specific areas
that we, as legislators, need to be looking at.
Mr. Muilenburg. Congresswoman, I appreciate that question.
And while we have had some challenging questions today, I think
we have a shared objective around safety of the aviation
system.
We believe there are several areas where we can work
together. Some are on the regulatory front.
We have discussed earlier things around design guidelines.
Some of the longstanding industry standards, I think, need to
be revisited.
There are some regulations on the books that could be
updated to take advantage of new technology.
We believe pilot----
Ms. Davids. What are those longstanding industry standards?
Mr. Muilenburg. Pardon?
Ms. Davids. What are the--what is a longstanding industry
standard that you--
Mr. Muilenburg. A good example are----
Ms. Davids [continuing]. Specifically think that we need to
look at----
Mr. Muilenburg [continuing]. Are assumptions around pilot
reaction times in various failure modes and scenarios.
So, again, it gets to what we assumed on pilot reaction
times, for example, in an MCAS failure scenario. We think it is
time for us to--just to revisit those, from an industry
standpoint, especially for digitally enhanced airplanes, going
forward.
We think there are opportunities for us to work together on
talent development, the pipeline for future pilots and
maintenance technicians----
Ms. Davids. Do any of the longstanding industry standards
that you think need to be looked at include things that, as a
manufacturer, you would be in charge of?
Mr. Muilenburg. Well, the----
Ms. Davids. Because the two things that you mentioned have
to do with pilot training.
Mr. Muilenburg. The first one has to do with--actually,
with design criteria.
John, you wanted to----
Mr. Hamilton. Yes, I think it is both. I think there is
advisory circulars released by the FAA that should be updated.
But then there is also our own internal guidelines and
design guides that need to be updated to reflect what we are
learning from these two accidents.
Mr. Muilenburg. We have also updated our design
requirements organization internally to do better cross-sharing
across defense and military sectors. I think that is an area
where the Government can help.
I think investing in future simulation technology, taking
advantage of virtual reality and augmented reality technologies
to enhance pilot training opportunities is another area.
The science of human factors, and how we----
Ms. Davids. Do you----
Mr. Muilenburg [continuing]. How we design for the future,
another example.
Ms. Davids. Do you think that--what about when it comes to
type certification, and the improvements or advancements,
technologically, that have been made?
We have spent this whole time talking about the family of
737s that got the original certification in 1967. Where is
that--what do you think we need to be doing about making sure
that, as lots of new technology and an entirely new system is
being integrated into a aircraft, that we are doing our jobs to
make sure that this doesn't happen again. Because you are
talking about a lot of improvements that you are already
making, but it sounds like we need to be making sure that the
FAA, as regulators, know about those things before we run into
a situation like this.
Mr. Hamilton. Yes, I would recommend--and this is one of
the JATR recommendations, is that the FAA work with industry on
part 21, on the change product rule, and look--see if there is
any enhancements that are required in that area.
Ms. Davids. I yield back.
Mr. DeFazio. And I believe this will be the last questions.
Ms. Craig has not yet had an opportunity to ask questions, and
I would recognize her.
Ms. Craig. Thank you, Mr. Chairman. I know it has been a
long day for the families of the victims here, and I just want
to say my condolences to each of you, and thank you so much for
being here.
I have been in and out of this hearing almost all day
today, and during a previous iteration of life, when I worked
in business, you know, my job was in medical technology. And in
that sector there is something called the MAUDE database. And
if there is an early warning of an issue, we were required to
report those things publicly. Our customers were required to
report those things publicly. And many of the questions I have
asked, as we have had a number of hearings with the FAA and
with others, is how do we create, moving forward, a more
robust, post-market reporting system for issues that occur.
My first question, really, Mr. Muilenburg, is, in
hindsight, when should you have grounded this plane?
Mr. Muilenburg. Congresswoman, we have asked ourselves that
question many, many times. And if we knew back then what we
know now, we would have grounded it right after the first
accident.
If we could have saved one life, we would have done it.
That is what we would have done.
Ms. Craig. Mr. Muilenburg, I spent the last 4 years of my
business career as the head of global HR for a Fortune 500
company, and I have seen tough decisions firsthand from the
inside.
There has been a lot of conversation today about your
compensation. And earlier this afternoon you indicated that,
well, that is up to the board of directors. I pulled up the
proxy statement from 2019, and did a little back-of-the-
envelope calculation.
What I want to make sure is that the people who loved those
who died, sitting in this room today, are assured by you that
Boeing executives who now regret not acting and making
decisions understand the pain that they are going through.
My back-of-the-envelope calculation, just on the number of
underlying stock options that you still have that are or are
not vested, is that just in stock options--and I understand
Boeing moved from stock options to performance-based RSUs and
restricted stock. Many companies have done that.
What I want to understand is that you are not going to
personally benefit and profit over the swings in the stock
price over this last year. Because if I look at Morgan
Stanley's report, they expect, once these planes are
ungrounded, your stock potentially to reach $500 a share. And I
know that is a long way from there today.
But you said earlier today that your board of directors
makes compensation decisions. Back of the envelope, just in
stock options, up to $500, you would have another $30 million.
That is based on the price at $75.97 that those options were
issued at. I understand how this works.
If your board in February, when they meet to issue your
performance grants and your restricted stock options, awards
you stock options for the 2019 time period, will you commit to
this committee and these family members sitting here today to
decline those awards?
Mr. Muilenburg. Congresswoman, we don't issue stock
options. Just trying to--I want to answer your question.
But our board will do a comprehensive review. They will
make their decisions. It is not about the money for me, and it
is--that is just not why I came to Boeing. And----
Ms. Craig. That is why I said I understand you don't get
stock options any more. The ones issued in 2013, you have got
some that haven't vested. You are still going to get, like,
millions of dollars from those. But when your board meets they
could decide to give you performance-based RSUs this cycle,
this time around. Or they could give you restricted stock
units.
Will you commit today to decline those awards if your board
chooses to give them to you?
Mr. Muilenburg. Congresswoman, I am anticipating that this
year's annual bonus cycle is zero. That is not where I am
focused.
I didn't come to this company for money. That is not why I
am here. And I--my board will do their work. But as I believe
we already announced last week, we expect our annual bonus
cycle to be a zero payout for our executives this year, and
that starts with me.
Ms. Craig. Thank you for being here, and thank you.
Mr. Chairman, I yield my time.
Mr. DeFazio. I thank the gentlelady.
I ask unanimous consent that the record of today's hearing
remain open until such time as our witnesses have provided
answers to any questions that may be submitted to them in
writing.
And some were submitted here today by various Members, and
we got a commitment that we would get answers on that. For
instance, the displacement of any litigation to Indonesia,
which I asked; questions that Mr. Graves asked; and others.
I also ask unanimous consent that the record remain open
for 15 days for any additional comments and information
submitted by Members or witnesses to be included in the record
of today's hearing.
Without objection, so ordered.
Again, I want to extend my condolences to the families,
thank the witnesses for their testimony.
And the committee stands adjourned.
[Whereupon, at 3:27 p.m., the committee was adjourned.]
Submissions for the Record
----------
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Appendix
----------
Questions from Hon. Peter A. DeFazio for Mr. Muilenburg
General Questions
Question 1. Mr. Muilenburg, the last two new airplanes developed by
Boeing, the 787 Dreamliner and the 737 MAX, have been the subjects of
worldwide groundings. Before the 787 grounding, the last airliner type
to be grounded was the DC-10 in 1979. What efforts has the company
taken in response to both groundings to ensure future airplane designs
do not have similar fates?
Answer. After the 737 MAX grounding, Boeing initiated a review by a
special board committee. That committee recommended several changes to
our organization and processes designed to enhance safety culture of
the company. These changes include:
(1) Creating a permanent Aerospace Safety Committee within our
Board of Directors to oversee and ensure safe design, development,
manufacture, maintenance, and delivery of our products and services;
(2) Creating a Product and Services Safety organization to review
all aspects of product safety;
(3) Realigning the Engineering function within the company, so
that engineers across Boeing will report directly to the Chief
Engineer;
(4) Establishing a design requirements program to further
facilitate the incorporation of historical design materials, data and
information, best practices, lessons learned, and detailed after action
reports to reinforce Boeing's commitment to continuous improvement;
(5) Enhancing our Continued Operational Safety Program to aid
transparency and visibility of safety related issues; the Continued
Operational Safety Program now will require the Chief Engineer's review
of all safety and potential safety reports;
(6) To anticipate the needs of future pilot populations, re-
examining assumptions about flight deck design and operation in
partnership with our airline customers and industry members;
(7) Expanding our Safety Promotion Center for employees to learn
and reflect on our safety culture and renew personal commitments to
safety;
(8) Expanding our anonymous safety reporting system to strengthen
safety management systems within Boeing and our supply chain;
(9) Investing in new capabilities, including enhanced flight
simulation and computing, and advanced R&D for future flight decks, as
well as pilot and maintenance technician training and STEM education.
Question 2. Mr. Muilenburg, the 737 fuselage is based on the 707
fuselage introduced in 1958. The original 737 itself was type-certified
in 1967. The trim wheel in the 737 MAX--an important part of the story
of the 737 MAX crashes--also dates to the 1967 737 version. For more
than 50 years this aircraft's type certificate has been amended 13
times. Redesigns may save design and development costs, but they
present challenges regarding upgrades to the safety of the aircraft.
What sorts of challenges did re-designing the 737NG into the 737 MAX
present and when will Boeing decide the 737 has had its day and that
it's time to develop an entirely new single-aisle airplane?
Answer. The certification of a derivative model aircraft is not
necessarily less expensive, or less time consuming, than obtaining a
new type certificate. For instance, the certification for the MAX took
more than five years, which is longer than the process for some new
type certificates. Each aircraft presents its own challenges. However,
building upon existing, safe designs with a proven track record has
continuously improved the safety record of the aviation industry for
decades. As to future new-airplane development decisions, we make such
decisions deliberately and methodically, after studying the market
demand and the current state of technology, among many other factors.
FAA Emergency Airworthiness Directive
The day after Boeing issued its November 6, 2018, flight crew
operations manual bulletin numbered TBC-19, the Federal Aviation
Administration (FAA) issued its emergency airworthiness directive (AD)
to owners and operators of 737 MAX airplanes. Like Boeing's bulletin,
the emergency AD described how erroneously high angle of attack (AOA)
inputs can cause ``repeated nose-down trim commands,'' with nose down
trim increments ``lasting up to 10 seconds,'' which, if not addressed,
could cause control difficulties and ``possible impact with terrain.''
As with the bulletin, there was no mention of MCAS whatsoever in this
document issued to operators across the globe after the Lion Air flight
610 accident.
Question 1. Did Boeing work with the FAA to develop the FAA's
emergency AD issued on November 7, 2018?
Question 2. Did Boeing have any discussions with the FAA, written
or oral, specifically about whether MCAS should be mentioned in this
document?
Question 2.a. If yes, why was MCAS ultimately excluded?
Question 2.i. Did Boeing recommend or suggest that MCAS be
excluded?
Question 2.ii. If so, why did Boeing suggest MCAS be excluded from
the FAA's emergency AD?
Question 2.b. If no, why did you not discuss MCAS with the FAA in
regard to the emergency AD?
Answer. Boeing and the FAA worked closely together in developing
both Boeing's Flight Crew Operations Manual Bulletin (``OMB'') issued
on November 6, 2018, and the FAA's Emergency Airworthiness Directive
(``AD'') issued the next day, on November 7, and were in agreement
about the content of both issuances. Boeing also issued a fleet-wide
message on November 10 that provided details regarding the MCAS
function.
Boeing issued the November 6 OMB to all owners and operators of 737
MAX planes. The OMB called attention to the airplane effects and flight
deck indications that could result from erroneous AOA data, including
nose down stabilizer trim movement, and directed flight crews to
existing procedures to address the condition. The OMB reinforced that
implementation of the Runaway Stabilizer Non-normal Checklist, one of
only a handful of procedures that pilots must commit to memory, was the
appropriate response to uncommanded nose down stabilizer trim movement.
The OMB also reminded flight crews of the importance of trimming out
the airplane before turning off the electric stabilizer trim system,
noting that ``[i]nitially, higher control forces may be needed to
overcome any stabilizer nose down trim already applied,'' and that
electric stabilizer trim can be used to neutralize control column pitch
forces before moving the STAB TRIM CUTOUT switches to CUTOUT.'' The OMB
advised operators to insert it into their Flight Crew Operations
Manual, and provided that the OMB ``remains in effect until Boeing
provides additional information on system updates that may allow this
Bulletin to be canceled.''
The same day Boeing issued the OMB, the FAA issued a Continued
Airworthiness Notification, which advised that the MAX involved in the
Lion Air incident ``appears to have experienced anomalies in the angle
of attack, airspeed, and altitude indications.'' The Notification
further explained that Boeing had issued the OMB to address the issue,
and that the FAA was considering mandating the OMB.
The FAA followed through with this action the next day (November
7), issuing an Emergency Airworthiness Directive to mandate the
guidance in Boeing's OMB. The AD required the information in the OMB to
be added to all 737-8 and 737-9 Airplane Flight Manuals within three
days. This information included the instruction, almost verbatim from
the OMB, to follow the existing runaway stabilizer procedure if flight
crews experience circumstances involving uncommanded downward trim
commands. Like the OMB, the AD also referenced the possible need for
flight crews to use electric stabilizer trim to overcome nose down trim
already applied before activating the stab trim cutout switches. Boeing
began complying with this AD by including a revised Airplane Flight
Manual with delivered 737 MAX airplanes, and advised operators on
November 8 that the revised Manual was available on the Boeing web
portal.
On November 10, responding to operator requests for additional
information about the subject matter of the OMB and AD, Boeing sent a
fleet-wide message to all 737 NG and MAX customers that provided
technical details and operational information regarding the MCAS
function.
Boeing's interactions with the FAA in connection with the
preparation and issuance of the OMB and AD reflected the Company's
commitment to full transparency with the FAA and to acting in close
coordination with regulatory authorities, and subject to their ultimate
authority, on safety issues.
Boeing's Response Post-Ethiopian Airlines Flight 302 Accident
Mr. Muilenburg, at an April 29 press conference, you said that the AOA
Disagree alert, which we learned was inoperative on most 737 MAX
aircraft, ``is not something that drives pilot action.''
Question 1. Are you saying that pilots would do nothing if their
AOA Disagree alert illuminates?
Question 2. How do you reconcile your comments with the Indonesian
authorities' report released last month on the Lion Air crash
indicating that without the alert's enabling, pilots could not document
the issue, which may have helped maintenance staff identify the mis-
calibrated AOA sensor that triggered MCAS on Lion Air flight 610?
Answer. Mr. Muilenburg was speaking about the fact that, at the
time of the accidents, there were no specific pilot actions described
in the Flight Crew Operations Manual for the situation when the AOA
DISAGREE alert illuminated. We do not believe that the Lion Air report
contains any contradictory information.
At the time of the accidents, and of Mr. Muilenburg's statement,
references to the AOA DISAGREE alert in flight crew manuals and
procedures did not direct the crew to take any specific action in
response to the alert activating, but instead directed the crew to
other information present on the flight display. Thus, the Boeing
flight crew manual at the time of the accident included a checklist for
the AOA DISAGREE alert, which sets forth the procedures that flight
crew should use in a situation in which the alert activates. That
checklist did not specify any pilot action, but rather highlighted that
if the alert is on, ``airspeed errors'' and the ``IAS DISAGREE alert''
(airspeed), as well as ``altimeter errors'' and the ``ALT DISAGREE
alert'' (altitude), ``may occur.''
These airspeed and altitude alerts are triggered independently of
the AOA DISAGREE alert, and have their own prominent displays on the
flight deck. Moreover, they have their own dedicated checklists that,
unlike the then operative AOA DISAGREE alert checklist, do specify
responsive crew action.
When the MAX returns to service, all MAX airplanes will have an
activated and operable AOA DISAGREE alert as a stand-alone, standard
feature.
Question 3. Mr. Muilenburg, at an April 29 press conference, you
said that MCAS is ``not something that needs to be trained on
separately. It's fundamentally imbedded in the handling qualities of
the airplane. And so, when you train on the airplane, you're being
trained on MCAS.''
Knowing what you know now, do you stand by your comments?
Answer. MCAS is an extension of the pre-existing Speed Trim
function, which helps stabilize airplane speed by commanding stabilizer
in the direction to oppose a speed change, and which has been used
safely on 737 series airplanes for decades. As such, MCAS is part of an
integrated flight control system, and its effects are embedded in the
handling qualities of the airplane. Going forward, however, as Mr.
Muilenburg testified, Boeing will provide additional information
regarding the MCAS system as part of training for the MAX.
Question 4. Given the two accidents involving unintended MCAS
activation, do you now believe that pilots should have known about MCAS
before flying a MAX? If so, why now and not then?
Answer. In accordance with FAA regulatory guidance, flight training
for all Boeing airplanes, including the 737 MAX, is designed to give
pilots the knowledge, skills, and abilities necessary to safely operate
each model on which they are licensed (or ``type-rated''). Boeing and
the FAA coordinated closely over the course of several years in
developing the necessary training requirements and flight manual
content for the MAX. Since the accidents, the FAA and Boeing have
worked together to develop additional MAX flight crew training, as well
as flight manual content, that addresses the updates Boeing has made to
MCAS. The inclusion of specific training and flight manual content on
MCAS is consistent with the feedback Boeing has received from pilots
and its customers, and reflects the additional knowledge and
understanding that Boeing has gained as a result of these accidents.
Question 5. Mr. Muilenburg, at an April 29 press conference, you
stated MCAS was ``designed to provide handling qualities for the pilot
that meet pilot preferences. We want the airplane to behave in the air
similar to the previous generation 737's. That's the preferred pilot
feel for the airplane, how it feels as they're flying it. And MCAS is
designed to provide those kinds of handling qualities at high angles of
attack.''
If that was indeed the goal, would it have been advisable to inform
pilots of potential MCAS malfunctions that would affect handling
qualities or the feel for the airplane?
Answer. In accordance with FAA regulatory guidance, flight training
for all Boeing airplanes, including the 737 MAX, is designed to give
pilots the knowledge, skills, and abilities necessary to safely operate
the airplanes which they are licensed to fly. Boeing and the FAA worked
together over multiple years to establish the appropriate training
materials for the MAX. Since the accidents, Boeing and the FAA have
worked together to develop additional MAX flight crew training, as well
as flight manual content, that addresses the updates Boeing has made to
MCAS.
Question 6. Mr. Muilenburg, immediately after the Ethiopian
Airlines crash, Boeing made clear it believed that the grounding of the
737 MAX was unnecessary. In fact, media reports widely circulated your
disagreement with the idea in your conversation with President Trump,
and Boeing further stated on March 12 that ``based on the information
currently available, we do not have any basis to issue new guidance to
operators.''
Do you agree with regulators' decisions to ultimately ground the
737 MAX?
Answer. Boeing supports the FAA's decision to ground the 737 MAX.
Question 7. Did Boeing leadership ever consider issuing a service
bulletin or requesting voluntarily that FAA ground the 737 MAX prior to
the FAA's official grounding?
Question 7.a. If Boeing did consider this, please provide
specifics. When was this issue raised, under what circumstances, and by
whom? Why was the ultimate decision made not to request that the FAA
ground the 737 MAX and who at Boeing made that decision?
Answer. Boeing does not have the authority to ground airplanes.
Boeing does, however, provide civil aviation authorities and our
airline customers with any relevant information we may receive or
develop, so that they can make informed decisions on how to regulate
aircraft operations.
In its written response to Question #16 of the Committee's April 1,
2019 request to Boeing, Boeing provided a detailed timeline of the
actions taken by the company after the Lion Air accident through the
date of the 737 MAX grounding, and we refer you to that response.
Question 8. When did Boeing first learn about the FAA decision to
ground the 737 MAX in U.S. airspace?
Answer. Boeing learned about the grounding order on March 13, 2019.
Question 9. If Boeing felt that the 737 MAX was safe enough to not
warrant grounding, why was it then pursuing software changes to MCAS
even before the Ethiopian Airlines crash?
Answer. On November 6, after a week of intensive efforts to
understand and analyze the accident sequence, a Boeing Safety Review
Board (``SRB'')--Boeing's established process for evaluating in-service
safety issues--determined that the crew workload effects of erroneous
AOA input leading to activation of the MCAS function presented a safety
issue, and also determined that appropriate pilot action could
counteract the condition. That same day, Boeing issued an Operations
Manual Bulletin (``OMB'') to the fleet calling attention to the
airplane effects and flight deck indications of the condition, and
directing flight crews to existing procedures to address it. Boeing
also moved forward expeditiously to develop an update to the MAX's
flight control computer software to eliminate the risk of erroneous AOA
data leading to repeated MCAS activation.
On November 7, 2018, a day after Boeing issued its OMB, the FAA
issued an Emergency Airworthiness Directive (``AD'') requiring airlines
to amend their Airplane Flight Manuals to include the OMB guidance. The
FAA also convened multiple Corrective Action Review Board (``CARB'')
meetings--the FAA's analog to Boeing's SRB process--starting in late
November to evaluate issues relating to the airplane effects of
erroneous AOA data and MCAS activation. Relying on the FAA's
independent risk analysis, the CARB process largely concurred with
Boeing's analysis of the safety issue and proposed risk mitigation
approach--although the FAA did determine that that Boeing should
implement the flight control computer software update more quickly than
Boeing had originally proposed, an accelerated schedule the Company
accepted. Referencing the FAA's independent risk analysis, an FAA CARB
concluded in December 2018 that, as development of the software update
proceeded, the MAX fleet could continue operating until the new
software was implemented on the FAA-approved schedule.
Implementing the revisions to the MAX's flight control computer
software is a complex task, and the Company has been and remains
committed to proceeding carefully and deliberately. Throughout this
process, Boeing has closely coordinated with the FAA (and other
regulators) to ensure that the software update and related issues are
evaluated thoroughly and comprehensively.
What Boeing Knew Then
You testified repeatedly before our Committee that had Boeing known
what it knows now, the company would have made different decisions with
regard to the 737 MAX. Specifically:
In response to my question about why Boeing didn't design MCAS
from day one to use information from both AOA sensors, you
said, ``Mr. Chairman, we have asked ourselves that same
question over and over. And if back then we knew everything
that we know now, we would have made a different decision.''
In response to Rep. Craig's question about when Boeing should
have grounded the plane, you said, ``Congresswoman, we have
asked ourselves that question many, many times. And if we knew
back then what we know now, we would have grounded it right
after the first accident.''
Before the Lion Air accident, Boeing was already aware that MCAS relied
on just one AOA sensor, and according to documentation made public at
the hearing, a Boeing engineer as far back as 2015 had already asked,
``Are we vulnerable to single AOA sensor failure with the MCAS
implementation or is there some checking that occurs?''
In addition, other documentation made public at the hearing established
that Boeing was also already well aware, before the Lion Air accident,
that if a pilot did not react to unintended MCAS activation within 10
seconds, the result could be catastrophic.
Question 1. What new information did Boeing learn only after the
October 2018 Lion Air accident, that it didn't already know previously,
with regard to the potentially catastrophic risk that a malfunctioning
AOA sensor could have on the MAX due to its interaction with MCAS?
Question 2. What new information did Boeing learn only after the
March 2019 Ethiopian Airlines accident, that it didn't already know
previously, with regard to the potentially catastrophic risk that a
malfunctioning AOA sensor could have on the MAX due to its interaction
with MCAS?
Answer. In designing MCAS, Boeing relied on well-accepted,
industry-wide assumptions in evaluating how pilots would react to the
uncommanded activation of MCAS for any reason, including erroneous AOA.
Those assumptions proved not to be accurate in these accidents.
Accordingly, we now know that there is a greater risk from unintended
activation of MCAS due to erroneous AOA data than we originally
thought. Our system redesign addresses this issue.
Boeing CEO Bonus Pay
On November 5, 2019, it was reported that you were declining to take
your bonus in 2019 and opting out of consideration for equity grants
until the 737 MAX is back in the air. Yet, as of October 26, 2019,
Boeing had already announced that it would not be paying annual bonuses
to its management, executives, or unionized engineers and white-collar
workers.
Question 1. What 2019 bonus, if any, are you declining to accept
that Boeing had not already determined that you would not be receiving?
Answer. Mr. Muilenburg has requested that he not receive any bonus,
either short- or long-term, for 2019. He has also requested that the
Board not provide him any equity grants until the MAX returns to
service globally. Mr. Muilenburg has also committed to donating the
entire value of any previous equity grants that vest in 2020 to
charity.
Question 2. With regard to your opting out of consideration for
equity grants, are you foregoing consideration for these equity grants
until the 737 MAX is back in the air, or are you merely deferring
consideration for these equity grants?
Answer. Please see the response to the previous question.
Question 3. How much was your bonus in 2018, the year of the Lion
Air accident, and how much of it have you offered to return?
Answer. Mr. Muilenburg's 2018 compensation is publicly available in
Boeing's annual proxy statement, which can be found at www.boeing.com.
Question 4. How much did you receive in equity grants in 2018, the
year of the Lion Air accident, and how much of these grants have you
offered to return?
Answer. Mr. Muilenburg's 2018 compensation is publicly available in
Boeing's annual proxy statement, which can be found at www.boeing.com.
Moving Lawsuits to Indonesia
In May, it was reported that Boeing had indicated in court filings that
it was likely to request that cases on behalf of the victims of the
October 2018 Lion Air accident involving the 737 MAX be moved to
Indonesia. At the hearing, in response to questions from both Rep. Hank
Johnson and me about whether Boeing plans to seek to move litigation
filed on behalf of victims of the Lion Air accident from Chicago to
Indonesia, you stated that you did not know the answer and would get
back to our Committee with an answer.
Question 1. Your answer also suggested this was an issue you had
not been briefed on or involved in, in any way at Boeing. Now that you
have had time to review records relevant to this question since the
hearing, did you receive any briefings regarding Boeing's litigation
strategy regarding the Lion Air accident in Indonesia?
Question 2. Is Boeing planning to seek to move litigation filed on
behalf of the families of victims of the Lion Air accident from Chicago
to Indonesia?
Question 3. Does Boeing have any reason to believe that if it loses
this litigation, it will ultimately have to pay less to the plaintiffs
if the litigation takes place in Indonesia as opposed to in the United
States?
Question 4. Are you aware of differences between the Indonesian
legal system and the one we have in the United States including but not
limited to the lack of a Seventh Amendment right to a jury trial, a
right to a cross-examination of witnesses, and a requirement of
discovery in Indonesia?
Answer. In response to both MAX accidents, Boeing has offered to
engage in mediations in the United States to resolve the families'
claims without the need for any litigation. To facilitate this, Boeing
arranged for a prominent Chicago mediator, a former Chief Judge of the
Circuit Court of Cook County, to assist, and is paying the full costs
of all mediations. Since the middle of July, Boeing has been working
with the mediator and the families who lost loved ones in the Lion Air
accident, to settle these cases. We are pleased to have resolved
approximately one half of the claims filed in the United States on
terms that we believe fairly compensate the victims' families. We
remain committed to this mediation process. If, at some point and
despite Boeing's best efforts, an impasse is reached in the mediation
process, the litigation may resume. And at that point, well-settled
U.S. law will give Boeing the option of requesting that the court
determine whether another jurisdiction is the appropriate venue for
such cases.
Boeing is aware that there are differences between the litigation
procedures available in the U.S. and those available around the world.
United States courts have routinely found such foreign forums
appropriate to handle aviation accident litigation in certain
circumstances. All decisions in this litigation about forum will be
decided by U.S. courts applying well-settled U.S. law.
Questions from Hon. Rick Larsen for Mr. Muilenburg
Question 1. I understand that when Boeing's attorneys met with
Committee staff regarding Mr. Forkner's Instant Messages, Boeing was in
the midst of investigating whether his reference to problems with MCAS
in the simulator were actually problems with MCAS or with the simulator
itself. Now that Boeing has had time to further investigate these
issues, please provide the Committee with any supporting records
indicating the problems that Mr. Forkner referenced were really
problems with the simulator or conversely issues with MCAS itself.
Please include a list of Boeing managers or employees and FAA
managers and employees to whom Mr. Forkner reported these issues,
whether MCAS- or simulator-related, and the actions taken to remedy the
issues and provide supporting records to verify this correction.
Answer. As you note, Boeing provided Committee staff with an
extensive briefing on this topic. This included providing Committee
staff with supporting records, including a discrepancy report for the
simulator that closely matches the conditions described in the instant
message, and documentation regarding the investigation and resolution
of that discrepancy report. Our review remains ongoing; we have no
additional documentation to provide at this time.
Questions from Hon. Salud O. Carbajal for Mr. Muilenburg
Question 1. In simulator tests, I understand that Boeing didn't
even simulate erroneous MCAS activation to the full 2.5 degrees of
stabilizer motion. Is that correct and if so please explain why that
sort of simulation did not take place?
Answer. This is not correct. Among other conditions considered
during the MAX development process, Boeing simulated uncommanded MCAS
operation to the maximum nose down stabilizer authority both before and
after the expansion of MCAS to operate in low speed conditions. In
early 2016, Boeing conducted simulator testing in an engineering
simulator known as an eCab involving the uncommanded activation of MCAS
to 3.0 degrees of nose down stabilizer motion, which at the time was
the maximum authority at low speed.
Questions from Hon. Sharice Davids for Mr. Muilenburg
Question 1. Mr. Muilenburg, when and how did you learn that the AOA
Disagree Alert on the 737 MAX was only functioning on aircraft that
purchased the optional AOA Indicator? Please also include who informed
you of that information and what you did in response.
Answer. Mr. Muilenburg was not aware of the discrepancy between how
the AOA DISAGREE alert was intended to function, and how it was
delivered, until after the Lion Air accident. At that point, the Boeing
Company took swift action to address this issue. Pursuant to the
recommendations of a special board committee, the Boeing Company has
revised its Board structure to ensure issues like this are brought more
quickly to the attention of senior management.
Question 2. Has Boeing taken any disciplinary action against any of
the individual Boeing employees who were aware the AOA Disagree Alert
was not functioning prior to the Lion Air crash and did not take any
steps to either inform the FAA or your customers? If so, please
describe what action Boeing has taken.
Answer. As Mr. Muilenburg testified, our current focus as a Company
is on doing everything possible to ensure the safe return of the MAX to
service. We owe this to our customers and the flying public. That said,
once the MAX is safely back in service, the time will come to consider
further questions of accountability. And Boeing will not hesitate to
hold people accountable, where appropriate.
Question 3. Boeing's marketing brochures published after the FAA
certified the 737 MAX in 2017 suggest that Boeing had expected the FAA
to require more significant pilot training than FAA ultimately required
for the MAX. Did the FAA's acceptance of Level B non-simulator training
for the 737 MAX come as a surprise to Boeing?
Answer. The determination of what training was appropriate for the
MAX was a multi-year process between Boeing and the FAA. Boeing
provides input into that process. However, commercial aviation is a
highly regulated industry, and both manufacturers and customers know
that the relevant civil aviation authorities ultimately decide what
training is required.
Questions from Hon. Sam Graves of Missouri for Mr. Muilenburg
Question 1. How is Boeing working to develop procedures that are
more tolerant of ``human factors'' or interactions between ``human and
machine''? Is human performance currently a major consideration during
the safety evaluation process?
Answer. Boeing's design, analysis and evaluation approach is based
on FAA guidance and published industry standards. Human performance is
and will continue to be an important consideration in the evaluation of
all Boeing airplanes. As part of the design and evaluation process,
Boeing has Human Factors specialists, engineers, and pilots that
consider the effects of cognition, perception, physical ergonomics,
anthropometry, and human computer interface on Boeing's design. Boeing
is in the process of re-evaluating our processes and assumptions
regarding human factors as a result of information we have learned from
the investigations into the MAX accidents. This review is not limited
to the MAX.
Question 2. It is Boeing's position that the MCAS was not hidden
from FAA, customers, and pilots. In what ways did Boeing ensure MCAS
was known and understood by all those parties?
Answer. Boeing briefed the FAA and international regulators on
numerous occasions about MCAS and its final design parameters. Although
MCAS itself had been discussed in multiple briefings over many years,
the meetings and information exchanges with regulators regarding MCAS's
final design parameters began in mid-2016 and continued over subsequent
months. The information provided to the FAA in these interactions
included MCAS's maximum stabilizer authority of 2.5 degrees, as well as
other aspects of the control law's functioning. For example, the use of
MCAS at low speeds was included in briefing materials for meetings
between Boeing and the FAA in July 2016, a revised certification
deliverable submitted to the FAA in October 2016, and materials from
validation meetings between Boeing staff and regulators in the fall of
2016.
In addition to these briefings, FAA personnel also observed the
operation of MCAS during certification flight testing. Boeing and the
FAA began certification flight testing of the 737 MAX 8 in August 2016.
Multiple conditions involving MCAS activation were flown through
January 2017. The objectives for these tests included demonstrating
that the 737 MAX 8 had compliant maneuvering and handling
characteristics in stall and near-stall conditions. The tests also
evaluated whether the airplane could safely fly and land with various
control system malfunctions or simulated failures. The conditions
tested included MCAS's performance during low speed stalls, and during
these tests, MCAS was activated nearly to the limit of its maximum
stabilizer authority of 2.5 degrees. FAA personnel--including
engineers, pilots, and at times both--were on board many of these
flight tests to observe the performance of the flight conditions,
including those involving MCAS. In some cases, FAA test pilots were at
the controls and flew the relevant conditions. Boeing also provided the
FAA with data of MCAS activating in low speed conditions.
Descriptions of MCAS were included in presentations given to
multiple customers at conferences for MAX customers, and Boeing
received questions from customers about MCAS and its operation prior to
delivery. Boeing did not hide information on the system, and provided
information in response to those customer inquiries.
Question 3. When the MAX and MCAS were being tested, what were
Boeing's assumptions related to flight crews' reactions to erroneous
MCAS function?
Answer. As authorized by applicable FAA guidance, including FAA
Advisory Circular 25-7C (``Flight Test Guide for Certification of
Transport Category Airplanes''), in conducting their hazard
assessments, Boeing's subject matter experts made a series of
assumptions about how a flight crew would react if MCAS failed or did
not function as intended. Consistent with established FAA guidance,
this included the assumption that the crew would recognize and address
uncommanded MCAS activation through normal use of the control column
and the electric trim switches, and that the crew would also be able to
use the stabilizer cutout switches and rely on manual trimming (as
outlined in the Runaway Stabilizer Non-Normal Procedure) to stop any
unintended stabilizer motion. Test pilots participated in the simulator
testing of MCAS and had vital input into the hazard analysis.
Question 4. How is Boeing working with customers, airlines, pilots,
and regulators to address their concerns with the 737 MAX going
forward?
Answer. Boeing has taken extensive action to update the MAX flight
control system, and to rebuild confidence with our customers, our
regulators, and the pilots who fly our aircraft.
We have made three key changes to the MCAS flight control software
that will prevent accidents like these from happening again:
The flight control system will compare inputs from both
angle-of-attack sensors, and MCAS will not activate if the sensors
disagree by 5.5 degrees or more.
MCAS will no longer activate repeatedly. It will provide
one input for each elevated angle-of-attack event.
Finally, MCAS will never be able to command more
stabilizer input than can be counteracted by the flight crew pulling
back on the control column.
Boeing has worked to update the MAX flight control software, we
have been actively engaged with airlines and pilots throughout the
process. As of November 26th, 2019, Boeing has conducted simulator
sessions with 545 participants from 99 of our airline customers and 41
global regulators to give them an opportunity to fly the new software.
We have spent over 150,000 engineering and test hours relating to the
MAX, and have flown more than 992 test and production flights.
Boeing has been transparent with regulators in their review of the
MAX, and, consistent with our culture, we have prioritized safety. The
MAX will not return to service until the FAA and other global
regulators have complete confidence that it is safe to do so.
Questions from Hon. Garret Graves of Louisiana for Mr. Muilenburg
Question 1. It does seem that Boeing, the Boeing ODA, and FAA did
not always communicate well and had both lax as well as informal
recordkeeping processes. Do you believe these processes need to be
improved? If so, how would you propose to improve Boeing's
communication and recordkeeping processes?
Answer. As Mr. Muilenburg testified, Boeing believes these
processes can and should be improved. The FAA requires extensive and
detailed recordkeeping from ODA holders in order to enable the FAA to
conduct compliance checks and audits of those ODA holders' performance.
Boeing is consistently working to improve the performance of our ODA,
and that includes our recordkeeping and our transparency with
regulators.
Boeing's ODA procedures manual, which is approved by the FAA,
contains procedures to ensure certain communications between Boeing ODA
unit members and the FAA are formally documented and managed. These
procedures help ensure the ODA is properly following FAA guidance.
Expanding this type of documentation requirement will help facilitate
both safety and transparency.
Question 2. Additionally, during the hearing I asked Mr. Muilenburg
to provide the Committee with responses to the following questions:
Question 2.a. After reviewing the recommendations of NTSB and
others available as of the date of the hearing (October 30, 2019),
please advise the Committee of any of those recommendations that Boeing
does not concur with?
Answer. Boeing is deeply committed to the safety of its products
and the safety of the aviation system and value the role of the NTSB in
promoting aviation safety. We do not oppose the recommendations from
the NTSB to the FAA on September 26, 2019. Boeing has already
undertaken steps that align with at least one of the NTSB's
recommendations.
The NTSB recommended that FAA require manufacturers to consider the
way cockpit design can impact pilot reaction to alerts and alarms that
may sound in non-normal situations.As a result of a recommendation from
a special committee of Boeing's Board of Directors, the company is
already planning to work with our airline customers to re-examine the
way we design our cockpits, with the goal of helping pilots to
prioritize their attention and their actions when faced with multiple
alerts and alarms. Boeing is taking this step with the recognition that
pilot training and experience can vary significantly in different
regions of the world.
Question 2.b. Provide an explanation of the specific changes Boeing
is making to the 737 MAX to help us better understand the proposed
fixes Boeing will submit to the FAA for recertification?
Answer. Boeing has made 3 key changes to the MCAS flight control
software:
The flight control system will compare inputs from both
angle-of-attack sensors, and MCAS will not activate if the sensors
disagree by 5.5 degrees or more
MCAS will no longer activate repeatedly. It will provide
one input for each elevated angle-of-attack event.
Finally, MCAS will never be able to command more
stabilizer input than can be counteracted by the flight crew pulling
back on the control column.
In addition, working under the guidance of the U.S. Federal
Aviation Administration, Boeing also addressed certain highly
improbable scenarios involving the flight control computers on the 737
MAX. The two flight control computers on each MAX airplane will now
monitor one another continuously, known as ``cross-checking.'' This
will further enhance the safety of the airplane.
Question 2.c. Provide responses to the following recommendations
made by the 737 MAX accident victims' families. Is Boeing willing to
commit to----
i. Publicly disclosing the MCAS fix?
ii. Clearly defining the utility of MCAS?
iii. Addressing concerns that the culture within Boeing might have
been prioritizing the wrong things?
iv. Ensuring that there were no efforts to conceal the MCAS and
its role?
v. Ensuring that the entire airplane is viewed as an integrated
system, as opposed to individual components where safety regulators may
not be able to recognize their role in the larger system.
Answer. Yes, Boeing is committed to keeping the public informed
about the status of the enhancements being made to the MCAS system.
Boeing has created a public website with information regarding the MAX
to facilitate dissemination of information regarding the MAX. That
website is located at http://www.boeing.com/737-max-updates/. Boeing is
also committed to demonstrating the safety of the 737 MAX to regulators
as well as the flying public, including the safety of its design and
the improvements that have been made since the accidents. As Boeing has
publicly stated, when the MAX returns to service, MCAS will compare
inputs from both angle-of-attack sensors on the MAX, it will only
activate one time per high angle-of-attack event, and MCAS will never
command more stabilizer input than can be counteracted by the flight
crew pulling back on the control column.
In addition, Boeing is committed to safety as a core value of the
company. Boeing has undertaken a number of structural changes to
strengthen this commitment, including the creation of a permanent
Aerospace Safety Committee within our Board of Directors, the creation
of a new internal Product and Services Safety organization, and
reorganization of the company's engineering function. These changes
will enhance and amplify our focus on safety, strengthen our culture,
and help to ensure that the safety of all our products are evaluated
holistically.
Boeing is also committed to ongoing transparency with FAA and
international regulators, who were briefed on multiple occasions about
the existence of MCAS, as well as MCAS's final configuration and
operating parameters. During the certification process, MCAS was
installed on the airplanes used for training-related flight testing
that the FAA administered in August 2016. And FAA personnel observed
the operation of MCAS in its final configuration during certification
flight testing, beginning in August 2016 and continuing through January
2017. Boeing is working hand-in-hand with regulators to return the 737
MAX to service.
Question 3. The Chairman read from a December 2015 email where a
Boeing engineer asked: ``Are we vulnerable to a single AoA sensor
failure . . . '' In what context was this email sent and what exactly
is your understanding of the concern raised in the email? How was the
concern addressed?
Answer. The development of MCAS was an integrated effort involving
numerous technical disciplines across Boeing. Multiple Boeing test
pilots, as well as engineers across many different organizations, were
involved in the development process and in the work of designing the
function's operating parameters, developing test conditions, and
evaluating the safety and efficacy of the design. Information was
shared freely among the individuals and groups involved in these
efforts, and the discussion of issues relating to the evolving design
was robust.
The referenced communication occurred during this design process.
The issue raised in the quoted sentence was one among innumerable
technical issues discussed during the design and development of the 737
MAX. As Mr. Hamilton testified, he has discussed the general topic of
MCAS's reliance on a single sensor with one of the engineers involved
in this exchange. As Mr. Hamilton further testified, this communication
reflects and demonstrates Boeing's open engineering culture, which
encourages the robust discussion of technical issues and concerns as an
integral part of the design process.
Boeing engaged in a multi-step process for evaluating the potential
safety considerations involved in the implementation of MCAS. At each
stage of the design, development, and testing of MCAS, Boeing subject
matter experts reviewed and evaluated the design change and its
potential safety implications. The MCAS safety evaluation was
consistent with applicable FAA guidance, including in relying on well-
accepted, industry-wide assumptions by Boeing's experts about how crew
members would act or react to different scenarios involving uncommanded
MCAS activation.
Question 4. During the hearing, Mr. Hamilton stated that a version
MCAS is implemented on the KC-46 tanker. Can you provide more details
on the KC-46 tanker version of MCAS and the 737 MAX MCAS? Please
describe any differences and the reason for those differences?
Answer. A version of the MCAS control law was implemented on the
KC-46 767 Tanker airplane. However, the architecture, implementation,
and pilot interface of MCAS are different for the KC-46 tanker and the
737 MAX.
The 737 MAX MCAS function is an extension of the pre-existing Speed
Trim System. This system resides in the Flight Control Computer (FCC),
and helps stabilize the airplane speed by commanding stabilizer in the
direction to oppose a speed change. This system has been used safely on
737 series airplanes for decades. In adding MCAS to the 737 MAX, Boeing
determined to utilize the existing speed trim system architecture,
including use of a single sensor for AOA inputs, consistent with the
fundamental airplane design principle of minimizing unnecessary changes
to a sound and safe existing airplane design. With this design, the 737
MAX was able to meet all design requirements, including those
associated with the applicable functional hazard assessment hazard
categories.
Question 5. Were there differences between the final MCAS design
and its original design requirements? The witnesses indicated that
Boeing's MCAS design met FAA regulatory standards and Boeing's own
design requirements. What were those standards and design requirements?
On what basis was it determined that Boeing's MCAS design met FAA
regulatory standards and Boeing's own design requirements?
Answer. MCAS's design changed over time. Boeing developed and
refined MCAS design requirements, including those requirements
discussed by the witnesses, such as the requirements related to dive
recovery and MCAS's interaction with the piloting of the airplane, that
defined how MCAS would function in normal operation. MCAS, as
originally certified, met those requirements for normal operations.
Unless otherwise expressly noted in the requirements, the specific
requirements were not intended to apply to abnormal operation or in
failure conditions. To assess those situations, Boeing experts
initially performed a thorough safety assessment for the initial MCAS
design, which would activate only in high-speed conditions, with Boeing
test pilots and engineers conducting a number of piloted simulator
sessions in 2012 and 2013 to evaluate possible hazards. In March 2016,
concurrently with developing the requirements for MCAS to operate at
low speeds, Boeing subject matter experts--including both engineers and
experienced pilots--conducted an additional targeted assessment of the
potential hazards posed by MCAS's greater stabilizer authority at low
speeds. In performing this assessment, Boeing's experts applied their
engineering judgment and piloting experience to the existing safety
analysis and data for the earlier MCAS design, and also considered new
performance data generated through piloted simulator testing and
computer analysis of MCAS's operation at low speeds.
Boeing's subject matter experts had already concluded that MCAS's
earlier design met all applicable functional hazard assessment
thresholds. Based on their updated hazard analysis, Boeing's subject
matter experts concluded at the end of March 2016 that the expanded
version of MCAS also met all applicable requirements, and did not
create any heightened risks beyond the earlier design.
Among other conditions tested during the MAX development process,
Boeing considered uncommanded MCAS operation resulting in unintended
nose down trim to the maximum stabilizer authority for both the earlier
and expanded MCAS designs. In March 2016, based on new simulator
testing, Boeing experts assessed this condition as a ``Minor'' hazard
when uncommanded operation of MCAS occurred at low speed in the normal
flight envelope. This was a lower classification category than had been
assessed for the uncommanded operation scenario for the earlier MCAS
design, which had been active only in high speed, high G-force
conditions. Based on this testing and analysis performed during the
lengthy MCAS development process, Boeing's technical experts determined
that the hazard classification categories for both the high-speed and
expanded MCAS functionality satisfied all applicable regulatory and
certification requirements.
As authorized by applicable FAA guidance, including FAA Advisory
Circular 25-7C (``Flight Test Guide for Certification of Transport
Category Airplanes''), in conducting their hazard assessments, Boeing's
subject matter experts made a series of assumptions about how a flight
crew would react if MCAS failed or did not function as intended. This
was the case for their hazard assessments of both the earlier and
expanded MCAS designs. Consistent with established FAA guidance, this
included the assumption that the crew would recognize and address
uncommanded activation through normal use of the control column and the
electric trim switches, and that the crew would also be able to use the
stabilizer cutout switches and rely on manual trimming (as outlined in
the Runaway Stabilizer Non-Normal Procedure) to stop any unintended
stabilizer motion. Test pilots participated in the simulator testing of
expanded MCAS and had vital input into the hazard analysis.
Question 6. Boeing has stated that it assumed that pilots would
react a specific way to repeated, unexpected nose down stabilizer trim
inputs due to MCAS activation. Can you describe what assumption Boeing
made in terms of how pilots would react and what actions they would
take in response to repeated, unexpected nose down stabilizer trim
inputs? What was the basis for this assumption?
Answer. As authorized by applicable FAA guidance including FAA
Advisory Circular 25-7C, in conducting their hazard assessments,
Boeing's subject matter experts made a series of assumptions about how
a flight crew would react if MCAS failed or did not function as
intended. Consistent with established FAA guidance, this included the
assumption that the crew would recognize and address uncommanded
activation through normal use of the control column and electric trim
switches, and that the crew would also be able to use the stabilizer
cutout switches (as outlined in the Runaway Stabilizer Non-Normal
Procedure) to stop any unintended stabilizer motion.
Question 7. In January 2019, Boeing recommended Level A differences
training (pilot training) accompany introduction of the MCAS updates.
Please describe on what basis Boeing made this recommendation.
Answer. In the wake of the Lion Air accident, Boeing and the FAA
have carefully scrutinized the level and content of appropriate
training for MAX pilots. Prior to the grounding of the MAX fleet on
March 13, 2019, following the Ethiopian Airlines flight 302 accident,
the FAA did not impose any additional training requirements for flight
crews operating the existing MAX fleet, which still had the original,
certified version of MCAS installed. The FAA and Boeing each
independently deemed the issuance of the OMB and AD, combined with the
existing training curriculum, sufficient to enable the safe operation
of the fleet pending the implementation of updated flight control
computer software, which Boeing began developing immediately after the
Lion Air accident.
Simultaneous with the development of that software update, Boeing
and the FAA assessed potential additional training requirements for
pilots who would operate MAX airplanes with the updated software, as is
typical for such a design change. Boeing began working closely with the
FAA starting in December 2018 to develop this training plan and
associated evaluation testing.
Responding to the FAA's request for a training proposal, Boeing in
January 2019 initially recommended Level A differences training for the
MCAS updates. Boeing noted in support of this recommendation that the
``difference between the 737 NG and 737 MAX relating to the MCAS flight
control law do[es] not affect pilot knowledge, skills, abilities, or
flight safety.'' No specific differences training is required under the
applicable regulatory guidance when this standard is met. Boeing
nonetheless was proposing Level A training in response to ``customers'
continued interest in the MCAS flight control law.'' Boeing also
proposed a plan to substantiate the training proposal for the FAA,
including the use of flight simulators to demonstrate various flight
scenarios involving the updated MCAS functionality.
Boeing worked expeditiously to complete its evaluation and approval
plan, submitting the final plan to the FAA on February 11. The FAA
accepted the plan, and agreed to Boeing's proposed date for simulator
testing of March 13. The FAA expressed willingness ``to evaluate
Boeing's proposal for Level A training,'' but also advised that the
evaluation ``is proceeding at risk,'' meaning that the FAA could
ultimately determine based on the evaluation results to require a
higher level of training.
The simulator testing took place as planned on March 13, using a
test procedure agreed upon with the FAA. Representatives from the FAA--
as well as the European Union Aviation Safety Agency and Transport
Canada--participated in the testing.
The next day, March 14, the FAA sent Boeing its pilot training
evaluation for the updated MCAS. The FAA noted that the Flight
Standardization Board (``FSB'') for the MAX had determined that ``no
pilot handling differences exist between the B-737 NG series and B-737
MAX aircraft in normal and non-normal operation of MCAS.'' In the FAA's
evaluation, ``[t]he NG and MAX aircraft handled the same and no
aircraft device training is necessary.'' Nonetheless, the FAA
explained, ``[t]he FSB determined that Level B training and checking is
required to ensure pilot knowledge and retention of MCAS for initial,
transition, upgrade, and recurrent [training].'' After describing the
exhaustive test scenarios performed during the evaluation process, the
letter concluded that ``level B training is provisionally approved''
pending certification of the MCAS updates.
In accordance with the FSB's determination, Boeing provided the FAA
a computer-based Level B training module for evaluation. The FAA FSB
evaluated and tested this module on March 18, and the following day the
FAA wrote to Boeing that the module ``satisfies the Level B training
and checking requirement.'' On March 25, the FAA sent Boeing further
written confirmation that ``[v]alidation of level B [computer-based]
training met all knowledge, skills, and abilities required to fly the
MAX.'' And on April 16, the FAA posted a draft FSB report for public
comment, in which the FAA described the FSB's ``evaluation of the
modified [MCAS] for training and checking differences determination,''
and stated that ``[t]he MCAS system was found to be operationally
suitable.'' That draft report has not been finalized.
Boeing's discussions with the FAA about pilot training for the MCAS
updates have continued since the FAA's posting of the FSB's draft
report in April. Boeing is committed to continuing to work with the FAA
to ensure that pilots receive appropriate training to accompany the
MCAS updates in connection with the MAX's return to service.
Question 8. Earlier this year, it was discovered that in 2017
Boeing learned that the AOA DISAGREE alert on the 737 MAX was not
operable on all airplanes. What steps did Boeing take upon making this
discovery? Did Boeing immediately inform the FAA and its customers? If
not, why not?
Answer. In 2017, within several months after beginning 737 MAX
deliveries, engineers at Boeing identified that the 737 MAX display
system software delivered by Boeing's supplier did not correctly meet
the requirements relating to the AOA DISAGREE alert. Instead of
activating the AOA DISAGREE alert on all MAX airplanes, as Boeing's
requirements provided, the software activated the alert only if an
airline selected the optional AOA indicator. When Boeing's engineers
identified the discrepancy between the requirements and the software,
Boeing followed its standard process for determining the appropriate
resolution of such issues. That review, which involved multiple company
subject matter experts, determined that the absence of the AOA DISAGREE
alert did not adversely impact the safety, operation, or certification
of the airplane. Accordingly, the review concluded, the existing
functionality was acceptable until the alert and the indicator could be
delinked in the next planned display system software update, scheduled
for 2020.
Shortly after the Lion Air Flight 610 accident on October 29, 2018,
both Boeing and the FAA informed MAX operators that the AOA DISAGREE
alert was available only if the AOA indicator option had been
installed. In the discussions that followed, Boeing fulfilled several
customer requests to implement the AOA indicator, and by extension the
AOA DISAGREE alert, on their airplanes. Boeing also discussed the
status of the AOA DISAGREE alert extensively with the FAA--including
the software discrepancy identified in 2017 and Boeing's determination
that the issue was not safety related. In close coordination with the
FAA, Boeing convened a Safety Review Board in December 2018, which
confirmed the prior determination that the absence of the AOA DISAGREE
alert from certain 737 MAX flight displays did not present a safety
issue. Boeing fully informed the FAA about this result and the
underlying analysis. The FAA subsequently informed Boeing that it had
convened a Corrective Action Review Board and reached the same
conclusion that the AOA DISAGREE alert issue did not present an unsafe
condition.
Boeing determined shortly after the Lion Air accident to accelerate
the AOA DISAGREE alert software update, and began the required software
development. MAX customers were informed of this plan beginning in
November 2018. As a result of these software development efforts, when
the MAX returns to service, all MAX airplanes will have an activated
and operable AOA DISAGREE alert.
Questions from Hon. Brian Babin for Mr. Muilenburg
Question 1. Would it be fair to say that you didn't inform pilots
about MCAS because when there is an emergency in the cockpit, you want
them to respond to the problem versus diagnose the problem? For
instance, like when I am driving my car, and it's veering off the side
of the road, I don't sit there and think, what is causing this, my
first thought is to steer the car back into the lane. Is that a fair
comparison?
Answer. In accordance with FAA regulatory guidance, flight training
for all Boeing airplanes, including the 737 MAX, is designed to give
pilots the knowledge, skills, and abilities necessary to safely operate
each model on which they are licensed (or ``type-rated''). This is not
necessarily the same information that would be needed to diagnose
particular types of failures, as the accepted training philosophy is to
equip pilots to address the particular non-normal condition at issue,
not diagnose the underlying cause of the failure. The priority in
developing the pilot training curriculum is always on giving pilots the
knowledge they need to safely fly the airplane.
Question 2. How do other manufacturers from other countries certify
their planes? Do they have something similar to delegation?
Answer. Delegation is common in aviation systems throughout the
world, though each regulatory authority handles delegation differently.
For instance, the European Aviation Safety Agency also uses a system of
delegation.
Question 3. This committee clearly has a lot of concern about how
Boeing prioritizes its safety versus its desire to make a profit and
increase its stock price. Boeing has talked a lot recently about the
recommendations that its board made, in what I see as an attempt to
respond to that criticism and concern. On a day-to-day basis, how will
those changes really lead to Boeing making safer airplanes?
Answer. First and foremost, the changes Boeing has made will
reinforce Boeing's safety culture. The Product and Services Safety
organization will review all aspects of product safety, across the
enterprise, ensuring that an independent organization within the
company is responsible for reviewing safety concerns and allegations of
undue pressure. It also enhances the presence of dedicated, safety-
related leadership and accountability within Boeing's corporate
structure. Moreover, by realigning the engineering function so that
each engineer reports to the Chief Engineer, we have ensured that all
engineers report to technical staff. Finally, we are expanding our
safety promotion center to disseminate safety-related information
throughout Boeing's global workforce.
In addition, Boeing is also re-examining flight deck design and
operation assumptions, in coordination with the regulators, our
commercial and defense customers, and other stakeholders. Pilot
training and experience can vary across operators in a rapidly growing
global aviation industry that faces pilot shortages in many regions,
and new technologies have also caused design assumptions to evolve.
Boeing will work with its partners to anticipate the needs of future
pilot populations. That review will help us design flight deck
interfaces that reflect the needs of the thousands of additional pilots
needed in the coming decades.
Questions from Hon. Jenniffer Gonzalez-Colon for Mr. Muilenburg
Question 1. Mr. Muilenburg, given your statements on the values of
Boeing including safety, quality, and integrity, why did it take so
long for Boeing to alert the Federal Aviation Administration about
internal concerns regarding the 737 MAX?
Answer. Safety, quality, and integrity are at the core of Boeing's
values. Boeing offers its employees a number of channels for raising
concerns and complaints and has a rigorous process in place to ensure
such complaints receive thorough consideration. If, after review,
Boeing identifies a safety issue with a product or program, the issue
is promptly reported to the FAA.
Question 2. What steps has Boeing taken to change its internal
culture to ensure that safety, quality, and integrity are put again at
the forefront of focus at the company?
Answer. After the 737 MAX grounding, Boeing initiated a review by a
special board committee. That committee recommended several changes to
our organization and processes, several of which will further enhance
Boeing's strong safety culture. These changes include:
(1) Creating a permanent Aerospace Safety Committee within our
Board of Directors to oversee and ensure safe design, development,
manufacture, maintenance, and delivery of our products and services;
(2) Creating a Product and Services Safety organization to review
all aspects of product safety;
(3) Realigning the Engineering function within the company, so
that engineers across Boeing will report directly to the Chief
Engineer;
(4) Establishing a design requirements program to further
facilitate the incorporation of historical design materials, data and
information, best practices, lessons learned, and detailed after action
reports to reinforce Boeing's commitment to continuous improvement;
(5) Enhancing our Continued Operational Safety Program to aid
transparency and visibility of safety related issues; the Continued
Operational Safety Program now will require the Chief Engineer's review
of all safety and potential safety reports;
(6) To anticipate the needs of future pilot populations, re-
examining assumptions about flight deck design and operation in
partnership with our airline customers and industry members;
(7) Expanding our Safety Promotion Center for employees to learn
and reflect on our safety culture and renew personal commitments to
safety;
(8) Expanding our anonymous safety reporting system to strengthen
safety management systems within Boeing and our supply chain;
(9) Investing in new capabilities, including enhanced flight
simulation and computing, and advanced R&D for future flight decks, as
well as pilot and maintenance technician training and STEM education.